Unable to use registry exposed on non-default http port

[miminar]

With default haproxy router, if I expose registry on port 5000, the router strips the port on each request from Host header.

When registry redirects the client as a response to POST request initiating blob upload, it will use just the url in Host header as a base for the value in Location header.

During the next client request, the Location will be used resulting in failure because port 80 is not exposed.

Version

master

Steps To Reproduce

1. deploy registry
2. deploy router like this: oadm router router --ports 5000:5000 -o json | oc env -f - --output=json ROUTER_SERVICE_HTTP_PORT=5000 | oc create -n default -f -
3. expose the registry using route: oc expose service docker-registry --hostname=registry.f24-ose.vm -n default
4. Add --insecure-registry=registry.f24-ose.vm:5000 to docker daemon's flags.
5. docker login -u unused -p $(oc whoami -t) -e unused registry.f24-ose.vm:5000
6. docker tag busybox registry.f24-ose.vm:5000/$proj/buxybox
7. docker push registry.f24-ose.vm:5000/$proj/buxybox

Current Result

The push fails on PATCH request: Upload failed: dial tcp 192.168.100.80:80: getsockopt: connection refused (extracted from docker daemon log).

Note the port 80 as a result of Location header in registry's response to POST: http://registry.f24-ose.vm/v2/pjoe/hello-world/blobs/uploads/3d70392c-0751-4190-9508-ab9efb450d99?_state=6VTnYEsxOJZCFVr8zthbXcPCV4t4S__QMsNL1OCLHaN7Ik5hbWUiOiJwam9lL2hlbGxvLXdvcmxkIiwiVVVJRCI6IjNkNzAzOTJjLTA3NTEtNDE5MC05NTA4LWFiOWVmYjQ1MGQ5OSIsIk9mZnNldCI6MCwiU3RhcnRlZEF0IjoiMjAxNi0xMC0xMlQxMzo1MDozNS4xNjI4MDQ4MzlaIn0%3D

(Note the missing :5000).

Expected Result

I'd expect the proxy to either pass the Host header unmodified to the exposed service or to modify Location header of service's responses to contain ports.

[liggitt]

Do you have the logs from the registry or the full request/response headers?

[miminar]

Sure, here are the logs: https://gist.github.com/miminar/1ca42d9fac535e17986d0835668e5c29

[miminar]

According to snippet copied from https://gist.github.com/miminar/1ca42d9fac535e17986d0835668e5c29#file-docker-registry-container-headers-txt (proxy -> docker-registry):

Host: registry.f24-ose.vm
X-Forwarded-Host: registry.f24-ose.vm
X-Forwarded-Port: 5000
X-Forwarded-Proto: http

The port is actually there. Is it perhaps a shortcoming of the docker registry not honoring X-Forwarded-Port?

[liggitt]

Exactly. https://github.com/docker/distribution/blob/b6e0cfbdaa1ddc3a17c95142c7bf6e42c5567370/registry/api/v2/urls.go#L65

[liggitt]

For reference, this is the function we use to detect the original host, port, and scheme of the request in order to send a location header for the token authentication: https://github.com/openshift/origin/blob/master/pkg/util/httprequest/httprequest.go#L59

[miminar]

@liggitt I see, thanks for the pointers. I'll submit a PR upstream.

[miminar]

@danmcp since this affects just the registry, I believe we can lower the priority. Is P2 appropriate?