NAME
X509v3_addr_get_afi,
X509v3_addr_get_range —
parse helpers for the IP address
delegation extension
SYNOPSIS
#include
<openssl/x509v3.h>
unsigned
X509v3_addr_get_afi(const
IPAddressFamily *af);
int
X509v3_addr_get_range(IPAddressOrRange
*aor, const unsigned afi,
unsigned char *min, unsigned char
*max, const int length);
DESCRIPTION
X509v3_addr_get_afi()
returns the address family identifier (AFI) of af.
X509v3_addr_get_range()
converts the minimum and maximum addresses in the address prefix or range
aor from internal encoding to IP addresses in network
byte order and places copies in the arrays min and
max, of size length. The
length must be large enough to accommodate an address
for afi, which is at least 4 for
IANA_AFI_IPV4 and at least 16 for
IANA_AFI_IPV6.
RETURN VALUES
X509v3_addr_get_afi() returns the AFI
encoded in af or 0 if af does
not contain a valid AFI, or if the AFI is not IPv4 or IPv6.
X509v3_addr_get_range() returns the number
of bytes copied into min and max
or 0 on error. An error occurs if aor is malformed, if
afi is not IANA_AFI_IPV4 or
IANA_AFI_IPV6, if either min
or max is NULL, or if
length is smaller than 4 or 16, respectively.
SEE ALSO
crypto(3), inet_ntop(3), IPAddressRange_new(3), X509_new(3), X509v3_addr_add_inherit(3)
STANDARDS
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:
- section 2: IP Address delegation extension
- section 2.2.3.3: Element addressFamily
- section 2.2.3.7: Type IPAddressOrRange
- section 2.2.3.8: Element addressPrefix and Type IPAddress
Address Family Numbers, https://www.iana.org/assignments/address-family-numbers.
HISTORY
These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1.
BUGS
There is no accessor for the SAFI of af.
An error from X509v3_addr_get_afi() is
indistinguishable from the reserved AFI 0 being set on
af.
It is not entirely clear how a caller is supposed to obtain an IPAddressFamily object or an IPAddressOrRange object without reaching into various structs documented in IPAddressRange_new(3).