shadowsocks/shadowsocks-rust · error

server config create failed

Error message

server config create failed

What it means

Thrown when ServerConfig::new(addr, password, method) fails while building a server entry from parsed JSON config. The cipher-specific validation error from ServerConfig is wrapped in ErrorKind::Malformed.

Source

Thrown at crates/shadowsocks-service/src/config.rs:2181

                    Some(ref pwd) => read_variable_field_value(pwd),
                    None => {
                        if method.is_none() {
                            String::new().into()
                        } else {
                            let err = Error::new(
                                ErrorKind::MissingField,
                                "`password` is required",
                                Some(format!("`password` is required for method {method}")),
                            );
                            return Err(err);
                        }
                    }
                };

                let mut nsvr = match ServerConfig::new(addr, password, method) {
                    Ok(svr) => svr,
                    Err(serr) => {
                        let err = Error::new(
                            ErrorKind::Malformed,
                            "server config create failed",
                            Some(format!("{}", serr)),
                        );
                        return Err(err);
                    }
                };
                nsvr.set_source(server_source);
                nsvr.set_mode(global_mode);

                if let Some(ref p) = config.plugin {
                    // SIP008 allows "plugin" to be an empty string
                    // Empty string implies "no plugin"
                    if !p.is_empty() {
                        let plugin = PluginConfig {
                            plugin: p.clone(),
                            plugin_opts: config.plugin_opts.clone(),
                            plugin_args: config.plugin_args.clone().unwrap_or_default(),

View on GitHub (pinned to 8eb0f0a65b)

Solutions

1. For `2022-*` methods, generate a proper base64 key (e.g. `openssl rand -base64 32` for aes-256) and use it as the password
2. Read the wrapped inner error message (`format!("{}", serr)`) to see the exact cipher-level complaint
3. Downgrade/choose a method matching your existing password format, or re-key the server and client together
4. Verify server and client use identical method and key

Example fix

// before
{"method": "2022-blake3-aes-256-gcm", "password": "mypassword"}
// after
{"method": "2022-blake3-aes-256-gcm", "password": "h3jRkW3...base64 32-byte key...=="}

// pre-check for 2022 methods:
if method.starts_with("2022-") {
    base64::decode(password).map_err(|_| "password must be valid base64 key")?;
    // expected lengths: 16 bytes (aes-128 / chacha20), 32 bytes (aes-256)
}

match ServerConfig::new(addr, password.clone(), method) {
    Ok(svr) => svr,
    Err(e) => { eprintln!("invalid server credentials: {e}"); return; }
}

When it happens

Trigger: Parsing a server entry whose combination of address, password, and method is rejected by ServerConfig::new — most commonly a password that is invalid for the chosen AEAD/2022 method (e.g. `2022-blake3-*` requiring base64 keys of exact length, or too-short passwords for some ciphers).

Common situations: Using SIP008/JSON config with `2022-blake3-aes-256-gcm` / `2022-blake3-chacha20-poly1305` and passwords that are not valid base64 32/16-byte keys; reusing plain-text passwords with 2022 ciphers; method/password pairs copied between incompatible servers.

Related errors

• unsupported method
• missing any valid servers in configuration
• method
• create local
• {method} don't know how to generate nonce

AI-assisted analysis of shadowsocks/shadowsocks-rust@8eb0f0a65b (2026-09-09). Data as JSON: /api/errors/d278e4eb1af65eda. Report an issue: GitHub.