Skip to content

Commit 900a7e5

Browse files
arkmishclaude
andcommitted
Fix C client SSL test hang on long-hostname runners (cap cert CN at 64 chars)
Root cause (confirmed via gdb thread dump on a long-FQDN Linux runner): gencerts.sh derives the X.509 CommonName from `hostname -f`. On hosts with a long FQDN -- e.g. Kubernetes pods / self-hosted CI runners whose names look like rdev-aks-...-cq4mx.corp.rdev.svc.cluster.local (~80 chars) -- the CN exceeds the 64-character ASN.1 limit, so every `openssl req` fails with "string too long:maxsize=64" and NO certificates are produced. The Java test server then silently skips its secure port (22281 never listens), and Zookeeper_simpleSystem::testSSL (TestClient.cc) issues a synchronous zoo_create against 127.0.0.1:22281 whose session can never establish. Synchronous ops on such a handle have no per-call timeout, so the IO thread spins on connect-refused and the main thread blocks forever in wait_sync_completion -- hanging the entire full-build-java-tests / full-build-cppunit-tests cppunit run. This is why the hang only reproduced on long-FQDN runners and not on upstream CI (short hostnames), and why it had nothing to do with the C client itself. Fix: truncate the CN-deriving FQDN to 64 characters in gencerts.sh. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent fbd911f commit 900a7e5

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

‎zookeeper-client/zookeeper-client-c/ssl/gencerts.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,13 @@ FQDN=`hostname -f`
3434
FQDN=${1:-$FQDN}
3535
FQDN=${FQDN:-"zookeeper.apache.org"}
3636

37+
# An X.509 CommonName is limited to 64 characters (ASN.1 upper bound). Hosts with
38+
# long fully-qualified names -- e.g. Kubernetes pods or CI runners -- otherwise make
39+
# `openssl req` fail with "string too long:maxsize=64", which leaves no certificates
40+
# generated, so the test server never opens its secure port and the SSL client tests
41+
# hang. Truncate the CN to stay within the limit.
42+
FQDN=${FQDN:0:64}
43+
3744
# Generate the root key
3845
openssl genrsa -out rootkey.pem 2048
3946

0 commit comments

Comments
 (0)