Projects/Timestamps after 2038 - Revision history

Ghudson at 19:53, 7 May 2017

2017-05-07T19:53:43Z

2017-05-07T19:44:05Z

2017-05-07T19:32:33Z

2017-05-07T18:42:23Z

2017-05-04T16:02:34Z

‎Problem

2017-05-04T15:22:36Z

‎Test cases

2017-05-01T17:38:47Z

‎Test cases

2017-05-01T17:37:57Z

‎Affected code

2017-04-30T22:46:13Z

‎Test cases

2017-04-29T04:35:23Z

‎Test cases

← Older revision		Revision as of 19:53, 7 May 2017
Line 144:		Line 144:
	* t_kerb.c converts a timestamp to a time_t in test_string_to_timestamp().		* t_kerb.c converts a timestamp to a time_t in test_string_to_timestamp().

⚫	~~In libkadm5,~~ chpass_util.c adds an interval to a timestamp to determine when the password can next be modified.
		+	In libkadm5:
		+
		⚫	* chpass_util.c adds an interval to a timestamp to determine when the password can next be modified.
		+
		+	* server_acl.c adds and compares timestamps to enforce maximum lifetimes in restrictions.
		+
		+	* svr_principal.c adds timestamps to implement the policy pw_max_life field.

	In libkdb5, timestamps are mostly just stored and retrieved, but kdb5.c:find_actkvno() compares timestamps to find the active master key.		In libkdb5, timestamps are mostly just stored and retrieved, but kdb5.c:find_actkvno() compares timestamps to find the active master key.

← Older revision		Revision as of 19:44, 7 May 2017
Line 87:		Line 87:

	* time_t: to catch assignments of krb5_timestamp values to time_t values		* time_t: to catch assignments of krb5_timestamp values to time_t values
		+
		+	* "now" and "_int32" on the same line: some kadm5 code uses krb5_int32 directly instead of krb5_timestamp.

	In the GSS krb5 mechanism:		In the GSS krb5 mechanism:

← Older revision		Revision as of 19:32, 7 May 2017
Line 209:		Line 209:

	* kadmin: displays timestamps using localtime(); must convert the timestamp to time_t correctly.		* kadmin: displays timestamps using localtime(); must convert the timestamp to time_t correctly.
		+
		+	* tcl_kadm5.c: converts timestamps to ASCII as signed integers; should use unsigned integers.

	* kinit and ksu print timestamps using similar functions which call krb5_timestamp_to_sfstring(). Both functions perform an unnecessary conversion from krb5_timestamp to time_t and back. This code does not strictly require changes but should be simplified.		* kinit and ksu print timestamps using similar functions which call krb5_timestamp_to_sfstring(). Both functions perform an unnecessary conversion from krb5_timestamp to time_t and back. This code does not strictly require changes but should be simplified.

@@ Line 206: / Line 206: @@
 * kdc_log.c: marshals timestamps into ASCII as signed int; should use an unsigned type.
-* kdb5_util: kdb5_mkey.c displays timestamps using localtime(); must convert the timestamp to time_t correctly.  tabdump.c uses gmtime() and also must correctly convert the timestamp to time_t.
+* kdb5_util: kdb5_mkey.c displays timestamps using localtime(); must convert the timestamp to time_t correctly.  tabdump.c uses gmtime() and also must correctly convert the timestamp to time_t.  dump.c converts timestamps to ASCII as signed integers, and should use unsigned integers.
 * kadmin: displays timestamps using localtime(); must convert the timestamp to time_t correctly.

← Older revision		Revision as of 16:02, 4 May 2017
Line 10:		Line 10:

	In the GSSAPI, intervals (always non-negative) are represented using OM_uint32. This is a limitation but not an important one, since GSSAPI does not make use of absolute timestamps.		In the GSSAPI, intervals (always non-negative) are represented using OM_uint32. This is a limitation but not an important one, since GSSAPI does not make use of absolute timestamps.
		+
		+	The CCAPI (used on Windows) represents timestamps using cc_time_t, which is defined as uint32_t. This should work until 2106. An old, apparently unused CCAPI header defines CC_TIME_T to int.

	(See also: {{bug\|8352}})		(See also: {{bug\|8352}})

@@ Line 222: / Line 222: @@
 * Inquire the lifetime of a credential which expires across the year 2038 boundary, with gss_acquire_cred() and gss_inquire_cred().
-* Compute the lifetime of a context which expires across the year 2038 boundary, with gss_init_sec_context(), gss_accept_sec_context(), gss_inquire_context(), and gss_context_time().
+* Inquire the lifetime of a context which expires across the year 2038 boundary, with gss_init_sec_context(), gss_accept_sec_context(), gss_inquire_context(), and gss_context_time().
 For libkrb5:
@@ Line 229: / Line 229: @@
 * Start a KDC with a time offset 21 years in the future.  Verify that KDC clock skew correction works, using t_skew.py as a reference.  Set a password expiration time shortly after the offset KDC time and verify that password expiration calculations work for timestamps after y2038.
 ==Related issues==

@@ Line 230: / Line 230: @@
 * Using a test harness in lib/krb5/krb, call krb5int_validate_times() using a context with the debugging time set and pre-filled krb5_ticket_times objects.  Exercise the cases where the start time and current time are across the y2038 boundary, and where the current time and ticket end time are across the boundary.
-* Start a KDC with a time offset 21 years in the future.  Verify that KDC clock skew correction works. (TBD: can this be done when the clock skew exceeds the ticket lifetime?  We could set the ticket lifetime to more than 21 years if necessary.)  (TBD: which specific clock skew scenarios?  Use t_skew.py as a reference.)
+* Start a KDC with a time offset 21 years in the future.  Verify that KDC clock skew correction works, using t_skew.py as a reference.  Set a password expiration time shortly after the offset KDC time and verify that password expiration calculations work for timestamps after y2038.
 ==Related issues==

← Older revision		Revision as of 17:37, 1 May 2017
Line 209:		Line 209:

	* kinit and ksu print timestamps using similar functions which call krb5_timestamp_to_sfstring(). Both functions perform an unnecessary conversion from krb5_timestamp to time_t and back. This code does not strictly require changes but should be simplified.		* kinit and ksu print timestamps using similar functions which call krb5_timestamp_to_sfstring(). Both functions perform an unnecessary conversion from krb5_timestamp to time_t and back. This code does not strictly require changes but should be simplified.
		+
		+	* Several trace log messages print timestamps using {long} (this is the only current use of {long}, so it is easy to search for those messages in k5-trace.h). Although it is not critical, it would be nice if they could be displayed as unsigned, or perhaps in a condensed ISO format like YYYYMMDDTHHMMSS.

	==Test cases==		==Test cases==

← Older revision		Revision as of 22:46, 30 April 2017
Line 227:		Line 227:

	* Using a test harness in lib/krb5/krb, call krb5int_validate_times() using a context with the debugging time set and pre-filled krb5_ticket_times objects. Exercise the cases where the start time and current time are across the y2038 boundary, and where the current time and ticket end time are across the boundary.		* Using a test harness in lib/krb5/krb, call krb5int_validate_times() using a context with the debugging time set and pre-filled krb5_ticket_times objects. Exercise the cases where the start time and current time are across the y2038 boundary, and where the current time and ticket end time are across the boundary.
		+
		+	* Start a KDC with a time offset 21 years in the future. Verify that KDC clock skew correction works. (TBD: can this be done when the clock skew exceeds the ticket lifetime? We could set the ticket lifetime to more than 21 years if necessary.) (TBD: which specific clock skew scenarios? Use t_skew.py as a reference.)

	==Related issues==		==Related issues==