{"record":{"id":"15c8885c18995e8d","repo":"gravitational/teleport","slug":"proto-wrong-wiretype-d-for-field-existingmfare","errorCode":null,"errorMessage":"proto: wrong wireType = %d for field ExistingMFAResponse","messagePattern":"proto: wrong wireType = (.+?) for field ExistingMFAResponse","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60426,"sourceCode":"\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: CreatePrivilegeTokenRequest: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ExistingMFAResponse\", wireType)\n\t\t\t}\n\t\t\tvar msglen int\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tmsglen |= int(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tif msglen < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice","sourceCodeStart":60408,"sourceCodeEnd":60444,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60408-L60444","documentation":"Field 1 of CreatePrivilegeTokenRequest is ExistingMFAResponse, an embedded message that must be encoded as length-delimited (wire type 2). The payload presents tag 1 with a different wire type, so the generated Unmarshal returns this error. It indicates encoder/decoder schema mismatch or malformed input.","triggerScenarios":"Bytes where tag 1 of CreatePrivilegeTokenRequest carries a non-length-delimited wire type — e.g. an encoder treating ExistingMFAResponse as bytes/varint, or an older schema where field 1 was a scalar — during privilege-token creation RPCs with MFA.","commonSituations":"Version skew between client and auth server around MFA privilege token APIs; custom scripts crafting the request by hand; corrupted frames; decoding a different message's bytes as CreatePrivilegeTokenRequest.","solutions":["Match api/client/proto versions on both peers (same field 1 type/numbering)","Build the request via the typed struct and proto.Marshal, never manual bytes","Inspect tag 1 with protoc --decode_raw to confirm the mismatch","Regenerate the pb.go files from the current .proto if the repo was patched inconsistently"],"exampleFix":"// before: hand-crafted request bytes\nraw := []byte{0x08, 0x01} // field 1 as varint\n// after\nreq := &proto.CreatePrivilegeTokenRequest{ExistingMFAResponse: mfaResp}\nraw, err := proto.Marshal(req)","handlingStrategy":"try-catch","validationCode":"func field1IsLengthDelimited(b []byte) bool {\n    if len(b) == 0 { return false }\n    tag, n := binary.Uvarint(b)\n    return n > 0 && tag>>3 == 1 && tag&0x7 == 2\n}","typeGuard":"func isWireTypeMismatch(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"wrong wireType = \")\n}","tryCatchPattern":"req := &proto.CreatePrivilegeTokenRequest{}\nif err := proto.Unmarshal(blob, req); err != nil {\n    if isWireTypeMismatch(err) {\n        return trace.AccessDenied(\"MFA payload from incompatible client version; upgrade client\")\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Keep client and auth server on matching api/client/proto versions for MFA APIs","Always construct requests via typed structs + proto.Marshal","Gate new privilege-token RPCs behind version handshakes","Log payload diagnostics (protoc --decode_raw) on decode failures"],"tags":["protobuf","grpc","wire-format","deserialization","mfa"],"backgroundTag":"proto-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}