1. 15 Nov, 2019 3 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nf_flow_table_offload: add flow_action_entry_next() and use it · 4a766d49
      Pablo Neira Ayuso authored
      This function retrieves a spare action entry from the array of actions.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4a766d49
    • Arnd Bergmann's avatar
      netfilter: nft_meta: use 64-bit time arithmetic · 6408c40c
      Arnd Bergmann authored
      On 32-bit architectures, get_seconds() returns an unsigned 32-bit
      time value, which also matches the type used in the nft_meta
      code. This will not overflow in year 2038 as a time_t would, but
      it still suffers from the overflow problem later on in year 2106.
      
      Change this instance to use the time64_t type consistently
      and avoid the deprecated get_seconds().
      
      The nft_meta_weekday() calculation potentially gets a little slower
      on 32-bit architectures, but now it has the same behavior as on
      64-bit architectures and does not overflow.
      
      Fixes: 63d10e12 ("netfilter: nft_meta: support for time matching")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      6408c40c
    • Arnd Bergmann's avatar
      netfilter: xt_time: use time64_t · fcbad829
      Arnd Bergmann authored
      The current xt_time driver suffers from the y2038 overflow on 32-bit
      architectures, when the time of day calculations break.
      
      Also, on both 32-bit and 64-bit architectures, there is a problem with
      info->date_start/stop, which is part of the user ABI and overflows in
      in 2106.
      
      Fix the first issue by using time64_t and explicit calls to div_u64()
      and div_u64_rem(), and document the seconds issue.
      
      The explicit 64-bit division is unfortunately slower on 32-bit
      architectures, but doing it as unsigned lets us use the optimized
      division-through-multiplication path in most configurations.  This should
      be fine, as the code already does not allow any negative time of day
      values.
      
      Using u32 seconds values consistently would probably also work and
      be a little more efficient, but that doesn't feel right as it would
      propagate the y2106 overflow to more place rather than fewer.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      fcbad829
  2. 13 Nov, 2019 28 commits
  3. 12 Nov, 2019 9 commits