Docker + Golang HTTPS问题。OpenSSL SSL_connect: SSL_ERROR_SYSCALL

huangapple
go评论121阅读模式
英文:

Docker + Golang HTTPS issue. OpenSSL SSL_connect: SSL_ERROR_SYSCALL

问题

我正在尝试从Docker容器中连接到Go创建的HTTPS会话，当我在本地运行时，它可以正常工作，但是一旦我尝试在容器中运行它，我无法访问URL。

以下是我的代码：

  1. func main() {
  2.     // 我使用的是Go-Chi V5
  3.     r := chi.NewRouter()
  5.     // TLS连接。灵感来自于https://blog.cloudflare.com/exposing-go-on-the-internet
  6.     tlsConfig := &tls.Config{
  7.         PreferServerCipherSuites: true,
  8.         CurvePreferences: []tls.CurveID{
  9.             tls.CurveP256,
  10.             tls.X25519,
  11.         },
  13.         MinVersion: tls.VersionTLS12,
  14.         CipherSuites: []uint16{
  15.             tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
  16.             tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
  17.             tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
  18.             tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
  19.             tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
  20.             tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
  21.         },
  22.     }
  23.     srv := &http.Server{
  24.         Addr:         "localhost:9090",
  25.         ReadTimeout:  5 * time.Second,
  26.         WriteTimeout: 20 * time.Second,
  27.         IdleTimeout:  200 * time.Second,
  28.         TLSConfig:    tlsConfig,
  29.         Handler:      r,
  30.     }
  32.     r.Get("/", func(w http.ResponseWriter, r *http.Request) {
  33.         w.Write([]byte("hello world"))
  34.     })
  36.     err := srv.ListenAndServeTLS("./.dev/localhost.crt", "./.dev/localhost.key")
  37.     if err != nil {
  38.         log.Fatalf("server failed to start: %v", err)
  39.     }
  40. }

我的Dockerfile：

  1. FROM golang:1.17-buster AS build
  3. WORKDIR /app
  5. COPY go.mod .
  6. COPY go.sum .
  7. RUN go mod download
  9. COPY ./.dev/localhost.key .
  10. COPY ./.dev/localhost.crt .
  12. COPY . .
  14. RUN go build -o /dev-admin ./cmd/admin
  16. ##
  17. ## 部署
  18. ##
  20. FROM gcr.io/distroless/base-debian10
  22. WORKDIR /
  24. COPY --from=build /dev-admin /dev-admin
  26. COPY --from=build ./app/localhost.key ./.dev/localhost.key
  27. COPY --from=build ./app/localhost.crt ./.dev/localhost.crt
  29. EXPOSE 9090
  30. EXPOSE 443
  32. ENTRYPOINT ["/dev-admin"]

docker-compose.yml：

  1. version: '3.9'
  2. services:
  3.   web:
  4.     image: api_test
  5.     build: .
  6.     ports:
  7.       - '9090:9090'
  8.     volumes:
  9.       - .:/app

当我尝试使用普通的HTTP版本时，容器可以正常工作，所以问题只出现在HTTPS上，我无法找出具体原因。

英文:

I'm trying to connect to an HTTPS session created in Go from a Docker container, it works fine when I run it on my local, but as soon as I try to run it in the container I can't access to the URL.

  1. func main() {
  3. 	// I'm using Go-Chi V5
  4. 	r := chi.NewRouter()
  6. 	// TLS connection. Inspired from https://blog.cloudflare.com/exposing-go-on-the-internet
  7. 	tlsConfig := &tls.Config{
  8. 		PreferServerCipherSuites: true,
  9. 		CurvePreferences: []tls.CurveID{
  10. 			tls.CurveP256,
  11. 			tls.X25519,
  12. 		},
  14. 		MinVersion: tls.VersionTLS12,
  15. 		CipherSuites: []uint16{
  16. 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
  17. 			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
  18. 			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
  19. 			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
  20. 			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
  21. 			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
  22. 		},
  23. 	}
  24. 	srv := &http.Server{
  25. 		Addr:         "localhost:9090",
  26. 		ReadTimeout:  5 * time.Second,
  27. 		WriteTimeout: 20 * time.Second,
  28. 		IdleTimeout:  200 * time.Second,
  29. 		TLSConfig:    tlsConfig,
  30. 		Handler:      r,
  31. 	}
  33. 	r.Get("/", func(w http.ResponseWriter, r *http.Request) {
  34. 		w.Write([]byte("hello world"))
  35. 	})
  37. 	err := srv.ListenAndServeTLS("./.dev/localhost.crt", "./.dev/localhost.key")
  38. 	if err != nil {
  39. 		log.Fatalf("server failed to start: %v", err)
  40. 	}
  41. }

My Dockerfile:

  1. FROM golang:1.17-buster AS build
  3. WORKDIR /app
  5. COPY go.mod .
  6. COPY go.sum .
  7. RUN go mod download
  9. COPY ./.dev/localhost.key .
  10. COPY ./.dev/localhost.crt .
  12. COPY . .
  14. RUN go build -o /dev-admin ./cmd/admin
  16. ##
  17. ## Deploy
  18. ##
  20. FROM gcr.io/distroless/base-debian10
  22. WORKDIR /
  24. COPY --from=build /dev-admin /dev-admin
  26. COPY --from=build ./app/localhost.key ./.dev/localhost.key
  27. COPY --from=build ./app/localhost.crt ./.dev/localhost.crt
  29. EXPOSE 9090
  30. EXPOSE 443
  32. ENTRYPOINT ["/dev-admin"]

docker-compose.yml:

  1. version: '3.9'
  2. services:
  3.   web:
  4.     image: api_test
  5.     build: .
  6.     ports:
  7.       - '9090:9090'
  8.     volumes:
  9.       - .:/app

$ curl https://localhost:9090
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:9090

The container works fine when I try the normal HTTP version, so there is a blockage on the HTTPS only and I can't figure out what it is.

答案1

得分: 3

你正在指定在Server定义中要监听的地址：

  1. srv := &http.Server{
  2.         Addr:         "localhost:9090",
  3. ...

将其更改为：

  1. srv := &http.Server{
  2.         Addr:         ":9090",
  3. ...

需要进行此更改的原因是地址“指定服务器要侦听的TCP地址”。当你指定localhost:9090时，你绑定到容器内的回环接口，在大多数情况下，这是无法从外部访问的（有关更多信息，请参见此问题）。

英文:

You are specifying the address to listen on in your Server definition:

  1. srv := &http.Server{
  2.         Addr:         "localhost:9090",
  3. ...

change this to:

  1. srv := &http.Server{
  2.         Addr:         ":9090",
  3. ...

The reason that this change is needed is that the address "specifies the TCP address for the server to listen on". When you specify localhost:9090 you are binding to the loopback interface within the container and, in most cases, this is not accessible externally (see this question for more info).

huangapple
  • 本文由 发表于 2021年12月29日 02:09:03
  • 转载请务必保留本文链接：https://go.coder-hub.com/70510882.html
  • docker
  • go
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定