{"record":{"id":"42876cd9cb345957","repo":"XTLS/Xray-core","slug":"read-encryption-request-fields-w","errorCode":null,"errorMessage":"read encryption request fields: %w","messagePattern":"read encryption request fields: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":138,"sourceCode":"\t// Encryption Request\n\tpkt, err := readPacket(c.reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read encryption request: %w\", err)\n\t}\n\n\tif pkt.packetID != 0x01 {\n\t\treturn fmt.Errorf(\"bad encrypt request packet id\")\n\t}\n\n\tvar (\n\t\tserverId    String\n\t\tpublicKey   Bytes\n\t\tverifyToken Bytes\n\t)\n\n\terr = pkt.readFields(&serverId, &publicKey, &verifyToken)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read encryption request fields: %w\", err)\n\t}\n\n\tif !bytes.Equal(publicKey, c.rsaPublicKey) {\n\t\treturn fmt.Errorf(\"server public key mismatch\")\n\t}\n\n\tk, err := x509.ParsePKIXPublicKey(publicKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse server public key: %w\", err)\n\t}\n\n\trsaPublicKey, ok := k.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn fmt.Errorf(\"parse server public key: not rsa\")\n\t}\n\n\tsharedSecret := make([]byte, 16)\n\tif _, err = rand.Read(sharedSecret); err != nil {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L120-L156","documentation":"Wraps a readFields failure while decoding the Encryption Request body (serverId String, publicKey Bytes, verifyToken Bytes). The %w chains the field-decoding error, which occurs when the packet body is truncated or contains malformed varint lengths/UTF-8 for those field types.","triggerScenarios":"A non-Minecraft or proxy server returning bytes that happen to parse as a packet but whose body does not match the String/Bytes/Bytes layout; a man-in-the-middle mangling the stream; a server using a modified protocol that reorders Encryption Request fields.","commonSituations":"Connecting through a MITM HTTP proxy that answers with its own payload; protocol forks (Paper/Forge) altering the packet body; truncation from middleboxes enforcing small first-packet sizes.","solutions":["Capture the actual bytes (hexdump the first packets) to see what the peer really sent.","Bypass intermediate proxies when dialing the Minecraft port.","Confirm the server runs an unmodified login protocol compatible with version 775."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := cc.Handshake(); err != nil {\n\tvar ferr *fieldDecodeError // if exposed; otherwise match message\n\tif errors.As(err, &ferr) || strings.Contains(err.Error(), \"read encryption request fields\") {\n\t\treturn fmt.Errorf(\"peer is not speaking the expected login protocol: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Hexdump the first packets when this fires; malformed bodies usually mean the wrong service answered.","Avoid routing the Minecraft port through MITM/HTTP proxies."],"tags":["network","xmc","finalmask","protocol","parse"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}