[PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Ren Wei]

From: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>

When XT_TIME_CONTIGUOUS handles a cross-day daytime range, packets in
the post-midnight part of the range are matched against the previous
calendar day by subtracting SECONDS_PER_DAY from stamp.

On the first day after the epoch, this backdating can make the signed
time64_t stamp negative. localtime_2() and localtime_3() then feed the
value into unsigned division helpers and derive wrapped calendar fields.
In particular, monthday can become larger than the valid 1..31 range,
leading time_mt() to evaluate an out-of-range
1U << current_time.monthday shift.

The date_start/date_stop ABI is unsigned and cannot represent pre-epoch
calendar dates. If contiguous matching backdates stamp before the epoch,
only rules without weekday and monthday constraints can still be
evaluated safely; reject calendar-constrained rules before converting
the timestamp to calendar fields.

Fixes: 54eb3df3a7d0 ("netfilter: xt_time: add support to ignore day transition")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
 net/netfilter/xt_time.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 2065fce8ef81..014561a2ef3f 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -220,6 +220,15 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par)
 			stamp -= SECONDS_PER_DAY;
 	}
 
+	/*
+	 * The date_start/date_stop ABI cannot express pre-epoch timestamps.
+	 * If XT_TIME_CONTIGUOUS moves the packet into that range, only rules
+	 * without calendar constraints can still match.
+	 */
+	if (stamp < 0)
+		return info->weekdays_match == XT_TIME_ALL_WEEKDAYS &&
+		       info->monthdays_match == XT_TIME_ALL_MONTHDAYS;
+
 	localtime_2(&current_time, stamp);
 
 	if (!(info->weekdays_match & (1U << current_time.weekday)))
-- 
2.43.0

Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Phil Sutter]

On Fri, Jul 03, 2026 at 03:32:43PM +0800, Ren Wei wrote:
> From: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> 
> When XT_TIME_CONTIGUOUS handles a cross-day daytime range, packets in
> the post-midnight part of the range are matched against the previous
> calendar day by subtracting SECONDS_PER_DAY from stamp.
> 
> On the first day after the epoch, this backdating can make the signed
> time64_t stamp negative. localtime_2() and localtime_3() then feed the
> value into unsigned division helpers and derive wrapped calendar fields.
> In particular, monthday can become larger than the valid 1..31 range,
> leading time_mt() to evaluate an out-of-range
> 1U << current_time.monthday shift.
> 
> The date_start/date_stop ABI is unsigned and cannot represent pre-epoch
> calendar dates. If contiguous matching backdates stamp before the epoch,
> only rules without weekday and monthday constraints can still be
> evaluated safely; reject calendar-constrained rules before converting
> the timestamp to calendar fields.
> 
> Fixes: 54eb3df3a7d0 ("netfilter: xt_time: add support to ignore day transition")
> Cc: stable@vger.kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Xin Liu <dstsmallbird@foxmail.com>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> Reviewed-by: Ren Wei <enjou1224z@gmail.com>

Reviewed-by: Phil Sutter <phil@nwl.cc>

Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> On Fri, Jul 03, 2026 at 03:32:43PM +0800, Ren Wei wrote:
> > From: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> > 
> > When XT_TIME_CONTIGUOUS handles a cross-day daytime range, packets in
> > the post-midnight part of the range are matched against the previous
> > calendar day by subtracting SECONDS_PER_DAY from stamp.

This is silly.  I'm not sure this is even a bug.
We're in 2026 not 1970.  I really don't see why this patch is required.

Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Phil Sutter]

On Fri, Jul 03, 2026 at 12:08:25PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > On Fri, Jul 03, 2026 at 03:32:43PM +0800, Ren Wei wrote:
> > > From: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> > > 
> > > When XT_TIME_CONTIGUOUS handles a cross-day daytime range, packets in
> > > the post-midnight part of the range are matched against the previous
> > > calendar day by subtracting SECONDS_PER_DAY from stamp.
> 
> This is silly.  I'm not sure this is even a bug.
> We're in 2026 not 1970.  I really don't see why this patch is required.

I imagined a system with broken BIOS clock which boots at epoch until
NTP has fixed it. Then stamp will be close to zero, no?

Cheers, Phil

Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> > This is silly.  I'm not sure this is even a bug.
> > We're in 2026 not 1970.  I really don't see why this patch is required.
> 
> I imagined a system with broken BIOS clock which boots at epoch until
> NTP has fixed it. Then stamp will be close to zero, no?

So what?  Rule won't match either way.  I wish we could get somehow
get rid of xt_time and nft_meta time matching, this was a very bad
idea from the start.

Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Phil Sutter]

On Fri, Jul 03, 2026 at 12:29:14PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > > This is silly.  I'm not sure this is even a bug.
> > > We're in 2026 not 1970.  I really don't see why this patch is required.
> > 
> > I imagined a system with broken BIOS clock which boots at epoch until
> > NTP has fixed it. Then stamp will be close to zero, no?
> 
> So what?  Rule won't match either way.  I wish we could get somehow
> get rid of xt_time and nft_meta time matching, this was a very bad
> idea from the start.

Sure, time-based packet matching won't work on a system with wrong time,
but AIUI the patch is merely trying to prevent the unexpectedly large
lshift. It seems harmless, though:
- current_time.weekday can't exceed 7, it is assigned the result of a
  modulo operation
- current_time.monthday is type u8, so worst case the kernel will
  compute '1U << 255'

Cheers, Phil

Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Pablo Neira Ayuso]

On Fri, Jul 03, 2026 at 01:03:43PM +0200, Phil Sutter wrote:
> On Fri, Jul 03, 2026 at 12:29:14PM +0200, Florian Westphal wrote:
> > Phil Sutter <phil@nwl.cc> wrote:
> > > > This is silly.  I'm not sure this is even a bug.
> > > > We're in 2026 not 1970.  I really don't see why this patch is required.
> > > 
> > > I imagined a system with broken BIOS clock which boots at epoch until
> > > NTP has fixed it. Then stamp will be close to zero, no?
> > 
> > So what?  Rule won't match either way.  I wish we could get somehow
> > get rid of xt_time and nft_meta time matching, this was a very bad
> > idea from the start.
> 
> Sure, time-based packet matching won't work on a system with wrong time,
> but AIUI the patch is merely trying to prevent the unexpectedly large
> lshift. It seems harmless, though:
> - current_time.weekday can't exceed 7, it is assigned the result of a
>   modulo operation
> - current_time.monthday is type u8, so worst case the kernel will
>   compute '1U << 255'

Maybe it can be added as hardening for nf-next, just for correctness.
Remove Fixes: tag. I don't see this as a bug either.