netdev - Re: [PATCH V1 net 04/11] net: ena: fix incorrect default RSS key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Jan 2020 08:03:11 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Sameeh Jubran <sameehj@...zon.com>
Cc:     <davem@...emloft.net>, <netdev@...r.kernel.org>,
        Arthur Kiyanovski <akiyano@...zon.com>, <dwmw@...zon.com>,
        <zorik@...zon.com>, <matua@...zon.com>, <saeedb@...zon.com>,
        <msw@...zon.com>, <aliguori@...zon.com>, <nafea@...zon.com>,
        <gtzalik@...zon.com>, <netanel@...zon.com>, <alisaidi@...zon.com>,
        <benh@...zon.com>, <ndagan@...zon.com>
Subject: Re: [PATCH V1 net 04/11] net: ena: fix incorrect default RSS key

On Wed, 29 Jan 2020 14:04:15 +0000, Sameeh Jubran wrote:
> From: Arthur Kiyanovski <akiyano@...zon.com>
> 
> Bug description:
> When running "ethtool -x <if_name>" the key shows up as all zeros.
> 
> When we use "ethtool -X <if_name> hfunc toeplitz hkey <some:random:key>" to
> set the key and then try to retrieve it using "ethtool -x <if_name>" then
> we return the correct key because we return the one we saved.
> 
> Bug cause:
> We don't fetch the key from the device but instead return the key
> that we have saved internally which is by default set to zero upon
> allocation.
> 
> Fix:
> This commit fixes the issue by initializing the key to the default key that
> is used by the device.
> 
> Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
> Signed-off-by: Sameeh Jubran <sameehj@...zon.com>
> Signed-off-by: Arthur Kiyanovski <akiyano@...zon.com>

So is the device actually using that key by default?

Hard coding a default RSS key makes it trivial for DDoS attackers 
to target specific queues, doesn't it?

Please follow the best practice of initializing your key with
netdev_rss_key_fill() and configuring the device with it at startup.

> diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
> index e54c44fdc..769339043 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_com.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_com.c
> @@ -64,6 +64,15 @@
>  
>  #define ENA_POLL_MS	5
>  
> +/* Default Microsoft RSS key, used for HRSS. */
> +static const u8 rss_hash_key[ENA_HASH_KEY_SIZE] = {
> +		0x6d, 0x5a, 0x56, 0xda, 0x25, 0x5b, 0x0e, 0xc2,
> +		0x41, 0x67, 0x25, 0x3d, 0x43, 0xa3, 0x8f, 0xb0,
> +		0xd0, 0xca, 0x2b, 0xcb, 0xae, 0x7b, 0x30, 0xb4,
> +		0x77, 0xcb, 0x2d, 0xa3, 0x80, 0x30, 0xf2, 0x0c,
> +		0x6a, 0x42, 0xb7, 0x3b, 0xbe, 0xac, 0x01, 0xfa

You also have an extra tab here for no reason.

> +};
> +
>  /*****************************************************************************/
>  /*****************************************************************************/
>  /*****************************************************************************/