A2I_IPADD(3)

💖 NAME 💖

okay bestie, this is the a2i_IPADD(3) page from the Library Functions Manual, and it's literally the whole squad: a2i_ipadd, a2i_IPADDRESS, and a2i_IPADDRESS_NC. Their job? Parse Internet Protocol addresses into ASN.1 OCTET STRINGs for X.509. periodt. 🎀

✨ SYNOPSIS ✨

#include <openssl/x509v3.h>

int
a2i_ipadd(unsigned char *ipout, const char *ipasc);

ASN1_OCTET_STRING *
a2i_IPADDRESS(const char *ipasc);

ASN1_OCTET_STRING *
a2i_IPADDRESS_NC(const char *ipasc);

yup, that's the include and the three signatures, exactly as they are. no funny business. 💅

🎀 DESCRIPTION 🎀

a2i_ipadd() and a2i_IPADDRESS() parse the string ipasc, which contains an IPv4 or IPv6 address in one of these formats:

d.d.d.d
x:x:x:x:x:x:x:x (exactly 8 words)
(x:)*x::x(:x)* (less than 8 words)
(x:)*x:: (less than 8 words)
::x(:x)* (less than 8 words)
::
(x:)*d.d.d.d (up to 6 hexadecimal words, :: can be used)

where each d is a non-negative decimal number less than 256 with one, two, or three digits, and each x is a non-negative hexadecimal number with one, two, three, or four digits. both lower case a-f and upper case A-F can be used. slay. ✨

a2i_ipadd() stores the bytes of the address in network byte order (big endian), starting at ipout. the caller is responsible for providing sufficient space — and the recommendation is important, bestie: always provide a buffer of at least 16 bytes, even if you're expecting an IPv4 address, to avoid buffer overruns in case ipasc is malformed. 💅

a2i_IPADDRESS() stores the address in a newly allocated ASN.1 OCTET STRING. cute and self-contained. 🦋

a2i_IPADDRESS_NC() expects ipasc to contain two addresses of the same address family in the above form, separated by a slash (/) character. it stores the concatenation of both addresses in a newly allocated ASN.1 OCTET STRING, which is typically used for address/mask pairs in name constraint extensions of CA certificates. iykyk. 👑

💅 RETURN VALUES 💅

a2i_ipadd() returns the number of bytes written to ipout in case of success — i.e. 4 for an IPv4 address or 16 for an IPv6 address — or 0 if parsing failed. 😭

a2i_IPADDRESS() and a2i_IPADDRESS_NC() return the new object, or NULL if parsing or memory allocation failed. 💀

🦋 SEE ALSO 🦋

the linked crew, bestie:

• a2i_ASN1_STRING(3)
• ASN1_OCTET_STRING_new(3)
• ASN1_OCTET_STRING_set(3)
• GENERAL_NAME_new(3)
• IPAddressRange_new(3)
• NAME_CONSTRAINTS_new(3)
• s2i_ASN1_OCTET_STRING(3)
• X509_EXTENSION_new(3)

🌈 STANDARDS 🌈

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile — and specifically these sections, no cap:

• section 4.2.1.6: Subject Alternative Name
• section 4.2.1.10: Name Constraints

⭐ HISTORY ⭐

a2i_IPADDRESS() and a2i_IPADDRESS_NC() first appeared in OpenSSL 0.9.8, and a2i_ipadd() in OpenSSL 0.9.8e. they have been available since OpenBSD 4.5. history was made, and honestly? iconic. 🫶

💀 CAVEATS 💀

bestie, heed this: while some syntax errors are caught, only minimal validation takes place, and these functions often return objects that make no sense — in particular in the context of IPv6. 😭

for example, the trailing :d.d.d.d syntax can be appended to a hexadecimal part that results in twelve arbitrary bytes. so yeah, vibe check before you trust the output, fr fr.

---

mwah 💋 this page comes from Debian, dated December 27, 2024 — that's the source/version and date sign-off, bestie. take care and parse responsibly! 🌸