correct route dispatch defaults and validation

Author: JeremiahM37

src/routes.c

@@ -1991,6 +1991,9 @@ WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_route_table_default_policy_set(
 {
     if (WOLFSENTRY_MASKOUT_BITS(default_policy, WOLFSENTRY_ROUTE_DEFAULT_POLICY_MASK) != WOLFSENTRY_ACTION_RES_NONE)
         WOLFSENTRY_ERROR_RETURN(INVALID_ARG);
+    if ((default_policy != WOLFSENTRY_ACTION_RES_NONE) &&
+        (! WOLFSENTRY_MASKIN_BITS(default_policy, WOLFSENTRY_ACTION_RES_ACCEPT | WOLFSENTRY_ACTION_RES_REJECT)))
+        WOLFSENTRY_ERROR_RETURN(INVALID_ARG);
     WOLFSENTRY_MUTEX_OR_RETURN();
     table->default_policy = default_policy;
     if (table == wolfsentry->routes)
@@ -2502,16 +2505,27 @@ static wolfsentry_errcode_t wolfsentry_route_event_dispatch_0(
 
         if (! (current_rule_route_flags & WOLFSENTRY_ROUTE_FLAG_DONT_COUNT_CURRENT_CONNECTIONS)) {
             if (*action_results & WOLFSENTRY_ACTION_RES_CONNECT) {
-                if (rule_route->meta.connection_count >= config->config.max_connection_count) {
-                    *action_results |= WOLFSENTRY_ACTION_RES_REJECT;
-                    ret = WOLFSENTRY_ERROR_ENCODE(OK);
-                    goto done;
-                }
-                if (WOLFSENTRY_ATOMIC_INCREMENT_BY_ONE(rule_route->meta.connection_count) > config->config.max_connection_count) {
-                    WOLFSENTRY_ATOMIC_DECREMENT_BY_ONE(rule_route->meta.connection_count);
-                    *action_results |= WOLFSENTRY_ACTION_RES_REJECT;
-                    ret = WOLFSENTRY_ERROR_ENCODE(OK);
-                    goto done;
+                if (config->config.max_connection_count > 0) {
+                    if (rule_route->meta.connection_count >= config->config.max_connection_count) {
+                        *action_results |= WOLFSENTRY_ACTION_RES_REJECT;
+                        ret = WOLFSENTRY_ERROR_ENCODE(OK);
+                        goto done;
+                    }
+                    if (WOLFSENTRY_ATOMIC_INCREMENT_BY_ONE(rule_route->meta.connection_count) > config->config.max_connection_count) {
+                        WOLFSENTRY_ATOMIC_DECREMENT_BY_ONE(rule_route->meta.connection_count);
+                        *action_results |= WOLFSENTRY_ACTION_RES_REJECT;
+                        ret = WOLFSENTRY_ERROR_ENCODE(OK);
+                        goto done;
+                    }
+                } else {
+                    /* unlimited: saturate at UINT16_MAX to avoid wrap-around.
+                     * Once saturated, the count no longer tracks live
+                     * connections exactly, but DISCONNECT's safe-decrement
+                     * stays well-defined.
+                     */
+                    uint16_t dummy;
+                    WOLFSENTRY_ATOMIC_INCREMENT_UNSIGNED_SAFELY_BY_ONE(rule_route->meta.connection_count, dummy);
+                    (void)dummy;
                 }
             } else if (*action_results & WOLFSENTRY_ACTION_RES_DISCONNECT) {
                 uint16_t new_connection_count;