time-matching — syntax and semantics of time specification in configuration


Time specifications may appear in various modifications of acl sections of the Kernun configuration (see access-control(7), configuration(7) manual pages). There are two independent mutually exclusive ways how to define proper time interval.

Repeatable item time

time [day days] [month months] [wdays [times]]

The semantics of individual elements is as follows:

day days

It stands for days of month and its type is UINT8-SET.

month months

This element is a set of months (again UINT8-SET).


This parameter is a set of special enumeration type for days of the week, where standard English three-letter shortcuts may be given (Sun, Mon, Tue, Wed, Thu, Fri, Sat). Their numerical counterparts can be given as well, beginning with 0 for Sunday through 1 for Monday, 2 for Tuesday etc. ending with 6 for Saturday.


This element is of type TIME-SET and specifies hours within a day, such as { 0800-1630 } which means 08:00:00 to 16:29:59.

Time conditions specified in the same time item are linked with logical AND. Unused conditions are not checked. Repeated occurrences of the time item within one acl are linked with logical OR.

Nonrepeatable section time-period-set

time-period-set {
  time-spec NAME {
    [dates from-day from-mon till-day till-mon;]
    [weekdays from till;]
    [hours from till;]

The semantics of individual items is as follows:

dates from-day from-mon till-day till-mon;

Specification of date interval within a year. Lower bound can represent higher date then upper one in which case the interval goes across the new year. Upper bound is included in the range.

weekdays from till;

Specification of day interval within a week. Day abbreviations of numbers can be used. Lower bound can represent later day then upper one in which case the interval goes across Sunday/Monday. Upper bound is included in the range.

hours from till;

Specification of time within a day. The HHMM time format is used for values. Lower bound can represent higer time then upper one in which case the interval goes across midnight. Upper bound is NOT included in the range.

Time specifications of the same type are linked with logical OR. Time specifications of different types are linked with logical AND. Unused conditions are not checked. The item exclude forces complementary specification, if the current time matches all given conditions, it is not accepted, and vice versa.


The following time specification is satisfied every Monday in February and October between 8 a.m. and 1 p.m. as well as every Wednesday, Thursday and Friday in July between 10 p.m. and midnight:

time month { 2, 10 } { 1 } { 0800-1300 };
time month { 7 } { Wed - Fri } { 2200-2400 };

Below, there is another time specification example that stands for the first ten days of each month between 1 p.m. and 7 p.m.:

time day { 1-10 } { 1300-1900 }

The last example shows the Czech schoolyear:

time-period-set {
  time-spec SCHOOLYEAR {
    dates 1 9 30 6;
    weekdays Mon Fri;
    hours 0800 1400;

See Also

acl(5), access-control(7), configuration(7)


This man page is a part of Kernun Firewall.
Copyright © 2000–2023 Trusted Network Solutions, a. s.
All rights reserved.