higress-group/higress

connect to server through WebSocket with SSL, the higress gateway response 503 Service Unavailable

オープン

#506 opened on 2023/09/01

 (44 件のコメント) (0 件のリアクション) (1 人の担当者)Go (1,219 件のフォーク)github user discovery
area/configgood first issuesig/ops

Repository metrics

Stars
 (9,036 個のスター)
PR merge metrics
 (平均マージ 7d 9h) (30d で 18 merged PRs)

説明

Ⅰ. Issue Description

curl -v https://uass.dev.com
*   Trying 10.20.30.0:443...
* Connected to uass.dev.com (10.20.30.0) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: [NONE]
*  start date: Aug 28 17:52:04 2023 GMT
*  expire date: Nov 26 17:52:04 2023 GMT
*  subjectAltName: host "uass.dev.com" matched cert's "uass.dev.com"
*  issuer: C=CN; ST=ZheJiang; L=HangZhou; O=XXX Inc.; OU=DevOps; CN=XXX DevOps Self Signed Root CA
*  SSL certificate verify ok.
* using HTTP/1.1
> GET / HTTP/1.1
> Host: uass.dev.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 503 Service Unavailable
< content-length: 273
< content-type: text/plain
< date: Fri, 01 Sep 2023 05:57:13 GMT
< server: istio-envoy
<
* Connection #0 to host uass.dev.com left intact
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO%

Ⅱ. Describe what happened

higress gateway response 503 Service Unavailable and some SSL Error.

higress-gateway log:

{"authority":"uass.dev.com","bytes_received":"0","bytes_sent":"273","downstream_local_address":"10.244.120.141:443","downstream_remote_address":"10.20.0.105:11437","duration":"43","istio_policy_status":"-","method":"GET","path":"/","protocol":"HTTP/1.1","request_id":"f5844422-1ab0-4816-b0b3-6dd3c04addae","requested_server_name":"uass.dev.com","response_code":"503","response_flags":"UF,URX","route_name":"default/freeswitch-uas-wss","start_time":"2023-09-01T05:41:51.677Z","trace_id":"e3143f92fd68377c77d6e5098baaaad7","upstream_cluster":"outbound|7443||freeswitch-uas.default.svc.cluster.local","upstream_host":"10.20.0.104:7443","upstream_local_address":"-","upstream_service_time":"-","upstream_transport_failure_reason":"TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36","x_forwarded_for":"10.20.0.105"}

Ⅲ. Describe what you expected to happen

No Error.

Ⅳ. How to reproduce it (as minimally and precisely as possible)

  1. xxx
  2. xxx
  3. xxx

Ⅴ. Anything else we need to know?

Ⅵ. Environment:

  • Higress version: 1.1.1
  • OS : CentOS 7
  • Others:

コントリビューターガイド