---
name: "libressl-a2i_ipadd"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-a2i_ipadd"
---

# libressl-a2i\_ipadd(3)

parse Internet Protocol addresses into ASN.1 OCTET STRINGs for X.509

## NAME

**a2i\_ipadd**, **a2i\_IPADDRESS**, **a2i\_IPADDRESS\_NC** – parse Internet Protocol addresses into ASN.1 OCTET STRINGs for X.509

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*int*\

**a2i\_ipadd**(*unsigned char \*ipout*, *const char \*ipasc*);

*ASN1\_OCTET\_STRING* *\**\

**a2i\_IPADDRESS**(*const char \*ipasc*);

*ASN1\_OCTET\_STRING* *\**\

**a2i\_IPADDRESS\_NC**(*const char \*ipasc*);

## DESCRIPTION

**a2i\_ipadd**() and **a2i\_IPADDRESS**() parse the string *ipasc* containing an IPv4 or IPv6 address in one of the following formats:

```
d.d.d.d
x:x:x:x:x:x:x:x (exactly 8 words)
(x:)*x::x(:x)* (less than 8 words)
(x:)*x:: (less than 8 words)
::x(:x)* (less than 8 words)
::
(x:)*d.d.d.d (up to 6 hexadecimal words, :: can be used)
```

where each *d* represents a non-negative decimal number less than 256 with one, two or three digits and each *x* represents a non-negative hexadecimal number with one, two, three, or four digits. Both the lower case letters a-f and the upper case letters A-F can be used.

**a2i\_ipadd**() stores the bytes of the address in network byte order (big endian) starting at *ipout*. The caller is responsible for providing sufficient space; always providing a buffer of at least 16 bytes is recommended, even if an IPv4 address is expected, to avoid buffer overruns in case *ipasc* is malformed.

**a2i\_IPADDRESS**() stores the address in a newly allocated ASN.1 *OCTET* *STRING*.

**a2i\_IPADDRESS\_NC**() expects *ipasc* to contain two addresses of the same address family in the above form, separated by a slash (‘/’) character, and stores the concatenation of both addresses in a newly allocated ASN.1 *OCTET* *STRING*, which is typically used for address/mask pairs in name constraint extensions of CA certificates.

## RETURN VALUES

**a2i\_ipadd**() returns the number of bytes written to *ipout* in case of success, i.e. 4 for an IPv4 or 16 for an IPv6 address, or 0 if parsing failed.

**a2i\_IPADDRESS**() and **a2i\_IPADDRESS\_NC**() return the new object or NULL if parsing or memory allocation failed.

## SEE ALSO

a2i\_ASN1\_STRING(3), ASN1\_OCTET\_STRING\_new(3), ASN1\_OCTET\_STRING\_set(3), GENERAL\_NAME\_new(3), IPAddressRange\_new(3), NAME\_CONSTRAINTS\_new(3), s2i\_ASN1\_OCTET\_STRING(3), X509\_EXTENSION\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

- section 4.2.1.6: Subject Alternative Name

- section 4.2.1.10: Name Constraints

## HISTORY

**a2i\_IPADDRESS**() and **a2i\_IPADDRESS\_NC**() first appeared in OpenSSL 0.9.8 and **a2i\_ipadd**() in OpenSSL 0.9.8e. They have been available since OpenBSD 4.5.

## CAVEATS

While some syntax errors are caught, only minimal validation takes place, and these functions often return objects that make no sense, in particular in the context of IPv6. For example, the trailing :d.d.d.d syntax can be appended to a hexadecimal part that results in twelve arbitrary bytes.