Windows Tunnl.dll fails to start as a service.

Windows Tunnl.dll fails to start as a service.

[Manikandan Thiagarajan]

I am working on a project where I create Wireguard tunnels on demand
and tear down the tunnel whenever it is not needed anymore. I have
been using the tunnel.dll and start/stop the tunnel service from
another windows service. Almost always the service doesn’t start in
one try. So I have to keep trying in a loop until the service finally
starts.

My main() function looks like below
if (argc > 2 && !wcscmp(argv[1], L"/service"))
{
      WireGuardTunnelService(argv[2]);
      return 0;
}
Create service call
hService = CreateService(
            hServiceManager,
            m_serviceName.c_str(),
            m_serviceName.c_str(),
            SC_MANAGER_ALL_ACCESS,
            SERVICE_WIN32_OWN_PROCESS,
            SERVICE_DEMAND_START,
            SERVICE_ERROR_NORMAL,
            path.c_str(),
            NULL,
            NULL,
            depends, // “Nsi”
            NULL,
            NULL);
I use windows Services API such as CreateService(). StartService(),
and QueryServiceStatusEx() to start the tunnel service. I start a
thread that monitors the service state changes after creating and
starting the service the thread restarts the service when it fails to
start. The service state changes from SERVICE_START_PENDING to
SERVICE_STOPPED when it fails to start.

Wintun Driver Version: 0.8
Wireguard version 0.1.1

Windows Event viewer Logs:
Log Name:      System
Source:        Service Control Manager
Date:          1/21/2021 9:41:23 AM
Event ID:      7034
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      MANI-WIN10-TEST
Description:
The ProsimoTunnel_if_cbc2a056dfdc25f7 service terminated unexpectedly.
It has done this 2 time(s).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager"
Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service
Control Manager" />
    <EventID Qualifiers="49152">7034</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2021-01-21T17:41:23.8109732Z" />
    <EventRecordID>35946</EventRecordID>
    <Correlation />
    <Execution ProcessID="660" ThreadID="6064" />
    <Channel>System</Channel>
    <Computer>MANI-WIN10-TEST</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">ProsimoTunnel_if_cbc2a056dfdc25f7</Data>
    <Data Name="param2">2</Data>
    <Binary>500072006F00730069006D006F00540075006E006E0065006C005F00690066005F0063006200630032006100300035003600640066006400630032003500660037000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          1/21/2021 9:41:25 AM
Event ID:      7024
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      MANI-WIN10-TEST
Description:
The ProsimoTunnel_if_cbc2a056dfdc25f7 service terminated with the
following service-specific error:
The system cannot find the path specified.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager"
Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service
Control Manager" />
    <EventID Qualifiers="49152">7024</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2021-01-21T17:41:25.8331194Z" />
    <EventRecordID>35950</EventRecordID>
    <Correlation />
    <Execution ProcessID="660" ThreadID="1540" />
    <Channel>System</Channel>
    <Computer>MANI-WIN10-TEST</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">ProsimoTunnel_if_cbc2a056dfdc25f7</Data>
    <Data Name="param2">%%3</Data>
    <Binary>500072006F00730069006D006F00540075006E006E0065006C005F00690066005F0063006200630032006100300035003600640066006400630032003500660037000000</Binary>
  </EventData>
</Event>

Wireguard Logs:
2021-01-21 10:04:20.107655: [TUN] [if_1ea7d00c23a616b1] Starting
WireGuard/0.1.1 (Windows 10.0.19041; amd64)
2021-01-21 10:04:20.108582: [TUN] [if_1ea7d00c23a616b1] Watching
network interfaces
2021-01-21 10:04:20.111915: [TUN] [if_1ea7d00c23a616b1] Resolving DNS names
2021-01-21 10:04:20.181831: [TUN] [if_1ea7d00c23a616b1] Creating
Wintun interface
2021-01-21 10:04:20.896480: [TUN] [if_1ea7d00c23a616b1] Using
Wintun/0.8 (NDIS 6.83)
2021-01-21 10:04:20.909065: [TUN] [if_1ea7d00c23a616b1] Enabling firewall rules
2021-01-21 10:04:22.126556: [TUN] [if_1ea7d00c23a616b1] Starting
WireGuard/0.1.1 (Windows 10.0.19041; amd64)
2021-01-21 10:04:22.127580: [TUN] [if_1ea7d00c23a616b1] Watching
network interfaces
2021-01-21 10:04:22.128604: [TUN] [if_1ea7d00c23a616b1] Resolving DNS names
2021-01-21 10:04:22.135234: [TUN] [if_1ea7d00c23a616b1] Creating
Wintun interface
2021-01-21 10:04:24.156638: [TUN] [if_1ea7d00c23a616b1] Starting
WireGuard/0.1.1 (Windows 10.0.19041; amd64)
2021-01-21 10:04:24.159365: [TUN] [if_1ea7d00c23a616b1] Watching
network interfaces
2021-01-21 10:04:24.159365: [TUN] [if_1ea7d00c23a616b1] Resolving DNS names
2021-01-21 10:04:24.165375: [TUN] [if_1ea7d00c23a616b1] Creating
Wintun interface
2021-01-21 10:04:24.616820: [TUN] [if_1ea7d00c23a616b1] Unable to
create Wintun interface: Error registering rings: Error listing NDIS
interfaces: no interfaces found
2021-01-21 10:04:24.634348: [TUN] [if_1ea7d00c23a616b1] Shutting down
2021-01-21 10:04:26.180594: [TUN] [if_1ea7d00c23a616b1] Starting
WireGuard/0.1.1 (Windows 10.0.19041; amd64)
2021-01-21 10:04:26.181124: [TUN] [if_1ea7d00c23a616b1] Watching
network interfaces
2021-01-21 10:04:26.182501: [TUN] [if_1ea7d00c23a616b1] Resolving DNS names
2021-01-21 10:04:26.247809: [TUN] [if_1ea7d00c23a616b1] Creating
Wintun interface
2021-01-21 10:04:27.594789: [TUN] [if_1ea7d00c23a616b1] Using
Wintun/0.8 (NDIS 6.83)
2021-01-21 10:04:27.697064: [TUN] [if_1ea7d00c23a616b1] Enabling firewall rules
2021-01-21 10:04:27.439705: [TUN] [if_1ea7d00c23a616b1] Dropping privileges
2021-01-21 10:04:27.554834: [TUN] [if_1ea7d00c23a616b1] Creating
interface instance
2021-01-21 10:04:27.668048: [TUN] [if_1ea7d00c23a616b1] Routine: event
worker - started
2021-01-21 10:04:28.840433: [TUN] [if_1ea7d00c23a616b1] Routine:
encryption worker - started
2021-01-21 10:04:29.390799: [TUN] [if_1ea7d00c23a616b1] Routine:
decryption worker - started
2021-01-21 10:04:29.695953: [TUN] [if_1ea7d00c23a616b1] Routine:
handshake worker - started
2021-01-21 10:04:29.116133: [TUN] [if_1ea7d00c23a616b1] Routine: TUN
reader - started
2021-01-21 10:04:29.188358: [TUN] [if_1ea7d00c23a616b1] Setting
interface configuration
2021-01-21 10:04:29.204949: [TUN] [if_1ea7d00c23a616b1] UAPI: Updating
private key
2021-01-21 10:04:29.216665: [TUN] [if_1ea7d00c23a616b1] UAPI: Removing all peers
2021-01-21 10:04:29.237024: [TUN] [if_1ea7d00c23a616b1] UAPI:
Transition to peer configuration
2021-01-21 10:04:29.239373: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - UAPI: Created
2021-01-21 10:04:29.240579: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - UAPI: Updating endpoint
2021-01-21 10:04:29.242548: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - UAPI: Updating persistent keepalive interval
2021-01-21 10:04:29.243066: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - UAPI: Removing all allowedips
2021-01-21 10:04:29.248889: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - UAPI: Adding allowedip
2021-01-21 10:04:29.253095: [TUN] [if_1ea7d00c23a616b1] Bringing peers up
2021-01-21 10:04:29.256190: [TUN] [if_1ea7d00c23a616b1] Routine:
receive incoming IPv6 - started
2021-01-21 10:04:29.260585: [TUN] [if_1ea7d00c23a616b1] Routine:
receive incoming IPv4 - started
2021-01-21 10:04:29.263610: [TUN] [if_1ea7d00c23a616b1] UDP bind has
been updated
2021-01-21 10:04:29.266180: [TUN] [if_1ea7d00c23a616b1] peer(m6bQ.Rxw)
- Starting...
2021-01-21 10:04:29.267507: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - Routine: sequential receiver - started
2021-01-21 10:04:29.268329: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - Routine: nonce worker - started
2021-01-21 10:04:29.269543: [TUN] [if_1ea7d00c23a616b1]
peer(m6bQ.RKxw) - Routine: sequential sender - started
2021-01-21 10:04:29.269543: [TUN] [if_1ea7d00c23a616b1] Monitoring
default v4 routes
2021-01-21 10:04:29.269543: [TUN] [if_1ea7d00c23a616b1] Binding v4
socket to interface 49 (blackhole=false)
2021-01-21 10:04:29.271167: [TUN] [if_1ea7d00c23a616b1] Setting device
v4 addresses
2021-01-21 10:04:29.520194: [TUN] [if_1ea7d00c23a616b1] Monitoring
default v6 routes
2021-01-21 10:04:29.520194: [TUN] [if_1ea7d00c23a616b1] Binding v6
socket to interface 49 (blackhole=false)
2021-01-21 10:04:29.521131: [TUN] [if_1ea7d00c23a616b1] Setting device
v6 addresses
2021-01-21 10:04:29.753887: [TUN] [if_1ea7d00c23a616b1] Listening for
UAPI requests
2021-01-21 10:04:29.753887: [TUN] [if_1ea7d00c23a616b1] Startup complete

RE: Windows Tunnl.dll fails to start as a service.

[Simon Rozman]

Hi,

> Log Name:      System
> Source:        Service Control Manager
> Date:          1/21/2021 9:41:25 AM
> Event ID:      7024
> Task Category: None
> Level:         Error
> Keywords:      Classic
> User:          N/A
> Computer:      MANI-WIN10-TEST
> Description:
> The ProsimoTunnel_if_cbc2a056dfdc25f7 service terminated with the
> following service-specific error:
> The system cannot find the path specified.

"The system cannot find the path specified." <= is your service path correct? Double check it. Mind the path deflection for WoW64 processes. SCM is always native (x64 on x64 Windows, x86 on x86 Windows...). So, the service path must match the path as a native process would see it.

Or is it just the fact that something returns status 2 which is interpreted as ERROR_FILE_NOT_FOUND by the Event Log?

> 2021-01-21 10:04:20.181831: [TUN] [if_1ea7d00c23a616b1] Creating Wintun
> interface
> 2021-01-21 10:04:20.896480: [TUN] [if_1ea7d00c23a616b1] Using
> Wintun/0.8 (NDIS 6.83)
> 2021-01-21 10:04:20.909065: [TUN] [if_1ea7d00c23a616b1] Enabling
> firewall rules
> 2021-01-21 10:04:22.126556: [TUN] [if_1ea7d00c23a616b1] Starting
> WireGuard/0.1.1 (Windows 10.0.19041; amd64)
> 2021-01-21 10:04:22.127580: [TUN] [if_1ea7d00c23a616b1] Watching network
> interfaces
> 2021-01-21 10:04:22.128604: [TUN] [if_1ea7d00c23a616b1] Resolving DNS
> names
> 2021-01-21 10:04:22.135234: [TUN] [if_1ea7d00c23a616b1] Creating Wintun
> interface
> 2021-01-21 10:04:24.156638: [TUN] [if_1ea7d00c23a616b1] Starting
> WireGuard/0.1.1 (Windows 10.0.19041; amd64)
> 2021-01-21 10:04:24.159365: [TUN] [if_1ea7d00c23a616b1] Watching network
> interfaces
> 2021-01-21 10:04:24.159365: [TUN] [if_1ea7d00c23a616b1] Resolving DNS
> names
> 2021-01-21 10:04:24.165375: [TUN] [if_1ea7d00c23a616b1] Creating Wintun
> interface
> 2021-01-21 10:04:24.616820: [TUN] [if_1ea7d00c23a616b1] Unable to create
> Wintun interface: Error registering rings: Error listing NDIS
> interfaces: no interfaces found

Wintun 0.8 is out of our support. Please, upgrade your wireguard-go and Wintun to the latest version first and see if the problem persists.

Why is that important? Because, we completely rewrote the wireguard-go <-> Wintun communication in v0.0.20201118 and v0.10 respectively. The issue you are seeing is triggered in a part of the code that is now gone from wireguard-go and has been rewritten in the new wintun.dll.

(The new Wintun no longer ships as a driver package you need to install, but rather as a self-contained do-it-all DLL. Don't worry, the new wireguard-go knows how to use it. Just add wintun.dll next to it.)

Regards,
Simon

Re: Windows Tunnl.dll fails to start as a service.

[Manikandan Thiagarajan]

Thanks Simon,
I tested the updated tunnel.dll (0.3.4) and latest wintun (0.10) It
fixed startup issues.
The error 2 wasn’t because of the service path. It could be a call to
exit(2) from the tunnel.dll that was interpreted as
ERROR_FILE_NOT_FOUND by the event log. My main() function doesn’t
return 2 it always returns 0.

Thanks,
Mani

On Mon, Jan 25, 2021 at 12:10 AM Simon Rozman <simon@rozman.si> wrote:
>
> Hi,
>
> > Log Name:      System
> > Source:        Service Control Manager
> > Date:          1/21/2021 9:41:25 AM
> > Event ID:      7024
> > Task Category: None
> > Level:         Error
> > Keywords:      Classic
> > User:          N/A
> > Computer:      MANI-WIN10-TEST
> > Description:
> > The ProsimoTunnel_if_cbc2a056dfdc25f7 service terminated with the
> > following service-specific error:
> > The system cannot find the path specified.
>
> "The system cannot find the path specified." <= is your service path correct? Double check it. Mind the path deflection for WoW64 processes. SCM is always native (x64 on x64 Windows, x86 on x86 Windows...). So, the service path must match the path as a native process would see it.
>
> Or is it just the fact that something returns status 2 which is interpreted as ERROR_FILE_NOT_FOUND by the Event Log?
>
> > 2021-01-21 10:04:20.181831: [TUN] [if_1ea7d00c23a616b1] Creating Wintun
> > interface
> > 2021-01-21 10:04:20.896480: [TUN] [if_1ea7d00c23a616b1] Using
> > Wintun/0.8 (NDIS 6.83)
> > 2021-01-21 10:04:20.909065: [TUN] [if_1ea7d00c23a616b1] Enabling
> > firewall rules
> > 2021-01-21 10:04:22.126556: [TUN] [if_1ea7d00c23a616b1] Starting
> > WireGuard/0.1.1 (Windows 10.0.19041; amd64)
> > 2021-01-21 10:04:22.127580: [TUN] [if_1ea7d00c23a616b1] Watching network
> > interfaces
> > 2021-01-21 10:04:22.128604: [TUN] [if_1ea7d00c23a616b1] Resolving DNS
> > names
> > 2021-01-21 10:04:22.135234: [TUN] [if_1ea7d00c23a616b1] Creating Wintun
> > interface
> > 2021-01-21 10:04:24.156638: [TUN] [if_1ea7d00c23a616b1] Starting
> > WireGuard/0.1.1 (Windows 10.0.19041; amd64)
> > 2021-01-21 10:04:24.159365: [TUN] [if_1ea7d00c23a616b1] Watching network
> > interfaces
> > 2021-01-21 10:04:24.159365: [TUN] [if_1ea7d00c23a616b1] Resolving DNS
> > names
> > 2021-01-21 10:04:24.165375: [TUN] [if_1ea7d00c23a616b1] Creating Wintun
> > interface
> > 2021-01-21 10:04:24.616820: [TUN] [if_1ea7d00c23a616b1] Unable to create
> > Wintun interface: Error registering rings: Error listing NDIS
> > interfaces: no interfaces found
>
> Wintun 0.8 is out of our support. Please, upgrade your wireguard-go and Wintun to the latest version first and see if the problem persists.
>
> Why is that important? Because, we completely rewrote the wireguard-go <-> Wintun communication in v0.0.20201118 and v0.10 respectively. The issue you are seeing is triggered in a part of the code that is now gone from wireguard-go and has been rewritten in the new wintun.dll.
>
> (The new Wintun no longer ships as a driver package you need to install, but rather as a self-contained do-it-all DLL. Don't worry, the new wireguard-go knows how to use it. Just add wintun.dll next to it.)
>
> Regards,
> Simon