From b68c9948881ad9fa3414bdf021ed1ad97d4a0128 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Sun, 11 Oct 2026 15:00:28 +0200 Subject: [PATCH] package/redis: Fix build with OpenSSL 4.0.0 Signed-off-by: Bernd Kuhls Cc: Daniel Price Cc: Titouan Christophe Signed-off-by: Thomas Petazzoni --- ...ecated-X509_NAME_get_text_by_NID-API.patch | 101 ++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 package/redis/0004-tls-replace-deprecated-X509_NAME_get_text_by_NID-API.patch diff --git a/package/redis/0004-tls-replace-deprecated-X509_NAME_get_text_by_NID-API.patch b/package/redis/0004-tls-replace-deprecated-X509_NAME_get_text_by_NID-API.patch new file mode 100644 index 0000000000..1b9238279d --- /dev/null +++ b/package/redis/0004-tls-replace-deprecated-X509_NAME_get_text_by_NID-API.patch @@ -0,0 +1,101 @@ +From 8bc1c4e147761e7c9d6ff1bb92248b9d4dda43ab Mon Sep 17 00:00:00 2001 +From: Arpit Jaswal +Date: Wed, 30 Sep 2026 07:56:36 -0400 +Subject: [PATCH] tls: replace deprecated X509_NAME_get_text_by_NID API + (#15227) + +Fixes #15221 + +OpenSSL 4.0 deprecates `X509_NAME_get_text_by_NID()`. With our +`-Werror=deprecated-declarations`, a `BUILD_TLS=yes` build against +OpenSSL 4 +headers fails: + +tls.c:713: error: 'X509_NAME_get_text_by_NID' is deprecated: Since +OpenSSL 4.0 + +Homebrew's `openssl` formula points at `openssl@4` since 2026-09-28, so +this is +now the default macOS build. + +## Fix + +Extract the certificate subject field with +`X509_NAME_get_index_by_NID()`, +`X509_NAME_get_entry()`, `X509_NAME_ENTRY_get_data()` and +`ASN1_STRING_to_UTF8()` instead. + +* The value is still built with `sdstrynewlen()` from the returned +length, so +the embedded-NUL CN fix (d22066d09) is preserved and empty fields are +still + rejected. +* BMPString/UniversalString names are now decoded to UTF-8 instead of +copied +as raw bytes, and the fixed 256-byte buffer that silently truncated +longer + names is gone. +* The intermediate OpenSSL objects (subject, entry, value) are not held +in +typed locals: OpenSSL 1.0.2/1.1.1 take non-const `X509_NAME` parameters, +while OpenSSL 4.0 returns const pointers from `X509_get_subject_name()`, + `X509_NAME_get_entry()` and `X509_NAME_ENTRY_get_data()`. No single +declaration is warning-free on both ends, so the calls are chained; +within + any one version each return type matches the next parameter type. + +Upstream: https://github.com/redis/redis/commit/8bc1c4e147761e7c9d6ff1bb92248b9d4dda43ab + +Signed-off-by: Bernd Kuhls +--- + src/tls.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +diff --git a/src/tls.c b/src/tls.c +index 4e7d91510..18b780be7 100644 +--- a/src/tls.c ++++ b/src/tls.c +@@ -704,16 +704,32 @@ static sds getCertFieldByName(X509 *cert, const char *field) { + + if (nid == -1) return NULL; + +- X509_NAME *subject = X509_get_subject_name(cert); +- if (!subject) return NULL; +- +- /* The name may contain embedded NULs, so use the returned length, not ++ /* The subject (e.g. "CN=alice, O=redis"), its entries and their values ++ * are all owned by the cert, don't free them. They are deliberately not ++ * held in typed locals: the const-ness of these accessors differs between ++ * OpenSSL 1.0.2, 3.x and 4.0, and chaining the calls keeps every version ++ * warning-free. */ ++ if (!X509_get_subject_name(cert)) return NULL; ++ ++ /* Find the first entry of type nid (e.g. CN), searching from the start ++ * (-1). Returns its index, or -1 if not found. */ ++ int index = X509_NAME_get_index_by_NID(X509_get_subject_name(cert), nid, -1); ++ if (index < 0) return NULL; ++ ++ /* Decode the entry's ASN.1 string (UTF8String, BMPString, ...) into UTF-8. ++ * The name may contain embedded NULs, so use the returned length, not + * strlen, to build the proper binary-safe string. */ +- char buf[256]; +- int len = X509_NAME_get_text_by_NID(subject, nid, buf, sizeof(buf)); +- if (len <= 0) return NULL; ++ unsigned char *utf8 = NULL; ++ int len = ASN1_STRING_to_UTF8(&utf8, ++ X509_NAME_ENTRY_get_data(X509_NAME_get_entry(X509_get_subject_name(cert), index))); ++ if (len <= 0) { ++ OPENSSL_free(utf8); ++ return NULL; ++ } + +- return sdstrynewlen(buf, len); ++ sds result = sdstrynewlen(utf8, len); ++ OPENSSL_free(utf8); ++ return result; + } + + sds tlsGetPeerUsername(connection *conn_) { +-- +2.47.3 +