Re: [PATCH V1 net 04/11] net: ena: fix incorrect default RSS key

[Jakub Kicinski <kuba@kernel.org>]

On Wed, 29 Jan 2020 14:04:15 +0000, Sameeh Jubran wrote:
> From: Arthur Kiyanovski <akiyano@amazon.com>
> 
> Bug description:
> When running "ethtool -x <if_name>" the key shows up as all zeros.
> 
> When we use "ethtool -X <if_name> hfunc toeplitz hkey <some:random:key>" to
> set the key and then try to retrieve it using "ethtool -x <if_name>" then
> we return the correct key because we return the one we saved.
> 
> Bug cause:
> We don't fetch the key from the device but instead return the key
> that we have saved internally which is by default set to zero upon
> allocation.
> 
> Fix:
> This commit fixes the issue by initializing the key to the default key that
> is used by the device.
> 
> Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
> Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
> Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>

So is the device actually using that key by default?

Hard coding a default RSS key makes it trivial for DDoS attackers 
to target specific queues, doesn't it?

Please follow the best practice of initializing your key with
netdev_rss_key_fill() and configuring the device with it at startup.

> diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
> index e54c44fdc..769339043 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_com.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_com.c
> @@ -64,6 +64,15 @@
>  
>  #define ENA_POLL_MS	5
>  
> +/* Default Microsoft RSS key, used for HRSS. */
> +static const u8 rss_hash_key[ENA_HASH_KEY_SIZE] = {
> +		0x6d, 0x5a, 0x56, 0xda, 0x25, 0x5b, 0x0e, 0xc2,
> +		0x41, 0x67, 0x25, 0x3d, 0x43, 0xa3, 0x8f, 0xb0,
> +		0xd0, 0xca, 0x2b, 0xcb, 0xae, 0x7b, 0x30, 0xb4,
> +		0x77, 0xcb, 0x2d, 0xa3, 0x80, 0x30, 0xf2, 0x0c,
> +		0x6a, 0x42, 0xb7, 0x3b, 0xbe, 0xac, 0x01, 0xfa

You also have an extra tab here for no reason.

> +};
> +
>  /*****************************************************************************/
>  /*****************************************************************************/
>  /*****************************************************************************/