On 02/05/2014 11:04 PM, Nikos Mavrogiannopoulos wrote: > On 02/05/2014 08:49 PM, David Woodhouse wrote: > >>> Hello, >>> It seems that sniproxy is a viable method to multiplex [0] ocserv with >>> another web server over port 443. However, it seems that openconnect >>> doesn't advertise the hostname it is connecting to on the client hello. >>> Would you be interested on a patch to make openconnect use SNI? >> As long as it doesn't offend the stupider firewalls that some people put >> in front of their ASAs, sure. > > I've added it in: > git://gitorious.org/openconnect-x/openconnect-x.git sni The patch is now simplified to enable SNI only when the protection from the F5 firewall is ensured by the %COMPAT keyword (gnutls 3.2.9+). regards, Nikos
