SSL CN name checked failed after Redis Sentinel failover

[aashishamrute]

Bug Report

Current Behavior

Redis sentinel 3 sentinel and 3 redis node with TLS connection.
First attempt to connect redis with TLS successful, but when master goes down, sentinel elect new master, while connecting to new master, CN name verification failed, as Lettuce lib still using old master host name for verification. It connect to new master but verify certificate CN name against old master.

Please note, issue existed either sentinal announcing IP address or DNS/hostname.

Environment

• Lettuce version(s): 6.1.1.RELEASE
• Redis version: 6

[mp911de]

This is indeed a bug. The SSL handler is initialized once at connection creation with the SocketAddress reported by sentinel. Upon reconnects, the SSL handler retains its initial SocketAddress but the actual address where the connection reconnect points to is already a different one. We need to provide means to ConnectionWatchdog and ReconnectHandler to re-initialize the ChannelInitializer to ensure that the SSL validation happens against the correct endpoint.