Bug 8325 - McAfee firewall: operation attempted on something not a socket. winnt_accept: AcceptEx failed
Summary: McAfee firewall: operation attempted on something not a socket. winnt_accept:...
Status: CLOSED FIXED
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: All (show other bugs)
Version: 2.0.40
Hardware: PC Windows XP
: P3 blocker with 4 votes (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL: http://cvs.apache.org/viewcvs.cgi/htt...
Keywords: FAQ
: 11608 13083 14812 14828 16089 16327 17099 17738 17765 21579 22081 23206 23300 23689 (view as bug list)
Depends on:
Blocks:
 
Reported: 2002-04-20 01:57 UTC by Paul Postuma
Modified: 2014-02-17 13:58 UTC (History)
15 users (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Paul Postuma 2002-04-20 01:57:02 UTC
Running Apache 2.0.36 dev. 4-17-1800Z - which got me past bug #7910 -
The Apache service now starts. Hurrah. But then goes nowhere. Error log reports:

[Fri Apr 19 10:48:28 2002] [notice] Parent: Created child process 2452
[Fri Apr 19 10:48:29 2002] [notice] Child 2452: Child process is running
[Fri Apr 19 10:48:29 2002] [notice] Child 2452: Acquired the start mutex.
[Fri Apr 19 10:48:29 2002] [notice] Child 2452: Starting 10 worker threads.
[Fri Apr 19 10:48:29 2002] [error] (32538)An operation was attempted on
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting to
recover.

Happens both with & without McAfee firewall loaded.
Comment 1 William A. Rowe Jr. 2002-05-15 03:23:37 UTC
  Please upgrade to 2.0.36 and try again.  If that doesn't work...

  Then please detail what your network driver stack looks like...

  Start ... Settings ... Control Panel ... Network Connections ...

  Right click -> Properties for your network connection (General tab)

  Choose Internet Protocol (TCP/IP) and click Properties, then Advanced.

  Go to the Options tab and please tell us which Optional Settings are
  in that list, and how they are set.  Let us know if there are any QoS
  (Quality Of Service) drivers.  [You might try removing QoS and see if
  your problem goes away.]

Comment 2 William A. Rowe Jr. 2002-05-30 05:56:50 UTC
  No response to request, presuming the issue is closed.

  Please reopen if you can reproduce on 2.0.37 which should release next week.
  Identify any firewall software you may have installed.
Comment 3 Kevin Osborn 2002-08-30 18:53:20 UTC
Here is some more information. I have two computers, a laptop and a desktop, 
both running Windows 2000 Professional and Service Pack 2. Both are fresh 
installs of Apache 2.0.40 with no extra modules.

This started on my laptop. I had IIS 5.0 running (worked fine). I uninstalled 
IIS, and installed Apache 2.0.40 instead. As soon as it started running, I 
noticed my hard disk kept on spinning. Sure enough, the error log was full of 
these messages:

[error] (32358)An operation was attempted on something that is not a 
socket.   : winnt_accept: AcceptEx failed. Attempting to recover.

These message kept on appearing until I stopped Apache. I also verified that I 
could telnet to port 80, but I could not display a web page in my browser.

Since it was asked, my TCP/IP Advanced Options have IP secuirty turned off and 
TCP/IP filtering turned off and set to Permit All.

I have also since upgraded to Service Pack 3 on my laptop, but nothing worked.

On my desktop, I installed Apache and did not have any problems. Except for the 
different IP addresses, these were identical installations. So, there seems to 
be something in my system that is affecting Apache. However, I have seen many 
messages on newsgroups that lead me to believe it is a common enough problem.

Let me know if there is any assistance I can offer.
Comment 4 webmaster 2002-09-19 19:13:03 UTC
I have the same issue when attempting to run Apache 2.0.40 on a Windows XP 
machine. Apache 1.3.26 runs fine on the same machine. This issue does occur 
with AND without a firewall running. TCP/IP filtering is disabled and I know 
of no QoS drivers on this machine. The following is from my error log:

[Thu Sep 19 12:28:27 2002] [notice] Parent: Created child process 3296
[Thu Sep 19 12:28:29 2002] [notice] Child 3296: Child process is running
[Thu Sep 19 12:28:29 2002] [notice] Child 3296: Acquired the start mutex.
[Thu Sep 19 12:28:29 2002] [notice] Child 3296: Starting 250 worker threads.
[Thu Sep 19 12:28:29 2002] [error] (32538)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
[Thu Sep 19 12:28:30 2002] [error] (32538)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
[Thu Sep 19 12:28:30 2002] [error] (32538)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
.
.
.
Comment 5 William A. Rowe Jr. 2002-09-19 19:57:43 UTC
webmaster@peoplegauge.com ...

  When you say with and without the firewall running, do you realize
that you must disable the firewall software and reboot to eliminate
the firewall's interaction with the server?

