summaryrefslogtreecommitdiffstats
path: root/recipes-security/sssd/files/CVE-2022-4254-1.patch
diff options
context:
space:
mode:
authorHitendra Prajapati <hprajapati@mvista.com>2023-02-24 10:11:06 +0530
committerArmin Kuster <akuster808@gmail.com>2023-03-23 06:28:09 -0400
commiteb631c12be585d18beddbb41f6035772b2cb17d5 (patch)
tree16a9f27a58d4bfb526793fa2be3680319f5ba058 /recipes-security/sssd/files/CVE-2022-4254-1.patch
parentc62970fda82acf75035243766ecd195243e0f82a (diff)
downloadmeta-security-dunfell.tar.gz
sssd: CVE-2022-4254 libsss_certmap fails to sanitise certificate data used in LDAP filtersdunfell
Upstream-Status: Backport from https://github.com/SSSD/sssd/commit/1c40208aa1e0f9a17cc4f336c99bcaa6977592d3 & https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'recipes-security/sssd/files/CVE-2022-4254-1.patch')
-rw-r--r--recipes-security/sssd/files/CVE-2022-4254-1.patch515
1 files changed, 515 insertions, 0 deletions
diff --git a/recipes-security/sssd/files/CVE-2022-4254-1.patch b/recipes-security/sssd/files/CVE-2022-4254-1.patch
new file mode 100644
index 0000000..a52ce1a
--- /dev/null
+++ b/recipes-security/sssd/files/CVE-2022-4254-1.patch
@@ -0,0 +1,515 @@
1From 1c40208aa1e0f9a17cc4f336c99bcaa6977592d3 Mon Sep 17 00:00:00 2001
2From: Sumit Bose <sbose@redhat.com>
3Date: Tue, 27 Nov 2018 16:40:01 +0100
4Subject: [PATCH] certmap: add sss_certmap_display_cert_content()
5
6To make debugging and writing certificate mapping and matching rules
7more easy a new function is added to libsss_certmap to display the
8certificate content as seen by libsss_certmap. Please note that the
9actual output might change in future.
10
11Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
12
13CVE: CVE-2022-4254
14Upstream-Status: Backport [https://github.com/SSSD/sssd/commit/1c40208aa1e0f9a17cc4f336c99bcaa6977592d3]
15Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
16---
17 Makefile.am | 2 +-
18 src/lib/certmap/sss_certmap.c | 142 ++++++++++++++++++++++
19 src/lib/certmap/sss_certmap.exports | 5 +
20 src/lib/certmap/sss_certmap.h | 18 +++
21 src/lib/certmap/sss_certmap_int.h | 31 ++++-
22 src/lib/certmap/sss_certmap_krb5_match.c | 145 +++++++++++------------
23 6 files changed, 261 insertions(+), 82 deletions(-)
24
25diff --git a/Makefile.am b/Makefile.am
26index 4475b3d..29cd93c 100644
27--- a/Makefile.am
28+++ b/Makefile.am
29@@ -1835,7 +1835,7 @@ libsss_certmap_la_LIBADD = \
30 $(NULL)
31 libsss_certmap_la_LDFLAGS = \
32 -Wl,--version-script,$(srcdir)/src/lib/certmap/sss_certmap.exports \
33- -version-info 0:0:0
34+ -version-info 1:0:1
35
36 if HAVE_NSS
37 libsss_certmap_la_SOURCES += \
38diff --git a/src/lib/certmap/sss_certmap.c b/src/lib/certmap/sss_certmap.c
39index f6f6f98..c60ac24 100644
40--- a/src/lib/certmap/sss_certmap.c
41+++ b/src/lib/certmap/sss_certmap.c
42@@ -914,3 +914,145 @@ void sss_certmap_free_filter_and_domains(char *filter, char **domains)
43 talloc_free(filter);
44 talloc_free(domains);
45 }
46+
47+static const char *sss_eku_oid2name(const char *oid)
48+{
49+ size_t c;
50+
51+ for (c = 0; sss_ext_key_usage[c].name != NULL; c++) {
52+ if (strcmp(sss_ext_key_usage[c].oid, oid) == 0) {
53+ return sss_ext_key_usage[c].name;
54+ }
55+ }
56+
57+ return NULL;
58+}
59+
60+struct parsed_template san_parsed_template[] = {
61+ { NULL, NULL, NULL }, /* SAN_OTHER_NAME handled separately */
62+ { "subject_rfc822_name", NULL, NULL},
63+ { "subject_dns_name", NULL, NULL},
64+ { "subject_x400_address", NULL, NULL},
65+ { "subject_directory_name", NULL, NULL},
66+ { "subject_ediparty_name", NULL, NULL},
67+ { "subject_uri", NULL, NULL},
68+ { "subject_ip_address", NULL, NULL},
69+ { "subject_registered_id", NULL, NULL},
70+ { "subject_pkinit_principal", NULL, NULL},
71+ { "subject_nt_principal", NULL, NULL},
72+ { "subject_principal", NULL, NULL},
73+ { NULL, NULL, NULL }, /* SAN_STRING_OTHER_NAME handled separately */
74+ { NULL, NULL, NULL } /* SAN_END */
75+};
76+
77+int sss_cert_dump_content(TALLOC_CTX *mem_ctx, struct sss_cert_content *c,
78+ char **content_str)
79+{
80+ char *out = NULL;
81+ size_t o;
82+ struct san_list *s;
83+ struct sss_certmap_ctx *ctx = NULL;
84+ char *expanded = NULL;
85+ int ret;
86+ char *b64 = NULL;
87+ const char *eku_str = NULL;
88+
89+ ret = sss_certmap_init(mem_ctx, NULL, NULL, &ctx);
90+ if (ret != EOK) {
91+ return ret;
92+ }
93+
94+ out = talloc_strdup(mem_ctx, "sss cert content (format might change):\n");
95+ if (out == NULL) return ENOMEM;
96+
97+ out = talloc_asprintf_append(out, "Issuer: %s\n", c->issuer_str != NULL
98+ ? c->issuer_str
99+ : "- not available -");
100+ if (out == NULL) return ENOMEM;
101+ out = talloc_asprintf_append(out, "Subject: %s\n", c->subject_str != NULL
102+ ? c->subject_str
103+ : "- not available -");
104+ if (out == NULL) return ENOMEM;
105+
106+ out = talloc_asprintf_append(out, "Key Usage: %u(0x%04x)", c->key_usage,
107+ c->key_usage);
108+ if (out == NULL) return ENOMEM;
109+
110+ if (c->key_usage != 0) {
111+ out = talloc_asprintf_append(out, " (");
112+ if (out == NULL) return ENOMEM;
113+ for (o = 0; sss_key_usage[o].name != NULL; o++) {
114+ if ((c->key_usage & sss_key_usage[o].flag) != 0) {
115+ out = talloc_asprintf_append(out, "%s%s",
116+ o == 0 ? "" : ",",
117+ sss_key_usage[o].name);
118+ if (out == NULL) return ENOMEM;
119+ }
120+ }
121+ out = talloc_asprintf_append(out, ")");
122+ if (out == NULL) return ENOMEM;
123+ }
124+ out = talloc_asprintf_append(out, "\n");
125+ if (out == NULL) return ENOMEM;
126+
127+ for (o = 0; c->extended_key_usage_oids[o] != NULL; o++) {
128+ eku_str = sss_eku_oid2name(c->extended_key_usage_oids[o]);
129+ out = talloc_asprintf_append(out, "Extended Key Usage #%zu: %s%s%s%s\n",
130+ o, c->extended_key_usage_oids[o],
131+ eku_str == NULL ? "" : " (",
132+ eku_str == NULL ? "" : eku_str,
133+ eku_str == NULL ? "" : ")");
134+ if (out == NULL) return ENOMEM;
135+ }
136+
137+ DLIST_FOR_EACH(s, c->san_list) {
138+ out = talloc_asprintf_append(out, "SAN type: %s\n",
139+ s->san_opt < SAN_END
140+ ? sss_san_names[s->san_opt].name
141+ : "- unsupported -");
142+ if (out == NULL) return ENOMEM;
143+
144+ if (san_parsed_template[s->san_opt].name != NULL) {
145+ ret = expand_san(ctx, &san_parsed_template[s->san_opt], c->san_list,
146+ &expanded);
147+ if (ret != EOK) {
148+ return ret;
149+ }
150+ out = talloc_asprintf_append(out, " %s=%s\n\n",
151+ san_parsed_template[s->san_opt].name,
152+ expanded);
153+ talloc_free(expanded);
154+ if (out == NULL) return ENOMEM;
155+ } else if (s->san_opt == SAN_STRING_OTHER_NAME) {
156+ b64 = sss_base64_encode(mem_ctx, s->bin_val, s->bin_val_len);
157+ out = talloc_asprintf_append(out, " %s=%s\n\n", s->other_name_oid,
158+ b64 != NULL ? b64
159+ : "- cannot encode -");
160+ talloc_free(b64);
161+ }
162+ }
163+
164+ *content_str = out;
165+
166+ return EOK;
167+}
168+
169+int sss_certmap_display_cert_content(TALLOC_CTX *mem_cxt,
170+ const uint8_t *der_cert, size_t der_size,
171+ char **desc)
172+{
173+ int ret;
174+ struct sss_cert_content *content;
175+
176+ ret = sss_cert_get_content(mem_cxt, der_cert, der_size, &content);
177+ if (ret != EOK) {
178+ return ret;
179+ }
180+
181+ ret = sss_cert_dump_content(mem_cxt, content, desc);
182+ if (ret != EOK) {
183+ return ret;
184+ }
185+
186+ return 0;
187+}
188diff --git a/src/lib/certmap/sss_certmap.exports b/src/lib/certmap/sss_certmap.exports
189index 8b5d536..a9e48d6 100644
190--- a/src/lib/certmap/sss_certmap.exports
191+++ b/src/lib/certmap/sss_certmap.exports
192@@ -11,3 +11,8 @@ SSS_CERTMAP_0.0 {
193 local:
194 *;
195 };
196+
197+SSS_CERTMAP_0.1 {
198+ global:
199+ sss_certmap_display_cert_content;
200+} SSS_CERTMAP_0.0;
201diff --git a/src/lib/certmap/sss_certmap.h b/src/lib/certmap/sss_certmap.h
202index 646e0f3..7da2d1c 100644
203--- a/src/lib/certmap/sss_certmap.h
204+++ b/src/lib/certmap/sss_certmap.h
205@@ -146,6 +146,24 @@ int sss_certmap_get_search_filter(struct sss_certmap_ctx *ctx,
206 */
207 void sss_certmap_free_filter_and_domains(char *filter, char **domains);
208
209+/**
210+ * @brief Get a string with the content of the certificate used by the library
211+ *
212+ * @param[in] mem_ctx Talloc memory context, may be NULL
213+ * @param[in] der_cert binary blog with the DER encoded certificate
214+ * @param[in] der_size size of the certificate blob
215+ * @param[out] desc Multiline string showing the certificate content
216+ * which is used by libsss_certmap
217+ *
218+ * @return
219+ * - 0: success
220+ * - EINVAL: certificate cannot be parsed
221+ * - ENOMEM: memory allocation failure
222+ */
223+int sss_certmap_display_cert_content(TALLOC_CTX *mem_cxt,
224+ const uint8_t *der_cert, size_t der_size,
225+ char **desc);
226+
227 /**
228 * @}
229 */
230diff --git a/src/lib/certmap/sss_certmap_int.h b/src/lib/certmap/sss_certmap_int.h
231index 479cc16..b1155e2 100644
232--- a/src/lib/certmap/sss_certmap_int.h
233+++ b/src/lib/certmap/sss_certmap_int.h
234@@ -101,9 +101,9 @@ enum comp_type {
235 };
236
237 struct parsed_template {
238- char *name;
239- char *attr_name;
240- char *conversion;
241+ const char *name;
242+ const char *attr_name;
243+ const char *conversion;
244 };
245
246 struct ldap_mapping_rule_comp {
247@@ -166,6 +166,28 @@ struct san_list {
248 #define SSS_KU_ENCIPHER_ONLY 0x0001
