eve/drop: don't log drops unless packet is dropped

In pass/drop combinations where the pass rule took precendence over
the drop, a "drop" false positive could still be logged due to the
storing of the drop record in the packet drop alert store.

Bug: #5867.
pull/8624/head
Victor Julien 3 years ago
parent 9b4fb63a7b
commit 09348564f0

@ -349,6 +349,10 @@ static int JsonDropLogCondition(ThreadVars *tv, void *data, const Packet *p)
return FALSE;
}
if (!(PacketCheckAction(p, ACTION_DROP))) {
return FALSE;
}
if (g_droplog_flows_start && p->flow != NULL) {
int ret = FALSE;
@ -365,11 +369,9 @@ static int JsonDropLogCondition(ThreadVars *tv, void *data, const Packet *p)
ret = TRUE;
return ret;
} else if (PacketCheckAction(p, ACTION_DROP)) {
return TRUE;
}
return FALSE;
return TRUE;
}
void JsonDropLogRegister (void)

Loading…
Cancel
Save