Re: IPFILTER IPv6 support non-functional?

Date: 03/01/01

To: Darren Reed <>
Date: Thu, 01 Mar 2001 16:34:37 +0900

>> yup, that is what i saw in the latest. also ipf does not chase
>> extension headers, so even if you try to filter tcp, "tcp with
>> routing header" will go through. not sure how should we model filter
>> languages in presense of header chain.
>Aren't TCP, UDP and ICMP required to be the "last header" ? That is,
>they must be preceeded by routing headers, etc.

        that is what I was trying to mean.
        TCP/UDP/ICMP are the last header, routing headers are placed between
        IPv6 header and TCP headers.

        so a TCP packet with routing header will be like this:
                IPv6 routing TCP payload

        ip6_nxt is IPPROTO_ROUTING, and ip6e_nxt in routing header will be

        fil.c:fr_check() does not seem to skip these intermediate headers,
        so the above packet will pass "drop tcp packets" filter.


To Unsubscribe: send mail to
with "unsubscribe freebsd-security" in the body of the message