From d8df9755f2e8c41ee21110f77bc0b0b662f59414 Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Wed, 28 Jul 2021 22:11:20 +0100
Subject: [PATCH] Allow specifying TLS SNI with ?sni= in peering URI

---
 src/core/link.go |  1 +
 src/core/tcp.go  |  1 +
 src/core/tls.go  | 13 ++++++++-----
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/core/link.go b/src/core/link.go
index ccab9219..f753156e 100644
--- a/src/core/link.go
+++ b/src/core/link.go
@@ -98,6 +98,7 @@ func (l *links) call(u *url.URL, sintf string) error {
 		l.tcp.call(pathtokens[0], tcpOpts, sintf)
 	case "tls":
 		tcpOpts.upgrade = l.tcp.tls.forDialer
+		tcpOpts.tlsSNI = u.Query().Get("sni")
 		l.tcp.call(u.Host, tcpOpts, sintf)
 	default:
 		return errors.New("unknown call scheme: " + u.Scheme)
diff --git a/src/core/tcp.go b/src/core/tcp.go
index 572fd652..7b1773b8 100644
--- a/src/core/tcp.go
+++ b/src/core/tcp.go
@@ -64,6 +64,7 @@ type tcpOptions struct {
 	socksProxyAddr string
 	socksProxyAuth *proxy.Auth
 	socksPeerAddr  string
+	tlsSNI         string
 }
 
 func (l *TcpListener) Stop() {
diff --git a/src/core/tls.go b/src/core/tls.go
index 4c25225b..eb21fcbc 100644
--- a/src/core/tls.go
+++ b/src/core/tls.go
@@ -77,8 +77,8 @@ func (t *tcptls) init(tcp *tcp) {
 	}
 }
 
-func (t *tcptls) configForOptions(options *tcpOptions) *tls.Config {
-	config := *t.config
+func (t *tcptls) configForOptions(options *tcpOptions, serverName string) *tls.Config {
+	config := t.config.Clone()
 	config.VerifyPeerCertificate = func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
 		if len(rawCerts) != 1 {
 			return errors.New("tls not exactly 1 cert")
@@ -103,11 +103,14 @@ func (t *tcptls) configForOptions(options *tcpOptions) *tls.Config {
 		}
 		return nil
 	}
-	return &config
+	if serverName != "" {
+		config.ServerName = serverName
+	}
+	return config
 }
 
 func (t *tcptls) upgradeListener(c net.Conn, options *tcpOptions) (net.Conn, error) {
-	config := t.configForOptions(options)
+	config := t.configForOptions(options, "")
 	conn := tls.Server(c, config)
 	if err := conn.Handshake(); err != nil {
 		return c, err
@@ -116,7 +119,7 @@ func (t *tcptls) upgradeListener(c net.Conn, options *tcpOptions) (net.Conn, err
 }
 
 func (t *tcptls) upgradeDialer(c net.Conn, options *tcpOptions) (net.Conn, error) {
-	config := t.configForOptions(options)
+	config := t.configForOptions(options, options.tlsSNI)
 	conn := tls.Client(c, config)
 	if err := conn.Handshake(); err != nil {
 		return c, err