The statement happily accepted any valid expression as payload and
assumed it to be a tcpopt expression (actually, a special case of
exthdr). Add a check to make sure this is the case.
Standard syntax does not provide this flexibility, so no need to have
the check there as well.
Fixes: 5d837d270d5a8 ("src: add tcp option reset support")
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
src/parser_json.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/src/parser_json.c b/src/parser_json.c
index 4ea5b4326a900..242f05eece58c 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -2797,7 +2797,14 @@ static struct stmt *json_parse_optstrip_stmt(struct json_ctx *ctx,
{
struct expr *expr = json_parse_expr(ctx, value);
- return expr ? optstrip_stmt_alloc(int_loc, expr) : NULL;
+ if (!expr ||
+ expr->etype != EXPR_EXTHDR ||
+ expr->exthdr.op != NFT_EXTHDR_OP_TCPOPT) {
+ json_error(ctx, "Illegal TCP optstrip argument");
+ return NULL;
+ }
+
+ return optstrip_stmt_alloc(int_loc, expr);
}
static struct stmt *json_parse_stmt(struct json_ctx *ctx, json_t *root)
--
2.41.0
