{"record":{"id":"3935ac23a6ce780a","repo":"XTLS/Xray-core","slug":"legacy-blocktypes-qtype-out-of-range","errorCode":null,"errorMessage":"legacy blockTypes qType out of range: {}","messagePattern":"legacy blockTypes qType out of range: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/dns_proxy.go","lineNumber":141,"sourceCode":"\tmode := \"reject\"\n\tif c.NonIPQuery != nil && *c.NonIPQuery != \"\" {\n\t\tmode = *c.NonIPQuery\n\t}\n\tswitch mode {\n\tcase \"\", \"reject\", \"drop\", \"skip\":\n\tdefault:\n\t\treturn nil, errors.New(\"unknown nonIPQuery: \", mode)\n\t}\n\n\tif c.BlockTypes != nil && len(*c.BlockTypes) > 0 {\n\t\trule := &dns.DNSRuleConfig{Action: dns.RuleAction_Drop}\n\t\tif mode == \"reject\" {\n\t\t\trule.Action = dns.RuleAction_Return\n\t\t\trule.RCode = 5\n\t\t}\n\t\tfor _, qType := range *c.BlockTypes {\n\t\t\tif qType < 0 || qType > 65535 {\n\t\t\t\treturn nil, errors.New(\"legacy blockTypes qType out of range: \", qType)\n\t\t\t}\n\t\t\trule.QType = append(rule.QType, qType)\n\t\t}\n\t\trules = append(rules, rule)\n\t}\n\n\t{\n\t\trule := &dns.DNSRuleConfig{Action: dns.RuleAction_Hijack}\n\t\trule.QType = append(rule.QType, 1)\n\t\trule.QType = append(rule.QType, 28)\n\t\trules = append(rules, rule)\n\t}\n\n\t{\n\t\trule := &dns.DNSRuleConfig{Action: dns.RuleAction_Return}\n\t\tif mode == \"reject\" {\n\t\t\trule.Action = dns.RuleAction_Return\n\t\t\trule.RCode = 5","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/dns_proxy.go#L123-L159","documentation":"Thrown when a legacy 'blockTypes' entry in a DNS outbound is outside the range 0-65535. DNS qType is a 16-bit field, so the builder rejects negative or oversized values before appending them to the drop rule. Only reached on the legacy path (blockTypes present, no 'rules').","triggerScenarios":"\"blockTypes\": [70000] or [-1] in a DNS outbound JSON; any entry where qType < 0 || qType > 65535 fails the guard in buildLegacyDNSPolicy().","commonSituations":"Typos or copy-paste of RR type mnemonics' numeric codes from IANA tables with OCR/format errors; generators emitting int32 values unchecked.","solutions":["Use valid DNS RR type numbers (e.g. 255 = ANY, 16 = TXT, 33 = SRV, 28 = AAAA).","Remove the legacy blockTypes and use \"rules\": [{\"action\": \"drop\", \"qType\": [...]}] which validates ranges too.","Validate generated configs programmatically before shipping them."],"exampleFix":"// before\n\"blockTypes\": [65536, 255]\n\n// after\n\"blockTypes\": [255]","handlingStrategy":"validation","validationCode":"for _, qt := range blockTypes {\n    if qt < 0 || qt > 65535 {\n        return fmt.Errorf(\"blockTypes qType %d out of range\", qt)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate qType against the IANA RR type registry values (0-65535).","Move to \"rules\" with explicit qType lists instead of blockTypes."],"tags":["go","xray","dns","config","numeric-range","deprecated"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}