Re: arp_hash

[Herbert Xu <herbert@gondor.apana.org.au>]

On Sun, Mar 22, 2015 at 07:53:15PM -0400, David Miller wrote:
>
> We want no reference counting of the neighbour entries, that's one of
> the main points of all this.
> 
> That way packets getting stuck do not run into the classic
> dreaded "Neighbour table overflow", remember that?

Right.

> THAT is what is attackable when people have /8 subnets and
> someone just spam pings every host on that subnet.
> 
> That is a more serious exposure than this hashing issue.
> 
> At least with ref-less use, as we have now, we could trim hash chains
> that get too large with almost no barriers whatsoever because nearly
> every neigh entry has no external references outside of these demux
> sequences.

Yes if we trim the buckets to keep the chain length under a limit
it should be good enough I think.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt