maks3201 opened a new issue, #66558:
URL: https://github.com/apache/doris/issues/66558
## Version and Environment
- **Apache Doris version**: 4.1.2 (also reproduced on 4.1.3-rc02, bug is
present on master/4.2-SNAPSHOT)
- **Deployment mode**: Compute-storage-decoupled (cloud mode), but the bug
also applies to shared-nothing mode
- **Source database**: MySQL 8.0 / Amazon Aurora MySQL 8.0
(`8.0.mysql_aurora.3.10.3`) with `require_secure_transport=ON`
## What happened
A CDC streaming job configured with `offset='latest'` (or `earliest`) and
`ssl_mode='require'` immediately fails with a JDBC connection error at job
startup. The job never begins replication.
## What was expected
The job should connect using SSL to resolve the current binlog position and
then begin streaming.
## Minimal Reproduction
1. Configure MySQL/Aurora with `require_secure_transport=ON`:
```sql
-- On MySQL:
SET GLOBAL require_secure_transport = ON;
```
2. Upload a CA certificate to Doris (if using verify-ca, otherwise
ssl_mode=require suffices):
```sql
CREATE FILE "mysql_ca.pem"
PROPERTIES ("url" = "file:///path/to/rds-combined-ca-bundle.pem", "catalog"
= "internal");
```
3. Create a CDC streaming job:
```sql
CREATE JOB my_cdc_job
PROPERTIES (
'type' = 'insert',
'format' = 'cdc'
)
FROM MYSQL (
'host' = '10.0.1.100',
'port' = '3306',
'user' = 'cdc_user',
'password' = '***',
'database' = 'mydb',
'table' = 'orders',
'offset' = 'latest',
'ssl_mode' = 'require'
)
INTO TABLE mydb.orders;
```
4. The job fails immediately. The BE `cdc_client` log shows:
```
java.sql.SQLException: Could not create connection to database server.
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol
```
or (depending on MySQL configuration):
```
java.sql.SQLException: Connections using insecure transport are prohibited
while --require_secure_transport=ON
```
## Root Cause
In `MySqlSourceReader.generateMySqlConfig()`
(`fs_brokers/cdc_client/src/main/java/org/apache/doris/cdcclient/source/reader/mysql/MySqlSourceReader.java`),
the startup mode switch block (starting at line 907 in tag 4.1.2) calls
`initializeEffectiveOffset()` for `latest`, `earliest`, and timestamp modes.
This method creates a `MySqlConnection` via
`DebeziumUtils.createMySqlConnection(config)` — i.e., it opens a JDBC
connection to the source database to resolve the current binlog file and
position.
However, the SSL properties (`ssl_mode` → `database.ssl.mode` / `sslMode`,
and `ssl_rootcert` → truststore path) are applied to `jdbcProperties` and
`dbzProps` **after** the startup mode block (line 955+ in tag 4.1.2). So when
`initializeEffectiveOffset()` builds its config and opens a connection, SSL is
not yet configured. Against a MySQL instance with
`require_secure_transport=ON`, the plaintext connection attempt is rejected.
## Affected Modes
- `offset='latest'` — always calls `initializeEffectiveOffset()`
- `offset='earliest'` — always calls `initializeEffectiveOffset()`
- Timestamp offset (13-digit epoch) — always calls
`initializeEffectiveOffset()`
The `offset='initial'` and `offset='snapshot'` modes are NOT affected
because they do not resolve binlog position at configuration time.
## Suggested Fix
Move the JDBC properties + SSL configuration block to before the startup
mode switch block. When SSL properties are absent, the behaviour is identical
(the JDBC connection simply doesn't use SSL). The reordering has no effect on
non-SSL users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
