netdev - Re: [PATCH net-next v2 0/4] ipv6: Disable IPv6 Destination Options RX processing by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALx6S36qzL2etxrTgEn5XurzvKfnPneAG25z5kebsbtVc7c9wQ@mail.gmail.com>
Date: Tue, 13 Jan 2026 11:54:26 -0800
From: Tom Herbert <tom@...bertland.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH net-next v2 0/4] ipv6: Disable IPv6 Destination Options RX
 processing by default

On Fri, Jan 9, 2026 at 11:50 AM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Thu,  8 Jan 2026 09:14:52 -0800 Tom Herbert wrote:
> > This patchset set changes the interpretation of the Destination Options
> > and Hop-by-Hop Options sysctl limits, net.ipv6.max_dst_opts_number and
> > net.ipv6.max_dst_opts_number to mean that when the sysctl is zero
> > processing of the associated extension header is disabled such that
> > packets received with the extension header are dropped.
>
> Hi Tom!
>
> Unfortunately, this breaks GRE:
> https://netdev.bots.linux.dev/contest.html?pw-n=0&branch=net-next-2026-01-09--18-00&pw-n=0&pass=0

Jakub,

There's a hidden Destination Option used by GREv6 in
IPV6_TLV_TNL_ENCAP_LIMIT (not defined with the other TLVs and not
processed in the main TLV loop). So probably can't disable Destination
options by default. I'll respin the patch set to restrict EH as much
as possible to avoid DoS.

Tom