move SNI to the correct place

diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
index 12bf503ce3f87f17b19a53328c1de59f3250d380..4315fecf26e611e3e1134a42817a84155e7331c1 100644 (file)
--- a/raddb/sites-available/tls
+++ b/raddb/sites-available/tls
@@ -490,6 +490,10 @@ home_server tls {
                #  connection, and then use SNI to route the
                #  underlying RADIUS TCP traffic to a particular host.
                #
+               #  Note that "hostname" here only for SNI, and is NOT
+               #  the hostname or IP address we connect to.  For that,
+               #  See "ipaddr", above.
+               #
        #       hostname = "example.com"
 
                private_key_password = whatever

diff --git a/src/main/listen.c b/src/main/listen.c
index f2af3e16dad7a4a674968c280013ca81e1542505..c9c27226146fc8c16e5364e2b48eafeb6de5ce8a 100644 (file)
--- a/src/main/listen.c
+++ b/src/main/listen.c
@@ -2990,6 +2990,18 @@ rad_listen_t *proxy_new_listener(TALLOC_CTX *ctx, home_server_t *home, uint16_t
        if ((home->proto == IPPROTO_TCP) && home->tls) {
                DEBUG("(TLS) Trying new outgoing proxy connection to %s", buffer);
 
+               /*
+                *      Set SNI, if configured.
+                *
+                *      The OpenSSL API says the filename is "char
+                *      const *", but some versions have it as "void
+                *      *", without the "const".  So we un-const it
+                *      here through various C magic.
+                */
+               if (home->tls->client_hostname) {
+                       (void) SSL_set_tlsext_host_name(sock->ssn->ssl, (void *) (uintptr_t) "home->tls->client_hostname");
+               }
+
                /*
                 *      This is blocking.  :(
                 */

diff --git a/src/main/tls_listen.c b/src/main/tls_listen.c
index cad1353cd3964f8b1fd0c4379f819af4ebfd1bcd..0c3a4cfcb3c346a6d670096802ac6697610b23cd 100644 (file)
--- a/src/main/tls_listen.c
+++ b/src/main/tls_listen.c
@@ -177,18 +177,6 @@ static int tls_socket_recv(rad_listen_t *listener)
                SSL_set_ex_data(sock->ssn->ssl, FR_TLS_EX_INDEX_TALLOC, sock);
                sock->ssn->quick_session_tickets = true; /* we don't have inner-tunnel authentication */
 
-               /*
-                *      Set SNI, if configured.
-                *
-                *      The OpenSSL API says the filename is "char
-                *      const *", but some versions have it as "void
-                *      *", without the "const".  So we un-const it
-                *      here through various C magic.
-                */
-               if (listener->tls->client_hostname) {
-                       (void) SSL_set_tlsext_host_name(sock->ssn->ssl, (void *) (uintptr_t) listener->tls->client_hostname);
-               }
-
                doing_init = true;
        }