Commit 2092fe6722 for strongswan.org

commit 2092fe67220e0b5b54ea504c8523a64b0e4bf04a
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Thu Jul 23 14:58:18 2026 +0200

    Revert "Recognize critical IssuingDistributionPoint CRL extension"

    It might not be a good idea to blindly accept such extensions.  A scoped
    CRL could be accepted for the wrong scope.  So just reject them again.

    This reverts commit 126778679f9edc8ff2de38feddaf84759936939d.

diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c
index 97072ec2e1..953b69c0db 100644
--- a/src/libstrongswan/plugins/openssl/openssl_crl.c
+++ b/src/libstrongswan/plugins/openssl/openssl_crl.c
@@ -543,10 +543,6 @@ static bool parse_extensions(private_openssl_crl_t *this)
 				case NID_freshest_crl:
 					ok = openssl_parse_crlDistributionPoints(ext, this->crl_uris);
 					break;
-				case NID_issuing_distribution_point:
-					/* TODO support of IssuingDistributionPoints */
-					ok = TRUE;
-					break;
 				default:
 					ok = X509_EXTENSION_get_critical(ext) == 0 ||
 						 !lib->settings->get_bool(lib->settings,
diff --git a/src/libstrongswan/plugins/x509/x509_crl.c b/src/libstrongswan/plugins/x509/x509_crl.c
index 9dbb7b5f2d..178bdc0a9f 100644
--- a/src/libstrongswan/plugins/x509/x509_crl.c
+++ b/src/libstrongswan/plugins/x509/x509_crl.c
@@ -315,9 +315,6 @@ static bool parse(private_x509_crl_t *this)
 						}
 						this->baseCrlNumber = object;
 						break;
-					case OID_ISSUING_DIST_POINT:
-						/* TODO support of IssuingDistributionPoints */
-						break;
 					default:
 						if (critical && lib->settings->get_bool(lib->settings,
 							"%s.x509.enforce_critical", TRUE, lib->ns))