{"record":{"id":"b5c08a64b3a21e16","repo":"XTLS/Xray-core","slug":"unsupported-cipher-method","errorCode":null,"errorMessage":"unsupported cipher method: ","messagePattern":"unsupported cipher method: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/shadowsocks.go","lineNumber":79,"sourceCode":"\n\tconfig := new(shadowsocks.ServerConfig)\n\tconfig.Network = v.NetworkList.Build()\n\n\tif v.Users != nil {\n\t\tif len(v.Users) > 0 {\n\t\t\tconfig.Users = make([]*protocol.User, len(v.Users))\n\t\t\tprocessUser := func(idx int) error {\n\t\t\t\tuser := v.Users[idx]\n\t\t\t\taccount := &shadowsocks.Account{\n\t\t\t\t\tPassword:   user.Password,\n\t\t\t\t\tCipherType: cipherFromString(user.Cipher),\n\t\t\t\t}\n\t\t\t\tif account.Password == \"\" {\n\t\t\t\t\treturn errors.New(\"Shadowsocks password is not specified.\")\n\t\t\t\t}\n\t\t\t\tif account.CipherType < shadowsocks.CipherType_AES_128_GCM ||\n\t\t\t\t\taccount.CipherType > shadowsocks.CipherType_XCHACHA20_POLY1305 {\n\t\t\t\t\treturn errors.New(\"unsupported cipher method: \", user.Cipher)\n\t\t\t\t}\n\t\t\t\tconfig.Users[idx] = &protocol.User{\n\t\t\t\t\tEmail:   user.Email,\n\t\t\t\t\tLevel:   uint32(user.Level),\n\t\t\t\t\tAccount: serial.ToTypedMessage(account),\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\tif err := task.ParallelForN(len(v.Users), processUser); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t} else {\n\t\taccount := &shadowsocks.Account{\n\t\t\tPassword:   v.Password,\n\t\t\tCipherType: cipherFromString(v.Cipher),\n\t\t}\n\t\tif account.Password == \"\" {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/shadowsocks.go#L61-L97","documentation":"In the multi-user Shadowsocks inbound builder, each user's cipher string is converted to a CipherType enum and must fall in the supported AEAD range [AES_128_GCM .. XCHACHA20_POLY1305]. If cipherFromString maps to a value outside that range, this error names the offending cipher string.","triggerScenarios":"A users entry whose 'cipher' is a legacy stream cipher (e.g. \"aes-256-cfb\", \"rc4-md5\", \"chacha20\") or a 2022 method (e.g. \"2022-blake3-aes-128-gcm\") inside a classic multi-user Shadowsocks inbound.","commonSituations":"Migrating an old Shadowsocks config that used stream ciphers; putting a Shadowsocks-2022 method string in a non-2022 inbound; typo like \"aes-128gcm\".","solutions":["Set each user's 'cipher' to one of: aes-128-gcm, aes-256-gcm, chacha20-poly1305, xchacha20-poly1305.","If you intended Shadowsocks-2022, move the whole inbound to the 2022-style config (password at server level, empty per-user method).","Regenerate keys/passwords sized for the chosen AEAD cipher if upgrading from legacy ciphers."],"exampleFix":"// before\n{\"cipher\": \"aes-256-cfb\", \"password\": \"...\"}\n\n// after\n{\"cipher\": \"aes-256-gcm\", \"password\": \"...\"}","handlingStrategy":"validation","validationCode":"var ssCiphers = map[string]bool{\"aes-128-gcm\": true, \"aes-256-gcm\": true, \"chacha20-poly1305\": true, \"xchacha20-poly1305\": true}\n\nfunc validSSCipher(c string) bool { return ssCiphers[c] }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin an allow-list of AEAD ciphers in generators","Reject legacy stream ciphers at authoring time"],"tags":["shadowsocks","cipher","aead","config"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}