new file mode 100644
@@ -0,0 +1,78 @@
+From e2c69353ed1702c22eac2191b67977853d7d4277 Mon Sep 17 00:00:00 2001
+From: Antonio Torres <antorres@redhat.com>
+Date: Tue, 5 May 2026 14:42:27 +0200
+Subject: [PATCH] Use ASN1_STRING functions for OpenSSL 4.0 compat
+
+Use ASN1_STRING accessor functions instead of direct field access
+for ASN1_IA5STRING, ASN1_INTEGER, and ASN1_TIME structures.
+
+This fixes compatibility with OpenSSL 4.0.
+
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+Upstream-Status: Submitted [https://github.com/FreeRADIUS/freeradius-server/pull/5841]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/main/tls.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/src/main/tls.c b/src/main/tls.c
+index bcb65cecca8b..211eb0f9ff9d 100644
+--- a/src/main/tls.c
++++ b/src/main/tls.c
+@@ -2568,7 +2568,7 @@ static int ocsp_parse_cert_url(X509 *cert, char **host_out, char **port_out,
+ if (OBJ_obj2nid(ad->method) != NID_ad_OCSP) continue;
+ if (ad->location->type != GEN_URI) continue;
+
+- if (OCSP_parse_url((char *) ad->location->d.ia5->data, host_out,
++ if (OCSP_parse_url((const char *) ASN1_STRING_get0_data(ad->location->d.ia5), host_out,
+ port_out, path_out, is_https)) {
+ ret = 1;
+ break;
+@@ -3050,12 +3050,14 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
+ * we're at the client or issuing certificate.
+ */
+ if (certs &&
+- (lookup <= 1) && sn && ((size_t) sn->length < (sizeof(buf) / 2))) {
++ (lookup <= 1) && sn && ((size_t) ASN1_STRING_length(sn) < (sizeof(buf) / 2))) {
+ char *p = buf;
+ int i;
++ int sn_len = ASN1_STRING_length(sn);
++ const unsigned char *sn_data = ASN1_STRING_get0_data(sn);
+
+- for (i = 0; i < sn->length; i++) {
+- sprintf(p, "%02x", (unsigned int)sn->data[i]);
++ for (i = 0; i < sn_len; i++) {
++ sprintf(p, "%02x", (unsigned int)sn_data[i]);
+ p += 2;
+ }
+ vp = fr_pair_make(talloc_ctx, certs, cert_attr_names[FR_TLS_SERIAL][lookup], buf, T_OP_SET);
+@@ -3068,9 +3070,11 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
+ buf[0] = '\0';
+ asn_time = X509_get_notAfter(client_cert);
+ if (certs && (lookup <= 1) && asn_time &&
+- (asn_time->length < (int) sizeof(buf))) {
+- memcpy(buf, (char*) asn_time->data, asn_time->length);
+- buf[asn_time->length] = '\0';
++ (ASN1_STRING_length(asn_time) < (int) sizeof(buf))) {
++ int time_len = ASN1_STRING_length(asn_time);
++ const unsigned char *time_data = ASN1_STRING_get0_data(asn_time);
++ memcpy(buf, time_data, time_len);
++ buf[time_len] = '\0';
+ vp = fr_pair_make(talloc_ctx, certs, cert_attr_names[FR_TLS_EXPIRATION][lookup], buf, T_OP_SET);
+ rdebug_pair(L_DBG_LVL_2, request, vp, NULL);
+ }
+@@ -3081,9 +3085,11 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
+ buf[0] = '\0';
+ asn_time = X509_get_notBefore(client_cert);
+ if (certs && (lookup <= 1) && asn_time &&
+- (asn_time->length < (int) sizeof(buf))) {
+- memcpy(buf, (char*) asn_time->data, asn_time->length);
+- buf[asn_time->length] = '\0';
++ (ASN1_STRING_length(asn_time) < (int) sizeof(buf))) {
++ int time_len = ASN1_STRING_length(asn_time);
++ const unsigned char *time_data = ASN1_STRING_get0_data(asn_time);
++ memcpy(buf, time_data, time_len);
++ buf[time_len] = '\0';
+ vp = fr_pair_make(talloc_ctx, certs, cert_attr_names[FR_TLS_VALID_SINCE][lookup], buf, T_OP_SET);
+ rdebug_pair(L_DBG_LVL_2, request, vp, NULL);
+ }
@@ -39,6 +39,7 @@ SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.2.x;tag=$
file://0016-version.c-don-t-print-build-flags.patch \
file://0017-Add-acinclude.m4-to-include-required-macros.patch \
file://0018-Fix-permissions-after-generating-certificates-with-m.patch \
+ file://0001-Use-ASN1_STRING-functions-for-OpenSSL-4.0-compat.patch \
"
raddbdir = "${sysconfdir}/${MLPREFIX}raddb"
OpenSSL 4.0 makes ASN1_STRING opaque. Use ASN1_STRING accessor functions. Upstream-Status: Submitted [https://github.com/FreeRADIUS/freeradius-server/pull/5841] Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- ...ING-functions-for-OpenSSL-4.0-compat.patch | 78 +++++++++++++++++++ .../freeradius/freeradius_3.2.10.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-connectivity/freeradius/freeradius/0001-Use-ASN1_STRING-functions-for-OpenSSL-4.0-compat.patch