XTLS/Xray-core · error

select profile: %w

Error message

select profile: %w

What it means

Wraps an error from crypto/rand's rand.Int when the client randomly selects a login profile. rand.Int reads from the system CSPRNG, so failure means the OS entropy source is unavailable (getrandom(2) error), not a problem with the profiles themselves.

Source

Thrown at transport/internet/finalmask/xmc/client.go:110

		port, err := strconv.Atoi(portString)
		if err == nil {
			serverPort = UnsignedShort(port)
		}

		if serverAddress == "" {
			serverAddress = String(host)
		}
	}

	err = writePacket(c.writer, 0x00, &protocolVersion, &serverAddress, &serverPort, &nextState)
	if err != nil {
		return fmt.Errorf("write handshake packet: %w", err)
	}

	// Login Start
	randomProfile, err := rand.Int(rand.Reader, big.NewInt(int64(len(c.profiles))))
	if err != nil {
		return fmt.Errorf("select profile: %w", err)
	}
	selectedProfile := c.profiles[randomProfile.Int64()]
	username := String(selectedProfile.Username)

	err = writePacket(c.writer, 0x00, &username, &selectedProfile.UUID)
	if err != nil {
		return fmt.Errorf("write login start: %w", err)
	}

	// Encryption Request
	pkt, err := readPacket(c.reader)
	if err != nil {
		return fmt.Errorf("read encryption request: %w", err)
	}

	if pkt.packetID != 0x01 {
		return fmt.Errorf("bad encrypt request packet id")
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Check the host: cat /proc/sys/kernel/random/entropy_avail and confirm /dev/urandom is readable.
2. Loosen the container/seccomp profile to allow getrandom(2).
3. If it occurs only right after boot, wait for the CSPRNG to initialize and retry.

if err := cc.Handshake(); err != nil {
	var perr *randError // unwrap crypto/rand failure
	if errors.As(err, &perr) {
		time.Sleep(time.Second) // give the OS CSPRNG time after boot
		return retryDial(ctx)
	}
	return err
}

When it happens

Trigger: rand.Reader failing on the host: Linux with getrandom blocked or /dev/urandom unavailable, restrictive sandboxes/seccomp filters, or entropy starvation during early boot in containers/VMs.

Common situations: Freshly booted minimal containers (especially old kernels without getrandom wakeup guarantees), gVisor/Firecracker sandboxes blocking random syscalls, chroots without /dev mounted.

Related errors

• empty rsa public key
• server public key mismatch
• failed to create client
• derive minecraft rsa key: %w
• marshal minecraft rsa public key: %w

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/3dc527b1506706f8. Report an issue: GitHub.