{"record":{"id":"5fd529548b46c5ab","repo":"apache/hadoop","slug":"invalid-cipher-suite-s-s-5fd529","errorCode":null,"errorMessage":"Invalid cipher suite, %s=%s","messagePattern":"Invalid cipher suite, (.+?)=(.+?)","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java","lineNumber":561,"sourceCode":"      // step 1\n      byte[] remoteResponse = readSaslMessage(in);\n      byte[] localResponse = sasl.evaluateChallengeOrResponse(remoteResponse);\n      List<CipherOption> cipherOptions = null;\n      String cipherSuites = conf.get(\n          DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY);\n      if (requestedQopContainsPrivacy(saslProps)) {\n        // Negotiate cipher suites if configured.  Currently, the only supported\n        // cipher suite is AES/CTR/NoPadding or SM4/CTR/Nopadding,\n        // but the protocol allows multiple values for future expansion.\n        if (cipherSuites != null && !cipherSuites.isEmpty()) {\n          CipherOption option = null;\n          if (cipherSuites.equals(CipherSuite.AES_CTR_NOPADDING.getName())) {\n            option = new CipherOption(CipherSuite.AES_CTR_NOPADDING);\n          } else if (cipherSuites.equals(\n              CipherSuite.SM4_CTR_NOPADDING.getName())) {\n            option = new CipherOption(CipherSuite.SM4_CTR_NOPADDING);\n          } else {\n            throw new IOException(String.format(\"Invalid cipher suite, %s=%s\",\n                DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY, cipherSuites));\n          }\n          cipherOptions = Lists.newArrayListWithCapacity(1);\n          cipherOptions.add(option);\n        }\n      }\n      LOG.debug(\"{}: cipherOptions={}\", sasl, cipherOptions);\n      sendSaslMessageAndNegotiationCipherOptions(out, localResponse,\n          cipherOptions);\n\n      // step 2 (client-side only)\n      SaslResponseWithNegotiatedCipherOption response =\n          readSaslMessageAndNegotiatedCipherOption(in);\n      localResponse = sasl.evaluateChallengeOrResponse(response.payload);\n      assert localResponse == null;\n\n      // SASL handshake is complete\n      checkSaslComplete(sasl, saslProps);","sourceCodeStart":543,"sourceCodeEnd":579,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java#L543-L579","documentation":"Client-side counterpart of the cipher suite check: when the negotiated SASL QOP includes privacy, SaslDataTransferClient builds a CipherOption list from dfs.encrypt.data.transfer.cipher.suites and only accepts 'aes/ctr/nopadding' or 'sm4/ctr/nopadding' (lowercase, exact). Any other value throws IOException while opening the first secured data connection.","triggerScenarios":"Client-side config with dfs.data.transfer.protection containing privacy plus dfs.encrypt.data.transfer.cipher.suites set to an unsupported value; thrown in the SASL negotiation step before any data flows.","commonSituations":"Client core-site.xml diverging from the cluster's value (wrong casing, JCE-style name); value valid for a different Hadoop version than the bundled client.","solutions":["Fix the client-side value to exactly aes/ctr/nopadding or sm4/ctr/nopadding","Remove the property if accelerated crypto is not required - SASL privacy alone still encrypts","Distribute the identical security config to all clients"],"exampleFix":"<!-- before (client core-site.xml) -->\n<property>\n  <name>dfs.encrypt.data.transfer.cipher.suites</name>\n  <value>AES/CTR/NoPadding</value>\n</property>\n\n<!-- after -->\n<property>\n  <name>dfs.encrypt.data.transfer.cipher.suites</name>\n  <value>aes/ctr/nopadding</value>\n</property>","handlingStrategy":"validation","validationCode":"String suite = conf.getTrimmed(\"dfs.encrypt.data.transfer.cipher.suites\", \"\");\nif (!suite.isEmpty()\n    && !suite.equals(\"aes/ctr/nopadding\")\n    && !suite.equals(\"sm4/ctr/nopadding\")) {\n  throw new IllegalArgumentException(\"Unsupported cipher suite: \" + suite);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep client-side security config byte-identical to the cluster's","Prefer unsetting the cipher key unless native crypto acceleration is verified"],"tags":["hdfs","configuration","encryption","sasl-client"],"backgroundTag":"invalid-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}