Envoy misdirecting valid URLs when Envoy HTTP/S default ports are not used

[ashirvadgupta]

What steps did you take and what happened:
Envoy misdirecting valid URLs when Envoy HTTP/S default ports are not used.
In my setup, I am changing the envoy https port from 443 to 8443. Its trying to match the host portal.example.com but its getting host as portal.example.com:8443.

Here is curl output

curl https://portal.devtest.example.com:8443/devtest -v

Trying xx.xx.xx.xx...
TCP_NODELAY set
Connected to portal.devtest.example.com (xx.xx.xx.xx) port 8443 (#0)
ALPN, offering h2
ALPN, offering http/1.1
Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@strength
successfully set certificate verify locations:
CAfile: /etc/ssl/cert.pem
CApath: none
TLSv1.2 (OUT), TLS handshake, Client hello (1):
TLSv1.2 (IN), TLS handshake, Server hello (2):
TLSv1.2 (IN), TLS handshake, Certificate (11):
TLSv1.2 (IN), TLS handshake, Server key exchange (12):
TLSv1.2 (IN), TLS handshake, Server finished (14):
TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
TLSv1.2 (OUT), TLS change cipher, Client hello (1):
TLSv1.2 (OUT), TLS handshake, Finished (20):
TLSv1.2 (IN), TLS change cipher, Client hello (1):
TLSv1.2 (IN), TLS handshake, Finished (20):
SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305
ALPN, server accepted to use h2
Server certificate:
subject: C=US; ST=California; L=San Jose; O=example Inc; OU=ESD; CN=.devtest.example.com
start date: May 19 00:00:00 2020 GMT
expire date: May 20 12:00:00 2022 GMT
subjectAltName: host "portal.devtest.example.com" matched cert's ".devtest.example.com"
issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA
SSL certificate verify ok.
Using HTTP2, server supports multi-use
Connection state changed (HTTP/2 confirmed)
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
Using Stream ID: 1 (easy handle 0x7ffb20806600)
GET /devtest HTTP/2
Host: portal.devtest.example.com:8443
User-Agent: curl/7.54.0
Accept: /

Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 421
< content-length: 0
< date: Wed, 03 Jun 2020 20:19:13 GMT
< server: envoy
<
Connection #0 to host portal.devtest.example.com left intact

What did you expect to happen:
It should take into account Envoy HTTP/S ports while validating hosts before throwing 421 Redirection error.

Anything else you would like to add:

Environment:

• Contour version: v1.5.0
• Kubernetes version: (use kubectl version): Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.5", GitCommit:"20c265fef0741dd71a66480e35bd69f18351daea", GitTreeState:"clean", BuildDate:"2019-10-15T19:16:51Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"darwin/amd64"}
  Server Version: version.Info{Major:"1", Minor:"14+", GitVersion:"v1.14.10-gke.36", GitCommit:"34a615f32e9a0c9e97cdb9f749adb392758349a6", GitTreeState:"clean", BuildDate:"2020-04-06T16:33:17Z", GoVersion:"go1.12.12b4", Compiler:"gc", Platform:"linux/amd64"}
• Kubernetes installer & version:
• Cloud provider or hardware configuration: GKE
• OS (e.g. from /etc/os-release):

[jpeach]

@ashirvadgupta Does this configuration work as expected in Contour 1.4?

For curl, you can do

$ curl -H "Host: portal.devtest.example.com" https://portal.devtest.example.com:8443/devtest

But depending on the application, it might not be feasible to do this in the general case

[ashirvadgupta]

@ashirvadgupta Does this configuration work as expected in Contour 1.4?

For curl, you can do

$ curl -H "Host: portal.devtest.example.com" https://portal.devtest.example.com:8443/devtest

But depending on the application, it might not be feasible to do this in the general case

Output of two commands is same. So its working in Contour 1.4
curl -H "Host: portal.devtest.example.com" https://portal.devtest.example.com:8443/devtest -v
curl https://portal.devtest.example.com:8443/devtest -v

$curl -H "Host: portal.devtest.example.com" https://portal.devtest.example.com:8443/devtest -v

• Trying xx.xx.xx.xx...
• TCP_NODELAY set
• Connected to portal.devtest.example.com (xx.xx.xx.xx) port 8443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@strength
• successfully set certificate verify locations:
• CAfile: /etc/ssl/cert.pem
  CApath: none
• TLSv1.2 (OUT), TLS handshake, Client hello (1):
• TLSv1.2 (IN), TLS handshake, Server hello (2):
• TLSv1.2 (IN), TLS handshake, Certificate (11):
• TLSv1.2 (IN), TLS handshake, Server key exchange (12):
• TLSv1.2 (IN), TLS handshake, Server finished (14):
• TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
• TLSv1.2 (OUT), TLS change cipher, Client hello (1):
• TLSv1.2 (OUT), TLS handshake, Finished (20):
• TLSv1.2 (IN), TLS change cipher, Client hello (1):
• TLSv1.2 (IN), TLS handshake, Finished (20):
• SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305
• ALPN, server accepted to use h2
• Server certificate:
• subject: C=US; ST=California; L=San Jose; O=example Inc; OU=ESD; CN=*.devtest.example.com
• start date: May 19 00:00:00 2020 GMT
• expire date: May 20 12:00:00 2022 GMT
• subjectAltName: host "portal.devtest.example.com" matched cert's "*.devtest.example.com"
• issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA
• SSL certificate verify ok.
• Using HTTP2, server supports multi-use
• Connection state changed (HTTP/2 confirmed)
• Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
• Using Stream ID: 1 (easy handle 0x7fe18f00d800)

GET /devtest HTTP/2
Host: portal.devtest.example.com
User-Agent: curl/7.54.0
Accept: /

• Connection state changed (MAX_CONCURRENT_STREAMS updated)!
  < HTTP/2 302
  < date: Fri, 05 Jun 2020 05:38:17 GMT
  < location: https://portal.devtest.example.com/devtest/
  < content-length: 0
  < server: envoy
  < x-envoy-upstream-service-time: 5
  <
• Connection #0 to host portal.devtest.example.com left intact

[ashirvadgupta]

You can add an extra OR condition if envoy port HTTP/S ports are different than 80/443, then if those ports are present in the host authority header, then do not misdirect.

[WillPlatnick]

I am experiencing this issue as well. In my case, I didn't change the envoy port, I have haproxy in front of contour, reverse proxying 8443 traffic to port 443 in contour.

[ashirvadgupta]

Thanks @jpeach for fixing it

[jpeach]

xref #1493
xref #2483