[Bug 21572] New: KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

http://bugs.winehq.org/show_bug.cgi?id=21572

Summary: KFSensor 4.5.0 Professional Trial: Trouble starting
                    and stopping the service
           Product: Wine
           Version: 1.1.37
          Platform: x86-64
               URL: http://www.keyfocus.net/kfsensor/download/kfsens40.exe
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=26016)
 --> (http://bugs.winehq.org/attachment.cgi?id=26016)
advapi and more --  Operation Failure

This one is a fairly erratic but greatly prolific bug. In the log attached, you
see my first launch of the application works after running the wizard, followed
by closing the application and attempting to start the server to no avail until
you see the "LockWindowUpdate" when it finally starts.

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

http://bugs.winehq.org/show_bug.cgi?id=21572

Luke  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download

--- Comment #1 from Luke   2010-02-01 17:02:39 ---
Adding keyword download since it's a free trial.

Also make sure you uncheck the "run as windows service" during wizard setup,
else the program won't run at all.

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

http://bugs.winehq.org/show_bug.cgi?id=21572

Andrew Nguyen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #26016|application/octet-stream    |text/plain
          mime type|                            |

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

http://bugs.winehq.org/show_bug.cgi?id=21572

--- Comment #2 from Vitaliy Margolen   2010-02-01 19:29:02 ---
err:module:import_dll Library NPPTools.dll (which is needed by
L"C:\windows\system32\WanPacket.dll") not found
err:module:import_dll Library WanPacket.dll (which is needed by
L"C:\windows\system32\packet.dll") not found
err:module:import_dll Library packet.dll (which is needed by L"C:\Program
Files\KeyFocus\KFSensor\bin\kfwpcap40.dll") not found

Wine doesn't have implementation for those dlls. And, according to google, they
are part of Netowrk Monitor which was removed from Windows as well (starting
from Vista). You can install it and see if it will work for you.

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

http://bugs.winehq.org/show_bug.cgi?id=21572

Qian Hong  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #3 from Qian Hong  2012-02-29 08:12:15 CST ---
(In reply to comment #2)
> err:module:import_dll Library NPPTools.dll (which is needed by
> L"C:\windows\system32\WanPacket.dll") not found
> err:module:import_dll Library WanPacket.dll (which is needed by
> L"C:\windows\system32\packet.dll") not found
> err:module:import_dll Library packet.dll (which is needed by L"C:\Program
> Files\KeyFocus\KFSensor\bin\kfwpcap40.dll") not found
>
> Wine doesn't have implementation for those dlls. And, according to google, they
> are part of Netowrk Monitor which was removed from Windows as well (starting
> from Vista). You can install it and see if it will work for you.

I've open a new bug for npptools.dll:
http://bugs.winehq.org/show_bug.cgi?id=30041

Do you think it should be a dup of this one?

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

https://bugs.winehq.org/show_bug.cgi?id=21572

Ken Sharp  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |Abandoned?

--- Comment #4 from Ken Sharp  ---
Is this still an issue in Wine 1.7.45 or later?

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

https://bugs.winehq.org/show_bug.cgi?id=21572

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #5 from [e-mail] ---
The 1st run when doing install seems to go well, but I cant get it started
after that.

err:module:import_dll Library packet.dll (which is needed by L"C:\Program
Files\KeyFocus\KFSensor\bin\kfwpcap411.dll") not found

wine 1.7.49

[Bug 21572] KFSensor 4.5.0 Professional Trial: Trouble starting and stopping the service

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=21572

joaopa  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #6 from joaopa  ---
Created attachment 70996
  --> https://bugs.winehq.org/attachment.cgi?id=70996
Screenshot showing everything is fine

Looks like the bug with wine-6.21.
Can an administrator close this bug as FIXED?

[Bug 21572] KFSensor 4.x/5.x: 'kfsnserv.exe' service fails to reliably stop/start/restart

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=21572

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
           Keywords|Abandoned?                  |
         Resolution|---                         |FIXED
            Summary|KFSensor 4.5.0 Professional |KFSensor 4.x/5.x:
                   |Trial: Trouble starting and |'kfsnserv.exe' service
                   |stopping the service        |fails to reliably
                   |                            |stop/start/restart
                URL|http://www.keyfocus.net/kfs |https://web.archive.org/web
                   |ensor/download/kfsens40.exe |/20211112083705/http://www.
                   |                            |keyfocus.net/kfsensor/downl
                   |                            |oad/kfsens40.exe
                 CC|                            |[e-mail]

--- Comment #7 from Anastasius Focht  ---
Hello folks,

--- quote ---
Screenshot showing everything is fine
--- quote ---

your screenshot shows an empty treeview on the left-hand side ('localhost'
node). Just because the main UI is shown doesn't mean things are fixed.

