shadow1ng/fscan · warning

socks5_invalid_request

Error message

socks5_invalid_request

What it means

SOCKS5 request handler rejects a client request whose parsed request is invalid: specifically the client requested a connection to target port 0, which is not a valid destination port. The handler responds with SOCKS5 reply code 0x08 (address type not supported / invalid request context) and returns a localized error string.

Source

Thrown at plugins/local/socks5proxy.go:251

		}
		targetHost = string(addr[:domainLen])
		targetPort = int(addr[domainLen])<<8 + int(addr[domainLen+1])
	case 0x04: // IPv6
		addr := make([]byte, 18)
		if _, err := io.ReadFull(clientConn, addr); err != nil {
			return nil, 0, fmt.Errorf("%s", i18n.GetText("ipv6_address_invalid"))
		}
		// IPv6地址解析（简化实现）
		targetHost = net.IP(addr[:16]).String()
		targetPort = int(addr[16])<<8 + int(addr[17])
	default:
		// 发送不支持的地址类型响应
		response := []byte{0x05, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
		_, _ = clientConn.Write(response)
		return nil, 0, fmt.Errorf(i18n.GetText("socks5_unsupported_address_type")+": %d", addrType)
	}
	if targetPort == 0 {
		return nil, 0, fmt.Errorf("%s", i18n.GetText("socks5_invalid_request"))
	}

	// 连接目标服务器
	targetAddr := net.JoinHostPort(targetHost, strconv.Itoa(int(targetPort)))
	targetConn, err := net.DialTimeout("tcp", targetAddr, 10*time.Second)
	if err != nil {
		// 发送连接失败响应
		response := []byte{0x05, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
		_, _ = clientConn.Write(response)
		return nil, 0, fmt.Errorf("%s: %w", i18n.GetText("socks5_target_connect_failed"), err)
	}

	// 获取本地监听端口（从targetConn获取）
	localAddr, ok := targetConn.LocalAddr().(*net.TCPAddr)
	if !ok {
		return nil, 0, fmt.Errorf("%s", i18n.GetText("local_address_unavailable"))
	}
	localPort := localAddr.Port

View on GitHub (pinned to 95cc12e753)

Solutions

1. Fix or reconfigure the SOCKS5 client so the destination port is correctly encoded (big-endian) and non-zero
2. Check the port bytes in the client's request packet; bytes 8-9 of the request are the port and must not both be 0x00
3. Log the client address and reject the connection; port 0 is never a valid target

Example fix

// before (client side, little-endian port)
req := []byte{0x05, 0x01, 0x00, 0x01, 127, 0, 0, 1, 0x50, 0x00}
// after (big-endian port 8080)
req := []byte{0x05, 0x01, 0x00, 0x01, 127, 0, 0, 1, 0x1F, 0x90}

// client side, before sending the request
if dstPort <= 0 || dstPort > 65535 {
    return fmt.Errorf("invalid destination port %d", dstPort)
}

When it happens

Trigger: A SOCKS5 client sends a CONNECT/BIND request after address parsing succeeds but with targetPort == 0 (e.g. malformed or malicious client, a client bug encoding port bytes as zero).

Common situations: Port-scanning or fuzzing tools against the proxy; clients with byte-order bugs in constructing the SOCKS5 request (port sent in wrong endianness yielding 0); handcrafted SOCKS5 requests.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• %s [socks5_unsupported_version]
• %s: %w [socks5_handshake_read_failed]
• invalid kafka response length: %d
• kafka response too large: %d
• invalid SCRAM server-first payload

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/26d7b7c7e994286f. Report an issue: GitHub.