Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Jul 03, 2026 at 01:03:43PM +0200, Phil Sutter wrote:
> On Fri, Jul 03, 2026 at 12:29:14PM +0200, Florian Westphal wrote:
> > Phil Sutter <phil@nwl.cc> wrote:
> > > > This is silly.  I'm not sure this is even a bug.
> > > > We're in 2026 not 1970.  I really don't see why this patch is required.
> > > 
> > > I imagined a system with broken BIOS clock which boots at epoch until
> > > NTP has fixed it. Then stamp will be close to zero, no?
> > 
> > So what?  Rule won't match either way.  I wish we could get somehow
> > get rid of xt_time and nft_meta time matching, this was a very bad
> > idea from the start.
> 
> Sure, time-based packet matching won't work on a system with wrong time,
> but AIUI the patch is merely trying to prevent the unexpectedly large
> lshift. It seems harmless, though:
> - current_time.weekday can't exceed 7, it is assigned the result of a
>   modulo operation
> - current_time.monthday is type u8, so worst case the kernel will
>   compute '1U << 255'

Maybe it can be added as hardening for nf-next, just for correctness.
Remove Fixes: tag. I don't see this as a bug either.