---
name: "libressl-X509v3_addr_get_range"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509v3_addr_get_range"
---

# libressl-X509v3\_addr\_get\_range(3)

parse helpers for the IP address delegation extension

## NAME

**X509v3\_addr\_get\_afi**, **X509v3\_addr\_get\_range** – parse helpers for the IP address delegation extension

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*unsigned*\

**X509v3\_addr\_get\_afi**(*const IPAddressFamily \*af*);

*int*\

**X509v3\_addr\_get\_range**(*IPAddressOrRange \*aor*, *const unsigned afi*, *unsigned char \*min*, *unsigned char \*max*, *const int length*);

## DESCRIPTION

**X509v3\_addr\_get\_afi**() returns the address family identifier (AFI) of *af*.

**X509v3\_addr\_get\_range**() converts the minimum and maximum addresses in the address prefix or range *aor* from internal encoding to IP addresses in network byte order and places copies in the arrays *min* and *max*, of size *length*. The *length* must be large enough to accommodate an address for *afi*, which is at least 4 for IANA\_AFI\_IPV4 and at least 16 for IANA\_AFI\_IPV6.

## RETURN VALUES

**X509v3\_addr\_get\_afi**() returns the AFI encoded in *af* or 0 if *af* does not contain a valid AFI, or if the AFI is not IPv4 or IPv6.

**X509v3\_addr\_get\_range**() returns the number of bytes copied into *min* and *max* or 0 on error. An error occurs if *aor* is malformed, if *afi* is not IANA\_AFI\_IPV4 or IANA\_AFI\_IPV6, if either *min* or *max* is NULL, or if *length* is smaller than 4 or 16, respectively.

## SEE ALSO

[crypto(3)](/crypto/3.md), [inet\_ntop(3)](/inet_ntop/3.md), IPAddressRange\_new(3), X509\_new(3), X509v3\_addr\_add\_inherit(3)

## STANDARDS

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:

- section 2: IP Address delegation extension

- section 2.2.3.3: Element addressFamily

- section 2.2.3.7: Type IPAddressOrRange

- section 2.2.3.8: Element addressPrefix and Type IPAddress

*Address Family Numbers*, https://www.iana.org/assignments/address-family-numbers.

## HISTORY

These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1.

## BUGS

There is no accessor for the SAFI of *af*.

An error from **X509v3\_addr\_get\_afi**() is indistinguishable from the reserved AFI 0 being set on *af*.

It is not entirely clear how a caller is supposed to obtain an *IPAddressFamily* object or an *IPAddressOrRange* object without reaching into various structs documented in IPAddressRange\_new(3).