Invalid packet, only rand/str/hex/base64 are supported

Error message

Invalid packet, only rand/str/hex/base64 are supported

What it means

Thrown by FreedomClientConfig's noise packet builder when the noise.packet field's type prefix is not one of rand, str, hex, or base64. The noise feature prefixes user input with a type keyword (e.g. "str:...", "hex:...", "rand:") to decide how to decode the packet payload into raw bytes. Any unrecognized prefix falls into the default branch of the switch and fails immediately.

Source

Thrown at infra/conf/freedom.go:232

		// user input string
		NConfig.Packet = []byte(noise.Packet)

	case "hex":
		// user input hex
		NConfig.Packet, err = hex.DecodeString(noise.Packet)
		if err != nil {
			return nil, errors.New("Invalid hex string").Base(err)
		}

	case "base64":
		// user input base64
		NConfig.Packet, err = base64.RawURLEncoding.DecodeString(strings.NewReplacer("+", "-", "/", "_", "=", "").Replace(noise.Packet))
		if err != nil {
			return nil, errors.New("Invalid base64 string").Base(err)
		}

	default:
		return nil, errors.New("Invalid packet, only rand/str/hex/base64 are supported")
	}

	if noise.Delay != nil {
		NConfig.DelayMin = uint64(noise.Delay.From)
		NConfig.DelayMax = uint64(noise.Delay.To)
	}
	switch strings.ToLower(noise.ApplyTo) {
	case "", "ip", "all":
		NConfig.ApplyTo = "ip"
	case "ipv4":
		NConfig.ApplyTo = "ipv4"
	case "ipv6":
		NConfig.ApplyTo = "ipv6"
	default:
		return nil, errors.New("Invalid applyTo, only ip/ipv4/ipv6 are supported")
	}
	return NConfig, nil
}

View on GitHub (pinned to 7d214f8b09)

Solutions

Prefix the packet value with a supported type: use 'rand:' followed by a decimal length, 'str:' followed by plain text, 'hex:' followed by hex digits, or 'base64:' followed by base64 data
Check for typos in the prefix keyword and its trailing colon
Verify against the current Xray-core freedom noise documentation, since supported formats are fixed to rand/str/hex/base64

Example fix

// before
"noise": { "packet": "binary:01010101" }
// after
"noise": { "packet": "str:01010101" }

Defensive patterns

Strategy: validation

Validate before calling

// Go: validate noise packet before building config
import (
	"fmt"
	"strings"
)
func validNoisePacket(p string) error {
	for _, prefix := range []string{"rand:", "str:", "hex:", "base64:"} {
		if strings.HasPrefix(strings.ToLower(p), prefix) {
			return nil
		}
	}
	return fmt.Errorf("noise.packet must start with rand:/str:/hex:/base64:, got %q", p)
}

Prevention

Validate noise.packet prefix against rand/str/hex/base64 before emitting config
Add a JSON schema check for the noise object in CI config linting

When it happens

Trigger: Setting freedom.outboundSettings.noise.packet to a value whose prefix is anything except 'rand', 'str', 'hex', or 'base64' (case handling per switch), e.g. "binary:0101", "bytes:AABB", or a bare string with no recognized prefix keyword.

Common situations: Copying noise config examples from other projects (e.g. other proxy cores) that support different packet formats; typos like 'base63' or 'hexa'; upgrading configs where the noise feature changed accepted prefixes.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/69371a67f3d3dbde. Report an issue: GitHub.