249 #define SSS_KU_DECIPHER_ONLY 0x8000
250
251+struct sss_key_usage {
252+ const char *name;
253+ uint32_t flag;
254+};
255+
256+extern const struct sss_key_usage sss_key_usage[];
257+
258+struct sss_ext_key_usage {
259+ const char *name;
260+ const char *oid;
261+};
262+
263+extern const struct sss_ext_key_usage sss_ext_key_usage[];
264+
265+struct sss_san_name {
266+ const char *name;
267+ enum san_opt san_opt;
268+ bool is_string;
269+};
270+
271+extern const struct sss_san_name sss_san_names[];
272+
273 struct sss_cert_content {
274 char *issuer_str;
275 const char **issuer_rdn_list;
276@@ -183,6 +205,9 @@ int sss_cert_get_content(TALLOC_CTX *mem_ctx,
277 const uint8_t *der_blob, size_t der_size,
278 struct sss_cert_content **content);
279
280+int sss_cert_dump_content(TALLOC_CTX *mem_ctx, struct sss_cert_content *c,
281+ char **content_str);
282+
283 char *check_ad_attr_name(TALLOC_CTX *mem_ctx, const char *rdn);
284
285 char *openssl_2_nss_attr_name(const char *attr);
286diff --git a/src/lib/certmap/sss_certmap_krb5_match.c b/src/lib/certmap/sss_certmap_krb5_match.c
287index 125e925..398d3d2 100644
288--- a/src/lib/certmap/sss_certmap_krb5_match.c
289+++ b/src/lib/certmap/sss_certmap_krb5_match.c
290@@ -29,6 +29,59 @@
291 #include "lib/certmap/sss_certmap.h"
292 #include "lib/certmap/sss_certmap_int.h"
293
294+const struct sss_key_usage sss_key_usage[] = {
295+ {"digitalSignature" , SSS_KU_DIGITAL_SIGNATURE},
296+ {"nonRepudiation" , SSS_KU_NON_REPUDIATION},
297+ {"keyEncipherment" , SSS_KU_KEY_ENCIPHERMENT},
298+ {"dataEncipherment" , SSS_KU_DATA_ENCIPHERMENT},
299+ {"keyAgreement" , SSS_KU_KEY_AGREEMENT},
300+ {"keyCertSign" , SSS_KU_KEY_CERT_SIGN},
301+ {"cRLSign" , SSS_KU_CRL_SIGN},
302+ {"encipherOnly" , SSS_KU_ENCIPHER_ONLY},
303+ {"decipherOnly" , SSS_KU_DECIPHER_ONLY},
304+ {NULL ,0}
305+};
306+
307+const struct sss_ext_key_usage sss_ext_key_usage[] = {
308+ /* RFC 3280 section 4.2.1.13 */
309+ {"serverAuth", "1.3.6.1.5.5.7.3.1"},
310+ {"clientAuth", "1.3.6.1.5.5.7.3.2"},
311+ {"codeSigning", "1.3.6.1.5.5.7.3.3"},
312+ {"emailProtection", "1.3.6.1.5.5.7.3.4"},
313+ {"timeStamping", "1.3.6.1.5.5.7.3.8"},
314+ {"OCSPSigning", "1.3.6.1.5.5.7.3.9"},
315+
316+ /* RFC 4556 section 3.2.2 */
317+ {"KPClientAuth", "1.3.6.1.5.2.3.4"},
318+ {"pkinit", "1.3.6.1.5.2.3.4"},
319+
320+ /* https://support.microsoft.com/en-us/help/287547/object-ids-associated-with-microsoft-cryptography*/
321+ {"msScLogin", "1.3.6.1.4.1.311.20.2.2"},
322+
323+ {NULL ,0}
324+};
325+
326+const struct sss_san_name sss_san_names[] = {
327+ /* https://www.ietf.org/rfc/rfc3280.txt section 4.2.1.7 */
328+ {"otherName", SAN_OTHER_NAME, false},
329+ {"rfc822Name", SAN_RFC822_NAME, true},
330+ {"dNSName", SAN_DNS_NAME, true},
331+ {"x400Address", SAN_X400_ADDRESS, false},
332+ {"directoryName", SAN_DIRECTORY_NAME, true},
333+ {"ediPartyName", SAN_EDIPART_NAME, false},
334+ {"uniformResourceIdentifier", SAN_URI, true},
335+ {"iPAddress", SAN_IP_ADDRESS, true},
336+ {"registeredID", SAN_REGISTERED_ID, true},
337+ /* https://www.ietf.org/rfc/rfc4556.txt section 3.2.2 */
338+ {"pkinitSAN", SAN_PKINIT, true},
