{"record":{"id":"f1d15e871b1ef1d1","repo":"XTLS/Xray-core","slug":"shadowsocks-2022-multi-user-only-blake3-aes-g","errorCode":null,"errorMessage":"shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods are supported","messagePattern":"shadowsocks 2022 \\(multi-user\\): only blake3-aes-\\*-gcm methods are supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/shadowsocks.go","lineNumber":127,"sourceCode":"\n\treturn config, nil\n}\n\nfunc buildShadowsocks2022(v *ShadowsocksServerConfig) (proto.Message, error) {\n\tif len(v.Users) == 0 {\n\t\tconfig := new(shadowsocks_2022.ServerConfig)\n\t\tconfig.Method = v.Cipher\n\t\tconfig.Key = v.Password\n\t\tconfig.Network = v.NetworkList.Build()\n\t\tconfig.Email = v.Email\n\t\treturn config, nil\n\t}\n\n\tif v.Cipher == \"\" {\n\t\treturn nil, errors.New(\"shadowsocks 2022 (multi-user): missing server method\")\n\t}\n\tif !strings.Contains(v.Cipher, \"aes\") {\n\t\treturn nil, errors.New(\"shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods are supported\")\n\t}\n\n\tif v.Users[0].Address == nil {\n\t\tconfig := new(shadowsocks_2022.MultiUserServerConfig)\n\t\tconfig.Method = v.Cipher\n\t\tconfig.Key = v.Password\n\t\tconfig.Network = v.NetworkList.Build()\n\n\t\tconfig.Users = make([]*protocol.User, len(v.Users))\n\t\tprocessUser := func(idx int) error {\n\t\t\tuser := v.Users[idx]\n\t\t\tif user.Cipher != \"\" {\n\t\t\t\treturn errors.New(\"shadowsocks 2022 (multi-user): users must have empty method\")\n\t\t\t}\n\t\t\taccount := &shadowsocks_2022.Account{\n\t\t\t\tKey: user.Password,\n\t\t\t}\n\t\t\tconfig.Users[idx] = &protocol.User{","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/shadowsocks.go#L109-L145","documentation":"In Shadowsocks-2022 multi-user mode, the implementation only supports blake3-aes-*-gcm methods because per-user keys are derived with BLAKE3 and the server key must be AES-based. If the server-level cipher string does not contain 'aes', this error is returned.","triggerScenarios":"A 2022 inbound with users and a non-AES method such as \"2022-blake3-chacha20-poly1305\" at server level, or a classic cipher string like \"chacha20-poly1305\" in a 2022 config.","commonSituations":"Wanting ChaCha20-based 2022 (unsupported here); leaving the classic method name when upgrading to 2022 keys; following an external guide that assumes chacha support.","solutions":["Use \"2022-blake3-aes-128-gcm\" or \"2022-blake3-aes-256-gcm\" as the multi-user server method.","Regenerate server and user keys as base64 of the correct length (16 or 32 bytes) for the chosen method.","If ChaCha is mandatory, run a classic Shadowsocks inbound instead (not 2022)."],"exampleFix":"// before\n\"method\": \"2022-blake3-chacha20-poly1305\"\n\n// after\n\"method\": \"2022-blake3-aes-256-gcm\"","handlingStrategy":"validation","validationCode":"func validSS2022Method(m string) bool {\n    return strings.Contains(m, \"aes\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Restrict generator output to 2022-blake3-aes-128-gcm / 2022-blake3-aes-256-gcm","Match key byte-length to method"],"tags":["shadowsocks-2022","cipher","aes","config"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}