Bug 4293: wrong SNI sent to server after URL-rewrite

diff --git a/ChangeLog b/ChangeLog
index e82c2f01be5c0771b3d8424c4e463a07f7e0166d..affee9d18fe857961c7817662e49c2283a385a35 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
 Changes to squid-3.5.7 (01 Aug 2015):
 
+       - Bug 4293: wrong SNI sent to server after URL-rewrite
        - Bug 4251: incorrect instance name for memory segments in /dev/shm
        - Bug 4227: invalid key in AuthUserHashPointer causing assertation failure
        - Bug 3345: support %un (any available user name) format code for external ACLs.

diff --git a/src/ssl/PeerConnector.cc b/src/ssl/PeerConnector.cc
index c4d53fabbe423e2a7871f24ffa56887128535118..10c7ed6e47cf46067d392e8680a96b6d336dbc2d 100644 (file)
--- a/src/ssl/PeerConnector.cc
+++ b/src/ssl/PeerConnector.cc
@@ -678,8 +678,13 @@ Ssl::PeekingPeerConnector::initializeSsl()
 
             // Use SNI TLS extension only when we connect directly
             // to the origin server and we know the server host name.
-            const char *sniServer = hostName ? hostName->c_str() :
-                                    (!request->url.hostIsNumeric() ? request->url.host() : NULL);
+            const char *sniServer = NULL;
+            const bool redirected = request->flags.redirected && ::Config.onoff.redir_rewrites_host;
+            if (!hostName || redirected)
+                sniServer = !request->url.hostIsNumeric() ? request->url.host() : NULL;
+            else
+                sniServer = hostName->c_str();
+
             if (sniServer)
                 Ssl::setClientSNI(ssl, sniServer);
         }