{"record":{"id":"60b8a0bf4bbb5cf5","repo":"jstedfast/MailKit","slug":"failed-to-connect-to-0-1-2-socks4client","errorCode":null,"errorMessage":"Failed to connect to {0}:{1}: {2}","messagePattern":"Failed to connect to (.+?):(.+?): (.+?)","errorType":"exception","errorClass":"ProxyProtocolException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Proxy/Socks4Client.cs","lineNumber":268,"sourceCode":"\t\t\ttry {\n\t\t\t\tvar buffer = GetConnectCommand (domain, addr, port);\n\n\t\t\t\tSend (socket, buffer, 0, buffer.Length, cancellationToken);\n\n\t\t\t\t// +-----+-----+----------+----------+\n\t\t\t\t// | VER | REP | BND.PORT | BND.ADDR |\n\t\t\t\t// +-----+-----+----------+----------+\n\t\t\t\t// |  1  |  1  |    2     |    4     |\n\t\t\t\t// +-----+-----+----------+----------+\n\t\t\t\tint nread, n = 0;\n\n\t\t\t\tdo {\n\t\t\t\t\tif ((nread = Receive (socket, buffer, 0 + n, 8 - n, cancellationToken)) > 0)\n\t\t\t\t\t\tn += nread;\n\t\t\t\t} while (n < 8);\n\n\t\t\t\tif (buffer[1] != (byte) Socks4Reply.RequestGranted)\n\t\t\t\t\tthrow new ProxyProtocolException (string.Format (CultureInfo.InvariantCulture, \"Failed to connect to {0}:{1}: {2}\", host, port, GetFailureReason (buffer[1])));\n\n\t\t\t\t// TODO: do we care about BND.ADDR and BND.PORT?\n\n\t\t\t\treturn new NetworkStream (socket, true);\n\t\t\t} catch {\n\t\t\t\tif (socket.Connected)\n\t\t\t\t\tsocket.Disconnect (false);\n\n\t\t\t\tsocket.Dispose ();\n\t\t\t\tthrow;\n\t\t\t}\n\t\t}\n\n\t\t/// <summary>\n\t\t/// Asynchronously connect to the target host.\n\t\t/// </summary>\n\t\t/// <remarks>\n\t\t/// Asynchronously connects to the target host and port through the proxy server.","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Proxy/Socks4Client.cs#L250-L286","documentation":"After sending the SOCKS4 CONNECT request, Socks4Client reads the 8-byte reply and requires byte[1] == 0x5A (RequestGranted). Any other reply code throws ProxyProtocolException('Failed to connect to host:port: <reason>') where the reason names the SOCKS4 failure (request rejected/ident failed, target unreachable, etc.).","triggerScenarios":"The SOCKS4 proxy refuses the CONNECT: target host/port blocked, SOCKS user-id rejected (ident check failed), proxy cannot reach the target, or wrong proxy port/protocol so the reply bytes are garbage.","commonSituations":"Proxy ACLs disallowing mail ports; missing or mismatched SOCKS userid when the proxy enforces ident; pointing the client at a SOCKS5-only or HTTP proxy; target host firewall dropping from the proxy's network.","solutions":["Check the failure reason embedded in the exception message (GetFailureReason output) for the exact SOCKS4 reply code.","Verify the proxy allows CONNECT to the target host:port and add the ACL entry if not.","Supply the correct SOCKS4 userid in the Connect call if the proxy validates ident.","Confirm the endpoint really is a SOCKS4 proxy; use Socks5Client/HttpProxyClient if it is SOCKS5/HTTP.","Test manually: `curl --socks4 proxy:1080 http://target:port` to reproduce outside the app."],"exampleFix":"// before\nvar proxy = new Socks4Client(\"proxy.corp\", 1080);\nproxy.Connect(targetEp); // rejected: ACL blocks port 995\n// after\n// fix on proxy side: allow CONNECT to target:995, or use an allowed proxy\nvar proxy = new Socks4Client(\"proxy-alt.corp\", 1080);\nproxy.Connect(targetEp, \"socksUserId\");","handlingStrategy":"try-catch","validationCode":"// pre-flight the proxy path outside the app:\n// curl --socks4 proxy:1080 https://target:port -I","typeGuard":null,"tryCatchPattern":"try {\n    return proxy.Connect(targetEp, cancellationToken);\n} catch (ProxyProtocolException ex) when (ex.Message.Contains(\"Failed to connect to\")) {\n    // message carries the SOCKS4 reply reason: check ACLs/userid/proxy type\n    throw new InvalidOperationException(\"SOCKS4 proxy refused CONNECT\", ex);\n}","preventionTips":["Whitelist the target host:port on the proxy before deploying","Supply the SOCKS4 userid when the proxy enforces ident checks","Confirm the proxy speaks SOCKS4 (not SOCKS5/HTTP) before wiring it in"],"tags":["socks4","proxy","connection-refused","mailkit","network"],"backgroundTag":"connection-refused","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}