Installs successfully but hangs on "VPN Details" and "Add VPN" does nothing

[Vincent Lord]

A long time ago I used TunnelBlick and I recently tried starting it up again but noticed I couldn't connect to my VPN. Noticing that I couldn't get to the VPN details screen, I tried to update to the latest stable version. Still had the same issues. I then uninstalled and then reinstalled the latest beta and same issues persisted.

I have since, removed the application and all traces (I think), reinstalled all to the same effect. Running on Mac OS 13.4. Any suggestions?

sudo find / -name "*?unnel?lick*" -print

sudo rm -fr /Library/Application\ Support/Tunnelblick

sudo rm -fr /Library/LaunchDaemons/net.tunnelblick.tunnelblick.tunnelblickd.plist

sudo rm -fr /System/Volumes/Data/Library/Application\ Support/Tunnelblick

sudo rm -fr /System/Volumes/Data/private/var/log/Tunnelblick             

sudo rm -fr /System/Volumes/Data/private/var/folders/vt/_ht0t211687__77pshnx1_2w0000gn/C/net.tunnelblick.tunnelblick

sudo rm -fr /System/Volumes/Data/private/var/run/net.tunnelblick.tunnelblick.tunnelblickd.socket

sudo rm -fr /System/Volumes/Data/private/tmp/tunnelblick-installer-log.txt 

sudo rm -fr /System/Volumes/Data/Users/vincent/Library/Application\ Support/Tunnelblick

sudo sqlite3 /private/var/db/SystemPolicyConfiguration/KextPolicy

select * from kext_policy;

delete from kext_policy where team_id = "xyz....";

--reboot--

reinstall 

[Tunnelblick developer]

Try restarting your computer in Safe Mode. Then restart it normally, install Tunnelblick 3.8.8a by double-clicking the application in a disk image as usual, and see if you can get to the "VPN Details" window.

[Vincent]

Update:

After waiting about 10 mins, I was able to get the VPN Details window loaded. I can perform all functions except adding a VPN using the plus sign. Clicking on "Add a VPN..." does nothing, even after letting it sit for 30 mins. I've tried this with both 3.8.8a and 4.0.0b5.

[Tunnelblick developer]

It shouldn't take that long to get the "VPN Details" window to appear, but please get the diagnostic info. That may help to find out what's going on.

Don't bother to try to connect, just get the window to appear, click on the large "Configurations" button at the top, then click on the "Copy Diagnostic Info to Clipboard" button. Wait until the "spinner" disappears and the button returns to normal, then paste into a reply.

It shouldn't contain anything that you need to keep private, but if you'd rather, you can send it to devel...@tunnelblick.net in an email with subject "Re: Installs successfully but hangs on "VPN Details" and "Add VPN" does nothing".

[Vincent]

I can't click on copy diagnostic info as the button is inactive. I also can't click on settings either. All the other buttons work though. 

I also went through and used the uninstall option and reinstalled but get this as part of the installation. Not sure if it has any bearing:

drwxrwxr-x  78 vincent  staff  2496 Jun  2 10:24 Applications/

[Tunnelblick developer]

The "System Requirements Not Met" indicates the problem: The /Applications folder on your computer does not have the correct owner and/or permissions.

Tunnelblick will not do certain operations that requires admin authorization if the system folders are not secure. That's probably why it is refusing to install configurations and may be why it takes so long to start Tunnelblick.

You should fix this problem. See System Folder Security for help.

[Vincent]

I resolved the folder permissions and no longer get the warning during installation but am still experiencing the same behavior with the VPN Details taking ~10 mins to open and can't click on anything but the top row of icons. I did manually check the permissions of the other folders and they were set correctly.

[Vincent]

Do you happen to have any other suggestions I could try?

[Tunnelblick developer]

(I'm assuming Tunnelblick is the only program that's misbehaving.)

Unfortunately, Apple has made the standard logging system unusable, so the log of what Tunnelblick is doing as it starts up is difficult to get and interpret.

