proto: CreatePrivilegeTokenRequest: illegal tag %d (wire typ

Q: What causes "proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)" in gravitational/teleport?

Verify the buffer starts at a real message boundary and is non-empty/non-zero-padded

Error message

proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)

What it means

After reading a tag, the generated Unmarshal for CreatePrivilegeTokenRequest validates the field number (tag >> 3). A field number <= 0 is impossible in valid protobuf, so the decoder returns this formatted error including the raw tag and wire type. It means the bytes are not a valid CreatePrivilegeTokenRequest encoding.

Source

Thrown at api/client/proto/authservice.pb.go:60421

				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: CreatePrivilegeTokenRequest: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: CreatePrivilegeTokenRequest: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ExistingMFAResponse", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {

View on GitHub (pinned to 1283425b60)

Solutions

Verify the buffer starts at a real message boundary and is non-empty/non-zero-padded
Confirm the sender marshals CreatePrivilegeTokenRequest (same type and schema version)
protoc --decode_raw the payload to see where the structure diverges
Add integrity checks (length prefixes, checksums) around framed payloads

Example fix

// before
err := proto.Unmarshal(zeroPaddedBuf, req)
// after
if len(buf) == 0 { return trace.BadParameter("empty payload") }
err := proto.Unmarshal(buf, req)

Defensive patterns

Strategy: validation

Validate before calling

func validLeadingTag(b []byte) error {
    if len(b) == 0 { return errors.New("empty payload") }
    tag, n := binary.Uvarint(b)
    if n <= 0 { return errors.New("undecodable leading tag") }
    if tag>>3 <= 0 { return fmt.Errorf("illegal field number %d in leading tag 0x%x", tag>>3, tag) }
    return nil
}

Type guard

func isIllegalTagError(err error) bool {
    return err != nil && strings.Contains(err.Error(), "illegal tag")
}

Try / catch

if err := proto.Unmarshal(blob, req); err != nil {
    if isIllegalTagError(err) {
        return trace.BadParameter("corrupt or misaligned payload")
    }
    return trace.Wrap(err)
}

Prevention

Trim buffers to actual written length before unmarshal
Use framed, length-prefixed transports instead of raw slicing
Confirm producer and consumer decode the same message type
Add corruption checks (checksums) around persisted or relayed payloads

When it happens

Trigger: Unmarshaling bytes whose next tag has field number 0 (tag byte 0x00) or otherwise decodes to a non-positive field number — typical of zero-filled/corrupted buffers or wrong-offset parsing.

Common situations: Decoding zeroed memory or an empty-padded buffer; parsing from the wrong offset inside a stream; fuzz inputs; a producer marshaling a different message type whose bytes misalign here.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/23cbe9ecf0b34230. Report an issue: GitHub.