From ce23baca7d0b8433939037526da829827e490917 Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Wed, 25 Mar 2026 14:50:05 -0300 Subject: [PATCH] add IPv6 SAN --- mongoose.c | 10 ++++++++-- src/tls_builtin.c | 10 ++++++++-- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/mongoose.c b/mongoose.c index df80dfc3..636dd883 100644 --- a/mongoose.c +++ b/mongoose.c @@ -14222,12 +14222,18 @@ static int mg_tls_verify_cert_san(const uint8_t *der, size_t dersz, if (!server_ip->is_ip6 && *((uint32_t *) name.value) == server_ip->addr.ip4) return 1; // and matches the one we're connected to - } else { // this is a text SAN +#if MG_ENABLE_IPV6 + } else if (name.type == 0x87 && name.len == 16) { // is an IPv6 address + MG_VERBOSE(("Found SAN, IPv6: %M", mg_print_ip6, name.value)); + if (server_ip->is_ip6 && memcmp(name.value, server_ip->addr.ip6, 16) == 0) + return 1; // and matches the one we're connected to +#endif + } else { // this is a text SAN MG_VERBOSE(("Found SAN, (%u): %.*s", name.type, name.len, name.value)); if (mg_match(mg_str(server_name), mg_str_n((char *) name.value, name.len), NULL)) return 1; // and matches the host name - } // TODO(): add IPv6 comparison, more items ? + } } return -1; } diff --git a/src/tls_builtin.c b/src/tls_builtin.c index 87e5945e..0374ab33 100644 --- a/src/tls_builtin.c +++ b/src/tls_builtin.c @@ -1507,12 +1507,18 @@ static int mg_tls_verify_cert_san(const uint8_t *der, size_t dersz, if (!server_ip->is_ip6 && *((uint32_t *) name.value) == server_ip->addr.ip4) return 1; // and matches the one we're connected to - } else { // this is a text SAN +#if MG_ENABLE_IPV6 + } else if (name.type == 0x87 && name.len == 16) { // is an IPv6 address + MG_VERBOSE(("Found SAN, IPv6: %M", mg_print_ip6, name.value)); + if (server_ip->is_ip6 && memcmp(name.value, server_ip->addr.ip6, 16) == 0) + return 1; // and matches the one we're connected to +#endif + } else { // this is a text SAN MG_VERBOSE(("Found SAN, (%u): %.*s", name.type, name.len, name.value)); if (mg_match(mg_str(server_name), mg_str_n((char *) name.value, name.len), NULL)) return 1; // and matches the host name - } // TODO(): add IPv6 comparison, more items ? + } } return -1; }