freeipa

#8378 CA validity past year 2038 breaks cert.py plugin on 32-bit platform
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

Reported by https://twitter.com/Aronetics at https://serverfault.com/questions/1017877/freeipa-on-rpi3-kerberos5-timeout/1022215:

When deploying FreeIPA on Raspberry PI 3 (arm 32-bit), Web UI fails on one tab, Authentication -> Certificates.

In the error_log:

[Tue May 19 22:02:02.578593 2020] [wsgi:error] [pid 1364:tid 2941485888] [remote IP.119:53807] ipa: INFO: [jsonserver_session] admin@ARONETICS.COM: user_find(None, version='2.236', no_members=True): SUCCESS</br>
[Tue May 19 22:02:05.062481 2020] [:warn] [pid 2099:tid 2494501696] [client IP.119:53807] failed to set perms (3140) on file (/run/ipa/ccaches/admin@ARONETICS.COM)!, referer: https://flash.aronetics.com/ipa/ui/  
[Tue May 19 22:02:06.382009 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] ipa: ERROR: non-public: OverflowError: timestamp out of range for platform time_t  
[Tue May 19 22:02:06.382180 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] Traceback (most recent call last):  
[Tue May 19 22:02:06.382248 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipaserver/rpcserver.py", line 368, in wsgi_execute  
[Tue May 19 22:02:06.382269 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     result = command(*args, **options)  
[Tue May 19 22:02:06.382288 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call  
[Tue May 19 22:02:06.382307 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     return self.__do_call(*args, **options)  
[Tue May 19 22:02:06.382324 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call  
[Tue May 19 22:02:06.382343 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     ret = self.run(*args, **options)  
[Tue May 19 22:02:06.382361 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 800, in run  
[Tue May 19 22:02:06.382379 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     return self.execute(*args, **options)  
[Tue May 19 22:02:06.382397 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipaserver/plugins/cert.py", line 1835, in execute  
[Tue May 19 22:02:06.382415 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     **options)  
[Tue May 19 22:02:06.382433 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipaserver/plugins/cert.py", line 1701, in _ca_search  
[Tue May 19 22:02:06.382453 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     convert_pkidatetime(obj['valid_not_after']))  
[Tue May 19 22:02:06.382471 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]   File "/usr/lib/python3.7/site-packages/ipaserver/plugins/cert.py", line 257, in convert_pkidatetime  
[Tue May 19 22:02:06.382490 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807]     value = datetime.datetime.fromtimestamp(int(value) // 1000)  
[Tue May 19 22:02:06.382508 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] OverflowError: timestamp out of range for platform time_t  
[Tue May 19 22:02:06.383531 2020] [wsgi:error] [pid 1363:tid 2941485888] [remote IP.119:53807] ipa: INFO: [jsonserver_session] admin@ARONETICS.COM: cert_find(None, version='2.236'): InternalError

Metadata Update from @abbra:
- Issue assigned to abbra

Do we still support 32 bit platforms on server side? I was under the impression that 389-DS dropped support with 32 bit platforms long ago.

They only dropped i686, not armhfp.

See here: https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/armhfp/os/Packages/f/

Does something like this work on 32-bit platform?

datetime.fromtimestamp(0) + timedelta(seconds=2223604050)

Yes, it works:

>>> import datetime, os, sys
>>> sys.maxsize
2147483647
>>> os.uname().machine
'armv7l'
>>> epoch = datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
>>> epoch + datetime.timedelta(seconds=2223604050)
datetime.datetime(2040, 6, 18, 3, 47, 30, tzinfo=datetime.timezone.utc)
>>> epoch + datetime.timedelta(seconds=2*sys.maxsize)
datetime.datetime(2106, 2, 7, 6, 28, 14, tzinfo=datetime.timezone.utc)

They only dropped i686, not armhfp.

This is incorrect. We dropped all 32bit platforms. I was very clear in the deprecation process with upstream, so if you are still shipping a 32bit variant even armhfp, that's probably incorrect as far as I'm aware.

@firstyear, you claimed only i686 is affected in the comment https://bugzilla.redhat.com/show_bug.cgi?id=1544386#c20"

Only i686 exhibits the issue, and only when using the glibc atomic types. PR_Atomic isn't affected, and no other platform is affected.

I think when I made the counters 32b they worked as intended, but I need to do it again to test - of course, I also don't care about i686 anymore, and it's the only broken platform we have, so I probably won't ever check this :)

Based on this bug discussion Fedora decided to only drop i686, that's why it is still available in armhfp and other 32-bit systems. It was never demonstrated that glibc has the issue on other platforms.

