tls: add tlsSni option - closes #1114

README.md

@@ -732,6 +732,21 @@ Alternatively, specify the connection through a [`rediss://` URL](https://www.ia
 var redis = new Redis("rediss://redis.my-service.com");
 ```
 
+To enable the Server Name Indication TLS extension (SNI) set the `tlsSni` option to `true`.
+The name is guessed based on the hostname used when opening the stream.
+
+```javascript
+var redis = new Redis({
+  host: "localhost",
+  // optional TLS options (see above)
+  tls: {...},
+  tlsSni: true,
+});
+```
+
+This will basically copy the Redis hostname to `tls.servername` before the connection initialization,
+allowing each node of a Redis Cluster to possess its own SNI.
+
 <hr>
 
 ## Sentinel

lib/cluster/ClusterSubscriber.ts

@@ -74,11 +74,13 @@ export default class ClusterSubscriber {
     this.subscriber = new Redis({
       port: options.port,
       host: options.host,
+      hostOriginal: options.hostOriginal,
       password: options.password,
       enableReadyCheck: true,
       connectionName: SUBSCRIBER_CONNECTION_NAME,
       lazyConnect: true,
       tls: options.tls,
+      tlsSni: options.tlsSni,
     });
 
     // Ignore the errors since they're handled in the connection pool.

lib/cluster/util.ts

@@ -54,6 +54,8 @@ export function normalizeNodeOptions(
     }
     if (!options.host) {
       options.host = "127.0.0.1";
+    } else {
+      options.hostOriginal = options.host;
     }
 
     return options;

lib/connectors/StandaloneConnector.ts

@@ -12,6 +12,8 @@ export function isIIpcConnectionOptions(
 
 export interface ITcpConnectionOptions extends TcpNetConnectOpts {
   tls?: SecureContextOptions;
+  tlsSni?: boolean;
+  hostOriginal?: string;
 }
 
 export interface IIpcConnectionOptions extends IpcNetConnectOpts {
@@ -29,6 +31,7 @@ export default class StandaloneConnector extends AbstractConnector {
     const { options } = this;
     this.connecting = true;
 
+    let isTls = false;
     let connectionOptions: any;
     if (isIIpcConnectionOptions(options)) {
       connectionOptions = {
@@ -42,12 +45,17 @@ export default class StandaloneConnector extends AbstractConnector {
       if (options.host != null) {
         connectionOptions.host = options.host;
       }
+      if (options.tlsSni && (options.hostOriginal || options.host)) {
+        isTls = true;
+        connectionOptions.servername = options.hostOriginal || options.host;
+      }
       if (options.family != null) {
         connectionOptions.family = options.family;
       }
     }
 
     if (options.tls) {
+      isTls = true;
       Object.assign(connectionOptions, options.tls);
     }
 
@@ -66,7 +74,7 @@ export default class StandaloneConnector extends AbstractConnector {
         }
 
         try {
-          if (options.tls) {
+          if (isTls) {
             this.stream = createTLSConnection(connectionOptions);
           } else {
             this.stream = createConnection(connectionOptions);

lib/redis/RedisOptions.ts

@@ -25,6 +25,7 @@ export interface IRedisOptions
   stringNumbers?: boolean;
   maxRetriesPerRequest?: number;
   maxLoadingRetryTime?: number;
+  tlsSni?: boolean;
 }
 
 export const DEFAULT_REDIS_OPTIONS: IRedisOptions = {

test/functional/cluster/nat.ts

@@ -199,7 +199,12 @@ describe("NAT", () => {
 
     cluster.on("ready", () => {
       expect(reset.secondCall.args[0]).to.deep.equal([
-        { host: "127.0.0.1", port: 30001, readOnly: false },
+        {
+          host: "127.0.0.1",
+          hostOriginal: "127.0.0.1",
+          port: 30001,
+          readOnly: false,
+        },
       ]);
       cluster.disconnect();
