From 2a7eb5d062e9735096a7b9ad765725061a747fcb Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 1 Nov 2025 14:27:56 +0100 Subject: [PATCH] detect/threshold: set missing alert flag in rate_filter ACTION_ALERT is supposed to be set now, but wasn't for rate_filter. This becomes important in a follow up patch where only PacketAlert entries with `action` `ACTION_ALERT` are logged in alert logging. --- src/detect-engine-threshold.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index 2d4e87919f..8bdbda8f5c 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -630,11 +630,11 @@ static inline void RateFilterSetAction(PacketAlert *pa, uint8_t new_action) break; case TH_ACTION_DROP: pa->flags |= PACKET_ALERT_FLAG_RATE_FILTER_MODIFIED; - pa->action = ACTION_DROP; + pa->action = (ACTION_DROP | ACTION_ALERT); break; case TH_ACTION_REJECT: pa->flags |= PACKET_ALERT_FLAG_RATE_FILTER_MODIFIED; - pa->action = (ACTION_REJECT | ACTION_DROP); + pa->action = (ACTION_REJECT | ACTION_DROP | ACTION_ALERT); break; case TH_ACTION_PASS: pa->flags |= PACKET_ALERT_FLAG_RATE_FILTER_MODIFIED;