t8y2/dbx · error

decode ZooKeeper SASL round %d: %w

Error message

decode ZooKeeper SASL round %d: %w

What it means

Returned by protocolZooKeeperClient.authenticateSASL when the SASL response frame from ZooKeeper cannot be decoded into the length-prefixed challenge bytes at round N. The reply frame is malformed or uses an unexpected layout, so GSSAPI negotiation cannot continue.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:216

	token, err := saslClient.Start()
	if err != nil {
		return fmt.Errorf("start ZooKeeper GSSAPI negotiation: %w", err)
	}
	for round := 0; round < zooKeeperMaxSASLRounds; round++ {
		response, requestErr := client.request(zooKeeperOpSASL, func(encoder *zooKeeperEncoder) {
			if token == nil {
				encoder.bytes([]byte{})
				return
			}
			encoder.bytes(token)
		})
		if requestErr != nil {
			return fmt.Errorf("ZooKeeper SASL round %d: %w", round+1, requestErr)
		}
		decoder := newZooKeeperDecoder(response)
		challenge, decodeErr := decoder.bytes()
		if decodeErr != nil {
			return fmt.Errorf("decode ZooKeeper SASL round %d: %w", round+1, decodeErr)
		}
		if saslClient.Complete() {
			if len(challenge) != 0 {
				return errors.New("ZooKeeper sent an unexpected token after GSSAPI completion")
			}
			return nil
		}
		token, err = saslClient.Step(challenge)
		if err != nil {
			return fmt.Errorf("continue ZooKeeper GSSAPI negotiation at round %d: %w", round+1, err)
		}
	}
	return fmt.Errorf("ZooKeeper GSSAPI negotiation exceeded %d rounds", zooKeeperMaxSASLRounds)
}

func (client *protocolZooKeeperClient) AddAuth(scheme string, auth []byte) error {
	_, err := client.request(zooKeeperOpSetAuth, func(encoder *zooKeeperEncoder) {
		encoder.int32(0)

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the ZooKeeper server version supports SASL over the wire protocol as implemented
2. Check for intermediaries corrupting frames
3. Retry against another ensemble member to rule out a single bad server

When it happens

Trigger: Thrown at agents/drivers/hive-go/zookeeper_protocol.go:216 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e2aa9841e393445b. Report an issue: GitHub.