{"record":{"id":"93b6dac1fc846803","repo":"XTLS/Xray-core","slug":"failed-to-create-client","errorCode":null,"errorMessage":"failed to create client","messagePattern":"failed to create client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/dns/dns.go","lineNumber":154,"sourceCode":"\n\t\tserveExpiredTTL := config.ServeExpiredTTL\n\t\tif ns.ServeExpiredTTL != nil {\n\t\t\tserveExpiredTTL = *ns.ServeExpiredTTL\n\t\t}\n\n\t\ttag := defaultTag\n\t\tif len(ns.Tag) > 0 {\n\t\t\ttag = ns.Tag\n\t\t}\n\n\t\tclientIPOption := ResolveIpOptionOverride(ns.QueryStrategy, ipOption)\n\t\tif !clientIPOption.IPv4Enable && !clientIPOption.IPv6Enable {\n\t\t\treturn nil, errors.New(\"no QueryStrategy available for \", ns.Address)\n\t\t}\n\n\t\tclient, err := NewClient(ctx, ns, myClientIP, disableCache, serveStale, serveExpiredTTL, tag, clientIPOption, updateRules)\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"failed to create client\").Base(err)\n\t\t}\n\t\tclients = append(clients, client)\n\t}\n\n\tvar domainMatcher geodata.DomainMatcher\n\tif len(effectiveRules) > 0 {\n\t\tdomainMatcher, err = geodata.DomainReg.BuildDomainMatcher(effectiveRules)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\t// If there is no DNS client in config, add a `localhost` DNS client\n\tif len(clients) == 0 {\n\t\tclients = append(clients, NewLocalDNSClient(ipOption))\n\t}\n\n\treturn &DNS{","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/app/dns/dns.go#L136-L172","documentation":"When a turn has no explicit variants, writePaddingTurnWithBuffer randomizes the write chunk size between turn.writeChunkMinLength and turn.writeChunkLength via randomPaddingTarget; this error wraps that call. randomPaddingTarget only fails if crypto/rand.Int fails (min == max short-circuits), so this is an OS entropy failure, since the range itself was already validated (writeChunkMinLength >= 0, writeChunkLength >= writeChunkMinLength).","triggerScenarios":"rand.Reader returning an error while drawing the chunk length; occurs during writePaddingTurnWithBuffer on turns using generated write chunks with a non-zero writeChunkMinLength.","commonSituations":"Fresh containers/VMs before the CRNG is seeded; seccomp/sandbox profiles blocking getrandom(2); entropy-starved embedded hosts.","solutions":["Check host entropy health and kernel RNG availability (getrandom syscall permitted)","Warm up the entropy source or delay the connection start until the pool is initialized","As a config-side workaround, set writeChunkMinLength = 0 (equal min/max path skips the rand draw)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if turn.writeChunkMinLength < 0 || turn.writeChunkLength < turn.writeChunkMinLength || turn.writeChunkLength > 48*1024 {\n    return errors.New(\"bad write chunk range\")\n}","typeGuard":null,"tryCatchPattern":"if err := run(...); err != nil && errors.Is(err, cryptoRandFailureMarker) {\n    // entropy transient: reconnect after entropy is seeded rather than tight-looping\n}","preventionTips":["Ensure the runtime environment has a working getrandom(2)","Set writeChunkMinLength = 0 to use a fixed chunk size with no rand draw if the host is entropy-poor"],"tags":["padding","crypto-rand","entropy","xmc"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}