Merge pull request #8223 from heyitsanthony/ip-san-exit

transport: accept connection if matched IP SAN but no DNS match
etcd-io · Jul 7, 2017 · 67fa8b8 · 67fa8b8
2 parents e6f4563 + ab95eb0
commit 67fa8b8
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/pkg/transport/listener_tls.go b/pkg/transport/listener_tls.go
@@ -197,7 +197,11 @@ func checkCertSAN(ctx context.Context, cert *x509.Certificate, remoteAddr string
 		return herr
 	}
 	if len(cert.IPAddresses) > 0 {
-		if cerr := cert.VerifyHostname(h); cerr != nil && len(cert.DNSNames) == 0 {
+		cerr := cert.VerifyHostname(h)
+		if cerr == nil {
+			return nil
+		}
+		if len(cert.DNSNames) == 0 {
 			return cerr
 		}
 	}