What causes "app check except:%r" in XX-net/XX-Net?

Inspect the %r representation in the log to identify the exception class

app check except:%r

Error message

app check except:%r

What it means

Unexpected exception during the app-check request/content processing in check_response (not one of the tolerated connection errors). The exception is logged with %r and the IP check returns False.

Source

Thrown at code/default/gae_proxy/local/check_ip.py:75

        if response.status in [503, 500]:
            # out of quota
            if b"gws" not in server_type and b"Google Frontend" not in server_type and b"GFE" not in server_type:
                xlog.warn("%d but server type:%s", response.status, server_type)
                return False
            else:
                return True

        try:
            content = response.read()
        except Exception as e:
            if sys.version_info[0] == 3 and (
                    isinstance(e, ConnectionError) or
                    isinstance(e, ConnectionResetError) or
                    isinstance(e, BrokenPipeError)
            ):
                return False

            self.logger.warn("app check except:%r", e)
            return False

        if self.config.check_ip_content not in content:
            self.logger.warn("app check content:%s", content)
            return False

        return True


class CheckAllIp(object):

    def __init__(self):
        ca_certs = os.path.join(current_path, "cacert.pem")
        openssl_context = SSLContext(
            logger, ca_certs=ca_certs,
            cipher_suites=[b'ALL', b"!RC4-SHA", b"!ECDHE-RSA-RC4-SHA", b"!ECDHE-RSA-AES128-GCM-SHA256",
                           b"!AES128-GCM-SHA256", b"!ECDHE-RSA-AES128-SHA", b"!AES128-SHA"]
        )

View on GitHub (pinned to cfa5bc17b6)

Solutions

Inspect the %r representation in the log to identify the exception class
Update XX-Net — known checker bugs are fixed over versions
If SSL-related, verify openssl/pyopenssl compatibility
Report recurring unexpected exception types upstream

Defensive patterns

Strategy: try-catch

Try / catch

try:
    ok = check_ip.check_ip(ip)
except Exception as e:
    log.debug('skip ip %s: %r', ip, e)
    continue

Prevention

Treat checker exceptions as per-IP skips, not crashes
Keep SSL libs updated
Log exception types to spot environment problems

When it happens

Trigger: check_ip raising non-connection exceptions: SSL errors, timeouts of unexpected types, decode errors, or library bugs while reading/validating the check response.

Common situations: SSL handshake anomalies on blocked IPs, Python/network library edge cases, or changes in the check endpoint response format.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/23a6d3e0b31813ab. Report an issue: GitHub.