cloudflare/cloudflared · error

wrong protocol signature %v

Error message

wrong protocol signature %v

What it means

ReadConnectResponseData first sniffs the stream's 6-byte protocol signature via determineProtocol, then requires it to be the data-stream signature. If the stream turns out to be an RPC stream (or anything else), this error is returned: the caller expected a data stream but got a different stream type.

Source

Thrown at tunnelrpc/quic/request_client_stream.go:43

	msg, err := connectRequest.ToPogs()
	if err != nil {
		return err
	}

	if err := writeDataStreamPreamble(rcs); err != nil {
		return err
	}
	return capnp.NewEncoder(rcs).Encode(msg)
}

// ReadConnectResponseData reads the response from the rpc stream to a ConnectResponse.
func (rcs *RequestClientStream) ReadConnectResponseData() (*pogs.ConnectResponse, error) {
	signature, err := determineProtocol(rcs)
	if err != nil {
		return nil, err
	}
	if signature != dataStreamProtocolSignature {
		return nil, fmt.Errorf("wrong protocol signature %v", signature)
	}

	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
	if _, err := readVersion(rcs); err != nil {
		return nil, err
	}

	msg, err := capnp.NewDecoder(rcs).Decode()
	if err != nil {
		return nil, err
	}

	r := &pogs.ConnectResponse{}
	if err := r.FromPogs(msg); err != nil {
		return nil, err
	}
	return r, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Make the client write the data-stream signature (writeDataStreamPreamble) before sending connect data
2. Verify the stream is being opened as a data/connect stream, not an RPC stream
3. Align client and server cloudflared versions so both agree on stream typing
4. Log/compare the %v signature value to confirm which stream type the peer sent

Example fix

// before: client opens stream with RPC preamble
NewSessionClient(ctx, stream, timeout)
// after: open as data stream
if err := writeDataStreamPreamble(stream); err != nil {
    return err
}
// then server-side ReadConnectResponseData succeeds

resp, err := rcs.ReadConnectResponseData()
if err != nil {
    if strings.Contains(err.Error(), "wrong protocol signature") {
        // the stream is not a data stream; route to RPC handling or reject
        return errWrongStreamType
    }
    return err
}

When it happens

Trigger: Calling ReadConnectResponseData on a stream whose peer wrote rpcStreamProtocolSignature (0x52BB825CDB65) as its preamble instead of dataStreamProtocolSignature (0x0A36CD12A13E) — e.g. the client opened an RPC-style stream but the server expected a connect/data stream.

Common situations: Client and server disagree on stream type for the same QUIC stream; mixing session_client (RPC) and request_client_stream (data) semantics across cloudflared versions; wiring a stream to the wrong reader.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• unknown signature %v
• failed to open a registration control stream: %w
• failed to accept QUIC stream: %w
• unknown protocol %v
• invalid datagram type expected

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c5703e5b7e883cb0. Report an issue: GitHub.