# Ensure source routed packets are not accepted

Necessity: Source routing is a mechanism that allows the sender of a packet to specify the path it should take through the network. This feature is rarely used for legitimate purposes and can be exploited by attackers to bypass network security controls, such as firewalls, by dictating a path that avoids inspection. Disabling the acceptance of source-routed packets mitigates the risk of IP spoofing and other network-based attacks. An improperly configured system that accepts these packets is vulnerable to network reconnaissance and targeted attacks that can compromise system integrity. Auditing and Remediation: The audit script verifies the current runtime state of the `net.ipv4.conf.all.accept_source_route` and `net.ipv4.conf.default.accept_source_route` kernel parameters, ensuring they are disabled. The remediation script disables these settings in the live kernel configuration using `sysctl` and makes the change persistent across reboots by writing the configuration to a file in `/etc/sysctl.d/`. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '0' (disabled). There is no generally accepted use case for source routing on modern hosts, and enabling it introduces a significant security vulnerability. Therefore, security standards like the CIS Benchmarks universally recommend disabling it. As this is a binary security setting (either secure or insecure), the recommendation does not vary across different hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to query the value of the `net.ipv4.conf.all.accept_source_route` kernel parameter. The script must use `sysctl -n net.ipv4.conf.all.accept_source_route` and output only the numerical value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single numerical value as a command-line argument (`$1`). The script must set both `net.ipv4.conf.all.accept_source_route` and `net.ipv4.conf.default.accept_source_route` kernel parameters to this value. The change must be applied to the live configuration using `sysctl -w` and made persistent by adding or modifying the settings in a file such as `/etc/sysctl.d/99-security.conf`. The script must output `true` on success and `false` on failure.

