{"record":{"id":"0bcf176fab23dc1d","repo":"XTLS/Xray-core","slug":"invalid-domain-name-domain","errorCode":null,"errorMessage":"invalid domain name: {domain}","messagePattern":"invalid domain name: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/protocol/address.go","lineNumber":220,"sourceCode":"\t\t}\n\t\treturn net.IPAddress(b.BytesFrom(-16)), nil\n\tcase net.AddressFamilyDomain:\n\t\tif _, err := b.ReadFullFrom(reader, 1); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tdomainLength := int32(b.Byte(b.Len() - 1))\n\t\tif _, err := b.ReadFullFrom(reader, domainLength); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tdomain := string(b.BytesFrom(-domainLength))\n\t\tif maybeIPPrefix(domain[0]) {\n\t\t\taddr := net.ParseAddress(domain)\n\t\t\tif addr.Family().IsIP() {\n\t\t\t\treturn addr, nil\n\t\t\t}\n\t\t}\n\t\tif !isValidDomain(domain) {\n\t\t\treturn nil, errors.New(\"invalid domain name: \", domain)\n\t\t}\n\t\treturn net.DomainAddress(domain), nil\n\tdefault:\n\t\tpanic(\"impossible case\")\n\t}\n}\n\nfunc (p *addressParser) writeAddress(writer io.Writer, address net.Address) error {\n\ttb := p.addrByteMap[address.Family()]\n\tif tb == afInvalid {\n\t\treturn errors.New(\"unknown address family\", address.Family())\n\t}\n\n\tswitch address.Family() {\n\tcase net.AddressFamilyIPv4, net.AddressFamilyIPv6:\n\t\tif _, err := writer.Write([]byte{tb}); err != nil {\n\t\t\treturn err\n\t\t}","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/protocol/address.go#L202-L238","documentation":"Returned when a decoded domain-type address fails isValidDomain after the maybeIPPrefix fast path did not parse it as an IP. The domain contains illegal characters, bad labels, or other RFC violations, so the parser refuses to accept it as a destination.","triggerScenarios":"readAddress decoding a domain address whose bytes include control characters, spaces, invalid punycode, empty labels, or exceed per-label length limits; typically because the stream is corrupted or the length prefix pointed mid-domain.","commonSituations":"Framing desync (length byte wrong), a malicious/malformed client deliberately sending invalid domains, or middleboxes mangling the payload.","solutions":["Verify client/server credentials and encryption match (desync is the usual root cause)","If a specific client triggers it, inspect the exact domain bytes logged and block/fix that client","Reproduce with a known-good client to confirm the server decoder is fine"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"addr, err := parser.ReadAddress(buf, reader)\nif err != nil { // invalid domain: reject request, keep listener alive\n    return newError(\"invalid destination domain\").Base(err)\n}","preventionTips":["Reject and log the raw domain bytes to identify the offending client","Fix stream desync root causes (credentials/encryption mismatch) rather than the symptom"],"tags":["protocol","domain","validation","parsing"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}