X509V3_ADDR_GET_RANGE(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💖 X509V3_ADDR_GET_RANGE(3) 💖

bestie, welcome to the Library Functions Manual page for two parse helpers, and they are lowkey iconic. This is all about the IP address delegation extension. iykyk. 🦋

✨ NAME ✨

X509v3_addr_get_afi, X509v3_addr_get_range — parse helpers for the IP address delegation extension. periodt.

🎀 SYNOPSIS 🎀

library “libcrypto” #include <openssl/x509v3.h>

unsigned
X509v3_addr_get_afi(const IPAddressFamily *af);

int
X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi,
    unsigned char *min, unsigned char *max, const int length);

🔥 DESCRIPTION 🔥

okay so X509v3_addr_get_afi() returns the address family identifier (AFI) of af. That's it. no cap. ✨

X509v3_addr_get_range() is the main character here. It converts the minimum and maximum addresses in the address prefix or range aor from internal encoding to IP addresses in network byte order, and places copies in the arrays min and max, of size length. The length must be large enough to accommodate an address for afi, which is at least 4 for IANA_AFI_IPV4 and at least 16 for IANA_AFI_IPV6. slay. 💅

💜 RETURN VALUES 💜

X509v3_addr_get_afi() returns the AFI encoded in af or 0 if af does not contain a valid AFI, or if the AFI is not IPv4 or IPv6. lowkey important: 0 can mean “no valid AFI” here.

X509v3_addr_get_range() returns the number of bytes copied into min and max or 0 on error. An error occurs if aor is malformed, if afi is not IANA_AFI_IPV4 or IANA_AFI_IPV6, if either min or max is NULL, or if length is smaller than 4 or 16, respectively. 🫶

🦋 SEE ALSO 🦋

🌈 STANDARDS 🌈

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:

  • section 2: IP Address delegation extension
  • section 2.2.3.3: Element addressFamily
  • section 2.2.3.7: Type IPAddressOrRange
  • section 2.2.3.8: Element addressPrefix and Type IPAddress

Address Family Numbers, https://www.iana.org/assignments/address-family-numbers.

🧚 HISTORY 🧚

These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1. iconic behavior, honestly. 👑

💀 BUGS 💀

  • There is no accessor for the SAFI of af. bestie, you heard me. 😭
  • An error from X509v3_addr_get_afi() is indistinguishable from the reserved AFI 0 being set on af.
  • It is not entirely clear how a caller is supposed to obtain an IPAddressFamily object or an IPAddressOrRange object without reaching into various structs documented in IPAddressRange_new(3).

mwah 💋 this page is from Debian, dated June 8, 2025, and it's the X509V3_ADDR_GET_RANGE(3) manual page. byeee 🫶

📦 where this page comes from