2.2.10. Disable Source Routing

Source routing is an Internet Protocol mechanism that allows an IP packet to carry information, a list of addresses, that tells a router the path the packet must take. There is also an option to record the hops as the route is traversed. The list of hops taken, the "route record", provides the destination with a return path to the source. This allows the source (the sending host) to specify the route, loosely or strictly, ignoring the routing tables of some or all of the routers. It can allow a user to redirect network traffic for malicious purposes. Therefore, source-based routing should be disabled.

The accept_source_route option causes network interfaces to accept packets with the Strict Source Route (SSR) or Loose Source Routing (LSR) option set. The acceptance of source routed packets is controlled by sysctl settings. Issue the following command as root to drop packets with the SSR or LSR option set:

~]# /sbin/sysctl -w net.ipv4.conf.all.accept_source_route=0

Disabling the forwarding of packets should also be done in conjunction with the above when possible (disabling forwarding may interfere with virtualization). Issue the commands listed below as root:

These commands disable forwarding of IPv4 and IPv6 packets on all interfaces.

~]# /sbin/sysctl -w net.ipv4.conf.all.forwarding=0

~]# /sbin/sysctl -w net.ipv6.conf.all.forwarding=0

These commands disable forwarding of all multicast packets on all interfaces.

~]# /sbin/sysctl -w net.ipv4.conf.all.mc_forwarding=0

~]# /sbin/sysctl -w net.ipv6.conf.all.mc_forwarding=0

Accepting ICMP redirects has few legitimate uses. Disable the acceptance and sending of ICMP redirected packets unless specifically required.

These commands disable acceptance of all ICMP redirected packets on all interfaces:

~]# /sbin/sysctl -w net.ipv4.conf.all.accept_redirects=0

~]# /sbin/sysctl -w net.ipv6.conf.all.accept_redirects=0

This command disables acceptance of secure ICMP redirected packets on all interfaces:

~]# /sbin/sysctl -w net.ipv4.conf.all.secure_redirects=0

This command disables sending of all IPv4 ICMP redirected packets on all interfaces:

~]# /sbin/sysctl -w net.ipv4.conf.all.send_redirects=0

~]# /sbin/sysctl -w net.ipv4.conf.default.send_redirects=0

There is only a directive to disable sending of IPv4 redirected packets. Refer to RFC4294 for an explanation of “IPv6 Node Requirements”, which resulted in this difference between IPv4 and IPv6.

In order to make the settings permanent they must be added to /etc/sysctl.conf.

See the sysctl(8) manual page for more information. Refer to RFC791 for an explanation of the Internet options related to source based routing and its variants.