XTLS/Xray-core · error

create service

Error message

create service

What it means

Wrapper when shadowaead_2022.NewMultiService fails while building the multi-user 2022 inbound. Same class of cause as [634] but for the multi-user service constructor with the decoded server PSK: key length incompatible with config.Method, or the method string invalid at the service layer.

Source

Thrown at proxy/shadowsocks_2022/inbound_multi.go:80

			return nil, errors.New("failed to get shadowsocks user").Base(err).AtError()
		}
		memUsers = append(memUsers, u)
	}

	inbound := &MultiUserInbound{
		networks: networks,
		users:    memUsers,
	}
	if config.Key == "" {
		return nil, errors.New("missing key")
	}
	psk, err := base64.StdEncoding.DecodeString(config.Key)
	if err != nil {
		return nil, errors.New("parse config").Base(err)
	}
	service, err := shadowaead_2022.NewMultiService[int](config.Method, psk, 500, inbound, nil)
	if err != nil {
		return nil, errors.New("create service").Base(err)
	}
	err = service.UpdateUsersWithPasswords(
		C.MapIndexed(memUsers, func(index int, it *protocol.MemoryUser) int { return index }),
		C.Map(memUsers, func(it *protocol.MemoryUser) string { return it.Account.(*MemoryAccount).Key }),
	)
	if err != nil {
		return nil, errors.New("create service").Base(err)
	}

	inbound.service = service
	return inbound, nil
}

// AddUser implements proxy.UserManager.AddUser().
func (i *MultiUserInbound) AddUser(ctx context.Context, u *protocol.MemoryUser) error {
	i.Lock()
	defer i.Unlock()

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Match PSK byte length to method: 16 bytes for *-aes-128-*, 32 bytes for *-aes-256-* and *chacha20*.
2. Regenerate keys for both server PSK and per-user keys after any method change.
3. Read the base error — it names the length/method constraint that failed.

Example fix

// before: 32-byte PSK with a 128-bit method
"method": "2022-blake3-aes-128-gcm", "key": "<base64-of-32-bytes>"
// after
"method": "2022-blake3-aes-128-gcm", "key": "<base64-of-16-bytes>"

raw, _ := base64.StdEncoding.DecodeString(config.Key)
want := 32
if strings.Contains(config.Method, "128") { want = 16 }
if len(raw) != want {
  return fmt.Errorf("server PSK must be %d bytes for %s", want, config.Method)
}

func keyMatchesMethod(method string, n int) bool {
  if strings.Contains(method, "128") { return n == 16 }
  return n == 32
}

service, err := shadowaead_2022.NewMultiService[int](config.Method, psk, 500, inbound, nil)
if err != nil {
  return fmt.Errorf("multi service init failed (method/PSK size mismatch?): %w", err)
}

When it happens

Trigger: NewMultiService[method, psk, ...] rejecting the method/psk pair — e.g. 2022-blake3-aes-128-gcm paired with a 32-byte PSK, or a method name that passed the earlier list check but is rejected by the library's own switch.

Common situations: Changing the method after generating the key without resizing it; keys shared from a different-method server; copy-paste between 128-bit and 256-bit deployments.

Related errors

• create service
• failed to get shadowsocks user
• shadowsocks 2022 (multi-user): missing server method
• shadowsocks 2022 (multi-user): users must have empty method
• missing key

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/745fdaf63feb6474. Report an issue: GitHub.