tailscale/tailscale · error

wrong length %d received for handshake response

Error message

wrong length %d received for handshake response

What it means

Raised by continueClientHandshake when the length field in the server's handshake response does not match the fixed response payload size. The peer sent a malformed response, indicating a protocol mismatch or corruption.

Source

Thrown at control/controlbase/handshake.go:152

	}

	// Read in the payload and look for errors/protocol violations from the server.
	var resp responseMessage
	if _, err := io.ReadFull(conn, resp.Header()); err != nil {
		return nil, fmt.Errorf("reading response header: %w", err)
	}
	if resp.Type() != msgTypeResponse {
		if resp.Type() != msgTypeError {
			return nil, fmt.Errorf("unexpected response message type %d", resp.Type())
		}
		msg := make([]byte, resp.Length())
		if _, err := io.ReadFull(conn, msg); err != nil {
			return nil, err
		}
		return nil, fmt.Errorf("server error: %q", msg)
	}
	if resp.Length() != len(resp.Payload()) {
		return nil, fmt.Errorf("wrong length %d received for handshake response", resp.Length())
	}
	if _, err := io.ReadFull(conn, resp.Payload()); err != nil {
		return nil, err
	}

	// <- e, ee, se
	controlEphemeralPub := key.MachinePublicFromRaw32(mem.B(resp.EphemeralPub()))
	s.MixHash(controlEphemeralPub.UntypedBytes())
	if _, err := s.MixDH(machineEphemeral, controlEphemeralPub); err != nil {
		return nil, fmt.Errorf("computing ee: %w", err)
	}
	cipher, err := s.MixDH(machineKey, controlEphemeralPub)
	if err != nil {
		return nil, fmt.Errorf("computing se: %w", err)
	}
	if err := s.DecryptAndHash(cipher, nil, resp.Tag()); err != nil {
		return nil, fmt.Errorf("decrypting payload: %w", err)
	}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Reconnect and retry
2. Verify client and server protocol versions match

When it happens

Trigger: Thrown at control/controlbase/handshake.go:152 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/395bf27964853bc1. Report an issue: GitHub.