339+ /* https://support.microsoft.com/en-us/help/287547/object-ids-associated-with-microsoft-cryptography */
340+ {"ntPrincipalName", SAN_NT, true},
341+ /* both previous principal types */
342+ {"Principal", SAN_PRINCIPAL, true},
343+ {"stringOtherName", SAN_STRING_OTHER_NAME, true},
344+ {NULL, SAN_END, false}
345+};
346+
347 static bool is_dotted_decimal(const char *s, size_t len)
348 {
349 size_t c = 0;
350@@ -145,28 +198,6 @@ static int parse_krb5_get_eku_value(TALLOC_CTX *mem_ctx,
351 size_t e = 0;
352 int eku_list_size;
353
354- struct ext_key_usage {
355- const char *name;
356- const char *oid;
357- } ext_key_usage[] = {
358- /* RFC 3280 section 4.2.1.13 */
359- {"serverAuth", "1.3.6.1.5.5.7.3.1"},
360- {"clientAuth", "1.3.6.1.5.5.7.3.2"},
361- {"codeSigning", "1.3.6.1.5.5.7.3.3"},
362- {"emailProtection", "1.3.6.1.5.5.7.3.4"},
363- {"timeStamping", "1.3.6.1.5.5.7.3.8"},
364- {"OCSPSigning", "1.3.6.1.5.5.7.3.9"},
365-
366- /* RFC 4556 section 3.2.2 */
367- {"KPClientAuth", "1.3.6.1.5.2.3.4"},
368- {"pkinit", "1.3.6.1.5.2.3.4"},
369-
370- /* https://support.microsoft.com/en-us/help/287547/object-ids-associated-with-microsoft-cryptography*/
371- {"msScLogin", "1.3.6.1.4.1.311.20.2.2"},
372-
373- {NULL ,0}
374- };
375-
376 ret = get_comp_value(mem_ctx, ctx, cur, &comp);
377 if (ret != 0) {
378 CM_DEBUG(ctx, "Failed to parse regexp.");
379@@ -188,11 +219,11 @@ static int parse_krb5_get_eku_value(TALLOC_CTX *mem_ctx,
380 }
381
382 for (c = 0; eku_list[c] != NULL; c++) {
383- for (k = 0; ext_key_usage[k].name != NULL; k++) {
384-CM_DEBUG(ctx, "[%s][%s].", eku_list[c], ext_key_usage[k].name);
385- if (strcasecmp(eku_list[c], ext_key_usage[k].name) == 0) {
386+ for (k = 0; sss_ext_key_usage[k].name != NULL; k++) {
387+CM_DEBUG(ctx, "[%s][%s].", eku_list[c], sss_ext_key_usage[k].name);
388+ if (strcasecmp(eku_list[c], sss_ext_key_usage[k].name) == 0) {
389 comp->eku_oid_list[e] = talloc_strdup(comp->eku_oid_list,
390- ext_key_usage[k].oid);
391+ sss_ext_key_usage[k].oid);
392 if (comp->eku_oid_list[e] == NULL) {
393 ret = ENOMEM;
394 goto done;
395@@ -202,7 +233,7 @@ CM_DEBUG(ctx, "[%s][%s].", eku_list[c], ext_key_usage[k].name);
396 }
397 }
398
399- if (ext_key_usage[k].name == NULL) {
400+ if (sss_ext_key_usage[k].name == NULL) {
401 /* check for an dotted-decimal OID */
402 if (*(eku_list[c]) != '.') {
403 o = eku_list[c];
404@@ -252,23 +283,6 @@ static int parse_krb5_get_ku_value(TALLOC_CTX *mem_ctx,
405 size_t c;
406 size_t k;
407
408- struct key_usage {
409- const char *name;
410- uint32_t flag;
411- } key_usage[] = {
412- {"digitalSignature" , SSS_KU_DIGITAL_SIGNATURE},
413- {"nonRepudiation" , SSS_KU_NON_REPUDIATION},
414- {"keyEncipherment" , SSS_KU_KEY_ENCIPHERMENT},
415- {"dataEncipherment" , SSS_KU_DATA_ENCIPHERMENT},
416- {"keyAgreement" , SSS_KU_KEY_AGREEMENT},
417- {"keyCertSign" , SSS_KU_KEY_CERT_SIGN},
418- {"cRLSign" , SSS_KU_CRL_SIGN},
419- {"encipherOnly" , SSS_KU_ENCIPHER_ONLY},
420- {"decipherOnly" , SSS_KU_DECIPHER_ONLY},
421- {NULL ,0}
422- };
423-
424-
425 ret = get_comp_value(mem_ctx, ctx, cur, &comp);
