{"record":{"id":"ba40c87b3b5f762a","repo":"apache/hadoop","slug":"fatal-invalid-rpc-header","errorCode":"FATAL_INVALID_RPC_HEADER","errorMessage":"Server is not wrapping data","messagePattern":"Server is not wrapping data","errorType":"exception","errorClass":"FatalRpcServerException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java","lineNumber":2252,"sourceCode":"        if (ugi == null) {\n          throw new AccessControlException(\n              \"Can't retrieve username from tokenIdentifier.\");\n        }\n        ugi.addTokenIdentifier(tokenId);\n        return ugi;\n      } else {\n        return UserGroupInformation.createRemoteUser(authorizedId, authMethod);\n      }\n    }\n\n    private void saslReadAndProcess(RpcWritable.Buffer buffer) throws\n        RpcServerException, IOException, InterruptedException {\n      final RpcSaslProto saslMessage =\n          getMessage(RpcSaslProto.getDefaultInstance(), buffer);\n      switch (saslMessage.getState()) {\n        case WRAP: {\n          if (!saslContextEstablished || !useWrap) {\n            throw new FatalRpcServerException(\n                RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,\n                new SaslException(\"Server is not wrapping data\"));\n          }\n          // loops over decoded data and calls processOneRpc\n          unwrapPacketAndProcessRpcs(saslMessage.getToken().toByteArray());\n          break;\n        }\n        default:\n          saslProcess(saslMessage);\n      }\n    }\n\n    /**\n     * Some exceptions ({@link RetriableException} and {@link StandbyException})\n     * that are wrapped as a cause of parameter e are unwrapped so that they can\n     * be sent as the true cause to the client side. In case of\n     * {@link InvalidToken} we go one level deeper to get the true cause.\n     * ","sourceCodeStart":2234,"sourceCodeEnd":2270,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java#L2234-L2270","documentation":"saslReadAndProcess received an SASL WRAP frame (wrapped RPC payload) while the server either had not completed SASL negotiation (saslContextEstablished false) or negotiated a QOP without wrapping (useWrap false, e.g., auth-only). It responds with FatalRpcServerException using error code FATAL_INVALID_RPC_HEADER — the connection is terminated because client and server disagree on SASL state or protection level.","triggerScenarios":"A client sending wrapped payloads before SASL completes; a client assuming integrity/privacy wrapping (hadoop.rpc.protection=privacy or integrity) against a server configured for authentication only; hand-written clients driving the SASL state machine out of order.","commonSituations":"hadoop.rpc.protection mismatch between client and server core-site.xml (client privacy, server authentication); cross-cluster access such as distcp between clusters with different protection settings; custom or native clients implementing SASL themselves.","solutions":["Align hadoop.rpc.protection on client and server — the server's allowed level must cover the client's requested level; setting both to the same value is simplest.","Use the standard RPC client (RPC.getProxy, DFSClient, YARN clients) rather than hand-driving the SASL exchange.","If wrapping is genuinely required, enable integrity/privacy on the server so useWrap is true."],"exampleFix":"<!-- before: client wraps, server does not -->\n<!-- client core-site.xml -->\n<property><name>hadoop.rpc.protection</name><value>privacy</value></property>\n<!-- after: both sides agree -->\n<property><name>hadoop.rpc.protection</name><value>authentication</value></property> <!-- same on server -->","handlingStrategy":"validation","validationCode":"static int rank(String p) { // authentication < integrity < privacy\n  switch (p) {\n    case \"integrity\": return 1;\n    case \"privacy\": return 2;\n    default: return 0;\n  }\n}\nString client = conf.get(\"hadoop.rpc.protection\", \"authentication\");\nString server = serverConf.get(\"hadoop.rpc.protection\", \"authentication\");\nif (rank(client) > rank(server)) {\n  throw new IllegalStateException(\n      \"client QOP '\" + client + \"' exceeds server allowance '\" + server + \"'\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep hadoop.rpc.protection identical in client and cluster core-site.xml.","Before cross-cluster jobs (distcp), verify protection settings on both sides.","Never hand-roll the SASL exchange; use the standard RPC client."],"tags":["rpc","sasl","security","qop","protocol-mismatch"],"backgroundTag":"sasl-negotiation-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}