it helps to have SSL session before using it. Fixes #5552

diff --git a/src/main/listen.c b/src/main/listen.c
index a3855d1f05c4febd92c819926be4bdfcb5cba03c..3cbd4f88f93d6b6155ef1faae7d74191fc26c7fc 100644 (file)
--- a/src/main/listen.c
+++ b/src/main/listen.c
@@ -3662,18 +3662,6 @@ rad_listen_t *proxy_new_listener(TALLOC_CTX *ctx, home_server_t *home, uint16_t
        if ((home->proto == IPPROTO_TCP) && home->tls) {
                DEBUG("(TLS) Trying new outgoing proxy connection to %s", buffer);
 
-               /*
-                *      Set SNI, if configured.
-                *
-                *      The OpenSSL API says the filename is "char
-                *      const *", but some versions have it as "void
-                *      *", without the "const".  So we un-const it
-                *      here through various C magic.
-                */
-               if (home->tls->client_hostname) {
-                       (void) SSL_set_tlsext_host_name(sock->ssn->ssl, (void *) (uintptr_t) home->tls->client_hostname);
-               }
-
 #ifdef WITH_RADIUSV11
                this->radiusv11 = home->tls->radiusv11;
 #endif

diff --git a/src/main/tls.c b/src/main/tls.c
index 7286f220c688b210f0833299b5a3e2bc1da9a27d..fe7cc4a88f2b8eb7d460d9ed26c382a36092ee53 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -497,6 +497,18 @@ tls_session_t *tls_new_client_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *con
                SSL_set_ex_data(ssn->ssl, FR_TLS_EX_INDEX_FIX_CERT_ORDER, (void *) &conf->fix_cert_order);
        }
 
+       /*
+        *      Set SNI, if configured.
+        *
+        *      The OpenSSL API says the filename is "char
+        *      const *", but some versions have it as "void
+        *      *", without the "const".  So we un-const it
+        *      here through various C magic.
+        */
+       if (conf->client_hostname) {
+               (void) SSL_set_tlsext_host_name(ssn->ssl, (void *) (uintptr_t) conf->client_hostname);
+       }
+
        /*
         *      Add the message callback to identify what type of
         *      message/handshake is passed