Doris-Breakwater commented on issue #70425: URL: https://github.com/apache/doris/issues/70425#issuecomment-6760046297
Breakwater-GitHub-Analysis-Slot: slot_bdc3c8ff914a Triage: the reported build has a source-confirmed FE HTTPS forwarding defect. This issue is actionable as a maintenance-branch backport and regression-coverage request for existing upstream work. I independently checked the reported commit and the branch snapshots below; I have not run a Doris cluster or reproduced the requests myself. **Verified mechanism** - At `ad35a140c7fd0b842f18c23300bac581f7d04326`, [GetStreamLoadState.execute](https://github.com/apache/doris/blob/ad35a140c7fd0b842f18c23300bac581f7d04326/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/GetStreamLoadState.java#L35-L61) authenticates, then forwards non-master requests before reading label state. [RestBaseController](https://github.com/apache/doris/blob/ad35a140c7fd0b842f18c23300bac581f7d04326/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L96-L114) preserves the incoming scheme, while [forwardToMaster](https://github.com/apache/doris/blob/ad35a140c7fd0b842f18c23300bac581f7d04326/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L272-L324) supplies `getMasterHttpPort()`. [Env](https://github.com/apache/doris/blob/ad35a140c7fd0b842f18c23300bac581f7d04326/fe/fe-core/src/main/java/org/apache/doris/catalog/Env.java#L1784-L1788) advertises `Config.http_port`. With the illustrative configuration, the intern al destination therefore becomes `https://<master-fe>:8030/...`, rather than port 8050. This explains why disabling client redirects does not avoid the failing server-side hop. - Forwarding exceptions are caught and passed to [okWithCommonError](https://github.com/apache/doris/blob/ad35a140c7fd0b842f18c23300bac581f7d04326/fe/fe-core/src/main/java/org/apache/doris/httpv2/entity/ResponseEntityBuilder.java#L36-L43), which returns HTTP 200 with the error envelope. The report's `code: 1` is consistent with that path, but the exact exception has not been independently established. It does not establish a failed load or justify resubmission. For an unused label, [DatabaseTransactionMgr.getLabelState](https://github.com/apache/doris/blob/ad35a140c7fd0b842f18c23300bac581f7d04326/fe/fe-core/src/main/java/org/apache/doris/transaction/DatabaseTransactionMgr.java#L1077-L1089) returns `UNKNOWN`, consistent with the direct-master result. **Backport status supported by the inspected source** The GitHub branch heads checked during this investigation match the report. Each still selects the master's HTTP port in the production forwarding path: | Branch | Checked commit / forwarding source | |---|---| | branch-4.0 | [8a9961723ea4](https://github.com/apache/doris/blob/8a9961723ea4be00cdf923c60759607202c7e2e7/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L267-L277) | | branch-4.1 | [65f59e26b2bb](https://github.com/apache/doris/blob/65f59e26b2bb51edc858195f8f5b2b33eaf6c01f/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L272-L282) | | branch-4.1.4 | [5dbec55b399c](https://github.com/apache/doris/blob/5dbec55b399c2c4323f565bb2c6745cacb574416/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L272-L282) | | branch-4.2 | [726167bd85f0](https://github.com/apache/doris/blob/726167bd85f06ba1f2089acb54a1463629341287/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L272-L282) | [PR #60921](https://github.com/apache/doris/pull/60921) is merged into master. At `13f4d297a52b9aadb9a57e2736a27b5e93de20d0`, [forwarding](https://github.com/apache/doris/blob/13f4d297a52b9aadb9a57e2736a27b5e93de20d0/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L333-L343) uses [buildInternalFeUrl](https://github.com/apache/doris/blob/13f4d297a52b9aadb9a57e2736a27b5e93de20d0/fe/fe-core/src/main/java/org/apache/doris/common/util/HttpURLUtil.java#L81-L95), pairing HTTPS with local `Config.https_port`. That addresses this URL mismatch for uniform FE configuration at source level; it does not prove runtime success, heterogeneous-port support, or inclusion in a released 4.x build. [PR #64670](https://github.com/apache/doris/pull/64670) is merged but concerns effective-port visibility. [#65212](https://github.com/apache/doris/pull/65212) is closed without merging, and [#68054](https://github.com/apache/doris/pull/68054) remains open; neither is evidence of a shipped backport. Intended branch coverage and target patch releases still require maintainer confirmation. **Recommended next steps and remaining evidence** 1. Record a backport PR and intended release for each supported branch above, or explicitly state exclusions. Review the required follow-up changes, including merged [#64697](https://github.com/apache/doris/pull/64697), before selecting the patch set. In particular, current master's [InternalHttpsUtils](https://github.com/apache/doris/blob/13f4d297a52b9aadb9a57e2736a27b5e93de20d0/fe/fe-core/src/main/java/org/apache/doris/common/util/InternalHttpsUtils.java#L64-L105) builds trust from the FE HTTPS keystore, whereas the original #60921 implementation used the MySQL SSL truststore. External-client certificate trust alone does not validate the internal FE client. 2. Add or identify an integration regression using a real follower/master hop with `http_port != https_port`, authenticated requests, and internal TLS trust configured. Assert that both followers match the master for unused, VISIBLE, and ABORTED synthetic labels, checking JSON `code` and state as well as HTTP status; include an HTTPS-disabled control. Run it before and after the backport and attach exact build commits/results. [#60921's changed files](https://github.com/apache/doris/pull/60921/files) add URL/SSL-context unit tests, but no follower/master `get_load_state` integration regression. Also, `FeConstants.runningUnitTest` bypasses production destination selection, so that route alone cannot cover this defect. 3. Keep heterogeneous FE ports and TLS identity behavior explicit in acceptance criteria. The current helper uses the forwarding FE's local port, and the [forwarding client](https://github.com/apache/doris/blob/13f4d297a52b9aadb9a57e2736a27b5e93de20d0/fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/RestBaseController.java#L360-L378) installs `NoopHostnameVerifier`; a successful request alone is not evidence of hostname verification. Other shared forwarding callers warrant follow-up checks, but their runtime impact remains inferred rather than reproduced here. The supplied version, configuration and reproduction are sufficient to establish the routing defect; no full error `data` field, credentials, deployment identifiers or profile is needed. If a corrected build still fails, provide only a sanitized exception class/cause chain and timestamp from the forwarding FE, that build's commit, and whether the failure is connection routing, certificate trust, or authentication. Pending a verified backport, the demonstrated workaround is an authenticated HTTPS request directly to the current master, with certificate validation retained and the master rediscovered after failover. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
