{"record":{"id":"ba93f6ea9c49da8a","repo":"cilium/cilium","slug":"failed-to-convert-since-timestamp-to-proto-w-ba93f6","errorCode":null,"errorMessage":"failed to convert `since` timestamp to proto: %w","messagePattern":"failed to convert `since` timestamp to proto: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hubble/cmd/observe/flows.go","lineNumber":789,"sourceCode":"\t}\n\tif first && selectorOpts.follow {\n\t\treturn nil, fmt.Errorf(\"cannot set both --first and --follow\")\n\t}\n\tif last && selectorOpts.all {\n\t\treturn nil, fmt.Errorf(\"cannot set both --last and --all\")\n\t}\n\n\t// convert selectorOpts.since into a param for GetFlows\n\tvar since, until *timestamppb.Timestamp\n\tif selectorOpts.since != \"\" {\n\t\tst, err := hubtime.FromString(selectorOpts.since)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse the since time: %w\", err)\n\t\t}\n\n\t\tsince = timestamppb.New(st)\n\t\tif err := since.CheckValid(); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to convert `since` timestamp to proto: %w\", err)\n\t\t}\n\t}\n\t// Set the until field if --until option is specified and --follow\n\t// is not specified. If --since is specified but --until is not, the server sets the\n\t// --until option to the current timestamp.\n\tif selectorOpts.until != \"\" && !selectorOpts.follow {\n\t\tut, err := hubtime.FromString(selectorOpts.until)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse the until time: %w\", err)\n\t\t}\n\t\tuntil = timestamppb.New(ut)\n\t\tif err := until.CheckValid(); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to convert `until` timestamp to proto: %w\", err)\n\t\t}\n\t}\n\n\tif since == nil && until == nil && !first {\n\t\tswitch {","sourceCodeStart":771,"sourceCodeEnd":807,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/hubble/cmd/observe/flows.go#L771-L807","documentation":"After hubtime parses --since, the resulting time is converted to a protobuf timestamppb.Timestamp and validated with CheckValid(). If the parsed time is out of the protobuf-valid range (e.g. year far beyond 9999 or negative overflow), this error wraps the proto validation failure.","triggerScenarios":"Passing --since with an extreme value such as `--since 9999999999h` whose resolved time exceeds protobuf Timestamp bounds (year 1..9999), or a system clock/parse edge producing an out-of-range time.Time.","commonSituations":"Huge relative durations meant as seconds instead of hours; script-computed timestamps in ms mistakenly interpreted as ns; malicious or fuzzed input.","solutions":["Use a sane, in-range timestamp (between year 1 and 9999, RFC3339 or a modest relative duration)","Sanitize user/supplied durations before passing to --since (cap max lookback)","If you need times outside protobuf range, filter client-side instead of via --since"],"exampleFix":"// before\nhubble observe --since 99999999h\n// after\nhubble observe --since 999999h","handlingStrategy":"validation","validationCode":"t, err := hubtime.FromString(since)\nif err != nil { return err }\nif t.Year() < 1 || t.Year() > 9999 {\n    return fmt.Errorf(\"--since resolves to out-of-range year %d\", t.Year())\n}","typeGuard":null,"tryCatchPattern":"req, err := getFlowsRequest(ofilter, allow, deny)\nif err != nil {\n    var rangeErr error\n    if strings.Contains(err.Error(), \"timestamp to proto\") {\n        return fmt.Errorf(\"--since out of protobuf Timestamp range: %w\", err)\n    }\n    return err\n}","preventionTips":["Cap relative durations before passing them to --since","Convert units carefully (ms vs ns vs s) when computing timestamps in scripts","Fuzz/validate user-supplied time inputs at the boundary of your tooling"],"tags":["cli","protobuf","time-parsing","hubble"],"backgroundTag":"invalid-timestamp-format","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}