PF support for IPv6 Extension Headers

[Kristof Provost]

(From a very quick look at the code)

On 2015-06-10 20:57:02 (-0300), Fernando Gont <fernando at gont.com.ar> wrote:
> What's the level f support of PF wrt IPv6 Extension Headers?
> 
It's pretty limited. 

There's code for a few specific header types (fragment, routing, AH,
hopopts and dstopts) but nothing generic. That means that none of the
things you described (filtering per EH type, EH size or number of EHs)
are supported.

> pf.conf(5) talks about an implicit block rule for packets employing the
> routing header, ...
> 
That appears to be only for the type 0 routing header. Packets with RH0
are always dropped, but other routing headers are left unmolested.

See https://www.ietf.org/rfc/rfc5095.txt .

Regards,
Kristof