{"record":{"id":"61c7f01dff7b6ab2","repo":"XTLS/Xray-core","slug":"first-prefixed-padding-turn-is-not-client-to-serve","errorCode":null,"errorMessage":"first prefixed padding turn is not client-to-server","messagePattern":"first prefixed padding turn is not client-to-server","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/padding.go","lineNumber":81,"sourceCode":"\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif err := readPaddingTurn(reader, turn, prefixLength); err != nil {\n\t\t\treturn fmt.Errorf(\"read padding turn %d: %w\", i, err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validatePaddingSchedule(schedule []paddingTurn, firstTurnPrefixLength int) error {\n\tif len(schedule) == 0 {\n\t\treturn fmt.Errorf(\"empty padding schedule\")\n\t}\n\tif firstTurnPrefixLength < 0 {\n\t\treturn fmt.Errorf(\"negative first turn prefix length: %d\", firstTurnPrefixLength)\n\t}\n\tif firstTurnPrefixLength > 0 && schedule[0].direction != paddingClientToServer {\n\t\treturn fmt.Errorf(\"first prefixed padding turn is not client-to-server\")\n\t}\n\n\tfor i, turn := range schedule {\n\t\tif turn.direction != paddingClientToServer && turn.direction != paddingServerToClient {\n\t\t\treturn fmt.Errorf(\"padding turn %d has invalid direction: %d\", i, turn.direction)\n\t\t}\n\t\tif err := validatePaddingDelayRange(turn.startDelay); err != nil {\n\t\t\treturn fmt.Errorf(\"padding turn %d has an invalid start delay: %w\", i, err)\n\t\t}\n\t\tif err := validatePaddingDelayRange(turn.chunkDelay); err != nil {\n\t\t\treturn fmt.Errorf(\"padding turn %d has an invalid chunk delay: %w\", i, err)\n\t\t}\n\t\tif turn.writeChunkMinLength < 0 || turn.writeChunkLength < turn.writeChunkMinLength || turn.writeChunkLength > maxPaddingChunkLength {\n\t\t\treturn fmt.Errorf(\"padding turn %d has an invalid write chunk range: %d-%d\", i, turn.writeChunkMinLength, turn.writeChunkLength)\n\t\t}\n\t\tif len(turn.variants) > 0 && turn.writeChunkLength != 0 {\n\t\t\treturn fmt.Errorf(\"padding turn %d combines variants with generated write chunks\", i)\n\t\t}","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/padding.go#L63-L99","documentation":"validatePaddingSchedule requires that when firstTurnPrefixLength > 0, the first padding turn flows client-to-server: the prefix bytes were client-sent real record bytes, so the camouflage padding that follows must continue in the same direction. A server-to-client first turn with a prefix is a contradiction.","triggerScenarios":"Building a schedule whose first turn has direction paddingServerToClient while passing a positive prefix length; inverting the isClient flag at a call site so directions are mirrored.","commonSituations":"Forks writing new schedule profiles; copy-paste of a server-perspective schedule into a client code path; tests constructing schedules by hand.","solutions":["Make the first turn direction paddingClientToServer whenever the prefix is non-zero","Emit schedules from one builder that knows the client perspective rather than hand-editing turn lists","Add a schedule round-trip test that validates client and mirrored server schedules together"],"exampleFix":"// before\nschedule := []paddingTurn{{direction: paddingServerToClient, ...}}\n\n// after\nschedule := []paddingTurn{{direction: paddingClientToServer, ...}, {direction: paddingServerToClient, ...}}","handlingStrategy":"validation","validationCode":"if prefix > 0 && schedule[0].direction != paddingClientToServer {\n    return fmt.Errorf(\"schedule invalid for prefixed first turn\")\n}","typeGuard":"func validFirstTurn(s []paddingTurn, prefix int) bool {\n    return prefix == 0 || (len(s) > 0 && s[0].direction == paddingClientToServer)\n}","tryCatchPattern":null,"preventionTips":["Author schedules from the client perspective with a single builder","Test client and mirrored server schedules together"],"tags":["go","padding","validation","schedule"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}