{"record":{"id":"47dd0694c195d313","repo":"slackhq/nebula","slug":"fwpmsublayeradd0-0x-x","errorCode":null,"errorMessage":"FwpmSubLayerAdd0: 0x%x","messagePattern":"FwpmSubLayerAdd0: 0x%x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wfp/wfp_windows.go","lineNumber":287,"sourceCode":"\tkey, err := windows.GenerateGUID()\n\tif err != nil {\n\t\treturn windows.GUID{}, fmt.Errorf(\"GenerateGUID for sublayer: %w\", err)\n\t}\n\n\tname, _ := windows.UTF16PtrFromString(\"Nebula WDF bypass sublayer\")\n\tdesc, _ := windows.UTF16PtrFromString(\"Permit filters bypassing Windows Defender Firewall\")\n\tsl := fwpmSublayer0{\n\t\tsubLayerKey: key,\n\t\tdisplayData: fwpmDisplayData0{name: name, description: desc},\n\t\tweight:      0xFFFF,\n\t}\n\tr1, _, _ := procFwpmSubLayerAdd0.Call(\n\t\tengine,\n\t\tuintptr(unsafe.Pointer(&sl)),\n\t\t0, // sd == NULL\n\t)\n\tif r1 != 0 {\n\t\treturn windows.GUID{}, fmt.Errorf(\"FwpmSubLayerAdd0: 0x%x\", r1)\n\t}\n\treturn key, nil\n}\n\nfunc addInterfaceFilter(engine uintptr, sublayerKey, layer windows.GUID, luid uint64) error {\n\tname, _ := windows.UTF16PtrFromString(\"Nebula allow interface inbound\")\n\tdesc, _ := windows.UTF16PtrFromString(\"Permits inbound traffic on a nebula interface\")\n\n\t// luid must remain addressable through the syscall -- FWP_UINT64 is stored\n\t// by pointer in the FWP_VALUE0 union.\n\tcond := fwpmFilterCondition0{\n\t\tfieldKey:  fwpmConditionIPLocalInterface,\n\t\tmatchType: fwpMatchEqual,\n\t\tconditionValue: fwpValue0{\n\t\t\ttype_: fwpUint64,\n\t\t\tvalue: uintptr(unsafe.Pointer(&luid)),\n\t\t},\n\t}","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/wfp/wfp_windows.go#L269-L305","documentation":"registerSublayer calls FwpmSubLayerAdd0 to add the dynamic, session-scoped sublayer (weight 0xFFFF) to the open engine. This error is thrown when the Win32 call returns non-zero, meaning the sublayer object could not be added to the BFE store. Because the sublayer anchors all subsequent filters, newSession aborts here.","triggerScenarios":"newSession → registerSublayer where FwpmSubLayerAdd0 fails with codes like FWP_E_ACCESS_DENIED (engine handle lacks write access), FWP_E_TXN_IN_PROGRESS / FWP_E_TXN_ABORTED (transaction conflict), or FWP_E_ALREADY_EXISTS (GUID collision, effectively impossible).","commonSituations":"Another WFP-managing agent (VPN client, EDR, Windows Firewall itself) holding the BFE transaction, running with a read-only engine handle, or a third-party product rejecting competing sublayer registrations.","solutions":["Retry newSession — transaction conflicts with other WFP clients are typically transient","Run elevated and confirm the engine was opened in read/write mode","Check the hex code in the message (e.g. 0x80320009 = FWP_E_TXN_IN_PROGRESS) for the precise cause","Temporarily disable conflicting third-party WFP agents to test for interference","Ensure BFE service is healthy: netsh wfp show state"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"func wfpHealthy() bool {\n\treturn exec.Command(\"netsh\", \"wfp\", \"show\", \"state\", \"file=-\").Run() == nil\n}","typeGuard":null,"tryCatchPattern":"s, err := w.PermitUDPPort(port)\nif err != nil && strings.Contains(err.Error(), \"FwpmSubLayerAdd0\") {\n\t// likely transient transaction conflict — retry after delay\n\ttime.Sleep(250 * time.Millisecond)\n\ts, err = w.PermitUDPPort(port)\n}","preventionTips":["Retry newSession on sublayer-add failures; conflicts are usually transient","Avoid running alongside multiple WFP-configuring agents in tests","Keep the Session usage single-owner: never share the engine handle across goroutines","Check the hex code: FWP_E_TXN_* codes indicate transaction conflicts"],"tags":["wfp","windows","sublayer","bfe","firewall"],"backgroundTag":"wfp-sublayer-add-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}