filtering packets with unknown options

[Iljitsch van Beijnum <iljitsch@muada.com>]

After thinking about this a little more, it occurs to me that the  
correct behavior in cases where an unknown option is encountered and  
the security environment is such that this is deemed undesireable, is  
to drop the OPTION, not the packet.

This way, new stuff can be deployed without problems.

There is of course the tiny detail of how to implement this.  
Firewalls do a lot of processing so it's not completely outside the  
realm of possibility to assume that they could remove extension  
headers, but routers certainly aren't going to do this.

An alternative would be to set the contents of the option to all zero  
bits, this should be easier to implement than removing the header  
from the packet.

Thoughts?