Re: [v6ops] Limiting the size of the IPv6 header chain (draft-ietf-6man-oversized-header-chain)

[Nick Hilliard <[e-mail]>]

On 11/06/2013 16:17, Randy Bush wrote:
>> 2008?   RH0?   
>> Dudes, have we not moved beyond this?
> 
> Jun 10 15:03:54 psg kernel: IPFW2: IPV6 - Unknown Extension Header(64), ext_hd=0
> 
> welcome to the operational internet

I had a look at the ipfw2 code yesterday.  In fact it handles extension
headers in the kernel code, but I have no idea how you might configure this
from userland because it sure as hell ain't documented.  Best wishes to
anyone who can figure this out.  Please document it somewhere if you figure it.

EHs are supported on OpenBSD PF, but not on the version that ships with
freebsd.  The configuration mechanism for this is fine.

linux iptables supports EHs, and is as easy to configure from the command
line as any other iptables command (that is not a compliment, btw).

Cisco ASA also supports extension headers and only allows frag and HBH by
default - everything else is dropped.

Despite the documentation on the cisco web site, I eventually figured out
how to change this behaviour.  Apparently, you need to configure up a
policy map of type "inspect ipv6", then hook that into whatever service
inspection profile you're using for that traffic.  In other words, this
forces packets with EHs to run through the PIXOS inspection engine which is
lulzerrifically slow, and can be used as a simple denial of service mechanism.

I didn't look at anything else because this all made me a sad bunny and I
had real work to do.

Nick