Redirect to https does not replace the http port correctly when specifying use-port-in-redirects in configmap #1882

cristic83 · 2018-01-08T09:03:51Z

NGINX Ingress controller version:
quay.io/aledbf/nginx-ingress-controller:0.296

Kubernetes version (use kubectl version):
oc v3.6.1+008f2d5
kubernetes v1.6.1+5115d708d7

Environment:

Cloud provider or hardware configuration: AWS
OS (e.g. from /etc/os-release):
NAME="Red Hat Enterprise Linux Server"
VERSION="7.2 (Maipo)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="7.2"
PRETTY_NAME="Red Hat Enterprise Linux Server 7.2 (Maipo)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:7.2:GA:server"
HOME_URL="https://www.redhat.com/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
REDHAT_BUGZILLA_PRODUCT_VERSION=7.2
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="7.2"

Kernel (e.g. uname -a):
Linux ip-10-0-110-21.eu-west-1.compute.internal 3.10.0-327.el7.x86_64 #1 SMP Thu Oct 29 17:29:29 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux

Install tools:
OpneShift

What happened:

Using a configuration map specified with the config flag --configmap that contains use-port-in-redirects: "true", the nginx-ingress controller doesn't work properly:
`curl http://my-domain:8080/health -v

Trying 127.0.0.1...
Connected to my-domain (127.0.0.1) port 8080 (#0)
GET /health HTTP/1.1
Host: my-domain:8080
User-Agent: curl/7.47.0
Accept: /
< HTTP/1.1 301 Moved Permanently
< Server: nginx/1.13.7
< Date: Fri, 05 Jan 2018 12:24:51 GMT
< Content-Type: text/html
< Content-Length: 185
< Connection: keep-alive
< Location: https://my-domain:8080:8843/health`

aledbf · 2018-01-08T12:06:33Z

@cristic83 please use quay.io/aledbf/nginx-ingress-controller:0.304. This issue is fixed in master

aledbf · 2018-01-08T12:06:46Z

Please reopen if the issue persists after the update

cristic83 · 2018-01-09T12:36:29Z

Hi, the issue persists with version 0.304:
` curl http://my-domain:8080/health -v

Trying 127.0.0.1...
Connected to my-domain (127.0.0.1) port 8080 (#0)

GET /health HTTP/1.1
Host: my-domain:8080
User-Agent: curl/7.47.0
Accept: /

< HTTP/1.1 308 Permanent Redirect
< Server: nginx/1.13.8
< Date: Tue, 09 Jan 2018 12:29:43 GMT
< Content-Type: text/html
< Content-Length: 187
< Connection: keep-alive
< Location: https://my-domain:8080:8843/health
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
`

cristic83 · 2018-01-10T08:47:41Z

Hi @aledbf, I am not allowed to reopen the issue, so this is just to let you know that the issue stil isn't fixed in the version 0.304, as described in the above comment.

aledbf · 2018-01-16T18:53:04Z

@cristic83 please use quay.io/aledbf/nginx-ingress-controller:0.307

valentinabojan · 2018-01-17T12:22:56Z

@aledbf : The issue is still not fixed in version 0.307. The error is the same as above. By looking at the commit, we think that the issue is that the variable best_http_host (its value is "my-domain:8080") is used when the https redirect is required.

aledbf · 2018-01-17T12:29:54Z

@valentinabojan an you post the configuration you are using?

This is the output using the flag --https-port=1234

$ curl -v http://$(minikube ip):31527 -H 'Host: echoheaders.uswest2-01.rocket-science.io'
* Rebuilt URL to: http://192.168.99.100:31527/
*   Trying 192.168.99.100...
* TCP_NODELAY set
* Connected to 192.168.99.100 (192.168.99.100) port 31527 (#0)
> GET / HTTP/1.1
> Host: echoheaders.uswest2-01.rocket-science.io
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 308 Permanent Redirect
< Date: Wed, 17 Jan 2018 12:28:08 GMT
< Content-Type: text/html
< Content-Length: 180
< Connection: keep-alive
< Location: https://echoheaders.uswest2-01.rocket-science.io:1234/
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
< 
<html>
<head><title>308 Permanent Redirect</title></head>
<body bgcolor="white">
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host 192.168.99.100 left intact

valentinabojan · 2018-01-17T13:03:50Z

@aledbf Here are the arguments used to run the ingress controller:

