Pull request #4299: detection: fix postponed rule evaluation with recall presence

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:sse_last_recall_fix to master

Squashed commit of the following:

commit 620b83fde9df276fe25e9b8968efb01a684ed566
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Mon Apr 29 13:37:04 2024 +0300

    detection: fix postponed rule evaluation with recall presence

    Proceed to the next rule continuation only after the current one is done.

diff --git a/src/detection/detection_continuation.h b/src/detection/detection_continuation.h
index 60d9ee9e7728647afca05a13bd378c83de00000d..a3ef4330ab54ba17d3fa78fd7da141410825e814 100644 (file)
--- a/src/detection/detection_continuation.h
+++ b/src/detection/detection_continuation.h
@@ -179,9 +179,10 @@ void Continuation::eval(snort::Packet& p)
     while (i != &states)
     {
         auto st = i;
-        i = i->get_next();
+        bool r = (**st).eval(p);
+        i = st->get_next();
 
-        if ((**st).eval(p))
+        if (r)
         {
             assert(0 < states_cnt);
             assert(st != &states);