version >= 3.8.8c freezes/hangs when reading config from older versions

[MichaelRoosz]

version >= 3.8.8c freezes/hangs when reading config from older versions

[whitone]

There was this following line in the Console:

<Emergency>: Catastrophic error: Could not create /Library/Application Support/tunnelblickd/stdout.txt

So after trying to type sudo rm -rf "/Library/Application Support/tunnelblickd", everything worked again as before.

[pingtimeout]

FWIW I was able to fix the issue with the rm -rf /Library/Application Support/tunnelblickd workaround. So:

• Uninstall Tunnelblick completely
• Ensure no process is running
• Delete the folders /Library/Application Support/Tunnelblick, ~/Library/Application Support/Tunnelblick and most importantly /Library/Application Support/tunnelblickd folders if they still exist
• Reinstall Tunnelblick for all users (not "for current user only")
• Reimport the VPN config

Verification: everything related to Tunnelblick should be under /Library/Application Support/Tunnelblick. The two other directories should not exist anymore.

[gubblebozer]

I can confirm this problem still occurs with Tunnelblick 3.8.8g. I went through numerous gyrations attempting to address it, including uninstalling and reinstalling Tunnelblick. In the end, quitting Tunnelblick and removing /Library/Application Support/tunnelblickd as described earlier, then relaunching Tunnelblick finally fixed it for me.

After launching Tunnelblick and connecting to my VPN endpoint, this directory has not been re-created. Before removing the directory, the permissions looked like this:

% ls -lat tunnelblickd
total 8
drwxr-xr-x  23 root  admin  736 Jan 29 14:02 ..
-rw-r--r--   1 root  admin   56 Jan 29 13:27 stdout.txt
drwxr-xr-x   4 root  admin  128 Jan 29 13:27 .
-rw-r--r--   1 root  admin    0 Jan 29 13:27 stderr.txt

Permissions on /Library/Application Support are root:admin 755. /Library is root:wheel 755.

My machine is an ancient Intel Macbook Pro:

MacBook Pro 15 Inch 2015
MacOS: Monterey 12.6.9
Model Identifier:	MacBookPro11,4
Processor Name:	Quad-Core Intel Core i7
Processor Speed:	2.8 GHz
Number of Processors:	1
Total Number of Cores:	4
...
Replacement 1TB drive from OWC, GUID Partition Map, APFS

[47k]

Thank you! I analyzed for hours to find a solution for my issue which appeared for NO REASON! (No upgrade of VPN or something).

sudo rm -rf "/Library/Application Support/tunnelblickd" worked for me!

[breuniga]

Same problem here since today after update to 3.8.8d (Build 5779). Before I was using 3.8.8c.
But because the problem appeared today and worked fine on last Friday with 3.8.8c which should also be affected, I think that it also may be related to an update of macOS?
The workaround to remove/rename /Library/Application Support/tunnelblickd fixed the problem for me.

[jl-stellar]

Same here: Updating to 3.8.8g did not solve the problem. I also tried removing the app including the Library folder etc and re-installing it, but the problem persisted.
Upgrading to the latest beta (4.0.0beta13), however, fixed the issue for me.

[MichaelRoosz]

it also happens when only trying to connect. it will fail with some error -1 if I remember correctly. even only starting Tunnelblick takes ages. also it will repeat to complain about config having changed and needing to be imported again. even after importing it, the same message will appear a few moments later. I will try to re-create the problem tomorrow. at least two more of my colleagues are experiencing the same problem

[opus-nbonenberger]

We have the same problem with some of our machines. After upgrading to 3.8.8d, Tunnelblick takes very long to open the VPN Details window. Connecting does not work because some error happens while checking the security of the configuration. In addition to that, Tunnelblick states that configuration has changed since the last save. The app is unusable in this state.

[tibeer]

There was this following line in the Console:

<Emergency>: Catastrophic error: Could not create /Library/Application Support/tunnelblickd/stdout.txt

So after trying to type sudo rm -rf "/Library/Application Support/tunnelblickd", everything worked again as before.

Thanks a lot @whitone ! This worked for me :)

[hildeb]

Shame on me and thanks to you :)

[jkbullard]

No problem, the releases were available only about 15 minutes before your post!

