What were you trying to do that didn't work?

Libreswan expected IPv4 address in gntoid() function while both IPv4 and IPv6 addresses are allowed in SAN. See

• https://github.com/libreswan/libreswan/blob/v4.12/programs/pluto/x509.c#L352

Issue was reported as https://github.com/libreswan/libreswan/issues/1321. This is not a regression, it was always like that.

Please provide the package NVR for which bug is seen:

libreswan-4.12-1.el9

How reproducible:

100%

Steps to reproduce

1. Create certificates using using SAN with IP using IPv6 addresses:

# certutil -v 120 -S -k rsa -c "CA" -n "worker1" -s "CN=worker1" -v 12 -t "u,u,u" -d sql:/var/lib/ipsec/nss --extSAN "ip:<ipv6>"

1. Load the following connection:

# cat /etc/ipsec.d/nstest.conf 
conn worker1-VM
	type=transport
        left=<ipv6>
        leftid=%fromcert
        leftrsasigkey=%cert
        leftcert=worker1
        hostaddrfamily=ipv6
        clientaddrfamily=ipv6
        right=<ipv6>
        rightid=%fromcert
        rightrsasigkey=%cert
	ike=aes_gcm256-sha2_256
	esp=aes_gcm256
	ikev2=insist

# ipsec auto --add worker1-VM

Expected results

Connection is loaded correctly, no warnings. Connection can be established.

Actual results

...

1. ipsec auto --add worker1-VM
   002 "worker1-VM": terminating SAs using this connection
   002 "worker1-VM": warning: gntoid() failed to initaddr(): IPv4 address must be exactly 4 bytes
   002 "worker1-VM": added IKEv2 connection