[NET] netfilter : xt_time should not assume CONFIG_KTIME_SCALAR

[NET] netfilter : xt_time should not assume CONFIG_KTIME_SCALAR

[Eric Dumazet]

[-- Attachment #1: Type: text/plain, Size: 143 bytes --]

It is not correct to assume one can get nsec from a ktime directly by 
using .tv64 field.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>



[-- Attachment #2: xt_time.patch --]
[-- Type: text/plain, Size: 435 bytes --]

diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index ff44f86..f9c55dc 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -170,7 +170,7 @@ static bool xt_time_match(const struct sk_buff *skb,
 	if (skb->tstamp.tv64 == 0)
 		__net_timestamp((struct sk_buff *)skb);
 
-	stamp = skb->tstamp.tv64;
+	stamp = ktime_to_ns(skb->tstamp);
 	do_div(stamp, NSEC_PER_SEC);
 
 	if (info->flags & XT_TIME_LOCAL_TZ)

Re: [NET] netfilter : xt_time should not assume CONFIG_KTIME_SCALAR

[David Miller]

From: Eric Dumazet <dada1@cosmosbay.com>
Date: Tue, 13 Nov 2007 12:30:37 +0100

> It is not correct to assume one can get nsec from a ktime directly by 
> using .tv64 field.
> 
> Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>

Patrick, this is very clearly a correct bug fix, so I'm
going to apply this directly.

Applied, thanks Eric.

Re: [NET] netfilter : xt_time should not assume CONFIG_KTIME_SCALAR

[Patrick McHardy]

David Miller wrote:
> From: Eric Dumazet <dada1@cosmosbay.com>
> Date: Tue, 13 Nov 2007 12:30:37 +0100
> 
>> It is not correct to assume one can get nsec from a ktime directly by 
>> using .tv64 field.
>>
>> Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
> 
> Patrick, this is very clearly a correct bug fix, so I'm
> going to apply this directly.


Thanks, thats obviously correct. Still, I would prefer if
people would CC netfilter-devel and myself, it has become
a bad habit lately especially to skip netfilter-devel.

Re: [NET] netfilter : xt_time should not assume CONFIG_KTIME_SCALAR

[Eric Dumazet]

Patrick McHardy a écrit :
> David Miller wrote:
>> From: Eric Dumazet <dada1@cosmosbay.com>
>> Date: Tue, 13 Nov 2007 12:30:37 +0100
>>
>>> It is not correct to assume one can get nsec from a ktime directly 
>>> by using .tv64 field.
>>>
>>> Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
>>
>> Patrick, this is very clearly a correct bug fix, so I'm
>> going to apply this directly.
>
>
> Thanks, thats obviously correct. Still, I would prefer if
> people would CC netfilter-devel and myself, it has become
> a bad habit lately especially to skip netfilter-devel.
>
>
Sorry for forgeting netfilter-devel, I'll try to remember for next time...

Thank you

[NET] random : secure_tcp_sequence_number should not assume CONFIG_KTIME_SCALAR

[Eric Dumazet]

[-- Attachment #1: Type: text/plain, Size: 694 bytes --]

I discovered one other incorrect use of .tv64 (coming from me, I must 
confess)

I guess this patch is  needed for 2.6.24 and stable (2.6.22 & 2.6.23)

Thank you

[NET] random : secure_tcp_sequence_number should not assume 
CONFIG_KTIME_SCALAR

All 32 bits machines but i386 dont have CONFIG_KTIME_SCALAR. On these 
machines, ktime.tv64
is more than 4 times the (correct) result given by ktime_to_ns()

Again on these machines, using ktime_get_real().tv64 >> 6 give a 32bits 
rollover every 64 seconds,
which is not wanted (less than the 120 s MSL)

Using ktime_to_ns() is the portable way to get nsecs from a ktime, and 
have correct code.


Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>


[-- Attachment #2: random.patch --]
[-- Type: text/plain, Size: 1146 bytes --]

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1756b1f..5fee056 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1494,7 +1494,7 @@ __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
 	seq = twothirdsMD4Transform((const __u32 *)daddr, hash) & HASH_MASK;
 	seq += keyptr->count;
 
-	seq += ktime_get_real().tv64;
+	seq += ktime_to_ns(ktime_get_real());
 
 	return seq;
 }
@@ -1556,7 +1556,7 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
 	 *	overlaps less than one time per MSL (2 minutes).
 	 *	Choosing a clock of 64 ns period is OK. (period of 274 s)
 	 */
-	seq += ktime_get_real().tv64 >> 6;
+	seq += ktime_to_ns(ktime_get_real()) >> 6;
 #if 0
 	printk("init_seq(%lx, %lx, %d, %d) = %d\n",
 	       saddr, daddr, sport, dport, seq);
@@ -1616,7 +1616,7 @@ u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
 	seq = half_md4_transform(hash, keyptr->secret);
 	seq |= ((u64)keyptr->count) << (32 - HASH_BITS);
 
-	seq += ktime_get_real().tv64;
+	seq += ktime_to_ns(ktime_get_real());
 	seq &= (1ull << 48) - 1;
 #if 0
 	printk("dccp init_seq(%lx, %lx, %d, %d) = %d\n",

Re: [NET] netfilter : xt_time should not assume CONFIG_KTIME_SCALAR

[Patrick McHardy]

Eric Dumazet wrote:
> Patrick McHardy a écrit :
>> David Miller wrote:
>>>
>>> Patrick, this is very clearly a correct bug fix, so I'm
>>> going to apply this directly.
>>
>>
>> Thanks, thats obviously correct. Still, I would prefer if
>> people would CC netfilter-devel and myself, it has become
>> a bad habit lately especially to skip netfilter-devel.
>>
>>
> Sorry for forgeting netfilter-devel, I'll try to remember for next time...


Thanks Eric. I missed that I actually was CCed because greylisting
took a bit longer to let it through :)

Re: [NET] random : secure_tcp_sequence_number should not assume CONFIG_KTIME_SCALAR

[David Miller]

From: Eric Dumazet <dada1@cosmosbay.com>
Date: Tue, 13 Nov 2007 14:41:19 +0100

> I discovered one other incorrect use of .tv64 (coming from me, I must 
> confess)
> 
> I guess this patch is  needed for 2.6.24 and stable (2.6.22 & 2.6.23)
 ...
> [NET] random : secure_tcp_sequence_number should not assume 
> CONFIG_KTIME_SCALAR

Applied thanks Eric, I'll queue it up for -stable too.

Perhaps ktime_t->tv64 should be renamed to "->__tv64" or
similar to prevent future mistakes like this.  Only
the ktime implementation should be touching that thing.

Re: [stable] [NET] random : secure_tcp_sequence_number should not assume CONFIG_KTIME_SCALAR

[Greg KH]

On Tue, Nov 13, 2007 at 02:41:19PM +0100, Eric Dumazet wrote:
> I discovered one other incorrect use of .tv64 (coming from me, I must 
> confess)
>
> I guess this patch is  needed for 2.6.24 and stable (2.6.22 & 2.6.23)
>
> Thank you

Thanks for sending this to stable@, but David does a great job of
forwarding these to us, so I'll wait for him to relay it to us before
taking it into our tree.

thanks,

greg k-h