higress-group/higress

connect to server through WebSocket with SSL, the higress gateway response 503 Service Unavailable

Ouverte

#506 ouverte le 1 sept. 2023

 (44 commentaires) (0 réaction) (1 personne assignée)Go (1 219 forks)github user discovery
area/configgood first issuesig/ops

Métriques du dépôt

Stars
 (9 036 étoiles)
Métriques de merge PR
 (Merge moyen 7j 9h) (18 PRs mergées en 30 j)

Description

Ⅰ. Issue Description

curl -v https://uass.dev.com
*   Trying 10.20.30.0:443...
* Connected to uass.dev.com (10.20.30.0) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: [NONE]
*  start date: Aug 28 17:52:04 2023 GMT
*  expire date: Nov 26 17:52:04 2023 GMT
*  subjectAltName: host "uass.dev.com" matched cert's "uass.dev.com"
*  issuer: C=CN; ST=ZheJiang; L=HangZhou; O=XXX Inc.; OU=DevOps; CN=XXX DevOps Self Signed Root CA
*  SSL certificate verify ok.
* using HTTP/1.1
> GET / HTTP/1.1
> Host: uass.dev.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 503 Service Unavailable
< content-length: 273
< content-type: text/plain
< date: Fri, 01 Sep 2023 05:57:13 GMT
< server: istio-envoy
<
* Connection #0 to host uass.dev.com left intact
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO%

Ⅱ. Describe what happened

higress gateway response 503 Service Unavailable and some SSL Error.

higress-gateway log:

{"authority":"uass.dev.com","bytes_received":"0","bytes_sent":"273","downstream_local_address":"10.244.120.141:443","downstream_remote_address":"10.20.0.105:11437","duration":"43","istio_policy_status":"-","method":"GET","path":"/","protocol":"HTTP/1.1","request_id":"f5844422-1ab0-4816-b0b3-6dd3c04addae","requested_server_name":"uass.dev.com","response_code":"503","response_flags":"UF,URX","route_name":"default/freeswitch-uas-wss","start_time":"2023-09-01T05:41:51.677Z","trace_id":"e3143f92fd68377c77d6e5098baaaad7","upstream_cluster":"outbound|7443||freeswitch-uas.default.svc.cluster.local","upstream_host":"10.20.0.104:7443","upstream_local_address":"-","upstream_service_time":"-","upstream_transport_failure_reason":"TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36","x_forwarded_for":"10.20.0.105"}

Ⅲ. Describe what you expected to happen

No Error.

Ⅳ. How to reproduce it (as minimally and precisely as possible)

  1. xxx
  2. xxx
  3. xxx

Ⅴ. Anything else we need to know?

Ⅵ. Environment:

  • Higress version: 1.1.1
  • OS : CentOS 7
  • Others:

Guide contributeur