Pull request #4916: stream: do not clear a session on a rebuilt packet

Merge in SNORT/snort3 from ~JALIIMRA/snort3:rebuilt_packet_check to master

Squashed commit of the following:

commit 419853bf07117f2560b50a3f18ff9e9d41f461a1
Author: Juweria Ali Imran <jaliimra@shaslad-ws.cisco.com>
Date:   Thu Sep 18 22:56:40 2025 -0400

    stream: do not clear a session on a rebuilt packet

diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc
index 28b6a3a0ec36ca2c1c922cefc1aea2484a855b81..b2a0e625c221af6a72d1182b5f86fa7a05d3751b 100644 (file)
--- a/src/detection/detection_engine.cc
+++ b/src/detection/detection_engine.cc
@@ -274,7 +274,7 @@ void DetectionEngine::finish_inspect(Packet* p, bool inspected)
     // this also handles block pending state
     // must only be done for terminal packets to avoid yoinking stream_tcp state
     // while processing a PDU
-    if ( !p->has_parent() )
+    if ( !p->has_parent() and !p->is_rebuilt() )
         Stream::check_flow_closed(p);
 
     clear_events(p);