X509V3_ADDR_SUBSET(3)

📦 version 4.1.0, in opensuse-leap 16.0

✨ X509V3_ADDR_SUBSET 💅

okay so bestie, you know how you're trying to figure out if one set of network resources is like... contained inside another set? that's literally what this manual page is about. it's X509v3_addr_subset and X509v3_asid_subset, and it's giving "RFC 3779 subset relationship" energy. no cap, this is the whole vibe check for IP addresses and AS identifiers. 🦋

✨ SYNOPSIS ✨

#include <openssl/x509v3.h>

int
X509v3_addr_subset(IPAddrBlocks *child, IPAddrBlocks *parent);

int
X509v3_asid_subset(ASIdentifiers *child, ASIdentifiers *parent);

💖 DESCRIPTION 💖

okay so like, X509v3_addr_subset() is basically the main character here. what it does is figure out if all the IP address resources hanging out in child are also living their truth inside the corresponding resources in parent. cute, right?

but here's the thing, bestie — the implementation assumes but does not ensure that both child and parent are in canonical form, as described in X509v3_addr_is_canonical(3). so like, that's on you to make sure they're in formation. specifically: both child and parent are sorted appropriately and they contain at most one IPAddressFamily object per address family identifier (AFI) and optional subsequent address family identifier (SAFI).

⚠️ literally cannot stress this enough: the function is not gonna check this for you. you gotta bring a canonical child and parent or it's giving undefined vibes.

the checks happen in this exact order, iykyk:

  1. if child is NULL or identical to parent, then child is a subset of parent. and yes, a NULL parent is totally allowed for a NULL child. slay.
  2. if parent is NULL, then child is not a subset of parent. periodt.
  3. if X509v3_addr_inherits(3) determines that child inherits or that parent inherits, then child is not a subset of parent. like, inheritance ruins the subset vibe. 💀
  4. each address prefix or range in child must be a subset of an address prefix or range in parent, taking AFI and optional SAFI into account:
    • for each IPAddressFamily of child there must be an IPAddressFamily of parent with the same AFI and optional SAFI. like, they have to match, bestie.
    • since the address prefixes and ranges in corresponding IPAddressFamily objects in child and parent are sorted in ascending order, and do not overlap, they can be traversed simultaneously in linear time. iconic efficiency, honestly. for each prefix or range in child there must be a prefix or range in parent whose minimal address is smaller and whose maximal address is larger. it's giving "you fit inside me" energy. 🫶

if any of these steps fails, child is not a subset of parent. and that's the tea.

now for X509v3_asid_subset() — it does the exact same thing but for all AS identifier resources in child. are they contained in the corresponding resources in parent? that's the question.

the description for X509v3_addr_subset() applies mutatis mutandis, which is fancy latin for "same vibe, different body." specifically: child and parent must be in canonical form per X509v3_asid_is_canonical(3), but this is not enforced. so again, bring your own canonical form or don't come. 🙈

🌈 RETURN VALUES 🌈

X509v3_addr_subset() and X509v3_asid_subset() return 1 if and only if child is a subset of parent, otherwise they return 0. and if both child and parent are in canonical form, these functions cannot fail. no cap, that's the guarantee bestie. so if you're doing it right, it's always gonna slay. ✨

🎀 SEE ALSO 🎀

like, go read those if you wanna understand the whole ecosystem. iykyk.

🌸 STANDARDS 🌸

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers. that's the moment. that's the standard. periodt.

⭐ HISTORY ⭐

these functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1. so they're not new new, but they're still iconic. 💜

💌 okay bestie, that's the whole manual page. source is Debian, dated September 30, 2023, and the manual is X509V3_ADDR_SUBSET(3). go be a subset queen. mwah. 💋
📦 where this page comes from