ZOOKEEPER-4947: Stop the send loop after SASL authentication fails

[1fanwang]

After SASL authentication fails, the send thread can remain in a transport wait. It eventually exits; the event thread already stops. Break out at the authentication-failure branch before another transport wait, so the existing cleanup runs without caller close. The client retains AUTH_FAILED; explicit close still sets CLOSED.

https://issues.apache.org/jira/browse/ZOOKEEPER-4947

Testing Done

The bad-DIGEST fixture uses a real file-backed loopback server and a 30-second session. It logs shutdown before close with a one-second bound per thread, then asserts shutdown, the retained failure state and request error.

Rejected-client fixtures wait for the AuthFailed event rather than requiring a live JMX connection entry. CI previously failed in that bookkeeping check with expected: <1> but was: <0> after rejection had removed the entry. Valid-client JMX checks and the failed clients' state and request assertions remain.

From this PR's checkout, apply only its test changes to the baseline:

base=5a201d633fd90a14ba76795683be36b05baedff0
git worktree add --detach ../zk-auth-before "$base"
git diff "$base" HEAD -- zookeeper-server/src/test/java | git -C ../zk-auth-before apply

With JDK 25 and cached Maven dependencies, run this in the baseline and PR checkouts:

for socket in NIO Netty; do
  if mvn -B -ntp --offline -T 1 -Pfull-build -pl zookeeper-server -am test \
    -Dtest=SaslAuthFailTest#testBadSaslAuthNotifiesWatch \
    "-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocket${socket}" \
    -Dsurefire-forkcount=1 -Dsurefire.rerunFailingTestsCount=0 \
    -Dsurefire.failIfNoSpecifiedTests=false -DfailIfNoTests=false \
    -DredirectTestOutputToFile=false; then status=0; else status=$?; fi
  echo "$socket exit=$status"
done

Both baseline runs exited 1 with:

org.opentest4j.AssertionFailedError: Client threads should stop after SASL authentication fails ==> expected: <true> but was: <false>

The baseline observations below are NIO followed by Netty:

2026-09-23 10:23:50,500 [myid:] - INFO  [main:o.a.z.t.SaslAuthFailTest@101] - SASL failure shutdown without close: threadsStopped=false, state=AUTH_FAILED
2026-09-23 10:24:02,891 [myid:] - INFO  [main:o.a.z.t.SaslAuthFailTest@101] - SASL failure shutdown without close: threadsStopped=false, state=AUTH_FAILED

After the fix, both runs exited 0:

2026-09-23 10:49:39,592 [myid:] - INFO  [main:o.a.z.t.SaslAuthFailTest@101] - SASL failure shutdown without close: threadsStopped=true, state=AUTH_FAILED
2026-09-23 10:49:49,287 [myid:] - INFO  [main:o.a.z.t.SaslAuthFailTest@101] - SASL failure shutdown without close: threadsStopped=true, state=AUTH_FAILED

[kezhuw]

Looks good!

[kezhuw]

Reproduction Steps

1. Configure SASL authentication with invalid credentials
2. Connect to ZooKeeper server
3. Watch receives KeeperState.AuthFailed event
4. Call zookeeper.close()
5. Observe SendThread/EventThread still running via thread dump

I checked the reproduction steps from ZOOKEEPER-4947 and think the behavior is temporary as AUTH_FAILED does not break send loop eagerly. After connection failure, SendThread and EventThread will be run out main loop eventally.

[kezhuw]

Withdraw my +1.

I think what we need to do is quiting send loop right after AUTH_FAILED.

[1fanwang]

Done in 2dd3c44. The send loop now exits on AUTH_FAILED without caller close; the description is corrected.

[anmolnar]

lgtm.

[anmolnar]

Thanks for the contribution @1fanwang . I restarted the failing build, but the unit test failure might be related, I'm not sure.

[1fanwang]

Done in 60ad965. Rejected-client tests now wait for AuthFailed instead of a transient JMX entry; the AUTHFAILED assertions remain.

[anmolnar]

Merged to master and branch-3.9 branches. Thanks for the contribution @1fanwang !

[anmolnar]

What is your jira id?

[1fanwang]

What is your jira id?

Thanks @anmolnar

My ASF Jira info is:
Username: 1fan
Full name: Stefan Wang

[anmolnar]

What is your jira id?

Thanks @anmolnar

My ASF Jira info is: Username: 1fan Full name: Stefan Wang

Great. I added you to the contributors list.