From: Eugene Grebenschikov <e.grebenshchikov@f5.com>
Date: Mon, 21 Sep 2026 20:32:36 +0000 (-0700)
Subject: SSL: avoid matching IP addresses in dNSName and commonName
X-Git-Tag: release-1.31.7~19
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=d10dd3123a0f1f3c6b9fc836162215a6df7af98b;p=nginx.git

SSL: avoid matching IP addresses in dNSName and commonName

OpenSSL 1.0.2+ validates IP addresses only against iPAddress
subjectAltName entries via X509_check_ip().  For older OpenSSL
versions, equivalent validation is now performed.

Note that dNSName entries are still logged when checking an IP
address, they are not used for matching.

Co-authored-by: Sergey Kandaurov <pluknet@nginx.com>
---

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index e94433bd3..e4250ee09 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -5415,7 +5415,7 @@ ngx_ssl_check_host(ngx_connection_t *c, ngx_str_t *name)
                                (size_t) ASN1_STRING_length(str),
                                ASN1_STRING_data(str));
 
-                if (ngx_ssl_check_name(name, str) == NGX_OK) {
+                if (addr == NULL && ngx_ssl_check_name(name, str) == NGX_OK) {
                     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
                                    "SSL subjectAltName: match");
                     GENERAL_NAMES_free(altnames);
@@ -5479,6 +5479,12 @@ ngx_ssl_check_host(ngx_connection_t *c, ngx_str_t *name)
      * CN, both Apache and OpenSSL check all CNs, and so do we.
      */
 
+    if (addr) {
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                       "SSL commonName: no match");
+        goto failed;
+    }
+
     sname = X509_get_subject_name(cert);
 
     if (sname == NULL) {