XX-net/XX-Net · warning

%s domain:%s fail:%r

Error message

%s domain:%s fail:%r

What it means

During try_loop, the GAE/direct attempt for a domain raised SslWrapFail or ParseReqFail. The domain is reported as GAE-denied (cached) and the socket is closed — routing stops for this request.

Source

Thrown at code/default/smart_router/local/smart_route.py:439

                    do_gae(sock, host, port, client_address, left_buf)
                    return
                except DontFakeCA:
                    continue
                except NotSupported as e:
                    req = e.req
                    left_bufs = [req.raw_requestline]
                    for k in req.headers:
                        v = req.headers[k]
                        left_bufs.append(b"%s: %s\r\n" % (k, v))
                    left_bufs.append(b"\r\n")
                    left_buf = b"".join(left_bufs)

                    return do_unwrap_socks(e.sock, host, port, client_address, req, left_buf=left_buf)
                except SniNotExist:
                    xlog.debug("%s domain:%s get sni fail", scense, host)
                    continue
                except (SslWrapFail, simple_http_server.ParseReqFail) as e:
                    xlog.warn("%s domain:%s fail:%r", scense, host, e)
                    g.domain_cache.report_gae_deny(host, port)
                    sock.close()
                    return
                except simple_http_server.GetReqTimeout:
                    # Happen sometimes, don't known why.
                    xlog.debug("%s host:%s:%d try gae, GetReqTimeout:%d", scense, host, port,
                             (time.time() - start_time) * 1000)
                    sock.close()
                    return
                except Exception as e:
                    xlog.exception("%s host:%s:%d rule:%s except:%r", scense, host, port, rule, e)
                    g.domain_cache.report_gae_deny(host, port)
                    sock.close()
                    return

            elif rule == "socks":
                if not g.x_tunnel or not g.x_tunnel.proxy_session.login_process():
                    continue

View on GitHub (pinned to cfa5bc17b6)

Solutions

1. Check the domain's TLS configuration with openssl s_client -connect host:443 -servername host
2. Clear/inspect domain_cache so a transient deny is not sticky
3. Adjust the ssl_context (CA bundle, TLS versions) used for wrapping
4. Route this domain via a different rule (proxy/direct) explicitly

openssl s_client check or a pre-flight TLS probe before committing the route

Catch (SslWrapFail, ParseReqFail); report deny to cache and try another transport.

When it happens

Trigger: An SSL wrap failure or HTTP request-parse failure occurs while attempting the connection for host; caught as (SslWrapFail, simple_http_server.ParseReqFail).

Common situations: Target site with broken TLS (bad cert chain, TLS-version-only endpoints), server sending non-HTTP responses, or interference dropping/mangling the handshake.

Related errors

• check_appid %s %r
• gae send response fail. %r
• test appid %s status:%d
• DnsOverTlsQuery connect %s %s:%d fail:%r
• do_unwrap_socks ssl_wrap for %s:%d proxy fail.

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/85889d5a459243eb. Report an issue: GitHub.