SS22 switch from 16 to 32 char length passwords crashes Node

inoutDeev · 22.Июнь.2026 13:45:20

Hi

There is a rare bug where if you created a SS inbound with 16 char length password, and add it to nodes and make it available in internal squads for users, with at least one successful connection to, then switching it to 32 char length, the corresponding node will crash with below error:
Failed to start: main: failed to create server > proxy/shadowsocks_2022: create service > bad key

remnawave · 05.Июль.2026 18:16:43

github.com/remnawave/backend

fix(shadowsocks): validate SS2022 password by decoded key size (#193)

dev ← TopPro104:fix/ss2022-key-size

открытые 05:54PM - 05 Jul 26 UTC

TopPro104

+18 -4

## Problem Creating or editing a `2022-blake3-aes-256-gcm` inbound with a passw…ord that is not a base64 value of exactly 32 bytes makes the node crash on start: ``` Failed to start: main: failed to create server > proxy/shadowsocks_2022: create service > bad key ``` Reported on the forum: https://f.docs.rw/t/250 ## Cause The validator checked the character length of the password string (`settings.password.length < 32`) instead of the decoded key length. Per SIP022, the password for a 2022-blake3-* method must be a base64 string that decodes to exactly the cipher key size (32 bytes for aes-256-gcm), which is what `openssl rand -base64 32` produces. A 32 character string is not the same thing: a raw 32 char value decodes to 24 bytes, still passed the old check, and then the node failed with `bad key`. ## Fix Validate the decoded key size instead of the string length. The key size is resolved from the method, so this stays correct if more 2022-blake3-* methods are added later. The error message now points at the actual requirement. Validation runs when a config profile is created or updated (`new XRayConfig(...)`), so an invalid password is now rejected at save time with a clear message instead of reaching the node and crashing it. ## Notes Auto generated user keys are unaffected: `createPassword()` returns 32 bytes and `encodeSS2022Password` base64 encodes them to a valid 32 byte key.