Let websites share a port across addresses, and refuse an HTTPS redirect that would take port 80 from a raw port

A website on 0.0.0.0 and websites on named addresses can use the same port. An https resource with
the redirect on also uses port 80 at its address, so a raw port there is refused, in either order.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

e2e/wildcard_test.go

@@ -0,0 +1,66 @@
+package e2e
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"testing"
+	"time"
+
+	"git.veillax.com/Veillax/blacktip"
+	"git.veillax.com/Veillax/reef/model"
+)
+
+// A website on every address does not take the port from a website that names an address: each
+// listens where it should, and the named address answers only for its own site.
+func TestWildcardWebsiteStepsAsideForANamedAddress(t *testing.T) {
+	w := setup(t, blacktip.TraefikConfig{})
+	w.admin.must("POST", "/api/orgs/"+w.org+"/domains", map[string]any{"name": "example.test", "edgeId": w.edge}, nil)
+	wild, named := webBackend(t, "wild", 200), webBackend(t, "named", 200)
+	port := freePort(t)
+
+	w.open(model.Mapping{Proto: "http", BindIP: "0.0.0.0", Port: port, Hostname: "wild.example.test", Targets: tgt(w.site, wild)})
+	w.open(model.Mapping{Proto: "http", BindIP: "127.0.0.2", Port: port, Hostname: "named.example.test", Targets: tgt(w.site, named)})
+
+	ask := func(ip, host string) (int, string) {
+		c := &http.Client{Timeout: 3 * time.Second, Transport: &http.Transport{DisableKeepAlives: true,
+			DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+				return (&net.Dialer{}).DialContext(ctx, "tcp", net.JoinHostPort(ip, strconv.Itoa(port)))
+			}}}
+		req, _ := http.NewRequest("GET", "http://"+host+"/", nil)
+		resp, err := c.Do(req)
+		if err != nil {
+			return 0, err.Error()
+		}
+		defer resp.Body.Close()
+		b, _ := io.ReadAll(resp.Body)
+		var body map[string]string
+		json.Unmarshal(b, &body)
+		return resp.StatusCode, body["backend"]
+	}
+	wait := func(ip, host, wantBackend string) {
+		t.Helper()
+		var code int
+		var got string
+		for i := 0; i < 60; i++ {
+			if code, got = ask(ip, host); code == 200 && got == wantBackend {
+				return
+			}
+			time.Sleep(150 * time.Millisecond)
+		}
+		t.Fatalf("%s via %s: status %d backend %q, want %q", host, ip, code, got, wantBackend)
+	}
+
+	wait("127.0.0.2", "named.example.test", "named") // the named address serves its own site
+	wait("127.0.0.1", "wild.example.test", "wild")   // the wildcard still covers the other addresses
+	// and the wildcard gave up the named address: its site is not served there
+	if code, _ := ask("127.0.0.2", "wild.example.test"); code == 200 {
+		t.Errorf("the wildcard website still answers on the address another website names")
+	}
+	if code, _ := ask("127.0.0.1", "named.example.test"); code == 200 {
+		t.Errorf("a website answers on an address it was not given")
+	}
+}