From: Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <oshumeik@cisco.com>
Date: Mon, 29 Apr 2024 13:48:58 +0000 (+0000)
Subject: Pull request #4299: detection: fix postponed rule evaluation with recall presence
X-Git-Tag: 3.2.1.0~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6a285aa8926fda597a184993598a3f7e285439f8;p=thirdparty%2Fsnort3.git

Pull request #4299: detection: fix postponed rule evaluation with recall presence

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:sse_last_recall_fix to master

Squashed commit of the following:

commit 620b83fde9df276fe25e9b8968efb01a684ed566
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Mon Apr 29 13:37:04 2024 +0300

    detection: fix postponed rule evaluation with recall presence

    Proceed to the next rule continuation only after the current one is done.
---

diff --git a/src/detection/detection_continuation.h b/src/detection/detection_continuation.h
index 60d9ee9e7..a3ef4330a 100644
--- a/src/detection/detection_continuation.h
+++ b/src/detection/detection_continuation.h
@@ -179,9 +179,10 @@ void Continuation::eval(snort::Packet& p)
     while (i != &states)
     {
         auto st = i;
-        i = i->get_next();
+        bool r = (**st).eval(p);
+        i = st->get_next();
 
-        if ((**st).eval(p))
+        if (r)
         {
             assert(0 < states_cnt);
             assert(st != &states);