{"record":{"id":"2fa94b01f750570d","repo":"XTLS/Xray-core","slug":"create-service","errorCode":null,"errorMessage":"create service","messagePattern":"create service","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/shadowsocks_2022/inbound.go","lineNumber":59,"sourceCode":"func NewServer(ctx context.Context, config *ServerConfig) (*Inbound, error) {\n\tnetworks := config.Network\n\tif len(networks) == 0 {\n\t\tnetworks = []net.Network{\n\t\t\tnet.Network_TCP,\n\t\t\tnet.Network_UDP,\n\t\t}\n\t}\n\tinbound := &Inbound{\n\t\tnetworks: networks,\n\t\temail:    config.Email,\n\t\tlevel:    int(config.Level),\n\t}\n\tif !C.Contains(shadowaead_2022.List, config.Method) {\n\t\treturn nil, errors.New(\"unsupported method \", config.Method)\n\t}\n\tservice, err := shadowaead_2022.NewServiceWithPassword(config.Method, config.Key, 500, inbound, nil)\n\tif err != nil {\n\t\treturn nil, errors.New(\"create service\").Base(err)\n\t}\n\tinbound.service = service\n\treturn inbound, nil\n}\n\nfunc (i *Inbound) Network() []net.Network {\n\treturn i.networks\n}\n\nfunc (i *Inbound) Process(ctx context.Context, network net.Network, connection stat.Connection, dispatcher routing.Dispatcher) error {\n\tinbound := session.InboundFromContext(ctx)\n\tinbound.Name = \"shadowsocks-2022\"\n\tinbound.CanSpliceCopy = 3\n\n\tvar metadata M.Metadata\n\tif inbound.Source.IsValid() {\n\t\tmetadata.Source = M.ParseSocksaddr(inbound.Source.NetAddr())\n\t}","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/shadowsocks_2022/inbound.go#L41-L77","documentation":"Wrapper around shadowaead_2022.NewServiceWithPassword failing for a single-user 2022 inbound. The underlying library rejects method/password combinations — most often the base64-decoded key length does not match the method (16 bytes for aes-128, 32 for aes-256/chacha20 variants). The inbound cannot start.","triggerScenarios":"config.Key is not valid base64 of the exact length required by config.Method (e.g. 24-byte random string with 2022-blake3-aes-256-gcm, or raw binary), or method/password key-derivation constraints violated inside the 2022 library.","commonSituations":"Using a human-chosen password instead of a generated base64 key; generating keys of the wrong bit size (openssl rand -base64 24 vs 32); switching method without regenerating the key.","solutions":["Generate a key of the right size: xray uuid won't do it — use `openssl rand -base64 32` for aes-256/chacha20 methods, `openssl rand -base64 16` (wait: 16 raw bytes) for 128-bit methods — verify the decoded byte length matches the method.","Match client and server keys exactly after fixing length.","Check the base error in the log to confirm which constraint failed."],"exampleFix":"# before: 24-byte key with a 256-bit method\n\"password\": \"$(openssl rand -base64 24)\"\n# after: 32-byte key for 2022-blake3-aes-256-gcm\n\"password\": \"$(openssl rand -base64 32)\"","handlingStrategy":"validation","validationCode":"func validateSS2022Key(method, keyB64 string) error {\n  raw, err := base64.StdEncoding.DecodeString(keyB64)\n  if err != nil { return err }\n  want := 32\n  if strings.Contains(method, \"128\") { want = 16 }\n  if len(raw) != want { return fmt.Errorf(\"key is %d bytes, method %q needs %d\", len(raw), method, want) }\n  return nil\n}","typeGuard":"func hasValidKeyLength(method string, keyLen int) bool {\n  if strings.Contains(method, \"128\") { return keyLen == 16 }\n  return keyLen == 32\n}","tryCatchPattern":"service, err := shadowaead_2022.NewServiceWithPassword(method, key, 500, inbound, nil)\nif err != nil {\n  return fmt.Errorf(\"2022 service init failed (check key length for %s): %w\", method, err)\n}","preventionTips":["Always generate keys with openssl rand -base64 (32 or 16) matched to the method.","Automate key generation in provisioning scripts instead of letting users type passwords."],"tags":["shadowsocks-2022","config","key-length","base64","startup"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}