Its valid in case of tcp option removal: [ { "reset": { "tcp option": { "base": 123, "len": 0, "offset": 0 } This makes nft-test.py -j pass again. Fixes: e08627257ecf ("parser: reject raw payload expressions with 0 length") Signed-off-by: Florian Westphal <fw@xxxxxxxxx> --- src/parser_json.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/parser_json.c b/src/parser_json.c index 970ae8cb2692..ff52423af4d7 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -670,7 +670,7 @@ static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx, if (kind < 0 || kind > 255) return NULL; - if (len <= 0 || len > (int)NFT_MAX_EXPR_LEN_BITS) { + if (len < 0 || len > (int)NFT_MAX_EXPR_LEN_BITS) { json_error(ctx, "option length must be between 0 and %lu, got %d", NFT_MAX_EXPR_LEN_BITS, len); return NULL; -- 2.43.2