compliance: Update the cis compliance scripts
Changes:
- Remove the script that disables ip forwarding.
Because it is not part of the CIS Benchmark
- Add missing ipv4 ICMP settings
BUG=b/199792965
TEST=locally tested
RELEASE_NOTE=None
Change-Id: Ib9573ee5a0e53b9c3eb5aff1021b61692d09b9cb
diff --git a/alphabet-compliance/scripts/3110-disable-ip-forwarding.sh b/alphabet-compliance/scripts/3110-disable-ip-forwarding.sh
deleted file mode 100644
index c89a9b5..0000000
--- a/alphabet-compliance/scripts/3110-disable-ip-forwarding.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-# Copyright 2021 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-## Section 3.1.1 Ensure IP forwarding is disabled ##
-sysctl -w net.ipv4.ip_forward=0
-sysctl -w net.ipv6.conf.all.forwarding=0
-sysctl -w net.ipv4.route.flush=1
-sysctl -w net.ipv6.route.flush=1
diff --git a/alphabet-compliance/scripts/3220-ensure-ICMP-redirects-not-accepted.sh b/alphabet-compliance/scripts/3220-ensure-ICMP-redirects-not-accepted.sh
index d6ef92c..72c6dfc 100644
--- a/alphabet-compliance/scripts/3220-ensure-ICMP-redirects-not-accepted.sh
+++ b/alphabet-compliance/scripts/3220-ensure-ICMP-redirects-not-accepted.sh
@@ -14,6 +14,9 @@
# limitations under the License.
## Section: 3.2.2 Ensure ICMP redirects are not accepted ##
+sysctl -w net.ipv4.conf.all.accept_redirects=0
+sysctl -w net.ipv4.conf.default.accept_redirects=0
+sysctl -w net.ipv4.route.flush=1
sysctl -w net.ipv6.conf.all.accept_redirects=0
sysctl -w net.ipv6.conf.default.accept_redirects=0
sysctl -w net.ipv6.route.flush=1
