[SOLVED] hiredis fails with TLS

hiredis fails with TLS

I have the following code for using Redis in C. Bases in hiredis.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <hiredis.h>

int main(int argc, char **argv) {
    unsigned int j;
    redisContext *c;
    redisReply *reply;

    const char *hostname = "MY-HOSTNAME";
    int port = 6379;

    const char *cert = NULL;
    const char *key = NULL;
    const char *ca = "MY-CA";

    struct timeval tv = { 1, 500000 }; // 1.5 seconds
    redisOptions options = {0};
    REDIS_OPTIONS_SET_TCP(&options, hostname, port);
    options.timeout = &tv;
    c = redisConnectWithOptions(&options);

    if (c == NULL || c->err) {
        if (c) {
            printf("Connection error: %s\n", c->errstr);
            redisFree(c);
        } else {
            printf("Connection error: can't allocate redis context\n");
        }
        exit(1);
    }

    if (redisSecureConnection(c, ca, cert, key, "sni") != REDIS_OK) {
        printf("Couldn't initialize SSL!\n");
        printf("Error: %s\n", c->errstr);
        redisFree(c);
        exit(1);
    }

    reply = redisCommand(c,"SELECT 0");
    printf("SELECT DB: %s\n", reply->str);
    freeReplyObject(reply);

    redisFree(c);

    return 0;
}

However, it keeps failing with:

Couldn't initialize SSL!
Error:

The error is blank, and I have no control over the Redis server.

How to debug?

redisSecureConnection(c, ca, cert, key, "sni") seems to return -1.

Wireshark outputs the following:

1027  26.554662 192.168.20.228 → 179.11.21.99 TCP 64 55480 → 30642 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 TSval=197044507 TSecr=0 SACK_PERM=1
 1028  26.589376 179.11.21.99 → 192.168.20.228 TCP 60 30642 → 55480 [SYN, ACK] Seq=0 Ack=1 Win=28560 Len=0 MSS=1440 SACK_PERM=1 TSval=136342937 TSecr=197044507 WS=512
 1029  26.589430 192.168.20.228 → 179.11.21.99 TCP 52 55480 → 30642 [ACK] Seq=1 Ack=1 Win=131328 Len=0 TSval=197044541 TSecr=136342937
 1030  26.589625 192.168.20.228 → 179.11.21.99 TCP 52 55480 → 30642 [FIN, ACK] Seq=1 Ack=1 Win=131328 Len=0 TSval=197044541 TSecr=136342937
 1033  26.625423 179.11.21.99 → 192.168.20.228 TCP 52 30642 → 55480 [FIN, ACK] Seq=1 Ack=2 Win=28672 Len=0 TSval=136342946 TSecr=197044541
 1034  26.625499 192.168.20.228 → 179.11.21.99 TCP 52 55480 → 30642 [ACK] Seq=2 Ack=2 Win=131328 Len=0 TSval=197044577 TSecr=136342946

Which indicates that no SSL / TLS is ever tried, no Client Hello etc.

If I try with NodeJS client I get this, and things work:

902034 1181.706157 192.168.20.228 → 179.11.21.99 TCP 64 56765 → 30642 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 TSval=198187591 TSecr=0 SACK_PERM=1
902035 1181.742757 179.11.21.99 → 192.168.20.228 TCP 60 30642 → 56765 [SYN, ACK] Seq=0 Ack=1 Win=28560 Len=0 MSS=1440 SACK_PERM=1 TSval=106784830 TSecr=198187591 WS=512
902036 1181.742823 192.168.20.228 → 179.11.21.99 TCP 52 56765 → 30642 [ACK] Seq=1 Ack=1 Win=131328 Len=0 TSval=198187627 TSecr=106784830
902037 1181.744130 192.168.20.228 → 179.11.21.99 TLSv1 272 Client Hello
902039 1181.779023 179.11.21.99 → 192.168.20.228 TLSv1.2 1480 Server Hello
902040 1181.779026 179.11.21.99 → 192.168.20.228 TLSv1.2 912 Certificate, Server Key Exchange, Server Hello Done

Solution

The example code you provide is correct and should work, or at least produce a meaningful error message in all cases of misconfiguration.

Getting an REDIS_ERR without any error message indicates your version of hiredis is not compiled with SSL/TLS support.

If you're building hiredis yourself, use make USE_SSL=1 in order to build SSL/TLS support as by default it is not currently enabled. You can then recompile and relink your example using something like gcc example.c libhiredis.a -o example -lssl -lcrypto (on Linux).