eve/drop: always enable verdict in firewall mode

4 months ago · f9b25dc6ec
parent ff6fb068c7
commit f9b25dc6ec
1 changed files with 5 additions and 1 deletions
--- a/src/output-json-drop.c
+++ b/src/output-json-drop.c
@ -296,8 +296,12 @@ static OutputInitResult JsonDropLogInitCtxSub(SCConfNode *conf, OutputCtx *paren
                             "'flow' are 'start' and 'all'");
            }
        }
+
        extended = SCConfNodeLookupChildValue(conf, "verdict");
-        if (extended != NULL) {
+
+        if (EngineModeIsFirewall()) {
+            drop_ctx->flags |= LOG_DROP_VERDICT;
+        } else if (extended != NULL) {
            if (SCConfValIsTrue(extended)) {
                drop_ctx->flags |= LOG_DROP_VERDICT;
            }