{"record":{"id":"7020c2d7f0c4df8f","repo":"XTLS/Xray-core","slug":"failed-to-read-request-7020c2","errorCode":null,"errorMessage":"failed to read request","messagePattern":"failed to read request","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/server.go","lineNumber":133,"sourceCode":"\t// Firstbyte is for forwarded conn from SOCKS inbound\n\t// Because it needs first byte to choose protocol\n\t// We need to add it back\n\treader := &buf.BufferedReader{\n\t\tReader: buf.NewReader(conn),\n\t\tBuffer: buf.MultiBuffer{buf.FromBytes(firstbyte)},\n\t}\n\trequest, tempUDPConn, err := svrSession.Handshake(reader, conn)\n\tdefer common.CloseIfExists(tempUDPConn)\n\tif err != nil {\n\t\tif inbound.Source.IsValid() {\n\t\t\tlog.Record(&log.AccessMessage{\n\t\t\t\tFrom:   inbound.Source,\n\t\t\t\tTo:     \"\",\n\t\t\t\tStatus: log.AccessRejected,\n\t\t\t\tReason: err,\n\t\t\t})\n\t\t}\n\t\treturn errors.New(\"failed to read request\").Base(err)\n\t}\n\tif request.User != nil {\n\t\tinbound.User.Email = request.User.Email\n\t}\n\n\tif err := conn.SetReadDeadline(time.Time{}); err != nil {\n\t\terrors.LogInfoInner(ctx, err, \"failed to clear deadline\")\n\t}\n\n\tif request.Command == protocol.RequestCommandTCP {\n\t\tdest := request.Destination()\n\t\terrors.LogInfo(ctx, \"TCP Connect request to \", dest)\n\t\tif inbound.Source.IsValid() {\n\t\t\tctx = log.ContextWithAccessMessage(ctx, &log.AccessMessage{\n\t\t\t\tFrom:   inbound.Source,\n\t\t\t\tTo:     dest,\n\t\t\t\tStatus: log.AccessAccepted,\n\t\t\t\tReason: \"\",","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/server.go#L115-L151","documentation":"Generic wrapper thrown when the SOCKS ServerSession.Handshake (SOCKS4/4a/5 negotiation including auth and request parsing) fails for any reason; the real cause is in the Base error chain. It also records an AccessRejected log entry when the source is known.","triggerScenarios":"Any handshake sub-failure: malformed SOCKS request bytes, auth rejection from the inbound's users list, unsupported command, or a read timeout within policy.Timeouts.Handshake. Triggered per-connection at svrSession.Handshake in processTCP.","commonSituations":"Clients with wrong credentials hitting an auth-enabled SOCKS inbound; scanners sending garbage; slow clients exceeding the handshake timeout; client libraries speaking a nonstandard SOCKS dialect.","solutions":["Inspect the logged Base error (and the AccessRejected record) to identify the actual handshake stage that failed.","For auth failures, correct the client credentials to match inbound users.","For timeouts, increase policy.timeouts.handshake (level 0 policy) on the server.","Enable debug logging (loglevel: debug) to capture the exact malformed request."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := s.processTCP(ctx, conn, dispatcher, first); err != nil {\n\tif base := errors.HasType(err, ...); strings.Contains(err.Error(), \"failed to read request\") {\n\t\tlog.Record(&log.AccessMessage{Status: log.AccessRejected, Reason: err})\n\t\treturn nil // per-connection failure, keep listener alive\n\t}\n}","preventionTips":["Log at debug level to capture the underlying handshake error.","Keep policy handshake timeouts above client RTT.","Monitor rejected-access records for credential-brute-force patterns."],"tags":["socks","inbound","handshake","wrapper-error"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}