stream: improve StreamTcpPruneSession

Check if a segment is done for the app-layer using
StreamTcpAppLayerSegmentProcessed instead of the flag directly so the
gap case works better.

diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index c7540fa7f4a9b9f72a432f164e2259830c151337..105e5d042da81386eb8b4d8709424799e355d65f 100644 (file)
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -2740,13 +2740,14 @@ void StreamTcpPruneSession(Flow *f, uint8_t flags) {
 
     for (; seg != NULL && SEQ_LT(seg->seq, stream->last_ack);)
     {
-        SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32,
+        SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32", FLAGS %02x",
                 seg, seg->seq, seg->payload_len,
-                (uint32_t)(seg->seq + seg->payload_len));
+                (uint32_t)(seg->seq + seg->payload_len), seg->flags);
 
         if (SEQ_LEQ((seg->seq + seg->payload_len), (ra_base_seq+1)) &&
                    (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) &&
-                   (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) {
+                    StreamTcpAppLayerSegmentProcessed(stream, seg))
+        {
             if (StreamTcpReturnSegmentCheck(ssn, stream, seg) == 0) {
                 break;
             }
@@ -2761,8 +2762,8 @@ void StreamTcpPruneSession(Flow *f, uint8_t flags) {
             continue;
 
         } else if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream) &&
-                (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) &&
-                (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED))
+                  (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) &&
+                   StreamTcpAppLayerSegmentProcessed(stream, seg))
         {
             if (StreamTcpReturnSegmentCheck(ssn, stream, seg) == 0) {
                 break;