package/redis: Fix build with OpenSSL 4.0.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Cc: Daniel Price <daniel.price@gmail.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/redis/0004-tls-replace-deprecated-X509_NAME_get_text_by_NID-API.patch

@@ -0,0 +1,101 @@
+From 8bc1c4e147761e7c9d6ff1bb92248b9d4dda43ab Mon Sep 17 00:00:00 2001
+From: Arpit Jaswal <iamarpitjaswal@gmail.com>
+Date: Wed, 30 Sep 2026 07:56:36 -0400
+Subject: [PATCH] tls: replace deprecated X509_NAME_get_text_by_NID API
+ (#15227)
+
+Fixes #15221
+
+OpenSSL 4.0 deprecates `X509_NAME_get_text_by_NID()`. With our
+`-Werror=deprecated-declarations`, a `BUILD_TLS=yes` build against
+OpenSSL 4
+headers fails:
+
+tls.c:713: error: 'X509_NAME_get_text_by_NID' is deprecated: Since
+OpenSSL 4.0
+
+Homebrew's `openssl` formula points at `openssl@4` since 2026-09-28, so
+this is
+now the default macOS build.
+
+## Fix
+
+Extract the certificate subject field with
+`X509_NAME_get_index_by_NID()`,
+`X509_NAME_get_entry()`, `X509_NAME_ENTRY_get_data()` and
+`ASN1_STRING_to_UTF8()` instead.
+
+* The value is still built with `sdstrynewlen()` from the returned
+length, so
+the embedded-NUL CN fix (d22066d09) is preserved and empty fields are
+still
+  rejected.
+* BMPString/UniversalString names are now decoded to UTF-8 instead of
+copied
+as raw bytes, and the fixed 256-byte buffer that silently truncated
+longer
+  names is gone.
+* The intermediate OpenSSL objects (subject, entry, value) are not held
+in
+typed locals: OpenSSL 1.0.2/1.1.1 take non-const `X509_NAME` parameters,
+while OpenSSL 4.0 returns const pointers from `X509_get_subject_name()`,
+  `X509_NAME_get_entry()` and `X509_NAME_ENTRY_get_data()`. No single
+declaration is warning-free on both ends, so the calls are chained;
+within
+  any one version each return type matches the next parameter type.
+
+Upstream: https://github.com/redis/redis/commit/8bc1c4e147761e7c9d6ff1bb92248b9d4dda43ab
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ src/tls.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/src/tls.c b/src/tls.c
+index 4e7d91510..18b780be7 100644
+--- a/src/tls.c
++++ b/src/tls.c
+@@ -704,16 +704,32 @@ static sds getCertFieldByName(X509 *cert, const char *field) {
+ 
+     if (nid == -1) return NULL;
+ 
+-    X509_NAME *subject = X509_get_subject_name(cert);
+-    if (!subject) return NULL;
+-
+-    /* The name may contain embedded NULs, so use the returned length, not
++    /* The subject (e.g. "CN=alice, O=redis"), its entries and their values
++     * are all owned by the cert, don't free them. They are deliberately not
++     * held in typed locals: the const-ness of these accessors differs between
++     * OpenSSL 1.0.2, 3.x and 4.0, and chaining the calls keeps every version
++     * warning-free. */
++    if (!X509_get_subject_name(cert)) return NULL;
++
++    /* Find the first entry of type nid (e.g. CN), searching from the start
++     * (-1). Returns its index, or -1 if not found. */
++    int index = X509_NAME_get_index_by_NID(X509_get_subject_name(cert), nid, -1);
++    if (index < 0) return NULL;
++
++    /* Decode the entry's ASN.1 string (UTF8String, BMPString, ...) into UTF-8.
++     * The name may contain embedded NULs, so use the returned length, not
+      * strlen, to build the proper binary-safe string. */
+-    char buf[256];
+-    int len = X509_NAME_get_text_by_NID(subject, nid, buf, sizeof(buf));
+-    if (len <= 0) return NULL;
++    unsigned char *utf8 = NULL;
++    int len = ASN1_STRING_to_UTF8(&utf8,
++        X509_NAME_ENTRY_get_data(X509_NAME_get_entry(X509_get_subject_name(cert), index)));
++    if (len <= 0) {
++        OPENSSL_free(utf8);
++        return NULL;
++    }
+ 
+-    return sdstrynewlen(buf, len);
++    sds result = sdstrynewlen(utf8, len);
++    OPENSSL_free(utf8);
++    return result;
+ }
+ 
+ sds tlsGetPeerUsername(connection *conn_) {
+-- 
+2.47.3
+