VirtualServer with conditional routes creates wrong rewrite rules

[andreaspe]

Describe the bug
When creating a VirtualServer with a route that contains a match condition and a rewritePath, it seems to create wrong rewrite rules. On the proxy destination i can observere request parameters duplicated.

To Reproduce

1. Create the following VirtualServer

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: myvserver
spec:
  host: myvserver.example.org
  server-snippets: |
    rewrite_log on;
  upstreams:
    - name: app
      service: myservice
      port: 8666
  routes:
    - path: /
      action:
        pass: app
    - path: /demo
      matches:
      - conditions:
        - cookie: user
          value: john
        action:
          proxy:
            upstream: app
            rewritePath: /user/john
      action:
        proxy:
          upstream: app
          rewritePath: /

2. Do a curl request to the created vhost. It doesn't matter it if the conditions is matched or not.

$ curl http://myvserver.example.org/demo?hello=world
...

3. Observe in the access log of app that the request is proxied in an unexpected way

10.142.184.178 - - [21/Sep/2021:16:21:49 +0000] "GET /%3Fhello=world?hello=world HTTP/1.1" 404 153 "-" "curl/7.64.1"

The location block in the generated config seems to be like this:

...
   location /internal_location_matches_0_default {
        set $service "myservice";
        internal;
        set $default_connection_header close;
        rewrite ^ $request_uri;
        rewrite "^/demo(.*)$" "/$1" break;
...

Expected behavior
The requests are proxied to the destination as /?hello=world.

Your environment

• 1.12.1 (installed via nginx-ingress-0.0.0-edge helm chart)
• 1.20.7
• Azure Kubernetes (AKS)
• Nginx + NginxPlus (on eval license)

Additional context
Without the matches: block the request is correctly passed to the upstream.

Aha! Link: https://nginx.aha.io/features/IC-280

[github-actions]

Hi @andreaspe thanks for reporting!

Be sure to check out the docs while you wait for a human to take a look at this 🙂

Cheers!

[pleshakov]

Hi @andreaspe

I confirm that it is a bug: If a path includes splits or matches, the rewritten URI will include duplicated request parameters.

I don't see a workaround. However, if you remove the matches, the URI rewriting will work:

  - path: /test/
    action:
      proxy:
        upstream: coffee
        rewritePath: /

$ curl "cafe.example.com/test?hello=world"
Server address: 10.244.0.8:8080
Server name: coffee-6f4b79b975-dgvlv
Date: 21/Sep/2021:21:29:39 +0000
URI: /?hello=world
Request ID: c0db4910cf21ca7c49407256e8ea2aeb