From 8a927c56d83ed0f78785011bd92a53edc25a0ca0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 27 Oct 2020 17:05:25 +0100 Subject: src: Support odd-sized payload matches When expanding a payload match, don't disregard oversized templates at the right offset. A more flexible user may extract less bytes from the packet if only parts of a field are interesting, e.g. only the prefix of source/destination address. Support that by using the template, but fix the length. Later when creating a relational expression for it, detect the unusually small payload expression length and turn the RHS value into a prefix expression. Signed-off-by: Phil Sutter --- src/payload.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src/payload.c') diff --git a/src/payload.c b/src/payload.c index ca422d5b..e51c5797 100644 --- a/src/payload.c +++ b/src/payload.c @@ -822,6 +822,11 @@ void payload_expr_expand(struct list_head *list, struct expr *expr, expr->payload.offset += tmpl->len; if (expr->len == 0) return; + } else if (expr->len > 0) { + new = payload_expr_alloc(&expr->location, desc, i); + new->len = expr->len; + list_add_tail(&new->list, list); + return; } else break; } -- cgit v1.2.3