[ec2-user@ip-10-0-110-21 ~]$ oc get configmap nginx-controller-conf -o yaml
apiVersion: v1
data:
use-port-in-redirects: "true"
kind: ConfigMap

[ec2-user@ip-10-0-110-21 ~]$ oc get daemonset nginx-ingress-lb -o yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
...
- args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --http-port=8080
- --https-port=8843
- --configmap=$(POD_NAMESPACE)/nginx-controller-conf

aledbf · 2018-01-17T13:10:16Z

@valentinabojan can you post a curl request please?

valentinabojan · 2018-01-17T13:21:30Z

curl http://my-domain:8080/health -v

*   Trying 127.0.0.1...
* Connected to my-domain (127.0.0.1) port 8080 (#0)
> GET /health HTTP/1.1
> Host: my-domain:8080
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 308 Permanent Redirect
< Server: nginx/1.13.8
< Date: Wed, 17 Jan 2018 13:18:57 GMT
< Content-Type: text/html
< Content-Length: 187
< Connection: close
< Location: https://my-domain:8080:8843/health
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
< 
<html>
<head><title>308 Permanent Redirect</title></head>
<body bgcolor="white">
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx/1.13.8</center>
</body>
</html>
* Closing connection 0

aledbf · 2018-01-17T13:22:05Z

@valentinabojan thanks

cristic83 · 2018-01-17T13:48:28Z

@aledbf : I suppose that testing with: -H 'Host: echoheaders.uswest2-01.rocket-science.io' in the curl request prevents the bug from appearing, because the http port is not present there.

valentinabojan · 2018-01-17T14:06:32Z

@aledbf Indeed, @cristic83 is right. Adding the Host header makes the request to return the expected result, while not adding the Host header reproduces the bug. Below I will add the two scenarios:

curl http://my-domain:8080/health -v -H 'Host: my-domain'


*   Trying 127.0.0.1...
* Connected to my-domain (127.0.0.1) port 8080 (#0)
> GET /health HTTP/1.1
> Host: my-domain
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 308 Permanent Redirect
< Server: nginx/1.13.8
< Date: Wed, 17 Jan 2018 14:02:30 GMT
< Content-Type: text/html
< Content-Length: 187
< Connection: close
< Location: https://my-domain:8843/health
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
< 
<html>
<head><title>308 Permanent Redirect</title></head>
<body bgcolor="white">
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx/1.13.8</center>
</body>
</html>
* Closing connection 0

curl http://my-domain:8080/health -v

*   Trying 127.0.0.1...
* Connected to my-domain (127.0.0.1) port 8080 (#0)
> GET /health HTTP/1.1
> Host:my-domain:8080
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 308 Permanent Redirect
< Server: nginx/1.13.8
< Date: Wed, 17 Jan 2018 14:05:23 GMT
< Content-Type: text/html
< Content-Length: 187
< Connection: close
< Location: https://my-domain:8080:8843/health
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
< 
<html>
<head><title>308 Permanent Redirect</title></head>
<body bgcolor="white">
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx/1.13.8</center>
</body>
</html>
* Closing connection 0

aledbf · 2018-01-17T18:07:35Z

@valentinabojan @cristic83 please use quay.io/aledbf/nginx-ingress-controller:0.309

valentinabojan · 2018-01-18T08:09:03Z

@aledbf Unfortunately, version 0.309 doesn't solve our issue. Executing **curl http://my-domain:8080/health -v ** still results into the same wrong location:

