Kfs io library: implement X509 certificate "not after" field retrieval and conversion into seconds since "epoch" / "unix" time by parsing ASN1 UTC and generalized time formatted strings, converting into Julian day number (JDN), and then calculating seconds difference since JDN of gmtime(zero_time) also converted into seconds, taking into the account the ANS1 time zone offset. Store pointer to X509 certificate used with ssl context into SSL_CTX, to implement certificate "end time" retrieval with ssl filter. Retrieve and pass peer's certificate chain "end time" to certificate validation method. Add x509 end time retrieval method to the client authentication context.
Meta server: add "maxAuthenticationValidTimeSec" parameter to authentication context configuration with 86400 seconds default, to allow to shorten max authentication [connection] lifetime, by limiting authentication "end time" to the min of the value of this parameter and "end time" of the authentication credentials used -- x509 certificate, or Kerberos ticket, or QFS delegation token. Return authentication end time with authentication RPC response. Take into the account end time of the peer's x509 certificate with both client and chunk server authentication. Use int64_t type to store authentication end time. Change delegation token cancellation check in client state machine by storing and comparing cancellation update count, and triggering current delegation re-validation when the count changes. Do not emit redundant transaction log records in the case where the tokens have already been canceled.
Kerberos library: change ticket end time return type from time_t to int64_t to match the return type X509 certificate end time.
Qfs client library: change authentication end time handling in the network protocol state machine to take into the account the end time in the authentication rpc response time, and client's credential's end time (delegation token or X509 certificate). With Kerberos authentication method client's ticket end time is already taken into the account with the authentication end time returned by the meta server. Implement basic client side delegation renew validation by ensuring that both token and key are not empty stings.
Qfs tool: implement delegation renew and cancellation. Add delegation renew and cancellation methods to FileSystem interface class.
Test scripts: set metaServer.clientAuthentication.maxAuthenticationValidTimeSec and metaServer.CSAuthentication.maxAuthenticationValidTimeSec to test client and chunk server re-authentication, and authentication end time enforcement by the meta server.