fixed ecn normalization

diff --git a/ChangeLog b/ChangeLog
index a620a2369b12bfd2740296a22ea76a3de36d19e7..d5d29f3dd5947cc9c3aaa97b68360e220556deb1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -41,6 +41,7 @@
 -- session flag clean up
 -- fix wizard dtor
 -- fixed norm module handling of tcp opts
+-- fixed ecn normalization
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug

diff --git a/src/network_inspectors/normalize/norm_module.cc b/src/network_inspectors/normalize/norm_module.cc
index 89b8d4dc6c459b0c511269b1b5b60dcd03f8b7f5..857b7949a083c778c62820e7b07ac237c5a869dd 100644 (file)
--- a/src/network_inspectors/normalize/norm_module.cc
+++ b/src/network_inspectors/normalize/norm_module.cc
@@ -209,10 +209,10 @@ bool NormalizeModule::set_tcp(const char*, Value& v, SnortConfig*)
     else if ( v.is("ecn") )
     {
         if ( !strcmp(v.get_string(), "packet") )
-            Norm_Set(&config, NORM_TCP_ECN_PKT, v.get_bool());
+            Norm_Set(&config, NORM_TCP_ECN_PKT, true);
 
         else if ( !strcmp(v.get_string(), "stream") )
-            Norm_Set(&config, NORM_TCP_ECN_STR, v.get_bool());
+            Norm_Set(&config, NORM_TCP_ECN_STR, true);
     }
     else if ( v.is("allow_names") )
         return allow_names(&config, v.get_string());

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index ac248b198e370fbd5f8b8f47e274a33264c4ff78..ca4d57d8e0007cf537430316c2f8578170ec963f 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -4811,6 +4811,36 @@ static int ProcessTcp(
             return retcode;
         }
     }
+    else
+    {
+        /* If session is already marked as established */
+        if ( !(lwssn->session_state & STREAM5_STATE_ESTABLISHED) &&
+             (!config->require_3whs() || config->midstream_allowed(p)) )
+        {
+            /* If not requiring 3-way Handshake... */
+
+            /* TCP session created on TH_SYN above,
+             * or maybe on SYN-ACK, or anything else */
+
+            /* Need to update Lightweight session state */
+            if ( p->ptrs.tcph->is_syn_ack() )
+            {
+                /* SYN-ACK from server */
+                if (lwssn->session_state != STREAM5_STATE_NONE)
+                {
+                    lwssn->session_state |= STREAM5_STATE_SYN_ACK;
+                }
+            }
+            else if ( p->ptrs.tcph->is_ack() &&
+                (lwssn->session_state & STREAM5_STATE_SYN_ACK) )
+            {
+                lwssn->session_state |= STREAM5_STATE_ACK | STREAM5_STATE_ESTABLISHED;
+                Stream5UpdatePerfBaseState(&sfBase, lwssn, TCP_STATE_ESTABLISHED);
+            }
+        }
+        if ( p->ptrs.tcph->is_syn() )
+            NormalTrackECN(tcpssn, (TCPHdr*)p->ptrs.tcph, config->require_3whs());
+    }
 
     /* figure out direction of this packet */
     lwssn->set_direction(p);