{"record":{"id":"93097637502e7ecf","repo":"nats-io/nats-server","slug":"w-invalid-address","errorCode":null,"errorMessage":"%w: invalid address","messagePattern":"%w: invalid address","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/client_proxyproto.go","lineNumber":194,"sourceCode":"\t\treturn nil, nil, fmt.Errorf(\"%w: invalid v1 format\", errProxyProtoInvalid)\n\t}\n\n\t// Handle UNKNOWN (health check, like v2 LOCAL)\n\tif parts[0] == proxyProtoV1Unknown {\n\t\treturn nil, remaining, nil\n\t}\n\n\t// Must have exactly 5 parts: protocol, src-ip, dst-ip, src-port, dst-port\n\tif len(parts) != 5 {\n\t\treturn nil, nil, fmt.Errorf(\"%w: invalid v1 format\", errProxyProtoInvalid)\n\t}\n\n\tprotocol := parts[0]\n\tsrcIP := net.ParseIP(parts[1])\n\tdstIP := net.ParseIP(parts[2])\n\n\tif srcIP == nil || dstIP == nil {\n\t\treturn nil, nil, fmt.Errorf(\"%w: invalid address\", errProxyProtoInvalid)\n\t}\n\n\t// Parse ports\n\tsrcPort, err := strconv.ParseUint(parts[3], 10, 16)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"invalid source port: %w\", err)\n\t}\n\n\tdstPort, err := strconv.ParseUint(parts[4], 10, 16)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"invalid dest port: %w\", err)\n\t}\n\n\t// Validate protocol matches IP version. The textual form determines the\n\t// family: TCP4 requires dotted-quad addresses, TCP6 requires IPv6\n\t// addresses. IPv4-mapped IPv6 addresses (e.g. \"::ffff:192.0.2.1\") are\n\t// valid for TCP6 since dual-stack proxies can emit those for IPv4\n\t// clients on IPv6 sockets, matching the v2 parser behavior.","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/client_proxyproto.go#L176-L212","documentation":"The v1 header's source or destination IP field failed net.ParseIP, meaning it is neither a valid IPv4 dotted-quad nor a valid IPv6 literal. The server rejects the header with an error wrapping errProxyProtoInvalid because the addresses cannot represent a real connection.","triggerScenarios":"Header contains malformed IP text such as 'PROXY TCP4 999.1.1.1 198.51.100.7 35646 4222\\r\\n', hostnames instead of IPs, or empty address fields.","commonSituations":"Proxy template using hostname instead of resolved IP; misconfigured transparent proxy passing through garbage; double proxying where an inner header leaks; typo in a hand-written test fixture.","solutions":["Confirm the sender writes valid IPv4 dotted-quad or IPv6 literals in both address fields","Fix proxy config that substitutes hostnames (e.g. 'localhost') instead of IPs","Log/inspect the raw header (tcpdump) to see exactly which field is bad","Update broken test fixtures to use valid addresses like 192.0.2.1 (TEST-NET)"],"exampleFix":"// before\n\"PROXY TCP4 localhost 198.51.100.7 35646 4222\\r\\n\"\n// after\n\"PROXY TCP4 192.0.2.1 198.51.100.7 35646 4222\\r\\n\"","handlingStrategy":"validation","validationCode":"src := net.ParseIP(srcIPStr)\ndst := net.ParseIP(dstIPStr)\nif src == nil || dst == nil {\n    return fmt.Errorf(\"cannot send PROXY header: invalid IP %q / %q\", srcIPStr, dstIPStr)\n}","typeGuard":"func parseableIPs(parts []string) bool {\n    return net.ParseIP(parts[1]) != nil && net.ParseIP(parts[2]) != nil\n}","tryCatchPattern":"addr, _, err := readProxyProtoHeader(conn)\nif err != nil {\n    if errors.Is(err, errProxyProtoInvalid) && strings.Contains(err.Error(), \"invalid address\") {\n        log.Printf(\"PROXY header had unparseable IP: %v\", err)\n        return\n    }\n    return err\n}","preventionTips":["Always send IPs, never hostnames, in v1 headers","Resolve hostnames to IPs in the proxy before header emission","Use net.ParseIP as a pre-flight check in custom senders","Prefer v2 binary headers, which carry raw IP bytes and cannot be malformed text"],"tags":["proxy-protocol","network","ip-address","nats"],"backgroundTag":"proxy-protocol-invalid-header","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}