[autobackport: sssd-2-13] Openssl 4 fixes by sssd-bot · Pull Request #8715 · SSSD/sssd

sssd-bot · 2026-05-19T13:26:08Z

This is an automatic backport of PR#8667 Openssl 4 fixes to branch sssd-2-13, created by @simo5.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot [email protected]:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8667-to-sssd-2-13
git checkout SSSD-sssd-backport-pr8667-to-sssd-2-13
git push sssd-bot SSSD-sssd-backport-pr8667-to-sssd-2-13 --force

Original commits
ab6713f - Correct x400Address type check in crypto.m4
b197d9d - Update certmap for OpenSSL 4.0 compatibility
770ae6c - Add const qualifier to X509_NAME pointers

Backported commits

a1ce2ab - Correct x400Address type check in crypto.m4
efef859 - Update certmap for OpenSSL 4.0 compatibility
9c47802 - Add const qualifier to X509_NAME pointers

Original Pull Request Body

I think this is a better patch than #8614

gemini-code-assist

Code Review

This pull request updates the codebase for OpenSSL 3.0 compatibility by replacing direct access to ASN1_STRING structure members with accessor functions and introducing const qualifiers to various X509 and ASN1 types. Feedback identifies a potential crash in sss_cert_content_crypto.c due to a missing type check on ASN1_TYPE before sequence access. Additionally, several instances of adding const to X509_NAME in p11_child_openssl.c are flagged as problematic for backward compatibility with OpenSSL 1.1.1, which is still used in some supported environments like RHEL 8.

gemini-code-assist · 2026-05-19T13:29:05Z

+    p = ASN1_STRING_get0_data(oct);
+    princ = d2i_KRB5PrincipalName(NULL, &p, ASN1_STRING_length(oct));


The code accesses current->d.otherName->value->value.sequence and passes it to ASN1_STRING_get0_data without verifying that the ASN1_TYPE is actually a sequence. If a malformed certificate contains an otherName with a different type for the PKINIT OID, oct might be NULL or contain invalid data, leading to a crash. A type check using ASN1_TYPE_get() should be added before accessing the sequence value, similar to the implementation in add_nt_princ_to_san_list.

if (ASN1_TYPE_get(current->d.otherName->value) != V_ASN1_SEQUENCE || oct == NULL) { return EINVAL; } p = ASN1_STRING_get0_data(oct); princ = d2i_KRB5PrincipalName(NULL, &p, ASN1_STRING_length(oct));

Hi,

this issue is present in the original code as well. I will add a check in a different PR.

bye,
Sumit

gemini-code-assist · 2026-05-19T13:29:05Z

    char *port = NULL;
    int use_ssl;
-    X509_NAME *issuer_name = NULL;
+    const X509_NAME *issuer_name = NULL;


Changing issuer_name to const X509_NAME * may cause compilation warnings or errors on OpenSSL versions prior to 3.0 (such as 1.1.1), where X509_OBJECT_retrieve_by_subject expects a non-const X509_NAME *. Since SSSD 2.13 may still be built against OpenSSL 1.1.1 on some supported platforms (e.g., RHEL 8), it is safer to keep this variable as X509_NAME * to maintain cross-version compatibility without requiring explicit casts at every call site.

X509_NAME *issuer_name = NULL;

Hi,

yes, there is a compiler warning on RHEL-8 with OpenSSL 1.1.1 but I think it can be ignored for the time being since it is not expected that this SSSD branch is used on this platform (there is even other issues which prevent the compilation on RHEL-8 without changes). I can add a fix for this in a different PR.

bye,
Sumit

I can add a fix for this in a different PR.

@sumit-bose, maybe we could drop support of openssl-1 in sssd-2-13+?

Hi,

in general yes but it might be more friendly to deprecate first, e.g. in the release notes of sssd-2.13.1 and remove support with sssd-2.14?

bye,
Sumit

If we still can skip fixing compilation, then it's also fine.

gemini-code-assist · 2026-05-19T13:29:05Z

    struct cert_list *list = NULL;
    struct cert_list *item;
-    X509_NAME *tmp_name;
+    const X509_NAME *tmp_name;


Declaring tmp_name as const X509_NAME * introduces a compatibility issue with OpenSSL 1.1.1, where X509_NAME_oneline (used at line 1097) expects a non-const X509_NAME *. This will likely result in build failures on platforms using older OpenSSL versions if warnings are treated as errors. It is recommended to revert this to X509_NAME *.

X509_NAME *tmp_name;

Same as with issuer_name.

sumit-bose

Hi,

originals and backports matches and valid Gemini comments can be handled imo in a new PR, ACK.

bye,
Sumit

Update the compilation check for the x400Address field in the GENERAL_NAME struct. By comparing the address of the field against an ASN1_STRING double pointer, it ensures the compiler strictly and safely verifies the exact type during autoconf checks without causing invalid pointer arithmetic errors. Co-authored-by: Gemini <[email protected]> Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Sumit Bose <[email protected]> (cherry picked from commit ab6713f)

Replace direct struct field accesses with OpenSSL accessor functions like ASN1_STRING_get0_data and ASN1_STRING_length. Add const qualifiers to ensure compatibilitty with OpenSSL 4.0. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Sumit Bose <[email protected]> (cherry picked from commit b197d9d)

The issuer_name and subject_name variables in get_issuer_subject_str have been updated to use the const qualifier. This improves const-correctness and prevents accidental modification of the certificate data. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Sumit Bose <[email protected]> (cherry picked from commit 770ae6c)

sssd-bot · 2026-05-19T16:43:14Z

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 Build / freebsd (success)
🟢 Build / make-distcheck (success)

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

sssd-bot assigned sumit-bose and alexey-tikhonov May 19, 2026

sssd-bot requested review from alexey-tikhonov and sumit-bose May 19, 2026 13:26

gemini-code-assist Bot reviewed May 19, 2026

View reviewed changes

sumit-bose approved these changes May 19, 2026

View reviewed changes

alexey-tikhonov removed their request for review May 19, 2026 16:42

alexey-tikhonov removed their assignment May 19, 2026

alexey-tikhonov added no-backport This should go to target branch only. Accepted labels May 19, 2026

simo5 and others added 3 commits May 19, 2026 16:43

sssd-bot force-pushed the SSSD-sssd-backport-pr8667-to-sssd-2-13 branch from 9c47802 to 73c6a0b Compare May 19, 2026 16:43

alexey-tikhonov merged commit 52547f7 into SSSD:sssd-2-13 May 19, 2026
8 checks passed

		p = ASN1_STRING_get0_data(oct);
		princ = d2i_KRB5PrincipalName(NULL, &p, ASN1_STRING_length(oct));

Uh oh!

Conversation

sssd-bot commented May 19, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

sumit-bose May 19, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

sumit-bose May 19, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sumit-bose May 19, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov May 19, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

sumit-bose May 19, 2026

Choose a reason for hiding this comment

Uh oh!

sumit-bose left a comment

Choose a reason for hiding this comment

Uh oh!

sssd-bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

alexey-tikhonov May 19, 2026 •

edited

Loading