[jkbullard]

@MichaelRoosz - Thanks for your report.

When you say "read/write config" -- are you installing/removing a configuration? That doesn't happen for me.

If anyone has this problem, please post a Spin Dump after selecting Tunnelblick in Applications/Utilities/Activity Monitor.

[vafschoen]

can confirm this issue
I've tried removing and re-adding a .ovpn-config which lead to the following log output

2023-08-08 14:01:30.387 Tunnelblick[22414:284702] Tunnelblick: macOS 13.5.0; Tunnelblick 3.8.8c (build 5778)
[...]
2023-08-08 14:02:02.123 Tunnelblick[22414:284780] runTunnelblickd: tunnelblickd is not responding; received 0 bytes
2023-08-08 14:02:02.123 Tunnelblick[22414:284780] tunnelblickd status from printSanitizedConfigurationFile: -1
2023-08-08 14:02:02.123 Tunnelblick[22414:284780] Error status -1 returned from 'openvpnstart printSanitizedConfigurationFile %%CONFIG_NAME_REMOVED%% 3'

[armindittmann]

same here. 3.8.8b works fine. 3.8.8c and above (including 4.0 beta) produces the error. The workaround mentioned by MichaelRoosz sadly didn't work for me.
(macOS 13.3.1 (a))

[luis-at]

Same here for macOS 13.4.1(c). Does not occur on macOS 12.6.8.

[nehuenPeluso]

Same here, for macOS 13.5 and tunnel 3.8.8d. And the workaround mentioned by MichaelRoosz didn't work for me too. If is usefull, here is the error that tunnelblick inform on spanish when I try to open VPN details:

"Tunnelblick no logró encontrar el archivo de configuración o el archivo de configuración no pudo ser sanado. Consulta la Consola de Log para más detalles." and the when i check the log there is nothing here

[benriou]

We are suffering the same issue here. Deleting the Application Library Folder fixed the issue.

[EdwardSalkeld]

Adding my voice to the chorus. Posted my experience on the discussion board - hadn't realised there was already an open issue for it.

@jkbullard are you still after logs for this? I can't provide them without breaking my VPN connectivity again so am in no hurry to do so, but if it'd be helpful I can replicate next week.

[csautter]

Same here with 4.0.0beta08 (build 5880) and macOS Ventura 13.5.1

[goetzd]

Same problem here, although removing /Library/Application Support/tunnelblickd does not help in my case. Tunnelblick doesn't seem to have permissions to create the directory itself:

<Error>: Could not create a new temporary directory using a fixed path at /Library/Application Support/tunnelblickd; error was Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission to save the file “tunnelblickd” in the folder “Application Support”." UserInfo={NSFilePath=/Library/Application Support/tunnelblickd, NSUnderlyingError=0x600002e096b0 {Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied"}}

If I create it myself (sudo mkdir /Library/Application Support/tunnelblickd), I get the error mentioned above:

<Emergency>: Catastrophic error: Could not create /Library/Application Support/tunnelblickd/stdout.txt

[benknight]

Affecting me as well. I don't know exactly what happens, but before I never had issues, after upgrade I frequently have to Force Stop tunnelblick processes.

[hildeb]

This is affecting our users on a broad scale. The solution described by @pingtimeout is fairly easy (for us), but not for the average Mac user (don't get me wrong here).

Is there any hope for a 3.8.8e version that could magically fix the issues?
Currently we're recommending to deinstall completely and use the 4.0.0 beta, then reinstall the config.

[jkbullard]

Tunnelblick 3.8.8e was released earlier today! (Tunnelblick 4.0.0beta10, too.)

[Left-Empty]

I have to sadly report I am experiencing this very issue on both the stable and beta branch, on OS 10.13.6.
The 3.8.8e upgrade worked fine on my system, but Tunnelblick threw some errors about the configuration using outdated options. I tried to add a freshly downloaded configuration, and sadly got the dreaded "takes too long to respond" message box, quite immediately I might add.
The configuration had been deleted the next time I started Tunnelblick, and I have tried to add it again, to no avail, with various fresh installs.

I tried out of curiosity to add back the /Library/Application Support/Tunnelblick folder from one of my backups, and sure enough, my old setup is back and working that way - and while I get the couple of error messages on every disconnection, I'll live with those for the time being!

