From: Juweria Ali Imran (jaliimra) <jaliimra@cisco.com>
Date: Wed, 24 Sep 2025 18:24:35 +0000 (+0000)
Subject: Pull request #4916: stream: do not clear a session on a rebuilt packet
X-Git-Tag: 3.9.6.0~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=87610a9878ec3870477fddacd3885e1b16457c2c;p=thirdparty%2Fsnort3.git

Pull request #4916: stream: do not clear a session on a rebuilt packet

Merge in SNORT/snort3 from ~JALIIMRA/snort3:rebuilt_packet_check to master

Squashed commit of the following:

commit 419853bf07117f2560b50a3f18ff9e9d41f461a1
Author: Juweria Ali Imran <jaliimra@shaslad-ws.cisco.com>
Date:   Thu Sep 18 22:56:40 2025 -0400

    stream: do not clear a session on a rebuilt packet
---

diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc
index 28b6a3a0e..b2a0e625c 100644
--- a/src/detection/detection_engine.cc
+++ b/src/detection/detection_engine.cc
@@ -274,7 +274,7 @@ void DetectionEngine::finish_inspect(Packet* p, bool inspected)
     // this also handles block pending state
     // must only be done for terminal packets to avoid yoinking stream_tcp state
     // while processing a PDU
-    if ( !p->has_parent() )
+    if ( !p->has_parent() and !p->is_rebuilt() )
         Stream::check_flow_closed(p);
 
     clear_events(p);