The system must prevent local applications from generating source-routed packets.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-48213	SOL-11.1-050370	SV-61085r1_rule		Low

Description
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2016-06-29

Details

Check Text ( C-50645r1_chk )
The IP Filter Management profile is required. Check the system for an IPF rule blocking outgoing source-routed packets. # ipfstat -o Examine the list for rules such as: block out log quick all with opt lsrr block out log quick all with opt ssrr If the listed rules do not block both lsrr and ssrr options, this is a finding.

Fix Text (F-51821r1_fix)
The root role is required. # pfedit /etc/ipf/ipf.conf Add rules to block outgoing source-routed packets, such as: block out log quick all with opt lsrr block out log quick all with opt ssrr Reload the IPF rules. # ipf -Fa -A -f /etc/ipf/ipf.conf