x509: implement verification of IPs in SAN
diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index a5c1b8e..f53573c 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -314,7 +314,16 @@
* for ECDSA) apply to all certificates: trusted root,
* intermediate CAs if any, and end entity certificate.
*
- * \note TODO: IP addresses in exp_name
+ * \note If MBEDTLS_X509_SAN_IP_ADDRESS_SUPPORT is enabled, instead
+ * of a DNS name, exp_name can also contain the string "IP:"
+ * followed by an IP address. This address must be either an
+ * IPv4 address in dotted decimal notation, or an IPv6
+ * address consisting of exactly 8 groups of 4 hexadecimal
+ * digits separated by colons. For example, if the expected
+ * IPv6 is fe80::1, then exp_name must be the string
+ * "IP:fe80:0000:0000:0000:0000:0000:0000:0001" or its
+ * uppercase equivalent. If the expected IPv4 is 127.0.0.1,
+ * then exp_name should be "IP:127.0.0.1".
*
* \return 0 if successful or MBEDTLS_ERR_X509_CERT_VERIFY_FAILED
* in which case *flags will have one or more