Disable the System from Responding to ICMP Broadcast Packets

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130347");
  script_version("2025-11-21T05:40:28+0000");
  script_tag(name:"last_modification", value:"2025-11-21 05:40:28 +0000 (Fri, 21 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-05-07 11:44:20 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Disable the System from Responding to ICMP Broadcast Packets");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_eulerosvirtual_openeuler_hce");

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.6 Disable the System from Responding to ICMP Broadcast Packets (Requirement)");
  script_xref(name:"Policy", value:"EulerOS Virtual: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.6 Disable the System from Responding to ICMP Broadcast Packets (Requirement)");
  script_xref(name:"Policy", value:"HCE Linux (Huawei Cloud EulerOS): openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.6 Disable the System from Responding to ICMP Broadcast Packets (Requirement)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.6 Disable the System from Responding to ICMP Broadcast Packets (Requirement)");

  script_tag(name:"summary", value:"Internet Control Message Protocol (ICMP) transmits query
packets and error packets. You can configure a policy of not receiving ICMP broadcast packets to
defend against ICMP packet attacks.

This parameter determines whether a device needs to respond to the ICMP echo messages and timestamp
requests. The destination address of these messages and requests is the broadcast address. No
matter which device sends a packet, the packet is sent to each device on the network. If the source
address is forged, all devices on the network may send malicious echo packets to the victim (device
with the forged source address).");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

title = "Disable the System from Responding to ICMP Broadcast Packets";

solution = "Run the following command to disable the system from responding to ICMP broadcast
packets:

# sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

Open the /etc/sysctl.conf file and add or modify the following configuration:

net.ipv4.icmp_echo_ignore_broadcasts=1";

check_type = "SSH_Cmd";

action = '1. Run the command in the terminal:
# sysctl net.ipv4.icmp_echo_ignore_broadcasts

2. Run the command in the terminal:
# grep -h "net.ipv4.icmp_echo_ignore_broadcasts" /etc/sysctl.conf /etc/sysctl.d/*';

expected_value = '1. The output should be equal to "net.ipv4.icmp_echo_ignore_broadcasts = 1"
2. The output should match the pattern "net.ipv4.icmp_echo_ignore_broadcasts=1\\s*net.ipv4.icmp_echo_ignore_broadcasts=1"';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

overall_pass = FALSE;
actual_value = "";

# ------------------------------------------------------------------
# CHECK 1 :  Verify command `sysctl net.ipv4.icmp_echo_ignore_broadcasts`
# ------------------------------------------------------------------

step_cmd_check_1 = 'sysctl net.ipv4.icmp_echo_ignore_broadcasts';
step_res_check_1 = ssh_cmd(socket:sock, cmd:step_cmd_check_1, return_errors:TRUE, return_linux_errors_only:TRUE);
actual_value += '1. ' + step_res_check_1 + '\n';
check_result_1 = FALSE;

if(step_res_check_1 == 'net.ipv4.icmp_echo_ignore_broadcasts = 1'){
  check_result_1 = TRUE;
}

# ------------------------------------------------------------------
# CHECK 2 :  Verify command `grep -h "net.ipv4.icmp_echo_ignore_broadcasts" /etc/sysctl.conf /etc/sysctl.d/*`
# ------------------------------------------------------------------

step_cmd_check_2 = 'grep -h "net.ipv4.icmp_echo_ignore_broadcasts" /etc/sysctl.conf /etc/sysctl.d/*';
step_res_check_2 = ssh_cmd(socket:sock, cmd:step_cmd_check_2, return_errors:TRUE, return_linux_errors_only:TRUE);
actual_value += '2. ' + step_res_check_2 + '\n';
check_result_2 = FALSE;

if(step_res_check_2 =~ 'net.ipv4.icmp_echo_ignore_broadcasts=1\\s*net.ipv4.icmp_echo_ignore_broadcasts=1'){
  check_result_2 = TRUE;
}

# ------------------------------------------------------------------
# FINAL RESULT
# ------------------------------------------------------------------

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the some audit check. Please try again.";
}
else if(check_result_1 && check_result_2){
  compliant = "yes";
  comment = "All checks passed";
}else{
  compliant = "no";
  comment = "One or more checks failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);