D30: a wait stamp dated after now (a clock that jumped back) is dropped, never a block until that date — the commit's security review; red-proved; unreleased

internal/wgtunnel/rekey.go

@@ -65,12 +65,20 @@ func (m *Manager) clockAheadRekeyLocked(ctx context.Context, block *hub.WireWire
 			"future_s", fut, "rekey_after", m.rekeyAfter.String())
 		return false
 	}
+	// A clock that jumps backwards must not stretch either wait (commit security review 2026-10-23 night): a start or a
+	// last re-key stamped AFTER now is from a wrong clock and is dropped — this whole feature exists because clocks jump.
+	if now.Before(m.futureSince) {
+		m.futureSince = now
+	}
 	if now.Sub(m.futureSince) < m.rekeyAfter {
 		return false
 	}
 	if m.lastRekey.IsZero() {
 		m.lastRekey = m.loadLastRekey()
 	}
+	if now.Before(m.lastRekey) {
+		m.lastRekey = time.Time{}
+	}
 	if !m.lastRekey.IsZero() && now.Sub(m.lastRekey) < rekeyMinGap {
 		return false
 	}

internal/wgtunnel/rekey_test.go

@@ -206,3 +206,22 @@ func TestD30_TheHourBoundSurvivesARestart(t *testing.T) {
 	}
 	_ = active
 }
+
+// Commit security review 2026-10-23 night: a last re-key saved while the clock ran ahead (a later date than now) must
+// not block the next re-key until that date. RED-PROOF: with the „lastRekey after now → dropped" guard removed, this
+// fails — seen failing 2026-10-23 night.
+func TestD30_ALastReKeyFromTheFutureDoesNotBlock(t *testing.T) {
+	fh := &fakeHub{}
+	m, _, active, _ := testManager(t, fh)
+	pub := establishWG(t, m, active)
+	m.saveLastRekey(time.Unix(hs+2*365*86400, 0)) // written while the clock was two years ahead
+	ctx := context.Background()
+	t0 := int64(hs - 3*3600)
+	at(m, t0)
+	m.Watchdog(ctx, true, testBlock(pub))
+	at(m, t0+16*60)
+	m.Watchdog(ctx, true, testBlock(pub))
+	if localPub(t, m) == pub {
+		t.Fatal("a last re-key dated in the future must not block the re-key")
+	}
+}