What causes "proto: wrong wireType = %d for field DeviceUsage" in gravitational/teleport?

Use matching Teleport versions on both ends of the RPC (upgrade the older side).

proto: wrong wireType = %d for field DeviceUsage

Error message

proto: wrong wireType = %d for field DeviceUsage

What it means

Thrown by the gogoproto-generated Unmarshal for a message with a DeviceUsage field (field number 3), declared as a varint enum. The decoder expects wire type 0 for this field; any other wire type on the wire is rejected with this error. It indicates the serialized bytes do not match the compiled schema.

Source

Thrown at api/client/proto/authservice.pb.go:60564

			}
			m.DeviceType = 0
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				m.DeviceType |= DeviceType(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
		case 3:
			if wireType != 0 {
				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
			}
			m.DeviceUsage = 0
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
		case 4:
			if wireType != 2 {

View on GitHub (pinned to 1283425b60)

Solutions

Use matching Teleport versions on both ends of the RPC (upgrade the older side).
Regenerate api/client/proto bindings from the current .proto.
Discard/re-serialize corrupted data produced under the old schema.
Verify the sender marshals DeviceUsage as an enum varint, not a string.

Example fix

// before: mismatched api module (old plugin)
require github.com/gravitational/teleport/api v0.0.0-old
// after: pin api to the version matching the auth server
require github.com/gravitational/teleport/api vX.Y.Z // same major/minor as server

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify sender/receiver schema agreement before decode:
// marshal an empty message and compare field tags if unsure
probe, _ := proto.Marshal(&proto.DeviceUsageProbe{})
if len(probe) == 0 { /* schema absent in this build */ }

Type guard

func isProtoWireErr(err error) bool {
  var uwn gogoproto.Error // or check message text
  return err != nil && strings.Contains(err.Error(), "wrong wireType")
}

Try / catch

if err := proto.Unmarshal(data, &m); err != nil {
  if strings.Contains(err.Error(), "field DeviceUsage") {
    log.Warn("DeviceUsage wire mismatch; upgrading client recommended")
  }
  return err
}

Prevention

Keep api/client/proto generated in sync with the .proto (CI check on `git diff --exit-code api/client/proto`).
Avoid mixing Teleport versions inside one cluster during upgrades.
Treat cached protobuf blobs as versioned data; store a schema version alongside them.
Never hand-marshal enum fields; use the generated Marshal methods.

When it happens

Trigger: Decoding a device-related Auth Service message whose field 3 was encoded with wire type != 0 — e.g. a peer built from a .proto where DeviceUsage is a string or embedded message.

Common situations: Teleport version skew during rolling upgrades, forgetting to `make proto` after schema changes, plugins/terraform provider pinned to an older api release, or corrupt cached payloads.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/64e8ad2ad271fc18. Report an issue: GitHub.