cloudflare/cloudflared · error

Unrecognized address type

Error message

Unrecognized address type

What it means

readAddrSpec parses the destination address in a SOCKS5 request and supports IPv4, domain name (FQDN), and IPv6 address types. If the ATYP byte is any other value (0x00, 0x04 was IPv6, >0x04, etc.), the parser cannot decode the address and returns this error. It indicates a malformed or non-standard SOCKS5 client packet.

Source

Thrown at socks/request.go:184

		addr := make([]byte, 16)
		if _, err := io.ReadAtLeast(r, addr, len(addr)); err != nil {
			return nil, err
		}
		d.IP = net.IP(addr)

	case fqdnAddress:
		if _, err := r.Read(addrType); err != nil {
			return nil, err
		}
		addrLen := int(addrType[0])
		fqdn := make([]byte, addrLen)
		if _, err := io.ReadAtLeast(r, fqdn, addrLen); err != nil {
			return nil, err
		}
		d.FQDN = string(fqdn)

	default:
		return nil, fmt.Errorf("Unrecognized address type")
	}

	// Read the port
	port := []byte{0, 0}
	if _, err := io.ReadAtLeast(r, port, 2); err != nil {
		return nil, err
	}
	d.Port = (int(port[0]) << 8) | int(port[1])

	return d, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Fix or replace the SOCKS5 client library so it emits standard ATYP values 1, 3, or 4
2. Capture the raw bytes of the failing client to confirm where desynchronization begins
3. If clients are known-good, check for an intermediary (proxy/inspection tool) that corrupts the stream
4. For custom address types, fork readAddrSpec and add support explicitly

Example fix

// client writing nonstandard ATYP=0
buf[3] = 0x00

// after
buf[3] = 0x01 // ATYP IPv4 (or 0x03 FQDN / 0x04 IPv6)

// validate ATYP byte before parsing (client side)
switch atyp {
case 0x01, 0x03, 0x04:
    // ok
default:
    return fmt.Errorf("invalid SOCKS5 ATYP byte: %#x", atyp)
}

func isKnownATYP(b byte) bool { return b == 0x01 || b == 0x03 || b == 0x04 }

if err := serve(conn); err != nil && strings.Contains(err.Error(), "Unrecognized address type") {
    log.Warn().Msg("malformed SOCKS5 client packet; capture raw bytes")
}

When it happens

Trigger: NewRequest receiving a request whose address-type byte (fourth byte) is outside {0x01 IPv4, 0x03 FQDN, 0x04 IPv6} — corrupted stream, wrong offset parsing, or a client speaking a divergent protocol variant.

Common situations: A buggy or hand-rolled SOCKS5 client writing the ATYP byte incorrectly; stream desynchronization after a partial/misread greeting; fuzzing or malicious clients probing the proxy.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Failed to read auth methods: %v
• Failed to get command version: %v
• Unsupported command version: %v
• Failed to format address: %v
• Failed to send reply: %v

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/d00f86ae64dac5f7. Report an issue: GitHub.