Sortix nightly manual
This manual documents Sortix nightly, a development build that has not been officially released. You can instead view this document in the latest official manual.
NAME
X509v3_addr_add_inherit, X509v3_addr_add_prefix, X509v3_addr_add_range, X509v3_addr_canonize, X509v3_addr_is_canonical — RFC 3779 IP address delegation extensionsSYNOPSIS
#include <openssl/x509v3.h>X509v3_addr_add_inherit(IPAddrBlocks *addrblocks, const unsigned afi, const unsigned *safi);
X509v3_addr_add_prefix(IPAddrBlocks *addrblocks, const unsigned afi, const unsigned *safi, unsigned char *prefix, const int prefixlen);
X509v3_addr_add_range(IPAddrBlocks *addrblocks, const unsigned afi, const unsigned *safi, unsigned char *min, unsigned char *max);
X509v3_addr_canonize(IPAddrBlocks *addrblocks);
X509v3_addr_is_canonical(IPAddrBlocks *addrblocks);
DESCRIPTION
An IPAddrBlocks object represents the content of an IP address delegation extension as defined in RFC 3779, section 2.2.3.1. It holds lists of IP address prefixes and IP address ranges delegated from the issuer to the subject of the certificate. It can be instantiated as explained in the EXAMPLES section and its internals are documented in IPAddressRange_new(3).RETURN VALUES
All these functions return 1 on success and 0 on failure. Memory allocation failure is one possible reason for all of them. Sometimes an error code can be obtained by ERR_get_error(3).EXAMPLES
Construct the first extension from RFC 3779, Appendix B.
#include <sys/socket.h>
#include <arpa/inet.h>
#include <err.h>
#include <stdio.h>
#include <unistd.h>
#include <openssl/asn1.h>
#include <openssl/objects.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
const char *prefixes[] = {
"10.0.32/20", "10.0.64/24", "10.1/16",
"10.2.48/20", "10.2.64/24", "10.3/16",
};
#define N_PREFIXES (sizeof(prefixes) / sizeof(prefixes[0]))
static void
hexdump(const unsigned char *buf, size_t len)
{
size_t i;
for (i = 1; i <= len; i++)
printf(" 0x%02x,%s", buf[i - 1], i % 8 ? "" : "\n");
if (len % 8)
printf("\n");
}
int
main(void)
{
IPAddrBlocks *addrblocks;
X509_EXTENSION *ext;
unsigned char *der;
int der_len;
size_t i;
if (pledge("stdio", NULL) == -1)
err(1, "pledge");
/*
* Somebody forgot to implement IPAddrBlocks_new(). IPAddrBlocks
* is the same as STACK_OF(IPAddressFamily). As such, it should
* have IPAddressFamily_cmp() as its comparison function. It is
* not possible to call sk_new(3) because IPAddressFamily_cmp()
* is not part of the public API. The correct comparison function
* can be installed as a side-effect of X509v3_addr_canonize(3).
*/
if ((addrblocks = sk_IPAddressFamily_new_null()) == NULL)
err(1, "sk_IPAddressFamily_new_null");
if (!X509v3_addr_canonize(addrblocks))
errx(1, "X509v3_addr_canonize");
/* Add the prefixes as IPv4 unicast. */
for (i = 0; i < N_PREFIXES; i++) {
unsigned char addr[16] = {0};
int len;
int unicast = 1; /* SAFI for unicast forwarding. */
len = inet_net_pton(AF_INET, prefixes[i], addr,
sizeof(addr));
if (len == -1)
errx(1, "inet_net_pton(%s)", prefixes[i]);
if (!X509v3_addr_add_prefix(addrblocks, IANA_AFI_IPV4,
&unicast, addr, len))
errx(1, "X509v3_addr_add_prefix(%s)", prefixes[i]);
}
if (!X509v3_addr_add_inherit(addrblocks, IANA_AFI_IPV6, NULL))
errx(1, "X509v3_addr_add_inherit");
/*
* Ensure the extension is in canonical form. Otherwise the two
* adjacent prefixes 10.2.48/20 and 10.2.64/24 are not merged into
* the range 10.2.48.0--10.2.64.255. This results in invalid DER
* encoding from X509V3_EXT_i2d(3) and i2d_X509_EXTENSION(3).
*/
if (!X509v3_addr_canonize(addrblocks))
errx(1, "X509v3_addr_canonize");
/* Create the extension with the correct OID; mark it critical. */
ext = X509V3_EXT_i2d(NID_sbgp_ipAddrBlock, 1, addrblocks);
if (ext == NULL)
errx(1, "X509V3_EXT_i2d");
der = NULL;
if ((der_len = i2d_X509_EXTENSION(ext, &der)) <= 0)
errx(1, "i2d_X509_EXTENSION");
hexdump(der, der_len);
/* One way of implementing IPAddrBlocks_free(). */
sk_IPAddressFamily_pop_free(addrblocks, IPAddressFamily_free);
X509_EXTENSION_free(ext);
free(der);
return 0;
}
IPAddrBlocks *
d2i_IPAddrBlocks(IPAddrBlocks **addrblocks, const unsigned char **in,
long len)
{
const X509V3_EXT_METHOD *v3_addr;
if ((v3_addr = X509V3_EXT_get_nid(NID_sbgp_ipAddrBlock)) == NULL)
return NULL;
return (IPAddrBlocks *)ASN1_item_d2i((ASN1_VALUE **)addrblocks,
in, len, ASN1_ITEM_ptr(v3_addr->it));
}
int
i2d_IPAddrBlocks(IPAddrBlocks *addrblocks, unsigned char **out)
{
const X509V3_EXT_METHOD *v3_addr;
if ((v3_addr = X509V3_EXT_get_nid(NID_sbgp_ipAddrBlock)) == NULL)
return -1;
return ASN1_item_i2d((ASN1_VALUE *)addrblocks, out,
ASN1_ITEM_ptr(v3_addr->it));
}
SEE ALSO
ASIdentifiers_new(3), crypto(3), inet_net_ntop(3), inet_ntop(3), IPAddressRange_new(3), X509_new(3), X509v3_addr_get_range(3), X509v3_addr_validate_path(3), X509v3_asid_add_id_or_range(3)STANDARDS
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:- section 2: IP Address delegation extension