{"record":{"id":"0eb6c5d29d5771a0","repo":"cloudflare/cloudflared","slug":"unsupported-auth-version-v","errorCode":null,"errorMessage":"Unsupported auth version: %v","messagePattern":"Unsupported auth version: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/authenticator.go","lineNumber":53,"sourceCode":"\t\tIsValid: isValid,\n\t}\n}\n\n// Handle writes back the version and NoAuth\nfunc (a *UserPassAuthAuthenticator) Handle(reader io.Reader, writer io.Writer) error {\n\tif _, err := writer.Write([]byte{socks5Version, UserPassAuth}); err != nil {\n\t\treturn err\n\t}\n\n\t// Get the version and username length\n\theader := []byte{0, 0}\n\tif _, err := io.ReadAtLeast(reader, header, 2); err != nil {\n\t\treturn err\n\t}\n\n\t// Ensure compatibility. Someone call E-harmony\n\tif header[0] != userAuthVersion {\n\t\treturn fmt.Errorf(\"Unsupported auth version: %v\", header[0])\n\t}\n\n\t// Get the user name\n\tuserLen := int(header[1])\n\tuser := make([]byte, userLen)\n\tif _, err := io.ReadAtLeast(reader, user, userLen); err != nil {\n\t\treturn err\n\t}\n\n\t// Get the password length\n\tif _, err := reader.Read(header[:1]); err != nil {\n\t\treturn err\n\t}\n\n\t// Get the password\n\tpassLen := int(header[0])\n\tpass := make([]byte, passLen)\n\tif _, err := io.ReadAtLeast(reader, pass, passLen); err != nil {","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/authenticator.go#L35-L71","documentation":"The username/password (0x01) sub-negotiation authenticator reads a 2-byte header and requires version byte 0x01 (userAuthVersion). If the client sends a different sub-negotiation version, Handle returns 'Unsupported auth version'. This indicates the client's username/password auth framing is malformed or from a different RFC draft.","triggerScenarios":"Client sends username/password auth bytes whose first byte is not 0x01 after selecting the user/pass method; short reads producing a wrong header byte.","commonSituations":"Clients implementing the obsolete draft (version 0x02) username/password framing; corrupt/garbage bytes from a non-conforming client; custom client code hardcoding the wrong version byte.","solutions":["Ensure the client sends RFC 1929 username/password framing starting with version byte 0x01.","Update the client library if it uses the pre-RFC draft version of sub-negotiation.","Verify bytes aren't offset — check the method negotiation consumed exactly the right number of bytes.","Capture the connection bytes to confirm the version byte value the client actually sends."],"exampleFix":"// before (client)\nconn.Write([]byte{0x02, 1, 'u', 1, 'p'})\n// after\nconn.Write(append([]byte{0x01, byte(len(user))}, append([]byte(user), append([]byte{byte(len(pass))}, []byte(pass)...)...)...))","handlingStrategy":"validation","validationCode":"// client-side: RFC 1929 framing starts with 0x01\nif header[0] != 0x01 { return fmt.Errorf(\"bad subnegotiation version %d\", header[0]) }","typeGuard":null,"tryCatchPattern":"if err := authenticator.Handle(reader, writer); err != nil {\n    return fmt.Errorf(\"user/pass auth failed: %w\", err)\n}","preventionTips":["Implement RFC 1929 exactly (version byte 0x01)","Avoid client libraries using the pre-RFC draft framing","Verify byte offsets after method negotiation","Test against a reference SOCKS5 client"],"tags":["socks5","authentication","rfc1929"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}