What causes "proto: wrong wireType = %d for field ChallengeExtensions" in gravitational/teleport?

Ensure both peers use identical proto definitions for field 6 and regenerate code

proto: wrong wireType = %d for field ChallengeExtensions

Error message

proto: wrong wireType = %d for field ChallengeExtensions

What it means

Protobuf unmarshal guard in generated code: while decoding CreateAuthenticateChallengeRequest, the ChallengeExtensions field arrived with an unexpected wire type instead of the length-delimited type expected for a message.

Source

Thrown at api/client/proto/authservice.pb.go:60211

				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + msglen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			if m.MFARequiredCheck == nil {
				m.MFARequiredCheck = &IsMFARequiredRequest{}
			}
			if err := m.MFARequiredCheck.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
				return err
			}
			iNdEx = postIndex
		case 6:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ChallengeExtensions", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			if msglen < 0 {
				return ErrInvalidLengthAuthservice

View on GitHub (pinned to 1283425b60)

Solutions

Ensure both peers use identical proto definitions for field 6 and regenerate code
Populate ChallengeExtensions via the generated struct and Marshal
Verify stream alignment: no off-by-one slicing before Unmarshal
Debug the raw payload with protoc --decode_raw

Example fix

// before
// ChallengeExtensions encoded as varint
// after
m.ChallengeExtensions = &proto.ChallengeExtensions{Required: true}
b, _ := m.Marshal()

Defensive patterns

Strategy: validation

Validate before calling

// ensure ChallengeExtensions is present and marshaled as a message
if req.ChallengeExtensions == nil { req.ChallengeExtensions = &proto.ChallengeExtensions{} }

Type guard

func hasChallengeExtensions(r *proto.CreateAuthenticateChallengeRequest) bool {
  return r.GetChallengeExtensions() != nil
}

Prevention

Only assign message structs to ChallengeExtensions
Avoid renumbering/retyping existing proto fields
Keep transport framing intact; no manual byte slicing before Unmarshal
Use protoc --decode_raw on failing payloads to confirm field encodings

When it happens

Trigger: Bytes where tag 6 is not length-delimited — produced by mismatched proto definitions, manual byte assembly, or stream corruption/misalignment.

Common situations: Version skew after ChallengeExtensions was added or retyped; test fixtures encoding it as a scalar; corrupted payload in transit.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/a66dd4fa17ee027b. Report an issue: GitHub.