{"record":{"id":"aa47af5f857f4347","repo":"shadowsocks/shadowsocks-rust","slug":"not-supported-tcp-transparent-proxy-type","errorCode":null,"errorMessage":"not supported tcp transparent proxy type","messagePattern":"not supported tcp transparent proxy type","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/shadowsocks-service/src/local/redir/tcprelay/sys/unix/bsd.rs","lineNumber":29,"sourceCode":"use crate::{\n    config::RedirType,\n    local::redir::{\n        redir_ext::{TcpListenerRedirExt, TcpStreamRedirExt},\n        sys::set_ipv6_only,\n    },\n};\n\nimpl TcpListenerRedirExt for TcpListener {\n    async fn bind_redir(ty: RedirType, addr: SocketAddr, accept_opts: AcceptOpts) -> io::Result<TcpListener> {\n        match ty {\n            #[cfg(any(target_os = \"freebsd\", target_os = \"openbsd\", target_os = \"macos\", target_os = \"ios\"))]\n            RedirType::PacketFilter => {}\n\n            #[cfg(any(target_os = \"freebsd\", target_os = \"macos\", target_os = \"ios\"))]\n            RedirType::IpFirewall => {}\n\n            _ => {\n                return Err(Error::new(\n                    ErrorKind::InvalidInput,\n                    \"not supported tcp transparent proxy type\",\n                ));\n            }\n        }\n\n        // BSD platform doesn't have any special logic\n        let socket = match addr {\n            SocketAddr::V4(..) => TcpSocket::new_v4()?,\n            SocketAddr::V6(..) => TcpSocket::new_v6()?,\n        };\n\n        // On platforms with Berkeley-derived sockets, this allows to quickly\n        // rebind a socket, without needing to wait for the OS to clean up the\n        // previous one.\n        //\n        // On Windows, this allows rebinding sockets which are actively in use,\n        // which allows “socket hijacking”, so we explicitly don't set it here.","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/shadowsocks/shadowsocks-rust/blob/8eb0f0a65b1d976ab6bed5787327ef86529b0435/crates/shadowsocks-service/src/local/redir/tcprelay/sys/unix/bsd.rs#L11-L47","documentation":"On BSD platforms the TCP transparent-proxy bind function only supports RedirType::PacketFilter (freebsd/macos/ios) and RedirType::IpFirewall (freebsd/macos/ios). Passing any other RedirType (e.g. TProxy, Redirect) reaches the catch-all arm and throws InvalidInput.","triggerScenarios":"Calling bind_redir with a RedirType not compiled in or not valid for the current BSD platform, e.g. requesting TProxy on macOS, or a config whose tcp redir type doesn't match the OS.","commonSituations":"Copying a Linux config (tproxy) to macOS/FreeBSD, or shadowsocks being built without the platform feature so the expected type falls into the unsupported arm.","solutions":["Set local config `mode`/redir type to PacketFilter on macOS/iOS or PacketFilter/IpFirewall on FreeBSD.","Run on Linux if you specifically need TProxy or Redirect mode.","Check `shadowsocks-service --help` / server startup log for the list of supported redir types on your platform.","Rebuild with platform-appropriate features if the binary was cross-compiled."],"exampleFix":"// before (config on macOS)\n{ \"locals\": [{ \"type\": \"redir\", \"tcp_redir\": \"tproxy\" }] }\n// after\n{ \"locals\": [{ \"type\": \"redir\", \"tcp_redir\": \"packet-filter\" }] }","handlingStrategy":"validation","validationCode":"// validate redir type for the platform before starting the local server\n#[cfg(any(target_os = \"freebsd\", target_os = \"macos\", target_os = \"ios\"))]\nassert!(matches!(ty, RedirType::PacketFilter | RedirType::IpFirewall));","typeGuard":"fn is_supported_tcp_redir(ty: &RedirType) -> bool {\n    matches!(ty, RedirType::PacketFilter | RedirType::IpFirewall) // BSD targets\n}","tryCatchPattern":"let listener = TcpListenerRedirExt::bind_redir(ty, addr, accept_opts).await.map_err(|e| {\n    anyhow::anyhow!(\"TCP redir type {:?} unsupported on this OS: {e}\", ty)\n})?;","preventionTips":["Use per-platform config files for the redir type","Validate the redir type at config parse time against platform support","Prefer the documented default (RedirType::tcp_default()) instead of hardcoding"],"tags":["configuration","freebsd","macos","transparent-proxy","unsupported-platform"],"backgroundTag":"unsupported-enum-value","analyzedSha":"8eb0f0a65b1d976ab6bed5787327ef86529b0435","analyzedAt":"2026-09-09T12:20:43.168Z","contentChangedAt":"2026-09-09T12:20:43.168Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}