From 049f5d87e368e2de99479c1b7ea813e6832ac74e Mon Sep 17 00:00:00 2001
From: CatboxParadox <CatboxParadox@users.noreply.github.com>
Date: Wed, 7 Dec 2022 14:45:21 +0100
Subject: [PATCH] Use SNI on outgoing TLS connections (#11458)

When establishing an outgoing TLS connection using a hostname as a target, use TLS SNI extensions to include the hostname in use.
---
 src/tls.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/tls.c b/src/tls.c
index d938fbe19..bfb4250c1 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -44,6 +44,7 @@
 #include <openssl/decoder.h>
 #endif
 #include <sys/uio.h>
+#include <arpa/inet.h>
 
 #define REDIS_TLS_PROTO_TLSv1       (1<<0)
 #define REDIS_TLS_PROTO_TLSv1_1     (1<<1)
@@ -857,10 +858,16 @@ static int connTLSAccept(connection *_conn, ConnectionCallbackFunc accept_handle
 
 static int connTLSConnect(connection *conn_, const char *addr, int port, const char *src_addr, ConnectionCallbackFunc connect_handler) {
     tls_connection *conn = (tls_connection *) conn_;
+    unsigned char addr_buf[sizeof(struct in6_addr)];
 
     if (conn->c.state != CONN_STATE_NONE) return C_ERR;
     ERR_clear_error();
 
+    /* Check whether addr is an IP address, if not, use the value for Server Name Indication */
+    if (inet_pton(AF_INET, addr, addr_buf) != 1 && inet_pton(AF_INET6, addr, addr_buf) != 1) {
+        SSL_set_tlsext_host_name(conn->ssl, addr);
+    }
+
     /* Initiate Socket connection first */
     if (connectionTypeTcp()->connect(conn_, addr, port, src_addr, connect_handler) == C_ERR) return C_ERR;