]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: set ACTION_ALERT for rules that should alert
authorVictor Julien <vjulien@oisf.net>
Fri, 12 Jan 2024 10:14:27 +0000 (11:14 +0100)
committerVictor Julien <victor@inliniac.net>
Tue, 2 Jul 2024 19:25:29 +0000 (21:25 +0200)
commit5bcbbf356961b493af1276554079dacfab67d4b9
tree0aaf14cbd4002dc9634703e85d8051fde4b556c5
parent1f69d6cdedc1cf17ba03016f6458568dc3f52791
detect: set ACTION_ALERT for rules that should alert

Replaces default "alert" logic and removed SIG_FLAG_NOALERT.

Instead, "noalert" unsets ACTION_ALERT. Same for flowbits:noalert and
friends.

In signature ordering rules w/o action are sorted as if they have 'alert',
which is the same behavior as before, but now implemented explicitly.

Ticket: #5466.
(cherry picked from commit 92581dbc0669464e2e3ed2b84c8e0695418879c3)
src/detect-engine-alert.c
src/detect-engine-analyzer.c
src/detect-flowbits.c
src/detect-hostbits.c
src/detect-noalert.c
src/detect-parse.c
src/detect-xbits.c
src/detect.h
src/packet.c
src/util-action.c
src/util-threshold-config.c