---
name: "libressl-X509v3_addr_subset"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509v3_addr_subset"
---

# libressl-X509v3\_addr\_subset(3)

RFC 3779 subset relationship

## NAME

**X509v3\_addr\_subset**, **X509v3\_asid\_subset** – RFC 3779 subset relationship

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*int*\

**X509v3\_addr\_subset**(*IPAddrBlocks \*child*, *IPAddrBlocks \*parent*);

*int*\

**X509v3\_asid\_subset**(*ASIdentifiers \*child*, *ASIdentifiers \*parent*);

## DESCRIPTION

**X509v3\_addr\_subset**() determines if all IP address resources present in *child* are contained in the corresponding resources in *parent*.

The implementation assumes but does not ensure that both *child* and *parent* are in canonical form as described in X509v3\_addr\_is\_canonical(3). In particular, both *child* and *parent* are sorted appropriately and they contain at most one *IPAddressFamily* object per address family identifier (AFI) and optional subsequent address family identifier (SAFI).

The checks are, in order:

1. If *child* is NULL or identical to *parent* then *child* is a subset of *parent*. In particular, a NULL *parent* is allowed for a NULL *child*.

2. If *parent* is NULL then *child* is not a subset of *parent*.

3. If X509v3\_addr\_inherits(3) determines that *child* inherits or that *parent* inherits then *child* is not a subset of *parent*.

4. Each address prefix or range in *child* must be a subset of an address prefix or range in the *parent*, taking AFI and optional SAFI into account:

   - For each *IPAddressFamily* of *child* there must be an *IPAddressFamily* of *parent* with the same AFI and optional SAFI.

   - Since the address prefixes and ranges in corresponding *IPAddressFamily* objects in *child* and *parent* are sorted in ascending order, and do not overlap, they can be traversed simultaneously in linear time. For each prefix or range in *child* there must be a prefix or range in *parent* whose minimal address is smaller and whose maximal address is larger.

     If any of these steps fails, *child* is not a subset of *parent*.

**X509v3\_asid\_subset**() determines if all AS identifier resources in *child* are contained in the corresponding resources in *parent*.

The description for **X509v3\_addr\_subset**() applies mutatis mutandis. In particular, *child* and *parent* must be in canonical form per X509v3\_asid\_is\_canonical(3), but this is not enforced.

## RETURN VALUES

**X509v3\_addr\_subset**() and **X509v3\_asid\_subset**() return 1 if and only if *child* is a subset of *parent*, otherwise they return 0. If both *child* and *parent* are in canonical form, these functions cannot fail.

## SEE ALSO

ASIdentifiers\_new(3), ASRange\_new(3), [crypto(3)](/crypto/3.md), IPAddressRange\_new(3), X509\_new(3), X509v3\_addr\_add\_inherit(3), X509v3\_asid\_add\_inherit(3)

## STANDARDS

RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers.

## HISTORY

These functions first appeared in OpenSSL 0.9.8e and have been available since OpenBSD 7.1.