What causes "app check content:%s" in XX-net/XX-Net?

Update XX-Net so check_ip_url/check_ip_content match current GFE behavior

app check content:%s

Error message

app check content:%s

What it means

The check request succeeded and content was read, but the expected marker (config.check_ip_content) is not present in the response body — the IP responded but not with a genuine GFE app-check reply. IP is rejected.

Source

Thrown at code/default/gae_proxy/local/check_ip.py:79

                return False
            else:
                return True

        try:
            content = response.read()
        except Exception as e:
            if sys.version_info[0] == 3 and (
                    isinstance(e, ConnectionError) or
                    isinstance(e, ConnectionResetError) or
                    isinstance(e, BrokenPipeError)
            ):
                return False

            self.logger.warn("app check except:%r", e)
            return False

        if self.config.check_ip_content not in content:
            self.logger.warn("app check content:%s", content)
            return False

        return True


class CheckAllIp(object):

    def __init__(self):
        ca_certs = os.path.join(current_path, "cacert.pem")
        openssl_context = SSLContext(
            logger, ca_certs=ca_certs,
            cipher_suites=[b'ALL', b"!RC4-SHA", b"!ECDHE-RSA-RC4-SHA", b"!ECDHE-RSA-AES128-GCM-SHA256",
                           b"!AES128-GCM-SHA256", b"!ECDHE-RSA-AES128-SHA", b"!AES128-SHA"]
        )
        host_manager = HostManager()
        connect_creator = ConnectCreator(logger, config, openssl_context, host_manager,
                                         debug=True)
        self.check_ip = CheckIp(logger, config, connect_creator)

View on GitHub (pinned to cfa5bc17b6)

Solutions

Update XX-Net so check_ip_url/check_ip_content match current GFE behavior
If all IPs fail content check, suspect response injection — test from another network
Manually curl the check URL from a good IP to see what content is returned
Refill the IP list with fresh scanned ranges

Defensive patterns

Strategy: validation

Prevention

Keep check_ip_url/content config updated with the deployed version
Verify check endpoint manually when all IPs fail content check
Watch for injected responses on hostile networks

When it happens

Trigger: check_ip hitting an endpoint whose 200-response body lacks the expected content string — spoofed responses, hijacked DNS/IP, or Google changing the check URL's response.

Common situations: Firewall/ISP injecting fake 200 pages, GFE behavior change requiring a new check URL/content, or proxy interference.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/eab9bf9d0c879338. Report an issue: GitHub.