Pull request #4293: detection: clear inspector data before removing flow_data

Merge in SNORT/snort3 from ~VHORBATO/snort3:http_assert to master

Squashed commit of the following:

commit 03879b80307fc9c43f31f62cfb94cd88ffbdeb32
Author: vhorbato <vhorbato@cisco.com>
Date:   Thu Apr 18 12:36:18 2024 +0300

    detection: clear inspector data before flow_data

diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc
index 771f6b4d8a8fd066f94143a1fe43164d23931bcd..6945abce6df784fc990c8186bde066090e55b310 100644 (file)
--- a/src/detection/detection_engine.cc
+++ b/src/detection/detection_engine.cc
@@ -252,6 +252,9 @@ void DetectionEngine::finish_inspect(Packet* p, bool inspected)
 
     p->context->post_detection();
 
+    if ( inspected and !p->context->next() )
+        InspectorManager::clear(p);
+
     // clear closed sessions here after inspection since non-stream
     // inspectors may depend on flow information
     // this also handles block pending state
@@ -260,9 +263,6 @@ void DetectionEngine::finish_inspect(Packet* p, bool inspected)
     if ( !p->has_parent() )
         Stream::check_flow_closed(p);
 
-    if ( inspected and !p->context->next() )
-        InspectorManager::clear(p);
-
     clear_events(p);
 }