yiguolei opened a new pull request, #70190:
URL: https://github.com/apache/doris/pull/70190
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary: Flight result tickets previously contained a result
instance, a BE callback address, and SQL without authentication. A client could
change the address before a BE chose a local reader or forwarded the result
request. This change signs those fields together with the cluster ID and expiry
using HMAC-SHA256, then verifies the signature at the BE Flight request
boundary when verification is enabled.
FE signs with the second newest retained auth token. Heartbeats carry the
full token queue to BEs, including newly joined BEs. Follower FEs acquire and
cache the queue through the existing FE token RPC, restore the cached queue on
promotion, and use the newest successful RPC result when concurrent replies
arrive out of order. The existing single-token RPC response remains usable with
older masters. Configured token queues smaller than four warn and use an
effective capacity of four.
Verification is disabled by default in BE configuration for the 4.2 rollout.
Upgrade all BEs first, then all FEs, allow outstanding unsigned tickets to
finish and heartbeats to distribute the queue, and then enable verification on
BEs (which requires a restart). When enabled, unsigned, tampered, expired, and
cross-cluster tickets are rejected. A follower that has not recently acquired
tokens can have an empty or stale cache at promotion; this implementation does
not proactively synchronize follower caches.
### Release note
Add `enable_arrow_flight_ticket_signature_check` to BE configuration
(default false) and `arrow_flight_ticket_lifetime_seconds` to FE configuration
(default 300 seconds, range 1–3600). Auth token queue sizes below four now log
a warning and use four. Enable BE verification only after upgrading all BEs and
FEs and allowing old unsigned tickets to finish.
### Check List (For Author)
- Test
- [ ] Regression test
- [ ] Unit Test — FE and BE unit tests were added/updated, but could not
be executed locally because Java, Maven, protoc, and thrift are unavailable. CI
validation is pending.
- [x] Manual test — static protocol field-ID comparison against local
3.1, 4.0, 4.1, 4.2, and master branches; BE header hygiene and clang-format 16
checks; changed FE Java line-length/whitespace and git diff whitespace checks.
- Behavior changed:
- [x] Yes. FE issues signed result tickets; BE can require verification
when the new configuration is enabled.
- Does this need documentation?
- [x] Yes. Configuration and rolling-upgrade guidance should be added to
user documentation; documentation PR pending.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
