summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/journal/journal-verify.c17
1 files changed, 15 insertions, 2 deletions
diff --git a/src/journal/journal-verify.c b/src/journal/journal-verify.c
index cfd6d40932..8b71d03c34 100644
--- a/src/journal/journal-verify.c
+++ b/src/journal/journal-verify.c
@@ -646,7 +646,7 @@ static int journal_file_parse_verification_key(JournalFile *f, const char *key)
f->fsprg_seed = seed;
f->fsprg_seed_size = seed_size;
- f->fss_start_usec = start;
+ f->fss_start_usec = start * interval;
f->fss_interval_usec = interval;
return 0;
@@ -655,7 +655,7 @@ static int journal_file_parse_verification_key(JournalFile *f, const char *key)
int journal_file_verify(JournalFile *f, const char *key) {
int r;
Object *o;
- uint64_t p = 0, last_tag = 0, last_epoch = 0;
+ uint64_t p = 0, last_tag = 0, last_epoch = 0, last_tag_realtime = 0;
uint64_t entry_seqnum = 0, entry_monotonic = 0, entry_realtime = 0;
sd_id128_t entry_boot_id;
bool entry_seqnum_set = false, entry_monotonic_set = false, entry_realtime_set = false, found_main_entry_array = false;
@@ -753,6 +753,12 @@ int journal_file_verify(JournalFile *f, const char *key) {
if (r < 0)
goto fail;
+ if (last_tag_realtime > le64toh(o->entry.realtime)) {
+ log_error("Older entry after newer tag at %llu", (unsigned long long) p);
+ r = -EBADMSG;
+ goto fail;
+ }
+
if (!entry_seqnum_set &&
le64toh(o->entry.seqnum) != le64toh(f->header->head_entry_seqnum)) {
log_error("Head entry sequence number incorrect");
@@ -870,6 +876,13 @@ int journal_file_verify(JournalFile *f, const char *key) {
goto fail;
}
+ last_tag_realtime = (o->tag.epoch + 1) * f->fss_interval_usec + f->fss_start_usec;
+ if (entry_realtime_set && entry_realtime >= last_tag_realtime) {
+ log_error("Tag/entry realtime timestamp out of synchronization at %llu", (unsigned long long) p);
+ r = -EBADMSG;
+ goto fail;
+ }
+
/* OK, now we know the epoch. So let's now set
* it, and calculate the HMAC for everything
* since the last tag. */