From owner-freebsd-net@FreeBSD.ORG  Wed Jun 10 23:58:11 2015
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 75A645AC
 for <freebsd-net@freebsd.org>; Wed, 10 Jun 2015 23:58:11 +0000 (UTC)
 (envelope-from fernando@gont.com.ar)
Received: from web01.jbserver.net (web01.jbserver.net [IPv6:2a00:8240:6:a::1])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits)) (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 3FCBC1C00
 for <freebsd-net@freebsd.org>; Wed, 10 Jun 2015 23:58:10 +0000 (UTC)
 (envelope-from fernando@gont.com.ar)
Received: from cl-1071.udi-01.br.sixxs.net ([2001:1291:200:42e::2])
 by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128)
 (Exim 4.85) (envelope-from <fernando@gont.com.ar>)
 id 1Z2psk-0006Dy-8h; Thu, 11 Jun 2015 01:58:06 +0200
Message-ID: <5578CECE.2050703@gont.com.ar>
Date: Wed, 10 Jun 2015 20:57:02 -0300
From: Fernando Gont <fernando@gont.com.ar>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: FreeBSD Net <freebsd-net@freebsd.org>
Subject: PF support for IPv6 Extension Headers
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 10 Jun 2015 23:58:11 -0000

Folks,

What's the level f support of PF wrt IPv6 Extension Headers?

pf.conf(5) talks about an implicit block rule for packets employing the
routing header, but I've not been able to find anything about e.g.,

* Filtering packets on a per-EH-type-occurrence (e.g. "block packets
that contain a Destination Options Header")

* Filtering packets base on the EH size

* Filtering packets based on the number of EHs they contain (e.g., drop
the packet if it employs more than 5 EHs)

etc.

Thoughts?

Thanks!

Best regards,
-- 
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@si6networks.com
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1