[rpms/qpid-proton] rawhide: Resolves: PROTON-2937 for OpenSSL 4

[rpms/qpid-proton] rawhide: Resolves: PROTON-2937 for OpenSSL 4

[Hirotaka Wakabayashi]

A new commit has been pushed.

Repo   : rpms/qpid-proton
Branch : rawhide
Commit : ea29e03299563154542f07258fd343a54d65579b
Author : Hirotaka Wakabayashi <hiwkby@yahoo.com>
Date   : 2026-08-07T08:37:35+00:00
Stats  : +104/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/qpid-proton/c/ea29e03299563154542f07258fd343a54d65579b?branch=rawhide

Log:
Resolves: PROTON-2937 for OpenSSL 4

---
diff --git a/proton.patch b/proton.patch
index 7e715fc..9793735 100644
--- a/proton.patch
+++ b/proton.patch
@@ -63,3 +63,103 @@ diff -rc qpid-proton-0.40.0.orig/python/CMakeLists.txt qpid-proton-0.40.0/python
       add_dependencies(docs docs-py)
       install(DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/docs/"
               DESTINATION "${PROTON_SHARE}/docs/api-py"
+
+diff -rc qpid-proton-0.40.0/c/src/ssl/openssl.c qpid-proton-0.40.0.new/c/src/ssl/openssl.c
+*** qpid-proton-0.40.0/c/src/ssl/openssl.c	Wed Nov 20 17:19:36 2024
+--- qpid-proton-0.40.0.new/c/src/ssl/openssl.c	Fri Aug  7 07:36:26 2026
+***************
+*** 339,345 ****
+        GENERAL_NAME *name = sk_GENERAL_NAME_value( sans, i );
+        if (name->type == GEN_DNS) {
+          ASN1_STRING *asn1 = name->d.dNSName;
+!         if (asn1 && asn1->data && asn1->length) {
+            unsigned char *str;
+            int len = ASN1_STRING_to_UTF8( &str, asn1 );
+            if (len >= 0) {
+--- 339,345 ----
+        GENERAL_NAME *name = sk_GENERAL_NAME_value( sans, i );
+        if (name->type == GEN_DNS) {
+          ASN1_STRING *asn1 = name->d.dNSName;
+!         if (asn1 && ASN1_STRING_get0_data(asn1) && ASN1_STRING_length(asn1) > 0){
+            unsigned char *str;
+            int len = ASN1_STRING_to_UTF8( &str, asn1 );
+            if (len >= 0) {
+***************
+*** 354,364 ****
+    }
+  
+    /* if no general names match, try the CommonName from the subject */
+!   X509_NAME *name = X509_get_subject_name(cert);
+    int i = -1;
+    while (!matched && (i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0) {
+!     X509_NAME_ENTRY *ne = X509_NAME_get_entry(name, i);
+!     ASN1_STRING *name_asn1 = X509_NAME_ENTRY_get_data(ne);
+      if (name_asn1) {
+        unsigned char *str;
+        int len = ASN1_STRING_to_UTF8( &str, name_asn1);
+--- 354,364 ----
+    }
+  
+    /* if no general names match, try the CommonName from the subject */
+!   const X509_NAME *name = X509_get_subject_name(cert);
+    int i = -1;
+    while (!matched && (i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0) {
+!     const X509_NAME_ENTRY *ne = X509_NAME_get_entry(name, i);
+!     const ASN1_STRING *name_asn1 = X509_NAME_ENTRY_get_data(ne);
+      if (name_asn1) {
+        unsigned char *str;
+        int len = ASN1_STRING_to_UTF8( &str, name_asn1);
+***************
+*** 1558,1564 ****
+    if (!ssl->subject) {
+      X509 *cert = get_peer_certificate(ssl);
+      if (!cert) return NULL;
+!     X509_NAME *subject = X509_get_subject_name(cert);
+      if (!subject) return NULL;
+  
+      BIO *out = BIO_new(BIO_s_mem());
+--- 1558,1564 ----
+    if (!ssl->subject) {
+      X509 *cert = get_peer_certificate(ssl);
+      if (!cert) return NULL;
+!     const X509_NAME *subject = X509_get_subject_name(cert);
+      if (!subject) return NULL;
+  
+      BIO *out = BIO_new(BIO_s_mem());
+***************
+*** 1677,1693 ****
+    X509 *cert = get_peer_certificate(ssl);
+    if (!cert) return NULL;
+  
+!   X509_NAME *subject_name = X509_get_subject_name(cert);
+  
+    // TODO (gmurthy) - A server side cert subject field can have more than one common name like this - Subject: CN=www.domain1.com, CN=www.domain2.com, see https://bugzilla.mozilla.org/show_bug.cgi?id=380656
+    // For now, we will only return the first common name if there is more than one common name in the cert
+    int index = X509_NAME_get_index_by_NID(subject_name, openssl_field, -1);
+  
+    if (index > -1) {
+!     X509_NAME_ENTRY *ne = X509_NAME_get_entry(subject_name, index);
+      if(ne) {
+!       ASN1_STRING *name_asn1 = X509_NAME_ENTRY_get_data(ne);
+!       return (char *) name_asn1->data;
+      }
+    }
+  
+--- 1677,1693 ----
+    X509 *cert = get_peer_certificate(ssl);
+    if (!cert) return NULL;
+  
+!   const X509_NAME *subject_name = X509_get_subject_name(cert);
+  
+    // TODO (gmurthy) - A server side cert subject field can have more than one common name like this - Subject: CN=www.domain1.com, CN=www.domain2.com, see https://bugzilla.mozilla.org/show_bug.cgi?id=380656
+    // For now, we will only return the first common name if there is more than one common name in the cert
+    int index = X509_NAME_get_index_by_NID(subject_name, openssl_field, -1);
+  
+    if (index > -1) {
+!     const X509_NAME_ENTRY *ne = X509_NAME_get_entry(subject_name, index);
+      if(ne) {
+!       const ASN1_STRING *name_asn1 = X509_NAME_ENTRY_get_data(ne);
+!       return (const char *)ASN1_STRING_get0_data(name_asn1);
+      }
+    }
+  

diff --git a/qpid-proton.spec b/qpid-proton.spec
index 3716998..bb3bdbc 100644
--- a/qpid-proton.spec
+++ b/qpid-proton.spec
@@ -10,7 +10,7 @@
 
 Name:           qpid-proton
 Version:        0.40.0
-Release:        18%{?dist}
+Release:        19%{?dist}
 Summary:        A high performance, lightweight messaging library
 # Automatically converted from old format: ASL 2.0 - review is highly recommended.
 License:        Apache-2.0
@@ -313,6 +313,9 @@ rm -f  %{buildroot}%{proton_datadir}/CMakeLists.txt
 %check
 
 %changelog
+* Fri Aug 07 2026 Hirotaka Wakabayashi <hiwkby@yahoo.com> - 0.40.0-19
+- Resolves: PROTON-2937 for OpenSSL 4
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.40.0-18
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild