eve/drop: always enable verdict in firewall mode

victorjulien · victorjulien · commit f9b25dc6ec39 · 2026-04-16T05:58:16.000Z
diff --git a/src/output-json-drop.c b/src/output-json-drop.c
@@ -296,8 +296,12 @@ static OutputInitResult JsonDropLogInitCtxSub(SCConfNode *conf, OutputCtx *paren
                              "'flow' are 'start' and 'all'");
             }
         }
+
         extended = SCConfNodeLookupChildValue(conf, "verdict");
-        if (extended != NULL) {
+
+        if (EngineModeIsFirewall()) {
+            drop_ctx->flags |= LOG_DROP_VERDICT;
+        } else if (extended != NULL) {
             if (SCConfValIsTrue(extended)) {
                 drop_ctx->flags |= LOG_DROP_VERDICT;
             }

Original file line number	Diff line number	Diff line change
`@@ -296,8 +296,12 @@ static OutputInitResult JsonDropLogInitCtxSub(SCConfNode conf, OutputCtx paren`
`296`	`296`	`"'flow' are 'start' and 'all'");`
`297`	`297`	`}`
`298`	`298`	`}`
	`299`	`+`
`299`	`300`	`extended = SCConfNodeLookupChildValue(conf, "verdict");`
`300`		`- if (extended != NULL) {`
	`301`	`+`
	`302`	`+ if (EngineModeIsFirewall()) {`
	`303`	`+ drop_ctx->flags \|= LOG_DROP_VERDICT;`
	`304`	`+ } else if (extended != NULL) {`
`301`	`305`	`if (SCConfValIsTrue(extended)) {`
`302`	`306`	`drop_ctx->flags \|= LOG_DROP_VERDICT;`
`303`	`307`	`}`