OpenNHP/opennhp · error

unsupported protocol

Error message

unsupported protocol: %s

What it means

EbpfRuleAdd maps a protocol string to its IP protocol number (tcp=6, udp=17, icmp=1) before installing an eBPF whitelist rule. Any protocol string other than these (when Protocol is non-empty) is rejected with "unsupported protocol: %s" because the underlying eBPF map only supports rules keyed by these protocol numbers.

Solutions

1. Use one of the exact lowercase strings: "tcp", "udp", or "icmp" in params.Protocol / config
2. Normalize the input before the call, e.g. strings.ToLower(strings.TrimSpace(params.Protocol))
3. If you need another protocol, extend the switch in EbpfRuleAdd with its IANA protocol number

Example fix

// before
params.Protocol = "TCP"
utils.EbpfRuleAdd(mapType, params, ttl) // error: unsupported protocol: TCP
// after
params.Protocol = strings.ToLower(strings.TrimSpace("TCP")) // "tcp"
utils.EbpfRuleAdd(mapType, params, ttl)

p = strings.ToLower(strings.TrimSpace(p)); ok := p=="tcp"||p=="udp"||p=="icmp"

When it happens

Trigger: Calling EbpfRuleAdd / HandleAccessControl / tcpTempAccessHandler / udpTempAccessHandler with params.Protocol set to something like "TCP" (uppercase), "sctp", "icmpv6", an empty-but-whitespace string handled by the default branch, or any typo.

Common situations: Config file with protocol written as "TCP" or "TCP/IP"; a protocol name from an external API (e.g. "https" or "icmp6") passed straight through; new protocol added upstream without extending this switch.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• nhp server length is too long
• value is out of range for uint16
• unsupported map type
• cluster instance # : must set either Host or Ip
• cluster instance # : invalid port

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/2cf91ff983a6ee79. Report an issue: GitHub.

Appendix: source

Thrown at nhp/utils/ebpf/ebpf.go:404

	}
	return uint16(i), nil
}

// A generic entry function that calls the corresponding function to add whitelist entries based on mapTypeandparams.
func EbpfRuleAdd(mapType int, params EbpfRuleParams, TtlSec int) error {
	var err error
	TtlSec64 := uint64(TtlSec)
	var protocol uint8
	if len(params.Protocol) > 0 {
		switch params.Protocol {
		case "tcp":
			protocol = 6
		case "udp":
			protocol = 17
		case "icmp":
			protocol = 1
		default:
			return fmt.Errorf("unsupported protocol: %s", params.Protocol)
		}
	}

	switch mapType {
	case MapTypeWhitelist:
		//base the map whitelist
		err = AddEbpfRuleForSrcDstPortProto(params.SrcIP, params.DstIP, protocol, uint16(params.DstPort), TtlSec64)
		if err != nil {
			log.Error("failed add ebpf src: %s dst: %s, error: %v, protocol: %d, dstport: %d", params.SrcIP, params.DstIP, err, protocol, uint16(params.DstPort))
			return err
		}

	case MapTypeSdWhitelist:
		//base the map sdwhitelist
		err = AddEbpfRuleForSrcDst(params.SrcIP, params.DstIP, TtlSec64)
		if err != nil {
			log.Error("failed add ebpf src: %s dst: %s", params.SrcIP, params.DstIP)
			return err

View on GitHub (pinned to 6e04ca5ff0)