From 4bc0961efb594c92b282c214bc975bc06fa323e2 Mon Sep 17 00:00:00 2001
From: Chris Buechler <cmb@pfsense.org>
Date: Sun, 5 Apr 2009 22:00:39 -0400
Subject: [PATCH] Block all IPv6 traffic by default, since IPv6 isn't
 supported, there isn't any way to add such rules in the GUI, and nearly all
 users won't want IPv6 to traverse their firewall at this point. Add "Allow
 IPv6" checkbox to disable this behavior.

---
 etc/inc/filter.inc                |  9 +++++++++
 usr/local/www/system_advanced.php | 25 +++++++++++++++++++++++--
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 3a4e304e31..b018bb317b 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -2189,6 +2189,15 @@ table <snort2c> persist
 block quick from <snort2c> to any label "Block snort2c hosts"
 block quick from any to <snort2c> label "Block snort2c hosts"
 
+EOD;
+
+        if(!isset($config['system']['ipv6allow'])) {
+                $ipfrules .= "# Block all IPv6\n";
+                $ipfrules .= "block in quick inet6 all\n";
+                $ipfrules .= "block out quick inet6 all\n";
+        }
+
+        $ipfrules .= <<<EOD
 # loopback
 anchor "loopback"
 pass in quick on \$loopback all label "pass loopback"
diff --git a/usr/local/www/system_advanced.php b/usr/local/www/system_advanced.php
index 8e0cdd75a8..0c2eed8f7a 100755
--- a/usr/local/www/system_advanced.php
+++ b/usr/local/www/system_advanced.php
@@ -38,6 +38,7 @@ $pconfig['rfc959workaround'] = $config['system']['rfc959workaround'];
 $pconfig['scrubnodf'] = $config['system']['scrubnodf'];
 $pconfig['ipv6nat_enable'] = isset($config['diag']['ipv6nat']['enable']);
 $pconfig['ipv6nat_ipaddr'] = $config['diag']['ipv6nat']['ipaddr'];
+$pconfig['ipv6allow'] = isset($config['system']['ipv6allow']);
 $pconfig['cert'] = base64_decode($config['system']['webgui']['certificate']);
 $pconfig['key'] = base64_decode($config['system']['webgui']['private-key']);
 $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
@@ -175,6 +176,11 @@ if ($_POST) {
 			unset($config['diag']['ipv6nat']['enable']);
 			unset($config['diag']['ipv6nat']['ipaddr']);
 		}
+		if($_POST['ipv6allow'] == "yes") {
+			$config['system']['ipv6allow'] = true;
+		} else {
+			unset($config['system']['ipv6allow']);
+		}                
 		$oldcert = $config['system']['webgui']['certificate'];
 		$oldkey = $config['system']['webgui']['private-key'];
 		$config['system']['webgui']['certificate'] = base64_encode($_POST['cert']);
@@ -367,10 +373,19 @@ include("head.inc");
 			<td colspan="2" class="list" height="12">&nbsp;</td>
 		</tr>
 		<tr>
-			<td colspan="2" valign="top" class="listtopic">IPv6 tunneling</td>
+			<td colspan="2" valign="top" class="listtopic">IPv6</td>
+		</tr>
+       		<tr>
+			<td width="22%" valign="top" class="vncell">Allow IPv6</td>
+			<td width="78%" class="vtable">
+				<input name="ipv6allow" type="checkbox" id="ipv6allow" value="yes" <?php if ($pconfig['ipv6allow']) echo "checked"; ?> onclick="enable_change(false)" />
+				<strong>Allow IPv6 traffic</strong>
+				<br /> <br />
+				All IPv6 traffic will be blocked unless this box is checked.
+			</td>
 		</tr>
 		<tr>
-			<td width="22%" valign="top" class="vncell">&nbsp;</td>
+			<td width="22%" valign="top" class="vncell">IPv6 tunneling</td>
 			<td width="78%" class="vtable">
 				<input name="ipv6nat_enable" type="checkbox" id="ipv6nat_enable" value="yes" <?php if ($pconfig['ipv6nat_enable']) echo "checked"; ?> onclick="enable_change(false)" />
 				<strong>NAT encapsulated IPv6 packets (IP protocol 41/RFC2893) to:</strong>
@@ -379,6 +394,12 @@ include("head.inc");
 				&nbsp;(IP address)
 			</td>
 		</tr>
+        	<tr>
+			<td width="22%" valign="top">&nbsp;</td>
+			<td width="78%">
+				<input name="Submit" type="submit" class="formbtn" value="Save" onclick="enable_change(true)" />
+			</td>
+		</tr>
 		<tr>
 			<td colspan="2" class="list" height="12">&nbsp;</td>
 		</tr>