From 528e5f07c3cdf830f575801298b14f633088932b Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 4 May 2026 12:04:53 +0200
Subject: [PATCH] openssl: Use functions for ASN.1 struct members hidden in
 OpenSSL 4

According to the docs, most ASN.1 types are just typedefs of ASN1_STRING.
---
 src/libstrongswan/plugins/openssl/openssl_util.c |  4 ++--
 src/libstrongswan/plugins/openssl/openssl_x509.c | 11 +++++++----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/libstrongswan/plugins/openssl/openssl_util.c b/src/libstrongswan/plugins/openssl/openssl_util.c
index e4ef09e83..67d3de00f 100644
--- a/src/libstrongswan/plugins/openssl/openssl_util.c
+++ b/src/libstrongswan/plugins/openssl/openssl_util.c
@@ -330,11 +330,11 @@ time_t openssl_asn1_to_time(const ASN1_TIME *time)
 	if (time)
 	{
 		chunk = openssl_asn1_str2chunk(time);
-		switch (time->type)
+		switch (ASN1_STRING_type(time))
 		{
 			case V_ASN1_UTCTIME:
 			case V_ASN1_GENERALIZEDTIME:
-				return asn1_to_time(&chunk, time->type);
+				return asn1_to_time(&chunk, ASN1_STRING_type(time));
 			default:
 				break;
 		}
diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c
index 3cedab7ee..06c8c20bf 100644
--- a/src/libstrongswan/plugins/openssl/openssl_x509.c
+++ b/src/libstrongswan/plugins/openssl/openssl_x509.c
@@ -77,6 +77,7 @@ static inline void X509_get0_signature(ASN1_BIT_STRING **psig, X509_ALGOR **palg
 #define X509v3_addr_is_canonical v3_addr_is_canonical
 #define X509_get0_notBefore X509_get_notBefore
 #define X509_get0_notAfter X509_get_notAfter
+#define ASN1_STRING_get0_data ASN1_STRING_data
 #endif
 
 typedef struct private_openssl_x509_t private_openssl_x509_t;
@@ -725,12 +726,14 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this,
 	usage = X509V3_EXT_d2i(ext);
 	if (usage)
 	{
-		if (usage->length > 0)
+		const u_char *data = ASN1_STRING_get0_data(usage);
+		int length = ASN1_STRING_length(usage);
+		if (length > 0)
 		{
-			int flags = usage->data[0];
-			if (usage->length > 1)
+			int flags = data[0];
+			if (length > 1)
 			{
-				flags |= usage->data[1] << 8;
+				flags |= data[1] << 8;
 			}
 			if (flags & X509v3_KU_CRL_SIGN)
 			{