What causes "CONNECT %s port:%d not support" in XX-net/XX-Net?

Route non-80/443 traffic outside the proxy: unset http_proxy/https_proxy for that tool or bypass the proxy for the host

CONNECT %s port:%d not support

Error message

CONNECT %s port:%d not support

What it means

do_CONNECT received a CONNECT tunnel request for a port other than 80 or 443. The GAE proxy only supports tunneling HTTP/HTTPS over those ports, so it logs the host/port and returns without establishing the tunnel (client gets no 200).

Source

Thrown at code/default/gae_proxy/local/proxy_handler.py:175

        for s in hosts:
            s = s.lower()
            if s.startswith(b'127.') \
                    or s.startswith(b'192.168.') \
                    or s.startswith(b'10.') \
                    or s.startswith(b'169.254.') \
                    or s in self.local_names:
                # xlog.debug(s)
                return True

        return False

    def do_CONNECT(self):
        """deploy fake cert to client"""
        host, _, port = self.path.rpartition(b':')
        port = int(port)
        if port not in (80, 443):
            xlog.warn("CONNECT %s port:%d not support", host, port)
            return

        certfile = CertUtil.get_cert(host)
        self.wfile.write(b'HTTP/1.1 200 Connection Established\r\n\r\n')
        self.wfile.flush()
        #self.conntunnel = True
 
        leadbyte = self.connection.recv(1, socket.MSG_PEEK)
        if leadbyte in (b'\x80', b'\x16'):
            try:
                ssl_sock = ssl.wrap_socket(self.connection, keyfile=CertUtil.cert_keyfile, certfile=certfile, server_side=True)
            except ssl.SSLError as e:
                xlog.info('ssl error: %s, create full domain cert for host:%s', e, host)
                certfile = CertUtil.get_cert(host, full_name=True)
                return
            except Exception as e:
                if e.args[0] not in (errno.ECONNABORTED, errno.ECONNRESET):
                    xlog.exception('ssl.wrap_socket(self.connection=%r) failed: %s path:%s, errno:%s', self.connection, e, self.path, e.args[0])

View on GitHub (pinned to cfa5bc17b6)

Solutions

Route non-80/443 traffic outside the proxy: unset http_proxy/https_proxy for that tool or bypass the proxy for the host
For SSH-over-HTTPS use an HTTP CONNECT-compatible endpoint on port 443 instead
Extend the allowed port tuple in do_CONNECT only if you control a tunnel that supports it (not possible with plain GAE)
Set the application's proxy exceptions to exclude the target host:port

Example fix

# before
ssh -o ProxyCommand='nc -X connect -x 127.0.0.1:8087 %h %p' user@host  # host:22 -> not support

# after
# don't proxy ssh; or use an https-tunnel endpoint on 443
ssh user@host  # direct, no proxy

Defensive patterns

Strategy: validation

Validate before calling

port = int(self.path.rpartition(b':')[2])
if port not in (80, 443):
    self.send_error(403, 'Port not supported via GAE')
    return

Prevention

Configure client proxy exceptions for non-HTTP ports (ssh, git, smtp)
Educate users: GAE tunneling only supports 80/443
Use an HTTP-CONNECT-capable tunnel on 443 for arbitrary ports

When it happens

Trigger: A client issues CONNECT host:port with port outside (80, 443) — e.g. ssh over 22, git ssh github.com:22, smtp 587, or websockets on 8443 — through the local GAE proxy.

Common situations: git clone git@... using SSH while the system proxy env points at GAEProxy; CLI tools (ssh, ftp, imap) inheriting HTTP proxy settings; development servers on odd ports being tunneled. Not a bug: a design limitation of the GAE transport.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/2c2a0537db1adf3a. Report an issue: GitHub.