From b0e6413cd3c53ceb9d0561e765977adff5be5f5d Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Wed, 26 Aug 2026 16:11:22 +0200 Subject: [PATCH 1/4] fw: validate scope inheritance in policies and rules A secondary action given without an explicit scope inherits the scope of the primary action, but was never validated against the scopes it supports itself. `pass` only supports packet and flow scope but the inheritance was never verified. Ticket: 8954 --- src/detect-parse.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/detect-parse.c b/src/detect-parse.c index 44d546984c19..a34276eca6ef 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1873,6 +1873,14 @@ static int SigParseActionDo(const char *action_in, const int idx, const bool fw_ return -1; } *scope_out = scope_flags; + } else if (*scope_out != 0 && (flags & ACTION_PASS)) { + /* No scope given, this action inherits the scope set by the preceding + * actions of a multi-action rule. */ + if (*scope_out != ACTION_SCOPE_PACKET && *scope_out != ACTION_SCOPE_FLOW) { + SCLogError("invalid action scope '%s' in action '%s': only 'packet' and 'flow' allowed", + ActionScopeToString((enum ActionScope) * scope_out), action_in); + return -1; + } } /* require explicit action scope for fw rules */ From 4a4b2de8cd36d893bf07142b424e006d28abcb3f Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Thu, 27 Aug 2026 16:32:13 +0200 Subject: [PATCH 2/4] fw: allow pass as a secondary action only for accept Previously, hook sequences in both rules and default policies allowed `pass` to be combined with incompatible hooks (e.g. reject or drop). This commit clamps pass to accept only. Ticket: 8954 --- src/detect-parse.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/detect-parse.c b/src/detect-parse.c index a34276eca6ef..74502ba6f2df 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1822,6 +1822,10 @@ static int SigParseActionDo(const char *action_in, const int idx, const bool fw_ "rules"); return -1; } + if (idx > 0 && (flags & ACTION_PASS) && !(*action_out & ACTION_ACCEPT)) { + SCLogError("'pass' is only supported as a secondary action for 'accept'"); + return -1; + } } /* parse scope, if any */ From 1dbca0d92a55e207d040068825574e2e146d3210 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Fri, 28 Aug 2026 11:56:47 +0200 Subject: [PATCH 3/4] fw: disallow config to be used as a default policy Ticket: 8954 --- src/detect-parse.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/detect-parse.c b/src/detect-parse.c index 74502ba6f2df..6a7c9d768465 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -4213,6 +4213,11 @@ static int DoParsePolicy(const char *policy_name, struct DetectFirewallPolicy *p return -1; idx++; } + + if (action & ACTION_CONFIG) { + SCLogError("%s: 'config' is not a valid default policy action", policy_name); + return -1; + } pol->action = action; pol->action_scope = action_scope; return 1; From 2f8097849911e4e0aa2e171cc0f4b99ac1cdd3c3 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Fri, 28 Aug 2026 12:21:09 +0200 Subject: [PATCH 4/4] fw: document config action in FW mode --- doc/userguide/firewall/firewall-design.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/doc/userguide/firewall/firewall-design.rst b/doc/userguide/firewall/firewall-design.rst index b2eb9d38c721..351cd19f25d5 100644 --- a/doc/userguide/firewall/firewall-design.rst +++ b/doc/userguide/firewall/firewall-design.rst @@ -122,6 +122,14 @@ alert action in firewall rules. The effect will be the creation of an alert event when the firewall rule matches. +config +~~~~~~ + +``config`` is a primary firewall action used to apply the setting of the ``config`` +rule keyword when the rule matches, see :doc:`../rules/config`. +The ``config`` action does not issue a verdict for the packet or the flow, so the +other tables are still evaluated. It is not available as a secondary action. + Multi action rules ~~~~~~~~~~~~~~~~~~