OpenNHP/opennhp · error

value is out of range for uint16

Error message

value %d is out of range for uint16

What it means

safeIntToUint16 converts an int rule value (e.g. a port) to uint16 for eBPF map keys, and rejects any value below 0 or above 65535 since uint16 cannot represent it. Callers AddEbpfRuleForSrcDestPort and AddEbpfRuleForSrcDestPortList invoke it with port numbers taken from rule parameters or config, so an out-of-range integer produces this error instead of a silently wrapped value.

Solutions

1. Validate the port at the config/input boundary: reject values outside 0-65535 before calling the ebpf API
2. Fix the offending value in the config or calling code to a valid port number (1-65535, or 0 if wildcard is intended)
3. Check whether the value was computed from an error return (a -1 sentinel) that was not handled upstream

Example fix

// before
port := cfg.Port
err := utils.AddEbpfRuleForSrcDestPort(params, port, ttl)
// after
if cfg.Port < 0 || cfg.Port > 65535 {
    return fmt.Errorf("invalid port %d in config", cfg.Port)
}
err := utils.AddEbpfRuleForSrcDestPort(params, cfg.Port, ttl)

if p < 0 || p > 65535 { return fmt.Errorf("bad port %d", p) }

When it happens

Trigger: Calling AddEbpfRuleForSrcDestPort / AddEbpfRuleForSrcDestPortList (or EbpfRuleAdd with port params) where params.DstPort or a list element is negative or greater than 65535 — e.g. a port parsed from a bad config line, a -1 sentinel, or a full 32-bit integer mistakenly used as a port.

Common situations: Config file with port 80808 or -1 for a temporary access rule; upstream code computed a port as int with an error sentinel; user-supplied port in an access-control HTTP request not validated upstream.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• cluster instance # : invalid port
• unsupported protocol
• unsupported map type
• cluster instance # : must set either Host or Ip
• AuthServiceId is required

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/30a834c7aa8e47d6. Report an issue: GitHub.

Appendix: source

Thrown at nhp/utils/ebpf/ebpf.go:385

	}
	portListMap, err := ebpf.LoadPinnedMap("/sys/fs/bpf/protocol_port", nil)
	if err != nil {
		log.Error("failed to load pinned protocol_port map: %v", err)
		return err
	}
	defer portListMap.Close()

	rule := &procoPortKey{
		DstPort:  dstPortt,
		Protocol: protocol,
	}

	return AddPpWhitelistRule(portListMap, rule, ttlSec)
}

func safeIntToUint16(i int) (uint16, error) {
	if i < 0 || i > 65535 {
		return 0, fmt.Errorf("value %d is out of range for uint16", i)
	}
	return uint16(i), nil
}

// A generic entry function that calls the corresponding function to add whitelist entries based on mapTypeandparams.
func EbpfRuleAdd(mapType int, params EbpfRuleParams, TtlSec int) error {
	var err error
	TtlSec64 := uint64(TtlSec)
	var protocol uint8
	if len(params.Protocol) > 0 {
		switch params.Protocol {
		case "tcp":
			protocol = 6
		case "udp":
			protocol = 17
		case "icmp":
			protocol = 1
		default:

View on GitHub (pinned to 6e04ca5ff0)