On Fri, Jan 9, 2026 at 11:50 AM Jakub Kicinski [off-list ref] wrote:

On Thu,  8 Jan 2026 09:14:52 -0800 Tom Herbert wrote:

quoted

This patchset set changes the interpretation of the Destination Options
and Hop-by-Hop Options sysctl limits, net.ipv6.max_dst_opts_number and
net.ipv6.max_dst_opts_number to mean that when the sysctl is zero
processing of the associated extension header is disabled such that
packets received with the extension header are dropped.

Hi Tom!

Unfortunately, this breaks GRE:
https://netdev.bots.linux.dev/contest.html?pw-n=0&branch=net-next-2026-01-09--18-00&pw-n=0&pass=0

Jakub,

There's a hidden Destination Option used by GREv6 in
IPV6_TLV_TNL_ENCAP_LIMIT (not defined with the other TLVs and not
processed in the main TLV loop). So probably can't disable Destination
options by default. I'll respin the patch set to restrict EH as much
as possible to avoid DoS.

Tom