Fort not exiting on uninstalling and sometimes upgrading fails for not exiting and keeping the `FortFirewall.exe` process alive

Emi-Emi-Emi commented 1 month ago

I was making some tests, and when I tried to uninstall Fort, Fort is not closing FortFirewall.exe causing the obvious problems of not removing the program that is already running.

Also, since yesterday, when I tried to upgrade Fort manually or through winget, the upgrading will fail because FortFirewall.exe is not being closed on upgrade either, this doesn't happen always though, but I could reproduce it often, and while Fort is being installed, you can see the Fort tray icon and all that and then the error appears that it can't replace some files. When upgrading through Winget it is even worst because since it is completely silent, it seems to install, but since can't do the driver stuff, it causes a strange behavior where Fort to open like if it was newly installed in %localappdata% instead of the ProgramData, and then the driver never installed correctly.

And sometimes it will just open like a new installation, so it 'allows' everything because ignores ProgramData files, and then it throws the error:

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

C:\Program Files\Fort Firewall\driver\scripts>sc stop fortfw

SERVICE_NAME: fortfw
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 3  STOP_PENDING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\Program Files\Fort Firewall\driver\scripts>sc delete fortfw
[SC] DeleteService SUCCESS
C:\WINDOWS\System32\drivers\fortfw.sys
Access is denied.
End execution... Result Code = 0
Error: Driver already installed. Uninstall it first
End execution... Result Code = 1
Press any key to continue . . .

And this is what Winget says:

Defaulting to Abort for suppressed message box (Abort/Retry/Ignore):
C:\Program Files\Fort Firewall\FortFirewall.exe
An error occurred while trying to replace the existing file:
DeleteFile failed; code 5.
Access is denied.
Click Retry to try again, Ignore to skip this file (not recommended), or Abort to cancel
User canceled the installation process.
Rolling back changes.

So maybe it is related since it seems it is just Fort not closing on uninstallation and upgrading silently or manually through the github exe.

tnodir commented 1 month ago

It was a regression in v3.12.8 Fixed in v3.12.9

Can you please test the updating from v3.12.9 to v3.12.10? Does it fail sometimes too?

Emi-Emi-Emi commented 1 month ago

Yes, it was when I updated from 3.12.9 to 3.12.10 through Winget but also I tested manually, like installed 9 and to 10 immediately and same problems with Access is denied., just the same issue as yesterday from 8 to 9, also downgrading from .10 to .9 caused similar issue sometimes

And uninstalling is happening always:

Emi-Emi-Emi commented 1 month ago

Clean installing 3.12.9 and then upgrading through winget

Emi-Emi-Emi commented 1 month ago

Upgrading from 3.12.9 to 3.12.10 manually didn't seem to throw any error on installation

But opened in clean installation 'user' mode

and when restarting Fort it just says:

And then I had to reinstall the driver for it to work.

tnodir commented 1 month ago

But opened in clean installation 'user' mode

How to reproduce it step by step please?

Emi-Emi-Emi commented 1 month ago

I just opened Terminal, cd Downloads and: FortFirewall-3.12.9-windows10-x86_64.exe with no flags or anything so I just clicked on the setup and when it is done. FortFirewall-3.12.10-windows10-x86_64.exe and same, no silent or any flag, plain and simple run installation through terminal and that causes the issue.

with Winget the same installed FortFirewall-3.12.9-windows10-x86_64.exe with silent flag or anything and then winget upgrade fort.firewall -s winget which does it completely silent.

Nothing special, just normal running the installers, only through terminal but that's it.

I have Windows 11 Pro 23H2 22631.3593 BTW.

tnodir commented 1 month ago

Thanks, let me check it tomorrow..

Emi-Emi-Emi commented 1 month ago

Ok! I was also recording the issues so you can see how easy is to reproduce, especially Winget.

But I get different results from time to time, sometimes installation fails sometimes it completes but then it driver still threw the access denied and then causes Fort to start from zero like in this case:

https://github.com/tnodir/fort/assets/152097351/13d53949-6bf7-43b6-9863-944f8d8b75ce

https://github.com/tnodir/fort/assets/152097351/30561b52-1ea8-4126-b737-62a0f40a659e

In this one for example, the installation did what the installation is supposed to do, throwing the error how access denied because Fort is still running. Seems like I couldn't reproduce what I showed in my screenshot where the installation just continues (like the winget one) and doesn't throw an error, not even the driver installation log thing like Winget did, but when Fort opens, it will open from zero, just creating the files in %localappdata%\fort firewall and you have to repair the driver for it to work.

But it is basically the same, fort not exiting and then causing installation and uninstallation to work incorrectly, sometimes it just seems to cause more issues than just closing Fort process and run the installation again / click retry.

Good night!

Edit: I think i run 3.12.9 over 3.12.9 lol but I still got that behavior sometimes when upgrading to 3.12.10 where it throws the error though. So it should still apply.

However, this is the new behavior I got when upgrading from 3.12.9 to 3.12.10 and how it completes the installation even if the error is present, same as Winget. When opening Fort it takes the settings from %localappdata% and then on restarting it goes back to %programdata% but since the driver never was installed properly then it doesn't work properly.

https://github.com/tnodir/fort/assets/152097351/6f05741b-b3a7-4ebd-ab5e-5c616fe0d510

ValiumBear commented 1 month ago

I don't know if this is related, but upgrading every time (from the app itself) causes internet to break and forces me to restart or stay without internet.

tnodir commented 1 month ago

@Emi-Emi-Emi Please check the v3.12.11-test01. You can test by installing it over self.

tnodir commented 1 month ago

upgrading every time (from the app itself) causes internet to break and forces me to restart or stay without internet.

@ValiumBear What do you mean by "internet to break"? Is internet non-functional until computer restarted?

ValiumBear commented 1 month ago

Is internet non-functional until computer restarted?

Exactly. Has been the case for the past updates I've tried. Edit: If I'm the only one then it's related to AdGuard Desktop also using WFP.

Emi-Emi-Emi commented 1 month ago

@tnodir Uninstalling seems to work okay now.

upgrading from 3.12.10 to 3.12.11-test01 causes the same issue where it would complete installation and driver has no access so it doesn't load correctly.

In place upgrade (3.12.11-test01 to 3.12.11-test01) goes back to give me the error.

What I notice now, is that Fort is closing Fort on upgrade (and the reason why FortFirewall.exe version updates), but it relaunches the FortFirewall.exe process in the middle of the installation causing the access denied for the driver part.

https://github.com/tnodir/fort/assets/152097351/194b4bef-0733-47a2-8f70-dd18d608e6f7

tnodir commented 1 month ago

Fort is closing Fort on upgrade (and the reason why FortFirewall.exe version updates), but it relaunches the FortFirewall.exe process in the middle of the installation

Actually, the relaunching logic of 3.12.11-test01 is as following:

Installer creates empty inst.tmp file on startup and deletes it on exit
Installer notifies a Service to restart clients and to exit
Clients launch cmd.exe with long command line to run FortFirewall.exe when inst.tmp does not exist

So, it's expected that updating from 3.12.10 to 3.12.11-test01 will fail on your testing.

But updating from 3.12.11-test01 to self should work.

How are you updating step by step? I can't reproduce the bug..

Maybe you should install the 3.12.11-test01 from scratch (after old version uninstall)?

Because on your video the cmd.exe runs the FortFirewall.exe after 2 seconds, which is the old behavior.

Emi-Emi-Emi commented 1 month ago

No, I am upgrading just 3.12.11-test01 to 3.12.11-test01, what I mean about the version is that the program always upgraded version, but still didn't install correctly, of course 3.12.11-test01 to 3.12.11-test01 will not change version, but the video displays how the PID changes and FortFirewall.exe (the client) relaunches (it also opens on the tray) before the installation finished and it happens when the driver says access denied.

go to terminal. cd Downloads FortFirewall-3.12.11-test01-windows10-x86_64.exe and hit enter. click next next next and then it throws the error.

I only run the installer, I also tried just running from File Explorer like a normal person and same issue.

All I do is updating on top of Fort that is already running, of course if I close it will install properly but not when FortFirewall client is running.

tnodir commented 1 month ago

FortFirewall.exe (the client) relaunches (it also opens on the tray) before the installation finished and it happens when the driver says access denied.

I'm doing the same steps:

Service and UI processes are running
start 3.12.11-test0 Installer from terminal and click Next until last page
there is a waiting cmd.exe (which runs ping.exe to wait 1 second and checks for inst.tmp file existence in the app's folder)
and UI launches only after clicking last Next button in Installer (i.e. after inst.tmp file deletion by Installer on exit)

Can you please check the waiting cmd.exe details:

working directory
command line arguments ?

And please check that inst.tmp file exists during installation?

Emi-Emi-Emi commented 1 month ago

So I tried it in another computer and cmd is present, same, runs and then closes and then gives Access Denied about the driver, So it is not my computer, but both computers have Windows 11 Pro 23H2.

that cmd.exe says:

C:\WINDOWS\system32\cmd.exe /c "for /L %i in (1,1,30) do (ping -n 2 127.0.0.1 >NUL & if not exist inst.tmp start FortFirewall.exe --restarted & exit)"

tnodir commented 1 month ago

And please check that inst.tmp file exists during installation?

Emi-Emi-Emi commented 1 month ago

I manually created the inst.tmp file in Fort directory with echo > inst.tmp before running the installer and it works and it installs fine.

I see the inst.tmp file, but not before the error, it seems to be after the error and when I close Fort Firewall so it install properly after hitting retry, before that it is just the is-whatever tmp installer.

https://github.com/tnodir/fort/assets/152097351/f799d922-f94d-422d-82c6-c63fa48f312f

You can see here how it works fine if the file previously exists. I am also installing with /silent /launch in this case BTW, but it works the same running the installer normally. Running /Launch or checking the box at the end of the installer, seems like now it opens Fort UI though, not just a tray icon (like double clicking desktop icon), but that's not like the biggest issue. Just a small detail about it, but I am not the one opening it, but you can see it works fine.

https://github.com/tnodir/fort/assets/152097351/db9f8d39-0d30-4719-b185-eb20646b28a6

tnodir commented 1 month ago

Ah classic racing bug. Client launches faster than installer creates the .tmp file..

tnodir commented 1 month ago

@Emi-Emi-Emi Please check v3.12.11.

tnodir commented 1 month ago

@ValiumBear What options do you use in the Options: "Self Protection"?

Emi-Emi-Emi commented 1 month ago

@tnodir from v3.12.11 to v3.12.11, installed with no issues. from v3.12.10 to v3.12.11 a got the little issue where Fort wasn't taking the %programdata% and the driver has to be reinstalled if Fort is not closed before upgrading because the installer completes without throwing an error or it only needed the restart and no issues with driver, but still needed the first restart of client before using the proper settings.

Besides that, now I still see Fort launching by itself without /Launch or checking the box launches Fort again, which means if you use those options, it will cause the UI to be seen. The issue with this is that My Fort might launch again and if Auto-Show Menu checked, sometimes the menu opens floating and the window stays in the background.

But besides that, if upgrading fort after v3.12.11+ works fine, then that's good, even if some existing users might have an issue upgrading to .11 if they are on .10. This is the biggest issue I can see, the upgrade from previous versions, because the driver, in that case just starting Fort with admin right should get the reinstall button active if necessary, but maybe there should have been a way to have the button available without admin rights to elevate Fort and then making users figure it out better how to deal with it. Also how %localappdata% will get some created if the user upgrades and Fort starts without the driver properly installed, but I guess not much can be done about that besides the user manually removing them like I did.

But seems like v3.12.11 over v3.12.11 works fine.

Edit: I tested and self updating works fine, so I guess all I said should be seen as a minor issue because I doubt many are upgrading manually downloading the installer or through winget from .10 to .11 (maybe just me in that case), so, in theory, not many should be affected by this, and that means not many have to figure it out how to close Fort and reinstall driver for example or run the installer again so it gets properly installed.

tnodir commented 1 month ago

seems like now it opens Fort UI though, not just a tray icon (like double clicking desktop icon)

Fixed by 283f674d

@Emi-Emi-Emi Thanks for testing it. Yes, it should work properly for v3.12.11+ updates.

tnodir commented 1 month ago

@ValiumBear Please try updating from 3.12.10 to 3.12.11:

does your Internet work fine after update?
if not, then does the Driver show "Installed" in the "My Fort" window after update?

ValiumBear commented 1 month ago

Updated and no internet again. Driver shows as installed. Tried restarting the services but no success. Only restart works.

What options do you use in the Options: "Self Protection"?

iq9VQT3dUy

tnodir commented 1 month ago

Updated and no internet again. Driver shows as installed. Tried restarting the services but no success. Only restart works.

Please try to update the v3.12.11 over itself by starting the Installer manually. Does Internet work?

What are Windows' version & build numbers?

ValiumBear commented 1 month ago

No, it's the same story after reinstalling over itself. System is Windows 10 Build 19045.4412. Did you rule out AdGuard Desktop WPF interaction? Can you reproduce what I get? Once the internet is down, AdGuard also freaks out and can't restart it's service properly.

tnodir commented 1 month ago

@ValiumBear "Filter local addresses" flag is turned on in your screenshot.

Maybe some service is broken without loopback (127.0.0.1) or broadcast (255.255.255.255) connections between driver re-installation?

tnodir commented 1 month ago

@ValiumBear Try to turn off the "Block traffic when Fort Firewall is not running" flag during update.

ValiumBear commented 1 month ago

"Filter local addresses" flag is turned on in your screenshot.

Disabling this fixed it. After reinstall internet works. I shouldn't be filtering localhost, AdGuard Desktop lives there. Thanks for your help. :)

tnodir commented 1 month ago

@Emi-Emi-Emi Can you please check the v3.12.13-test03 by updating itself?

I've simplified the restarting script:

removed the for loop, because it's not working on Win7
so, cmd.exe just waits for 3 seconds and then launches UI, if inst.tmp does not exist

Emi-Emi-Emi commented 1 month ago

@tnodir working great on my side 👍

tnodir commented 2 weeks ago

@Emi-Emi-Emi Can you please double check the v3.13.1-test01 by updating itself?

Added "restart.bat" script to workaround a Win7 limitations. The script file will be created on update.

Emi-Emi-Emi commented 2 weeks ago

@tnodir no issues 👍

tnodir / fort

Fort not exiting on uninstalling and sometimes upgrading fails for not exiting and keeping the `FortFirewall.exe` process alive #254