eve/drop: don't log drops unless packet is dropped

In pass/drop combinations where the pass rule took precendence over
the drop, a "drop" false positive could still be logged due to the
storing of the drop record in the packet drop alert store.

Bug: #5867.

diff --git a/src/output-json-drop.c b/src/output-json-drop.c
index 39d283d3aadd8ef9fa5382350d8a75fb402f9f66..962358ab6186589d963af346f1150cb7a95e961d 100644 (file)
--- a/src/output-json-drop.c
+++ b/src/output-json-drop.c
@@ -349,6 +349,10 @@ static int JsonDropLogCondition(ThreadVars *tv, void *data, const Packet *p)
         return FALSE;
     }
 
+    if (!(PacketCheckAction(p, ACTION_DROP))) {
+        return FALSE;
+    }
+
     if (g_droplog_flows_start && p->flow != NULL) {
         int ret = FALSE;
 
@@ -365,11 +369,9 @@ static int JsonDropLogCondition(ThreadVars *tv, void *data, const Packet *p)
             ret = TRUE;
 
         return ret;
-    } else if (PacketCheckAction(p, ACTION_DROP)) {
-        return TRUE;
     }
 
-    return FALSE;
+    return TRUE;
 }
 
 void JsonDropLogRegister (void)