Suricata

I guess there are really two parts here. Currently we don't support pass rules, we parse them, set ACTION_PASS for them but don't actually implement the action.

grep "ACTION_PASS" * r
action-globals.h:#define ACTION_PASS 0x20
detect-parse.c: s>action = ACTION_PASS;

The second part is that we should support a user defined rule evaluation order. From the snort manual....

"config order: <order> Changes the order that rules are evaluated, eg: pass alert log activation."

"The current rule application order is:
>activation>dynamic->pass->drop->sdrop->reject->alert->log
This will ensure that a drop rule has precedence over an alert or log rule."