NAME¶

X509v3_addr_get_afi, X509v3_addr_get_range — parse helpers for the IP address delegation extension

SYNOPSIS¶

#include <openssl/x509v3.h>

unsigned
X509v3_addr_get_afi(const IPAddressFamily *af);

int
X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi, unsigned char *min, unsigned char *max, const int length);

DESCRIPTION¶

X509v3_addr_get_afi() returns the address family identifier (AFI) of af.

X509v3_addr_get_range() converts the minimum and maximum addresses in the address prefix or range aor from internal encoding to IP addresses in network byte order and places copies in the arrays min and max, of size length. The length must be large enough to accommodate an address for afi, which is at least 4 for IANA_AFI_IPV4 and at least 16 for IANA_AFI_IPV6.

RETURN VALUES¶

X509v3_addr_get_afi() returns the AFI encoded in af or 0 if af does not contain a valid AFI, or if the AFI is not IPv4 or IPv6.

X509v3_addr_get_range() returns the number of bytes copied into min and max or 0 on error. An error occurs if aor is malformed, if afi is not IANA_AFI_IPV4 or IANA_AFI_IPV6, if either min or max is NULL, or if length is smaller than 4 or 16, respectively.

SEE ALSO¶

crypto(3), inet_ntop(3), IPAddressRange_new(3), X509_new(3), X509v3_addr_add_inherit(3)

STANDARDS¶

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:

• section 2: IP Address delegation extension
• section 2.2.3.3: Element addressFamily
• section 2.2.3.7: Type IPAddressOrRange
• section 2.2.3.8: Element addressPrefix and Type IPAddress

Address Family Numbers, https://www.iana.org/assignments/address-family-numbers.

HISTORY¶

These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1.

BUGS¶

There is no accessor for the SAFI of af.

An error from X509v3_addr_get_afi() is indistinguishable from the reserved AFI 0 being set on af.

It is not entirely clear how a caller is supposed to obtain an IPAddressFamily object or an IPAddressOrRange object without reaching into various structs documented in IPAddressRange_new(3).