Running into STATUS_FWP_OUT_OF_BOUNDS while making a call to fwpkclnt!FwpmFilterAdd0

NTDEV
1

I am trying to see the types of events that show up in WFP, if I try to use FWPM_LAYER_NAME_RESOLUTION_CACHE but my call to add a filter is failing with STATUS_FWP_OUT_OF_BOUNDS,
I have modified the inspect driver in WFP sample code [0] , the documentation on FWPM_LAYER_NAME_RESOLUTION_CACHE_V4 is really thin otherwise as well.

call stack from where the call failing is
00 fwpkclnt!FwppProxyFilterAdd → in this function ultimately the response from this call returns the error msrpc!Ndr64AsyncClientCall
01 fwpkclnt!FwpmFilterAdd0
02 Inspect!TLInspectAddFilter1
03 Inspect!TLInspectRegisterNamespaceClassifyCallout
04 Inspect!TLInspectRegisterCallouts
05 Inspect!DriverEntry

The final snippet where things fail is as follows:

    NTSTATUS status = STATUS_SUCCESS;
    FWPM_FILTER filter = { 0 };
    filter.layerKey = FWPM_LAYER_NAME_RESOLUTION_CACHE_V4;
    filter.displayData.name = (wchar_t*)filterName;
    filter.displayData.description = (wchar_t*)filterDesc;
    filter.action.type = FWP_ACTION_CALLOUT_TERMINATING;
    filter.action.calloutKey = *calloutKey;
    filter.subLayerKey = TL_NAMESPACE_SUBLAYER;
    filter.weight.type = FWP_EMPTY; // auto-weight.
    filter.rawContext = context;


    status = FwpmFilterAdd0(
        gEngineHandle,
        &filter,
        NULL,
        NULL);

Let me know if I am missing something obvious.

TIA,
Johri

[0] https://github.com/microsoft/Windows-driver-samples/tree/master/network/trans/inspect

2

Sorry for the lack of my google-fu, FWIW I did try it with one condition but it seems it needs 4 of them! and it would mostly work in USER mode.

Somebody obviously came across this exact issue in a user-mode filter,
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/a6f2dfb0-d35e-4fcc-8f41-f1c71d587093/problem-registering-filter-fwpslayernameresolutioncachev4?forum=wfp