gravitational/teleport · error

proto: wrong wireType = %d for field TokenID

Error message

proto: wrong wireType = %d for field TokenID

What it means

Field 1 of CreateRegisterChallengeRequest is TokenID, a string that must be wire type 2 (length-delimited). The incoming bytes carry tag 1 with a different wire type, so the generated Unmarshal returns this error, indicating schema mismatch or malformed input.

Source

Thrown at api/client/proto/authservice.pb.go:60513

			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: CreateRegisterChallengeRequest: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

  1. Align the api/client/proto generated code on both client and server
  2. Construct the request via the typed struct and marshal with proto.Marshal
  3. Confirm tag 1's wire type with protoc --decode_raw when diagnosing
  4. Check for middleboxes or caches that could alter binary payloads in transit

Example fix

// before: manual bytes for the request
raw := []byte{0x08, 0x2A} // TokenID as varint
// after
req := &proto.CreateRegisterChallengeRequest{TokenID: tokID}
raw, err := proto.Marshal(req)
Defensive patterns

Strategy: try-catch

Validate before calling

func tokenIDFieldIsValid(b []byte) bool {
    if len(b) == 0 { return false }
    tag, n := binary.Uvarint(b)
    return n > 0 && tag>>3 == 1 && tag&0x7 == 2
}

Type guard

func isWireTypeMismatch(err error) bool {
    return err != nil && strings.Contains(err.Error(), "wrong wireType = ")
}

Try / catch

req := &proto.CreateRegisterChallengeRequest{}
if err := proto.Unmarshal(blob, req); err != nil {
    if isWireTypeMismatch(err) {
        return trace.BadParameter("register challenge payload from incompatible schema; upgrade peer")
    }
    return trace.Wrap(err)
}

Prevention

When it happens

Trigger: Bytes where field 1 of CreateRegisterChallengeRequest is not length-delimited — e.g. an encoder that emits TokenID as a varint, or an older/newer schema where field 1 held a different scalar — during register-challenge RPCs.

Common situations: Version skew between teleport client and auth service proto definitions; custom integration scripts crafting raw bytes; corrupted gRPC frames; decoding a different request type's bytes as CreateRegisterChallengeRequest.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/16101fdd640adf9b. Report an issue: GitHub.