aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

json alert: fix action

Browse Source 
It would give 'Pass' as an action when the rule is set to 'alert'.
pull/892/head
Victor Julien 12 years ago
parent e04b5f0dca
commit 010a334e1a
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File

20
src/output-json-alert.c
Unescape Escape View File

@ -77,7 +77,6 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
{ {
MemBuffer *buffer = (MemBuffer *)aft->buffer; MemBuffer *buffer = (MemBuffer *)aft->buffer;
int i; int i;
char *action = "Pass";
if (p->alerts.cnt == 0) if (p->alerts.cnt == 0)
return TM_ECODE_OK; return TM_ECODE_OK;
@ -94,10 +93,11 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
continue; continue;
} }
if ((pa->action & ACTION_DROP) && IS_ENGINE_MODE_IPS(engine_mode)) { char *action = "allowed";
action = "Drop"; if (pa->action & (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)) {
} else if (pa->action & ACTION_DROP) { action = "blocked";
action = "wDrop"; } else if ((pa->action & ACTION_DROP) && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "blocked";
} }
json_t *ajs = json_object(); json_t *ajs = json_object();
@ -133,7 +133,6 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
MemBuffer *buffer = (MemBuffer *)aft->buffer; MemBuffer *buffer = (MemBuffer *)aft->buffer;
int i; int i;
char timebuf[64]; char timebuf[64];
char *action = "Pass";
json_t *js; json_t *js;
if (p->alerts.cnt == 0) if (p->alerts.cnt == 0)
@ -149,10 +148,11 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
continue; continue;
} }
if ((pa->action & ACTION_DROP) && IS_ENGINE_MODE_IPS(engine_mode)) { char *action = "allowed";
action = "Drop"; if (pa->action & (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)) {
} else if (pa->action & ACTION_DROP) { action = "blocked";
action = "wDrop"; } else if ((pa->action & ACTION_DROP) && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "blocked";
} }
char buf[(32 * 3) + 1]; char buf[(32 * 3) + 1];

Write Preview
Loading…
Cancel
Save