{"record":{"id":"813d03b1725f7b93","repo":"txthinking/brook","slug":"invalid-packet-length-len-address-a-h","errorCode":null,"errorMessage":"invalid packet. length: ${len} address: ${a} ${h} ${p}","messagePattern":"invalid packet\\. length: (.+?) address: (.+?) (.+?) (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packetserverconn.go","lineNumber":78,"sourceCode":"\t}\n\tx.BP32.Put(ck)\n\tca, err := cipher.NewGCM(cb)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tif _, err := ca.Open(b[:12], b[:12], b[12:], nil); err != nil {\n\t\treturn nil, nil, err\n\t}\n\ti := int64(binary.BigEndian.Uint32(b[12 : 12+4]))\n\tif time.Now().Unix()-i > 60 {\n\t\treturn nil, nil, errors.New(\"Expired request\")\n\t}\n\ta, h, p, err := socks5.ParseBytesAddress(b[12+4:])\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tif 12+4+1+len(h)+2 >= len(b)-16 {\n\t\treturn nil, nil, errors.New(fmt.Sprintf(\"invalid packet. length: %d address: %#x %#x %#x\", len(b), a, h, p))\n\t}\n\tdst := socks5.ToAddress(a, h, p)\n\tf.Lock.Lock()\n\tc, ok := f.Conns[addr.String()+dst]\n\tf.Lock.Unlock()\n\tif ok {\n\t\t_ = c.In(b[12+4+1+len(h)+2 : len(b)-16])\n\t\treturn nil, nil, nil\n\t}\n\tf.Lock.Lock()\n\tc = NewPacketConn(b[12+4+1+len(h)+2:len(b)-16], w, timeout, func() {\n\t\tf.Lock.Lock()\n\t\tdelete(f.Conns, addr.String()+dst)\n\t\tf.Lock.Unlock()\n\t})\n\tf.Conns[addr.String()+dst] = c\n\tf.Lock.Unlock()\n\treturn c, b[12+4 : 12+4+1+len(h)+2], nil","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/txthinking/brook/blob/5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8/packetserverconn.go#L60-L96","documentation":"After parsing the SOCKS5 address from the decrypted packet, Handle validates that the declared address actually fits in the packet: if 12+4+1+len(host)+2 >= len(b)-16, the payload is too short/malformed to contain the address plus the 16-byte HMAC tail. The error includes packet length and the parsed address components in hex.","triggerScenarios":"Sending a truncated or corrupted UDP packet to the brook packet server; wrong protocol version/serialization so bytes do not line up; a packet where the host length byte claims more bytes than remain before the 16-byte authentication tag.","commonSituations":"Client and server running mismatched brook versions with different packet framing; bit-flips/corruption on the wire after MAC bypass due to layout change; hand-rolled clients constructing the packet incorrectly.","solutions":["Ensure client and server use the same (matching) brook version so packet framing (12-byte nonce + 4-byte timestamp + SOCKS5 address + payload + 16-byte tag) aligns.","Inspect the logged length and hex address values; rebuild the packet so the SOCKS5 address host length matches the actual bytes present.","Use the official brook client instead of a hand-rolled implementation to construct packets.","Check for middleboxes/tunneling layers truncating UDP payloads (MTU issues); reduce payload size."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before sending, verify framing: 12 nonce + 4 ts + socks5 addr + payload, and len(payload) >= 1\nif len(packet) < 12+4+1+1+2+16 {\n    return errors.New(\"packet too short to be valid\")\n}","typeGuard":null,"tryCatchPattern":"if strings.HasPrefix(err.Error(), \"invalid packet.\") {\n    log.Printf(\"malformed packet dropped: %v\", err)\n    // do not retry; rebuild packet with current library version\n}","preventionTips":["Pin client and server to the same brook version.","Use the official client library to build packets, not hand-rolled serializers.","Keep UDP payloads under path MTU to avoid truncation.","Log the length/address fields from the error to diagnose framing drift."],"tags":["udp","packet-format","protocol-error","socks5"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8","analyzedAt":"2026-09-06T04:35:00.432Z","contentChangedAt":"2026-09-06T04:35:00.432Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}