{"record":{"id":"c69dce5f585ef23f","repo":"cloudflare/cloudflared","slug":"unsupported-command-v","errorCode":null,"errorMessage":"Unsupported command: %v","messagePattern":"Unsupported command: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/request_handler.go","lineNumber":47,"sourceCode":"\t\tdialer:       dialer,\n\t\taccessPolicy: accessPolicy,\n\t}\n}\n\n// Handle processes and responds to socks5 commands\nfunc (h *StandardRequestHandler) Handle(req *Request, conn io.ReadWriter) error {\n\tswitch req.Command {\n\tcase connectCommand:\n\t\treturn h.handleConnect(conn, req)\n\tcase bindCommand:\n\t\treturn h.handleBind(conn, req)\n\tcase associateCommand:\n\t\treturn h.handleAssociate(conn, req)\n\tdefault:\n\t\tif err := sendReply(conn, commandNotSupported, nil); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to send reply: %v\", err)\n\t\t}\n\t\treturn fmt.Errorf(\"Unsupported command: %v\", req.Command)\n\t}\n}\n\n// handleConnect is used to handle a connect command\nfunc (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request) error {\n\tif h.accessPolicy != nil {\n\t\tif req.DestAddr.IP == nil {\n\t\t\taddr, err := net.ResolveIPAddr(\"ip\", req.DestAddr.FQDN)\n\t\t\tif err != nil {\n\t\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\t\treturn fmt.Errorf(\"unable to resolve host to confirm access\")\n\t\t\t}\n\n\t\t\treq.DestAddr.IP = addr.IP\n\t\t}\n\t\tif allowed, rule := h.accessPolicy.Allowed(req.DestAddr.IP, req.DestAddr.Port); !allowed {\n\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\tif rule != nil {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/request_handler.go#L29-L65","documentation":"StandardRequestHandler.Handle dispatches on the SOCKS5 command byte; only connect, bind, and associate are implemented. Any other command byte produces this error (after a commandNotSupported reply is attempted). It means the client requested an operation this handler does not support.","triggerScenarios":"Handle (via Serve) receiving a request whose Command field is not one of the constants connectCommand, bindCommand, or associateCommand.","commonSituations":"Client using an unofficial/experimental SOCKS command; corrupted command byte from a desynchronized stream; clients targeting other SOCKS servers with vendor extensions.","solutions":["Fix the client to send a standard SOCKS5 command (1, 2, or 3)","If you need custom commands, implement your own RequestHandler wrapping StandardRequestHandler","Verify the client stream isn't desynchronized (check the earlier greeting/version bytes)","Update or replace client proxy libraries that emit non-standard command codes"],"exampleFix":"// client\nrequest.Command = 0x07 // unsupported\n\n// after\nrequest.Command = connectCommand // 0x01","handlingStrategy":"validation","validationCode":"// client: send only standard SOCKS5 commands\nif !isSupportedCommand(request.Command) {\n    return fmt.Errorf(\"refusing to send nonstandard command %d\", request.Command)\n}","typeGuard":"func isStandardCommand(b byte) bool { return b == 0x01 || b == 0x02 || b == 0x03 }","tryCatchPattern":"if err := handle(req); err != nil && strings.Contains(err.Error(), \"Unsupported command\") {\n    log.Warn().Uint8(\"cmd\", req.Command).Msg(\"nonstandard SOCKS5 command\")\n}","preventionTips":["Stick to CONNECT for typical proxying workloads","Review vendor extensions of your client's SOCKS stack","Confirm the request stream is not desynchronized when this appears"],"tags":["network","socks5","unsupported-command"],"backgroundTag":"unsupported-operation","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}