{"record":{"id":"c0e6a4902b1f75a6","repo":"slackhq/nebula","slug":"generateguid-for-sublayer-w","errorCode":null,"errorMessage":"GenerateGUID for sublayer: %w","messagePattern":"GenerateGUID for sublayer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wfp/wfp_windows.go","lineNumber":271,"sourceCode":"\tr1, _, _ := procFwpmEngineOpen0.Call(\n\t\t0, // serverName == NULL (local)\n\t\tuintptr(rpcCAuthnWinNT),\n\t\t0, // authIdentity == NULL\n\t\tuintptr(unsafe.Pointer(&session)),\n\t\tuintptr(unsafe.Pointer(&engine)),\n\t)\n\tif r1 != 0 {\n\t\treturn 0, fmt.Errorf(\"FwpmEngineOpen0: 0x%x\", r1)\n\t}\n\treturn engine, nil\n}\n\n// registerSublayer adds a session-scoped sublayer with a freshly generated GUID, weight 0xFFFF so its filters arbitrate\n// above WDF's default sublayer. The sublayer is dynamic (no PERSISTENT flag) and goes away when the engine handle closes.\nfunc registerSublayer(engine uintptr) (windows.GUID, error) {\n\tkey, err := windows.GenerateGUID()\n\tif err != nil {\n\t\treturn windows.GUID{}, fmt.Errorf(\"GenerateGUID for sublayer: %w\", err)\n\t}\n\n\tname, _ := windows.UTF16PtrFromString(\"Nebula WDF bypass sublayer\")\n\tdesc, _ := windows.UTF16PtrFromString(\"Permit filters bypassing Windows Defender Firewall\")\n\tsl := fwpmSublayer0{\n\t\tsubLayerKey: key,\n\t\tdisplayData: fwpmDisplayData0{name: name, description: desc},\n\t\tweight:      0xFFFF,\n\t}\n\tr1, _, _ := procFwpmSubLayerAdd0.Call(\n\t\tengine,\n\t\tuintptr(unsafe.Pointer(&sl)),\n\t\t0, // sd == NULL\n\t)\n\tif r1 != 0 {\n\t\treturn windows.GUID{}, fmt.Errorf(\"FwpmSubLayerAdd0: 0x%x\", r1)\n\t}\n\treturn key, nil","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/wfp/wfp_windows.go#L253-L289","documentation":"registerSublayer begins by generating a fresh GUID for the session-scoped sublayer via windows.GenerateGUID(). This error wraps a failure of that call. GenerateGUID essentially only fails if the underlying Windows UUID generation (CoCreateGuid/UuidCreate) returns an error, which is extremely rare.","triggerScenarios":"Calling newSession on a machine where the OS UUID generator fails (RPCSS/CoCreateGuid unavailable, severely degraded COM/RPC infrastructure).","commonSituations":"Heavily locked-down or corrupted Windows installs, broken COM/RPC runtime, or memory pressure during CoCreateGuid.","solutions":["Retry the operation — the failure is transient/environmental, not deterministic","Reboot or repair the Windows COM/RPC runtime (sfc /scannow) if it persists","Check the wrapped win32 error via errors.Unwrap for the exact cause","Confirm the process can create COM objects (test with another GUID-generating call)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"var s *wfp.Session\nvar err error\nfor i := 0; i < 3; i++ {\n\ts, err = w.PermitUDPPort(port)\n\tif err == nil || !strings.Contains(err.Error(), \"GenerateGUID\") { break }\n\ttime.Sleep(100 * time.Millisecond)\n}","preventionTips":["Treat GUID failures as environmental — retry with backoff","Monitor COM/RPC health on long-lived hosts","Surface the unwrapped errno in telemetry to catch systemic OS issues"],"tags":["wfp","windows","guid","com"],"backgroundTag":"guid-generation-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}