From 7e9402a2e0614bf59f3ca44e3e1f426e3c19504a Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 26 May 2026 11:52:40 +0200 Subject: [PATCH] detect/alert: fix suppressed drop handling If drop was issued for suppressed rule, still consider it for the next alert. --- src/detect-engine-alert.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index 5c0cd6cafe..43f8c05a41 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -587,15 +587,13 @@ static inline void PacketAlertFinalizeProcessQueue( skip_td = true; continue; } - - // TODO we can also drop if alert is suppressed, right? - if (s->action & ACTION_DROP) { - SCLogDebug("sid:%u led to a drop that will skip any firewall alerts", s->id); - dropped = true; - } } else { p->alerts.discarded++; } + + if (s->action & ACTION_DROP) { + dropped = true; + } } /* Set flag on flow to indicate that it has alerts. We use the bool to