---
name: "libressl-ASRange_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-ASRange_new"
---

# libressl-ASRange\_new(3)

RFC 3779 autonomous system identifiers and ranges

## NAME

**ASRange\_new**, **ASRange\_free**, **d2i\_ASRange**, **i2d\_ASRange**, **ASIdOrRange\_new**, **ASIdOrRange\_free**, **d2i\_ASIdOrRange**, **i2d\_ASIdOrRange**, **ASIdentifierChoice\_new**, **ASIdentifierChoice\_free**, **d2i\_ASIdentifierChoice**, **i2d\_ASIdentifierChoice** – RFC 3779 autonomous system identifiers and ranges

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*ASRange* *\**\

**ASRange\_new**(*void*);

*void*\

**ASRange\_free**(*ASRange \*asrange*);

*ASRange* *\**\

**d2i\_ASRange**(*ASRange \*\*asrange*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_ASRange**(*ASRange \*asrange*, *unsigned char \*\*der\_out*);

*ASIdOrRange* *\**\

**ASIdOrRange\_new**(*void*);

*void*\

**ASIdOrRange\_free**(*ASIdOrRange \*aor*);

*ASIdOrRange* *\**\

**d2i\_ASIdOrRange**(*ASIdOrRange \*\*aor*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_ASIdOrRange**(*ASIdOrRange \*aor*, *unsigned char \*\*der\_out*);

*ASIdentifierChoice* *\**\

**ASIdentifierChoice\_new**(*void*);

*void*\

**ASIdentifierChoice\_free**(*ASIdentifierChoice \*aic*);

*ASIdentifierChoice* *\**\

**d2i\_ASIdentifierChoice**(*ASIdentifierChoice \*\*aic*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_ASIdentifierChoice**(*ASIdentifierChoice \*aic*, *unsigned char \*\*der\_out*);

## DESCRIPTION

*ASRange*, *ASIdOrRange*, and *ASIdentifierChoice* are building blocks of the *ASIdentifiers* type representing the RFC 3779 autonomous system identifier delegation extension.

All *ASN1\_INTEGER*s in this manual must be representable as unsigned 32-bit integers. The API performs no corresponding checks. An *ASN1\_INTEGER* can be set using ASN1\_INTEGER\_set\_uint64(3).

The *ASRange* type defined in RFC 3779 section 3.2.3.8 is implemented as

```
typedef struct ASRange_st {
	ASN1_INTEGER *min;
	ASN1_INTEGER *max;
} ASRange;
```

It represents the closed range \[min,max\] of AS identifiers between *min* and *max*, where *min* should be strictly smaller than *max*.

**ASRange\_new**() allocates a new *ASRange* object with allocated, empty *min* and *max*, thus representing the invalid range \[0,0\].

**ASRange\_free**() frees *asrange* including any data contained in it. If *asrange* is NULL, no action occurs.

The *ASIdOrRange* type defined in RFC 3779 section 3.2.3.5 is implemented as

```
typedef struct ASIdOrRange_st {
	int type;
	union {
		ASN1_INTEGER *id;
		ASRange *range;
	} u;
} ASIdOrRange;
```

representing an individual AS identifier or a range. When populating an *ASIdOrRange* object by hand, its *type* should be set to ASIdOrRange\_id or ASIdOrRange\_range to indicate which member of the union *u* is valid.

**ASIdOrRange\_new**() returns a new *ASIdOrRange* object with invalid type and NULL members of the union *u*.

**ASIdOrRange\_free**() frees *aor* including any data contained in it, provided *type* is set correctly. If *asrange* is NULL, no action occurs.

In order to express a list of AS identifiers and ranges, RFC 3779 section 3.2.3.4 uses an ASN.1 SEQUENCE, which is implemented via a STACK\_OF(3) construction over *ASIdOrRange*:

```
typedef STACK_OF(ASIdOrRange) ASIdOrRanges;
```

Since an *ASIdOrRanges* object should be sorted in a specific way (see X509v3\_asid\_canonize(3)), a comparison function is needed for a correct instantiation with sk\_new(3). The **ASIdOrRange\_cmp**() function is not directly exposed and not easily accessible from outside the library, and it is non-trivial to implement. It is therefore discouraged to use *ASIdOrRanges* objects that are not part of an *ASIdentifiers* object.

