Disable hashing by source IP in rt_hash_code

Hello netdev,

  I am using a Linux system as a border router in an ISP
environment (2x3GHz Xeon 2MB Cache, 4GB RAM, Intel Server
PCI-X 133MHz cards, E7520 chipset). Kernel is vanilla 2.6.17.10
rhash_entries and max_size are set to 2.500.000
Conntrack/netfilter are disabled. I don't use policy
routing, I only need routing by destination IP.

  Recently we've had severe DDoS attacks from outside our network (over 350 kpps)
with completely random source addresses and random
destinations within our prefix ranges.
When this happens, the route cache fills up instantly,
the receiving CPU is almost 100% busy with allocating/freeing
route cache entries and packet loss and delay jump through the roof.
  I think that if only the destination IP was used when
hashing the dst_entry, the cache size (for packets coming
into our network) would be limited only by the total
number of possible destinations (arount a /16 subnet).
This won't protect against random dst DoS from within our
network but this is less common and easily traceable.


  After a quick look through linux/net/ipv4/route.c
I thought of an easy (but possibly wrong) way to eliminate
the source address contribution to the hash result: zero the saddr
parameter when calling jhash_2words to hash a dst_entry.

static unsigned int rt_hash_code(u32 daddr, u32 saddr)
{
-        return (jhash_2words(daddr, saddr, rt_hash_rnd)
+        return (jhash_2words(daddr, 0, rt_hash_rnd)
                & rt_hash_mask);
}

My questions are:

1. What could the above change break in the routing code?
(policy routing is disabled)

2. Wouldn't a configure option to disable hashing dst_entries
by source IP be useful? I think it would eliminate a lot of
DoS attacks against the routing code, even for systems
which don't do routing.








-- 
Best regards,
 Calin                          mailto:vcalinus@gemenii.ro