From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 18 Oct 2023 16:27:07 +0000 (+0200)
Subject: openssl: Add support for IP address nameConstraints
X-Git-Tag: 5.9.12rc1~8^2~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1c3096fe50b59ae892a14c260d3e287ec87aa36c;p=thirdparty%2Fstrongswan.git

openssl: Add support for IP address nameConstraints
---

diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c
index f7bef0d031..db227c5485 100644
--- a/src/libstrongswan/plugins/openssl/openssl_x509.c
+++ b/src/libstrongswan/plugins/openssl/openssl_x509.c
@@ -224,10 +224,20 @@ static identification_t *general_name2id(GENERAL_NAME *name)
 			{
 				return identification_create_from_encoding(ID_IPV4_ADDR, chunk);
 			}
+			if (chunk.len == 8)
+			{
+				return identification_create_from_encoding(ID_IPV4_ADDR_SUBNET,
+														   chunk);
+			}
 			if (chunk.len == 16)
 			{
 				return identification_create_from_encoding(ID_IPV6_ADDR, chunk);
 			}
+			if (chunk.len == 32)
+			{
+				return identification_create_from_encoding(ID_IPV6_ADDR_SUBNET,
+														   chunk);
+			}
 			return NULL;
 		}
 		case GEN_DIRNAME :