{"record":{"id":"3dc527b1506706f8","repo":"XTLS/Xray-core","slug":"select-profile-w","errorCode":null,"errorMessage":"select profile: %w","messagePattern":"select profile: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":110,"sourceCode":"\t\tport, err := strconv.Atoi(portString)\n\t\tif err == nil {\n\t\t\tserverPort = UnsignedShort(port)\n\t\t}\n\n\t\tif serverAddress == \"\" {\n\t\t\tserverAddress = String(host)\n\t\t}\n\t}\n\n\terr = writePacket(c.writer, 0x00, &protocolVersion, &serverAddress, &serverPort, &nextState)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write handshake packet: %w\", err)\n\t}\n\n\t// Login Start\n\trandomProfile, err := rand.Int(rand.Reader, big.NewInt(int64(len(c.profiles))))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"select profile: %w\", err)\n\t}\n\tselectedProfile := c.profiles[randomProfile.Int64()]\n\tusername := String(selectedProfile.Username)\n\n\terr = writePacket(c.writer, 0x00, &username, &selectedProfile.UUID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write login start: %w\", err)\n\t}\n\n\t// Encryption Request\n\tpkt, err := readPacket(c.reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read encryption request: %w\", err)\n\t}\n\n\tif pkt.packetID != 0x01 {\n\t\treturn fmt.Errorf(\"bad encrypt request packet id\")\n\t}","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L92-L128","documentation":"Wraps an error from crypto/rand's rand.Int when the client randomly selects a login profile. rand.Int reads from the system CSPRNG, so failure means the OS entropy source is unavailable (getrandom(2) error), not a problem with the profiles themselves.","triggerScenarios":"rand.Reader failing on the host: Linux with getrandom blocked or /dev/urandom unavailable, restrictive sandboxes/seccomp filters, or entropy starvation during early boot in containers/VMs.","commonSituations":"Freshly booted minimal containers (especially old kernels without getrandom wakeup guarantees), gVisor/Firecracker sandboxes blocking random syscalls, chroots without /dev mounted.","solutions":["Check the host: cat /proc/sys/kernel/random/entropy_avail and confirm /dev/urandom is readable.","Loosen the container/seccomp profile to allow getrandom(2).","If it occurs only right after boot, wait for the CSPRNG to initialize and retry."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := cc.Handshake(); err != nil {\n\tvar perr *randError // unwrap crypto/rand failure\n\tif errors.As(err, &perr) {\n\t\ttime.Sleep(time.Second) // give the OS CSPRNG time after boot\n\t\treturn retryDial(ctx)\n\t}\n\treturn err\n}","preventionTips":["On containers/VMs, wait for the CSPRNG to initialize before dialing (check /proc/sys/kernel/random/entropy_avail).","Ensure the sandbox/seccomp profile permits getrandom(2)."],"tags":["crypto","system","xmc","finalmask","entropy"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}