FWPM_FILTER_FLAG_PERSISTENT flag setting causes error 0x80320016

Sinha Prokash 46 Reputation points
2022-03-15T19:14:24.577+00:00

Trying to add filter rules ( this works when it is dynamic , i.e. flags=0 ) but causes error for trying to do PERSISTENT rules.

All of this from user mode

FWP_E_LIFETIME_MISMATCH

0x80320016

The call tried to associate two objects with incompatible lifetimes.

TIA
prokash

Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,557 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Sinha Prokash 46 Reputation points
    2022-03-16T12:00:30.65+00:00
    fwpFilter.action.type = (permitOrBlock ? FWP_ACTION_PERMIT : FWP_ACTION_BLOCK);
    if (isIpV4)
        fwpFilter.layerKey = (directionInOrOut ? FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 : FWPM_LAYER_ALE_AUTH_CONNECT_V4);
    else
        fwpFilter.layerKey = (directionInOrOut ? FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 : FWPM_LAYER_ALE_AUTH_CONNECT_V6);
    
    
    fwpFilter.subLayerKey = CT_SUBLAYER_GUID;
    //fwpFilter.providerKey = (LPGUID)&GUID_WfpProvider;
    fwpFilter.weight.type = FWP_EMPTY; // auto-weight.
    fwpFilter.numFilterConditions = numConds;
    if (numConds > 0)
        fwpFilter.filterCondition = conds;
    fwpFilter.displayData.name = const_cast <wchar_t *>(wstrRuleName.c_str() );
    fwpFilter.displayData.description = const_cast <wchar_t *>(wstrRuleDescription.c_str());
    
    LGMLOG(INFO, "fwpFilter settings  OK ... ");
    
    switch (type)
    {
    case RuleType::Boottime: //only for kernel mode
        LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() fwpFilter.flags Boottime ");
        fwpFilter.flags |= FWPM_FILTER_FLAG_BOOTTIME;
        break;
    case RuleType::Persistent: // too many such rules make BFE instable
        LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() fwpFilter.flags Persistent ");
        fwpFilter.flags |= FWPM_FILTER_FLAG_PERSISTENT;
        break;
    case RuleType::Static: // This is what we will have 
        LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() fwpFilter.flags Static ");
        //fwpFilter.flags = (FWPM_FILTER_FLAG_NONE | FWPM_FILTER_FLAG_INDEXED);
        fwpFilter.flags |= FWPM_FILTER_FLAG_NONE;
    
        break;
    }
    LGMLOG(INFO, "CFirewallOpWFP::ConfigureWfp() Before FwpmFilterAdd0() ");
    
    try {
        result = FwpmFilterAdd0(mEngineHandle, &fwpFilter, NULL, &o_ruleLuid);
    }
    catch (...) {
        LGMLOG(INFO, " CFirewallOpWFP::ConfigureWfp() FwpmFilterAdd0() raising exceptions...");
    }
    
    0 comments No comments