"accept_source_route" enabled by default in 24.04

[Michael Quiniola]

Case 384821 - https://canonical.lightning.force.com/lightning/r/Case/500N100000BS4C3IAL/view

Customer reported in 24.04 Noble that accept_source_route options in sysctl.conf are enabled by default. 22.04 Jammy ships with a 50-sysctl.conf file which disables this by default. Previous releases ship with 99-sysctl.conf, but the line disabling this feature is commented out.

In discussion on Mattermost (~Foundations, https://chat.canonical.com/canonical/pl/ytc1iyp6ai875pij3h7bzmeqoa) it was agreed that this option should be disabled by default and likely violates STIG.

[Marc Deslauriers (mdeslaur)]

I assume you mean noble? (24.04 is noble)

My noble VM has it disabled by default:

root@sec-noble-amd64:~# more /proc/sys/net/ipv4/conf/all/accept_source_route
0

Are you seeing it enabled in a fresh noble install?

[Michael Quiniola (qthepirate)]

Yes I did mean noble, I corrected my typo.

It is enabled by default in a fresh install:

net.ipv4.conf.default.accept_source_route = 1
net.ipv4.conf.eno1.accept_source_route = 1
net.ipv4.conf.lo.accept_source_route = 1

[Marc Deslauriers (mdeslaur)]

What's the output of sysctl net.ipv4.conf.all.accept_source_route ?

[Marc Deslauriers (mdeslaur)]

per the documentation, "conf/all/accept_source_route must also be set to TRUE to accept packets":

https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

[Marc Deslauriers (mdeslaur)]

Also, my default install of jammy has the lines commented out as well in 99-sysctl.conf, and the default value is 0:

# sysctl net.ipv4.conf.all.accept_source_route
net.ipv4.conf.all.accept_source_route = 0

[Marc Deslauriers (mdeslaur)]

So, the "all" value is disabled by default on all releases, which means it's turned off by default.

The "default" value is forcible turned off also on jammy because we shipped the /usr/lib/sysctl.d/50-default.conf file by mistake, while on other releases, the "default" value is on.

Since the "all" value is turned off by default on all releases, and overrides the interface specific values, I don't see a security issue here.