detect/alert: fix suppressed drop handling

If drop was issued for suppressed rule, still consider it for the
next alert.
pull/15475/head
Victor Julien 5 months ago
parent 508bb71d78
commit 7e9402a2e0

@ -587,15 +587,13 @@ static inline void PacketAlertFinalizeProcessQueue(
skip_td = true;
continue;
}
// TODO we can also drop if alert is suppressed, right?
if (s->action & ACTION_DROP) {
SCLogDebug("sid:%u led to a drop that will skip any firewall alerts", s->id);
dropped = true;
}
} else {
p->alerts.discarded++;
}
if (s->action & ACTION_DROP) {
dropped = true;
}
}
/* Set flag on flow to indicate that it has alerts. We use the bool to

Loading…
Cancel
Save