There were different issues mixed in here. The packet/npptools modules were
separately handled. This one is about the 'kfsnserv.exe' service not properly
running after stop/start (restart) sequences.

Did you start/stop/(re)start the system service via UI and check what's
happening?

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files (x86)/KeyFocus/KFSensor/bin

$ WINEDEBUG=+loaddll,+process,+service wine ./kfsensmonitor.exe
...
003c:trace:service:scmdatabase_load_services Loading service L"KeyFocusSensor"
003c:trace:service:load_service_config Image path           = L"C:\Program
Files (x86)\KeyFocus\KFSensor\bin\kfsnserv.exe"
003c:trace:service:load_service_config Group                = (null)
003c:trace:service:load_service_config Service account name = L"LocalSystem"
003c:trace:service:load_service_config Display name         = L"KFSensor"
003c:trace:service:load_service_config Service dependencies : (none)
003c:trace:service:load_service_config Group dependencies   : (none)
003c:trace:service:scmdatabase_load_services Loading service L"KFMond"
003c:trace:service:load_service_config Image path           = L"C:\Program
Files (x86)\KeyFocus\KFSensor\bin\kfmond.exe"
003c:trace:service:load_service_config Group                = (null)
003c:trace:service:load_service_config Service account name = L"LocalSystem"
003c:trace:service:load_service_config Display name         = L"KFSensor
Monitor Service"
003c:trace:service:load_service_config Service dependencies : (none)
003c:trace:service:load_service_config Group dependencies   : (none)
...
--- snip ---

There are log files in 'c:\kfsensor\logs\system_<datestamp>.log' about
service status/failures.

First, you need 'cap_net_raw+epi' on Wine's 32-bit preloader otherwise the
service behaves badly.

--- snip ---
...
[2021/11/12 10:38:20.593 5 +0100] Service starting {INFO}  <5.6.0>
[2021/11/12 10:38:20.610 5 +0100] Config {INFO}  <SysLog: Enabled:False
Format:STD Server::514>
[2021/11/12 10:38:20.629 5 +0100] Cannot listen to network interface 'wlp4s0.
', interface is not IP based {WARNING} 
<\Device\NPF_{00000003-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.630 5 +0100] Cannot listen to network interface
'virbr0-nic. ', interface is not IP based {WARNING} 
<\Device\NPF_{00000005-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.638 5 +0100] Error opening network interface 'enp5s0'
{ERROR}  <enp5s0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.639 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.645 5 +0100] Error opening network interface 'enp5s0'
{ERROR}  <enp5s0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.645 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.651 5 +0100] Error opening network interface 'lo' {ERROR} 
<lo: You don't have permission to capture on that device (socket: Operation not
permitted), \Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.651 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.657 5 +0100] Error opening network interface 'enp5s0'
{ERROR}  <enp5s0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.657 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.664 5 +0100] Error opening network interface 'lo' {ERROR} 
<lo: You don't have permission to capture on that device (socket: Operation not
permitted), \Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.664 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.670 5 +0100] Error opening network interface 'virbr0'
{ERROR}  <virbr0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.670 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.676 5 +0100] Error opening network interface 'enp5s0'
{ERROR}  <enp5s0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.676 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.678 5 +0100] ERROR: Bind on port {ERROR}  <TCP Any:1>
[2021/11/12 10:38:20.679 5 +0100] ERROR: Bind on port {ERROR}  <TCP Any:7>
...
[2021/11/12 10:38:20.695 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.697 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:7>
[2021/11/12 10:38:20.699 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:13>
[2021/11/12 10:38:20.699 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:17>
[2021/11/12 10:38:20.699 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:19>
[2021/11/12 10:38:20.699 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:67>
[2021/11/12 10:38:20.699 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:137>
[2021/11/12 10:38:20.700 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:138>
[2021/11/12 10:38:20.700 5 +0100] Service started {NOTICE}  <5.6.0>
[2021/11/12 10:38:20.702 5 +0100] Error opening network interface 'lo' {ERROR} 
<lo: You don't have permission to capture on that device (socket: Operation not
permitted), \Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.702 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.708 5 +0100] Error opening network interface 'virbr0'
{ERROR}  <virbr0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
[2021/11/12 10:38:20.708 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
...
<repeats endlessly, filling logs very quickly>
--- snip ---

Because of that, SCM requests to the service to stop take ~40 secs to be
fulfilled:

--- snip ---
[2021/11/12 10:39:49.421 5 +0100] Service stopping {NOTICE} 
...
[2021/11/12 10:40:31.718 5 +0100] Error opening network interface 'virbr0'
{ERROR}  <virbr0: You don't have permission to capture on that device (socket:
Operation not permitted), \Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
[2021/11/12 10:40:31.718 5 +0100] Network capture shutting down {NOTICE} 
<\Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
[2021/11/12 10:40:31.724 5 +0100] Service stopped {NOTICE}  <5.6.0>
--- snip ---

If you try stop the service in between via UI you will get "an error occurred
controlling the system service".

