diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-04-04 13:23:04 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-04-04 13:37:32 +0200 |
| commit | e18d8c2ac23ba173c773b5114b39dac04e5af8db (patch) | |
| tree | a8c221806bd7533b859719bf6c812e9d410aeaa8 | |
| parent | 3edb96200690b804ceb76a9fb0ae441ed7d4d8f0 (diff) | |
evaluate: improve error reporting in tproxy with inet family
# nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
Error: conflicting protocols specified: ip vs. unknown. You must specify ip or ip6 family in tproxy statement
add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
~~~~~~~~ ^^^^^^^^^^^^^^^
instead of:
# nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
Error: Conflicting network layer protocols.
add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
^^^^^^^^^^^^^^^
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/evaluate.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 94377da9..3a3f2468 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2606,8 +2606,11 @@ static int stmt_evaluate_tproxy(struct eval_ctx *ctx, struct stmt *stmt) /* this prevents us from rules like * ip protocol tcp tproxy ip6 to [dead::beef] */ - return stmt_error(ctx, stmt, - "Conflicting network layer protocols."); + return stmt_binary_error(ctx, stmt, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], + "conflicting protocols specified: %s vs. %s. You must specify ip or ip6 family in tproxy statement", + ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc->name, + family2str(stmt->tproxy.family)); if (stmt->tproxy.addr != NULL) { if (stmt->tproxy.addr->etype == EXPR_RANGE) |