{"record":{"id":"a21f21baad29c113","repo":"ginuerzh/gost","slug":"bad-tls-data-len","errorCode":null,"errorMessage":"bad tls data len","messagePattern":"bad tls data len","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"obfs.go","lineNumber":323,"sourceCode":"\t\t0x009e, 0xc024, 0xc028, 0x006b, 0xc023, 0xc027, 0x0067, 0xc00a,\n\t\t0xc014, 0x0039, 0xc009, 0xc013, 0x0033, 0x009d, 0x009c, 0x003d,\n\t\t0x003c, 0x0035, 0x002f, 0x00ff,\n\t}\n\n\tcompressionMethods = []uint8{0x00}\n\n\talgorithms = []uint16{\n\t\t0x0601, 0x0602, 0x0603, 0x0501, 0x0502, 0x0503, 0x0401, 0x0402,\n\t\t0x0403, 0x0301, 0x0302, 0x0303, 0x0201, 0x0202, 0x0203,\n\t}\n\n\ttlsRecordTypes   = []uint8{0x16, 0x14, 0x16, 0x17}\n\ttlsVersionMinors = []uint8{0x01, 0x03, 0x03, 0x03}\n\n\tErrBadType         = errors.New(\"bad type\")\n\tErrBadMajorVersion = errors.New(\"bad major version\")\n\tErrBadMinorVersion = errors.New(\"bad minor version\")\n\tErrMaxDataLen      = errors.New(\"bad tls data len\")\n)\n\nconst (\n\ttlsRecordStateType = iota\n\ttlsRecordStateVersion0\n\ttlsRecordStateVersion1\n\ttlsRecordStateLength0\n\ttlsRecordStateLength1\n\ttlsRecordStateData\n)\n\ntype obfsTLSParser struct {\n\tstep   uint8\n\tstate  uint8\n\tlength uint16\n}\n\ntype obfsTLSConn struct {","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/ginuerzh/gost/blob/a33fdbf4c98034f4bfeeaea9868909822b9c526d/obfs.go#L305-L341","documentation":"Parse of a TLS obfuscation header failed because the parsed record length exceeds maxTLSDataLen. The library reads the 2-byte TLS record length field and rejects values larger than the allowed maximum, since such a record cannot be a valid TLS handshake/record emitted by the obfuscation protocol. This guards against malformed or hostile streams masquerading as TLS records.","triggerScenarios":"Calling Parse on a byte stream whose TLS record header carries a length field > maxTLSDataLen (checked in the state machine at obfs.go:389 when r.length is read). Typically happens when the peer is not sending the expected TLS-obfuscated traffic or the stream is corrupted mid-record.","commonSituations":"Pointing an obfs client at a plain TLS server (raw TLS records may exceed the crafted maximum), byte loss/corruption in the tunnel causing misaligned parsing, or a version mismatch between obfs endpoints.","solutions":["Verify both endpoints run the same obfs protocol/version and the remote actually speaks the TLS-obfuscation format","Check the connection for corruption/reordering (unreliable transport) that shifts the parse state","Re-sync or restart the stream; once the state machine is misaligned, re-establish the connection","If you control the peer, ensure records are capped at maxTLSDataLen before sending"],"exampleFix":"// before: parsing arbitrary bytes that are not obfs-TLS\nnode, err := obfs.Parse(rawStream)\n// after: validate the first record header length before parsing\nif binary.BigEndian.Uint16(raw[3:5]) > maxTLSDataLen {\n    return fmt.Errorf(\"stream is not valid obfs-tls traffic\")\n}\nnode, err := obfs.Parse(raw)","handlingStrategy":"validation","validationCode":"if len(raw) >= 5 && binary.BigEndian.Uint16(raw[3:5]) > maxTLSDataLen {\n    return errors.New(\"invalid obfs-tls record length\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm both peers run the same obfs version","Check transport integrity (no reordering/truncation)","Re-establish the stream after any parse failure"],"tags":["tls","obfuscation","protocol-error"],"backgroundTag":"tls-record-parse-failure","analyzedSha":"a33fdbf4c98034f4bfeeaea9868909822b9c526d","analyzedAt":"2026-09-02T22:15:54.506Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}