But the Tunnelblick installer subprogram logs separately. Install Tunnelblick again to get a fresh log (don't bother to uninstall) and then post /tmp/tunnelblick-installer-log.txt.

One other possibility comes to mind: how many VPN configurations do you have?

[Vincent]

Yes -- Tunnelblick is the only app I'm experiencing any issues with. I have one other VPN installed which is Windscribe's free version. 

vincent@Vincent_MBP /tmp % cat tunnelblick-installer-log.txt

Tunnelblick installer started 2023-06-06 11:53:05.460367. 1 arguments: 0x0017

getuid() = 501; getgid() = 20; geteuid() = 0; getegid() = 20

Created or checked '/Users/vincent/Library/Application Support/Tunnelblick'; owner = 501:80; permissions = 488

Created or checked '/Users/vincent/Library/Application Support/Tunnelblick/Configurations'; owner = 501:80; permissions = 488

Copied /Volumes/Tunnelblick/Tunnelblick.app to /Applications/Tunnelblick.app

Removed any 'com.apple.quarantine' extended attributes

Changed ownership of /Applications/Tunnelblick.app and its contents from 501:80 to 0:0

Need to replace and/or reload 'tunnelblickd':

    daemonHashesMatch  = NO

    plistHashesMatch   = YES

    activePlistMatches = YES

Replaced /Library/LaunchDaemons/net.tunnelblick.tunnelblick.tunnelblickd.plist

Used launchctl to load tunnelblickd

Tunnelblick installer finished without error

[Tunnelblick developer]

There's nothing unusual in the installer log.

Please try the following to get a log of the process of Tunnelblick starting up:

1. Quit Tunnelblick if it is running.
   
2. Launch /Applications/Utilities/Console.
   
3. Click on the name of your computer at the top of the left column.
   
4. Type tunnelblick in the search box in the upper right, then press "return". The word "Any" should appear to the left of tunnelblick in the search box.
5. Click the "Start" button at the top of the Console window.
   
6. Launch Tunnelblick.
   
7. Wait until the Tunnelblick icon appears in the menu bar.
   
8. Hover over the icon until it isn't a "spinning beachball".
   
9. Click on the icon, then click "VPN Details…"
   
10. Wait until the VPN Details window appears.
    
11. In Console, click on the "Pause" button (it was the "start" button but changed to "Pause" when you clicked "Start" in step 5).
    
12. Click on one of the log entries on the right of the Console window.
13. Click Edit >> Select All.
14. Click Edit >> Copy.

Then paste into a reply and send it, or into an empty file and send the file as an attachment.

The log is likely to be very long, so attaching a file is preferred.

[Vincent]

Attached is the log file. Thank you in advance for looking into this. Let me know if there are any additional details that you need.

[Tunnelblick developer]

What language are you using? English or something else?

[Tunnelblick developer]

All sorts of things Tunnelblick is trying to do as it starts up are failing, including checking SIP status and initializing the strings that appear in the VPN Details window. (That's why I asked about the language you're using: non-English strings are all translated from English, so maybe there's a problem with the strings in your language.)

A couple of other things:

1. Are you running Tunnelblick in a VM?

2. What is the exact version of macOS you have? I know it's 13.4, but what build? (I have 22F66.) You can get the build by clicking the black Apple icon, then "About This Mac", and mousing over the 13.4 -- it will change to show the build number in parentheses.

3. What is the output from typing    csrtutil status.   into /Applications/Utliities/Terminal?

What Tunnelblick is expecting is:

System Integrity Protection status: enabled.

which is what macOS version 13.4 (22F66) and earlier, going back at least several major macOS versions.

But from the log it looks like your output will be:

Apple Internal: disabled
Kext Signing: disabled
Filesystem Protections: disabled
Debugging Restrictions: enabled
DTrace Restrictions: enabled
NVRAM Protections: enabled
BaseSystem Verification: enabled

which I've never seen. (And I wonder why so many protections are disabled.)

[Tunnelblick developer]

Correction:

3. What is the output from typing    csrtutil status.   into /Applications/Utliities/Terminal?

should be

3. What is the output from typing    csrtutil status   into /Applications/Utliities/Terminal?

(That is, there should not be a period after "status".)

[Wyllys Ingersoll]

I have same problem runnning tunnelblick, my csrutil status says:

System Integrity Protection status: unknown (Custom Configuration).

Configuration:

Apple Internal: disabled
Kext Signing: disabled
Filesystem Protections: disabled
Debugging Restrictions: enabled
DTrace Restrictions: enabled
NVRAM Protections: enabled
BaseSystem Verification: enabled

The reason for the odd configuration is that my Mac is running Ventura but with the OpenCore Legacy Patcher fixes installed which allow me to run Ventura on an older iMac (late 2013), without the OpenCore patches, I can't run anything after Big Sur.

Perhaps this unusual configuration is causing Tunnelblick to fail?

I also see this in the systems log, which says that SIP is enabled but the crash is due to bad kernel access...

-------------------------------------
Translated Report (Full Report Below)
-------------------------------------

Process:               nsattributedstringagent [28484]
Path:                  /System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/XPCServices/nsattributedstringagent.xpc/Contents/MacOS/nsattributedstringagent
Identifier:            com.apple.textkit.nsattributedstringagent
Version:               1.0 (857.8)
Build Info:            UIFoundation-857008000000000~221
Code Type:             X86-64 (Native)
Parent Process:        launchd [1]
Responsible:           Tunnelblick [28346]
User ID:               501

Date/Time:             2023-06-07 15:34:57.8376 -0400
OS Version:            macOS 13.4 (22F66)
Report Version:        12
Anonymous UUID:        8B8789D9-16F1-3848-0FBD-A20F97715DF8

Sleep/Wake UUID:       F2353489-9B58-48D1-AFCE-F86C8B93A58E

Time Awake Since Boot: 83000 seconds
Time Since Wake:       338 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x000000020bf1d6a0
Exception Codes:       0x0000000000000001, 0x000000020bf1d6a0

Termination Reason:    Namespace SIGNAL, Code 11 Segmentation fault: 11
Terminating Process:   exc handler [28484]

VM Region Info: 0x20bf1d6a0 is not in any region.  Bytes after previous region: 45491873  Bytes before following region: 4094568800
      REGION TYPE                    START - END         [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      mapped file                 208c3e000-2093bb000    [ 7668K] r--/rwx SM=COW  ...t_id=d4ffcad7
--->  GAP OF 0xf6c45000 BYTES
      VM_ALLOCATE (reserved)      300000000-308000000    [128.0M] rw-/rw- SM=NUL  ...(unallocated)

