Skip to content

fix(cache): send TLS SNI when connecting to rediss:// package cache#44469

Open
lauraseidler wants to merge 1 commit into
renovatebot:mainfrom
lauraseidler:fix/44461-redis-tls-sni
Open

fix(cache): send TLS SNI when connecting to rediss:// package cache#44469
lauraseidler wants to merge 1 commit into
renovatebot:mainfrom
lauraseidler:fix/44461-redis-tls-sni

Conversation

@lauraseidler

@lauraseidler lauraseidler commented Jul 10, 2026

Copy link
Copy Markdown

Changes

On Node.js, tls.connect({host}) does not automatically set the SNI servername from the host. @redis/client spreads caller socket options directly into tls.connect without injecting servername, so a plain createClient({url: 'rediss://...'}) sends no SNI.

On SNI-routed endpoints (e.g. Aiven Privatelink, where many hostnames share a single IP:port), the TLS handshake is rejected and the client gets ECONNRESET before secure TLS connection was established.

Fix: set socket.servername to the URL hostname when the scheme is rediss: and the hostname is not an IP literal (RFC 6066 forbids IP addresses in SNI). Bracketed IPv6 literals ([::1]) are correctly excluded by stripping the brackets before the isIP check.

The parsedUrl call is hoisted above the config object so the cluster path can reuse it without a second parse. Placing servername in config.socket means it is also passed to cluster rootNodes; note that dynamically-discovered cluster nodes may still lack per-node SNI (out of scope for this fix).

Context

Please select one of the following:

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

  • No — I did not use AI for this contribution.
  • Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
  • Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
  • Yes — other (please describe):

Documentation (please check one with an [x])

  • I have updated the documentation, or
  • No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

  • Code inspection only, or
  • Newly added/modified unit tests, or
  • No unit tests, but ran on a real repository, or
  • Both unit tests + ran on a real repository

The public repository: not a public repository

@github-actions github-actions Bot requested a review from viceice July 10, 2026 07:01
On Node.js, `tls.connect({host})` does not automatically set the SNI
servername from the host. `@redis/client` spreads caller socket options
directly into `tls.connect` without injecting `servername`, so a plain
`createClient({url: 'rediss://...'})` sends no SNI.

On SNI-routed endpoints (e.g. Aiven Privatelink, where many hostnames
share a single IP:port), the TLS handshake is rejected and the client
gets `ECONNRESET before secure TLS connection was established`.

Fix: set `socket.servername` to the URL hostname when the scheme is
`rediss:` and the hostname is not an IP literal (RFC 6066 forbids IP
addresses in SNI). Bracketed IPv6 literals (`[::1]`) are correctly
excluded by stripping the brackets before the `isIP` check.

The `parsedUrl` call is hoisted above the config object so the cluster
path can reuse it without a second parse. Placing `servername` in
`config.socket` means it is also passed to cluster `rootNodes`; note
that dynamically-discovered cluster nodes may still lack per-node SNI
(out of scope for this fix).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

@RahulGautamSingh RahulGautamSingh left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Else LGTM

const clusteredMode = rewrittenUrl !== url;

const parsedUrl = parseUrl(rewrittenUrl);
const rawHostname = parsedUrl?.hostname.replace(/^\[(.+)\]$/, '$1') ?? '';

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
const rawHostname = parsedUrl?.hostname.replace(/^\[(.+)\]$/, '$1') ?? '';
const rawHostname = parsedUrl?.hostname.replace(regEx(/^\[(.+)\]$/), '$1') ?? '';

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(cache/redis): set servername for rediss:// so SNI-routed endpoints connect

2 participants