evaluate: improve error reporting in tproxy with inet family

 # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
 Error: conflicting protocols specified: ip vs. unknown. You must specify ip or ip6 family in tproxy statement
 add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
                             ~~~~~~~~                            ^^^^^^^^^^^^^^^

instead of:

 # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
 Error: Conflicting network layer protocols.
 add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000
                                                                 ^^^^^^^^^^^^^^^

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 94377da993359ebd8f092a1d6811608d4eb72bcc..3a3f2468c826cf113e6c799ec709b7fbe3f3a6b8 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2606,8 +2606,11 @@ static int stmt_evaluate_tproxy(struct eval_ctx *ctx, struct stmt *stmt)
                /* this prevents us from rules like
                 * ip protocol tcp tproxy ip6 to [dead::beef]
                 */
-               return stmt_error(ctx, stmt,
-                                 "Conflicting network layer protocols.");
+               return stmt_binary_error(ctx, stmt,
+                                        &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR],
+                                        "conflicting protocols specified: %s vs. %s. You must specify ip or ip6 family in tproxy statement",
+                                        ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc->name,
+                                        family2str(stmt->tproxy.family));
 
        if (stmt->tproxy.addr != NULL) {
                if (stmt->tproxy.addr->etype == EXPR_RANGE)