{"record":{"id":"fd7267108c5bac0a","repo":"jdx/mise","slug":"cli-feature-is-not-enabled","errorCode":null,"errorMessage":"cli feature is not enabled","messagePattern":"cli feature is not enabled","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/vfox/src/bin.rs","lineNumber":21,"sourceCode":"extern crate log;\n\n#[cfg(feature = \"cli\")]\nmod cli;\n\n#[cfg(feature = \"cli\")]\n#[tokio::main]\nasync fn main() -> std::process::ExitCode {\n    env_logger::init_from_env(env_logger::Env::default().filter_or(\"VFOX_LOG\", \"info\"));\n    if let Err(err) = cli::run().await {\n        error!(\"{err}\");\n        return std::process::ExitCode::FAILURE;\n    }\n    std::process::ExitCode::SUCCESS\n}\n\n#[cfg(not(feature = \"cli\"))]\nfn main() {\n    panic!(\"cli feature is not enabled\");\n}\n","sourceCodeStart":3,"sourceCodeEnd":23,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/crates/vfox/src/bin.rs#L3-L23","documentation":"Thrown by validate_backend_request in src/system/firewall.rs during firewall request validation: when the effective firewall backend is UFW and a rule declares protocol = \"sctp\" or \"dccp\". UFW (a frontend to iptables with a fixed feature set) cannot express SCTP or DCCP rules, so mise refuses the whole request up front instead of writing a partial ruleset. The error names the offending rule and tells you the two backends (nftables, firewalld) that do support these protocols.","triggerScenarios":"A firewall request with backend = \"ufw\" (set explicitly, or resolved from backend = \"auto\" when only ufw is available/active) containing any rule whose protocol field is Some(FirewallProtocol::Sctp) or Some(FirewallProtocol::Dccp). Validation runs before any rules are applied, so one bad rule fails the entire firewall configuration.","commonSituations":"mise.toml [system.firewall] section copied from a machine that used nftables, then deployed on a UFW-managed host; enabling WebRTC/SCTP or DCCP-ish services (e.g. telephony, older VPN transports) in rules while keeping the ufw default; switching backend = \"nftables\" to \"ufw\" during a distro change without auditing rule protocols.","solutions":["Change backend = \"nftables\" (or \"firewalld\") in the firewall config so SCTP/DCCP rules are expressible, and install/enable that firewall on the host","Change the offending rule's protocol to \"tcp\" or \"udp\" if SCTP/DCCP was not intentional","Drop the rule named in the error message and apply the rest of the ruleset, then add the SCTP/DCCP rule via raw ufw/iptables outside mise","Verify with `ufw status` and `nft --version` / `firewall-cmd --state` which backends are actually installed and active before choosing"],"exampleFix":"# before (mise.toml)\n[system.firewall]\nbackend = \"ufw\"\n\n[[system.firewall.rules]]\nname = \"webrtc-sctp\"\nprotocol = \"sctp\"\nport = 3478\n\n# after\n[system.firewall]\nbackend = \"nftables\"\n\n[[system.firewall.rules]]\nname = \"webrtc-sctp\"\nprotocol = \"sctp\"\nport = 3478","handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\n# lint mise.toml before applying firewall config\nif grep -q 'backend = \"ufw\"' mise.toml && grep -qE 'protocol = \"(sctp|dccp)\"' mise.toml; then\n  echo \"REFUSING: ufw backend cannot express sctp/dccp rules; use nftables/firewalld\"\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":"In Rust, treat this as a configuration error, not a runtime one: match on the bail text ('UFW does not support') when calling the firewall API, surface it to the user as a config problem (point at backend/rule), and do not retry with the same request.","preventionTips":["Pick the firewall backend first (based on what the host runs: nft > firewalld > ufw) and only then author rules","Keep protocol exoticism (sctp/dccp) isolated in a separate rules file applied by nftables directly","Run `mise doctor` / a config lint step in CI that rejects ufw backend plus non-tcp/udp protocols before deploy"],"tags":["firewall","ufw","nftables","config-validation","protocol","networking"],"backgroundTag":"config-validation-failed","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}