shadowsocks/shadowsocks-rust · error

method

Error message

method

What it means

In local service config creation, when SERVER_ADDR is present the ENCRYPT_METHOD value is parsed into a CipherKind; an unknown method name makes parse fail and .expect("method") panics. It guarantees every server entry has a recognized cipher before building the ServerConfig.

Source

Thrown at src/service/local.rs:633

                logging::init_with_file(path);
            }
            None => {
                logging::init_with_config("sslocal", &service_config.log);
            }
        }

        trace!("{:?}", service_config);

        let mut config = match config_path_opt {
            Some(cpath) => Config::load_from_file(&cpath, ConfigType::Local)
                .map_err(|err| ShadowsocksError::LoadConfigFailure(format!("loading config {cpath:?}, {err}")))?,
            None => Config::new(ConfigType::Local),
        };

        if let Some(svr_addr) = matches.get_one::<String>("SERVER_ADDR") {
            let method = matches
                .get_one::<String>("ENCRYPT_METHOD")
                .map(|x| x.parse::<CipherKind>().expect("method"))
                .expect("`method` is required");

            let password = match matches.get_one::<String>("PASSWORD") {
                Some(pwd) => read_variable_field_value(pwd).into(),
                None => {
                    // NOTE: svr_addr should have been checked by crate::vparser
                    if method.is_none() {
                        // If method doesn't need a key (none, plain), then we can leave it empty
                        String::new()
                    } else {
                        match crate::password::read_server_password(svr_addr) {
                            Ok(pwd) => pwd,
                            Err(..) => panic!("`password` is required for server {svr_addr}"),
                        }
                    }
                }
            };

View on GitHub (pinned to 8eb0f0a65b)

Solutions

1. Use a supported AEAD cipher name: aes-128-gcm, aes-256-gcm, chacha20-ietf-poly1305, or a 2022-blake3 variant.
2. Replace legacy stream ciphers (aes-*-cfb, rc4-md5) that were dropped from the crypto crate.
3. Enable the matching shadowsocks-crypto feature or update the binary if the cipher exists upstream.

Example fix

// before
sslocal -b 127.0.0.1:1080 -s example.com:8388 --encrypt-method aes-256-cfb -k secret

// after
sslocal -b 127.0.0.1:1080 -s example.com:8388 --encrypt-method aes-256-gcm -k secret

let method = match matches.get_one::<String>("ENCRYPT_METHOD") {
    Some(s) => s.parse::<CipherKind>().map_err(|_| format!("invalid encrypt-method: {}", s))?,
    None => return Err("`method` is required with SERVER_ADDR".into()),
};

let kind: CipherKind = s.parse().map_err(|e| ShadowsocksError::InvalidConfig(format!("bad encrypt-method: {e}")))?;

When it happens

Trigger: Running sslocal with a server address (-b/-s SERVER_ADDR) plus an --encrypt-method string that is not a valid CipherKind (typo, unsupported algorithm, or crypto feature disabled).

Common situations: Config-file/URL server entries carrying legacy cipher names (e.g. rc4-md5, aes-256-cfb) removed in newer versions; typos; SIP002 plugin configs ported from older clients.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• dns
• missing manager config
• logging
• method
• `method` is required

AI-assisted analysis of shadowsocks/shadowsocks-rust@8eb0f0a65b (2026-09-09). Data as JSON: /api/errors/cbf3068f8aeab4cd. Report an issue: GitHub.