ssl.cert_time_to_seconds() returns wrong results if local timezone is not UTC

[4kir4]

BPO	19940
Nosy	@pitrou, @tiran, @4kir4
Files	patch.txt: Patch patch.txt: Patch with the combined test case and code chages. This overrides the previous patch patch.txt. ssl_cert_time_seconds.py: example cert_time_to_seconds(cert_time) implementation ssl_cert_time_to_seconds.patch: Fixed code (timezone and locale issues), added tests, updated documention ssl_cert_time_to_seconds-ps3.patch: changes following the review ssl_cert_time_to_seconds-462470859e57.patch: simplify implementation ssl_cert_time_to_seconds-ps5.patch ssl_cert_time_to_seconds-ps6.patch: fix issues pointed out in the review

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2014-04-28.18:58:17.945>
created_at = <Date 2013-12-10.07:29:12.424>
labels = ['type-bug', 'library']
title = 'ssl.cert_time_to_seconds() returns wrong results if local timezone is not UTC'
updated_at = <Date 2014-04-28.22:46:14.088>
user = 'https://github.com/4kir4'

bugs.python.org fields:

activity = <Date 2014-04-28.22:46:14.088>
actor = 'akira'
assignee = 'none'
closed = True
closed_date = <Date 2014-04-28.18:58:17.945>
closer = 'pitrou'
components = ['Library (Lib)']
creation = <Date 2013-12-10.07:29:12.424>
creator = 'akira'
dependencies = []
files = ['33217', '33254', '34197', '34201', '34594', '35050', '35051', '35075']
hgrepos = []
issue_num = 19940
keywords = ['patch']
message_count = 26.0
messages = ['205774', '205803', '205814', '205815', '205860', '206616', '206617', '206620', '206629', '206635', '206666', '206810', '206825', '207083', '211988', '211992', '212022', '212380', '214637', '217243', '217245', '217373', '217392', '217394', '217395', '217435']
nosy_count = 7.0
nosy_names = ['janssen', 'pitrou', 'christian.heimes', 'docs@python', 'akira', 'python-dev', 'gudge']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue19940'
versions = ['Python 3.5']

[4kir4]

cert_time_to_seconds() uses time.mktime() 1 to convert utc time tuple to seconds since epoch. mktime() works with local time. It should use calendar.timegm() analog instead.

Example from the docs 2 is seven hours off (it shows utc offset of the local timezone of the person who created it):

    >>> import ssl
    >>> ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT")
    1178694000.0

It should be 1178668800:

    >>> from datetime import datetime
    >>> datetime.utcfromtimestamp(1178668800)
    datetime.datetime(2007, 5, 9, 0, 0)
    >>> import time
    >>> time.gmtime(1178668800)
    time.struct_time(tm_year=2007, tm_mon=5, tm_mday=9, tm_hour=0, tm_min=0, tm_sec=0, tm_wday=2, tm_yday=129, tm_isdst=0)

And calendar.timegm returns correct result:

    >>> calendar.timegm(time.strptime("May 9 00:00:00 2007 GMT", "%b %d %H:%M:%S %Y GMT"))
    1178668800

[gudge]

Will work on this.
Please assign the issue to me.

Instructions before proceeding by Tim Golden(python mailing list):

Having just glanced at that issue, I would point out that there's been a
lot of development around the ssl module for the 3.4 release, so you
definitely want to confirm the issue against the hg tip to ensure it
still applies.

[pitrou]

Indeed the example in the docs is wrong, and so is the current behaviour.

The example shows "round-tripping" using ssl.cert_time_to_seconds() and then time.ctime(), except that it is bogus as it takes a GMT time and ctime() returns a local time ("""Convert a time expressed in seconds since the epoch to a string representing local time""").

Still, we should only fix it in 3.4, as code written for prior versions may rely on the current (bogus) behaviour.

[pitrou]

gudge, your contribution is welcome! If you need guidance about how to write a patch, you can read the developer's guide: http://docs.python.org/devguide/

Also you will have to sign a contributor's agreement: http://www.python.org/psf/contrib/

[4kir4]

gudge,

There is also an issue with the current strptime format 1 ("%b %d %H:%M:%S %Y GMT"). It is locale-dependent and it may fail if a non-English locale is in effect. I don't know whether I should open a new issue on this or are you going to fix it too.

cert_time_to_seconds() is documented 2 to parse notBefore, notAfter fields from a certificate. As far as I can tell they do not depend on current locale. Thus the following code should not fail:

    >>> timestr = "May  9 00:00:00 2007 GMT"
    >>> import ssl
    >>> ssl.cert_time_to_seconds(timestr)
    1178661600.0
    >>> import locale
    >>> locale.setlocale(locale.LC_TIME, 'pl_PL.utf8')
    'pl_PL.utf8'
    >>> ssl.cert_time_to_seconds(timestr)
    Traceback (most recent call last):
    ...[snip]...
    ValueError: time data 'May  9 00:00:00 2007 GMT' does not match format '%b %d %H:%M:%S %Y GMT'

