PF support for IPv6 Extension Headers
kp at FreeBSD.org
Thu Jun 11 13:50:02 UTC 2015
(From a very quick look at the code)
On 2015-06-10 20:57:02 (-0300), Fernando Gont <fernando at gont.com.ar> wrote:
> What's the level f support of PF wrt IPv6 Extension Headers?
It's pretty limited.
There's code for a few specific header types (fragment, routing, AH,
hopopts and dstopts) but nothing generic. That means that none of the
things you described (filtering per EH type, EH size or number of EHs)
> pf.conf(5) talks about an implicit block rule for packets employing the
> routing header, ...
That appears to be only for the type 0 routing header. Packets with RH0
are always dropped, but other routing headers are left unmolested.
See https://www.ietf.org/rfc/rfc5095.txt .
More information about the freebsd-net