IPFW IP options: can IPFW match against header length?

R

rowan194

Hi everyone.

I'm reasonably confident that my upstreams block packets that contain (some, or all) IP options, and FreeBSD already denies source routing by default, however, the recent Linux MSTCP CVE has made me examine local blocking more closely.

It appears that IPFW can only block 4 specific IP options, rather than just "any" IP options being present.

Is there some way for IPFW to block on IP header length > 20 instead?

Thanks.
 
You must log in or register to reply here.
Back
Top