From 82012a2c80e0f0bed75586b7d93570db2121962e Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Mon, 1 Aug 2022 17:50:37 +0200 Subject: [PATCH 1/2] Add rule for sysctl net.ipv4.conf.all.forwarding This is rule is similar to sysctl_net_ipv6_conf_all_forwarding and sysctl_net_ipv4_forward. --- .../rule.yml | 44 +++++++++++++++++++ ...ctl_net_ipv4_conf_all_forwarding_value.var | 17 +++++++ shared/references/cce-redhat-avail.txt | 1 - 3 files changed, 61 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml new file mode 100644 index 00000000000..7b0066f7c29 --- /dev/null +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml @@ -0,0 +1,44 @@ +documentation_complete: true + +prodtype: rhel8 + +title: 'Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces' + +description: '{{{ describe_sysctl_option_value(sysctl="net.ipv4.conf.all.forwarding", value="0") }}}' + +rationale: |- + IP forwarding permits the kernel to forward packets from one network + interface to another. The ability to forward packets between two networks is + only appropriate for systems acting as routers. + +severity: medium + +identifiers: + cce@rhel8: CCE-86220-1 + +references: + disa: CCI-000366 + nist: CM-6(b) + srg: SRG-OS-000480-GPOS-00227 + stigid@rhel8: RHEL-08-040259 + +ocil_clause: 'IP forwarding value is "1" and the system is not router' + +ocil: |- + {{{ ocil_sysctl_option_value(sysctl="net.ipv4.conf.all.forwarding", value="0") }}} + The ability to forward packets is only appropriate for routers. + +fixtext: |- + Configure {{{ full_name }}} to not allow packet forwarding unless the system is a router with the following commands: + {{{ fixtext_sysctl(sysctl="net.ipv4.conf.all.forwarding", value="0") | indent(4) }}} + +srg_requirement: '{{{ full_name }}} must not perform packet forwarding unless the system is a router.' + +platform: machine + +template: + name: sysctl + vars: + sysctlvar: net.ipv4.conf.all.forwarding + datatype: int + diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var new file mode 100644 index 00000000000..2aedd6e6432 --- /dev/null +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var @@ -0,0 +1,17 @@ +documentation_complete: true + +title: net.ipv4.conf.all.forwarding + +description: 'Toggle IPv4 Forwarding' + +type: number + +operator: equals + +interactive: false + +options: + default: "0" + disabled: "0" + enabled: 1 + diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 914233f06bf..3e14b73dd71 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -168,7 +168,6 @@ CCE-86216-9 CCE-86217-7 CCE-86218-5 CCE-86219-3 -CCE-86220-1 CCE-86221-9 CCE-86222-7 CCE-86223-5 From 0e2be2dfb7c185ac15e69e110c2e7a76f6896df7 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Mon, 1 Aug 2022 17:53:32 +0200 Subject: [PATCH 2/2] Better align with RHEL-08-040259 The item is about net.ipv4.conf.all.forwarding The update to V1R7 made brought this misalignment to light. --- .../sysctl_net_ipv4_ip_forward/rule.yml | 1 - products/rhel8/profiles/stig.profile | 2 +- tests/data/profile_stability/rhel8/stig.profile | 4 ++-- tests/data/profile_stability/rhel8/stig_gui.profile | 2 +- 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml index 5c449db7f3a..7acfc0b05b6 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml @@ -45,7 +45,6 @@ references: stigid@ol7: OL07-00-040740 stigid@ol8: OL08-00-040260 stigid@rhel7: RHEL-07-040740 - stigid@rhel8: RHEL-08-040259 stigid@sle12: SLES-12-030430 stigid@sle15: SLES-15-040380 diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile index 4b480bd2c11..6b44436a2b1 100644 --- a/products/rhel8/profiles/stig.profile +++ b/products/rhel8/profiles/stig.profile @@ -1127,7 +1127,7 @@ selections: - sysctl_net_ipv6_conf_default_accept_source_route # RHEL-08-040259 - - sysctl_net_ipv4_ip_forward + - sysctl_net_ipv4_conf_all_forwarding # RHEL-08-040260 - sysctl_net_ipv6_conf_all_forwarding diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile index 4bee72830d0..47f53a9d023 100644 --- a/tests/data/profile_stability/rhel8/stig.profile +++ b/tests/data/profile_stability/rhel8/stig.profile @@ -1,7 +1,7 @@ title: DISA STIG for Red Hat Enterprise Linux 8 description: 'This profile contains configuration checks that align to the - DISA STIG for Red Hat Enterprise Linux 8 V1R7 + DISA STIG for Red Hat Enterprise Linux 8 V1R7. In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes @@ -395,13 +395,13 @@ selections: - sysctl_net_core_bpf_jit_harden - sysctl_net_ipv4_conf_all_accept_redirects - sysctl_net_ipv4_conf_all_accept_source_route +- sysctl_net_ipv4_conf_all_forwarding - sysctl_net_ipv4_conf_all_rp_filter - sysctl_net_ipv4_conf_all_send_redirects - sysctl_net_ipv4_conf_default_accept_redirects - sysctl_net_ipv4_conf_default_accept_source_route - sysctl_net_ipv4_conf_default_send_redirects - sysctl_net_ipv4_icmp_echo_ignore_broadcasts -- sysctl_net_ipv4_ip_forward - sysctl_net_ipv6_conf_all_accept_ra - sysctl_net_ipv6_conf_all_accept_redirects - sysctl_net_ipv6_conf_all_accept_source_route diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile index ece32d06a6f..c4e60ddcde5 100644 --- a/tests/data/profile_stability/rhel8/stig_gui.profile +++ b/tests/data/profile_stability/rhel8/stig_gui.profile @@ -405,13 +405,13 @@ selections: - sysctl_net_core_bpf_jit_harden - sysctl_net_ipv4_conf_all_accept_redirects - sysctl_net_ipv4_conf_all_accept_source_route +- sysctl_net_ipv4_conf_all_forwarding - sysctl_net_ipv4_conf_all_rp_filter - sysctl_net_ipv4_conf_all_send_redirects - sysctl_net_ipv4_conf_default_accept_redirects - sysctl_net_ipv4_conf_default_accept_source_route - sysctl_net_ipv4_conf_default_send_redirects - sysctl_net_ipv4_icmp_echo_ignore_broadcasts -- sysctl_net_ipv4_ip_forward - sysctl_net_ipv6_conf_all_accept_ra - sysctl_net_ipv6_conf_all_accept_redirects - sysctl_net_ipv6_conf_all_accept_source_route