detect: implement 'alert' keyword as a companion to 'noalert'

This can be used to implement alert then pass logic.

Add support for alert-then-pass to alert handling routines.

Ticket: #5466.

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 750ed6a8be4f20fd706fd441c98337cc1bff4d68..01452ecf89ae7fa32867f33006b6f37f9e82d2df 100644 (file)
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -417,12 +417,18 @@ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx
             p->alerts.alerts[p->alerts.cnt] = *pa;
             SCLogDebug("Appending sid %" PRIu32 " alert to Packet::alerts at pos %u", s->id, i);
 
-            /* pass "alert" found, we're done */
-            if (pa->action & ACTION_PASS) {
+            /* pass w/o alert found, we're done. Alert is not logged. */
+            if ((pa->action & (ACTION_PASS | ACTION_ALERT)) == ACTION_PASS) {
                 SCLogDebug("sid:%u: is a pass rule, so break out of loop", s->id);
                 break;
             }
             p->alerts.cnt++;
+
+            /* pass with alert, we're done. Alert is logged. */
+            if (pa->action & ACTION_PASS) {
+                SCLogDebug("sid:%u: is a pass rule, so break out of loop", s->id);
+                break;
+            }
         } else {
             p->alerts.discarded++;
         }

diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h
index 87fcce20e96b7c90beb84cd3fb2bab0ccf6800d9..58908c05d756a811750a77d2819b4bd8186ac02c 100644 (file)
--- a/src/detect-engine-register.h
+++ b/src/detect-engine-register.h
@@ -87,6 +87,7 @@ enum DetectKeywordId {
     DETECT_FLOWINT,
     DETECT_PKTVAR,
     DETECT_NOALERT,
+    DETECT_ALERT,
     DETECT_FLOWBITS,
     DETECT_HOSTBITS,
     DETECT_IPV4_CSUM,

diff --git a/src/detect-noalert.c b/src/detect-noalert.c
index c0d90eca2fe39717662f2cb6160f91755c643d88..4cb522cf029765bfd015b89905c60c2911b80315 100644 (file)
--- a/src/detect-noalert.c
+++ b/src/detect-noalert.c
@@ -20,7 +20,7 @@
  *
  * \author Victor Julien <victor@inliniac.net>
  *
- * Implements the noalert keyword
+ * Implements the noalert and alert keywords.
  */
 
 #include "suricata-common.h"
@@ -38,6 +38,14 @@ static int DetectNoalertSetup(DetectEngineCtx *de_ctx, Signature *s, const char
     return 0;
 }
 
+static int DetectAlertSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
+{
+    DEBUG_VALIDATE_BUG_ON(nullstr != NULL);
+
+    s->action |= ACTION_ALERT;
+    return 0;
+}
+
 void DetectNoalertRegister(void)
 {
     sigmatch_table[DETECT_NOALERT].name = "noalert";
@@ -45,4 +53,10 @@ void DetectNoalertRegister(void)
     sigmatch_table[DETECT_NOALERT].url = "/rules/flow-keywords.html";
     sigmatch_table[DETECT_NOALERT].Setup = DetectNoalertSetup;
     sigmatch_table[DETECT_NOALERT].flags |= SIGMATCH_NOOPT;
+
+    sigmatch_table[DETECT_ALERT].name = "alert";
+    sigmatch_table[DETECT_ALERT].desc = "alert will be generated by the rule";
+    sigmatch_table[DETECT_ALERT].url = "/rules/flow-keywords.html";
+    sigmatch_table[DETECT_ALERT].Setup = DetectAlertSetup;
+    sigmatch_table[DETECT_ALERT].flags |= SIGMATCH_NOOPT;
 }