higress-group/higress

connect to server through WebSocket with SSL, the higress gateway response 503 Service Unavailable

Aperta

#506 aperta il 1 set 2023

 (44 commenti) (0 reazioni) (1 assegnatario)Go (1219 fork)github user discovery
area/configgood first issuesig/ops

Metriche repository

Star
 (9036 stelle)
Metriche merge PR
 (Merge medio 7g 9h) (18 PR mergiate in 30 g)

Descrizione

Ⅰ. Issue Description

curl -v https://uass.dev.com
*   Trying 10.20.30.0:443...
* Connected to uass.dev.com (10.20.30.0) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: [NONE]
*  start date: Aug 28 17:52:04 2023 GMT
*  expire date: Nov 26 17:52:04 2023 GMT
*  subjectAltName: host "uass.dev.com" matched cert's "uass.dev.com"
*  issuer: C=CN; ST=ZheJiang; L=HangZhou; O=XXX Inc.; OU=DevOps; CN=XXX DevOps Self Signed Root CA
*  SSL certificate verify ok.
* using HTTP/1.1
> GET / HTTP/1.1
> Host: uass.dev.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 503 Service Unavailable
< content-length: 273
< content-type: text/plain
< date: Fri, 01 Sep 2023 05:57:13 GMT
< server: istio-envoy
<
* Connection #0 to host uass.dev.com left intact
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO%

Ⅱ. Describe what happened

higress gateway response 503 Service Unavailable and some SSL Error.

higress-gateway log:

{"authority":"uass.dev.com","bytes_received":"0","bytes_sent":"273","downstream_local_address":"10.244.120.141:443","downstream_remote_address":"10.20.0.105:11437","duration":"43","istio_policy_status":"-","method":"GET","path":"/","protocol":"HTTP/1.1","request_id":"f5844422-1ab0-4816-b0b3-6dd3c04addae","requested_server_name":"uass.dev.com","response_code":"503","response_flags":"UF,URX","route_name":"default/freeswitch-uas-wss","start_time":"2023-09-01T05:41:51.677Z","trace_id":"e3143f92fd68377c77d6e5098baaaad7","upstream_cluster":"outbound|7443||freeswitch-uas.default.svc.cluster.local","upstream_host":"10.20.0.104:7443","upstream_local_address":"-","upstream_service_time":"-","upstream_transport_failure_reason":"TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36","x_forwarded_for":"10.20.0.105"}

Ⅲ. Describe what you expected to happen

No Error.

Ⅳ. How to reproduce it (as minimally and precisely as possible)

  1. xxx
  2. xxx
  3. xxx

Ⅴ. Anything else we need to know?

Ⅵ. Environment:

  • Higress version: 1.1.1
  • OS : CentOS 7
  • Others:

Guida contributor