{"record":{"id":"30a834c7aa8e47d6","repo":"OpenNHP/opennhp","slug":"value-d-is-out-of-range-for-uint16","errorCode":null,"errorMessage":"value %d is out of range for uint16","messagePattern":"value (.+?) is out of range for uint16","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/utils/ebpf/ebpf.go","lineNumber":385,"sourceCode":"\t}\n\tportListMap, err := ebpf.LoadPinnedMap(\"/sys/fs/bpf/protocol_port\", nil)\n\tif err != nil {\n\t\tlog.Error(\"failed to load pinned protocol_port map: %v\", err)\n\t\treturn err\n\t}\n\tdefer portListMap.Close()\n\n\trule := &procoPortKey{\n\t\tDstPort:  dstPortt,\n\t\tProtocol: protocol,\n\t}\n\n\treturn AddPpWhitelistRule(portListMap, rule, ttlSec)\n}\n\nfunc safeIntToUint16(i int) (uint16, error) {\n\tif i < 0 || i > 65535 {\n\t\treturn 0, fmt.Errorf(\"value %d is out of range for uint16\", i)\n\t}\n\treturn uint16(i), nil\n}\n\n// A generic entry function that calls the corresponding function to add whitelist entries based on mapTypeandparams.\nfunc EbpfRuleAdd(mapType int, params EbpfRuleParams, TtlSec int) error {\n\tvar err error\n\tTtlSec64 := uint64(TtlSec)\n\tvar protocol uint8\n\tif len(params.Protocol) > 0 {\n\t\tswitch params.Protocol {\n\t\tcase \"tcp\":\n\t\t\tprotocol = 6\n\t\tcase \"udp\":\n\t\t\tprotocol = 17\n\t\tcase \"icmp\":\n\t\t\tprotocol = 1\n\t\tdefault:","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/utils/ebpf/ebpf.go#L367-L403","documentation":"safeIntToUint16 converts an int rule value (e.g. a port) to uint16 for eBPF map keys, and rejects any value below 0 or above 65535 since uint16 cannot represent it. Callers AddEbpfRuleForSrcDestPort and AddEbpfRuleForSrcDestPortList invoke it with port numbers taken from rule parameters or config, so an out-of-range integer produces this error instead of a silently wrapped value.","triggerScenarios":"Calling AddEbpfRuleForSrcDestPort / AddEbpfRuleForSrcDestPortList (or EbpfRuleAdd with port params) where params.DstPort or a list element is negative or greater than 65535 — e.g. a port parsed from a bad config line, a -1 sentinel, or a full 32-bit integer mistakenly used as a port.","commonSituations":"Config file with port 80808 or -1 for a temporary access rule; upstream code computed a port as int with an error sentinel; user-supplied port in an access-control HTTP request not validated upstream.","solutions":["Validate the port at the config/input boundary: reject values outside 0-65535 before calling the ebpf API","Fix the offending value in the config or calling code to a valid port number (1-65535, or 0 if wildcard is intended)","Check whether the value was computed from an error return (a -1 sentinel) that was not handled upstream"],"exampleFix":"// before\nport := cfg.Port\nerr := utils.AddEbpfRuleForSrcDestPort(params, port, ttl)\n// after\nif cfg.Port < 0 || cfg.Port > 65535 {\n    return fmt.Errorf(\"invalid port %d in config\", cfg.Port)\n}\nerr := utils.AddEbpfRuleForSrcDestPort(params, cfg.Port, ttl)","handlingStrategy":"validation","validationCode":"if p < 0 || p > 65535 { return fmt.Errorf(\"bad port %d\", p) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate ports at config parse time"],"tags":["go","ebpf","validation","port"],"backgroundTag":"value-out-of-range","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}