What form is the timestamp in the KRB5_TRACE log (and why)

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

What form is the timestamp in the KRB5_TRACE log (and why)

Todd Grayson
Is this some form of specialized unix epoch time timestamp or something?
And more importantly... why?  How do I convert it, normal epoch time
conversion is yielding insane values.


Thanks in advance...
________________________________________________
Kerberos mailing list           [hidden email]
https://mailman.mit.edu/mailman/listinfo/kerberos
Reply | Threaded
Open this post in threaded view
|

Re: What form is the timestamp in the KRB5_TRACE log (and why)

Benjamin Kaduk-2
On Thu, Apr 02, 2020 at 09:04:33PM -0600, Todd Grayson wrote:
> Is this some form of specialized unix epoch time timestamp or something?
> And more importantly... why?  How do I convert it, normal epoch time
> conversion is yielding insane values.

It looks to just be the seconds.microseconds output from
krb5_crypto_us_timeofday().

-Ben
________________________________________________
Kerberos mailing list           [hidden email]
https://mailman.mit.edu/mailman/listinfo/kerberos
Reply | Threaded
Open this post in threaded view
|

Re: What form is the timestamp in the KRB5_TRACE log (and why)

Todd Grayson
Ok but does that mean Unix Epoch time conversion should be working, or is
there some other form of secret decoder ring that is used to translate to
system time?  In troubleshooting/debugging scenarios, being able to
associate the timestamps from the KRB5_TRACE that has been running over an
extended period with external services integrating with kerberos would
be... handy?  I can find no real references on krb5_crypto_us_timeofday()
other than a select set of developer comments within the source code, and a
whole bunch of spam advertising sites representing it and other source code
segments?

On Thu, Apr 2, 2020 at 10:09 PM Benjamin Kaduk <[hidden email]> wrote:

> On Thu, Apr 02, 2020 at 09:04:33PM -0600, Todd Grayson wrote:
> > Is this some form of specialized unix epoch time timestamp or something?
> > And more importantly... why?  How do I convert it, normal epoch time
> > conversion is yielding insane values.
>
> It looks to just be the seconds.microseconds output from
> krb5_crypto_us_timeofday().
>
> -Ben
>


--
Todd Grayson
Principal Customer Operations Engineer
Security SME
________________________________________________
Kerberos mailing list           [hidden email]
https://mailman.mit.edu/mailman/listinfo/kerberos
Reply | Threaded
Open this post in threaded view
|

Re: What form is the timestamp in the KRB5_TRACE log (and why)

Benjamin Kaduk-2
Whoops, I copied the wrong name; the public interface has docs at
http://web.mit.edu/kerberos/krb5-1.18/doc/appdev/refs/api/krb5_us_timeofday.html
and peeking at the source it's a gettimeofday()-like on unix-like systems.
So the unix epocy conversion ought to be working, in my reading, yes.

-Ben

On Fri, Apr 03, 2020 at 08:21:39AM -0600, Todd Grayson wrote:

> Ok but does that mean Unix Epoch time conversion should be working, or is
> there some other form of secret decoder ring that is used to translate to
> system time?  In troubleshooting/debugging scenarios, being able to
> associate the timestamps from the KRB5_TRACE that has been running over an
> extended period with external services integrating with kerberos would
> be... handy?  I can find no real references on krb5_crypto_us_timeofday()
> other than a select set of developer comments within the source code, and a
> whole bunch of spam advertising sites representing it and other source code
> segments?
>
> On Thu, Apr 2, 2020 at 10:09 PM Benjamin Kaduk <[hidden email]> wrote:
>
> > On Thu, Apr 02, 2020 at 09:04:33PM -0600, Todd Grayson wrote:
> > > Is this some form of specialized unix epoch time timestamp or something?
> > > And more importantly... why?  How do I convert it, normal epoch time
> > > conversion is yielding insane values.
> >
> > It looks to just be the seconds.microseconds output from
> > krb5_crypto_us_timeofday().
> >
> > -Ben
> >
>
>
> --
> Todd Grayson
> Principal Customer Operations Engineer
> Security SME
> ________________________________________________
> Kerberos mailing list           [hidden email]
> https://mailman.mit.edu/mailman/listinfo/kerberos
________________________________________________
Kerberos mailing list           [hidden email]
https://mailman.mit.edu/mailman/listinfo/kerberos
Reply | Threaded
Open this post in threaded view
|

Re: What form is the timestamp in the KRB5_TRACE log (and why)

Greg Hudson
In reply to this post by Todd Grayson
On 4/3/20 10:21 AM, Todd Grayson wrote:
> Ok but does that mean Unix Epoch time conversion should be working, or is
> there some other form of secret decoder ring that is used to translate to
> system time?

It's just system time.

    $ date; KRB5_TRACE=/dev/stdout kvno user
    Fri Apr  3 10:58:03 EDT 2020
    [...]
    [12194] 1585925883.499498: Retrieving [hidden email] [...]
    [...]
    $ date -d '@1585925883'
    Fri Apr  3 10:58:03 EDT 2020
________________________________________________
Kerberos mailing list           [hidden email]
https://mailman.mit.edu/mailman/listinfo/kerberos
Reply | Threaded
Open this post in threaded view
|

Re: What form is the timestamp in the KRB5_TRACE log (and why)

Todd Grayson
Cool, thanks!

On Fri, Apr 3, 2020 at 8:59 AM Greg Hudson <[hidden email]> wrote:

> On 4/3/20 10:21 AM, Todd Grayson wrote:
> > Ok but does that mean Unix Epoch time conversion should be working, or is
> > there some other form of secret decoder ring that is used to translate to
> > system time?
>
> It's just system time.
>
>     $ date; KRB5_TRACE=/dev/stdout kvno user
>     Fri Apr  3 10:58:03 EDT 2020
>     [...]
>     [12194] 1585925883.499498: Retrieving [hidden email] [...]
>     [...]
>     $ date -d '@1585925883'
>     Fri Apr  3 10:58:03 EDT 2020
>


--
Todd Grayson
Principal Customer Operations Engineer
Security SME
________________________________________________
Kerberos mailing list           [hidden email]
https://mailman.mit.edu/mailman/listinfo/kerberos