Redirect http to https on the same destination

[atillamas]

Hi, is it possible to use fabio to redirect http to https on the same destination? for example redirect http://example.com to https://example.com ? when I've tried it i just get a redirect-loop.

[aaronhurt]

something like ...

route add http-redirect www.example.com:80 https://www.example.com$path opts "redirect=301"

[aaronhurt]

when doing http -> https the match host needs to have the port or else you will get a redirect for sure

[atillamas]

@leprechau Hi. thanks for the suggestion, unfortunately i get a redirect loop using that example

[aaronhurt]

That's odd ... that's literally the exact copy/paste from our production config with the hostname changed.

[atillamas]

@leprechau

In fabio UI:

26 | http-redirect | some.domain.example.com:80/ | https://some.domain.example.com$path | redirect=301 | 100.00% |

And a curl:

curl -iL some.domain.example.com
HTTP/1.1 301 Moved Permanently                    
Date: Thu, 22 Feb 2018 16:39:26 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 65
Connection: keep-alive
Location: https://some.domain.example.com/

HTTP/2 301 
date: Thu, 22 Feb 2018 16:39:26 GMT
content-type: text/html; charset=utf-8
content-length: 65
location: https://some.domain.example.com/

HTTP/2 301 
date: Thu, 22 Feb 2018 16:39:26 GMT
content-type: text/html; charset=utf-8
content-length: 65
location: https://some.domain.example.com/

HTTP/2 301 
date: Thu, 22 Feb 2018 16:39:26 GMT
content-type: text/html; charset=utf-8
content-length: 65
location: https://some.domain.example.com/
<continues>

curl: (47) Maximum (50) redirects followed

If i remove the redirect accessing both http and https://some.domain.example.com works fine.

[aaronhurt]

So, I'm assuming that go.staging.budbee.com == some.domain.example.com ...

Secondly have you tried removing the trailing slash from the route match?

Meaning some.domain.example.com:80 instead of some.domain.example.com:80/ ... also are you sure the target backend service is not doing any additional redirect? I find it a bit odd that you are getting mixed HTTP/1.1 and HTTP/2 redirects.

[atillamas]

@leprechau yes that is correct, silly me missed the curl :)
Anyway
In the ui i type in this:
route add http-redirect go.staging.budbee.com:80 https://go.staging.budbee.com$path opts "redirect=301"
but it shows the trailing slash when i look at the rules.
The mixed HTTP/1.1 and HTTP/2 redirecets could be that it's two services listening, one is listening on the original go.staging.budbee.com and one is listening on go.staging.budbee.com/api

[aaronhurt]

Can you post a full log of ...

curl --http1.1 --max-redirs 3 -vL go.staging.budbee.com

[atillamas]

curl --http1.1 --max-redirs 3 -vL go.staging.budbee.com
* Rebuilt URL to: go.staging.budbee.com/
*   Trying 54.229.60.69...
* TCP_NODELAY set
* Connected to go.staging.budbee.com (54.229.60.69) port 80 (#0)
> GET / HTTP/1.1
> Host: go.staging.budbee.com
> User-Agent: curl/7.53.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 17:37:32 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 65
< Connection: keep-alive
< Location: https://go.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #0 to host go.staging.budbee.com left intact
* Issue another request to this URL: 'https://go.staging.budbee.com/'
*   Trying 34.250.238.214...
* TCP_NODELAY set
* Connected to go.staging.budbee.com (34.250.238.214) port 443 (#1)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: none
  CApath: none
* loaded libnssckbi.so
* ALPN, server accepted to use http/1.1
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* 	subject: CN=budbee.com
* 	start date: May 17 00:00:00 2017 GMT
* 	expire date: Jun 17 12:00:00 2018 GMT
* 	common name: budbee.com
* 	issuer: CN=Amazon,OU=Server CA 1B,O=Amazon,C=US
> GET / HTTP/1.1
> Host: go.staging.budbee.com
> User-Agent: curl/7.53.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 17:37:32 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 65
< Connection: keep-alive
< Location: https://go.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #1 to host go.staging.budbee.com left intact
* Issue another request to this URL: 'https://go.staging.budbee.com/'
* Found bundle for host go.staging.budbee.com: 0x55c7b23436c0 [can pipeline]
* Re-using existing connection! (#1) with host go.staging.budbee.com
* Connected to go.staging.budbee.com (34.250.238.214) port 443 (#1)
> GET / HTTP/1.1
> Host: go.staging.budbee.com
> User-Agent: curl/7.53.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 17:37:32 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 65
< Connection: keep-alive
< Location: https://go.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #1 to host go.staging.budbee.com left intact
* Issue another request to this URL: 'https://go.staging.budbee.com/'
* Found bundle for host go.staging.budbee.com: 0x55c7b23436c0 [can pipeline]
* Re-using existing connection! (#1) with host go.staging.budbee.com
* Connected to go.staging.budbee.com (34.250.238.214) port 443 (#1)
> GET / HTTP/1.1
> Host: go.staging.budbee.com
> User-Agent: curl/7.53.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 17:37:32 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 65
< Connection: keep-alive
< Location: https://go.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #1 to host go.staging.budbee.com left intact
* Maximum (3) redirects followed
curl: (47) Maximum (3) redirects followed

[aaronhurt]

So it looks like you switch to a different host for the port 443 request than the port 80 request. Is it possible there is a difference in configuration between those two hosts?

