{"record":{"id":"70fbc428457f0740","repo":"slackhq/nebula","slug":"fwpmengineopen0-0x-x","errorCode":null,"errorMessage":"FwpmEngineOpen0: 0x%x","messagePattern":"FwpmEngineOpen0: 0x%x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wfp/wfp_windows.go","lineNumber":261,"sourceCode":"\tif err != nil {\n\t\tprocFwpmEngineClose0.Call(engine)\n\t\treturn nil, windows.GUID{}, err\n\t}\n\treturn &Session{engine: engine}, sublayerKey, nil\n}\n\nfunc openDynamicEngine() (uintptr, error) {\n\tsession := fwpmSession0{flags: fwpmSessionFlagDynamic}\n\tvar engine uintptr\n\tr1, _, _ := procFwpmEngineOpen0.Call(\n\t\t0, // serverName == NULL (local)\n\t\tuintptr(rpcCAuthnWinNT),\n\t\t0, // authIdentity == NULL\n\t\tuintptr(unsafe.Pointer(&session)),\n\t\tuintptr(unsafe.Pointer(&engine)),\n\t)\n\tif r1 != 0 {\n\t\treturn 0, fmt.Errorf(\"FwpmEngineOpen0: 0x%x\", r1)\n\t}\n\treturn engine, nil\n}\n\n// registerSublayer adds a session-scoped sublayer with a freshly generated GUID, weight 0xFFFF so its filters arbitrate\n// above WDF's default sublayer. The sublayer is dynamic (no PERSISTENT flag) and goes away when the engine handle closes.\nfunc registerSublayer(engine uintptr) (windows.GUID, error) {\n\tkey, err := windows.GenerateGUID()\n\tif err != nil {\n\t\treturn windows.GUID{}, fmt.Errorf(\"GenerateGUID for sublayer: %w\", err)\n\t}\n\n\tname, _ := windows.UTF16PtrFromString(\"Nebula WDF bypass sublayer\")\n\tdesc, _ := windows.UTF16PtrFromString(\"Permit filters bypassing Windows Defender Firewall\")\n\tsl := fwpmSublayer0{\n\t\tsubLayerKey: key,\n\t\tdisplayData: fwpmDisplayData0{name: name, description: desc},\n\t\tweight:      0xFFFF,","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/wfp/wfp_windows.go#L243-L279","documentation":"openDynamicEngine calls the Win32 FwpmEngineOpen0 API to open a handle to the Windows Filtering Platform Base Filtering Engine with WinNT authentication and an explicit session. This error is thrown when FwpmEngineOpen0 returns a non-zero win32 error code, formatted as hex (e.g. 0x800706d9 = FWP_E_... / RPC unavailable). No engine handle is returned, so no session can be created.","triggerScenarios":"Any call chain ending in newSession → openDynamicEngine where FwpmEngineOpen0 fails: the Windows Firewall service (mpssvc/BFE) is not running, the process lacks admin rights (FWP_E_ACCESS_DENIED), or the BFE RPC endpoint is unreachable.","commonSituations":"Running the program without an elevated prompt, BFE service stopped or crashed, group policy blocking engine access, running in a service/session without the required privileges, or on hardened hosts where third-party firewalls deny additional clients.","solutions":["Run the process as Administrator — FwpmEngineOpen0 requires elevation","Check the BFE service: sc query BFE and net start BFE if stopped (mpssvc too)","Decode the hex code (e.g. net helpmsg or err.exe) to identify the exact FWP_E_* failure","Verify no third-party security product is blocking WFP engine connections","Confirm the session 0/RPC environment is available if running as a service"],"exampleFix":"// before (diagnosing)\nengine, err := openDynamicEngine()\n// err: FwpmEngineOpen0: 0x80070005\n// after — check BFE + elevation first\nfunc canOpenEngine() error {\n\tif !isAdmin() { return errors.New(\"requires elevation\") }\n\treturn exec.Command(\"net\", \"start\", \"BFE\").Run() // ensure service running\n}","handlingStrategy":"validation","validationCode":"func preflightEngine() error {\n\tif !isAdmin() { return errors.New(\"must run elevated\") }\n\tif err := exec.Command(\"sc\", \"query\", \"BFE\").Run(); err != nil {\n\t\treturn errors.New(\"BFE service not available\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := preflightEngine(); err != nil { log.Fatal(err) }\nif err := w.PermitUDPPort(port); err != nil {\n\tif strings.Contains(err.Error(), \"FwpmEngineOpen0\") {\n\t\tlog.Fatalf(\"WFP engine unavailable: %v\", err) // fail fast, service-level issue\n\t}\n}","preventionTips":["Ship an elevation check (isElevated) before any WFP call","Ensure the BFE/mpssvc services are running; add a dependency if installing as a service","Decode hex win32 codes in logs (0x80070005 = access denied)","Run integration tests on a clean elevated environment"],"tags":["wfp","windows","bfe","firewall","privileges"],"backgroundTag":"bfe-engine-open-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}