From 893ccda1e120dbb92e6c4ea60dc1a1015bef2086 Mon Sep 17 00:00:00 2001
From: Juliana Fajardini <jufajardini@oisf.net>
Date: Wed, 7 Oct 2026 16:29:52 -0300
Subject: [PATCH] firewall: do not support config action in TD rules

In firewall mode.
Second part: rule action.

Ticket: #9041
---
 src/detect-parse.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/detect-parse.c b/src/detect-parse.c
index d79642ffd0..045f660f04 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1022,6 +1022,12 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
                 optname);
         goto error;
     }
+
+    if (EngineModeIsFirewall() && !s->init_data->firewall_rule && s->action & ACTION_CONFIG) {
+        SCLogError(
+                "action \'config\' is not supported in threat detection rules with firewall mode");
+        goto error;
+    }
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */