ginuerzh/gost · error

[socks4a] %d

Error message

[socks4a] %d

What it means

The SOCKS4a CONNECT reply was not Granted (0x5A): the proxy refused the request. Like the SOCKS4 case, the numeric reply code is embedded in the error so callers can tell rejection, ident failure, or mismatch apart.

Source

Thrown at socks.go:803

	if err := req.Write(conn); err != nil {
		return nil, err
	}

	if Debug {
		log.Logf("[socks4a] %s", req)
	}

	reply, err := gosocks4.ReadReply(conn)
	if err != nil {
		return nil, err
	}

	if Debug {
		log.Logf("[socks4a] %s", reply)
	}

	if reply.Code != gosocks4.Granted {
		return nil, fmt.Errorf("[socks4a] %d", reply.Code)
	}

	return conn, nil
}

type socks5Handler struct {
	selector *serverSelector
	options  *HandlerOptions
}

// SOCKS5Handler creates a server Handler for SOCKS5 proxy server.
func SOCKS5Handler(opts ...HandlerOption) Handler {
	h := &socks5Handler{}
	h.Init(opts...)

	return h
}

View on GitHub (pinned to a33fdbf4c9)

Solutions

  1. Read the reply code: 91 request rejected/failed (check target reachability & proxy ACL), 92/93 ident problems (fix or disable ident).
  2. Test the hostname resolution from the proxy host; fix the proxy's DNS.
  3. Prefer SOCKS5 (gosocks5) connector for modern proxies with richer error reporting.
  4. Add the target to the proxy allow list.

Example fix

// before
conn, err := socks4aConnector.Connect(ctx, proxyConn, "legacy.internal:80") // code 91
// after
conn, err := socks5Connector.Connect(ctx, proxyConn, "legacy.internal:80") // SOCKS5, richer support/replies
Defensive patterns

Strategy: try-catch

Validate before calling

if _, _, err := net.SplitHostPort(address); err != nil {
	return fmt.Errorf("invalid socks4a target %q", address)
}

Try / catch

conn, err := socks4aConnector.ConnectContext(ctx, conn, "tcp", addr)
if err != nil {
	var code int
	if n, _ := fmt.Sscanf(err.Error(), "[socks4a] %d", &code); n == 1 {
		if code == 91 {
			// refused/failed: check proxy ACL & proxy-side DNS
		}
		return fmt.Errorf("socks4a refused (code %d)", code)
	}
	return err
}

Prevention

When it happens

Trigger: socks4aConnector.ConnectContext (tcp-family) writes the SOCKS4a request with the hostname in the userid field; server replies with a non-granted code: destination denied, ident check failed, or the proxy could not reach/resolve the host.

Common situations: Proxy ACL blocking the hostname; proxy without DNS access failing remote resolution; identd-based SOCKS4a servers rejecting clients; expired/blacklisted target hosts.

Related errors

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/16c351095baa21e6. Report an issue: GitHub.