Update clocks in netstack during restore.

pkg/sentry/inet/inet.go

@@ -98,7 +98,7 @@ type Stack interface {
 	Resume()
 
 	// Restore restarts the network stack after restore.
-	Restore()
+	Restore(clock tcpip.Clock)
 
 	// ReplaceConfig replaces the new network stack configuration to the
 	// loaded or saved network stack after restore.

pkg/sentry/inet/test_stack.go

@@ -173,7 +173,7 @@ func (s *TestStack) NewRoute(ctx context.Context, msg *nlmsg.Message) *syserr.Er
 func (s *TestStack) Pause() {}
 
 // Restore implements Stack.
-func (s *TestStack) Restore() {}
+func (s *TestStack) Restore(_ tcpip.Clock) {}
 
 // ReplaceConfig implements Stack.
 func (s *TestStack) ReplaceConfig(_ Stack) {}

pkg/sentry/kernel/kernel.go

@@ -843,9 +843,9 @@ func (k *Kernel) LoadFrom(ctx context.Context, r, pagesMetadata io.Reader, pages
 		if net != nil {
 			s.ReplaceConfig(net)
 		}
-		s.Restore()
+		s.Restore(k.Timekeeper())
 	} else if net != nil {
-		net.Restore()
+		net.Restore(k.Timekeeper())
 	}
 
 	if err := k.vfs.CompleteRestore(ctx, vfsOpts); err != nil {

pkg/sentry/socket/hostinet/stack.go

@@ -396,7 +396,7 @@ func (*Stack) RemoveRoute(context.Context, *nlmsg.Message) *syserr.Error {
 func (*Stack) Pause() {}
 
 // Restore implements inet.Stack.Restore.
-func (*Stack) Restore() {}
+func (*Stack) Restore(_ tcpip.Clock) {}
 
 // ReplaceConfig implements inet.Stack.ReplaceConfig.
 func (s *Stack) ReplaceConfig(_ inet.Stack) {}

pkg/sentry/socket/netstack/stack.go

@@ -921,8 +921,8 @@ func (s *Stack) Pause() {
 }
 
 // Restore implements inet.Stack.Restore.
-func (s *Stack) Restore() {
-	s.Stack.Restore()
+func (s *Stack) Restore(clock tcpip.Clock) {
+	s.Stack.Restore(clock)
 }
 
 // ReplaceConfig implements inet.Stack.ReplaceConfig.

pkg/tcpip/stack/iptables.go

@@ -15,7 +15,6 @@
 package stack
 
 import (
-	"context"
 	"fmt"
 	"math/rand"
 	"reflect"
@@ -612,8 +611,10 @@ func (it *IPTables) beforeSave() {
 	it.connections.mu.Lock()
 }
 
-// afterLoad is invoked by stateify.
-func (it *IPTables) afterLoad(context.Context) {
+// Restore will initialize the variables in IPTables during restore.
+func (it *IPTables) Restore(rand *rand.Rand, clock tcpip.Clock) {
+	it.connections.rand = rand
+	it.connections.clock = clock
 	it.startReaper(reaperDelay)
 }
 

pkg/tcpip/stack/stack.go

@@ -1998,14 +1998,18 @@ func (s *Stack) ReplaceConfig(st *Stack) {
 
 // Restore restarts the stack after a restore. This must be called after the
 // entire system has been restored.
-func (s *Stack) Restore() {
+func (s *Stack) Restore(clock tcpip.Clock) {
 	// RestoredEndpoint.Restore() may call other methods on s, so we can't hold
 	// s.mu while restoring the endpoints.
 	s.mu.Lock()
+	s.clock = clock
+	s.tables.Restore(s.insecureRNG, s.clock)
+	s.icmpRateLimiter = NewICMPRateLimiter(s.clock)
 	eps := s.restoredEndpoints
 	s.restoredEndpoints = nil
 	saveRestoreEnabled := s.saveRestoreEnabled
 	s.mu.Unlock()
+
 	for _, e := range eps {
 		e.Restore(s)
 	}