From a0c79cad33e4d4a8e90d7e60524bdc5ce5fa2289 Mon Sep 17 00:00:00 2001
From: Tianyu Chen <sweetyfish@deepin.org>
Date: Thu, 30 Jul 2026 15:16:14 +0800
Subject: [PATCH] rsync-ssl: -verify_ip when connecting to an IP/IPv6 address

Fixes:
$ rsync-ssl rsync://<IP-Address>
verify depth is 4
Connecting to <IP-Address>
depth=0
verify error:num=62:hostname mismatch
40F13FDC967F0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:2103:
rsync: did not see server greeting
rsync error: error starting client-server protocol (code 5) at main.c(1850) [Receiver=3.4.0]
---
 rsync-ssl | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/rsync-ssl b/rsync-ssl
index 56ee7dfe0..f81bb19b0 100755
--- a/rsync-ssl
+++ b/rsync-ssl
@@ -137,7 +137,19 @@ function rsync_ssl_helper {
     fi
 
     if [[ $RSYNC_SSL_TYPE == openssl ]]; then
-	exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname -verify_hostname $hostname -connect $hostname:$port
+	if echo "$hostname" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$|^[0-9a-fA-F:]+$'; then
+	    verify_opt="-verify_ip $hostname"
+	    if echo "$hostname" | grep -q ':'; then
+		# IPv6
+		connect="[$hostname]:$port"
+	    else
+		connect="$hostname:$port"
+	    fi
+	else
+	    verify_opt="-verify_hostname $hostname"
+	    connect="$hostname:$port"
+	fi
+	exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname $verify_opt -connect "$connect"
     elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then
 	exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_key_opt $gnutls_opts $hostname:$port
     else