mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-08-11 21:01:24 +00:00
ba390f2399
An IP-literal host must only be authenticated via a matching iPAddress SAN, never via the certificate's Common Name (RFC 9110), as the OpenSSL backend already does through X509_check_ip. The Mbed TLS and wolfSSL backends instead fell back to the CN when no IP SAN matched, and recognized IPv4 only. This is a more complete solution for #2476, which gated the CN fallback for IPv4 hosts only; here the same gap is closed for IPv6 as well, and IPv6 iPAddress SANs are actually matched. - Add impl::parse_ip_address() to parse IPv4/IPv6 literals into raw bytes - Match IPv6 (16-byte) iPAddress SANs, not just IPv4 - Skip the CN fallback for IP-literal hosts (both IPv4 and IPv6) - Remove the unused SSLClient::verify_host* dead code - Add regression tests and test certificates for the IP-host cases
