XTLS/Xray-core · error

failed to create client

Error message

failed to create client

What it means

When a turn has no explicit variants, writePaddingTurnWithBuffer randomizes the write chunk size between turn.writeChunkMinLength and turn.writeChunkLength via randomPaddingTarget; this error wraps that call. randomPaddingTarget only fails if crypto/rand.Int fails (min == max short-circuits), so this is an OS entropy failure, since the range itself was already validated (writeChunkMinLength >= 0, writeChunkLength >= writeChunkMinLength).

Source

Thrown at app/dns/dns.go:154

		serveExpiredTTL := config.ServeExpiredTTL
		if ns.ServeExpiredTTL != nil {
			serveExpiredTTL = *ns.ServeExpiredTTL
		}

		tag := defaultTag
		if len(ns.Tag) > 0 {
			tag = ns.Tag
		}

		clientIPOption := ResolveIpOptionOverride(ns.QueryStrategy, ipOption)
		if !clientIPOption.IPv4Enable && !clientIPOption.IPv6Enable {
			return nil, errors.New("no QueryStrategy available for ", ns.Address)
		}

		client, err := NewClient(ctx, ns, myClientIP, disableCache, serveStale, serveExpiredTTL, tag, clientIPOption, updateRules)
		if err != nil {
			return nil, errors.New("failed to create client").Base(err)
		}
		clients = append(clients, client)
	}

	var domainMatcher geodata.DomainMatcher
	if len(effectiveRules) > 0 {
		domainMatcher, err = geodata.DomainReg.BuildDomainMatcher(effectiveRules)
		if err != nil {
			return nil, err
		}
	}

	// If there is no DNS client in config, add a `localhost` DNS client
	if len(clients) == 0 {
		clients = append(clients, NewLocalDNSClient(ipOption))
	}

	return &DNS{

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Check host entropy health and kernel RNG availability (getrandom syscall permitted)
2. Warm up the entropy source or delay the connection start until the pool is initialized
3. As a config-side workaround, set writeChunkMinLength = 0 (equal min/max path skips the rand draw)

if turn.writeChunkMinLength < 0 || turn.writeChunkLength < turn.writeChunkMinLength || turn.writeChunkLength > 48*1024 {
    return errors.New("bad write chunk range")
}

if err := run(...); err != nil && errors.Is(err, cryptoRandFailureMarker) {
    // entropy transient: reconnect after entropy is seeded rather than tight-looping
}

When it happens

Trigger: rand.Reader returning an error while drawing the chunk length; occurs during writePaddingTurnWithBuffer on turns using generated write chunks with a non-zero writeChunkMinLength.

Common situations: Fresh containers/VMs before the CRNG is seeded; seccomp/sandbox profiles blocking getrandom(2); entropy-starved embedded hosts.

Related errors

• unexpected query strategy
• Unable to parse CIDR for Fake DNS IP assignment
• not a Service.
• Dispatcher: Invalid destination.
• FakeDNSEngine is not initialized, but such a sniffer is used

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/93b6dac1fc846803. Report an issue: GitHub.