FWPM_FILTER_FLAG_PERSISTENT flag setting causes error 0x80320016

Question

Trying to add filter rules ( this works when it is dynamic , i.e. flags=0 ) but causes error for trying to do PERSISTENT rules.

All of this from user mode

FWP_E_LIFETIME_MISMATCH

0x80320016

The call tried to associate two objects with incompatible lifetimes.

TIA
prokash

Answer 1

fwpFilter.action.type = (permitOrBlock ? FWP_ACTION_PERMIT : FWP_ACTION_BLOCK);
if (isIpV4)
    fwpFilter.layerKey = (directionInOrOut ? FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 : FWPM_LAYER_ALE_AUTH_CONNECT_V4);
else
    fwpFilter.layerKey = (directionInOrOut ? FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 : FWPM_LAYER_ALE_AUTH_CONNECT_V6);


fwpFilter.subLayerKey = CT_SUBLAYER_GUID;
//fwpFilter.providerKey = (LPGUID)&GUID_WfpProvider;
fwpFilter.weight.type = FWP_EMPTY; // auto-weight.
fwpFilter.numFilterConditions = numConds;
if (numConds > 0)
    fwpFilter.filterCondition = conds;
fwpFilter.displayData.name = const_cast <wchar_t *>(wstrRuleName.c_str() );
fwpFilter.displayData.description = const_cast <wchar_t *>(wstrRuleDescription.c_str());

LGMLOG(INFO, "fwpFilter settings  OK ... ");

switch (type)
{
case RuleType::Boottime: //only for kernel mode
    LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() fwpFilter.flags Boottime ");
    fwpFilter.flags |= FWPM_FILTER_FLAG_BOOTTIME;
    break;
case RuleType::Persistent: // too many such rules make BFE instable
    LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() fwpFilter.flags Persistent ");
    fwpFilter.flags |= FWPM_FILTER_FLAG_PERSISTENT;
    break;
case RuleType::Static: // This is what we will have 
    LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() fwpFilter.flags Static ");
    //fwpFilter.flags = (FWPM_FILTER_FLAG_NONE | FWPM_FILTER_FLAG_INDEXED);
    fwpFilter.flags |= FWPM_FILTER_FLAG_NONE;

    break;
}
LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() Before FwpmFilterAdd0() ");

try {
    result = FwpmFilterAdd0(mEngineHandle, &fwpFilter, NULL, &o_ruleLuid);
}
catch (...) {
    LGMLOG(INFO, " CFirewallOpWFP::ConfigureWfp() FwpmFilterAdd0() raising exceptions...");
}