From: Rafael Sadowski <rafael@sizeofvoid.org>
Subject: relayd: more useful config checks
To: tech@openbsd.org
Date: Thu, 10 Sep 2026 15:01:44 +0200

A handful useful config checks to avoid errors:

- The interval should not be 0, we're making a few divisions with it.
- HTTP check codes should be between 100 and 600.
- tcp buffer size and header length of zero makes no sense.
- ip ttl and  minttl is u_int8_t so we should restrict it to 255.

Does IP TTL/MINTTL of 0 makes sense?

OK?

diff --git a/parse.y b/parse.y
index 929b031..b953542 100644
--- a/parse.y
+++ b/parse.y
@@ -416,7 +416,7 @@ sendbinbuf	: NOTHING		{
 		;
 
 main		: INTERVAL NUMBER	{
-			if ((conf->sc_conf.interval.tv_sec = $2) < 0) {
+			if ((conf->sc_conf.interval.tv_sec = $2) <= 0) {
 				yyerror("invalid interval: %lld", $2);
 				YYERROR;
 			}
@@ -936,7 +936,9 @@ tablecheck	: ICMP			{ table->conf.check = CHECK_ICMP; }
 				table->conf.flags |= F_TLS;
 			}
 			table->conf.check = CHECK_HTTP_CODE;
-			if ((table->conf.retcode = $5) <= 0) {
+			table->conf.retcode = $5;
+			if (table->conf.retcode < 100 ||
+			    table->conf.retcode > 600) {
 				yyerror("invalid HTTP code: %lld", $5);
 				free($2);
 				free($3);
@@ -1197,7 +1199,7 @@ httpflags_l	: httpflags comma httpflags_l
 		;
 
 httpflags	: HEADERLEN NUMBER	{
-			if ($2 < 0 || $2 > RELAY_MAXHEADERLENGTH) {
+			if ($2 <= 0 || $2 > RELAY_MAXHEADERLENGTH) {
 				yyerror("invalid headerlen: %lld", $2);
 				YYERROR;
 			}
@@ -1226,13 +1228,13 @@ tcpflags	: SACK			{ proto->tcpflags |= TCPFLAG_SACK; }
 		}
 		| SOCKET BUFFER NUMBER	{
 			proto->tcpflags |= TCPFLAG_BUFSIZ;
-			if ((proto->tcpbufsiz = $3) < 0) {
+			if ((proto->tcpbufsiz = $3) <= 0) {
 				yyerror("invalid socket buffer size: %lld", $3);
 				YYERROR;
 			}
 		}
 		| IP STRING NUMBER	{
-			if ($3 < 0) {
+			if ($3 < 0 || $3 > 255) {
 				yyerror("invalid ttl: %lld", $3);
 				free($2);
 				YYERROR;