diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c index b0728c4739..a4d4634b29 100644 --- a/src/alert-fastlog.c +++ b/src/alert-fastlog.c @@ -145,9 +145,9 @@ TmEcode AlertFastLogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); - if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { + if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { action = "[Drop] "; - } else if (pa->action == ACTION_DROP) { + } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } @@ -199,9 +199,9 @@ TmEcode AlertFastLogIPv6(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); - if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { + if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { action = "[Drop] "; - } else if (pa->action == ACTION_DROP) { + } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } @@ -251,9 +251,9 @@ TmEcode AlertFastLogDecoderEvent(ThreadVars *tv, Packet *p, void *data, PacketQu continue; } - if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { + if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { action = "[Drop] "; - } else if (pa->action == ACTION_DROP) { + } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } diff --git a/src/alert-syslog.c b/src/alert-syslog.c index 78bdfd4010..806070043b 100644 --- a/src/alert-syslog.c +++ b/src/alert-syslog.c @@ -275,9 +275,9 @@ TmEcode AlertSyslogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); - if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { + if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { action = "[Drop] "; - } else if (pa->action == ACTION_DROP) { + } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } @@ -336,9 +336,9 @@ TmEcode AlertSyslogIPv6(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); - if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { + if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { action = "[Drop] "; - } else if (pa->action == ACTION_DROP) { + } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } @@ -399,9 +399,9 @@ TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, Packet *p, void *data, continue; } - if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { + if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) { action = "[Drop] "; - } else if (pa->action == ACTION_DROP) { + } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } diff --git a/src/detect-engine-sigorder.c b/src/detect-engine-sigorder.c index cf2484783f..a44c3e2cc9 100644 --- a/src/detect-engine-sigorder.c +++ b/src/detect-engine-sigorder.c @@ -1862,7 +1862,7 @@ static int SCSigTestSignatureOrdering08(void) prevsig->next = sig; prevsig = sig; - sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:6; rev:4; priority:1;)"); + sig = SigInit(de_ctx, "reject tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:6; rev:4; priority:1;)"); if (sig == NULL) { goto end; } diff --git a/src/detect-parse.c b/src/detect-parse.c index 38a04dac66..11dfa7b16a 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -912,22 +912,22 @@ int SigParseAction(Signature *s, const char *action) { } else if (strcasecmp(action, "reject") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; - s->action = ACTION_REJECT; + s->action = ACTION_REJECT|ACTION_DROP; return 0; } else if (strcasecmp(action, "rejectsrc") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; - s->action = ACTION_REJECT; + s->action = ACTION_REJECT|ACTION_DROP; return 0; } else if (strcasecmp(action, "rejectdst") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; - s->action = ACTION_REJECT_DST; + s->action = ACTION_REJECT_DST|ACTION_DROP; return 0; } else if (strcasecmp(action, "rejectboth") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; - s->action = ACTION_REJECT_BOTH; + s->action = ACTION_REJECT_BOTH|ACTION_DROP; return 0; } else { SCLogError(SC_ERR_INVALID_ACTION,"An invalid action \"%s\" was given",action); diff --git a/src/detect.c b/src/detect.c index 648bfe5336..daa1f92ed5 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1523,7 +1523,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh pmatch = 1; /* Tell the engine that this reassembled stream can drop the * rest of the pkts with no further inspection */ - if (s->action == ACTION_DROP) + if (s->action & ACTION_DROP) alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW; /* store ptr to current smsg */ @@ -1630,7 +1630,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh } /* match */ - if (s->action == ACTION_DROP) + if (s->action & ACTION_DROP) alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW; alert_flags |= PACKET_ALERT_FLAG_STATE_MATCH;