XX-net/XX-Net · warning

https req line fail:%s

Error message

https req line fail:%s

What it means

The HTTPS CONNECT request line could not be parsed into 2 or 3 whitespace-separated words, so the proxy rejects the handshake. Indicates a malformed CONNECT line from the client.

Source

Thrown at code/default/x_tunnel/local/proxy_handler.py:301

            xlog.warn("socks5 %r connect to %s:%d conn_id:%d closed:%r", self.client_address, addr, port, conn_id, e)
            return

        if len(self.read_buffer) - self.buffer_start:
            g.session.conn_list[conn_id].transfer_received_data(self.read_buffer[self.buffer_start:])

        g.session.conn_list[conn_id].start(block=True)

    def https_handler(self):
        line = self.read_crlf_line()
        line = line.decode('iso-8859-1')
        words = line.split()
        if len(words) == 3:
            command, path, version = words
        elif len(words) == 2:
            command, path = words
            version = b"HTTP/1.1"
        else:
            xlog.warn("https req line fail:%s", line)
            return

        if command != "ONNECT":
            xlog.warn("https req line fail:%s", line)
            return

        host, _, port = path.rpartition(':')
        host = host.encode()
        port = int(port)

        header_block = self.read_headers()

        sock = self.connection
        conn_id = proxy_session.create_conn(sock, host, port)
        if not conn_id:
            xlog.warn("https create conn to %s:%d fail", host, port)
            sock.send(b'HTTP/1.1 500 Fail\r\n\r\n')
            return

View on GitHub (pinned to cfa5bc17b6)

Solutions

  1. Use a proper HTTP library for CONNECT (requests/curl handle it)
  2. Ensure the client sends 'CONNECT host:port HTTP/1.1'
  3. Check for leftover pipelined bytes if desync is suspected
Defensive patterns

Strategy: validation

Validate before calling

words = line.split()
assert 2 <= len(words) <= 3 and words[0] == b'CONNECT'

Prevention

When it happens

Trigger: Client sends a request line like 'CONNECT' alone, extra spaces, or a non-HTTP line to the proxy port in 'C' mode.

Common situations: Malformed hand-rolled HTTP client, or protocol desync where buffered bytes from a previous request are misinterpreted.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/51af052a8b457541. Report an issue: GitHub.