diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-09-13 20:32:37 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-09-22 10:55:25 +0200 |
| commit | 22febeea80043f5fe4eb1aa7723da0a0a6953802 (patch) | |
| tree | f59adb5d16490708e2141c6d2ef78830a78d9112 /src/parser_json.c | |
| parent | b37424f137d412804e6a21d5ad04ec57fe9e5bc6 (diff) | |
parser_json: Catch wrong "reset" payload
The statement happily accepted any valid expression as payload and
assumed it to be a tcpopt expression (actually, a special case of
exthdr). Add a check to make sure this is the case.
Standard syntax does not provide this flexibility, so no need to have
the check there as well.
Fixes: 5d837d270d5a8 ("src: add tcp option reset support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'src/parser_json.c')
| -rw-r--r-- | src/parser_json.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/parser_json.c b/src/parser_json.c index e8a175de..9532f7be 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -2797,7 +2797,14 @@ static struct stmt *json_parse_optstrip_stmt(struct json_ctx *ctx, { struct expr *expr = json_parse_expr(ctx, value); - return expr ? optstrip_stmt_alloc(int_loc, expr) : NULL; + if (!expr || + expr->etype != EXPR_EXTHDR || + expr->exthdr.op != NFT_EXTHDR_OP_TCPOPT) { + json_error(ctx, "Illegal TCP optstrip argument"); + return NULL; + } + + return optstrip_stmt_alloc(int_loc, expr); } static struct stmt *json_parse_stmt(struct json_ctx *ctx, json_t *root) |