From 17e2e7f89286e040a280fc5b78e67c05c1197c87 Mon Sep 17 00:00:00 2001
From: Lukas Sismis <lsismis@oisf.net>
Date: Fri, 28 Aug 2026 11:56:47 +0200
Subject: [PATCH] fw: disallow config to be used as a default policy

Ticket: 8954
---
 src/detect-parse.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 74502ba6f2..6a7c9d7684 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -4213,6 +4213,11 @@ static int DoParsePolicy(const char *policy_name, struct DetectFirewallPolicy *p
             return -1;
         idx++;
     }
+
+    if (action & ACTION_CONFIG) {
+        SCLogError("%s: 'config' is not a valid default policy action", policy_name);
+        return -1;
+    }
     pol->action = action;
     pol->action_scope = action_scope;
     return 1;