{"record":{"id":"2cf91ff983a6ee79","repo":"OpenNHP/opennhp","slug":"unsupported-protocol-s","errorCode":null,"errorMessage":"unsupported protocol: %s","messagePattern":"unsupported protocol: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/utils/ebpf/ebpf.go","lineNumber":404,"sourceCode":"\t}\n\treturn uint16(i), nil\n}\n\n// A generic entry function that calls the corresponding function to add whitelist entries based on mapTypeandparams.\nfunc EbpfRuleAdd(mapType int, params EbpfRuleParams, TtlSec int) error {\n\tvar err error\n\tTtlSec64 := uint64(TtlSec)\n\tvar protocol uint8\n\tif len(params.Protocol) > 0 {\n\t\tswitch params.Protocol {\n\t\tcase \"tcp\":\n\t\t\tprotocol = 6\n\t\tcase \"udp\":\n\t\t\tprotocol = 17\n\t\tcase \"icmp\":\n\t\t\tprotocol = 1\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unsupported protocol: %s\", params.Protocol)\n\t\t}\n\t}\n\n\tswitch mapType {\n\tcase MapTypeWhitelist:\n\t\t//base the map whitelist\n\t\terr = AddEbpfRuleForSrcDstPortProto(params.SrcIP, params.DstIP, protocol, uint16(params.DstPort), TtlSec64)\n\t\tif err != nil {\n\t\t\tlog.Error(\"failed add ebpf src: %s dst: %s, error: %v, protocol: %d, dstport: %d\", params.SrcIP, params.DstIP, err, protocol, uint16(params.DstPort))\n\t\t\treturn err\n\t\t}\n\n\tcase MapTypeSdWhitelist:\n\t\t//base the map sdwhitelist\n\t\terr = AddEbpfRuleForSrcDst(params.SrcIP, params.DstIP, TtlSec64)\n\t\tif err != nil {\n\t\t\tlog.Error(\"failed add ebpf src: %s dst: %s\", params.SrcIP, params.DstIP)\n\t\t\treturn err","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/utils/ebpf/ebpf.go#L386-L422","documentation":"EbpfRuleAdd maps a protocol string to its IP protocol number (tcp=6, udp=17, icmp=1) before installing an eBPF whitelist rule. Any protocol string other than these (when Protocol is non-empty) is rejected with \"unsupported protocol: %s\" because the underlying eBPF map only supports rules keyed by these protocol numbers.","triggerScenarios":"Calling EbpfRuleAdd / HandleAccessControl / tcpTempAccessHandler / udpTempAccessHandler with params.Protocol set to something like \"TCP\" (uppercase), \"sctp\", \"icmpv6\", an empty-but-whitespace string handled by the default branch, or any typo.","commonSituations":"Config file with protocol written as \"TCP\" or \"TCP/IP\"; a protocol name from an external API (e.g. \"https\" or \"icmp6\") passed straight through; new protocol added upstream without extending this switch.","solutions":["Use one of the exact lowercase strings: \"tcp\", \"udp\", or \"icmp\" in params.Protocol / config","Normalize the input before the call, e.g. strings.ToLower(strings.TrimSpace(params.Protocol))","If you need another protocol, extend the switch in EbpfRuleAdd with its IANA protocol number"],"exampleFix":"// before\nparams.Protocol = \"TCP\"\nutils.EbpfRuleAdd(mapType, params, ttl) // error: unsupported protocol: TCP\n// after\nparams.Protocol = strings.ToLower(strings.TrimSpace(\"TCP\")) // \"tcp\"\nutils.EbpfRuleAdd(mapType, params, ttl)","handlingStrategy":"validation","validationCode":"p = strings.ToLower(strings.TrimSpace(p)); ok := p==\"tcp\"||p==\"udp\"||p==\"icmp\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Normalize protocol names at input boundaries"],"tags":["go","ebpf","validation","protocol"],"backgroundTag":"invalid-enum-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}