Skip to content

Commit

Permalink
[fix](auth)fix be enable http auth, some request link never return. (a…
Browse files Browse the repository at this point in the history
…pache#44959)

if you `enable_all_http_auth = true` in be.conf, then restart be, and
keep using `curl -u "xxxx:xxxx" http://127.0.0.1:8040/api/health` while
be is starting. You may encounter a situation where the link does not
return.
Reason:
When be is still starting, there is no information about fe master. When
you make an api request to be http port, be needs to request
authentication information from fe, which will cause it to request a
machine with empty ip and port 0. This rpc call will definitely fail
(this is not equivalent to a password error). After receiving this
failure, be does not `send_reply` to the api requester, so this api
request cannot be returned.
  • Loading branch information
hubgeter committed Dec 5, 2024
1 parent 405b50b commit 92f0159
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 1 deletion.
10 changes: 10 additions & 0 deletions be/src/http/http_handler_with_auth.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ HttpHandlerWithAuth::HttpHandlerWithAuth(ExecEnv* exec_env, TPrivilegeHier::type
: _exec_env(exec_env), _hier(hier), _type(type) {}

int HttpHandlerWithAuth::on_header(HttpRequest* req) {
//if u return value isn't 0,u should `send_reply`,Avoid requesting links that never return.
TCheckAuthRequest auth_request;
TCheckAuthResult auth_result;
AuthInfo auth_info;
Expand Down Expand Up @@ -64,13 +65,22 @@ int HttpHandlerWithAuth::on_header(HttpRequest* req) {

#ifndef BE_TEST
TNetworkAddress master_addr = _exec_env->master_info()->network_address;
if (master_addr.hostname.empty() || master_addr.port == 0) {
LOG(WARNING) << "Not found master fe, Can't auth API request: " << req->debug_string();
HttpChannel::send_error(req, HttpStatus::SERVICE_UNAVAILABLE);
return -1;
}
{
auto status = ThriftRpcHelper::rpc<FrontendServiceClient>(
master_addr.hostname, master_addr.port,
[&auth_result, &auth_request](FrontendServiceConnection& client) {
client->checkAuth(auth_result, auth_request);
});
if (!status) {
LOG(WARNING) << "CheckAuth Rpc Fail.Fe Ip:" << master_addr.hostname
<< ", Fe port:" << master_addr.port << ".Status:" << status.to_string()
<< ".Request: " << req->debug_string();
HttpChannel::send_error(req, HttpStatus::SERVICE_UNAVAILABLE);
return -1;
}
}
Expand Down
1 change: 0 additions & 1 deletion be/test/http/http_client_test.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -340,5 +340,4 @@ TEST_F(HttpClientTest, escape_url) {
std::string output_G = hostname + "/download_file?key=0x2E&key=%252E#section";
ASSERT_TRUE(check_result(input_G, output_G));
}

} // namespace doris

0 comments on commit 92f0159

Please sign in to comment.