XX-net/XX-Net · error

do_unwrap_socks ssl_wrap for

Error message

do_unwrap_socks ssl_wrap for %s:%d proxy fail.

What it means

TLS wrap (ssl_context.wrap_socket with server_hostname=host) of the freshly created SOCKS connection failed, so the unwrap path aborts.

Solutions

1. Inspect the swallowed exception (log it instead of bare except) to get the exact ssl.SSLError
2. Update CA bundle / system certificates
3. If the target's TLS is trusted-but-odd, adjust the ssl_context purpose or disable hostname checks deliberately
4. Verify the host supports the TLS version/ciphers in ssl_context

Example fix

# before
except:
    xlog.warn("do_unwrap_socks ssl_wrap for %s:%d proxy fail.", host, port)
# after
except ssl.SSLError as e:
    xlog.warn("do_unwrap_socks ssl_wrap for %s:%d proxy fail:%r", host, port, e)

import ssl; ctx.get_ca_certs()  # ensure CA bundle loaded before wrap

def can_tls(host): return ssl.create_default_context().wrap_socket ...

except ssl.SSLError as e: log repr(e); fall back or adjust context (CA/TLS version).

When it happens

Trigger: SSL handshake failure during wrap_socket: certificate verification error, TLS version/cipher mismatch with host, or the peer resetting during handshake.

Common situations: Missing root CAs in the runtime, self-signed/misconfigured target cert, Python/OpenSSL TLS policy changes, SNI-required server rejecting the handshake.

Related errors

• add_sock_event conn: e:%r
• api: fail
• api: fail: t
• api: parse json: fail:%r
• check_appid %r

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/bd1f6423d28a641b. Report an issue: GitHub.

Appendix: source

Thrown at code/default/smart_router/local/smart_route.py:278

def do_unwrap_socks(sock, host, port, client_address, req, left_buf=b""):
    if not g.x_tunnel:
        return

    try:
        remote_sock = socks.create_connection(
            (host, port),
            proxy_type="socks5h", proxy_addr="127.0.0.1", proxy_port=g.x_tunnel_socks_port, timeout=15
        )
    except Exception as e:
        xlog.warn("do_unwrap_socks connect to x-tunnel for %s:%d proxy fail.", host, port)
        return

    if isinstance(req.connection, ssl.SSLSocket):
        try:
            remote_ssl_sock = ssl_context.wrap_socket(remote_sock, server_hostname=host)
        except:
            xlog.warn("do_unwrap_socks ssl_wrap for %s:%d proxy fail.", host, port)
            return
    else:
        remote_ssl_sock = remote_sock

    # avoid close by req.__del__
    req.rfile._close = False
    req.wfile._close = False
    req.connection = None

    if not isinstance(sock, SocketWrap):
        sock = SocketWrap(sock, client_address[0], client_address[1])

    xlog.info("host:%s:%d do_unwrap_socks", host, port)

    remote_ssl_sock.send(left_buf)
    sw = SocketWrap(remote_ssl_sock, "x-tunnel", port, host)
    sock.recved_times = 3
    g.pipe_socks.add_socks(sock, sw)

View on GitHub (pinned to cfa5bc17b6)