fix(inbounds): refuse 2022-blake3-chacha20-poly1305 on shadowsocks inbounds

xray-core builds a Shadowsocks-2022 inbound with users only for the AES
methods: the multi-user identity header is AES-only, so the config
builder and the multi-user server both reject chacha20. Every panel
inbound carries clients, so picking 2022-blake3-chacha20-poly1305 in the
inbound form kept the whole core from starting; its links also failed
on the client with "multi-key is not supported".

The inbound form no longer offers the method and AddInbound/UpdateInbound
reject it. Startup moves stored inbounds to 2022-blake3-aes-256-gcm,
which takes the same 32-byte keys, so every stored key stays valid.
Outbounds keep the method, since a single-key outbound to such a server
works. The share-link generator drops the single-user branch that only
this method reached.

internal/web/service/client_crud.go

@@ -509,9 +509,9 @@ func shadowsocksKeyBytes(method string) int {
 	return 0
 }
 
-// validateShadowsocks2022ServerKey refuses a server key xray-core cannot parse:
-// the core then fails to build the inbound and does not start at all.
-func validateShadowsocks2022ServerKey(protocol model.Protocol, settings string) error {
+// validateShadowsocks2022Inbound refuses a method or server key xray-core cannot
+// build an inbound from: the core then does not start at all.
+func validateShadowsocks2022Inbound(protocol model.Protocol, settings string) error {
 	if protocol != model.Shadowsocks {
 		return nil
 	}
@@ -526,6 +526,9 @@ func validateShadowsocks2022ServerKey(protocol model.Protocol, settings string)
 	if n == 0 {
 		return nil
 	}
+	if xray.Shadowsocks2022NoMultiUser(parsed.Method) {
+		return common.NewErrorf("shadowsocks inbound method %s does not support multiple users, use a 2022-blake3-aes method", parsed.Method)
+	}
 	if !xray.ValidShadowsocks2022Key(parsed.Method, parsed.Password) {
 		return common.NewErrorf("shadowsocks inbound password: %s needs a %d-byte key, base64 encoded", parsed.Method, n)
 	}

internal/web/service/inbound.go

@@ -1178,7 +1178,7 @@ func (s *InboundService) AddInbound(inbound *model.Inbound) (*model.Inbound, boo
 	if err := validateFinalMaskSalamander(inbound.StreamSettings); err != nil {
 		return inbound, false, err
 	}
-	if err := validateShadowsocks2022ServerKey(inbound.Protocol, inbound.Settings); err != nil {
+	if err := validateShadowsocks2022Inbound(inbound.Protocol, inbound.Settings); err != nil {
 		return inbound, false, err
 	}
 	s.normalizeMtprotoSecret(inbound)
@@ -1826,7 +1826,7 @@ func (s *InboundService) UpdateInbound(inbound *model.Inbound) (*model.Inbound,
 	if err := validateFinalMaskSalamander(inbound.StreamSettings); err != nil {
 		return inbound, false, err
 	}
-	if err := validateShadowsocks2022ServerKey(inbound.Protocol, inbound.Settings); err != nil {
+	if err := validateShadowsocks2022Inbound(inbound.Protocol, inbound.Settings); err != nil {
 		return inbound, false, err
 	}
 	s.normalizeMtprotoSecret(inbound)

internal/web/service/shadowsocks_server_key_test.go

@@ -75,3 +75,50 @@ func TestShadowsocks2022ServerKeyRejected(t *testing.T) {
 		}
 	})
 }
+
+// xray-core builds a Shadowsocks-2022 inbound with users only for the AES methods;
+// a 2022-chacha20 one with clients keeps the whole core from starting.
+func TestShadowsocks2022ChachaInboundRejected(t *testing.T) {
+	const chacha = "2022-blake3-chacha20-poly1305"
+	key32 := base64.StdEncoding.EncodeToString(make([]byte, 32))
+	key16 := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	const wantErr = "shadowsocks inbound method 2022-blake3-chacha20-poly1305 does not support multiple users"
+
+	t.Run("add", func(t *testing.T) {
+		setupConflictDB(t)
+		nodeID, fake := setupNodeRuntime(t)
+		ib := &model.Inbound{
+			UserId: 1, NodeID: &nodeID, Tag: "ss-chacha-add", Enable: true, Port: 41811, Protocol: model.Shadowsocks,
+			Settings: ss2022Settings(chacha, key32),
+		}
+		_, _, err := (&InboundService{}).AddInbound(ib)
+		if err == nil || !strings.Contains(err.Error(), wantErr) {
+			t.Fatalf("AddInbound with %s: err = %v", chacha, err)
+		}
+		if fake.addInbound.Load() != 0 {
+			t.Fatal("rejected inbound dispatched to the runtime")
+		}
+	})
+
+	t.Run("update", func(t *testing.T) {
+		setupConflictDB(t)
+		nodeID, fake := setupNodeRuntime(t)
+		svc := &InboundService{}
+		ib := &model.Inbound{
+			UserId: 1, NodeID: &nodeID, Tag: "ss-chacha-update", Enable: true, Port: 41812, Protocol: model.Shadowsocks,
+			Settings: ss2022Settings("2022-blake3-aes-128-gcm", key16),
+		}
+		if _, _, err := svc.AddInbound(ib); err != nil {
+			t.Fatalf("AddInbound: %v", err)
+		}
+		update := *ib
+		update.Settings = ss2022Settings(chacha, key32)
+		_, _, err := svc.UpdateInbound(&update)
+		if err == nil || !strings.Contains(err.Error(), wantErr) {
+			t.Fatalf("UpdateInbound to %s: err = %v", chacha, err)
+		}
+		if fake.updateInbound.Load() != 0 {
+			t.Fatal("rejected update dispatched to the runtime")
+		}
+	})
+}