SV-204630r991589: The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets. | Red Hat Enterprise Linux 7 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.

Description

Discussion Text

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-72319SV-86943

References

DPMS Target Red Hat Enterprise Linux 7 DISA DPMS Target Red Hat Enterprise Linux 7 2899

Checks

OVAL

oval:mil.disa.stig.rhel7:var:3785 ← xccdf_mil.disa.stig_value_sysctl_net_ipv6_conf_all_accept_source_route_value

DISA STIG (Manual Reference)

If IPv6 is not enabled, the key will not exist, and this is Not Applicable.

Verify the system does not accept IPv6 source-routed packets.

     # grep -r net.ipv6.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
     net.ipv6.conf.all.accept_source_route = 0

If "net.ipv6.conf.all.accept_source_route" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of "0", this is a finding.

Check that the operating system implements the accept source route variable with the following command:

     # /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route
     net.ipv6.conf.all.accept_source_route = 0

If the returned lines do not have a value of "0", this is a finding.

If conflicting results are returned, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:303
# The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test) -- kernel grub.cfg ipv6.disable set to 1: no extractor for field "subexpression"
#   - textfilecontent54_object (textfilecontent54_test) -- kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in at least one of the acceptable sysctl directories: <set> composition (base object oval:mil.disa.stig.rhel7:obj:2308, oval:mil.disa.stig.rhel7:obj:20463001): member unresolved -- no extractor for field "subexpression"

# kernel /proc/cmdline ipv6.disable set to 1
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '\bipv6\.disable=1\b' '/proc/cmdline' &>/dev/null
}
# kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in any acceptable directory
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  grep -Pq '^[\s]*net\.ipv6\.conf\.all\.disable_ipv6[\s]*=[\s]*1[\s]*$' '/etc/sysctl.conf' &>/dev/null
}
# kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
# sysctl_object (sysctl_test)
test_4() {
  [ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6)" -eq 1 ]
}
# kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value
# sysctl_object (sysctl_test)
test_6() {
  [ "$(cat /proc/sys/net/ipv6/conf/all/accept_source_route)" -eq 0 ]
}

if ( test_1 || ( test_3 && test_4 ) || test_6 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel7:def:303
if [ ! -f "/proc/cmdline" ] || [ ! -f "/boot/grub2/grub.cfg" ] || ! grep -qE 'ipv6\.disable=1' /proc/cmdline || ! grep -qE '^[^#]*\\bipv6\\.disable=1\\b' /boot/grub2/grub.cfg ]; then
    if [ ! -f "/etc/sysctl.conf" ] || ! grep -qE '^[\\s]*net\\.ipv6\\.conf\\.all\\.disable_ipv6[\\s]*=[\\s]*1[\\s]*$' /etc/sysctl.conf ]; then
        if [ ! -x "$(command -v sysctl)" ]; then
            echo "FAIL"
            exit 1
        fi
        if ! sysctl -q -n -a | grep -qE 'net\\.ipv6\\.conf\\.all\\.disable_ipv6 = 1'; then
            echo "FAIL"
            exit 1
        fi
    fi
fi
if [ ! -f "/etc/sysctl.d/" ]; then
    if ! grep -qE 'net\\.ipv6\\.conf\\.all\\.accept_source_route = 0' /etc/sysctl.conf; then
        echo "FAIL"
        exit 1
    fi
else
    for file in /etc/sysctl.d/*; do
        if [ -r "$file" ]; then
            if ! grep -qE 'net\\.ipv6\\.conf\\.all\\.accept_source_route = 0' "$file"; then
                echo "FAIL"
                exit 1
            fi
        fi
    done
fi
echo "PASS"
exit 0

Remediation

Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):

     net.ipv6.conf.all.accept_source_route = 0

Issue the following command to make the changes take effect:

     # sysctl --system