V-38537: Ignore ICMPv4 bogus error messages

Implements: blueprint security-hardening

Change-Id: I203b74f711d7aafac2997fc19231931081834475

doc/source/developer-notes/V-38537.rst

@@ -0,0 +1,2 @@
+Ubuntu already ignores ICMPv4 bogus error messages by default. The role will
+ensure that this default setting is maintained.

openstack-ansible-security/tasks/kernel.yml

@@ -13,6 +13,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This is the default in Ubuntu 14.04
+- name: V-38537 - The system must ignore ICMPv4 bogus error responses
+  sysctl:
+    name: net.ipv4.icmp_ignore_bogus_error_responses
+    value: 1
+    state: present
+    sysctl_set: yes
+  tags:
+    - kernel
+    - cat3
+    - V-38537
+
 # This is the default in Ubuntu 14.04
 - name: V-38596 - Enable virtual address space randomization
   sysctl: