X509V3_ADDR_GET_RANGE(3)

hey bestie 💖 you found the X509V3_ADDR_GET_RANGE(3) page — yes, the manual name is right there in the title, and this is a Library Functions Manual moment. We're decoding the parse helpers for the IP address delegation extension, and they're lowkey iconic 🎀

🌸 NAME 🌸

X509v3_addr_get_afi, X509v3_addr_get_range — parse helpers for the IP address delegation extension. These two are the duo we're obsessing over ✨

✨ SYNOPSIS ✨

#include <openssl/x509v3.h>

unsigned
X509v3_addr_get_afi(const IPAddressFamily *af);

int
X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi,
    unsigned char *min, unsigned char *max, const int length);

💅 DESCRIPTION 💅

okay so X509v3_addr_get_afi() is giving "tell me the address family identifier (AFI) of af" energy. That's it. It returns the AFI of af. 💫

X509v3_addr_get_range() is the main character here: it converts the minimum and maximum addresses in the address prefix or range aor from internal encoding to IP addresses in network byte order, then places copies in the arrays min and max, of size length. The length must be large enough to accommodate an address for afi — that's at least 4 for IANA_AFI_IPV4 and at least 16 for IANA_AFI_IPV6. No cap. 🫶

🎀 RETURN VALUES 🎀

X509v3_addr_get_afi() returns the AFI encoded in af, or 0 if af does not contain a valid AFI, or if the AFI is not IPv4 or IPv6. 🦋

X509v3_addr_get_range() returns the number of bytes copied into min and max, or 0 on error. An error occurs if aor is malformed, if afi is not IANA_AFI_IPV4 or IANA_AFI_IPV6, if either min or max is NULL, or if length is smaller than 4 or 16, respectively. Periodt. 💅

🦋 SEE ALSO 🦋

• crypto(3)
• inet_ntop(3)
• IPAddressRange_new(3)
• X509_new(3)
• X509v3_addr_add_inherit(3)

🌈 STANDARDS 🌈

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:

• section 2: IP Address delegation extension
• section 2.2.3.3: Element addressFamily
• section 2.2.3.7: Type IPAddressOrRange
• section 2.2.3.8: Element addressPrefix and Type IPAddress

Also: Address Family Numbers, https://www.iana.org/assignments/address-family-numbers. 🌟

💜 HISTORY 💜

These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1. history slay ✨

💀 BUGS 💀

okay bestie, the caveats are real:

• There is no accessor for the SAFI of af.
• An error from X509v3_addr_get_afi() is indistinguishable from the reserved AFI 0 being set on af.
• It is not entirely clear how a caller is supposed to obtain an IPAddressFamily object or an IPAddressOrRange object without reaching into various structs documented in IPAddressRange_new(3).

---

byeeee 🫶 this lovely little page is from Debian, dated September 30, 2023 — mwah 💋