From 23a77d4973ec20b2aaab6a9c3a9fd8a98034923e Mon Sep 17 00:00:00 2001
From: Raja Grewal <rg_public@proton.me>
Date: Fri, 16 Aug 2024 12:46:51 +1000
Subject: [PATCH] Simplify syntax of some network-related `sysctl`'s

---
 usr/lib/sysctl.d/990-security-misc.conf | 30 +++++++++----------------
 1 file changed, 10 insertions(+), 20 deletions(-)

diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf
index 8e49235..f6b49f0 100644
--- a/usr/lib/sysctl.d/990-security-misc.conf
+++ b/usr/lib/sysctl.d/990-security-misc.conf
@@ -275,8 +275,7 @@ net.ipv4.tcp_rfc1337=1
 ## https://forums.whonix.org/t/enable-reverse-path-filtering/8594
 ## https://seclists.org/oss-sec/2019/q4/122
 ##
-net.ipv4.conf.all.rp_filter=1
-net.ipv4.conf.default.rp_filter=1
+net.ipv4.conf.*.rp_filter=1
 
 ## Disable ICMP redirect acceptance and redirect sending messages.
 ## Prevents man-in-the-middle attacks and minimizes information disclosure.
@@ -289,14 +288,10 @@ net.ipv4.conf.default.rp_filter=1
 ## https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked
 ## https://github.com/Kicksecure/security-misc/pull/248
 ##
-net.ipv4.conf.all.accept_redirects=0
-net.ipv4.conf.default.accept_redirects=0
-net.ipv4.conf.all.send_redirects=0
-net.ipv4.conf.default.send_redirects=0
-net.ipv6.conf.all.accept_redirects=0
-net.ipv6.conf.default.accept_redirects=0
-#net.ipv4.conf.all.secure_redirects=1
-#net.ipv4.conf.default.secure_redirects=1
+net.ipv4.conf.*.accept_redirects=0
+net.ipv4.conf.*.send_redirects=0
+net.ipv6.conf.*.accept_redirects=0
+#net.ipv4.conf.*.secure_redirects=1
 
 ## Ignore ICMP echo requests.
 ## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks.
@@ -316,15 +311,12 @@ net.ipv4.icmp_ignore_bogus_error_responses=1
 ##
 ## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing
 ##
-net.ipv4.conf.all.accept_source_route=0
-net.ipv4.conf.default.accept_source_route=0
-net.ipv6.conf.all.accept_source_route=0
-net.ipv6.conf.default.accept_source_route=0
+net.ipv4.conf.*.accept_source_route=0
+net.ipv6.conf.*.accept_source_route=0
 
 ## Do not accept IPv6 router advertisements and solicitations.
 ##
-net.ipv6.conf.all.accept_ra=0
-net.ipv6.conf.default.accept_ra=0
+net.ipv6.conf.*.accept_ra=0
 
 ## Disable SACK and DSACK.
 ## Select acknowledgements (SACKs) are a known common vector of exploitation.
@@ -362,8 +354,7 @@ net.ipv4.tcp_timestamps=0
 ##
 ## The logging of martian packets is currently disabled.
 ##
-#net.ipv4.conf.all.log_martians=1
-#net.ipv4.conf.default.log_martians=1
+#net.ipv4.conf.*.log_martians=1
 
 ## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses.
 ## The temporary/privacy address is used as the source for all outgoing traffic.
@@ -379,5 +370,4 @@ net.ipv4.tcp_timestamps=0
 ##
 ## The use of IPv6 Privacy Extensions is currently disabled due to these breakages.
 ##
-#net.ipv6.conf.all.use_tempaddr=2
-#net.ipv6.conf.default.use_tempaddr=2
+#net.ipv6.conf.*.use_tempaddr=2