Cheers and thank you for all your work to the nice people who made this so easy to use tool.

[opus-nbonenberger]

I encountered the same problem from 3.8.8c on the new 3.8.8e. configuration file error window, extremely laggy main window, notices about configuration changes where none are..........

removing only the folder /Library/Application Support/tunnelblickd fixed the issue. @jkbullard can you please look deeper into this? I just deployed the new version to our fleet after a successful test on some machines. it seems that not every machine is affected by this.

[jkbullard]

This is fixed in Tunnelblick 4.0.0beta11, which was released a few minutes ago.

[opus-nbonenberger]

@jkbullard I wont deploy a beta, sorry. Can you fix it in 3.8.8, too?

[jkbullard]

The problems probably won't be fixed in 3.8.8.

Assuming I hear from enough people using 4.0.0beta11 that it works, a stable 4.0.0 release will be made and 3.8.8 will be deprecated.

[Left-Empty]

In the newest 4.0.0 beta on 10.13.6, I get the same issues: warning about improper configuration when disconnecting from the VPN, and the applicaton says it is taking "too long to respond" in an error box that pops up immediately when trying to add a new configuration.
I never suffered from any slowdowns though, and still don't.
Best regards.

[jkbullard]

@Left-Empty - Assuming by "newest 4.0.0 beta" you mean 4.0.0beta11, please follow the instructions at Read Before You Post, either posting the "Diagnostic Info" as a reply or emailing it to [email protected].

[richardleger]

Last Friday 17th November, a Mac OS X user was alerted to update Tunnelblick for security reason.

Update was applied to version Tunnelblick_3.8.8e_build_5779.1.dmg. After which application would just freeze with the impossibility to load the existing configuration file with error message like the following appearing:

"An error (status -1) has occurred while trying to check the security of the vpn-to-office configuration. Please quit and relaunch Tunnelblick. If the problem persists, please reinstall Tunnelblick."

"The vpn-to-office VPN configuration has been modified since it was last secured. Do you wish to secure the modified configuratino or revert to the last secured configuration>" None of the related action option helped to fix the problem."

Tried to remove/re-install configuration file but without success. Tunnelblick not being able to load it any more.

Tried to uninstall Tunnelblick via Details > Utilities > Uninstall Tunnelblick and re-install stable version but same issue occurred.

Same issue with beta version Tunnelblick_4.0.0beta12_build_5920.dmg

Upgrading Mac OS X to Sonoma did not fixed the issue either.

The current workaround was to remove Tunnelblick and re-install older version for macOS 10.10 and higher:

https://tunnelblick.net/iprelease/Tunnelblick_3.8.8b_build_5777.dmg

available from this page:

https://tunnelblick.net/downloadsDeprecated.html

...asking end-user not to update Tunnelblick when prompted (just press the Skip button).

In error console it seems Tunnelblick was trying to create the following file but did not have permissions to do so:

/Library/Application Support/tunnelblickd/stdout.txt

Strangely using the same configuration file on Mac OS X Big Sure 11.1 with Tunnelblick 4.0.0beta01 (build 5810) did not cause any issue. But that version was installed manually. Not upgraded from existing install.

Just wanted to share experience and feedback in case it may help find and fix the culprit...

Cheers,

[jkbullard]

Thanks, @richardleger.

[richardleger]

Fyi, see also other affected people reporting issues/possible fix:
https://groups.google.com/g/tunnelblick-discuss/c/6VGLeabzaN8?pli=1
...but you may be aware already :-)

[jkbullard]

We have released Tunnelblick 4.0.0beta13, which should fix this issue.

[jkbullard]

Tunnelblick 3.8.8f fixes this problem (or these problems).

[opus-nbonenberger]

@jkbullard Updating from 3.8.8e to 3.8.8f on an affected client does not resolve the problem, i had to manually remove the /Library/Application Support/tunnelblickd. It's getting a bit annoying...

[opus-nbonenberger]

Same here: 3.8.8g still has the same issue as 3.8.8c – this gets really annoying in an environment with 50+ machines. @jkbullard when can we expect a final 4.0 or a fix for the 3.x version?

