Merge pull request #1578 in SNORT/snort3 from ~MASHASAN/snort3:excess_max_sessions...

Squashed commit of the following:

commit 0f8c59bf66e5fb22a20a884d86a069deaf79f715
Author: Masud Hasan <mashasan@cisco.com>
Date:   Mon Apr 15 22:08:16 2019 -0400

    flow_cache: Pruning one stream when excess pruning skips even if max_sessions is reached

diff --git a/src/flow/flow_cache.cc b/src/flow/flow_cache.cc
index 2224ecd28f8150cbe199a485b483905949d5f648..c3dae9dbc22e3155e31248957639fcac18ee3fb7 100644 (file)
--- a/src/flow/flow_cache.cc
+++ b/src/flow/flow_cache.cc
@@ -281,6 +281,13 @@ unsigned FlowCache::prune_excess(const Flow* save_me)
         if ( ignore_offloads > 0 )
             --ignore_offloads;
     }
+
+    if (!pruned and hash_table->get_count() > max_cap)
+    {
+        prune_one(PruneReason::EXCESS, true);
+        ++pruned;
+    }
+
     return pruned;
 }
 
@@ -291,6 +298,7 @@ bool FlowCache::prune_one(PruneReason reason, bool do_cleanup)
     if ( hash_table->get_count() <= 1 )
         return false;
 
+    // ZHash returns in LRU order, which is updated per packet via find --> move_to_front call
     auto flow = static_cast<Flow*>(hash_table->first());
     assert(flow);