{"record":{"id":"bd1f6423d28a641b","repo":"XX-net/XX-Net","slug":"do-unwrap-socks-ssl-wrap-for-s-d-proxy-fail","errorCode":null,"errorMessage":"do_unwrap_socks ssl_wrap for %s:%d proxy fail.","messagePattern":"do_unwrap_socks ssl_wrap for (.+?):(.+?) proxy fail\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"code/default/smart_router/local/smart_route.py","lineNumber":278,"sourceCode":"\ndef do_unwrap_socks(sock, host, port, client_address, req, left_buf=b\"\"):\n    if not g.x_tunnel:\n        return\n\n    try:\n        remote_sock = socks.create_connection(\n            (host, port),\n            proxy_type=\"socks5h\", proxy_addr=\"127.0.0.1\", proxy_port=g.x_tunnel_socks_port, timeout=15\n        )\n    except Exception as e:\n        xlog.warn(\"do_unwrap_socks connect to x-tunnel for %s:%d proxy fail.\", host, port)\n        return\n\n    if isinstance(req.connection, ssl.SSLSocket):\n        try:\n            remote_ssl_sock = ssl_context.wrap_socket(remote_sock, server_hostname=host)\n        except:\n            xlog.warn(\"do_unwrap_socks ssl_wrap for %s:%d proxy fail.\", host, port)\n            return\n    else:\n        remote_ssl_sock = remote_sock\n\n    # avoid close by req.__del__\n    req.rfile._close = False\n    req.wfile._close = False\n    req.connection = None\n\n    if not isinstance(sock, SocketWrap):\n        sock = SocketWrap(sock, client_address[0], client_address[1])\n\n    xlog.info(\"host:%s:%d do_unwrap_socks\", host, port)\n\n    remote_ssl_sock.send(left_buf)\n    sw = SocketWrap(remote_ssl_sock, \"x-tunnel\", port, host)\n    sock.recved_times = 3\n    g.pipe_socks.add_socks(sock, sw)","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/smart_router/local/smart_route.py#L260-L296","documentation":"TLS wrap (ssl_context.wrap_socket with server_hostname=host) of the freshly created SOCKS connection failed, so the unwrap path aborts.","triggerScenarios":"SSL handshake failure during wrap_socket: certificate verification error, TLS version/cipher mismatch with host, or the peer resetting during handshake.","commonSituations":"Missing root CAs in the runtime, self-signed/misconfigured target cert, Python/OpenSSL TLS policy changes, SNI-required server rejecting the handshake.","solutions":["Inspect the swallowed exception (log it instead of bare except) to get the exact ssl.SSLError","Update CA bundle / system certificates","If the target's TLS is trusted-but-odd, adjust the ssl_context purpose or disable hostname checks deliberately","Verify the host supports the TLS version/ciphers in ssl_context"],"exampleFix":"# before\nexcept:\n    xlog.warn(\"do_unwrap_socks ssl_wrap for %s:%d proxy fail.\", host, port)\n# after\nexcept ssl.SSLError as e:\n    xlog.warn(\"do_unwrap_socks ssl_wrap for %s:%d proxy fail:%r\", host, port, e)","handlingStrategy":"try-catch","validationCode":"import ssl; ctx.get_ca_certs()  # ensure CA bundle loaded before wrap","typeGuard":"def can_tls(host): return ssl.create_default_context().wrap_socket ...","tryCatchPattern":"except ssl.SSLError as e: log repr(e); fall back or adjust context (CA/TLS version).","preventionTips":["Keep system CA store updated","Log the real exception instead of bare except","Test handshake with openssl s_client when debugging"],"tags":["ssl","tls","handshake","x-tunnel"],"backgroundTag":"ssl-handshake-failure","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}