<Group id="network-kernel">
<title>Kernel Parameters Which Affect Networking</title>
<description>The <tt>sysctl</tt> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.
</description>

<Group id="network_host_parameters">
<title>Network Parameters for Hosts Only</title>
<description>If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</description>

<Rule id="sysctl_net_ipv4_conf_send_redirects" severity="medium">
<title>Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.send_redirects" value="0" />
</ocil>
<rationale>Sending ICMP redirects permits the system to instruct other systems
to update their routing information.  The ability to send ICMP redirects is
only appropriate for systems acting as routers.</rationale>
<ident stig="GEN003610" />
<oval id="sysctl_net_ipv4_conf_send_redirects" />
<ref nist="ECSC-1" disa="1551" />
</Rule>

<Rule id="sysctl_net_ipv4_ip_forward" severity="medium">
<title>Disable Kernel Parameter for IP Forwarding</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.ip_forward" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.ip_forward" value="0" />
The ability to forward packets is only appropriate for routers.
</ocil>
<rationale>IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers.</rationale>
<ident stig="GEN005600" />
<oval id="sysctl_net_ipv4_ip_forward" />
<ref nist="ECSC-1" disa="366" />
</Rule>
</Group>

<Group id="network_host_and_router_parameters">
<title>Network Related Kernel Runtime Parameters for Hosts and Routers</title>
<description>Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</description>

<Value id="sysctl_net_ipv4_conf_all_accept_source_route_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.accept_source_route</title>
<description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Value id="sysctl_net_ipv4_conf_all_accept_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.accept_redirects</title>
<description>Disable ICMP Redirect Acceptance</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Value id="sysctl_net_ipv4_conf_all_secure_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.secure_redirects</title>
<description>Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table.</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Value id="sysctl_net_ipv4_conf_all_log_martians_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.log_martians</title>
<description>Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_accept_source_route_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.accept_source_route</title>
<description>Disable IP source routing?</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_accept_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.accept_redirects</title>
<description>Disable ICMP Redirect Acceptance?</description>
<value selector="">0</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_secure_redirects_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.secure_redirects</title>
<description>Log packets with impossible addresses to kernel
log?</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.icmp_echo_ignore_broadcasts</title>
<description>Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.icmp_ignore_bogus_error_responses</title>
<description>Enable to prevent unnecessary logging</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_tcp_syncookies_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.tcp_syncookies</title>
<description>Enable to turn on TCP SYN Cookie
Protection</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_tcp_max_syn_backlog_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.tcp_max_syn_backlog</title>
<description>Enable to turn on TCP SYN Cookie
Protection</description>
<value selector="">1280</value>
<value selector="recommended">1280</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_all_rp_filter_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.all.rp_filter</title>
<description>Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>


<Value id="sysctl_net_ipv4_conf_default_rp_filter_value" type="string"
operator="equals" interactive="0">
<title>net.ipv4.conf.default.rp_filter</title>
<description>Enables source route verification</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
</Value>

<Rule id="sysctl_net_ipv4_conf_accept_source_route" severity="medium">
<title>Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />
</ocil>
<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident stig="GEN003607" />
<oval id="sysctl_net_ipv4_conf_accept_source_route" value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
<ref nist="ECSC-1" disa="1551" />
</Rule>

<Rule id="sysctl_net_ipv4_conf_accept_redirects" severity="medium">
<title>Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_redirects" value="0" />
</ocil>
<rationale>Accepting ICMP redirects has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident stig="GEN003609" />
<oval id="sysctl_net_ipv4_conf_accept_redirects" value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
<ref nist="ECSC-1" disa="1503,1551" />
</Rule>

<Rule id="sysctl_net_ipv4_conf_log_martians">
<title>Enable Kernel Parameter to Log Martian Packets</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.conf.all.log_martians" value="1" />
</ocil>
<rationale>The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
<ident stig="GEN003611" />
<oval id="sysctl_net_ipv4_conf_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
<ref nist="ECAT-1" disa="126" />
</Rule>

<Rule id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts">
<title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts" value="1" />
</ocil>
<rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.
</rationale>
<ident stig="GEN003603" />
<oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
<ref nist="ECSC-1" disa="1551" />
</Rule>

<Rule id="sysctl_net_ipv4_tcp_syncookies" severity="medium">
<title>Enable Kernel Parameter to Use TCP Syncookies</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.tcp_syncookies" value="1" />
</ocil>
<rationale>A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.
</rationale>
<ident stig="GEN003612" />
<oval id="sysctl_net_ipv4_tcp_syncookies" value="sysctl_net_ipv4_tcp_syncookies_value" />
<ref nist="ECSC-1" disa="1092" />
</Rule>

<Rule id="sysctl_net_ipv4_tcp_max_syn_backlog" severity="medium">
<title>TCP backlog queue sizes must be set appropriately</title>
<description>
<sysctl-desc-macro sysctl="net.ipv4.max_syn_backlog" value="1280" />
</description>
<ocil>
<sysctl-check-macro sysctl="net.ipv4.max_syn_backlog" value="1280" />
</ocil>
<rationale>To provide some mitigation to TCP Denial of Service attacks, the TCP 
backlog queue sizes must be set to at least 1280 or in accordance with 
product-specific guidelines.
</rationale>
<ident stig="GEN003601" />
<oval id="sysctl_net_ipv4_tcp_max_syn_backlog" value="sysctl_net_ipv4_tcp_max_syn_backlog_value" />
<ref nist="ECSC-1" disa="" />
</Rule>
</Group>
</Group>
