Reject signed NAT forward IDs hidden by leading whitespace

src/config_parser.c

@@ -608,7 +608,7 @@ static int parse_nat(const char *key, const char *value, struct global_config *g
         char* end;
         errno = 0;
         uint64_t node_id = strtoull(fields[1], &end, 16);
-        if (!node_id || *fields[1] == '-' || *fields[1] == '+' || *end || errno == ERANGE) {
+        if (!isxdigit((unsigned char)*fields[1]) || !node_id || *end || errno == ERANGE) {
             DEBUG_ERROR(DEBUG_CATEGORY_CONFIG, "%s:%d: Invalid NAT forward node ID: %s", filename, line_num, fields[1]);
             return -1;
         }

tests/test_nat_engine.c

@@ -534,7 +534,7 @@ static void test_egress_fragments(void) {
         compute_ip_checksum(pkt);
 
         int r = eim_nat_egress(&ctx, pkt, 20 + 8 + TEST_PAYLOAD_LEN, 0x1111, get_mock_conn());
-        // MF bit set → bypassed (returns 0, no allocation)
+        // MF bit set → EIM_NAT_SKIP, без выделения mapping.
         ASSERT_EQ(r, EIM_NAT_SKIP, "egress fragment MF=1 skipped");
         ASSERT(ctx.table[TEST_PORT_START].state == EIM_NAT_ENTRY_FREE, "no entry for fragment");
         free(pkt);
@@ -667,9 +667,7 @@ static void test_ingress_udp(void) {
         uint8_t* resp = make_respond_pkt(TEST_IP_DST_HOST, 53, TEST_GW_HOST, TEST_PORT_START + 500);
         int r = eim_nat_ingress(&ctx, resp, 20 + 8 + TEST_PAYLOAD_LEN, NULL);
         ASSERT_EQ(r, EIM_NAT_SKIP, "missing mapping explicitly skipped");
-        // Packet unchanged (port not in range anyway? Actually it IS in range but entry is FREE)
-        // Wait: port_start+500 = 10500, which IS in range [10000,20000]. Entry state = FREE.
-        // Code checks: if entry->state == FREE return 0
+        // Порт входит в динамический диапазон, но FREE-запись не даёт mapping.
         ASSERT(ctx.table[10500].state == EIM_NAT_ENTRY_FREE, "entry is free");
         free(resp);
         eim_nat_destroy_ctx(&ctx);
@@ -1039,6 +1037,8 @@ static void test_static_forward_owners(void) {
         "forward=udp:10000000000000000:10.0.0.2:40000:80", "forward=udp:1234:10.0.0.2:65536:80",
         "forward=udp:1234:10.0.0.2:40000:0", "forward=udp:1234:10.0.0.2:40000:-1",
         "forward=udp:1234:10.0.0.2:40000:80x", "port_start=65536", "port_end=-1", "nat_via=1234x",
+        "forward=udp: -1:10.0.0.2:40000:80", "forward=udp: +1:10.0.0.2:40000:80",
+        "forward=udp: 1234:10.0.0.2:40000:80",
         "tun_ip=bad", "tun_ip=::1", "tun_ifname=abcdefghijklmnopq", "malformed-option"
     };
     for (size_t i = 0; i < sizeof(invalid) / sizeof(invalid[0]); i++) {