cloudflare/cloudflared · warning

Failed to get command version: %v

Error message

Failed to get command version: %v

What it means

NewRequest reads the 3-byte SOCKS request header (version, cmd, rsv) with io.ReadAtLeast; if the read fails, the error is wrapped as 'Failed to get command version'. It precedes the version compatibility check, so it specifically means the header bytes could not be read at all, not that the version was wrong.

Source

Thrown at socks/request.go:79

// Request is a SOCKS5 command with supporting field of the connection
type Request struct {
	// Protocol version
	Version uint8
	// Requested command
	Command uint8
	// AddrSpec of the destination
	DestAddr *AddrSpec
	// reading from the connection
	bufConn io.Reader
}

// NewRequest creates a new request from the connection data stream
func NewRequest(bufConn io.Reader) (*Request, error) {
	// Read the version byte
	header := []byte{0, 0, 0}
	if _, err := io.ReadAtLeast(bufConn, header, 3); err != nil {
		return nil, fmt.Errorf("Failed to get command version: %v", err)
	}

	// ensure compatibility
	if header[0] != socks5Version {
		return nil, fmt.Errorf("Unsupported command version: %v", header[0])
	}

	// Read in the destination address
	dest, err := readAddrSpec(bufConn)
	if err != nil {
		return nil, err
	}

	return &Request{
		Version:  socks5Version,
		Command:  header[1],
		DestAddr: dest,
		bufConn:  bufConn,

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Retry the client request; the failure is usually a transient connection drop.
2. Check client-side timeout settings so the client sends the request promptly after auth.
3. Verify the client fully implements the SOCKS5 request phase after successful auth.
4. Treat as a normal disconnect in server logs rather than a protocol bug.

Example fix

// before
req, err := socks.NewRequest(bufConn)
if err != nil { return err }
// after
req, err := socks.NewRequest(bufConn)
if err != nil {
    if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
        return nil // client went away; not a server error
    }
    return err
}

req, err := socks.NewRequest(bufConn)
if err != nil {
    if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
        return nil // client disconnected mid-request
    }
    return err
}

When it happens

Trigger: Client disconnects after auth but before sending the request header, or sends fewer than 3 bytes, while Serve/createRequest call NewRequest.

Common situations: Client crashes or times out mid-session; flaky network closing the stream; aggressive idle timeouts on either side; port scanners that complete auth probes then drop.

Related errors

• Failed to read auth methods: %v
• Unsupported command version: %v
• Failed to format address: %v
• Unrecognized address type
• Failed to send reply: %v

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/e0c9fba24b3ec0e5. Report an issue: GitHub.