[gudge]

1. Can I get a list of failures. The summary of test results which I compare on my machine.

-----------------------------------------------------------------------------------------------------

>>> import ssl
>>> ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT")
1178649000.0
>>> from datetime import datetime
>>> datetime.utcfromtimestamp(1178668800)
datetime.datetime(2007, 5, 9, 0, 0)
>>> import time
>>> time.gmtime(1178668800)
time.struct_time(tm_year=2007, tm_mon=5, tm_mday=9, tm_hour=0, tm_min=0, tm_sec=0, tm_wday=2, tm_yday=129, tm_isdst=0)
>>> import calender
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: No module named 'calender'
>>> import callendar
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: No module named 'callendar'
>>> import calendar
>>> calendar.timegm(time.strptime("May 9 00:00:00 2007 GMT", "%b %d %H:%M:%S %Y GMT"))
1178668800

---

I am running a VM on windows host machine.
In your comment ou have specified:

>>> import ssl
    >>> ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT")
    1178694000.0

It should be 1178668800:

But I get also get the same answer with the Python build from latest sources?
Therefore I do not get you?

3. 3 tests omitted:
   test___all__ test_site test_urllib2net
   348 tests OK.
   3 tests failed:
   test_codecs test_distutils test_ioctl
   2 tests altered the execution environment:
   test___all__ test_site
   33 tests skipped:
   test_bz2 test_codecmaps_cn test_codecmaps_hk test_codecmaps_jp
   test_codecmaps_kr test_codecmaps_tw test_curses test_dbm_gnu
   test_dbm_ndbm test_devpoll test_gzip test_idle test_kqueue
   test_lzma test_msilib test_ossaudiodev test_readline test_smtpnet
   test_socketserver test_sqlite test_ssl test_startfile test_tcl
   test_timeout test_tk test_ttk_guionly test_ttk_textonly
   test_urllibnet test_winreg test_winsound test_xmlrpc_net
   test_zipfile64 test_zlib

Are these results fine. These results are with no changes.
How can I make all tests (skipped and omiited pass)

What about the 3 tests which failed. Are these known failures?

Now say I have to pull time again to get the latest code. Does it help
to do a make. Or I will have o do configure again.

5. I had posted a query on core-metorship? No answers? Not that I am entitled to.

Thanks

[gudge]

Sorry I think I did not read msg205774 (1st comment) correctly.
It clearly says:

"cert_time_to_seconds() uses time.mktime() [1] to convert utc time tuple to seconds since epoch. mktime() works with local time. It should use calendar.timegm() analog instead."

So the function cert_time_to_seconds() has to be fixed?

Thanks

[pitrou]

So the function cert_time_to_seconds() has to be fixed?

Yes!

[gudge]

Patch is uploaded.
I will also copy paste it.

I have created the patch with git. Let me know if it is okay with you.
If it is unacceptable I will try and create one for mercury

Patch:
------------------------------------------------------------------

diff --combined Doc/library/ssl.rst
index a6ce5d6,30cb732..0000000
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@@ -366,7 -366,7 +366,7 @@@ Certificate handlin
  
       >>> import ssl
       >>> ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT")
 -     1178694000.0
 +     1178668800 
       >>> import time
       >>> time.ctime(ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT"))
       'Wed May  9 00:00:00 2007'
diff --combined Lib/ssl.py
index f81ef91,052a118..0000000
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@@ -852,8 -852,7 +852,8 @@@ def cert_time_to_seconds(cert_time)
      a Python time value in seconds past the epoch."""
  
      import time
 -    return time.mktime(time.strptime(cert_time, "%b %d %H:%M:%S %Y GMT"))
 +    import calendar 
 +    return calendar.timegm(time.strptime(cert_time, "%b %d %H:%M:%S %Y GMT"))
  
  PEM_HEADER = "-----BEGIN CERTIFICATE-----"
  PEM_FOOTER = "-----END CERTIFICATE-----"

---

Test Results:
358 tests OK.
1 test failed:
test_compileall
1 test altered the execution environment:
test___all__
28 tests skipped:
test_codecmaps_cn test_codecmaps_hk test_codecmaps_jp
test_codecmaps_kr test_codecmaps_tw test_curses test_dbm_gnu
test_dbm_ndbm test_devpoll test_idle test_kqueue test_lzma
test_msilib test_ossaudiodev test_smtpnet test_socketserver
test_sqlite test_startfile test_tcl test_timeout test_tk
test_ttk_guionly test_ttk_textonly test_urllibnet test_winreg
test_winsound test_xmlrpc_net test_zipfile64
------------------------------------------------------------------------

Doc changes won't effect the code. The tests would not fail.
How would I check if the doc changes are coming up fine in the
final version.

>>> import ssl
>>> ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT")
1178668800

I do not have a printer curretly. I will sign the license agreement
in a few days.