+m4_divert(82)m4_dnl
+###--------------------------------------------------------------------------
+### Check for source routing.
+
+clearchain check-srcroute
+
+run iptables -A check-srcroute -g forbidden \
+ -m ipv4options --any --flags lsrr,ssrr
+run ip6tables -A check-srcroute -g forbidden \
+ -m rt
+
+for c in INPUT FORWARD; do
+ for m in $from_scary $from_untrusted; do
+ run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute
+ done
+done
+