txthinking/brook · error

Password is wrong

Error message

Password is wrong

What it means

NewSimpleStreamServer compares the first 32 bytes of the client's handshake against the configured password digest; on mismatch it drains the connection and returns 'Password is wrong'. This is the server-side authentication check for the simple stream protocol.

Source

Thrown at simplestreamserver.go:54

	dst     string
}

func NewSimpleStreamServer(password []byte, src string, client net.Conn, timeout, udptimeout int) (Exchanger, error) {
	if timeout != 0 {
		if err := client.SetDeadline(time.Now().Add(time.Duration(timeout) * time.Second)); err != nil {
			return nil, err
		}
	}
	s := &SimpleStreamServer{Client: client, Timeout: timeout, src: src}
	b := x.BP2048.Get().([]byte)
	if _, err := io.ReadFull(s.Client, b[:32+2]); err != nil {
		x.BP2048.Put(b)
		return nil, err
	}
	if bytes.Compare(password, b[:32]) != 0 {
		x.BP2048.Put(b)
		WaitReadErr(s.Client)
		return nil, errors.New("Password is wrong")
	}
	l := int(binary.BigEndian.Uint16(b[32:34]))
	if l > 2048 {
		x.BP2048.Put(b)
		return nil, errors.New("data too long")
	}
	if _, err := io.ReadFull(s.Client, b[:l]); err != nil {
		x.BP2048.Put(b)
		return nil, err
	}
	i := int64(binary.BigEndian.Uint32(b[:4]))
	if time.Now().Unix()-i > 60 {
		x.BP2048.Put(b)
		WaitReadErr(s.Client)
		return nil, errors.New("Expired request")
	}
	if i%2 == 0 {
		s.network = "tcp"

View on GitHub (pinned to 5cd13ef3b1)

Solutions

1. Verify the client's password exactly matches the server's configured password (no trailing whitespace/newline, same encoding)
2. Re-sync credentials on both ends after any password rotation and restart both sides
3. Confirm the client hashes the password the same way (SHA-256 of the raw password bytes) before sending
4. If receiving random probes, ignore the error or firewall the offending source

Example fix

// before (client)
conn.Write([]byte(myPassword))
// after
sum := sha256.Sum256(password)
conn.Write(sum[:])

if string(sentHash) != string(sha256.Sum256([]byte(configuredPassword))[0:32]) {
    return errors.New("client password does not match server configuration")
}

_, err := NewSimpleStreamServer(password, s.Client, ...)
if err != nil && err.Error() == "Password is wrong" {
    log.Printf("auth failure from %s", s.Client.RemoteAddr())
    s.Client.Close()
}

When it happens

Trigger: A client connects (via TCPHandle or HTTP ServeHTTP path) and the first 32 bytes of its handshake payload do not equal the SHA-256 digest of the server's configured password — wrong password, different key material, or garbage/noise bytes from a non-protocol client (port scanner, wrong protocol).

Common situations: Client and server configured with different passwords; config deployed out of sync after a password rotation; a scanner or health-checker hits the port sending non-protocol bytes; client hashing the password with a different algorithm/encoding.

Related errors

• socks5 server requires a clear IP for UDP, only port is not
• Invalid dial with IP
• no ipv6 from nic
• no ipv4 from nic
• black hole

AI-assisted analysis of txthinking/brook@5cd13ef3b1 (2026-09-06). Data as JSON: /api/errors/893790f0fedc6d45. Report an issue: GitHub.