From adef20d1e341d7c6a4478d5d6e673aede928331b Mon Sep 17 00:00:00 2001
From: david <david@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 8 Mar 2012 20:11:08 +0000
Subject: [PATCH] Use getFlags16 for TCP flags in vectorize.

We use as features even the four reserved TCP flags (some of them are no
longer reserved but declared for a particular purpose by some RFCs).
getFlags only returns 8 bits, leading to garbage in the feature vector
in the higher-order positions.

This doesn't affect the integrity of fingerprint submissions, because
they copy the packet contents directly and don't go through the getFlags
accessor.
---
 FPEngine.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/FPEngine.cc b/FPEngine.cc
index 7462f2825..f57320d32 100644
--- a/FPEngine.cc
+++ b/FPEngine.cc
@@ -847,7 +847,7 @@ static struct feature_node *vectorize(const FingerPrintResultsIPv6 *FPR) {
       continue;
     }
     features[idx++].value = tcp->getWindow();
-    flags = tcp->getFlags();
+    flags = tcp->getFlags16();
     for (mask = 0x001; mask <= 0x800; mask <<= 1)
       features[idx++].value = (flags & mask) != 0;