426 if (ret != 0) {
427 CM_DEBUG(ctx, "Failed to get value.");
428@@ -283,14 +297,14 @@ static int parse_krb5_get_ku_value(TALLOC_CTX *mem_ctx,
429 }
430
431 for (c = 0; ku_list[c] != NULL; c++) {
432- for (k = 0; key_usage[k].name != NULL; k++) {
433- if (strcasecmp(ku_list[c], key_usage[k].name) == 0) {
434- comp->ku |= key_usage[k].flag;
435+ for (k = 0; sss_key_usage[k].name != NULL; k++) {
436+ if (strcasecmp(ku_list[c], sss_key_usage[k].name) == 0) {
437+ comp->ku |= sss_key_usage[k].flag;
438 break;
439 }
440 }
441
442- if (key_usage[k].name == NULL) {
443+ if (sss_key_usage[k].name == NULL) {
444 /* FIXME: add check for numerical ku */
445 CM_DEBUG(ctx, "No matching key usage found.");
446 ret = EINVAL;
447@@ -342,31 +356,6 @@ done:
448 return ret;
449 }
450
451-struct san_name {
452- const char *name;
453- enum san_opt san_opt;
454- bool is_string;
455-} san_names[] = {
456- /* https://www.ietf.org/rfc/rfc3280.txt section 4.2.1.7 */
457- {"otherName", SAN_OTHER_NAME, false},
458- {"rfc822Name", SAN_RFC822_NAME,true},
459- {"dNSName", SAN_DNS_NAME, true},
460- {"x400Address", SAN_X400_ADDRESS, false},
461- {"directoryName", SAN_DIRECTORY_NAME, true},
462- {"ediPartyName", SAN_EDIPART_NAME, false},
463- {"uniformResourceIdentifier", SAN_URI, true},
464- {"iPAddress", SAN_IP_ADDRESS, true},
465- {"registeredID", SAN_REGISTERED_ID, true},
466- /* https://www.ietf.org/rfc/rfc4556.txt section 3.2.2 */
467- {"pkinitSAN", SAN_PKINIT, true},
468- /* https://support.microsoft.com/en-us/help/287547/object-ids-associated-with-microsoft-cryptography */
469- {"ntPrincipalName", SAN_NT, true},
470- /* both previous principal types */
471- {"Principal", SAN_PRINCIPAL, true},
472- {"stringOtherName", SAN_STRING_OTHER_NAME, true},
473- {NULL, SAN_END, false}
474-};
475-
476 static int parse_krb5_get_san_option(TALLOC_CTX *mem_ctx,
477 struct sss_certmap_ctx *ctx,
478 const char **cur,
479@@ -388,12 +377,12 @@ static int parse_krb5_get_san_option(TALLOC_CTX *mem_ctx,
480 if (len == 0) {
481 c= SAN_PRINCIPAL;
482 } else {
483- for (c = 0; san_names[c].name != NULL; c++) {
484- if (strncasecmp(*cur, san_names[c].name, len) == 0) {
485+ for (c = 0; sss_san_names[c].name != NULL; c++) {
486+ if (strncasecmp(*cur, sss_san_names[c].name, len) == 0) {
487 break;
488 }
489 }
490- if (san_names[c].name == NULL) {
491+ if (sss_san_names[c].name == NULL) {
492 if (is_dotted_decimal(*cur, len)) {
493 c = SAN_STRING_OTHER_NAME;
494 *str_other_name_oid = talloc_strndup(mem_ctx, *cur, len);
495@@ -408,7 +397,7 @@ static int parse_krb5_get_san_option(TALLOC_CTX *mem_ctx,
496 }
497 }
498
499- *option = san_names[c].san_opt;
500+ *option = sss_san_names[c].san_opt;
501 *cur = end + 1;
502
503 return 0;
504@@ -432,7 +421,7 @@ static int parse_krb5_get_san_value(TALLOC_CTX *mem_ctx,
505 }
506 }
507
508- if (san_names[san_opt].is_string) {
509+ if (sss_san_names[san_opt].is_string) {
510 ret = parse_krb5_get_component_value(mem_ctx, ctx, cur, &comp);
511 if (ret != 0) {
512 goto done;
513--
5142.25.1
515
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-16 15:04:02 +0000