github-actions[bot] commented on code in PR #69970:
URL: https://github.com/apache/doris/pull/69970#discussion_r4439838375
##########
fe/pom.xml:
##########
@@ -297,7 +297,7 @@ under the License.
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<!-- Spring Framework 7 and Jetty EE11 require Jakarta Servlet 6.1. -->
<jakarta.servlet-api.version>6.1.0</jakarta.servlet-api.version>
- <je.version>18.3.14-doris-SNAPSHOT</je.version>
+ <je.version>18.3.18-doris-SNAPSHOT</je.version>
Review Comment:
[P1] Preserve existing JE truststore configuration before upgrading
Existing FEs can configure TLS through bdb/je.properties with
je.rep.channelType=ssl and je.rep.ssl.trustStoreFile pointing to a private-CA
JKS/P12 store; ReplicatedEnvironment loads this file even with the no-op OSS
provider. In this snapshot,
[readTrustStoreInfo](https://github.com/apache/doris-thirdparty/blob/70324a2452e4ff717c872e431b5b385c82a54f84/src/main/java/com/sleepycat/je/rep/utilint/net/SSLChannelFactory.java#L1020-L1038)
only reads the new pemCaCertFile setting and returns null otherwise.
SSLContext then uses JVM default trust managers. If that CA exists only in the
configured JE truststore, upgraded FEs cannot validate their peers and rejoin
the replication group. Select a JE build that preserves the existing
trustStoreFile/type behavior before changing this version, and cover the
existing configuration in an upgrade test.
##########
fe/pom.xml:
##########
@@ -297,7 +297,7 @@ under the License.
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<!-- Spring Framework 7 and Jetty EE11 require Jakarta Servlet 6.1. -->
<jakarta.servlet-api.version>6.1.0</jakarta.servlet-api.version>
- <je.version>18.3.14-doris-SNAPSHOT</je.version>
+ <je.version>18.3.18-doris-SNAPSHOT</je.version>
Review Comment:
[P1] Retain client-certificate requests for existing JE authenticators
For an existing TLS group using je.rep.ssl.authenticator=mirror or
dnmatch(...), .14 requests client certificates. The new default clientAuthMode
is verify_peer, but
[configureClientAuth](https://github.com/apache/doris-thirdparty/blob/70324a2452e4ff717c872e431b5b385c82a54f84/src/main/java/com/sleepycat/je/rep/utilint/net/SSLChannelFactory.java#L256-L299)
performs no request in that branch. Clients therefore supply no certificate
and the configured authenticator rejects the missing peer principal.
ServiceDispatcher supplies an empty, non-null authentication-method array for
this untrusted channel, so the JE service handshake fails. This also breaks
replication connections when JVM trust roots are configured correctly,
independently of the truststore issue. Use a snapshot that preserves the legacy
certificate request (or fixes verify_peer) before upgrading.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
