diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index aa366ec194..bf7927d638 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -2706,19 +2706,6 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, seg, seg->seq, seg->payload_len, (uint32_t)(seg->seq + seg->payload_len)); - /* if app layer protocol has been detected, then remove all the segments - which has been previously processed and reassembled */ - if ((ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED) && - (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) && - (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) - { - SCLogDebug("segment(%p) of length %"PRIu16" has been processed," - " so return it to pool", seg, seg->payload_len); - TcpSegment *next_seg = seg->next; - seg = next_seg; - continue; - } - /* Remove the segments which are either completely before the ra_base_seq or if they are beyond ra_base_seq, but the segment offset from which we need to copy in to smsg is beyond the stream->last_ack. @@ -2738,6 +2725,19 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, continue; } + /* if app layer protocol has been detected, then remove all the segments + which has been previously processed and reassembled */ + if ((ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED) && + (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) && + (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) + { + SCLogDebug("segment(%p) of length %"PRIu16" has been processed," + " so return it to pool", seg, seg->payload_len); + TcpSegment *next_seg = seg->next; + seg = next_seg; + continue; + } + /* we've run into a sequence gap */ if (SEQ_GT(seg->seq, next_seq)) { @@ -3114,22 +3114,6 @@ static int StreamTcpReassembleRaw (TcpReassemblyThreadCtx *ra_ctx, seg, seg->seq, seg->payload_len, (uint32_t)(seg->seq + seg->payload_len)); - /* if app layer protocol has been detected, then remove all the segments - * which has been previously processed and reassembled - * - * If the stream is in GAP state the app layer flag won't be set */ - if ((ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED) && - (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) && - (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED || - stream->flags & STREAMTCP_STREAM_FLAG_GAP)) - { - SCLogDebug("segment(%p) of length %"PRIu16" has been processed," - " so return it to pool", seg, seg->payload_len); - TcpSegment *next_seg = seg->next; - seg = next_seg; - continue; - } - /* Remove the segments which are either completely before the ra_base_seq or if they are beyond ra_base_seq, but the segment offset from which we need to copy in to smsg is beyond the stream->last_ack. @@ -3147,6 +3131,22 @@ static int StreamTcpReassembleRaw (TcpReassemblyThreadCtx *ra_ctx, continue; } + /* if app layer protocol has been detected, then remove all the segments + * which has been previously processed and reassembled + * + * If the stream is in GAP state the app layer flag won't be set */ + if ((ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED) && + (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) && + (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED || + stream->flags & STREAMTCP_STREAM_FLAG_GAP)) + { + SCLogDebug("segment(%p) of length %"PRIu16" has been processed," + " so return it to pool", seg, seg->payload_len); + TcpSegment *next_seg = seg->next; + seg = next_seg; + continue; + } + /* we've run into a sequence gap */ if (SEQ_GT(seg->seq, next_seq)) {