{"record":{"id":"16c351095baa21e6","repo":"ginuerzh/gost","slug":"socks4a-d","errorCode":null,"errorMessage":"[socks4a] %d","messagePattern":"\\[socks4a\\] (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks.go","lineNumber":803,"sourceCode":"\tif err := req.Write(conn); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif Debug {\n\t\tlog.Logf(\"[socks4a] %s\", req)\n\t}\n\n\treply, err := gosocks4.ReadReply(conn)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif Debug {\n\t\tlog.Logf(\"[socks4a] %s\", reply)\n\t}\n\n\tif reply.Code != gosocks4.Granted {\n\t\treturn nil, fmt.Errorf(\"[socks4a] %d\", reply.Code)\n\t}\n\n\treturn conn, nil\n}\n\ntype socks5Handler struct {\n\tselector *serverSelector\n\toptions  *HandlerOptions\n}\n\n// SOCKS5Handler creates a server Handler for SOCKS5 proxy server.\nfunc SOCKS5Handler(opts ...HandlerOption) Handler {\n\th := &socks5Handler{}\n\th.Init(opts...)\n\n\treturn h\n}\n","sourceCodeStart":785,"sourceCodeEnd":821,"githubUrl":"https://github.com/ginuerzh/gost/blob/a33fdbf4c98034f4bfeeaea9868909822b9c526d/socks.go#L785-L821","documentation":"The SOCKS4a CONNECT reply was not Granted (0x5A): the proxy refused the request. Like the SOCKS4 case, the numeric reply code is embedded in the error so callers can tell rejection, ident failure, or mismatch apart.","triggerScenarios":"socks4aConnector.ConnectContext (tcp-family) writes the SOCKS4a request with the hostname in the userid field; server replies with a non-granted code: destination denied, ident check failed, or the proxy could not reach/resolve the host.","commonSituations":"Proxy ACL blocking the hostname; proxy without DNS access failing remote resolution; identd-based SOCKS4a servers rejecting clients; expired/blacklisted target hosts.","solutions":["Read the reply code: 91 request rejected/failed (check target reachability & proxy ACL), 92/93 ident problems (fix or disable ident).","Test the hostname resolution from the proxy host; fix the proxy's DNS.","Prefer SOCKS5 (gosocks5) connector for modern proxies with richer error reporting.","Add the target to the proxy allow list."],"exampleFix":"// before\nconn, err := socks4aConnector.Connect(ctx, proxyConn, \"legacy.internal:80\") // code 91\n// after\nconn, err := socks5Connector.Connect(ctx, proxyConn, \"legacy.internal:80\") // SOCKS5, richer support/replies","handlingStrategy":"try-catch","validationCode":"if _, _, err := net.SplitHostPort(address); err != nil {\n\treturn fmt.Errorf(\"invalid socks4a target %q\", address)\n}","typeGuard":null,"tryCatchPattern":"conn, err := socks4aConnector.ConnectContext(ctx, conn, \"tcp\", addr)\nif err != nil {\n\tvar code int\n\tif n, _ := fmt.Sscanf(err.Error(), \"[socks4a] %d\", &code); n == 1 {\n\t\tif code == 91 {\n\t\t\t// refused/failed: check proxy ACL & proxy-side DNS\n\t\t}\n\t\treturn fmt.Errorf(\"socks4a refused (code %d)\", code)\n\t}\n\treturn err\n}","preventionTips":["Verify the proxy can resolve the target hostname.","Keep destinations whitelisted on the proxy.","Prefer SOCKS5 where possible for better error semantics.","Handle ident codes (92/93) by fixing or disabling ident checks."],"tags":["socks4a","connect-refused","proxy","reply-code"],"backgroundTag":"socks-command-refused","analyzedSha":"a33fdbf4c98034f4bfeeaea9868909822b9c526d","analyzedAt":"2026-09-02T22:15:54.506Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}