diff options
| -rw-r--r-- | src/parser_json.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/parser_json.c b/src/parser_json.c index e8a175de..9532f7be 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -2797,7 +2797,14 @@ static struct stmt *json_parse_optstrip_stmt(struct json_ctx *ctx, { struct expr *expr = json_parse_expr(ctx, value); - return expr ? optstrip_stmt_alloc(int_loc, expr) : NULL; + if (!expr || + expr->etype != EXPR_EXTHDR || + expr->exthdr.op != NFT_EXTHDR_OP_TCPOPT) { + json_error(ctx, "Illegal TCP optstrip argument"); + return NULL; + } + + return optstrip_stmt_alloc(int_loc, expr); } static struct stmt *json_parse_stmt(struct json_ctx *ctx, json_t *root) |