{"record":{"id":"abf0bd19128d4712","repo":"XTLS/Xray-core","slug":"unknown-cipher-method","errorCode":null,"errorMessage":"unknown cipher method: ","messagePattern":"unknown cipher method: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/shadowsocks.go","lineNumber":101,"sourceCode":"\t\t\t\t\tLevel:   uint32(user.Level),\n\t\t\t\t\tAccount: serial.ToTypedMessage(account),\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\tif err := task.ParallelForN(len(v.Users), processUser); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t} else {\n\t\taccount := &shadowsocks.Account{\n\t\t\tPassword:   v.Password,\n\t\t\tCipherType: cipherFromString(v.Cipher),\n\t\t}\n\t\tif account.Password == \"\" {\n\t\t\treturn nil, errors.New(\"Shadowsocks password is not specified.\")\n\t\t}\n\t\tif account.CipherType == shadowsocks.CipherType_UNKNOWN {\n\t\t\treturn nil, errors.New(\"unknown cipher method: \", v.Cipher)\n\t\t}\n\t\tconfig.Users = append(config.Users, &protocol.User{\n\t\t\tEmail:   v.Email,\n\t\t\tLevel:   uint32(v.Level),\n\t\t\tAccount: serial.ToTypedMessage(account),\n\t\t})\n\t}\n\n\treturn config, nil\n}\n\nfunc buildShadowsocks2022(v *ShadowsocksServerConfig) (proto.Message, error) {\n\tif len(v.Users) == 0 {\n\t\tconfig := new(shadowsocks_2022.ServerConfig)\n\t\tconfig.Method = v.Cipher\n\t\tconfig.Key = v.Password\n\t\tconfig.Network = v.NetworkList.Build()\n\t\tconfig.Email = v.Email","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/shadowsocks.go#L83-L119","documentation":"In the single-user classic Shadowsocks inbound builder, the method string is mapped through cipherFromString; if the result is CipherType_UNKNOWN the method is not a recognized classic cipher. Unlike the users-array variant, this triggers for any unrecognized string, including empty.","triggerScenarios":"A single-user inbound with 'method' missing, empty, misspelled (\"aes-128-gmc\"), a 2022 method, or a legacy stream cipher — anything that does not map to the supported AEAD set.","commonSituations":"Omitting method assuming a default exists; pasting a Shadowsocks-2022 method into a classic inbound; case or separator typos in the method name.","solutions":["Set 'method' to a supported AEAD cipher: aes-128-gcm, aes-256-gcm, chacha20-poly1305, or xchacha20-poly1305.","For 2022 methods (2022-blake3-*), use the Shadowsocks-2022 configuration shape supported by the server builder instead.","Double-check spelling and exact casing of the method string."],"exampleFix":"// before\n\"settings\": {\"password\": \"my-secret\", \"method\": \"aes-128-gmc\"}\n\n// after\n\"settings\": {\"password\": \"my-secret\", \"method\": \"aes-128-gcm\"}","handlingStrategy":"validation","validationCode":"func validSSMethod(m string) bool {\n    switch m {\n    case \"aes-128-gcm\", \"aes-256-gcm\", \"chacha20-poly1305\", \"xchacha20-poly1305\":\n        return true\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Centralize the supported-method list in your tooling","Reject empty method explicitly"],"tags":["shadowsocks","cipher","config","inbound"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}