The “inherit” marker from RFC 3779 section 3.2.3.3 is implemented as *ASN1\_NULL*. It has no dedicated type or API and can be instantiated with ASN1\_NULL\_new(3).

The *ASIdentifierChoice* type defined in RFC 3779 section 3.2.3.2 is implemented as

```
typedef struct ASIdentifierChoice_st {
	int type;
	union {
		ASN1_NULL *inherit;
		ASIdOrRanges *asIdsOrRanges;
	} u;
} ASIdentifierChoice;
```

where the *type* member should be set to ASIdentifierChoice\_inherit or ASIdentifierChoice\_asIdsOrRanges to indicate whether a given *ASIdentifierChoice* object represents an inherited list or an explicit list.

**ASIdentifierChoice\_new**() returns a new *ASIdentifierChoice* object with invalid type and NULL members of the union *u*.

**ASIdentifierChoice\_free**() frees *aic* including any data contained in it, provided *type* is set correctly.

The *ASIdentifiers* type defined in RFC 3779 section 3.2.3.1 is implemented as

```
typedef struct ASIdentifiers_st {
	ASIdentifierChoice *asnum;
	ASIdentifierChoice *rdi;
} ASIdentifiers;
```

It should be instantiated with ASIdentifiers\_new(3) and populated with X509v3\_asid\_add\_id\_or\_range(3).

**d2i\_ASRange**(), **i2d\_ASRange**(), **d2i\_ASIdOrRange**(), **i2d\_ASIdOrRange**(), **d2i\_ASIdentifierChoice**(), and **i2d\_ASIdentifierChoice**() decode and encode ASN.1 *ASRange*, *ASIdOrRange*, and *ASIdentifierChoice* objects. For details about the semantics, examples, caveats, and bugs, see ASN1\_item\_d2i(3). In order for the encoding produced by **i2d\_ASRange**() to be correct, *min* must be strictly less than *max*. Similarly for **i2d\_ASIdOrRange**() and an *ASIdOrRange* object of *type* ASIdOrRange\_range.

## RETURN VALUES

**ASRange\_new**() returns a new *ASRange* object with allocated, empty members, or NULL if an error occurs.

**ASIdOrRange\_new**() returns a new, empty *ASIdOrRange* object or NULL if an error occurs.

**ASIdentifierChoice\_new**() returns a new, empty *ASIdentifierChoice* object or NULL if an error occurs.

The decoding functions **d2i\_ASRange**(), **d2i\_ASIdOrRange**(), and **d2i\_ASIdentifierChoice**() return an *ASRange*, an *ASIdOrRange*, or an *ASIdentifierChoice*, object, respectively, or NULL if an error occurs.

The encoding functions **i2d\_ASRange**(), **i2d\_ASIdOrRange**(), and **i2d\_ASIdentifierChoice**() return the number of bytes successfully encoded or a value \<= 0 if an error occurs.

## SEE ALSO

ASIdentifiers\_new(3), ASN1\_INTEGER\_set\_uint64(3), [crypto(3)](/crypto/3.md), IPAddressRange\_new(3), s2i\_ASN1\_INTEGER(3), STACK\_OF(3), X509\_new(3), X509v3\_asid\_add\_id\_or\_range(3)

## STANDARDS

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:

- section 3.2.3: Syntax

- section 3.2.3.1: Type ASIdentifiers

- section 3.2.3.2: Elements asnum, rdi, and Type ASIdentifierChoice

- section 3.2.3.3: Element inherit

- section 3.2.3.4: Element asIdsOrRanges

- section 3.2.3.5: Type ASIdOrRange

- section 3.2.3.6: Element id

- section 3.2.3.7: Element range

- section 3.2.3.8: Type ASRange

- section 3.2.3.9: Elements min and max

## HISTORY

These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1.

## BUGS

An **ASIdOrRanges\_new**() function that installs the correct comparison function on the stack of *ASIdOrRange* should have been part of the API to make it usable.

**ASIdentifierChoice\_new**() is of very limited use because **ASIdOrRanges\_new**() is missing.

There is no way of ensuring that an *ASIdOrRanges* object is in canonical form unless it is part of an *ASIdentifiers* object. It is therefore difficult to guarantee that the output of **i2d\_ASIdentifierChoice**() is conformant.

RFC 3779 3.2.3.4 has “*asIdsOrRanges*” while its type in this implementation is *ASIdOrRanges*.