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib                   0x7ff80892c497 objc_msgSend + 23
1   CoreFoundation                     0x7ff808d416bf mdict_rehashd + 183
2   CoreFoundation                     0x7ff808d41121 -[__NSDictionaryM __setObject:forKey:] + 892
3   CoreFoundation                     0x7ff808d54820 __93-[_CFXPreferences(SearchListAdditions) withSuiteSearchListForIdentifier:user:locked:perform:]_block_invoke + 226
4   CoreFoundation                     0x7ff808eb84c3 -[_CFXPreferences withSuiteSearchListForIdentifier:user:locked:perform:] + 429
5   CoreFoundation                     0x7ff808d5471f -[CFPrefsSearchListSource addSuiteSourceForIdentifier:user:] + 104
6   CoreFoundation                     0x7ff808eb9781 __108-[_CFXPreferences(SearchListAdditions) withSearchListForIdentifier:container:cloudConfigurationURL:perform:]_block_invoke.160 + 788
7   CoreFoundation                     0x7ff808eb925a -[_CFXPreferences withSearchLists:] + 60
8   CoreFoundation                     0x7ff808d4d334 __108-[_CFXPreferences(SearchListAdditions) withSearchListForIdentifier:container:cloudConfigurationURL:perform:]_block_invoke + 279
9   CoreFoundation                     0x7ff808eb93eb -[_CFXPreferences withSearchListForIdentifier:container:cloudConfigurationURL:perform:] + 374
10  CoreFoundation                     0x7ff808d4ccc3 -[_CFXPreferences copyAppValueForKey:identifier:container:configurationURL:] + 137
11  CoreFoundation                     0x7ff808d4cbf8 _CFPreferencesCopyAppValueWithContainerAndConfiguration + 101
12  CoreFoundation                     0x7ff808d65eac _CFPreferencesGetAppBooleanValueWithContainer + 17
13  GLRendererFloat                   0x7ffa2297b838 __useSWRastAcceleratedBits_block_invoke + 32
14  libdispatch.dylib                 0x7ff808b20033 _dispatch_client_callout + 8
15  libdispatch.dylib                 0x7ff808b21267 _dispatch_once_callout + 20
16  GLRendererFloat                   0x7ffa2297b816 gldPopulateRendererInfo + 161
17  GLEngine                           0x7ffa22808b7a gliQueryRendererInfo + 178
18  OpenGL                             0x7ffa225d8ddb 0x7ffa225d6000 + 11739
19  OpenGL                             0x7ffa225e1bc2 CGLQueryRendererInfo + 426
20  WebCore                           0x7ff909825508 WebCore::collectScreenProperties() + 1160
21  WebKit                             0x7ff90bc4ae3b WebKit::WebProcessPool::platformInitializeWebProcess(WebKit::WebProcessProxy const&, WebKit::WebProcessCreationParameters&) + 1217
22  WebKit                             0x7ff90bdd4346 WebKit::WebProcessPool::initializeNewWebProcess(WebKit::WebProcessProxy&, WebKit::WebsiteDataStore*, WebKit::WebProcessProxy::IsPrewarmed) + 2538
23  WebKit                             0x7ff90bdd4e66 WebKit::WebProcessPool::createNewWebProcess(WebKit::WebsiteDataStore*, WebKit::WebProcessProxy::LockdownMode, WebKit::WebProcessProxy::IsPrewarmed, WebCore::CrossOriginMode) + 108
24  WebKit                             0x7ff90bdd6711 WebKit::WebProcessPool::processForRegistrableDomain(WebKit::WebsiteDataStore&, WebCore::RegistrableDomain const&, WebKit::WebProcessProxy::LockdownMode) + 893
25  WebKit                             0x7ff90bd86f4c WebKit::WebPageProxy::launchProcess(WebCore::RegistrableDomain const&, WebKit::WebPageProxy::ProcessLaunchReason) + 346
26  WebKit                             0x7ff90bd8b262 WebKit::WebPageProxy::loadData(WTF::Span<unsigned char const, 18446744073709551615ul> const&, WTF::String const&, WTF::String const&, WTF::String const&, API::Object*, WebCore::ShouldOpenExternalURLsPolicy) + 392
27  WebKit                             0x7ff90bb38fc1 -[WKWebView loadData:MIMEType:characterEncodingName:baseURL:] + 303
28  WebKit                             0x7ff90ba91861 __90+[NSAttributedString(WKPrivate) _loadFromHTMLWithOptions:contentLoader:completionHandler:]_block_invoke + 1186
29  libdispatch.dylib                 0x7ff808b1ed91 _dispatch_call_block_and_release + 12
30  libdispatch.dylib                 0x7ff808b20033 _dispatch_client_callout + 8
31  libdispatch.dylib                 0x7ff808b2cfcf _dispatch_main_queue_drain + 954
32  libdispatch.dylib                 0x7ff808b2cc07 _dispatch_main_queue_callback_4CF + 31
33  CoreFoundation                     0x7ff808ddc205 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 9
34  CoreFoundation                     0x7ff808d9bf2f __CFRunLoopRun + 2452
35  CoreFoundation                     0x7ff808d9af31 CFRunLoopRunSpecific + 560
36  HIToolbox                         0x7ff812816dad RunCurrentEventLoopInMode + 292
37  HIToolbox                         0x7ff8128169f4 ReceiveNextEventCommon + 199
38  HIToolbox                         0x7ff812816918 _BlockUntilNextEventMatchingListInModeWithFilter + 64
39  AppKit                             0x7ff80be2f5d0 _DPSNextEvent + 858
40  AppKit                             0x7ff80be2e47a -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1214
41  AppKit                             0x7ff80be20ae8 -[NSApplication run] + 586
42  AppKit                             0x7ff80bdf4d02 NSApplicationMain + 817
43  nsattributedstringagent              0x101688ef1 main + 226
44  dyld                               0x7ff80896741f start + 1903

