jumpserver/jumpserver · error · ValueError

unsupported SM4 alg: 0x{alg:08x}

Error message

unsupported SM4 alg: 0x{alg:08x}

What it means

__do_cipher_action only supports SGD_SM4_CBC and SGD_SM4_ECB algorithm identifiers. Any other alg value reaches the else branch and raises ValueError with the unsupported code formatted in hex.

Source

Thrown at apps/common/sdk/gm/sctu/session_mixin.py:139

        if len(key) == 0 or len(key) % 16 != 0:
            raise ValueError("SM4 external key length must be multiple of 16 bytes")

        if alg == SGD_SM4_CBC:
            if iv is None:
                raise ValueError("SM4 CBC mode requires 16 bytes iv")
            if not isinstance(iv, (bytes, bytearray)):
                raise TypeError("iv must be bytes or bytearray")
            iv = bytes(iv)
            if len(iv) != 16:
                raise ValueError("SM4 CBC iv must be 16 bytes")
            iv_arr = as_uchar_array(iv)

        elif alg == SGD_SM4_ECB:
            iv_arr = None

        else:
            raise ValueError(f"unsupported SM4 alg: 0x{alg:08x}")

        if encrypt:
            if padding == PADDING_PKCS7:
                text = pkcs7_pad(text, 16)
            elif padding == PADDING_ZERO:
                text = zero_pad(text, 16)
            elif padding == PADDING_NONE:
                if len(text) == 0 or len(text) % 16 != 0:
                    raise ValueError("plain text length must be multiple of 16 bytes when padding is none")
            else:
                raise ValueError(f"unsupported padding: {padding}")
        else:
            if len(text) == 0 or len(text) % 16 != 0:
                raise ValueError("cipher text length must be multiple of 16 bytes")

        text_arr = as_uchar_array(text)
        key_arr = as_uchar_array(key)

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Use exactly SGD_SM4_CBC or SGD_SM4_ECB
2. Validate/normalize alg at config load and fail fast on unknown values
3. Add logging of alg before the call when debugging

Example fix

# before
ct = session.encrypt(data, key, alg=0x00000102)  # wrong constant

# after
from ...constants import SGD_SM4_CBC
ct = session.encrypt(data, key, alg=SGD_SM4_CBC, iv=iv)

SUPPORTED_ALGS = (SGD_SM4_CBC, SGD_SM4_ECB)
if alg not in SUPPORTED_ALGS:
    raise ValueError(f'unsupported SM4 alg: 0x{alg:08x}')

def is_supported_alg(a) -> bool:
    return a in (SGD_SM4_CBC, SGD_SM4_ECB)

When it happens

Trigger: Passing an SM1/SM3/other SGD_ constant, a raw int typo, an uninitialized alg variable (0x00000000), or an alg from a different constant family.

Common situations: Refactoring that renamed constants; alg defaulting to None/0 when config omits the field; copy-paste from code using a different SDF SDK with additional modes (CTR, OFB).

Related errors

• SM4 external key length must be multiple of 16 bytes
• SM4 CBC iv must be 16 bytes
• unsupported padding: {padding}
• empty plaintext after decrypt
• invalid pkcs7 padding

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/d15ceb9f97194471. Report an issue: GitHub.