The system must prevent local applications from generating source-routed packets.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-48213	SOL-11.1-050370	SV-61085r3_rule		Low

Description
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2017-03-02

Details

Check Text ( C-50645r3_chk )
The IP Filter Management profile is required. Check the system for an IPF rule blocking outgoing source-routed packets. # ipfstat -o Examine the list for rules such as: block out log quick from any to any with opt lsrr block out log quick from any to any with opt ssrr If the listed rules do not block both lsrr and ssrr options, this is a finding.

Fix Text (F-51821r3_fix)
The root role is required. # pfedit /etc/ipf/ipf.conf Add rules to block outgoing source-routed packets, such as: block out log quick all with opt lsrr block out log quick all with opt ssrr Reload the IPF rules. # ipf -Fa -A -f /etc/ipf/ipf.conf