From 7b0fd8158b5517ea8a490a757a189d11ec109557 Mon Sep 17 00:00:00 2001
From: Lukas Sismis <lsismis@oisf.net>
Date: Thu, 27 Aug 2026 16:32:13 +0200
Subject: [PATCH] fw: allow pass as a secondary action only for accept

Previously, hook sequences in both rules and default policies
allowed `pass` to be combined with incompatible hooks (e.g.
reject or drop).

This commit clamps pass to accept only.

Ticket: 8955
(cherry picked from commit d6521adf4e145ab065d80663bd8ab1e319c10aec)
---
 src/detect-parse.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/detect-parse.c b/src/detect-parse.c
index b68b9a92c5..e55e8403de 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1651,6 +1651,10 @@ static int SigParseActionDo(const char *action_in, const int idx, const bool fw_
                        "rules");
             return -1;
         }
+        if (idx > 0 && (flags & ACTION_PASS) && !(*action_out & ACTION_ACCEPT)) {
+            SCLogError("'pass' is only supported as a secondary action for 'accept'");
+            return -1;
+        }
     }
 
     /* parse scope, if any */