Snort mailing list archives
[PATCH]: Add Nonce Sum bit to 'flags'
From: Joshua Kinard <kumba () gentoo org>
Date: Sat, 26 Jan 2013 04:59:38 -0500
Hi snort-devel, The attached patch adds support for reading the 'Nonce Sum' bit of the TCP Flags byte, as defined in RFC 3540. The order of the 'C' and 'E' bit case statements are moved around to put them into logical (LSB) order (FSRPAUECN). It also fixes the TCPHEADER_NORESERVED macro in src/dynamic-plugins/sf_engine/sf_snort_packet.h, which was missing the ECE/CWR bits, and adds TCPHEADER_NS to it as well. The TeX for the manual is also updated. doc/snort_manual.tex | 7 ++-- src/detection-plugins/sp_tcp_flag_check.c | 35 +++++++++++++++--------- src/dynamic-plugins/sf_engine/sf_snort_packet.h | 4 ++ src/rules.h | 1 4 files changed, 31 insertions(+), 16 deletions(-) Cheers!, -- Joshua Kinard Gentoo/MIPS kumba () gentoo org 4096R/D25D95E3 2011-03-28 "The past tempts us, the present confuses us, the future frightens us. And our lives slip away, moment by moment, lost in that vast, terrible in-between." --Emperor Turhan, Centauri Republic
Attachment:
snort-294-flags-nonce_sum.patch
Description:
Attachment:
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS, MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft MVPs and experts. ON SALE this month only -- learn more at: http://p.sf.net/sfu/learnnow-d2d
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- [PATCH]: Add Nonce Sum bit to 'flags' Joshua Kinard (Jan 26)
- Re: [PATCH]: Add Nonce Sum bit to 'flags' Todd Wease (Jan 28)