[PATCH]: Add Nonce Sum bit to 'flags'

[Joshua Kinard <kumba () gentoo org>]

Hi snort-devel,

The attached patch adds support for reading the 'Nonce Sum' bit of the TCP
Flags byte, as defined in RFC 3540.  The order of the 'C' and 'E' bit case
statements are moved around to put them into logical (LSB) order
(FSRPAUECN).  It also fixes the TCPHEADER_NORESERVED macro in
src/dynamic-plugins/sf_engine/sf_snort_packet.h, which was missing the
ECE/CWR bits, and adds TCPHEADER_NS to it as well.  The TeX for the manual
is also updated.

 doc/snort_manual.tex                            |    7 ++--
 src/detection-plugins/sp_tcp_flag_check.c       |   35 +++++++++++++++---------
 src/dynamic-plugins/sf_engine/sf_snort_packet.h |    4 ++
 src/rules.h                                     |    1
 4 files changed, 31 insertions(+), 16 deletions(-)


Cheers!,

-- 
Joshua Kinard
Gentoo/MIPS
kumba () gentoo org
4096R/D25D95E3 2011-03-28

"The past tempts us, the present confuses us, the future frightens us.  And
our lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic

Attachment: snort-294-flags-nonce_sum.patch
Description:

Attachment: signature.asc
Description: OpenPGP digital signature

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!