diff --git a/src/ui/util/conf/ruletextparser.cpp b/src/ui/util/conf/ruletextparser.cpp
index 0d6bd65b..eaa36aac 100644
--- a/src/ui/util/conf/ruletextparser.cpp
+++ b/src/ui/util/conf/ruletextparser.cpp
@@ -6,6 +6,11 @@
 
 namespace {
 
+enum FortRuleExprSugarType {
+    FORT_RULE_EXPR_TYPE_PROTOCOL_TCP = -100,
+    FORT_RULE_EXPR_TYPE_PROTOCOL_UDP,
+};
+
 const char *const extraNameChars = "_";
 const char *const extraValueChars = ".:-/]";
 
@@ -84,6 +89,10 @@ bool RuleTextParser::parseLine()
 {
     bool ok = false;
 
+    const int listIndex = pushListNode(FORT_RULE_EXPR_LIST_AND);
+
+    m_isNot = false;
+
     const auto charType = nextCharType(CharAnyBegin);
 
     switch (charType) {
@@ -103,6 +112,8 @@ bool RuleTextParser::parseLine()
         break;
     }
 
+    popListNode(listIndex);
+
     return ok;
 }
 
@@ -132,6 +143,8 @@ bool RuleTextParser::parseName()
         { "protocol", FORT_RULE_EXPR_TYPE_PROTOCOL },
         { "dir", FORT_RULE_EXPR_TYPE_DIRECTION },
         { "direction", FORT_RULE_EXPR_TYPE_DIRECTION },
+        { "tcp", FORT_RULE_EXPR_TYPE_PROTOCOL_TCP },
+        { "udp", FORT_RULE_EXPR_TYPE_PROTOCOL_UDP },
     };
 
     m_exprType = exprTypesMap.value(nameLower, -1);
@@ -141,6 +154,12 @@ bool RuleTextParser::parseName()
         return false;
     }
 
+    if (m_exprType < 0) {
+        // Desugar the expression
+    } else {
+        //
+    }
+
     return true;
 }