From 6fe3a3dfc3f9fbb8ab955ff931865809d8a88400 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Wed, 26 Aug 2026 19:19:39 +0200 Subject: [PATCH] firewall: apply flow scope to the default packet policy drop The packet default policy runtime only applied the action scope for `accept`. For `drop:flow` and `reject:flow` it dropped the packet and left the flow untouched, so the flow scope had no effect. Ticket: 8969 --- src/detect.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/detect.c b/src/detect.c index 71ef9a2db5..4e5e41d5f4 100644 --- a/src/detect.c +++ b/src/detect.c @@ -710,6 +710,10 @@ static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx, SCLogDebug("packet %" PRIu64 ": drop PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY", PcapPacketCntGet(p)); PacketDrop(p, pol->action, PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY); + if (p->flow && pol->action_scope == ACTION_SCOPE_FLOW) { + FlowSetDropAction(p->flow, FLOW_ACTION_BY_FIREWALL); + SCLogDebug("packet %" PRIu64 ": drop scope flow", PcapPacketCntGet(p)); + } } else if (pol->action & ACTION_ACCEPT) { SCLogDebug("packet %" PRIu64 ": accept", PcapPacketCntGet(p)); if (pol->action_scope == ACTION_SCOPE_PACKET) {