{"record":{"id":"77f3c55ccd5600cd","repo":"XTLS/Xray-core","slug":"unsupported-command-v","errorCode":null,"errorMessage":"unsupported command: %v","messagePattern":"unsupported command: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":97,"sourceCode":"\t\t}\n\t\taddress = net.ParseAddress(domain)\n\t}\n\n\tswitch cmd {\n\tcase cmdTCPConnect:\n\t\trequest := &protocol.RequestHeader{\n\t\t\tCommand: protocol.RequestCommandTCP,\n\t\t\tAddress: address,\n\t\t\tPort:    port,\n\t\t\tVersion: socks4Version,\n\t\t}\n\t\tif err := writeSocks4Response(writer, socks4RequestGranted, net.AnyIP, net.Port(0)); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn request, nil\n\tdefault:\n\t\twriteSocks4Response(writer, socks4RequestRejected, net.AnyIP, net.Port(0))\n\t\treturn nil, errors.New(\"unsupported command: \", cmd)\n\t}\n}\n\nfunc (s *ServerSession) auth5(nMethod byte, reader io.Reader, writer io.Writer) (username string, err error) {\n\tbuffer := buf.StackNew()\n\tdefer buffer.Release()\n\n\tif _, err = buffer.ReadFullFrom(reader, int32(nMethod)); err != nil {\n\t\treturn \"\", errors.New(\"failed to read auth methods\").Base(err)\n\t}\n\n\tvar expectedAuth byte = authNotRequired\n\tif s.config.AuthType == AuthType_PASSWORD {\n\t\texpectedAuth = authPassword\n\t}\n\n\tif !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {\n\t\twriteSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L79-L115","documentation":"Returned by handshake4 (proxy/socks/protocol.go:97) when the SOCKS4 command byte is anything other than cmdTCPConnect (0x01). The server writes a socks4RequestRejected response and rejects the request; SOCKS4 BIND (0x02) is not implemented.","triggerScenarios":"A SOCKS4 client issuing command 0x02 (BIND) or any value other than 0x01 in the second header byte; also garbage input where the byte happens to be the version byte of another protocol.","commonSituations":"Applications that require inbound connections (FTP data channels, legacy peer-to-peer) attempting SOCKS4 BIND; malformed probes.","solutions":["Change the client to use CONNECT (0x01); SOCKS BIND is not supported by this server in any version (SOCKS5 returns 'TCP bind is not supported.' too).","If the application truly needs BIND, SOCKS proxying is the wrong tool: expose the service directly or use a port-forward inbound.","Verify the client is not corrupting the request framing (wrong byte offsets produce arbitrary command values)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client-side: only CONNECT is valid for SOCKS4\nconst socks4Connect = 0x01\nif cmd != socks4Connect {\n    return fmt.Errorf(\"SOCKS4 command 0x%02X unsupported; only CONNECT (0x01) is allowed\", cmd)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unsupported command\") {\n    // tell the caller this operation needs a different transport\n    return ErrNeedsDirectConnection\n}","preventionTips":["Do not attempt FTP active mode or BIND-style flows through SOCKS.","Use passive modes and plain CONNECT requests."],"tags":["socks","protocol","unsupported-command","bind","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}