time match does not track DST changes

The time match does not follow daylight savings time changes. Without adding timezone information to the kernel, fixing the module doesn't seem possible.

I considered adding a /proc entry to configure whether to add an hour or not, but doing so would still require user intervention, and the user can just as easily fix things up with this:

   hwclock --systohc ; hwclock --hctosys

So, the below just adds a couple notes so users are aware of this limitation.

Unless someone thinks of a better idea, this closes bugzilla #75.

Phil

diff -ru ipt-orig/extensions/libipt_time.c ipt-new/extensions/libipt_time.c
@@ -21,6 +21,7 @@
 " [ --timestart value ] [ --timestop value] [ --days listofdays ] [ --datestart value ] [ --datestop value ]\n"
 "          timestart value : HH:MM (default 00:00)\n"
 "          timestop  value : HH:MM (default 23:59)\n"
+"                            Note: daylight savings time changes are not tracked\n"
 "          listofdays value: a list of days to apply\n"
 "                            from Mon,Tue,Wed,Thu,Fri,Sat,Sun\n"
 "                            Coma speparated, no space, case sensitive.\n"

diff -ru pom-orig/time/help pom-new/time/help
@@ -30,3 +30,5 @@
   -A OUTPUT -m time --timestart 8:00 --timestop 18:00 --Days Mon --date-stop 2010
   will match the packets (locally generated) that have a departure timestamp
   in the range 8:00->18:00 on Monday only, until 2010
+
+NOTE: the time match does not track changes in daylight savings time

Yes, this is one of the reasons why the time match shouldn't be used in the first place. Use cron and a small script to modify your ruleset at the given time(s).

ipt_time will never get into the mainline kernel...

I'm fine with this.

- Harald Welte <[email protected]>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie