Re: [PATCH]: Add Nonce Sum bit to 'flags'

[Todd Wease <twease () sourcefire com>]

On Sat, Jan 26, 2013 at 4:59 AM, Joshua Kinard <kumba () gentoo org> wrote:

> Hi snort-devel,
>
> The attached patch adds support for reading the 'Nonce Sum' bit of the TCP
> Flags byte, as defined in RFC 3540.  The order of the 'C' and 'E' bit case
> statements are moved around to put them into logical (LSB) order
> (FSRPAUECN).  It also fixes the TCPHEADER_NORESERVED macro in
> src/dynamic-plugins/sf_engine/sf_snort_packet.h, which was missing the
> ECE/CWR bits, and adds TCPHEADER_NS to it as well.  The TeX for the manual
> is also updated.
>
>  doc/snort_manual.tex                            |    7 ++--
>  src/detection-plugins/sp_tcp_flag_check.c       |   35
> +++++++++++++++---------
>  src/dynamic-plugins/sf_engine/sf_snort_packet.h |    4 ++
>  src/rules.h                                     |    1
>  4 files changed, 31 insertions(+), 16 deletions(-)
>
>
> Cheers!,
>
> --
> Joshua Kinard
> Gentoo/MIPS
> kumba () gentoo org
> 4096R/D25D95E3 2011-03-28
>
> "The past tempts us, the present confuses us, the future frightens us.  And
> our lives slip away, moment by moment, lost in that vast, terrible
> in-between."
>
> --Emperor Turhan, Centauri Republic


Thanks for the patch Joshua.  We've created a feature bug to get this into
Snort.

Todd

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!