What causes "ip not support GAE" in XX-net/XX-Net?

Let the IP manager rescan / remove bad IPs; restart XX-Net to trigger re-scanning

XX-net/XX-Net · error · GAE_Exception

602

602

Error message

ip not support GAE

What it means

GAE_Exception 602 raised when the responding server is not a Google frontend: the Server header lacks 'gws'/'Google Frontend'/'GFE', or status is 403/405. The IP connects but cannot serve GAE, so the worker is closed and the IP is effectively rejected for GAE use.

Source

Thrown at code/default/gae_proxy/local/gae_handler.py:361

            xlog.warning('APPID %r out of Quota, remove it. %s',
                         appid, response.ssl_sock.ip_str)
            front.appid_manager.report_out_of_quota(appid)
            # google_ip.report_connect_closed(response.ssl_sock.ip_str, "out of quota")
            response.worker.close("appid out of quota:%s" % appid)
            raise GAE_Exception(604, "appid out of quota:%s" % appid)

        server_type = response.getheader(b"Server", b"")
        if (b"gws" not in server_type and b"Google Frontend" not in server_type and b"GFE" not in server_type) or \
                response.status == 403 or response.status == 405:

            # some ip can connect, and server type can be gws
            # but can't use as GAE server
            # so we need remove it immediately

            xlog.warn("IP:%s not support GAE, headers:%s status:%d", response.ssl_sock.ip_str, response.headers,
                      response.status)
            response.worker.close("ip not support GAE")
            raise GAE_Exception(602, "ip not support GAE")

        response.gps = response.getheader(b"x-server", b"")

        if response.status > 300:
            raise GAE_Exception(605, "status:%d" % response.status)

        if response.status != 200:
            xlog.warn("GAE %s appid:%s status:%d", response.ssl_sock.ip_str,
                      appid, response.status)

        return response
    except GAE_Exception as e:
        if e.error_code not in (600, 603, 604) and hasattr(response, "ssl_sock"):
            front.ip_manager.recheck_ip(response.ssl_sock.ip_str, first_report=False)
        raise e


def request_gae_proxy(method, url, headers, body, timeout=None):

View on GitHub (pinned to cfa5bc17b6)

Solutions

Let the IP manager rescan / remove bad IPs; restart XX-Net to trigger re-scanning
Verify the IP actually belongs to Google (whois / curl to https://ip)
Update XX-Net — IP evaluation logic improves over versions
Use a cleaner network path (different ISP route, VPN) if hijacking is systematic

Defensive patterns

Strategy: retry

Try / catch

try:
    resp = request_gae_proxy(...)
except GAE_Exception as e:
    if e.code == 602:  # non-Google server; retry picks another IP
        report_bad_ip_current()
        resp = request_gae_proxy(...)
    else:
        raise

Prevention

Trust the built-in Server-header validation; never disable it
Use uncensored DNS to reduce landing on hijacked IPs
Periodically let the IP scanner re-qualify the pool

When it happens

Trigger: request_gae_proxy landing on a non-Google server (hijacked IP, wrong scan result), or a Google IP that refuses the GAE app path with 403/405. The check runs on every response's Server header.

Common situations: DNS poisoning / IP hijack returning a captive portal, CDN or other service occupying the IP, GFW interference, IP ranges reassigned away from Google.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/7562f9bf8fccd046. Report an issue: GitHub.