From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Tue, 18 Nov 2014 20:18:54 +0000 (-0500)
Subject: fixed ecn normalization
X-Git-Tag: 3.0.0-233~1197^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=de5d1bed4f3ca1c1e7aa926d16945edcc646cfd9;p=thirdparty%2Fsnort3.git

fixed ecn normalization
---

diff --git a/ChangeLog b/ChangeLog
index a620a2369..d5d29f3dd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -41,6 +41,7 @@
 -- session flag clean up
 -- fix wizard dtor
 -- fixed norm module handling of tcp opts
+-- fixed ecn normalization
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug
diff --git a/src/network_inspectors/normalize/norm_module.cc b/src/network_inspectors/normalize/norm_module.cc
index 89b8d4dc6..857b7949a 100644
--- a/src/network_inspectors/normalize/norm_module.cc
+++ b/src/network_inspectors/normalize/norm_module.cc
@@ -209,10 +209,10 @@ bool NormalizeModule::set_tcp(const char*, Value& v, SnortConfig*)
     else if ( v.is("ecn") )
     {
         if ( !strcmp(v.get_string(), "packet") )
-            Norm_Set(&config, NORM_TCP_ECN_PKT, v.get_bool());
+            Norm_Set(&config, NORM_TCP_ECN_PKT, true);
 
         else if ( !strcmp(v.get_string(), "stream") )
-            Norm_Set(&config, NORM_TCP_ECN_STR, v.get_bool());
+            Norm_Set(&config, NORM_TCP_ECN_STR, true);
     }
     else if ( v.is("allow_names") )
         return allow_names(&config, v.get_string());
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index ac248b198..ca4d57d8e 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -4811,6 +4811,36 @@ static int ProcessTcp(
             return retcode;
         }
     }
+    else
+    {
+        /* If session is already marked as established */
+        if ( !(lwssn->session_state & STREAM5_STATE_ESTABLISHED) &&
+             (!config->require_3whs() || config->midstream_allowed(p)) )
+        {
+            /* If not requiring 3-way Handshake... */
+
+            /* TCP session created on TH_SYN above,
+             * or maybe on SYN-ACK, or anything else */
+
+            /* Need to update Lightweight session state */
+            if ( p->ptrs.tcph->is_syn_ack() )
+            {
+                /* SYN-ACK from server */
+                if (lwssn->session_state != STREAM5_STATE_NONE)
+                {
+                    lwssn->session_state |= STREAM5_STATE_SYN_ACK;
+                }
+            }
+            else if ( p->ptrs.tcph->is_ack() &&
+                (lwssn->session_state & STREAM5_STATE_SYN_ACK) )
+            {
+                lwssn->session_state |= STREAM5_STATE_ACK | STREAM5_STATE_ESTABLISHED;
+                Stream5UpdatePerfBaseState(&sfBase, lwssn, TCP_STATE_ESTABLISHED);
+            }
+        }
+        if ( p->ptrs.tcph->is_syn() )
+            NormalTrackECN(tcpssn, (TCPHdr*)p->ptrs.tcph, config->require_3whs());
+    }
 
     /* figure out direction of this packet */
     lwssn->set_direction(p);