# Ensure source routed packets are not accepted

Necessity: Source routing is a mechanism that allows the sender of a packet to specify the path it should take through the network, overriding the routing decisions of network devices. Attackers can exploit this feature to bypass firewalls, conduct IP spoofing, or perform man-in-the-middle attacks. Disabling the acceptance of source-routed packets is a critical security measure to prevent these network-based attacks. Misconfiguration leaves the system vulnerable to network traffic manipulation and reconnaissance.

Auditing and Remediation: The audit script verifies the live kernel configuration by checking the values of `net.ipv4.conf.all.accept_source_route` and `net.ipv4.conf.default.accept_source_route`. A value of '0' indicates the setting is secure. The remediation script disables this functionality by setting both parameters to '0' using the `sysctl` command and writes this configuration to a file in `/etc/sysctl.d/` to ensure the setting is persistent across system reboots.

Recommended State Rationale: 
- Basic: ['0'] - The setting is disabled. This is the minimum acceptable security standard as there are almost no legitimate modern use cases for source routing, and the risks are significant.
- Moderate: ['0'] - Same as Basic. There is no middle ground for this configuration; it should be disabled to maintain a moderate security posture.
- Strict: ['0'] - The most secure and universally recommended state is to have source packet routing disabled. This aligns with CIS Benchmarks and other security hardening standards, completely mitigating the associated risks without impacting normal network operations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the values of the `net.ipv4.conf.all.accept_source_route` and `net.ipv4.conf.default.accept_source_route` kernel parameters. The script should output '0' if both parameters are set to 0, and '1' otherwise. The output must not contain any extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state for source routed packet acceptance (e.g., '0' for disabled). The script must set both `net.ipv4.conf.all.accept_source_route` and `net.ipv4.conf.default.accept_source_route` kernel parameters to this value using `sysctl`. It must also ensure the setting persists across reboots by creating or updating a configuration file in `/etc/sysctl.d/`. The script must output `true` on success and `false` on failure.

