{"record":{"id":"d9c6425a7e4cf8c9","repo":"ginuerzh/gost","slug":"bad-type","errorCode":null,"errorMessage":"bad type","messagePattern":"bad type","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"obfs.go","lineNumber":320,"sourceCode":"var (\n\tcipherSuites = []uint16{\n\t\t0xc02c, 0xc030, 0x009f, 0xcca9, 0xcca8, 0xccaa, 0xc02b, 0xc02f,\n\t\t0x009e, 0xc024, 0xc028, 0x006b, 0xc023, 0xc027, 0x0067, 0xc00a,\n\t\t0xc014, 0x0039, 0xc009, 0xc013, 0x0033, 0x009d, 0x009c, 0x003d,\n\t\t0x003c, 0x0035, 0x002f, 0x00ff,\n\t}\n\n\tcompressionMethods = []uint8{0x00}\n\n\talgorithms = []uint16{\n\t\t0x0601, 0x0602, 0x0603, 0x0501, 0x0502, 0x0503, 0x0401, 0x0402,\n\t\t0x0403, 0x0301, 0x0302, 0x0303, 0x0201, 0x0202, 0x0203,\n\t}\n\n\ttlsRecordTypes   = []uint8{0x16, 0x14, 0x16, 0x17}\n\ttlsVersionMinors = []uint8{0x01, 0x03, 0x03, 0x03}\n\n\tErrBadType         = errors.New(\"bad type\")\n\tErrBadMajorVersion = errors.New(\"bad major version\")\n\tErrBadMinorVersion = errors.New(\"bad minor version\")\n\tErrMaxDataLen      = errors.New(\"bad tls data len\")\n)\n\nconst (\n\ttlsRecordStateType = iota\n\ttlsRecordStateVersion0\n\ttlsRecordStateVersion1\n\ttlsRecordStateLength0\n\ttlsRecordStateLength1\n\ttlsRecordStateData\n)\n\ntype obfsTLSParser struct {\n\tstep   uint8\n\tstate  uint8\n\tlength uint16","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/ginuerzh/gost/blob/a33fdbf4c98034f4bfeeaea9868909822b9c526d/obfs.go#L302-L338","documentation":"ErrBadType is a sentinel from the TLS obfs (otls) dissector, returned during Parse when a byte does not match the expected TLS record type for the current state, and during serverHandshake when the parsed TLS record's Type is not Handshake. It means the data stream does not look like valid TLS traffic.","triggerScenarios":"Parse (obfs.go:362): a record's first byte differs from the expected tlsRecordTypes entry for the current step (0x16, 0x14, 0x16, 0x17). serverHandshake (obfs.go:533): record.Type != dissector.Handshake — the client sent a non-handshake TLS record first.","commonSituations":"Non-TLS clients connecting to an otls-obfuscated server (scanners, wrong transport); client/server obfs mismatch (ohttp server vs otls client); truncated or corrupted streams desynchronizing the record parser; TLS library version differences sending unexpected initial records.","solutions":["Ensure both endpoints use the same obfs method (otls) and parameters.","Check the very first bytes the client sends are a TLS ClientHello (record type 0x16).","If you see this during legit traffic, verify no intermediary proxy is mangling/padding the stream.","Match library versions on client and server; record-state expectations differ across versions."],"exampleFix":"// server config before (expects TLS-looking traffic)\ndialer: {type: \"obfs\", obfs: \"ohttp\"}\n// after (client sends TLS records)\ndialer: {type: \"obfs\", obfs: \"otls\"}","handlingStrategy":"validation","validationCode":"// preflight: ensure first byte of a client-side stream is a TLS record type\nif len(buf) > 0 {\n\tswitch buf[0] {\n\tcase 0x16, 0x14, 0x17:\n\t\t// plausible TLS record\n\tdefault:\n\t\treturn errors.New(\"stream does not start with a TLS record; check obfs=otls on both ends\")\n\t}\n}","typeGuard":"func isTLSRecordType(b byte) bool {\n\tfor _, t := range []byte{0x16, 0x14, 0x17} {\n\t\tif b == t { return true }\n\t}\n\treturn false\n}","tryCatchPattern":"n, err := dissector.Parse(conn, buf)\nif errors.Is(err, dissector.ErrBadType) {\n\tlog.Printf(\"non-TLS traffic on otls port from %s; closing\", conn.RemoteAddr())\n\tconn.Close()\n}","preventionTips":["Match obfs method (otls) on client and server.","Close connections immediately on ErrBadType — the parser cannot resync.","Alert on spikes of ErrBadType (scanner activity or config drift)."],"tags":["obfs","tls","dissector","protocol-mismatch"],"backgroundTag":"obfs-tls-bad-record-type","analyzedSha":"a33fdbf4c98034f4bfeeaea9868909822b9c526d","analyzedAt":"2026-09-02T22:15:54.506Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}