higress-group/higress
connect to server through WebSocket with SSL, the higress gateway response 503 Service Unavailable
Aperta
#506 aperta il 1 set 2023
area/configgood first issuesig/ops
Metriche repository
- Star
- (9036 stelle)
- Metriche merge PR
- (Merge medio 7g 9h) (18 PR mergiate in 30 g)
Descrizione
Ⅰ. Issue Description
curl -v https://uass.dev.com
* Trying 10.20.30.0:443...
* Connected to uass.dev.com (10.20.30.0) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
* subject: [NONE]
* start date: Aug 28 17:52:04 2023 GMT
* expire date: Nov 26 17:52:04 2023 GMT
* subjectAltName: host "uass.dev.com" matched cert's "uass.dev.com"
* issuer: C=CN; ST=ZheJiang; L=HangZhou; O=XXX Inc.; OU=DevOps; CN=XXX DevOps Self Signed Root CA
* SSL certificate verify ok.
* using HTTP/1.1
> GET / HTTP/1.1
> Host: uass.dev.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 503 Service Unavailable
< content-length: 273
< content-type: text/plain
< date: Fri, 01 Sep 2023 05:57:13 GMT
< server: istio-envoy
<
* Connection #0 to host uass.dev.com left intact
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO%
Ⅱ. Describe what happened
higress gateway response 503 Service Unavailable and some SSL Error.
higress-gateway log:
{"authority":"uass.dev.com","bytes_received":"0","bytes_sent":"273","downstream_local_address":"10.244.120.141:443","downstream_remote_address":"10.20.0.105:11437","duration":"43","istio_policy_status":"-","method":"GET","path":"/","protocol":"HTTP/1.1","request_id":"f5844422-1ab0-4816-b0b3-6dd3c04addae","requested_server_name":"uass.dev.com","response_code":"503","response_flags":"UF,URX","route_name":"default/freeswitch-uas-wss","start_time":"2023-09-01T05:41:51.677Z","trace_id":"e3143f92fd68377c77d6e5098baaaad7","upstream_cluster":"outbound|7443||freeswitch-uas.default.svc.cluster.local","upstream_host":"10.20.0.104:7443","upstream_local_address":"-","upstream_service_time":"-","upstream_transport_failure_reason":"TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36","x_forwarded_for":"10.20.0.105"}
- Problems related to envoy: https://github.com/envoyproxy/envoy/issues/13047
- Problems related to istio: https://github.com/istio/istio/issues/36301
Ⅲ. Describe what you expected to happen
No Error.
Ⅳ. How to reproduce it (as minimally and precisely as possible)
- xxx
- xxx
- xxx
Ⅴ. Anything else we need to know?
Ⅵ. Environment:
- Higress version: 1.1.1
- OS : CentOS 7
- Others: