# nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy
to :2000
Error: conflicting protocols specified: ip vs. unknown. You must specify ip or
ip6 family in tproxy statement
add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
~~~~~~~~ ^^^^^^^^^^^^^^^
instead of:
# nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy
to :2000
Error: Conflicting network layer protocols.
add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
^^^^^^^^^^^^^^^
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310
Signed-off-by: Pablo Neira Ayuso <[email protected]>
---
src/evaluate.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/evaluate.c b/src/evaluate.c
index 94377da99335..3a3f2468c826 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2606,8 +2606,11 @@ static int stmt_evaluate_tproxy(struct eval_ctx *ctx,
struct stmt *stmt)
/* this prevents us from rules like
* ip protocol tcp tproxy ip6 to [dead::beef]
*/
- return stmt_error(ctx, stmt,
- "Conflicting network layer protocols.");
+ return stmt_binary_error(ctx, stmt,
+
&ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR],
+ "conflicting protocols specified: %s
vs. %s. You must specify ip or ip6 family in tproxy statement",
+
ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc->name,
+ family2str(stmt->tproxy.family));
if (stmt->tproxy.addr != NULL) {
if (stmt->tproxy.addr->etype == EXPR_RANGE)
--
2.11.0
