What causes "GenerateGUID for sublayer: %w" in slackhq/nebula?

Retry the operation — the failure is transient/environmental, not deterministic

GenerateGUID for sublayer: %w

Error message

GenerateGUID for sublayer: %w

What it means

registerSublayer begins by generating a fresh GUID for the session-scoped sublayer via windows.GenerateGUID(). This error wraps a failure of that call. GenerateGUID essentially only fails if the underlying Windows UUID generation (CoCreateGuid/UuidCreate) returns an error, which is extremely rare.

Source

Thrown at wfp/wfp_windows.go:271

	r1, _, _ := procFwpmEngineOpen0.Call(
		0, // serverName == NULL (local)
		uintptr(rpcCAuthnWinNT),
		0, // authIdentity == NULL
		uintptr(unsafe.Pointer(&session)),
		uintptr(unsafe.Pointer(&engine)),
	)
	if r1 != 0 {
		return 0, fmt.Errorf("FwpmEngineOpen0: 0x%x", r1)
	}
	return engine, nil
}

// registerSublayer adds a session-scoped sublayer with a freshly generated GUID, weight 0xFFFF so its filters arbitrate
// above WDF's default sublayer. The sublayer is dynamic (no PERSISTENT flag) and goes away when the engine handle closes.
func registerSublayer(engine uintptr) (windows.GUID, error) {
	key, err := windows.GenerateGUID()
	if err != nil {
		return windows.GUID{}, fmt.Errorf("GenerateGUID for sublayer: %w", err)
	}

	name, _ := windows.UTF16PtrFromString("Nebula WDF bypass sublayer")
	desc, _ := windows.UTF16PtrFromString("Permit filters bypassing Windows Defender Firewall")
	sl := fwpmSublayer0{
		subLayerKey: key,
		displayData: fwpmDisplayData0{name: name, description: desc},
		weight:      0xFFFF,
	}
	r1, _, _ := procFwpmSubLayerAdd0.Call(
		engine,
		uintptr(unsafe.Pointer(&sl)),
		0, // sd == NULL
	)
	if r1 != 0 {
		return windows.GUID{}, fmt.Errorf("FwpmSubLayerAdd0: 0x%x", r1)
	}
	return key, nil

View on GitHub (pinned to dd8f660c0a)

Solutions

Retry the operation — the failure is transient/environmental, not deterministic
Reboot or repair the Windows COM/RPC runtime (sfc /scannow) if it persists
Check the wrapped win32 error via errors.Unwrap for the exact cause
Confirm the process can create COM objects (test with another GUID-generating call)

Defensive patterns

Strategy: retry

Try / catch

var s *wfp.Session
var err error
for i := 0; i < 3; i++ {
	s, err = w.PermitUDPPort(port)
	if err == nil || !strings.Contains(err.Error(), "GenerateGUID") { break }
	time.Sleep(100 * time.Millisecond)
}

Prevention

Treat GUID failures as environmental — retry with backoff
Monitor COM/RPC health on long-lived hosts
Surface the unwrapped errno in telemetry to catch systemic OS issues

When it happens

Trigger: Calling newSession on a machine where the OS UUID generator fails (RPCSS/CoCreateGuid unavailable, severely degraded COM/RPC infrastructure).

Common situations: Heavily locked-down or corrupted Windows installs, broken COM/RPC runtime, or memory pressure during CoCreateGuid.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c0e6a4902b1f75a6. Report an issue: GitHub.