[atillamas]

They are running behind an ALB in different docker-containers, 2 with go.staging.budbee.com and 2 with go.staging.budbee.com/api and the configuration is identical. Only different is the random listening port they get allocated.

[aaronhurt]

Something really strange is happening ... it's almost like there are two redirect rules defined. The first request clearly matches go.staging.budbee.com:80 that you have defined for the posted http-redirect. However it looks like the second request to go.staging.budbee.com:443 is also matching a redirect route. That could be a specific route for https://go.staging.budbee.com/ or a plain non-port specific host route go.staging.budbee.com.

[magiconair]

@atillamas Can you post your full routing table with curl localhost:9998/api/routes?raw ?

[atillamas]

@magiconair Sure thing, i created a completely new stack, exact copy of our staging, just running one single job, exactly the same behaviour

job "http-echo" {
    datacenters = ["eu-west-1"]
    group "service" {
        count = 2
	constraint {
		operator = "distinct_hosts"
		value = "true"
	}
        update {
                max_parallel = 1
                min_healthy_time = "30s"
                healthy_deadline = "5m"
        }
        task "http-echo" {
            driver = "docker"
            config {
                image = "hashicorp/http-echo"
                port_map {
                        echo = 5678
                }
                args  = ["-text", " version4: ${node.unique.name}"]
            }
            service {
                name = "http-echo"
                tags = ["http-echo","urlprefix-echo.staging.budbee.com/"]
                port = "echo"
                check {
                    type     = "http"
                    path     = "/"
                    interval = "5s"
                    timeout  = "2s"
                    port     = "echo"
                }
            }
            resources {
                cpu = 500
                network {
                    port "echo" { }
                }
            }
        }
    }

ubuntu@ip-10-0-62-158:~$ curl localhost:9998/api/routes?raw
route add http-redirect echo.staging.budbee.com:80/ https://echo.staging.budbee.com$path opts "redirect=301"
route add http-echo echo.staging.budbee.com/ http://10.0.62.158:26296/ tags "http-echo"
route add http-echo echo.staging.budbee.com/ http://10.0.61.154:23384/ tags "http-echo"

curl --http1.1 --max-redirs 3 -vL echo.staging.budbee.com
* Rebuilt URL to: echo.staging.budbee.com/
*   Trying 52.30.193.125...
* TCP_NODELAY set
* Connected to echo.staging.budbee.com (52.30.193.125) port 80 (#0)
> GET / HTTP/1.1
> Host: echo.staging.budbee.com
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 20:36:58 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 67
< Connection: keep-alive
< Location: https://echo.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #0 to host echo.staging.budbee.com left intact
* Issue another request to this URL: 'https://echo.staging.budbee.com/'
*   Trying 52.30.193.125...
* TCP_NODELAY set
* Connected to echo.staging.budbee.com (52.30.193.125) port 443 (#1)
* ALPN, offering http/1.1
* Cipher selection: PROFILE=SYSTEM
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=budbee.com
*  start date: May 17 00:00:00 2017 GMT
*  expire date: Jun 17 12:00:00 2018 GMT
*  subjectAltName: host "echo.staging.budbee.com" matched cert's "*.staging.budbee.com"
*  issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: echo.staging.budbee.com
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 20:36:58 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 67
< Connection: keep-alive
< Location: https://echo.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #1 to host echo.staging.budbee.com left intact
* Issue another request to this URL: 'https://echo.staging.budbee.com/'
* Found bundle for host echo.staging.budbee.com: 0x55795ae5a090 [can pipeline]
* Re-using existing connection! (#1) with host echo.staging.budbee.com
* Connected to echo.staging.budbee.com (52.30.193.125) port 443 (#1)
> GET / HTTP/1.1
> Host: echo.staging.budbee.com
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 20:36:58 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 67
< Connection: keep-alive
< Location: https://echo.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #1 to host echo.staging.budbee.com left intact
* Issue another request to this URL: 'https://echo.staging.budbee.com/'
* Found bundle for host echo.staging.budbee.com: 0x55795ae5a090 [can pipeline]
* Re-using existing connection! (#1) with host echo.staging.budbee.com
* Connected to echo.staging.budbee.com (52.30.193.125) port 443 (#1)
> GET / HTTP/1.1
> Host: echo.staging.budbee.com
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Feb 2018 20:36:58 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 67
< Connection: keep-alive
< Location: https://echo.staging.budbee.com/
< 
* Ignoring the response-body
* Connection #1 to host echo.staging.budbee.com left intact
* Maximum (3) redirects followed
curl: (47) Maximum (3) redirects followed

[aaronhurt]

Hrm.... I wonder ... what if you try something like ...

route add http-redirect echo.staging.budbee.com:80/ https://echo.staging.budbee.com$path opts "redirect=301"
route add http-echo / http://10.0.62.158:26296/ tags "http-echo"
route add http-echo / http://10.0.61.154:23384/ tags "http-echo"