{"record":{"id":"2fb98da74d04a7a4","repo":"apache/hadoop","slug":"unknown-channel-mode","errorCode":null,"errorMessage":"Unknown channel mode: {}","messagePattern":"Unknown channel mode: (.+?)","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/DelegatingSSLSocketFactory.java","lineNumber":182,"sourceCode":"            e);\n        ctx = SSLContext.getDefault();\n        channelMode = SSLChannelMode.Default_JSSE;\n      }\n      break;\n    case OpenSSL:\n      bindToOpenSSLProvider();\n      channelMode = SSLChannelMode.OpenSSL;\n      break;\n    case Default_JSSE:\n      ctx = SSLContext.getDefault();\n      channelMode = SSLChannelMode.Default_JSSE;\n      break;\n    case Default_JSSE_with_GCM:\n      ctx = SSLContext.getDefault();\n      channelMode = SSLChannelMode.Default_JSSE_with_GCM;\n      break;\n    default:\n      throw new IOException(\"Unknown channel mode: \"\n          + preferredChannelMode);\n    }\n  }\n\n  /**\n   * Bind to the OpenSSL provider via wildfly.\n   * This MUST be the only place where wildfly classes are referenced,\n   * so ensuring that any linkage problems only surface here where they may\n   * be caught by the initialization code.\n   */\n  private void bindToOpenSSLProvider()\n      throws NoSuchAlgorithmException, KeyManagementException {\n    if (!openSSLProviderRegistered) {\n      LOG.debug(\"Attempting to register OpenSSL provider\");\n      org.wildfly.openssl.OpenSSLProvider.register();\n      openSSLProviderRegistered = true;\n    }\n    // Strong reference needs to be kept to logger until initialization of","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/DelegatingSSLSocketFactory.java#L164-L200","documentation":"DelegatingSSLSocketFactory's constructor switch on SSLChannelMode hit its default branch: the enum value passed is not one of the four handled modes (OpenSSL, Default, Default_JSSE, Default_JSSE_with_GCM). Since those are all constants of the enum, this practically means the caller and this class come from different Hadoop builds — a newer SSLChannelMode constant compiled against an older factory (version/shading skew).","triggerScenarios":"Passing an SSLChannelMode constant that this compiled version of DelegatingSSLSocketFactory does not know; mixed hadoop-common jars on the classpath (e.g. an ABFS/other client compiled against a newer Hadoop shading an older hadoop-common).","commonSituations":"Dependency conflicts after upgrading one Hadoop module; shaded JARs embedding mismatched hadoop-common versions; custom distributions reordering classpath entries.","solutions":["Align all Hadoop artifacts to the same version: check `mvn dependency:tree` or `hadoop classpath` for duplicate hadoop-common jars","Exclude the older hadoop-common from the shaded/conflicting dependency so one DelegatingSSLSocketFactory/SSLChannelMode pair is used","Use one of the documented mode strings (OpenSSL, Default, Default_JSSE, Default_JSSE_with_GCM) wherever the mode is configured, e.g. fs.azure.ssl.channel.mode for ABFS"],"exampleFix":"<!-- before: mixed versions, pom has hadoop-common 3.2.1 next to azure-data-lake 3.3.x -->\n\n<!-- after -->\n<dependency>\n  <groupId>org.apache.hadoop</groupId>\n  <artifactId>hadoop-common</artifactId>\n  <version>3.3.6</version>\n</dependency>\n<!-- and exclude hadoop-common from transitive deps pulling an older copy -->","handlingStrategy":"validation","validationCode":"private static final Set<SSLChannelMode> SUPPORTED = EnumSet.of(\n    SSLChannelMode.OpenSSL, SSLChannelMode.Default,\n    SSLChannelMode.Default_JSSE, SSLChannelMode.Default_JSSE_with_GCM);\n\nif (!SUPPORTED.contains(preferredMode)) {\n  throw new IllegalArgumentException(\n      \"Unsupported SSL channel mode \" + preferredMode\n      + \"; check hadoop artifact version alignment\");\n}\nDelegatingSSLSocketFactory.initializeDefaultFactory(preferredMode);","typeGuard":null,"tryCatchPattern":"try {\n  DelegatingSSLSocketFactory.initializeDefaultFactory(mode);\n} catch (IOException e) {\n  if (e.getMessage().startsWith(\"Unknown channel mode\")) {\n    // classpath skew: fail loudly and dump hadoop-common jar versions\n    throw new IllegalStateException(\"Mixed Hadoop versions on classpath\", e);\n  }\n  throw e;\n}","preventionTips":["Pin a single Hadoop version across the dependency tree and enforce it with enforcer rules","Exclude hadoop-common from shaded third-party clients that bundle their own copy","Validate configured mode strings against the documented set before passing them on"],"tags":["ssl","tls","hadoop","dependency-conflict","classpath"],"backgroundTag":"invalid-enum-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}