Download Failures or Disconnected Agents Due To WinHttpSendRequest Error 12002

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Endpoint symptoms may include:
  • Using dascli status the result includes:

    Connection: Disconnected(Security Error)

  • Disconnected Agent Logs reveal messages similar to the following in the Trace.bt9 file:
    

    Server Communication: WinHTTP communication error: 12002

• Results in Console may include:
• Errors when attempting to download the Agent upgrade package, similar to:

  Failed to download upgrade package: https://ServerAddress/hostpkg/pkg.php?pkg=/ParityHostAgent.msi. WinHttpReadData Error[12002]

• Errors when attempting to download some other file from the Resource Download Location (RDL), similar to:

  Failed to download Server Cert List file from URL [https://ServerAddress/hostpkg/pkg.php?pkg=TrustedCertList.pem]: Error[WinHttpSendRequest Error[12002:]]. Options[00000003] TotalFailures[1] FailureId[961]

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

Microsoft defines the WinHttp Error 12002 as:

ERROR_WINHTTP_TIMEOUT: 12002
The request has timed out.

This error can be returned as a result of TCP/IP time-out behavior, regardless of time-out values set in Windows HTTP Services.

Typically this happens when the endpoint encountered a network timeout while attempting to access the files on the Resource Download Location.

In many cases this is due to a Firewall or Proxy blocking the communication.

Resolution

1. Verify the Resource Download Location (RDL) specified is correct and traffic is not blocked by the firewall.
2. Log in to the endpoint encountering the error and use a browser to validate the file exists and can be downloaded (without error), example:

   https://ServerAddress/hostpkg/pkg.php?pkg=ParityHostAgent.msi
   https://ServerAddress/packages/trustedcertlist.pem

3. Test the Agent Network Connectivity
4. If a Proxy is in use:
   • The Agent does not officially support a Proxy and a bypass to the Server Address/RDL may be required.
   • The Agent is currently still a 32-bit application, and uses the 32-bit Proxy settings.
   • Use an administrative command prompt on the endpoint to verify a Bypass exists:

     cd C:\Windows\SysWOW64\
     netsh winhttp show proxy

   • If a Bypass does not exist, add one:

     netsh winhttp set proxy proxy-server="<proxyservername>" bypass-list=<appserver.domain.com>;<Existing Bypass Lists>

   • A reboot may be required to restore the connection.
5. Perform the relevant task manually on the endpoint:
   • Manually upgrade the Agent.
   • Manually import the TrustedCertList.pem or Keychain.json file(s).
   • Manually import the Yara file.

Additional Information

Certain Proxies may also require the ports be added to the address in the Bypass List, example:

Server Address:
appserver.domain.com:41002 
appserver.domain.com:443