XX-net/XX-Net · error

do_unwrap_socks ssl_wrap for %s:%d proxy fail.

Error message

do_unwrap_socks ssl_wrap for %s:%d proxy fail.

What it means

TLS wrap (ssl_context.wrap_socket with server_hostname=host) of the freshly created SOCKS connection failed, so the unwrap path aborts.

Source

Thrown at code/default/smart_router/local/smart_route.py:278

def do_unwrap_socks(sock, host, port, client_address, req, left_buf=b""):
    if not g.x_tunnel:
        return

    try:
        remote_sock = socks.create_connection(
            (host, port),
            proxy_type="socks5h", proxy_addr="127.0.0.1", proxy_port=g.x_tunnel_socks_port, timeout=15
        )
    except Exception as e:
        xlog.warn("do_unwrap_socks connect to x-tunnel for %s:%d proxy fail.", host, port)
        return

    if isinstance(req.connection, ssl.SSLSocket):
        try:
            remote_ssl_sock = ssl_context.wrap_socket(remote_sock, server_hostname=host)
        except:
            xlog.warn("do_unwrap_socks ssl_wrap for %s:%d proxy fail.", host, port)
            return
    else:
        remote_ssl_sock = remote_sock

    # avoid close by req.__del__
    req.rfile._close = False
    req.wfile._close = False
    req.connection = None

    if not isinstance(sock, SocketWrap):
        sock = SocketWrap(sock, client_address[0], client_address[1])

    xlog.info("host:%s:%d do_unwrap_socks", host, port)

    remote_ssl_sock.send(left_buf)
    sw = SocketWrap(remote_ssl_sock, "x-tunnel", port, host)
    sock.recved_times = 3
    g.pipe_socks.add_socks(sock, sw)

View on GitHub (pinned to cfa5bc17b6)

Solutions

1. Inspect the swallowed exception (log it instead of bare except) to get the exact ssl.SSLError
2. Update CA bundle / system certificates
3. If the target's TLS is trusted-but-odd, adjust the ssl_context purpose or disable hostname checks deliberately
4. Verify the host supports the TLS version/ciphers in ssl_context

Example fix

# before
except:
    xlog.warn("do_unwrap_socks ssl_wrap for %s:%d proxy fail.", host, port)
# after
except ssl.SSLError as e:
    xlog.warn("do_unwrap_socks ssl_wrap for %s:%d proxy fail:%r", host, port, e)

import ssl; ctx.get_ca_certs()  # ensure CA bundle loaded before wrap

def can_tls(host): return ssl.create_default_context().wrap_socket ...

except ssl.SSLError as e: log repr(e); fall back or adjust context (CA/TLS version).

When it happens

Trigger: SSL handshake failure during wrap_socket: certificate verification error, TLS version/cipher mismatch with host, or the peer resetting during handshake.

Common situations: Missing root CAs in the runtime, self-signed/misconfigured target cert, Python/OpenSSL TLS policy changes, SNI-required server rejecting the handshake.

Related errors

• XTunnelNotRunning
• SslWrapFail
• ConnectionPipe remove sock e:%r
• proxy handler read error %r
• login session server is down, try get new server.

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/bd1f6423d28a641b. Report an issue: GitHub.