What causes "missing remote address" in larksuite/cli?

Use the standard net.Dialer-produced connection whose RemoteAddr is always populated

missing remote address

Error message

missing remote address

What it means

After confirming the connection is non-nil, validateConnRemoteIP reads RemoteAddr() to learn the actual peer IP the OS connected to. This error means RemoteAddr() returned nil, which can happen for exotic or half-built connections where the address was never populated. The validator refuses to approve a connection whose peer is unknown.

Source

Thrown at internal/validate/url.go:553

	var d net.Dialer
	return d.DialContext(ctx, network, addr)
}

func downloadTargetPolicyError(err error) error {
	return errs.NewSecurityPolicyError(
		errs.SubtypeAccessDenied,
		"blocked download target: %v",
		err,
	).WithCause(err)
}

func validateConnRemoteIP(conn net.Conn) error {
	if conn == nil {
		return fmt.Errorf("nil connection")
	}
	raddr := conn.RemoteAddr()
	if raddr == nil {
		return fmt.Errorf("missing remote address")
	}
	host, _, err := net.SplitHostPort(raddr.String())
	if err != nil {
		host = raddr.String()
	}
	ip := net.ParseIP(strings.Trim(host, "[]"))
	if ip == nil {
		return fmt.Errorf("invalid remote IP")
	}
	if isRestrictedDownloadIP(ip) {
		return fmt.Errorf("local/internal host is not allowed")
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Use the standard net.Dialer-produced connection whose RemoteAddr is always populated
Fix any custom net.Conn wrapper to forward RemoteAddr() to the underlying connection
Update test mocks to return a realistic *net.TCPAddr from RemoteAddr

Example fix

// before
func (c *loggingConn) RemoteAddr() net.Addr { return nil }
// after
func (c *loggingConn) RemoteAddr() net.Addr { return c.Conn.RemoteAddr() }

Defensive patterns

Strategy: type-guard

Validate before calling

if conn == nil { return errors.New("nil connection") }
if conn.RemoteAddr() == nil { return errors.New("conn wrapper does not forward RemoteAddr") }

Type guard

func hasRemoteAddr(conn net.Conn) bool {
    return conn != nil && conn.RemoteAddr() != nil
}

Try / catch

if err != nil && strings.Contains(err.Error(), "missing remote address") {
    return fmt.Errorf("connection wrapper hides RemoteAddr; unwrap or fix the conn decorator: %w", err)
}

Prevention

When decorating net.Conn, forward all methods including RemoteAddr/LocalAddr
Avoid exotic conn types in the download client; use standard net.Dialer output
Add a smoke test that RoundTrip works through any conn wrapper you introduce

When it happens

Trigger: The established net.Conn reports a nil RemoteAddr — e.g. a custom/wrapped conn implementation that does not implement RemoteAddr properly, or a connection created outside the normal net.Dialer path.

Common situations: Custom net.Conn wrappers (logging/tracing decorators) that forget to forward RemoteAddr; mocks in tests; unusual transport customizations on the download client.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/39cddeca3c3c442d. Report an issue: GitHub.