  Further, you may need to uninstall the firewall software completely
in order to remove all modified components in the Windows TCP/IP socket
I/O stack.  Otherwise your firewall software may still interact with
Apache, even though it is 'disabled'.
Comment 6 webmaster 2002-09-19 20:17:32 UTC
I have removed McAfee Firewall version 3.x, rebooted and Apache 2.0.40 now
starts. If a firewall filter needs to be in place, is there a specified list of
protocols that need to be allowed to prevent the socket error? Is the issue with
McAfee Firewall preventing Apache 2.0.40 from running a configuration issue or
are the two applications mutually exclusive?
Comment 7 William A. Rowe Jr. 2002-09-20 04:49:18 UTC
  Sorry webmaster@peoplegauge.com ...

  The Apache server expects a robust implementation of the TCP/IP stack
  layer, and that is obviously not true of the McAfee product.  Microsoft
  makes it fairly trivial to write a stripped down TCP/IP provider or hook,
  but it is relatively difficult to design one to properly handle socket
  handle inheritence.  See the ancient issues of the Aventail connent VPN
  client... which didn't work properly for a very long time {if ever}.
  <http://httpd.apache.org/docs/misc/FAQ.html#WSADuplicateSocket>

  All we can advise is that you upgrade to a more robust firewall product
  or consider dealing with your firewall issues at your router or dedicated
  firewall box.

  Based on feedback, I'm closing this report and reclassing as an FAQ.



  
  
Comment 8 William A. Rowe Jr. 2002-10-13 19:59:56 UTC
*** Bug 11608 has been marked as a duplicate of this bug. ***
Comment 9 William A. Rowe Jr. 2002-10-13 20:18:35 UTC
*** Bug 13083 has been marked as a duplicate of this bug. ***
Comment 10 William A. Rowe Jr. 2002-10-13 20:28:08 UTC
  Anyone encountering this bug, running 2.0.43 (or able to recreate the
  conditions for triggering this bug, such as reinstalling or enabling
  their firewall or antivirus software) is welcome to try the patch given
  under the URL above.

  You may download a binary module built from 2.0.43 plus the patch from

    http://www.apache.org/~wrowe/acceptex_fix1.zip

  which contains only the replacement libhttpd.dll (DON'T UNPACK THIS BINARY
  INTO ANY RELEASE VERSION OTHER THAN 2.0.43).

  1. Confirm you are getting the AcceptEx failure.
  2. Stop your Apache2 server
  3. Unpack libhttpsd.dll from acceptex_fix1.zip into your apache2\lib 
directory.
  4. Restart your server and attempt to reproduce the AcceptEx failure.

  Please post your success or failure to this report.  Perhaps this can
  be licked after all.
Comment 11 webmaster 2002-10-15 03:13:08 UTC
I have upgraded to 2.0.43, reinstalled McAfee Firewall 3.03.1 and confirmed 
the following looping error message upon startup:

[Mon Oct 14 20:57:27 2002] [error] (730038)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
[Mon Oct 14 20:57:28 2002] [error] (730038)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
[Mon Oct 14 20:57:28 2002] [error] (730038)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
[Mon Oct 14 20:57:28 2002] [error] (730038)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
[Mon Oct 14 20:57:28 2002] [error] (730038)An operation was attempted on 
something that is not a socket.  : winnt_accept: AcceptEx failed. Attempting 
to recover.
.
.
.

It is the same error message with a new number. I then applied the referenced 
patch replacement for libhttpd.dll. The patch eliminates the aforementioned 
error message and provides for a clean startup sequence and fully functional 
Apache 2.0.43. Thank you for the persistance with this issue, as it now 
appears McAfee Firewall and Apache 2.0.43 are no longer mutually exclusive 
applications. Nice job.
Comment 12 William A. Rowe Jr. 2002-10-15 03:16:24 UTC
  Although I just announced this patch to comp.infosystems.www.servers.ms-windows
  I'm calling this closed.  Thanks for testing!
Comment 13 Josh Joslyn 2002-10-15 04:02:57 UTC
once i upgraded to 2.0.43, this patch works for me also - thank you.
Comment 14 russ 2002-10-15 15:06:18 UTC
I have installed 2.0.43 (Binary) in my XP, I also put the patch (libhttpd.dll) 
that was mentioned above in my apache2/lib folder. But I am still having the 
exact problem. One thing I have noticed, It happens from approx. 7 AM to 7 PM 
(MST). In about every other hit my apache is crashing with the following error 
message. It works like a champ at night. I am using AT&T Broadband and I am 
testing it with few test pages, On average I am getting about 20 Unique hits a 
day. It's not my ISP is busy, I can download 300/500 Mbps files during that 
time with no problem, I am also running MDaemon Mail server (Port 3000 for web 
based client with MDaemon web server) and that works with no problem at all.


[warn] (720064) The specified network name is no longer available : 
winnt_accept : Aynchronous AcceptEx failed. 

