Commit 83762006ad for strongswan.org

commit 83762006addc08e8d29eb783be8fa47cb7d34c71
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Oct 26 12:23:23 2026 +0100

    github: Use OpenSSL 4.1.0 for tests

diff --git a/scripts/test.sh b/scripts/test.sh
index bf6620ded9..5c77401e21 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -214,7 +214,7 @@ openssl*)
 		use_custom_openssl $1
 	elif test "$TEST" = "openssl-4"; then
 		DEPS=""
-		SSL_REV=openssl-4.0.3
+		SSL_REV=openssl-4.1.0
 		use_custom_openssl $1
 	elif test "$TEST" = "openssl-awslc"; then
 		DEPS="cmake ninja-build golang"
diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c
index 953b69c0db..d638c41fc8 100644
--- a/src/libstrongswan/plugins/openssl/openssl_crl.c
+++ b/src/libstrongswan/plugins/openssl/openssl_crl.c
@@ -61,6 +61,11 @@ static inline void X509_CRL_get0_signature(const X509_CRL *crl, ASN1_BIT_STRING
 #define X509_CRL_get0_nextUpdate(c) X509_CRL_get_nextUpdate(c)
 #endif

+/* this was added with 4.1.0 and deprecated immediately */
+#if OPENSSL_VERSION_NUMBER < 0x40100000L
+#define ASN1_STRING_get_length(s) ASN1_STRING_length(s)
+#endif
+
 typedef struct private_openssl_crl_t private_openssl_crl_t;

 /**
@@ -193,7 +198,7 @@ METHOD(enumerator_t, crl_enumerate, bool,
 			if (crlrsn)
 			{
 				if (ASN1_STRING_type(crlrsn) == V_ASN1_ENUMERATED &&
-					ASN1_STRING_length(crlrsn) == 1)
+					ASN1_STRING_get_length(crlrsn) == 1)
 				{
 					*reason = *ASN1_STRING_get0_data(crlrsn);
 				}
diff --git a/src/libstrongswan/plugins/openssl/openssl_util.c b/src/libstrongswan/plugins/openssl/openssl_util.c
index ae72710fb3..c09d2a38d9 100644
--- a/src/libstrongswan/plugins/openssl/openssl_util.c
+++ b/src/libstrongswan/plugins/openssl/openssl_util.c
@@ -39,6 +39,11 @@
 #define ASN1_STRING_get0_data(a) ASN1_STRING_data((ASN1_STRING*)a)
 #endif

+/* this was added with 4.1.0 and deprecated immediately */
+#if OPENSSL_VERSION_NUMBER < 0x40100000L
+#define ASN1_STRING_get_length(s) ASN1_STRING_length(s)
+#endif
+
 #if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
 /**
  * Chunk for an ASN.1 Integer with a value of 0.
@@ -263,7 +268,7 @@ chunk_t openssl_asn1_str2chunk(const ASN1_STRING *asn1)
 	if (asn1)
 	{
 		return chunk_create((u_char*)ASN1_STRING_get0_data(asn1),
-							ASN1_STRING_length(asn1));
+							ASN1_STRING_get_length(asn1));
 	}
 	return chunk_empty;
 }
diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c
index 06c8c20bfe..b1ea1fc898 100644
--- a/src/libstrongswan/plugins/openssl/openssl_x509.c
+++ b/src/libstrongswan/plugins/openssl/openssl_x509.c
@@ -80,6 +80,11 @@ static inline void X509_get0_signature(ASN1_BIT_STRING **psig, X509_ALGOR **palg
 #define ASN1_STRING_get0_data ASN1_STRING_data
 #endif

+/* this was added with 4.1.0 and deprecated immediately */
+#if OPENSSL_VERSION_NUMBER < 0x40100000L
+#define ASN1_STRING_get_length(s) ASN1_STRING_length(s)
+#endif
+
 typedef struct private_openssl_x509_t private_openssl_x509_t;

 /**
@@ -727,7 +732,7 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this,
 	if (usage)
 	{
 		const u_char *data = ASN1_STRING_get0_data(usage);
-		int length = ASN1_STRING_length(usage);
+		int length = ASN1_STRING_get_length(usage);
 		if (length > 0)
 		{
 			int flags = data[0];