[Vincent]

English only

1. Not running in a VM

2. 13.4 (22F66)

3. 

vincent@Vincents-MBP ~ % csrutil status

System Integrity Protection status: unknown (Custom Configuration).

Configuration:

Apple Internal: disabled

Kext Signing: disabled

Filesystem Protections: disabled

Debugging Restrictions: enabled

DTrace Restrictions: enabled

NVRAM Protections: enabled

BaseSystem Verification: enabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

vincent@Vincents-MBP ~ % 

[Vincent]

I too am running opencorelegacy patcher on my 2013 MBP. :)

[Tunnelblick developer]

Thanks, Wyllys and Vincent. That clarifies things. I think the crash Wyllys reported is the same as the series of crashes shown in the Vincent's log.

The first problem (checking the SIP status) isn't a crash and doesn't take any more time, it just means that Tunnelblick doesn't know the SIP status.

But each time Tunnelblick accesses its preferences (for each of the checkboxes and other controls in its menu and the VPN Details window), it crashes. That crash takes about 10 seconds to process, so it makes sense for it to take 10 minutes for the window to show up -- there are probably 60 or so controls. And it makes sense that when the window does show up, a lot of the buttons are disabled, because Tunnelblick never got them set up (because the crash interrupted the setup process).

As to what can be done, I don't know. Tunnelblick is using standard macOS system calls to access the preferences, but the calls crash*. I have to assume that's caused by something that OpenCore Legacy Patcher does or fails to do.

I'd be happy to work with any OpenCore Legacy Patcher folks to see what exactly is causing this and if anything can be done – they can contact me at devel...@tunnelblick.net.

* I'm ignoring the failure to detect the SIP status because it doesn't really affect anything other than reporting the SIP status in Tunnelblick's "Diagnostic Info".

[Vincent]

In looking at the OCLP documentation here, there are a number of SIP options that could be enabled or disabled. Are there any that you would suggest trying that might allow tunnelblick to run successfully? 

[Tunnelblick developer]

In general, OCLP does patches for hardware support (like GPUs, USB, display, etc.), and I don't see how the Tunnelblick problems have anything to do with hardware.

Assuming these are SIP options that could be enabled or disabled:

Apple Internal: disabled
Kext Signing: disabled
Filesystem Protections: disabled
Debugging Restrictions: enabled
DTrace Restrictions: enabled
NVRAM Protections: enabled
BaseSystem Verification: enabled

I don't see any that seem promising. And if I remember correctly, one of the comments on the page you posted indicates that fiddling with them can result in bricking the computer. So I don't think that's a good way to go.

I've been looking at the first real crash in the log that Vincent provided. It happens when Tunnelblick is trying to display a window alerting the user to something, perhaps that there are no configurations yet. I may have found a Tunnelblick bug that would cause this crash. It would be triggered when the message it is trying to display is malformed, and I don't understand why the message would be malformed -- if it is the message I think it is, it is a static message that everyone sees, and it would be the English version of the message.

If I create a version of Tunnelblick that logs info about this possibility and tries to correct it, would either of you (Vincent & Wyllys) be willing to try it out?

[Vincent]

Thanks for looking into this further. Any tests you'd like to try, I'm willing to help out in any way helpful

[Wyllys Ingersoll]

I would be willing to try it out.