shadowsocks/shadowsocks-rust · error

method

Error message

method

What it means

The genkey subcommand parses the ENCRYPT_METHOD CLI argument into a CipherKind with FromStr; an unrecognized method name makes .parse fail and the .expect("method") panics. This is a CLI-input validation guard: only cipher names implemented by the linked shadowsocks-crypto crate are accepted.

Source

Thrown at src/service/genkey.rs:30

    app = app.arg(
        Arg::new("ENCRYPT_METHOD")
            .short('m')
            .long("encrypt-method")
            .num_args(1)
            .action(ArgAction::Set)
            .required(true)
            .value_parser(PossibleValuesParser::new(available_ciphers()))
            .help("Server's encryption method"),
    );

    app
}

/// Program entrance `main`
pub fn main(matches: &ArgMatches) -> ExitCode {
    let method = matches
        .get_one::<String>("ENCRYPT_METHOD")
        .map(|x| x.parse::<CipherKind>().expect("method"))
        .expect("`method` is required");

    let key_len = method.key_len();
    if key_len > 0 {
        let mut key = vec![0u8; key_len];
        rand::fill(key.as_mut_slice());

        let encoded_key = base64::engine::general_purpose::STANDARD.encode(&key);
        println!("{encoded_key}");
    }

    ExitCode::SUCCESS
}

View on GitHub (pinned to 8eb0f0a65b)

Solutions

1. Use a supported cipher name exactly, e.g. aes-256-gcm, aes-128-gcm, chacha20-ietf-poly1305, 2022-blake3-aes-256-gcm.
2. Check the crate's cipher feature flags; recompile with the feature that enables the wanted cipher.
3. Pre-validate the method string against CipherKind::from_str before invoking to print a friendly error instead of panicking.

Example fix

// before
let method: CipherKind = "aes-256-cbc".parse().expect("method");

// after
let method: CipherKind = match "aes-256-cbc".parse() {
    Ok(m) => m,
    Err(_) => { eprintln!("unsupported encrypt-method\"aes-256-cbc\""); return ExitCode::FAILURE; }
};

fn validate_cipher_method(s: &str) -> Result<shadowsocks::config::CipherKind, String> {
    s.parse::<shadowsocks::config::CipherKind>()
        .map_err(|_| format!("unknown encrypt-method: {} (try aes-256-gcm, chacha20-ietf-poly1305)", s))
}

let kind = s.parse::<CipherKind>().unwrap_or_else(|_| {
    eprintln!("invalid encrypt-method: {}", s);
    std::process::exit(2);
});

When it happens

Trigger: Running `sslocal genkey <method>` (or ssserver genkey) with a method string that is not a valid CipherKind, e.g. a typo like `aes-256-gcm-12`, an old/removed cipher name, or a cipher requiring a disabled crypto feature.

Common situations: Typo in cipher name; copying a method name from a different tool (e.g. OpenSSL names); cipher compiled out because a crypto feature flag is off; lowercase/case mistakes.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• `method` is required
• method
• `method` is required
• server-addr
• plugin-mode must be one of `tcp_only` (default), `udp_only`

AI-assisted analysis of shadowsocks/shadowsocks-rust@8eb0f0a65b (2026-09-09). Data as JSON: /api/errors/bdb637f5bc460781. Report an issue: GitHub.