From e6440cb867e07780b4e6eeac1d0b33644dd57a20 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Tue, 24 Dec 2024 17:28:10 +0100
Subject: [PATCH] Firewall: Automation: Filter - add allowopts for
 https://github.com/opnsense/core/issues/8143

---
 .../OPNsense/Firewall/forms/dialogFilterRule.xml           | 7 +++++++
 src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml   | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogFilterRule.xml b/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogFilterRule.xml
index 90f55638eb..9ceb276c15 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogFilterRule.xml
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogFilterRule.xml
@@ -55,6 +55,13 @@
             When a rule does not have quick enabled, the last matching rule wins.
         </help>
     </field>
+    <field>
+        <id>rule.allowopts</id>
+        <label>Allow options</label>
+        <type>checkbox</type>
+        <help>This allows packets with IP options to pass. Otherwise they are blocked by default.</help>
+        <advanced>true</advanced>
+    </field>
     <field>
         <id>rule.interfacenot</id>
         <label>Interface / Invert</label>
diff --git a/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml b/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
index 75e2274e5e..cc6350bd37 100644
--- a/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+++ b/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
@@ -131,6 +131,10 @@
                     <Default>0</Default>
                     <Required>Y</Required>
                 </log>
+                <allowopts type="BooleanField">
+                    <Default>0</Default>
+                    <Required>Y</Required>
+                </allowopts>
                 <nosync type="BooleanField">
                     <Default>0</Default>
                     <Required>Y</Required>