diff --git a/.gitignore b/.gitignore
index e738d00..8a5600d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ dep
 .idea
 proxy-multi.conf
 proxy-secret
+_codeql_detected_source_root
diff --git a/net/net-tcp-rpc-ext-server.c b/net/net-tcp-rpc-ext-server.c
index 636bfc6..5e9b4eb 100644
--- a/net/net-tcp-rpc-ext-server.c
+++ b/net/net-tcp-rpc-ext-server.c
@@ -1315,8 +1315,8 @@ int tcp_rpcs_compact_parse_execute (connection_job_t C) {
         unsigned tag = *(unsigned *)(random_header + 56);
 
         if (tag == 0xdddddddd || ((tag == 0xeeeeeeee || tag == 0xefefefef) && !ext_rand_pad_only)) {
-          if (tag != 0xdddddddd && allow_only_tls) {
-            vkprintf (1, "Expected random padding mode\n");
+          if (tag == 0xdddddddd && allow_only_tls) {
+            vkprintf (1, "Expected Fake-TLS mode (EE/EF), got random padding mode (DD)\n");
             RETURN_TLS_ERROR(default_domain_info);
           }
           assert (rwm_skip_data (&c->in, 64) == 64);