]> git.kaiwu.me - nginx.git/commit
projects / nginx.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 4f86b96) | patch
SSL: avoid matching IP addresses in dNSName and commonName
authorEugene Grebenschikov <e.grebenshchikov@f5.com>
Mon, 21 Sep 2026 20:32:36 +0000 (13:32 -0700)
committerEugene <54681898+jimf5@users.noreply.github.com>
Thu, 24 Sep 2026 19:33:26 +0000 (12:33 -0700)
commitd10dd3123a0f1f3c6b9fc836162215a6df7af98b
tree73428f2e1f608a39ee612c00d4bd58fafb38f7e0tree | snapshot
parent4f86b96da93a5a1dab922b393e02b5aaf0396425commit | diff
SSL: avoid matching IP addresses in dNSName and commonName

OpenSSL 1.0.2+ validates IP addresses only against iPAddress
subjectAltName entries via X509_check_ip().  For older OpenSSL
versions, equivalent validation is now performed.

Note that dNSName entries are still logged when checking an IP
address, they are not used for matching.

Co-authored-by: Sergey Kandaurov <pluknet@nginx.com>
src/event/ngx_event_openssl.c diff | blob | history
nginx upstream