Re: arp_hash

[David Miller <davem@davemloft.net>]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Mon, 23 Mar 2015 10:08:48 +1100

> On Sun, Mar 22, 2015 at 06:58:50PM -0400, David Miller wrote:
>>
>> But I do not agree with the idea that it is in any way possible to
>> stop someone with root access on the physical network from crudding up
>> our ARP hash tables.
> 
> But you don't need root access to exploit the neighbour hash
> table.  You just need a sufficiently large (e.g., /16) route
> to a network and anybody on the system can then generate traffic
> to it.
> 
> Granted these days hardly anybody on IPv4 would have such a route
> but if you do then the hash table makes you exposed.
> 
> And for IPv6 everybody is potentially exposed.

BTW I asked for feedback when I posted the patches which created this
situation, and the multiply with the random input was believed to have
sufficient entropy and not create a situation any worse,
asymptotically, than what we had beforehand.

Perhaps the ipv6 case can be improved, by using a u32 random input
for each u32 of the address being hashed.