Skip to content

Commit

Permalink
transport: accept connection if matched IP SAN but no DNS match
Browse files Browse the repository at this point in the history
The IP SAN check would always do a DNS SAN check if DNS is given
and the connection's IP is verified. Instead, don't check DNS
entries if there's a matching iP.

Fixes #8206
  • Loading branch information
Anthony Romano authored and gyuho committed Jul 7, 2017
1 parent f8f7966 commit 40468ab
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion pkg/transport/listener_tls.go
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,11 @@ func checkCert(ctx context.Context, cert *x509.Certificate, remoteAddr string) e
return herr
}
if len(cert.IPAddresses) > 0 {
if cerr := cert.VerifyHostname(h); cerr != nil && len(cert.DNSNames) == 0 {
cerr := cert.VerifyHostname(h)
if cerr == nil {
return nil
}
if len(cert.DNSNames) == 0 {
return cerr
}
}
Expand Down

0 comments on commit 40468ab

Please sign in to comment.