From: Victor Julien <victor@inliniac.net>
Date: Fri, 11 Apr 2014 15:26:47 +0000 (+0200)
Subject: stream: improve StreamTcpPruneSession
X-Git-Tag: suricata-2.0.1rc1~29
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=539bf57a651d2278f6160a291be74940a5f861e3;p=thirdparty%2Fsuricata.git

stream: improve StreamTcpPruneSession

Check if a segment is done for the app-layer using
StreamTcpAppLayerSegmentProcessed instead of the flag directly so the
gap case works better.
---

diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index c7540fa7f4..105e5d042d 100644
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -2740,13 +2740,14 @@ void StreamTcpPruneSession(Flow *f, uint8_t flags) {
 
     for (; seg != NULL && SEQ_LT(seg->seq, stream->last_ack);)
     {
-        SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32,
+        SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32", FLAGS %02x",
                 seg, seg->seq, seg->payload_len,
-                (uint32_t)(seg->seq + seg->payload_len));
+                (uint32_t)(seg->seq + seg->payload_len), seg->flags);
 
         if (SEQ_LEQ((seg->seq + seg->payload_len), (ra_base_seq+1)) &&
                    (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) &&
-                   (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) {
+                    StreamTcpAppLayerSegmentProcessed(stream, seg))
+        {
             if (StreamTcpReturnSegmentCheck(ssn, stream, seg) == 0) {
                 break;
             }
@@ -2761,8 +2762,8 @@ void StreamTcpPruneSession(Flow *f, uint8_t flags) {
             continue;
 
         } else if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream) &&
-                (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) &&
-                (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED))
+                  (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) &&
+                   StreamTcpAppLayerSegmentProcessed(stream, seg))
         {
             if (StreamTcpReturnSegmentCheck(ssn, stream, seg) == 0) {
                 break;