Re: snort3: reject rule problem
"Russ Combs \(rucombs\) via Snort-devel" <[email protected]> Thu, 26 Sep 2019 11:36:33 +0000
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============4317358060287826888== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_" --_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGFrZSBhIGxvb2sgYXQgdGhlIGFjdGl2ZSBtb2R1bGUuICBUcnkgY29uZmlndXJpbmcgYWN0aXZl Lm1pbl9pbnRlcnZhbC4NCg0KUnVzcw0KDQpGcm9tOiBTbm9ydC1kZXZlbCA8c25vcnQtZGV2ZWwt Ym91bmNlc0BsaXN0cy5zbm9ydC5vcmc+IG9uIGJlaGFsZiBvZiBNZXJpZG9mZiB2aWEgU25vcnQt ZGV2ZWwgPHNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZz4NClJlcGx5LVRvOiBNZXJpZG9mZiA8 b2Fndm96ZEBnbWFpbC5jb20+DQpEYXRlOiBXZWRuZXNkYXksIFNlcHRlbWJlciAyNSwgMjAxOSBh dCA1OjM5IFBNDQpUbzogInNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyIgPHNub3J0LWRldmVs QGxpc3RzLnNub3J0Lm9yZz4NClN1YmplY3Q6IFtTbm9ydC1kZXZlbF0gc25vcnQzOiByZWplY3Qg cnVsZSBwcm9ibGVtDQoNCg0KSGVsbG8NCg0KSSBoYXZlIHJlamVjdCBydWxlIHRoYXQgc2VuZCBQ b3J0IHVucmVhY2hhYmxlIGZvciBwaW5nLg0KDQoNCg0KSXQncyBPaywgYnV0IG9ubHkgZm9yIDFz dCBwYWNrZXQuDQoNCg0KDQpUaGUgbmV4dCBwaW5nIHBhY2tldHMgYXJlIHNpbGVudGx5IGRyb3Bw ZWQgYW5kIG5vdCBkZXRlY3RlZCBhbmQgbm90IGxvZ2dlZC4NCg0KDQoNCnJlamVjdCBpY21wIDE5 Mi4xNjguMC4xIGFueSAtPiBhbnkgYW55ICggZ2lkOjgwMDA7IHNpZDoxOyBtc2c6InBpbmciOyAg KQ0KDQoNCg0KVGhpcyBoYXBwZW5zIHdoZW4gc3RyZWFtIGFuZCBzdHJlYW1faWNtcCBpbnNwZWN0 b3JzIGFyZSBpbiBjb25maWcuDQoNCg0KDQpJZiBJIHJlbW92ZSBzdHJlYW0ge30gYW5kL29yIHN0 cmVhbV9pY21wIHt9IGluc3BlY3RvcnMgZnJvbSBzbm9ydCBsdWEgY29uZmlnLCB0aGVuIEFMTCBP SzogZWFjaCBwYWNrZXQgaXMNCg0KZHJvcHBlZCwgbG9nZ2VkIGFuZCBJQ01QIFBvcnQgdW5yZWFj aCBpcyBzZW5kaW5nIG9uIGVhY2ggZHJvcHBlZCBwYWNrZXQuDQoNCg0KDQoNCg0KUGFydCBvZiBj b25maWc6DQoNCg0KDQpzdHJlYW09e30NCg0Kc3RyZWFtX2ljbXA9e30NCg0KcmVqZWN0PXtjb250 cm9sPSJwb3J0In0NCg0KDQoNClRoYW5rcy4NCg== --_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <[email protected]> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxp bms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 Ijt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1z dHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4t cmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBp bjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJl Zm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7fQ0K c3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNv Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAu MHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46 MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT ZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9 IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5UYWtlIGEgbG9vayBhdCB0aGUgYWN0aXZlIG1vZHVsZS4mbmJz cDsgVHJ5IGNvbmZpZ3VyaW5nIGFjdGl2ZS5taW5faW50ZXJ2YWwuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlJ1c3M8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAj QjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206 IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPlNu b3J0LWRldmVsICZsdDtzbm9ydC1kZXZlbC1ib3VuY2VzQGxpc3RzLnNub3J0Lm9yZyZndDsgb24g YmVoYWxmIG9mIE1lcmlkb2ZmIHZpYSBTbm9ydC1kZXZlbCAmbHQ7c25vcnQtZGV2ZWxAbGlzdHMu c25vcnQub3JnJmd0Ozxicj4NCjxiPlJlcGx5LVRvOiA8L2I+TWVyaWRvZmYgJmx0O29hZ3ZvemRA Z21haWwuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5XZWRuZXNkYXksIFNlcHRlbWJlciAyNSwg MjAxOSBhdCA1OjM5IFBNPGJyPg0KPGI+VG86IDwvYj4mcXVvdDtzbm9ydC1kZXZlbEBsaXN0cy5z bm9ydC5vcmcmcXVvdDsgJmx0O3Nub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyZndDs8YnI+DQo8 Yj5TdWJqZWN0OiA8L2I+W1Nub3J0LWRldmVsXSBzbm9ydDM6IHJlamVjdCBydWxlIHByb2JsZW08 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5IZWxsbzxvOnA+PC9vOnA+PC9zcGFu PjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkkgaGF2ZSByZWplY3QgcnVs ZSB0aGF0IHNlbmQgUG9ydCB1bnJlYWNoYWJsZSBmb3IgcGluZy48bzpwPjwvbzpwPjwvc3Bhbj48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JdCdzIE9rLCBidXQg b25seSBmb3IgMXN0IHBhY2tldC48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UaGUgbmV4dCBwaW5nIHBhY2tldHMgYXJlIHNpbGVu dGx5IGRyb3BwZWQgYW5kIG5vdCBkZXRlY3RlZCBhbmQgbm90IGxvZ2dlZC48bzpwPjwvbzpwPjwv c3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5yZWplY3Qg aWNtcCAxOTIuMTY4LjAuMSBhbnkgLSZndDsgYW55IGFueSAoIGdpZDo4MDAwOyBzaWQ6MTsgbXNn OiZxdW90O3BpbmcmcXVvdDs7Jm5ic3A7ICk8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4N CjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UaGlzIGhhcHBlbnMgd2hlbiBzdHJlYW0g YW5kIHN0cmVhbV9pY21wIGluc3BlY3RvcnMgYXJlIGluIGNvbmZpZy48bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5JZiBJIHJlbW92 ZSBzdHJlYW0ge30gYW5kL29yIHN0cmVhbV9pY21wIHt9IGluc3BlY3RvcnMgZnJvbSBzbm9ydCBs dWEgY29uZmlnLCB0aGVuIEFMTCBPSzogZWFjaCBwYWNrZXQgaXM8bzpwPjwvbzpwPjwvc3Bhbj48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5kcm9wcGVkLCBsb2dnZWQgYW5k IElDTVAgUG9ydCB1bnJlYWNoIGlzIHNlbmRpbmcgb24gZWFjaCBkcm9wcGVkIHBhY2tldC48bzpw PjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9y OmJsYWNrIj5QYXJ0IG9mIGNvbmZpZzo8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5zdHJlYW09e308bzpwPjwvbzpwPjwvc3Bhbj48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5zdHJlYW1faWNtcD17fTxvOnA+ PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPnJlamVj dD17Y29udHJvbD0mcXVvdDtwb3J0JnF1b3Q7fTxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcHJl Pg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlRoYW5rcy48bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_A2DF498180174CD3B36E742D25E6D78Fciscocom_-- --===============4317358060287826888== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! --===============4317358060287826888==--