jdx/mise · error

cli feature is not enabled

Error message

cli feature is not enabled

What it means

Thrown by validate_backend_request in src/system/firewall.rs during firewall request validation: when the effective firewall backend is UFW and a rule declares protocol = "sctp" or "dccp". UFW (a frontend to iptables with a fixed feature set) cannot express SCTP or DCCP rules, so mise refuses the whole request up front instead of writing a partial ruleset. The error names the offending rule and tells you the two backends (nftables, firewalld) that do support these protocols.

Source

Thrown at crates/vfox/src/bin.rs:21

extern crate log;

#[cfg(feature = "cli")]
mod cli;

#[cfg(feature = "cli")]
#[tokio::main]
async fn main() -> std::process::ExitCode {
    env_logger::init_from_env(env_logger::Env::default().filter_or("VFOX_LOG", "info"));
    if let Err(err) = cli::run().await {
        error!("{err}");
        return std::process::ExitCode::FAILURE;
    }
    std::process::ExitCode::SUCCESS
}

#[cfg(not(feature = "cli"))]
fn main() {
    panic!("cli feature is not enabled");
}

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Change backend = "nftables" (or "firewalld") in the firewall config so SCTP/DCCP rules are expressible, and install/enable that firewall on the host
2. Change the offending rule's protocol to "tcp" or "udp" if SCTP/DCCP was not intentional
3. Drop the rule named in the error message and apply the rest of the ruleset, then add the SCTP/DCCP rule via raw ufw/iptables outside mise
4. Verify with `ufw status` and `nft --version` / `firewall-cmd --state` which backends are actually installed and active before choosing

Example fix

# before (mise.toml)
[system.firewall]
backend = "ufw"

[[system.firewall.rules]]
name = "webrtc-sctp"
protocol = "sctp"
port = 3478

# after
[system.firewall]
backend = "nftables"

[[system.firewall.rules]]
name = "webrtc-sctp"
protocol = "sctp"
port = 3478

#!/usr/bin/env bash
# lint mise.toml before applying firewall config
if grep -q 'backend = "ufw"' mise.toml && grep -qE 'protocol = "(sctp|dccp)"' mise.toml; then
  echo "REFUSING: ufw backend cannot express sctp/dccp rules; use nftables/firewalld"
  exit 1
fi

In Rust, treat this as a configuration error, not a runtime one: match on the bail text ('UFW does not support') when calling the firewall API, surface it to the user as a config problem (point at backend/rule), and do not retry with the same request.

When it happens

Trigger: A firewall request with backend = "ufw" (set explicitly, or resolved from backend = "auto" when only ufw is available/active) containing any rule whose protocol field is Some(FirewallProtocol::Sctp) or Some(FirewallProtocol::Dccp). Validation runs before any rules are applied, so one bad rule fails the entire firewall configuration.

Common situations: mise.toml [system.firewall] section copied from a machine that used nftables, then deployed on a UFW-managed host; enabling WebRTC/SCTP or DCCP-ish services (e.g. telephony, older VPN transports) in rules while keeping the ufw default; switching backend = "nftables" to "ufw" during a distro change without auditing rule protocols.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• refusing firewall default incoming {} over SSH: blocking rul
• firewall rule '{}' uses protocol {}, which UFW does not supp
• firewall rule name '{name}' must contain only ASCII letters,
• firewall interface '{interface}' is invalid
• remote action result does not match requested action

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/fd7267108c5bac0a. Report an issue: GitHub.