handle Y2038 in timestamp to datetime conversions

According to datetime.utcfromtimestamp() method documentation[1],
this and similar methods fail for dates past 2038 and can be replaced by
the following expression on the POSIX compliant systems:

  datetime(1970, 1, 1, tzinfo=timezone.utc) + timedelta(seconds=timestamp)

Make sure to use a method that at least allows to import the timestamps
properly to datetime objects on 32-bit platforms.

[1] https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp

Fixes: https://pagure.io/freeipa/issue/8378

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>

ipaserver/plugins/cert.py

@@ -52,6 +52,7 @@ from ipalib.request import context
 from ipalib import output
 from ipapython import dnsutil, kerberos
 from ipapython.dn import DN
+from ipapython.ipautil import datetime_from_utctimestamp
 from ipaserver.plugins.service import normalize_principal, validate_realm
 from ipaserver.masters import (
     ENABLED_SERVICE, CONFIGURED_SERVICE, is_service_enabled
@@ -254,8 +255,9 @@ def normalize_pkidate(value):
 
 
 def convert_pkidatetime(value):
-    value = datetime.datetime.fromtimestamp(int(value) // 1000)
-    return x509.format_datetime(value)
+    if isinstance(value, str):
+        value = int(value)
+    return x509.format_datetime(datetime_from_utctimestamp(value, units=1000))
 
 
 def normalize_serial_number(num):

ipaserver/plugins/dogtag.py

@@ -241,7 +241,6 @@ digits and nothing else follows.
 
 from __future__ import absolute_import
 
-import datetime
 import json
 import logging
 
@@ -651,12 +650,14 @@ def parse_check_request_result_xml(doc):
 
     updated_on = doc.xpath('//xml/header/updatedOn[1]')
     if len(updated_on) == 1:
-        updated_on = datetime.datetime.utcfromtimestamp(int(updated_on[0].text))
+        updated_on = ipautil.datetime_from_utctimestamp(
+            int(updated_on[0].text), units=1)
         response['updated_on'] = updated_on
 
     created_on = doc.xpath('//xml/header/createdOn[1]')
     if len(created_on) == 1:
-        created_on = datetime.datetime.utcfromtimestamp(int(created_on[0].text))
+        created_on = ipautil.datetime_from_utctimestamp(
+            int(created_on[0].text), units=1)
         response['created_on'] = created_on
 
     request_notes = doc.xpath('//xml/header/requestNotes[1]')