From c10229f44ed96b07a41014a7c8552c285d44a379 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 21:43:27 +0200 Subject: firewall: T9474: keep time windows correct across UTC offset changes nft converts hour matches to UTC when the ruleset is loaded, using the offset of that moment. After a daylight saving change, or a change of the system time-zone, every hour window was off until the next firewall commit. - A new helper loads only the rules with an hour match again, in place, so sets such as dynamic, domain and GeoIP groups and all counters are kept. It is scheduled as a systemd timer for the next UTC offset change and re-arms itself; firewall and policy route commits arm or remove it. - Changing the time-zone re-runs firewall and policy route. The smoketest moves the clock to just before a change in Europe/Berlin and checks that the window is refreshed and a dynamic group entry survives. It only runs in the smoketest harness, as it changes the system clock. --- python/vyos/defaults.py | 3 +++ 1 file changed, 3 insertions(+) (limited to 'python') diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py index 17f8aed51..d45661a43 100644 --- a/python/vyos/defaults.py +++ b/python/vyos/defaults.py @@ -96,6 +96,9 @@ rt_global_table = rt_symbolic_names['main'] fragment_mark_bit = '0x80000000' user_mark_mask = '0x7fffffff' +# Loads nft rules with an hour match again whenever the UTC offset changes +nft_time_refresh = f'{base_dir}/vyos-nft-time-refresh.py' + vyconfd_conf = '/etc/vyos/vyconfd.conf' DEFAULT_COMMIT_CONFIRM_MINUTES = 10 -- cgit v1.2.3