From 82012a2c80e0f0bed75586b7d93570db2121962e Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Mon, 1 Aug 2022 17:50:37 +0200

Subject: [PATCH 1/2] Add rule for sysctl net.ipv4.conf.all.forwarding

This is rule is similar to sysctl_net_ipv6_conf_all_forwarding and

sysctl_net_ipv4_forward.

---

 .../rule.yml                                  | 44 +++++++++++++++++++

 ...ctl_net_ipv4_conf_all_forwarding_value.var | 17 +++++++

 shared/references/cce-redhat-avail.txt        |  1 -

 3 files changed, 61 insertions(+), 1 deletion(-)

 create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml

 create mode 100644 linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var

diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml

new file mode 100644

index 00000000000..7b0066f7c29

--- /dev/null

+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding/rule.yml

@@ -0,0 +1,44 @@

+documentation_complete: true

+

+prodtype: rhel8

+

+title: 'Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces'

+

+description: '{{{ describe_sysctl_option_value(sysctl="net.ipv4.conf.all.forwarding", value="0") }}}'

+

+rationale: |-

+    IP forwarding permits the kernel to forward packets from one network

+    interface to another. The ability to forward packets between two networks is

+    only appropriate for systems acting as routers.

+

+severity: medium

+

+identifiers:

+    cce@rhel8: CCE-86220-1

+

+references:

+    disa: CCI-000366

+    nist: CM-6(b)

+    srg: SRG-OS-000480-GPOS-00227

+    stigid@rhel8: RHEL-08-040259

+

+ocil_clause: 'IP forwarding value is "1" and the system is not router'

+

+ocil: |-

+    {{{ ocil_sysctl_option_value(sysctl="net.ipv4.conf.all.forwarding", value="0") }}}

+    The ability to forward packets is only appropriate for routers.

+

+fixtext: |-

+    Configure {{{ full_name }}} to not allow packet forwarding unless the system is a router with the following commands:

+    {{{ fixtext_sysctl(sysctl="net.ipv4.conf.all.forwarding", value="0") | indent(4) }}}

+

+srg_requirement: '{{{ full_name }}} must not perform packet forwarding unless the system is a router.'

+

+platform: machine

+

+template:

+    name: sysctl

+    vars:

+        sysctlvar: net.ipv4.conf.all.forwarding

+        datatype: int

+

diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var

new file mode 100644

index 00000000000..2aedd6e6432

--- /dev/null

+++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_forwarding_value.var

@@ -0,0 +1,17 @@

+documentation_complete: true

+

+title: net.ipv4.conf.all.forwarding

+

+description: 'Toggle IPv4 Forwarding'

+

+type: number

+

+operator: equals

+

+interactive: false

+

+options:

+    default: "0"

+    disabled: "0"

+    enabled: 1

+

diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt

index 914233f06bf..3e14b73dd71 100644

--- a/shared/references/cce-redhat-avail.txt

+++ b/shared/references/cce-redhat-avail.txt

@@ -168,7 +168,6 @@ CCE-86216-9

 CCE-86217-7

 CCE-86218-5

 CCE-86219-3

-CCE-86220-1

 CCE-86221-9

 CCE-86222-7

 CCE-86223-5

From 0e2be2dfb7c185ac15e69e110c2e7a76f6896df7 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Mon, 1 Aug 2022 17:53:32 +0200

Subject: [PATCH 2/2] Better align with RHEL-08-040259

The item is about net.ipv4.conf.all.forwarding

The update to V1R7 made brought this misalignment to light.

---

 .../sysctl_net_ipv4_ip_forward/rule.yml                       | 1 -

 products/rhel8/profiles/stig.profile                          | 2 +-

 tests/data/profile_stability/rhel8/stig.profile               | 4 ++--

 tests/data/profile_stability/rhel8/stig_gui.profile           | 2 +-

 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml

index 5c449db7f3a..7acfc0b05b6 100644

--- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml

+++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml

@@ -45,7 +45,6 @@ references:

     stigid@ol7: OL07-00-040740

     stigid@ol8: OL08-00-040260

     stigid@rhel7: RHEL-07-040740

-    stigid@rhel8: RHEL-08-040259

     stigid@sle12: SLES-12-030430

     stigid@sle15: SLES-15-040380

diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile

index 4b480bd2c11..6b44436a2b1 100644

--- a/products/rhel8/profiles/stig.profile

+++ b/products/rhel8/profiles/stig.profile

@@ -1127,7 +1127,7 @@ selections:

     - sysctl_net_ipv6_conf_default_accept_source_route

     # RHEL-08-040259

-    - sysctl_net_ipv4_ip_forward

+    - sysctl_net_ipv4_conf_all_forwarding

     # RHEL-08-040260

     - sysctl_net_ipv6_conf_all_forwarding

diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile

index 4bee72830d0..47f53a9d023 100644

--- a/tests/data/profile_stability/rhel8/stig.profile

+++ b/tests/data/profile_stability/rhel8/stig.profile

@@ -1,7 +1,7 @@

 title: DISA STIG for Red Hat Enterprise Linux 8

 description: 'This profile contains configuration checks that align to the

-    DISA STIG for Red Hat Enterprise Linux 8 V1R7

+    DISA STIG for Red Hat Enterprise Linux 8 V1R7.

     In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes

@@ -395,13 +395,13 @@ selections:

 - sysctl_net_core_bpf_jit_harden

 - sysctl_net_ipv4_conf_all_accept_redirects

 - sysctl_net_ipv4_conf_all_accept_source_route

+- sysctl_net_ipv4_conf_all_forwarding

 - sysctl_net_ipv4_conf_all_rp_filter

 - sysctl_net_ipv4_conf_all_send_redirects

 - sysctl_net_ipv4_conf_default_accept_redirects

 - sysctl_net_ipv4_conf_default_accept_source_route

 - sysctl_net_ipv4_conf_default_send_redirects

 - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

-- sysctl_net_ipv4_ip_forward

 - sysctl_net_ipv6_conf_all_accept_ra

 - sysctl_net_ipv6_conf_all_accept_redirects

 - sysctl_net_ipv6_conf_all_accept_source_route

diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile

index ece32d06a6f..c4e60ddcde5 100644

--- a/tests/data/profile_stability/rhel8/stig_gui.profile

+++ b/tests/data/profile_stability/rhel8/stig_gui.profile

@@ -405,13 +405,13 @@ selections:

 - sysctl_net_core_bpf_jit_harden

 - sysctl_net_ipv4_conf_all_accept_redirects

 - sysctl_net_ipv4_conf_all_accept_source_route

+- sysctl_net_ipv4_conf_all_forwarding

 - sysctl_net_ipv4_conf_all_rp_filter

 - sysctl_net_ipv4_conf_all_send_redirects

 - sysctl_net_ipv4_conf_default_accept_redirects

 - sysctl_net_ipv4_conf_default_accept_source_route

 - sysctl_net_ipv4_conf_default_send_redirects

 - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

-- sysctl_net_ipv4_ip_forward

 - sysctl_net_ipv6_conf_all_accept_ra

 - sysctl_net_ipv6_conf_all_accept_redirects

 - sysctl_net_ipv6_conf_all_accept_source_route