Ansible and bash remediations for set_ipv6_loopback_traffic

linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/ansible/shared.yml

@@ -0,0 +1,30 @@
+# platform = multi_platform_sle
+
+- name: Check if IPv6 is enabled
+  command: sysctl -n net.ipv6.conf.all.disable_ipv6
+  register: ipv6_status
+  failed_when: ipv6_status.stdout != "0"
+
+- name: Allow incoming traffic on the loopback interface
+  ansible.builtin.iptables:
+    ipv6: yes
+    chain: INPUT
+    in_interface: lo
+    jump: ACCEPT
+  when: "{{ ipv6_status.stdout == '0' }}"
+
+- name: Allow outgoing traffic on the loopback interface
+  ansible.builtin.iptables:
+    ipv6: yes
+    chain: OUTPUT
+    out_interface: lo
+    jump: ACCEPT
+  when: "{{ ipv6_status.stdout == '0' }}"
+
+- name: Drop incoming traffic from the localhost
+  ansible.builtin.iptables:
+    ipv6: yes
+    chain: INPUT
+    source: "::1"
+    jump: DROP
+  when: "{{ ipv6_status.stdout == '0' }}"

linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/bash/shared.sh

@@ -1,5 +1,8 @@
 # platform = multi_platform_sle
 
-iptables -A INPUT -i lo -j ACCEPT
-iptables -A OUTPUT -o lo -j ACCEPT
-iptables -A INPUT -s 127.0.0.0/8 -j DROP
+if [ "$(sysctl -n net.ipv6.conf.all.disable_ipv6)" -eq 0 ]; then
+  # IPv6 is not disabled, so run the script
+  ip6tables -A INPUT -i lo -j ACCEPT
+  ip6tables -A OUTPUT -o lo -j ACCEPT
+  ip6tables -A INPUT -s ::1 -j DROP
+fi

linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/rule.yml

@@ -22,7 +22,7 @@ identifiers:
 
 references:
     cis@sle12: 3.5.3.1
-    cis@sle15: 3.5.3.2.2 
+    cis@sle15: 3.5.3.3.2 
     pcidss: Req-1.4.1
 
 warnings: