From e1a3aad304be451bd1762ebfaaf8d4853b806a6b Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Fri, 17 Jul 2026 11:19:43 +0200
Subject: [PATCH] parser_bison: add range check for synproxy wscale

JIRA: https://issues.redhat.com/browse/RHEL-190549
Upstream Status: nftables commit d6c09b7c7e86dcda6d933917b2ffbfd1c9ce3ff1
Conflicts: Context change due to missing commits 35d9c77c57452
           ("src: add tunnel template support") and ffc40b38d58d3
	   ("tunnel: add erspan support")

commit d6c09b7c7e86dcda6d933917b2ffbfd1c9ce3ff1
Author: Florian Westphal <fw@strlen.de>
Date:   Wed Mar 11 18:52:31 2026 +0100

    parser_bison: add range check for synproxy wscale

    After: nft -f wscale
    Error: wscale must be in range 0-14
     wscale 15
            ^^

    As-is the bogus value makes it to the kernel. Upcoming nf-next patch
    adds futher checks to value attributes and will reject this.

    Also catch this from parser and fix the single_flag test case.

    Signed-off-by: Florian Westphal <fw@strlen.de>

Signed-off-by: Phil Sutter <psutter@redhat.com>
---
 src/parser_bison.y                     | 30 ++++++++++++++++++--------
 tests/shell/testcases/json/single_flag |  4 ++--
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index a5b70d8..0b49de2 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -762,6 +762,7 @@ int nft_lex(void *, void *, void *);
 %destructor { flowtable_free($$); }	flowtable_block_alloc
 
 %type <obj>			obj_block_alloc counter_block quota_block ct_helper_block ct_timeout_block ct_expect_block limit_block secmark_block synproxy_block
+%type <val>			synproxy_wscale
 %destructor { obj_free($$); }	obj_block_alloc
 
 %type <list>			stmt_list stateful_stmt_list set_elem_stmt_list
@@ -3752,14 +3753,25 @@ synproxy_args		:	synproxy_arg
 			|	synproxy_args	synproxy_arg
 			;
 
+synproxy_wscale		:	WSCALE 	NUM
+			{
+				if ($2 > 14) {
+					erec_queue(error(&@2, "wscale must be in range 0-14"), state->msgs);
+					YYERROR;
+				}
+
+				$$ = $2;
+			}
+			;
+
 synproxy_arg		:	MSS	NUM
 			{
 				$<stmt>0->synproxy.mss = $2;
 				$<stmt>0->synproxy.flags |= NF_SYNPROXY_OPT_MSS;
 			}
-			|	WSCALE	NUM
+			|	synproxy_wscale
 			{
-				$<stmt>0->synproxy.wscale = $2;
+				$<stmt>0->synproxy.wscale = $1;
 				$<stmt>0->synproxy.flags |= NF_SYNPROXY_OPT_WSCALE;
 			}
 			|	TIMESTAMP
@@ -3772,7 +3784,7 @@ synproxy_arg		:	MSS	NUM
 			}
 			;
 
-synproxy_config		:	MSS	NUM	WSCALE	NUM	synproxy_ts	synproxy_sack
+synproxy_config		:	MSS	NUM	synproxy_wscale synproxy_ts	synproxy_sack
 			{
 				struct synproxy *synproxy;
 				uint32_t flags = 0;
@@ -3782,13 +3794,13 @@ synproxy_config		:	MSS	NUM	WSCALE	NUM	synproxy_ts	synproxy_sack
 				flags |= NF_SYNPROXY_OPT_MSS;
 				synproxy->wscale = $4;
 				flags |= NF_SYNPROXY_OPT_WSCALE;
+				if ($4)
+					flags |= $4;
 				if ($5)
 					flags |= $5;
-				if ($6)
-					flags |= $6;
 				synproxy->flags = flags;
 			}
-			|	MSS	NUM	stmt_separator	WSCALE	NUM	stmt_separator	synproxy_ts	synproxy_sack
+			|	MSS	NUM	stmt_separator	synproxy_wscale stmt_separator	synproxy_ts	synproxy_sack
 			{
 				struct synproxy *synproxy;
 				uint32_t flags = 0;
@@ -3796,12 +3808,12 @@ synproxy_config		:	MSS	NUM	WSCALE	NUM	synproxy_ts	synproxy_sack
 				synproxy = &$<obj>0->synproxy;
 				synproxy->mss = $2;
 				flags |= NF_SYNPROXY_OPT_MSS;
-				synproxy->wscale = $5;
+				synproxy->wscale = $4;
 				flags |= NF_SYNPROXY_OPT_WSCALE;
+				if ($6)
+					flags |= $6;
 				if ($7)
 					flags |= $7;
-				if ($8)
-					flags |= $8;
 				synproxy->flags = flags;
 			}
 			;
diff --git a/tests/shell/testcases/json/single_flag b/tests/shell/testcases/json/single_flag
index fa917eb..7f36e72 100755
--- a/tests/shell/testcases/json/single_flag
+++ b/tests/shell/testcases/json/single_flag
@@ -156,11 +156,11 @@ back_n_forth "$STD_SYNPROXY_2" "$JSON_SYNPROXY_2"
 STD_SYNPROXY_OBJ_1="table ip t {
 	synproxy s {
 		mss 1280
-		wscale 64
+		wscale 14
 		 sack-perm
 	}
 }"
-JSON_SYNPROXY_OBJ_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}}, {"synproxy": {"family": "ip", "name": "s", "table": "t", "handle": 0, "mss": 1280, "wscale": 64, "flags": "sack-perm"}}]}'
+JSON_SYNPROXY_OBJ_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}}, {"synproxy": {"family": "ip", "name": "s", "table": "t", "handle": 0, "mss": 1280, "wscale": 14, "flags": "sack-perm"}}]}'
 JSON_SYNPROXY_OBJ_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_SYNPROXY_OBJ_1")
 
 STD_SYNPROXY_OBJ_2=$(sed 's/ \(sack-perm\)/timestamp \1/' <<< "$STD_SYNPROXY_OBJ_1")