{"record":{"id":"2c2a0537db1adf3a","repo":"XX-net/XX-Net","slug":"connect-s-port-d-not-support","errorCode":null,"errorMessage":"CONNECT %s port:%d not support","messagePattern":"CONNECT (.+?) port:(.+?) not support","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"code/default/gae_proxy/local/proxy_handler.py","lineNumber":175,"sourceCode":"\n        for s in hosts:\n            s = s.lower()\n            if s.startswith(b'127.') \\\n                    or s.startswith(b'192.168.') \\\n                    or s.startswith(b'10.') \\\n                    or s.startswith(b'169.254.') \\\n                    or s in self.local_names:\n                # xlog.debug(s)\n                return True\n\n        return False\n\n    def do_CONNECT(self):\n        \"\"\"deploy fake cert to client\"\"\"\n        host, _, port = self.path.rpartition(b':')\n        port = int(port)\n        if port not in (80, 443):\n            xlog.warn(\"CONNECT %s port:%d not support\", host, port)\n            return\n\n        certfile = CertUtil.get_cert(host)\n        self.wfile.write(b'HTTP/1.1 200 Connection Established\\r\\n\\r\\n')\n        self.wfile.flush()\n        #self.conntunnel = True\n \n        leadbyte = self.connection.recv(1, socket.MSG_PEEK)\n        if leadbyte in (b'\\x80', b'\\x16'):\n            try:\n                ssl_sock = ssl.wrap_socket(self.connection, keyfile=CertUtil.cert_keyfile, certfile=certfile, server_side=True)\n            except ssl.SSLError as e:\n                xlog.info('ssl error: %s, create full domain cert for host:%s', e, host)\n                certfile = CertUtil.get_cert(host, full_name=True)\n                return\n            except Exception as e:\n                if e.args[0] not in (errno.ECONNABORTED, errno.ECONNRESET):\n                    xlog.exception('ssl.wrap_socket(self.connection=%r) failed: %s path:%s, errno:%s', self.connection, e, self.path, e.args[0])","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/gae_proxy/local/proxy_handler.py#L157-L193","documentation":"do_CONNECT received a CONNECT tunnel request for a port other than 80 or 443. The GAE proxy only supports tunneling HTTP/HTTPS over those ports, so it logs the host/port and returns without establishing the tunnel (client gets no 200).","triggerScenarios":"A client issues CONNECT host:port with port outside (80, 443) — e.g. ssh over 22, git ssh github.com:22, smtp 587, or websockets on 8443 — through the local GAE proxy.","commonSituations":"git clone git@... using SSH while the system proxy env points at GAEProxy; CLI tools (ssh, ftp, imap) inheriting HTTP proxy settings; development servers on odd ports being tunneled. Not a bug: a design limitation of the GAE transport.","solutions":["Route non-80/443 traffic outside the proxy: unset http_proxy/https_proxy for that tool or bypass the proxy for the host","For SSH-over-HTTPS use an HTTP CONNECT-compatible endpoint on port 443 instead","Extend the allowed port tuple in do_CONNECT only if you control a tunnel that supports it (not possible with plain GAE)","Set the application's proxy exceptions to exclude the target host:port"],"exampleFix":"# before\nssh -o ProxyCommand='nc -X connect -x 127.0.0.1:8087 %h %p' user@host  # host:22 -> not support\n\n# after\n# don't proxy ssh; or use an https-tunnel endpoint on 443\nssh user@host  # direct, no proxy","handlingStrategy":"validation","validationCode":"port = int(self.path.rpartition(b':')[2])\nif port not in (80, 443):\n    self.send_error(403, 'Port not supported via GAE')\n    return","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure client proxy exceptions for non-HTTP ports (ssh, git, smtp)","Educate users: GAE tunneling only supports 80/443","Use an HTTP-CONNECT-capable tunnel on 443 for arbitrary ports"],"tags":["http-proxy","connect-tunnel","port-restriction"],"backgroundTag":"proxy-connect-port-not-allowed","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}