From a5c4a5365e141dce83343233c83f4e7facb02ceb Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 17 Nov 2021 11:10:06 +0100 Subject: parser_json: add raw payload inner header match support Add missing "ih" base raw payload and extend tests/py to cover this new usecase. Signed-off-by: Pablo Neira Ayuso --- src/parser_json.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src') diff --git a/src/parser_json.c b/src/parser_json.c index 3cd21175..7a2d30ff 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -558,6 +558,8 @@ static struct expr *json_parse_payload_expr(struct json_ctx *ctx, val = PROTO_BASE_NETWORK_HDR; } else if (!strcmp(base, "th")) { val = PROTO_BASE_TRANSPORT_HDR; + } else if (!strcmp(base, "ih")) { + val = PROTO_BASE_INNER_HDR; } else { json_error(ctx, "Invalid payload base '%s'.", base); return NULL; -- cgit v1.2.3