{"record":{"id":"f93feb0a11c46e74","repo":"shadowsocks/shadowsocks-windows","slug":"openssl-fail-to-init-ctx","errorCode":null,"errorMessage":"openssl: fail to init ctx","messagePattern":"openssl: fail to init ctx","errorType":"exception","errorClass":"System.Exception","httpStatus":null,"severity":"critical","filePath":"shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs","lineNumber":68,"sourceCode":"            if (_cipherInfoPtr == IntPtr.Zero) throw new System.Exception(\"openssl: cipher not found\");\r\n            IntPtr ctx = OpenSSL.EVP_CIPHER_CTX_new();\r\n            if (ctx == IntPtr.Zero) throw new System.Exception(\"openssl: fail to create ctx\");\r\n\r\n            if (isEncrypt)\r\n            {\r\n                _encryptCtx = ctx;\r\n            }\r\n            else\r\n            {\r\n                _decryptCtx = ctx;\r\n            }\r\n\r\n            DeriveSessionKey(isEncrypt ? _encryptSalt : _decryptSalt, _Masterkey,\r\n                isEncrypt ? _opensslEncSubkey : _opensslDecSubkey);\r\n\r\n            var ret = OpenSSL.EVP_CipherInit_ex(ctx, _cipherInfoPtr, IntPtr.Zero, null, null,\r\n                isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to init ctx\");\r\n\r\n            ret = OpenSSL.EVP_CIPHER_CTX_set_key_length(ctx, keyLen);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to set key length\");\r\n\r\n            ret = OpenSSL.EVP_CIPHER_CTX_ctrl(ctx, OpenSSL.EVP_CTRL_AEAD_SET_IVLEN,\r\n                nonceLen, IntPtr.Zero);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to set AEAD nonce length\");\r\n\r\n            ret = OpenSSL.EVP_CipherInit_ex(ctx, IntPtr.Zero, IntPtr.Zero,\r\n                isEncrypt ? _opensslEncSubkey : _opensslDecSubkey,\r\n                null,\r\n                isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);\r\n            if (ret != 1) throw new System.Exception(\"openssl: cannot set key\");\r\n            OpenSSL.EVP_CIPHER_CTX_set_padding(ctx, 0);\r\n        }\r\n\r\n        public override void cipherEncrypt(byte[] plaintext, uint plen, byte[] ciphertext, ref uint clen)\r\n        {\r","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/shadowsocks/shadowsocks-windows/blob/891d971682eefcaa2e640258d3b352a3ad3b2233/shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs#L50-L86","documentation":"Thrown from AEADOpenSSLEncryptor.InitCipher when the first EVP_CipherInit_ex returns != 1. This call initialises the context with the cipher (from _cipherInfoPtr) and the encrypt/decrypt flag, passing null key/IV. Failure means OpenSSL rejected the cipher/context combination at setup.","triggerScenarios":"_cipherInfoPtr is invalid/null for this OpenSSL version; the context was created but is in a bad state; the cipher requires initialisation options this build does not provide; mismatch between OpenSSL headers used to build the bindings and the runtime library.","commonSituations":"ABI mismatch between binding and runtime OpenSSL; a cipher present at compile time but not at runtime; calling EVP_CipherInit_ex on an already-initialised context that was not reset.","solutions":["Ensure _cipherInfoPtr is non-null (error 14 guards this) and that the OpenSSL runtime matches the binding version.","Use a single, consistent OpenSSL version across the app and all native deps.","Verify the context is freshly created (error 15) and not reused without EVP_CIPHER_CTX_reset."],"exampleFix":"// before\nvar ret = OpenSSL.EVP_CipherInit_ex(ctx, _cipherInfoPtr, IntPtr.Zero, null, null, isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);\nif (ret != 1) throw new System.Exception(\"openssl: fail to init ctx\");\n\n// after\nif (ret != 1)\n    throw new System.Exception($\"openssl: fail to init ctx (ret={ret}, cipher={_innerLibName}); check OpenSSL ABI version\");","handlingStrategy":"validation","validationCode":"// Validate cipher info and context freshness before init\nif (_cipherInfoPtr == IntPtr.Zero) throw new InvalidOperationException(\"no cipher info\");\nif (ctx == IntPtr.Zero) throw new InvalidOperationException(\"no ctx\");","typeGuard":null,"tryCatchPattern":"try { OpenSSL.EVP_CipherInit_ex(...); }\ncatch (Exception ex) when (ex.Message.Contains(\"fail to init ctx\"))\n{ /* recreate ctx, verify OpenSSL ABI, fall back to mbedTLS */ }","preventionTips":["Use one consistent OpenSSL version across all native dependencies.","Create a fresh context per session and reset before reuse.","Cross-check binding headers against the runtime library version."],"tags":["encryption","aead","openssl","initialization","abi"],"backgroundTag":null,"analyzedSha":"891d971682eefcaa2e640258d3b352a3ad3b2233","analyzedAt":"2026-08-13T10:12:34.434Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}