[richardleger]

From my last experience today as an alternative to downgrading:

• Upgrading from 3.8.8c to 3.8.8g when prompting to update by Tunnelblick - did not fix the issue
• Uninstalling 3.8.8g via the Tunnelblick > Utility > Uninstall procedure and re-installing Tunnelblick 4.0.0beta13 - did not fix the issue
• Quitting Tunnelblick
• Renaming...

• ~/Library/Application Support/Tunnelblick
• /Library/Application Support/Tunnelblick
• /Library/Application Support/tunnelblickd (had to Relaunch Finder as first attempt resulted in an error, could not rename the folder at first)
  into OLD, in all cases it required to enter user password to apply the change...

• Then re-adding the configuration file and making sure to apply it to For all users rather than For current user only - did fix the issue

It may be quite possible that the issue may be related to some permission set when choosing to add configuration For current user only

In any case, neither update or re-install to Tunnelblick 3.8.8g nor Tunnelblick 4.0.0beta13 fixed the on-going issue... as it should... so back to the developers to identify the issue and fix it more easily via further manual or auto update in the future :-)

Thank you all for reporting your issues and possible solutions on this forum page as it was very helpful for me to fix the issue today, while allowing an update of the version, for improved security :-)

Happy New Year - Health, Love and Happiness I wish you all!

[jkbullard]

Thanks, @richardleger . When you say "did not fix the issue", please confirm that are you referring to the following, which you wrote earlier:

Last Friday 17th November, a Mac OS X user was alerted to update Tunnelblick for security reason.

Update was applied to version Tunnelblick_3.8.8e_build_5779.1.dmg. After which application would just freeze with the impossibility to load the existing configuration file with error message like the following appearing:

"An error (status -1) has occurred while trying to check the security of the vpn-to-office configuration. Please quit and relaunch Tunnelblick. If the problem persists, please reinstall Tunnelblick."

Also, please confirm that it is happening on Sonoma 14.2.1 and whether it is happening on an Intel or Apple Silicon machine.

Finally, please send a .zip of the configuration that's causing the problem to [email protected]. You can obscure anything in the copy of the configuration that you send (target of remote option, contents of keys, etc.) by X-ing them out, since we won't need the configuration to actually connect, we just need to install it and click "Connect" to get the error.

[richardleger]

When you say "did not fix the issue", please confirm that are you referring to the following, which you wrote earlier:

Yes. Both issue reported on the 17th Nov and 4th Jan are the same issue from end-user point of view, but they are two separate cases from two different users, Apple hardware computers and openvpn configurations.

I cannot confirm for sure if on the 4th Jan case if it was directly related to:
/Library/Application Support/tunnelblickd/stdout.txt

...but from the end-users point of view, error message and issue look the same, configuration file could not be loaded somehow.

In my attempt to fix issue, the following folder was manually deleted:
/Library/Application Support/tunnelblickd

So that may have fixed the issue somehow if not the other deletion applied.

Also as stated previously it could be linked to the option: For current user only (as opposed to: For all users) but I have not been able to easily reproduce the issue nor having enough time to test on the systems encountering the issue.

Also, please confirm that it is happening on Sonoma 14.2.1 and whether it is happening on an Intel or Apple Silicon machine.

The case reported on 4th Jan was on the following environment:

MacBook Pro 16 inch 2023
MacOS: Ventura 13.4.1 (c)
Model Identifier: Mac14,10
Model Number: Z175000Q2B/A
Chip: Apple M2 Pro
Total Number of Cores: 12 (8 performance and 4 efficiency)
Memory: 32 GB
Capacity: 1TB
Model: APPLE SSD AP1024Z
Partition Map Type: GPT (GUID Partition Table)

The case from November would have had happened on a much older hardware machine but I cannot confirm details about it.

Finally, please send a .zip of the configuration that's causing the problem to [email protected].

Sent.

[kilgarenone]

We have the same problem with some of our machines. After upgrading to 3.8.8d, Tunnelblick takes very long to open the VPN Details window. Connecting does not work because some error happens while checking the security of the configuration. In addition to that, Tunnelblick states that configuration has changed since the last save. The app is unusable in this state.

I'm having exactly this issue with v4.0.1 Build 5971 on mac M1. I can connect using https://openvpn.net/client-connect-vpn-for-mac-os/