ClickHouse / ClickHouse/ClickHouse
clickhouse-keeper-client `flwc` fails with "Service not found" when using --secure
- Dominant language
- C++
- Stars
- 49.9k
- Forks
- 9k
- Avg merge
- 20h 33m
- Merged PRs (30d)
- 501
Description
### Company or project name
_No response_
### Describe what's wrong
When connecting to ClickHouse Keeper with `clickhouse-keeper-client --secure`, the interactive `flwc ` command (four-letter-word commands, e.g. `stat`, `mntr`) always fails with "Service not found: //localhost:9281", even though the same four-letter-word command succeeds when sent manually over a raw TLS socket to the same port. The bug is isolated to `flwc`'s own connection handling for four-letter-word commands, not the Keeper server or the main interactive session (ls/get/etc. work fine over --secure).
Root cause (from source inspection): in programs/keeper-client/KeeperClient.cpp, the four-letter-word command handler does:
Poco::Net::StreamSocket socket;
socket.connect(Poco::Net::SocketAddress{zk_args.hosts[0]}, ...);
When --secure is used, zk_args.hosts[0] already carries a "secure://" prefix (added earlier for the main ZK client). This raw, scheme-prefixed string is passed directly to Poco::Net::SocketAddress without stripping the prefix or opening a TLS socket, producing a malformed address ("//host:port") that Poco then tries to resolve as a named service in /etc/services — hence "Service not found".
### Does it reproduce on the most recent release?
Yes
### How to reproduce
- ClickHouse Keeper version: 26.3.17.56 (official build)
- Interface: clickhouse-keeper-client
- Non-default settings: Keeper configured with tcp_port_secure only (plain tcp_port disabled), openSSL server+client sections configured, digest ACL (superdigest) enabled
Steps:
1. clickhouse-keeper-client --identity 'super:' -p 9281 --secure
2. Once connected (interactive session works, e.g. `ls /` succeeds): run `flwc stat` or `flwc mntr`
### Expected behavior
`flwc stat`/`flwc mntr` should return the same four-letter-word output as sending the raw command directly over a TLS socket, e.g.:
```
printf 'mntr\r\n' | openssl s_client -connect localhost:9281 -quiet
zk_version v26.3.17.56-lts-...
zk_server_state follower
zk_znode_count 24
...
```
### Error message and/or stacktrace
```
/ :) flwc stat
Service not found: //localhost:9281
Finalizing session 4. finalization_started: false, queue_finished: false, reason: 'Destructor called' 0. Coordination::ZooKeeper::finalize(bool, bool, String const&) @ 0x00000000123241d8
1. Coordination::ZooKeeper::~ZooKeeper() @ 0x0000000012323848
2. Coordination::ZooKeeper::~ZooKeeper() @ 0x00000000123276c9
3. std::__shared_ptr_pointer::__shared_ptr_default_delete, std::allocator>::__on_zero_shared() @ 0x00000000122c6912
4. DB::KeeperClientBase::~KeeperClientBase() @ 0x00000000123c6231
5. mainEntryClickHouseKeeperClient(int, char**) @ 0x00000000123c3739
6. main @ 0x000000000a190f9d
7. ? @ 0x0000000000029ca8
8. __libc_start_main @ 0x0000000000029d65
9. _start @ 0x0000000006bad1ae
```
### Related issues and pull requests
_No response_
### Additional context
Confirmed the Keeper server side is correctly configured and working — sending the raw flwc manually over TLS to the same port succeeds:
```
printf 'mntr\r\n' | openssl s_client -connect localhost:9281 -quiet 2>/dev/null
zk_version v26.3.17.56-lts-...
zk_avg_latency 1
zk_max_latency 8
zk_min_latency 0
zk_packets_received 329
zk_packets_sent 319
zk_num_alive_connections 0
zk_outstanding_requests 0
zk_server_state follower
zk_znode_count 24
zk_watch_count 0
zk_ephemerals_count 6
zk_approximate_data_size 4515
zk_key_arena_size 0
zk_latest_snapshot_size 698
zk_open_file_descriptor_count 51
zk_max_file_descriptor_count 500000
```
This confirms the bug is client-side only, specifically in flwc's socket handling when `--secure` is used.
Contributor guide
Research direction
Start in programs/keeper-client/KeeperClient.cpp at the four-letter-word command handler and compare its socket setup with the secure main session. Reproduce with clickhouse-keeper-client --secure and flwc stat or mntr. Done means secure flwc commands return the Keeper output instead of the Service not found error, while the existing interactive session remains working.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100