XX-net/XX-Net · warning · DontFakeCA

DontFakeCA

Error message

DontFakeCA

What it means

do_gae raises DontFakeCA when the GAE proxy component (g.gae_proxy) is not loaded, meaning the request cannot be served via GAE. The name is historical: the GAE path requires the fake-CA/SSL capability, and without g.gae_proxy none of that machinery exists, so the router must fall back to another strategy.

Source

Thrown at code/default/smart_router/local/smart_route.py:301

    # avoid close by req.__del__
    req.rfile._close = False
    req.wfile._close = False
    req.connection = None

    if not isinstance(sock, SocketWrap):
        sock = SocketWrap(sock, client_address[0], client_address[1])

    xlog.info("host:%s:%d do_unwrap_socks", host, port)

    remote_ssl_sock.send(left_buf)
    sw = SocketWrap(remote_ssl_sock, "x-tunnel", port, host)
    sock.recved_times = 3
    g.pipe_socks.add_socks(sock, sw)


def do_gae(sock, host, port, client_address, left_buf=""):
    if not g.gae_proxy:
        raise DontFakeCA()

    sock.setblocking(1)
    if left_buf:
        schema = b"http"
    else:
        leadbyte = sock.recv(1, socket.MSG_PEEK)
        if leadbyte in (b'\x80', b'\x16'):
            if host != fake_host and not g.config.enable_fake_ca:
                raise DontFakeCA()

            try:
                sock._sock = g.gae_proxy.proxy_handler.wrap_ssl(sock._sock, host, port, client_address)
            except Exception as e:
                raise SslWrapFail()

            schema = b"https"
        else:
            schema = b"http"

View on GitHub (pinned to cfa5bc17b6)

Solutions

1. Ensure the GAE proxy module is properly installed/initialized so g.gae_proxy is set
2. Fix whatever import/init failure prevented the GAE proxy from loading (check startup logs)
3. Update smart_router rules to not route via GAE when it is unavailable
4. Catch DontFakeCA and fall back to direct/X-Tunnel strategies

if not getattr(g, 'gae_proxy', None):
    skip_strategy('gae')  # don't include GAE in rule_list

def gae_available() -> bool:
    return getattr(g, 'gae_proxy', None) is not None

try:
    do_gae(...)
except DontFakeCA:
    try_next_strategy(sock, host, port)

When it happens

Trigger: Routing a request to the GAE strategy via try_loop when g.gae_proxy is None — e.g. GAE proxy module not initialized in this build or disabled in config.

Common situations: Running a build/deployment where the GAE proxy module was removed or failed to import, or config disables GAE while routing rules still reference it.

Related errors

• time out
• 600
• fetch gae fail:%d
• 602
• 605

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/34a4415385803966. Report an issue: GitHub.