Please help. 
Comment 15 William A. Rowe Jr. 2002-10-15 15:32:20 UTC
  Russ.  Please create a new incident for "The specified network name is no
  longer available" ... this is a side effect of dynamic IP assignment that
  is outside the scope of the firewall/antivirus errors.  It isn't a bug
  but an enhancement request to handle dynamic IP assignment.  Apache doesn't
  handle IP transitions in it's current form.
Comment 16 russ 2002-10-15 17:07:43 UTC
Thanks, Just a quick note: my IP is not changing though, it hasn't been changed 
for past 8 months. Also it worked fine with 1.XX.XX. I am using Zone Alarm 
firewall and PC Chillin Anti Virus. Do you think it has something to do with it 
or still could be dynamic IP problem? Then I can open a new incedient. 

Thanks a lot.
Comment 17 William A. Rowe Jr. 2002-10-15 17:17:29 UTC
  It has something to do with DHCP lease negotiation, I'm pretty sure.
  The recovery scenario is different from this report, since we need to
  start a restart sequence that tears down all listeners.  Please start
  that new report for tracking.
Comment 18 William A. Rowe Jr. 2002-11-25 05:37:08 UTC
*** Bug 14812 has been marked as a duplicate of this bug. ***
Comment 19 William A. Rowe Jr. 2002-11-25 16:51:07 UTC
*** Bug 14828 has been marked as a duplicate of this bug. ***
Comment 20 patt 2002-11-25 20:06:20 UTC
bug 14812 has been marked as duplicate of this one but concern WinRoute
and the libhttpd.dll patch from fix1 does not solve the problem at all

could you help me ?
Comment 21 William A. Rowe Jr. 2002-11-25 21:02:37 UTC
  As I explained to you in your bug report, XP/WinRoute is yet another example
  of a badly written WinSock2 plugable driver.  Nothing we can do about that,
  we can't help that driver authors don't thoroughly test their drivers.

  To the extent that some of these had a bug that returned INVALID_HANDLE
  instead of WSAEINVAL v.s. WSAENOTSOCK, we've fixed that bug and the fix 
  will be in 2.0.44.

  Choose a product other than XP/WinRoute or choose another webserver if you
  are married to that product.  Another alternative, we will have a couple
  of options to toggle Sendfile Off and to toggle ReuseSockets off in the
  next release.  But if those don't work, as I stated in the bug report,
  "XP/Winroute is also incompatible with Apache". 

  Please do *not* reopen this bug.
Comment 22 David Shane Holden 2003-01-15 04:23:04 UTC
*** Bug 16089 has been marked as a duplicate of this bug. ***
Comment 23 spil 2003-01-15 12:09:31 UTC
McAfee is releasing a patch that might solves this issue.
Link to 
forum:
http://forums.mcafeehelp.com/viewtopic.php?t=441

Will update with details 
of patch when available.
Comment 24 Joshua Slive 2003-02-16 15:38:04 UTC
*** Bug 17099 has been marked as a duplicate of this bug. ***
Comment 25 William A. Rowe Jr. 2003-03-06 08:20:07 UTC
  Another thread tracking this issue...

    http://forums.mcafeehelp.com/viewtopic.php?t=5521
Comment 26 Joshua Slive 2003-03-06 20:58:41 UTC
*** Bug 17738 has been marked as a duplicate of this bug. ***
Comment 27 Philip Rutkowski 2003-03-24 16:56:58 UTC
I'm still getting the AcceptEx error even though it was fixed in 2.0.44. I am 
using Windows XP Pro (all the patches), McAfee VirusScan 6 and Firewall 3, and 
Apache 2.0.44. Does anybody have any recommendations on what to do? I have 
disabled VirusScan and Firewall. Uninstalling both applications is not an 
option. Any help would be appreciated.
Comment 28 Cliff Woolley 2003-08-31 02:13:29 UTC
*** Bug 21579 has been marked as a duplicate of this bug. ***
Comment 29 Cliff Woolley 2003-08-31 02:16:28 UTC
*** Bug 16327 has been marked as a duplicate of this bug. ***
Comment 30 Cliff Woolley 2003-08-31 02:27:29 UTC
*** Bug 22081 has been marked as a duplicate of this bug. ***
Comment 31 Joshua Slive 2003-09-05 16:59:30 UTC
*** Bug 17765 has been marked as a duplicate of this bug. ***
Comment 32 Cliff Woolley 2003-09-17 05:05:53 UTC
*** Bug 23206 has been marked as a duplicate of this bug. ***
Comment 33 Cliff Woolley 2003-10-10 20:19:05 UTC
*** Bug 23689 has been marked as a duplicate of this bug. ***
Comment 34 Cliff Woolley 2003-10-11 21:05:11 UTC
*** Bug 23300 has been marked as a duplicate of this bug. ***
Comment 35 David D. Kilzer 2005-03-09 01:37:06 UTC
In case anyone is looking for it, Russ filed Bug 13661 response to Comment 15.