*   Trying 127.0.0.1...
* Connected to my-domain (127.0.0.1) port 8080 (#0)
> GET /health HTTP/1.1
> Host: my-domain:8080
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 308 Permanent Redirect
< Server: nginx/1.13.8
< Date: Thu, 18 Jan 2018 08:04:25 GMT
< Content-Type: text/html
< Content-Length: 187
< Connection: close
< Location: https://my-domain:8080:8843/health
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
<
<html>

aledbf · 2018-01-18T16:09:46Z

@valentinabojan @cristic83 please use quay.io/aledbf/nginx-ingress-controller:0.310

aledbf · 2018-01-18T16:10:22Z

By looking at the commit, we think that the issue is that the variable best_http_host (its value is "my-domain:8080") is used when the https redirect is required.

That was the issue. The best_http_host contained the host + port.
The PR 1926 replaces the map to just use the $host variable

valentinabojan · 2018-01-19T08:19:26Z

@aledbf Indeed, the last version solved our issue. Thank a lot for your help!

aledbf closed this as completed Jan 8, 2018

aledbf reopened this Jan 10, 2018

aledbf mentioned this issue Jan 16, 2018

Fix custom port in redirects #1907

Merged

aledbf closed this as completed in #1907 Jan 17, 2018

aledbf reopened this Jan 17, 2018

aledbf mentioned this issue Jan 18, 2018

Do not use port from host header #1926

Merged

aledbf closed this as completed in #1926 Jan 18, 2018

ElvinEfendi mentioned this issue Feb 3, 2018

do not ignore $http_host and $http_x_forwarded_host #2030

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Redirect to https does not replace the http port correctly when specifying use-port-in-redirects in configmap #1882

Redirect to https does not replace the http port correctly when specifying use-port-in-redirects in configmap #1882

cristic83 commented Jan 8, 2018

aledbf commented Jan 8, 2018

aledbf commented Jan 8, 2018

cristic83 commented Jan 9, 2018 •

edited

Loading

cristic83 commented Jan 10, 2018

aledbf commented Jan 16, 2018

valentinabojan commented Jan 17, 2018 •

edited

Loading

aledbf commented Jan 17, 2018

valentinabojan commented Jan 17, 2018 •

edited

Loading

aledbf commented Jan 17, 2018

valentinabojan commented Jan 17, 2018

aledbf commented Jan 17, 2018

cristic83 commented Jan 17, 2018

valentinabojan commented Jan 17, 2018 •

edited

Loading

aledbf commented Jan 17, 2018

valentinabojan commented Jan 18, 2018

aledbf commented Jan 18, 2018

aledbf commented Jan 18, 2018 •

edited

Loading

valentinabojan commented Jan 19, 2018

Redirect to https does not replace the http port correctly when specifying use-port-in-redirects in configmap #1882

Redirect to https does not replace the http port correctly when specifying use-port-in-redirects in configmap #1882

Comments

cristic83 commented Jan 8, 2018

aledbf commented Jan 8, 2018

aledbf commented Jan 8, 2018

cristic83 commented Jan 9, 2018 • edited Loading

cristic83 commented Jan 10, 2018

aledbf commented Jan 16, 2018

valentinabojan commented Jan 17, 2018 • edited Loading

aledbf commented Jan 17, 2018

valentinabojan commented Jan 17, 2018 • edited Loading

aledbf commented Jan 17, 2018

valentinabojan commented Jan 17, 2018

aledbf commented Jan 17, 2018

cristic83 commented Jan 17, 2018

valentinabojan commented Jan 17, 2018 • edited Loading

aledbf commented Jan 17, 2018

valentinabojan commented Jan 18, 2018

aledbf commented Jan 18, 2018

aledbf commented Jan 18, 2018 • edited Loading

valentinabojan commented Jan 19, 2018

cristic83 commented Jan 9, 2018 •

edited

Loading

valentinabojan commented Jan 17, 2018 •

edited

Loading

valentinabojan commented Jan 17, 2018 •

edited

Loading

valentinabojan commented Jan 17, 2018 •

edited

Loading

aledbf commented Jan 18, 2018 •

edited

Loading