upvote
Again, in practice the packets with _any_ IPv6 extension headers are unusable when traversing the public Internet: https://blog.apnic.net/2022/10/13/ipv6-extension-headers-rev...

The issue is that the extension headers can be used for nefarious purposes, such as hop-by-hop routing. So your fast hardware-based border routers might be EH-agnostic and transmit packets to your core network. And then a helpful Linux box that implements all of IPv6 in software would reflect the traffic right past your firewall.

Implementing the EHs in hardware is expensive, as you need to do conditional checks. So routers just drop them.

reply