With 'cap_net_raw+epi' the service is obviously more responsive - because it
can open network interfaces for capture.

--- snip ---
$ sudo setcap cap_net_raw+eip $(which wine-preloader)
--- snip ---

--- snip ---
[2021/11/12 10:44:38.682 5 +0100] Service starting {INFO}  <5.6.0>
[2021/11/12 10:44:38.691 5 +0100] Config {INFO}  <SysLog: Enabled:False
Format:STD Server::514>
[2021/11/12 10:44:38.705 5 +0100] Cannot listen to network interface 'wlp4s0.
', interface is not IP based {WARNING} 
<\Device\NPF_{00000003-0000-0000-0000-4E6574446576}>
[2021/11/12 10:44:38.706 5 +0100] Cannot listen to network interface
'virbr0-nic. ', interface is not IP based {WARNING} 
<\Device\NPF_{00000005-0000-0000-0000-4E6574446576}>
[2021/11/12 10:44:38.725 5 +0100] Monitoring network interface 'enp5s0' {INFO} 
<\Device\NPF_{00000002-0000-0000-0000-4E6574446576}>
[2021/11/12 10:44:38.743 5 +0100] Monitoring network interface 'lo' {INFO} 
<\Device\NPF_{00000001-0000-0000-0000-4E6574446576}>
[2021/11/12 10:44:38.761 5 +0100] Monitoring network interface 'virbr0' {INFO} 
<\Device\NPF_{00000004-0000-0000-0000-4E6574446576}>
[2021/11/12 10:44:38.769 5 +0100] ERROR: Bind on port {ERROR}  <TCP Any:1>
[2021/11/12 10:44:38.769 5 +0100] ERROR: Bind on port {ERROR}  <TCP Any:7>
...
[2021/11/12 10:44:38.792 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:137>
[2021/11/12 10:44:38.792 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:138>
[2021/11/12 10:44:38.793 5 +0100] Service started {NOTICE}  <5.6.0>
--- snip ---

Stopping - still takes considerable time but less than before:

--- snip ---
[2021/11/12 10:46:06.980 5 +0100] Service stopping {NOTICE} 
[2021/11/12 10:46:26.160 5 +0100] Service stopped {NOTICE}  <5.6.0>
--- snip ---

'restart' via UI:

--- snip ---
[2021/11/12 10:53:08.969 5 +0100] Service Restart request {NOTICE} 
[2021/11/12 10:53:08.969 5 +0100] Service stopping {NOTICE} 
[2021/11/12 10:53:26.433 5 +0100] Service stopped {NOTICE}  <5.6.0>
[2021/11/12 10:53:26.627 5 +0100] Loaded 1 Visitor Rules {INFO} 
[2021/11/12 10:53:26.638 5 +0100] Loaded 36 signatures, time: 2021-04-19
03:06:58:000 {NOTICE}  <C:\kfsensor\conf\kfsigs.xml>
[2021/11/12 10:53:26.641 5 +0100] Service starting {INFO}  <5.6.0>
...
[2021/11/12 10:53:26.753 5 +0100] ERROR: Bind on port {ERROR}  <UDP Any:138>
[2021/11/12 10:53:26.754 5 +0100] Service started {NOTICE}  <5.6.0>
--- snip ---

BTW the current 'kfsens40.exe' download is KFSensor v5.6.0. The vendor decided
to recycle the same binary name 'kfsens40.exe' for different versions for
whatever stupid reasons. No prior archive.org snapshots exist from the original
vendor site. There might be alternate mirrors with older versions which have
archive.org snapshots though.

https://web.archive.org/web/20211112083705/http://www.keyfocus.net/kfsensor/...

$ sha1sum kfsens40.exe 
476ab6937c962395c8149dc05639b57d67a099b1  kfsens40.exe

$ du -sh kfsens40.exe 
3.8M    kfsens40.exe

$ wine --version
wine-6.21-182-g3dbce69fd4c

Regards

[Bug 21572] KFSensor 4.x/5.x: 'kfsnserv.exe' service fails to reliably stop/start/restart

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=21572

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Alexandre Julliard  ---
Closing bugs fixed in 6.22.