       done();

test/functional/cluster/tls.ts

@@ -27,7 +27,7 @@ describe("cluster:tls option", () => {
       // @ts-ignore
       expect(op.ca).to.eql("123");
       // @ts-ignore
-      expect(op.port).to.be.oneOf([30001, 30003, 30003]);
+      expect(op.port).to.be.oneOf([30001, 30002, 30003]);
       const stream = net.createConnection(op);
       stream.on("connect", (data) => {
         stream.emit("secureConnect", data);
@@ -56,4 +56,54 @@ describe("cluster:tls option", () => {
       cluster.on("end", () => done());
     });
   });
+
+  it("supports tls sni", (done) => {
+    const slotTable = [
+      [0, 5460, ["127.0.0.1", 30001]],
+      [5461, 10922, ["127.0.0.1", 30002]],
+      [10923, 16383, ["127.0.0.1", 30003]],
+    ];
+    const argvHandler = function (argv) {
+      if (argv[0] === "cluster" && argv[1] === "slots") {
+        return slotTable;
+      }
+    };
+
+    new MockServer(30001, argvHandler);
+    new MockServer(30002, argvHandler);
+    new MockServer(30003, argvHandler);
+
+    // @ts-ignore
+    const stub = sinon.stub(tls, "connect").callsFake((op) => {
+      // @ts-ignore
+      expect(op.host).to.eql("127.0.0.1");
+      // @ts-ignore
+      expect(op.servername).to.eql("localhost");
+      // @ts-ignore
+      expect(op.port).to.be.oneOf([30001, 30002, 30003]);
+      const stream = net.createConnection(op);
+      stream.on("connect", (data) => {
+        stream.emit("secureConnect", data);
+      });
+      return stream;
+    });
+
+    const cluster = new Cluster(
+      [
+        { host: "localhost", port: "30001" },
+        { host: "localhost", port: "30002" },
+        { host: "localhost", port: "30003" },
+      ],
+      {
+        redisOptions: { tlsSni: true },
+      }
+    );
+
+    cluster.on("ready", () => {
+      expect(cluster.subscriber.subscriber.options.tlsSni).to.equal(true);
+      cluster.disconnect();
+      stub.restore();
+      cluster.on("end", () => done());
+    });
+  });
 });

test/functional/tls.ts

@@ -30,6 +30,32 @@ describe("tls option", () => {
         redis.on("end", () => done());
       });
     });
+
+    it("supports tls sni", (done) => {
+      let redis;
+
+      // @ts-ignore
+      const stub = sinon.stub(tls, "connect").callsFake((op) => {
+        // @ts-ignore
+        expect(op.host).to.eql("localhost");
+        // @ts-ignore
+        expect(op.servername).to.eql("localhost");
+        // @ts-ignore
+        expect(op.port).to.eql(6379);
+        const stream = net.createConnection(op);
+        stream.on("connect", (data) => {
+          stream.emit("secureConnect", data);
+        });
+        return stream;
+      });
+
+      redis = new Redis({ tlsSni: true });
+      redis.on("ready", () => {
+        redis.disconnect();
+        stub.restore();
+        redis.on("end", () => done());
+      });
+    });
   });
 
   describe("Sentinel", () => {

test/unit/connectors/connector.ts

@@ -39,5 +39,22 @@ describe("StandaloneConnector", () => {
       expect(spy.firstCall.args[0]).to.eql({ port: 6379, ca: "on" });
       connector.disconnect();
     });
+
+    it("supports tls sni", async () => {
+      const spy = sinon.stub(tls, "connect");
+      const connector = new StandaloneConnector({
+        host: "localhost",
+        port: 6379,
+        tlsSni: true,
+      });
+      await connector.connect(() => {});
+      expect(spy.calledOnce).to.eql(true);
+      expect(spy.firstCall.args[0]).to.eql({
+        host: "localhost",
+        port: 6379,
+        servername: "localhost",
+      });
+      connector.disconnect();
+    });
   });
 });