openssl/openssl

Not possible to get the SAFI from IPAddressFamily

Open

#18,529 opened on Jun 10, 2022

View on GitHub
 (0 comments) (0 reactions) (0 assignees)C (11,262 forks)batch import
good first issuehelp wantedtriaged: feature

Repository metrics

Stars
 (30,157 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Reported by @botovq:

The public API exposes the AFI using X509v3_addr_get_afi(), but doesn't expose the SAFI. The SAFI can only be fed into the API but not be read from it. Another unfortunate thing about X509v3_addr_get_afi() is that it uses the reserved AFI 0 as an in-band error. It does not care about the reserved AFI 65535.

Contributor guide

Research direction
Examine the implementation of X509v3 addr get afi() and the IPAddressFamily structure to add a similar function X509v3 addr get safi() that returns the SAFI without using reserved values as error indicators.
Tech stack
c
Domain
securityapi
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
COpenSSL internals
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30