Opened 3 years ago

Last modified 7 months ago

#252 accepted Bug / Defect

OpenVPN-GUI (64-bit) fails after installation

Reported by: djc Owned by: samuli
Priority: major Milestone: release 2.4
Component: Windows GUI Version: 2.3-beta / 2.3-RC
Severity: Not set (if unsure, select this one) Keywords: windows
Cc: cron2


I installed OpenVPN-2.3.0 on my 64-bit Windows 7 install without uninstalling my older OpenVPN install. I install OpenVPN in a custom path. After installing, opening OpenVPN-GUI errors out with this error:

Error while creating HKLM\SOFTWARE\OpenVPN-GUI key.

I tried to remove any old OpenVPN-GUI keys I found in the Registry, but it doesn't appear to work.

Attachments (1)

openvpn-gui-registry-keys.png (15.8 KB) - added by samuli 3 years ago.
List of openvpn-gui registry keys

Download all attachments as: .zip

Change History (22)

comment:1 Changed 3 years ago by cron2

  • Owner set to mattock
  • Status changed from new to assigned

comment:2 Changed 3 years ago by cron2

  • Cc cron2 added

comment:3 Changed 3 years ago by djc

I tried uninstalling 2.3.0, then installing 2.2.2, then uninstalling 2.2.2 and installing 2.3.0, but it still failed the same way. I've now installed 2.2.2 again.

I should note that I successfully installed 2.3.0 on top of 2.2.2 on another box (which also runs 64-bit Windows 7), using the same custom path, although I'm only using the service there (i.e. no UI).

comment:4 Changed 3 years ago by d12fk

Run the GUI as Administrator once. It will be able to create the keys then.

@mattock: the installer should create the GUI keys during installation.

comment:5 Changed 3 years ago by djc

You mean the actual Administrator? I was running it as a user with Admin privs.

comment:6 Changed 3 years ago by d12fk

Yes, the admin group alone won't do the trick as long as you have UAC enabled.

comment:7 Changed 3 years ago by samuli

This is somewhat related to ticket #249. I'll fix both in one go.

comment:8 Changed 3 years ago by samuli

  • Owner changed from mattock to samuli

comment:9 Changed 3 years ago by samuli

Fixing this is not straightforward. So this is how it goes currently:

  • OpenVPN installer does not generate any OpenVPN-GUI registry keys.
  • OpenVPN uninstaller does not delete any OpenVPN-GUI registry keys.
  • When OpenVPN-GUI is launched the first time as admin, it reads the OpenVPN installation directory from the registry. It then creates a fair amount (see the attached image) of registry keys, some of which change dynamically based on OpenVPN install directory.

Currently openvpn-gui registry key generation logic is embedded into the openvpn-gui.exe executable, whereas openvpn registry keys are created by the openvpn installer.

Here are some options for fixing this:

  1. Move the openvpn-gui registry key generation logic into the OpenVPN installer. The downside is that it won't be possible to install openvpn-gui separately from OpenVPN. Also, any registry-related changes in openvpn-gui need to go into the openvpn(-build) project.
  2. Add registry key generation to the openvpn installer while keeping the same logic in openvpn-gui.exe. This creates redundancy and could possibly trigger some interesting bugs in openvpn-gui.exe.
  3. Create a proper installer script for openvpn-gui, which can be embedded into the openvpn installer. The installer could be fairly simple, as it only copies one file and creates some registry keys. More stuff, such as openvpn-gui documentation could be added later.
  4. Keep things as they are but document them properly. For example, openvpn-gui could pop up an understandable error message if it's not launched as admin.

I would definitely prefer option 3. Option 4 would be the second best option. I don't think options 1 or 2 make sense.

I don't think openvpn uninstaller should remove OpenVPN-GUI registry keys, either, as they contain some configuration options the user might want to keep. For example, the user could just be uninstalling an older version of openvpn before an upgrade, without any intention of getting rid of openvpn-gui completely. Similarly the openvpn uninstaller does not touch openvpn configuration files.

comment:10 Changed 3 years ago by samuli

OpenVPN-GUI could also check if the registry keys are reasonable (i.e. point to OpenVPN installation dir) when it launches. Currently the GUI just refuses to start up if, say, the user had previously installed OpenVPN to a non-standard directory.

comment:11 Changed 3 years ago by cron2

I think we need to distinguish between "user related" and "program related" registry settings.

Stuff like "where is openvpn.exe?" is a registry key that should be created by the installer *and removed* upon uninstallation - there is no benefit in keeping it around after uninstallation, and no loss incurred by setting it again at re-installation. This would be in line with "option #3" above.

OTOH, options selected by the user in the GUI and stored in the registry should be made by openvpn-gui.exe (obviously), and should not be removed upon logout.

comment:12 Changed 3 years ago by samuli

The most important OpenVPN-GUI-specific user configuration parameters are the user interface language and the proxy settings. The rest of the information can probably be safely deleted when OpenVPN is uninstalled. That should solve this issue, provided that OpenVPN-GUI checks for the existence of individual registry keys during startup. If it only checks if the registry key "directory" (HKEY_LOCAL_MACHONE\SOFTWARE\OpenVPN-GUI) exists, then we still have a problem.

All this said, I'm thinking that the best solution is to create a separate, simple installer and uninstaller for OpenVPN-GUI and embed that into the OpenVPN installer. I'll discuss this with d12fk, maintainer of OpenVPN-GUI. If there are no complaints, I'll start writing an OpenVPN-GUI NSI installer.

Changed 3 years ago by samuli

List of openvpn-gui registry keys

comment:13 Changed 2 years ago by jeffasinger

This happened to me on Windows 7 32 Bit on two occasions, with the 32 bit installer. Adding the required key, in regedit fixed it for me.

Would it be possible for OpenVPN GUI to just do this instead of displaying that error message?

comment:14 Changed 2 years ago by samuli

  • Keywords windows added
  • Milestone set to release 2.4

I wrote an installer for OpenVPN-GUI, which is available here.

Integration with the openvpn-build buildsystem is still missing, but I plan on adding it before the 2.4 release. After that we can close this bug report, and a few other ones that are NSIS-related.

comment:15 Changed 12 months ago by samuli

  • Component changed from Installation to Windows GUI

The openvpn-gui-installer.exe is now integrated into the OpenVPN installer:

The changes are currently in my private openvpn-build fork in the "gui" .

The installer integration has been tested quite thoroughly, but there are a couple of known issues:

  1. OpenVPN-GUI installer is unable to restart the GUI
    • This was a fairly new piece of functionality in openvpn.nsi which was moved to openvpn-gui.nsi. Basically the installer stops the GUI if it it's running, and then should restart it after install. The restart part does not work currently, pobably because something is missing from the openvpn-gui.nsi.
  2. openvpn-gui.exe is unsigned
    • This is a bit annoying, as it's a regression. The problem is that the openvpn-gui build (in openvpn-build) does not sign any files. The signing part is only done after the build, which means that an unsigned openvpn-gui.exe will be embedded into signed openvpn-gui-installer.exe. The underlying problem is openvpn-gui's lack of a proper buildsystem of it's own. For example, tap-windows/tap-windows6 have buildsystems, which sign whatever files they need and then package them into an installer. A somewhat nasty workaround would be to hack signing into the openvpn-gui build functions in openvpn-build. Alternatively the openvpn-gui build could be separated from openvpn-build into a separate buildsystem, but that'd be a major effort probably.

I'll provide test installers later today.

comment:16 Changed 12 months ago by samuli

I sent the changes to openvpn-gui.nsi to the GUI's author. Hopefully they will get merged soon.

comment:17 Changed 12 months ago by samuli

OpenVPN-GUI installer is now fully functional and integrated into openvpn-build. A test installer can be downloaded from here. The associated NSI sources are available in these Git repositories:

The openvpn-gui.nsi script has some additional fixes/changes, but the two issues above still persist.

comment:18 Changed 9 months ago by samuli

  • Status changed from assigned to accepted

comment:19 follow-up: Changed 8 months ago by samuli

New installers with a properly signed openvpn-gui here:

If you test these please report back. Making these required patches to openvpn-gui and openvpn-build which are still pending review.

comment:20 in reply to: ↑ 19 Changed 8 months ago by samuli

Replying to samuli:

New installers with a properly signed openvpn-gui here:

If you test these please report back. Making these required patches to openvpn-gui and openvpn-build which are still pending review.

These include the tap-windows6 (NDIS 6) driver and will not work on Windows XP.

comment:21 Changed 7 months ago by ValdikSS

I've tried to run fresh installed OpenVPN from comment 20 on Windows 8.1 x64 and got an error message that I should run it with administrator privileges once first. Am I missing something?

By the way, if OpenVPN gui still requires administrator privileges to add routes, then should it be better for installer to make a shortcut with "run as administrator" flag set?

Note: See TracTickets for help on using tickets.