detect/alert: fix suppressed drop handling

If drop was issued for suppressed rule, still consider it for the
next alert.

(cherry picked from commit 7e9402a2e0)
pull/15572/head
Victor Julien 4 months ago
parent 9bd0ce75d6
commit f5ee931d6b

@ -592,15 +592,13 @@ static inline void PacketAlertFinalizeProcessQueue(
skip_td = true;
continue;
}
// TODO we can also drop if alert is suppressed, right?
if (s->action & ACTION_DROP) {
SCLogDebug("sid:%u led to a drop that will skip any firewall alerts", s->id);
dropped = true;
}
} else {
p->alerts.discarded++;
}
if (s->action & ACTION_DROP) {
dropped = true;
}
}
}

Loading…
Cancel
Save