{"record":{"id":"7a8184a397b27e78","repo":"grpc/grpc-java","slug":"filterchain-filterchainname-with-filter-l4fil","errorCode":null,"errorMessage":"FilterChain ${filterChainName} with filter ${l4Filter.getName()} failed to unpack message","messagePattern":"FilterChain (.+?) with filter (.+?) failed to unpack message","errorType":"exception","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":263,"sourceCode":"              + \" with unsupported typed_config type \" + any.getTypeUrl());\n    }\n\n    // Parse HCM.\n    HttpConnectionManager hcmProto;\n    try {\n      hcmProto = any.unpack(HttpConnectionManager.class);\n    } catch (InvalidProtocolBufferException e) {\n      throw new ResourceInvalidException(\"FilterChain \" + filterChainName + \" with filter \"\n          + l4Filter.getName() + \" failed to unpack message\", e);\n    }\n    io.grpc.xds.HttpConnectionManager httpConnectionManager = parseHttpConnectionManager(\n        hcmProto, filterRegistry, false /* isForClient */, args);\n\n    // Parse Transport Socket.\n    EnvoyServerProtoData.DownstreamTlsContext downstreamTlsContext = null;\n    if (proto.hasTransportSocket()) {\n      if (!TRANSPORT_SOCKET_NAME_TLS.equals(proto.getTransportSocket().getName())) {\n        throw new ResourceInvalidException(\"transport-socket with name \"\n            + proto.getTransportSocket().getName() + \" not supported.\");\n      }\n      DownstreamTlsContext downstreamTlsContextProto;\n      try {\n        downstreamTlsContextProto =\n            proto.getTransportSocket().getTypedConfig().unpack(DownstreamTlsContext.class);\n      } catch (InvalidProtocolBufferException e) {\n        throw new ResourceInvalidException(\"FilterChain \" + filterChainName\n            + \" failed to unpack message\", e);\n      }\n      downstreamTlsContext =\n          EnvoyServerProtoData.DownstreamTlsContext.fromEnvoyProtoDownstreamTlsContext(\n              validateDownstreamTlsContext(downstreamTlsContextProto, certProviderInstances));\n    }\n\n    // Parse FilterChainMatch.\n    FilterChainMatch filterChainMatch = parseFilterChainMatch(proto.getFilterChainMatch());\n    // null used to skip this check for defaultFilterChain.","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L245-L281","documentation":"Although phrased generically, this exact string is thrown when the filter chain's transport_socket typed_config cannot be unpacked into an Envoy DownstreamTlsContext proto (InvalidProtocolBufferException from Any.unpack). The TLS context bytes do not match the expected protobuf type.","triggerScenarios":"transport_socket.typed_config holds bytes that are not a valid DownstreamTlsContext for its type_url - e.g. wrong type_url with serialized data of another message, truncated payload, or mismatched proto versions - while parseFilterChain processes proto.hasTransportSocket().","commonSituations":"Control planes emitting v2 TLS context protos under a v3 type_url; corrupted or hand-crafted Any payloads; proto schema drift between the management server and the gRPC xDS library version.","solutions":["Ensure transport_socket.typed_config contains a correctly serialized envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext with a matching v3 type_url","Align the management server's proto versions with the gRPC xDS library (both on v3 Envoy APIs)","Enable xDS client debug logging to inspect the raw Any payload and verify the type_url/bytes pair"],"exampleFix":"// before\ntyped_config:\n  '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext\n// after\ntyped_config:\n  '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext","handlingStrategy":"try-catch","validationCode":"if (fc.hasTransportSocket()\n    && !fc.getTransportSocket().getTypedConfig().getTypeUrl()\n        .endsWith(\"tls.v3.DownstreamTlsContext\")) {\n  throw new IllegalArgumentException(\"Unexpected transport socket type_url\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  listener = XdsListenerResource.parseServerSideListener(proto, ...);\n} catch (ResourceInvalidException e) {\n  if (e.getMessage().contains(\"failed to unpack message\")) {\n    logger.warn(\"Transport socket typed_config bytes do not match v3 DownstreamTlsContext\", e);\n  }\n}","preventionTips":["Keep management server and client Envoy proto versions in sync (v3)","Test-decode Any payloads with protoc before serving resources","Avoid hand-marshaling Any payloads; use generated proto code"],"tags":["xds","grpc","tls","protobuf-unmarshal"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}