From 6370f599d48ca871e6a030cdce2bf998f75989e7 Mon Sep 17 00:00:00 2001
From: Lukas Sismis <lsismis@oisf.net>
Date: Fri, 28 Aug 2026 11:56:47 +0200
Subject: [PATCH] fw: disallow config to be used as a default policy

Ticket: 8955
(cherry picked from commit 17e2e7f89286e040a280fc5b78e67c05c1197c87)
---
 src/detect-parse.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/detect-parse.c b/src/detect-parse.c
index e55e8403de..52ac401bb1 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -3954,6 +3954,11 @@ static int DoParsePolicy(const char *policy_name, struct DetectFirewallPolicy *p
             return -1;
         idx++;
     }
+
+    if (action & ACTION_CONFIG) {
+        SCLogError("%s: 'config' is not a valid default policy action", policy_name);
+        return -1;
+    }
     pol->action = action;
     pol->action_scope = action_scope;
     return 1;