Whatever the case, we can proceed with fixing this specific bug.

master:

  • 1f6ca418ee9e823b63680ab1213160884fe59cf6 handle Y2038 in timestamp to datetime conversions

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-8:

  • c02544c07d040e4e96ed17233b479c958a68b8fa azure: bump F32->F34
  • 7802e14f5e209512fc736af56972f572bc599bec freeipa.spec: do not use jsl for linting on Fedora 34+
  • 7433be926c6e084f7f1f3bead060544a1334c86e azure: Collect systemd boot log
  • 523a9f863815cccfa05f0f87269d6b448a5ab12a azure: Enforce multi-user.target as default systemd's target
  • 677df148c7d606242ae14665e3d0580f12e972b3 azure: Wait for systemd booted
  • 04c90fb4f2fb16e932f5d198cacb31c75dc9b955 azure: Remove no longer needed repo
  • 8fea2f6f3573cd18f6d1cf2af5f95f0f5da2a643 azure: Mask systemd-resolved
  • 976a3bf4c388e71c3dc85c8c50b9c727bc07de65 ipatests: Update expectations for test_detect_container
  • e5731634a17aa96f4efa235f12bcca993726e6fc azure: Add workaround for PhantomJS against OpenSSL 1.1.1
  • 01237953a21b80219ebd6665e0eb67558a951a83 azure: Warn about memory issues
  • 835df314d65f42c2e36ac52737eecc1f4e9536e6 BIND: Setup logging
  • 2a9dea81254accb08a114a0e853a4c485d1082e4 ipatests: Setup and collect BIND logs
  • e23f9767ce2d509c00efa3c0fa5684e7a1fe1973 azure: Run Base and XMLRPC tests is isolated network
  • 34e1f6ab3971468a0fa485fe7588e469632d3d0f ipatests: Handle network-isolated mode
  • c8e5867d01e4a3a75f7abebf08caf29bbeae5eb6 dnsutil: Improvements for IPA DNS Resolver
  • fe0b5ff449da473a69449f7c3267e4a17245a753 dns: get_reverse_zone: Ignore resolver's timeout
  • d40306b90527337e504d019797ffb41b7c13d035 pytest: Show extra summary information for all except passed tests
  • ff70aacbf8f9035ec496c5e8ea8b23ac6724a8c6 ipatests: Ignore warnings on failed to read files on tarring
  • cb3b396fbbbf11462597a7289d5a89cb9fe2cbc9 ipatests: Suppress list trust or certificates
  • 21a520181f0e8c2a1e19b3a9e559fd77d9df4b04 azure: Collect installed packages
  • c65c7eb05779425355266486c02a30d9cc1f9659 ipatests: dnssec: Add alternative approach for checking chain of trust
  • 6710ff42ea853a5dcee96ab64a72051fb4e3f6f7 azure: Warn about extra and missing gating tests compared to PR-CI
  • a5730f5053a706c9ce93ef7ec4c52f44b32ca432 azure: Re-balance tests envs
  • e66eb48ac43ec513b1e787dcb0da3ee7f7ea3908 azure: coredump: Wait for systemd fully booted
  • 6561fc689800c390b8a05cec01e3e69e563edebb ipatests: re-add test_dnssec.py::TestInstallDNSSECFirst in gating
  • 8bf95380f1e3608be993e90c0005742db1cb9090 azure: Make it possible to adjust Docker resources per test env
  • 2a7f21a9c308cba33edf9ffa43c4aaf271e3a612 ipa-kdb: fix gcc complaints in kdb tests
  • e94261f9d9a09dbeca581dfe77f0ae94d2cb1c0b Set client keytab location for 389ds
  • ba6eb857ee7abf0fdead07a86e60b0308935ed38 dnssec: fix the key type with OpenDNSSEC 2.1
  • 7daf47c83a11ee9cf63462bef8c34a4899054623 ipatests: add a test for ZSK/KSK keytype in DNSKEY record
  • b8242e64ee7765d17746281192eaefc4f8fd7dcc handle Y2038 in timestamp to datetime conversions
  • 5bfe16a8182f2a2903d12ddd93c9d86a20cae198 OpenDNSSEC: fix timezone in key creation date
  • 56746ec0055803b8f6c73c382bed1132a950c0df freeipa.spec: bump the required version of 389ds
  • 2b8ccc8a1ec00fe2b4054f169233092c12d78522 freeipa.spec: synchronize with Fedora for 389-ds and PKI versions
  • a8686043a521ab115e21700c7782f3fad8ee9752 ipatests: collect config files for NetworkManager and systemd-resolved
  • bc9ca47fbd006a533a5f520fe303913b56b13712 ipatests: add utility for managing domain name resolvers
  • cdc78af9d77e22b27fc13d3a82e511f7693dff89 ipatests: setup resolvers during replica and client installations
  • 549ef48c4bf749919fcd93a7ee71641c180b1687 ipatests: do not manually modify /etc/resolv.conf in tests
  • 324ba203ebdd5e8ca5837d40a549c6f43e214d13 ipatests: disable systemd-resolved cache
  • 9a28022e4792a905137da9b8a463057473a86499 ipatests: mock resolver factory
  • 63a3cfff967eadc8b8ca07ab82ea47d876cc8491 ipatests: always try to create A records for hosts in IPA domain
  • d9744e7fa3a9ada6af44b993047fde6521f9bac3 ipatests: do not configure nameserver when installing client and replica
  • 47e9df18cd85295e02dd96c95d5888a84aaceaae ipatests: fix TestInstalDNSSECFirst::test_resolvconf logic
  • bca86ced8dd4fc36685137b32361e311ba34c04f pr-ci: Run tests on F34
  • 0b8517d6f1f09ce246ef2e6c5305099ceec8ac48 Revert "ipatests: configure client to use IPA server as DNS resolver"
  • d43d9ca8afa20c83010a3e862e806936414631fc ipatests: Fetch sudo rules without time offset
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.