Re: [PATCH net v2] ipv6: Implement limits on extension header parsing

[Daniel Borkmann <daniel@iogearbox.net>]

On 4/27/26 8:01 AM, Ido Schimmel wrote:
> On Sun, Apr 26, 2026 at 05:47:38PM +0200, Justin Iurman wrote:
>> Ido, Daniel,
>>
>> As I said, my vote would definitely go to the solution without a sysctl for
>> the very reason Ido mentioned. Note that an upper bound of 32 is kind of
>> unrealistic, although super (SUPER!) safe. Sending more than 8 Extension
>> Headers (assuming a different type for each) is not standard behavior and
>> would make you non-RFC-compliant anyway. But I'm happy with 32, as long as
>> we don't define a sysctl for that.
> 
> OK, so given that:
> 
> 1. 32 is super safe and solves the issue.
> 
> 2. We will likely have to maintain a sysctl forever.
> 
> 3. A sysctl has the potential to be incompatible with the upcoming
> "enforce_ext_hdr_order" sysctl.
> 
> I believe we can just go with the simplest solution of hard coding 32 as
> a limit and drop the sysctl.

Although to be honest, I like it slightly better if we could actually constrain
it to just 8 by default rather than 32 given 32 is just an arbitrary 'large enough'
pick vs 8 something sensible derived from the RFC and the sysctl knob is not out
of place. Eric, what's your pref?

Thanks,
Daniel