mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
ca0a62eac3
"Kerberos principal expiration" is set in UTC and when server is in different timezone, the time difference between timezone is respected by the IPA server/client for Kerberos authentication. The problem is due to mktime() assuming default time zone but since we parse the time using Zulu (UTC+0) timezone, mktime() forces current time zone offset added. The method is using mktime() and comparing to the current time obtained with time(NULL). According to its man page, mktime is considering the time as local time: The mktime() function converts a broken-down time structure, expressed as local time, to calendar time representation. Instead mktime() we should use timegm(). The problem is that it is non-standard GNU extension and it is recommended (in the man page for timegm(3)) to avoid its use. An alternative is to set TZ=UTC, call mktime(), unset TZ, but since we are running in a multi-threaded environment this is problematic. On the other hand, we already rely on GNU extensions and enable them with -D_DEFAULT_SOURCE=1, so use of timegm() is enabled already. The fix, therefore, is to use timegm() instead of mktime() in daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c in two places where we first do 'strptime()' with Zulu time zone (in ipapwd_pre_bind() and ipapwd_write_krb_keys()). Fixes: https://pagure.io/freeipa/issue/8362 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>