Re: snort3: reject rule problem

"Russ Combs \(rucombs\) via Snort-devel" <[email protected]> Thu, 26 Sep 2019 11:36:33 +0000
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <[email protected]>
--===============4317358060287826888==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_"

--_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

VGFrZSBhIGxvb2sgYXQgdGhlIGFjdGl2ZSBtb2R1bGUuICBUcnkgY29uZmlndXJpbmcgYWN0aXZl
Lm1pbl9pbnRlcnZhbC4NCg0KUnVzcw0KDQpGcm9tOiBTbm9ydC1kZXZlbCA8c25vcnQtZGV2ZWwt
Ym91bmNlc0BsaXN0cy5zbm9ydC5vcmc+IG9uIGJlaGFsZiBvZiBNZXJpZG9mZiB2aWEgU25vcnQt
ZGV2ZWwgPHNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZz4NClJlcGx5LVRvOiBNZXJpZG9mZiA8
b2Fndm96ZEBnbWFpbC5jb20+DQpEYXRlOiBXZWRuZXNkYXksIFNlcHRlbWJlciAyNSwgMjAxOSBh
dCA1OjM5IFBNDQpUbzogInNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyIgPHNub3J0LWRldmVs
QGxpc3RzLnNub3J0Lm9yZz4NClN1YmplY3Q6IFtTbm9ydC1kZXZlbF0gc25vcnQzOiByZWplY3Qg
cnVsZSBwcm9ibGVtDQoNCg0KSGVsbG8NCg0KSSBoYXZlIHJlamVjdCBydWxlIHRoYXQgc2VuZCBQ
b3J0IHVucmVhY2hhYmxlIGZvciBwaW5nLg0KDQoNCg0KSXQncyBPaywgYnV0IG9ubHkgZm9yIDFz
dCBwYWNrZXQuDQoNCg0KDQpUaGUgbmV4dCBwaW5nIHBhY2tldHMgYXJlIHNpbGVudGx5IGRyb3Bw
ZWQgYW5kIG5vdCBkZXRlY3RlZCBhbmQgbm90IGxvZ2dlZC4NCg0KDQoNCnJlamVjdCBpY21wIDE5
Mi4xNjguMC4xIGFueSAtPiBhbnkgYW55ICggZ2lkOjgwMDA7IHNpZDoxOyBtc2c6InBpbmciOyAg
KQ0KDQoNCg0KVGhpcyBoYXBwZW5zIHdoZW4gc3RyZWFtIGFuZCBzdHJlYW1faWNtcCBpbnNwZWN0
b3JzIGFyZSBpbiBjb25maWcuDQoNCg0KDQpJZiBJIHJlbW92ZSBzdHJlYW0ge30gYW5kL29yIHN0
cmVhbV9pY21wIHt9IGluc3BlY3RvcnMgZnJvbSBzbm9ydCBsdWEgY29uZmlnLCB0aGVuIEFMTCBP
SzogZWFjaCBwYWNrZXQgaXMNCg0KZHJvcHBlZCwgbG9nZ2VkIGFuZCBJQ01QIFBvcnQgdW5yZWFj
aCBpcyBzZW5kaW5nIG9uIGVhY2ggZHJvcHBlZCBwYWNrZXQuDQoNCg0KDQoNCg0KUGFydCBvZiBj
b25maWc6DQoNCg0KDQpzdHJlYW09e30NCg0Kc3RyZWFtX2ljbXA9e30NCg0KcmVqZWN0PXtjb250
cm9sPSJwb3J0In0NCg0KDQoNClRoYW5rcy4NCg==

--_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_
Content-Type: text/html; charset="utf-8"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4
bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo
dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo
dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l
dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg
bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj
ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2
IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy
IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz
Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z
ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow
aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m
YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K
CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRp
b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt
c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246
dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxp
bms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv
bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3
Ijt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1z
dHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4t
cmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBp
bjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm
O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJl
Zm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu
azoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7fQ0K
c3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9u
dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNv
Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAu
MHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46
MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT
ZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9
IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8
cCBjbGFzcz0iTXNvTm9ybWFsIj5UYWtlIGEgbG9vayBhdCB0aGUgYWN0aXZlIG1vZHVsZS4mbmJz
cDsgVHJ5IGNvbmZpZ3VyaW5nIGFjdGl2ZS5taW5faW50ZXJ2YWwuPG86cD48L286cD48L3A+DQo8
cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O
b3JtYWwiPlJ1c3M8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i
c3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAj
QjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05v
cm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206
IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPlNu
b3J0LWRldmVsICZsdDtzbm9ydC1kZXZlbC1ib3VuY2VzQGxpc3RzLnNub3J0Lm9yZyZndDsgb24g
YmVoYWxmIG9mIE1lcmlkb2ZmIHZpYSBTbm9ydC1kZXZlbCAmbHQ7c25vcnQtZGV2ZWxAbGlzdHMu
c25vcnQub3JnJmd0Ozxicj4NCjxiPlJlcGx5LVRvOiA8L2I+TWVyaWRvZmYgJmx0O29hZ3ZvemRA
Z21haWwuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5XZWRuZXNkYXksIFNlcHRlbWJlciAyNSwg
MjAxOSBhdCA1OjM5IFBNPGJyPg0KPGI+VG86IDwvYj4mcXVvdDtzbm9ydC1kZXZlbEBsaXN0cy5z
bm9ydC5vcmcmcXVvdDsgJmx0O3Nub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyZndDs8YnI+DQo8
Yj5TdWJqZWN0OiA8L2I+W1Nub3J0LWRldmVsXSBzbm9ydDM6IHJlamVjdCBydWxlIHByb2JsZW08
bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs
Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp
dj4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5IZWxsbzxvOnA+PC9vOnA+PC9zcGFu
PjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkkgaGF2ZSByZWplY3QgcnVs
ZSB0aGF0IHNlbmQgUG9ydCB1bnJlYWNoYWJsZSBmb3IgcGluZy48bzpwPjwvbzpwPjwvc3Bhbj48
L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv
c3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JdCdzIE9rLCBidXQg
b25seSBmb3IgMXN0IHBhY2tldC48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4g
c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+
PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UaGUgbmV4dCBwaW5nIHBhY2tldHMgYXJlIHNpbGVu
dGx5IGRyb3BwZWQgYW5kIG5vdCBkZXRlY3RlZCBhbmQgbm90IGxvZ2dlZC48bzpwPjwvbzpwPjwv
c3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwv
bzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5yZWplY3Qg
aWNtcCAxOTIuMTY4LjAuMSBhbnkgLSZndDsgYW55IGFueSAoIGdpZDo4MDAwOyBzaWQ6MTsgbXNn
OiZxdW90O3BpbmcmcXVvdDs7Jm5ic3A7ICk8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+
PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4N
CjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UaGlzIGhhcHBlbnMgd2hlbiBzdHJlYW0g
YW5kIHN0cmVhbV9pY21wIGluc3BlY3RvcnMgYXJlIGluIGNvbmZpZy48bzpwPjwvbzpwPjwvc3Bh
bj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw
Pjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JZiBJIHJlbW92
ZSBzdHJlYW0ge30gYW5kL29yIHN0cmVhbV9pY21wIHt9IGluc3BlY3RvcnMgZnJvbSBzbm9ydCBs
dWEgY29uZmlnLCB0aGVuIEFMTCBPSzogZWFjaCBwYWNrZXQgaXM8bzpwPjwvbzpwPjwvc3Bhbj48
L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5kcm9wcGVkLCBsb2dnZWQgYW5k
IElDTVAgUG9ydCB1bnJlYWNoIGlzIHNlbmRpbmcgb24gZWFjaCBkcm9wcGVkIHBhY2tldC48bzpw
PjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpw
PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr
Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9y
OmJsYWNrIj5QYXJ0IG9mIGNvbmZpZzo8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNw
YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxw
cmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5zdHJlYW09e308bzpwPjwvbzpwPjwvc3Bhbj48
L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5zdHJlYW1faWNtcD17fTxvOnA+
PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPnJlamVj
dD17Y29udHJvbD0mcXVvdDtwb3J0JnF1b3Q7fTxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHBy
ZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcHJl
Pg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlRoYW5rcy48bzpwPjwvbzpwPjwvc3Bh
bj48L3ByZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+
DQo8L2h0bWw+DQo=

--_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_--

--===============4317358060287826888==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============4317358060287826888==--