From 8c94f108bc24b3e3aa2d8843d9f813a072e43ac7 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Tue, 26 May 2026 23:06:49 +0200
Subject: [PATCH] detect/firewall: drop in fw mode does not include alert

In TD mode the drop action also includes alert.

In firewall mode it should not to stay in line with accept.

Ticket: #8601.
(cherry picked from commit 57b16c964eb67e2d6f13b58da67141e522ee9aba)
---
 src/detect-parse.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 9fe3e1a0e9..66a221e2d5 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1586,6 +1586,12 @@ static int SigParseActionDo(const char *action_in, const int idx, const bool fw_
         return -1;
 
     if (fw_rule) {
+        /* in firewall mode, drop is just drop. Whereas in IDS/IPS mode, drop is drop+alert.
+         * Same for reject which includes ACTION_DROP. */
+        if (flags & ACTION_DROP) {
+            flags &= ~ACTION_ALERT;
+        }
+
         if (idx == 0 &&
                 !(flags & (ACTION_ACCEPT | ACTION_DROP | ACTION_REJECT_ANY | ACTION_CONFIG))) {
             SCLogError("only accept, config, drop and reject actions allowed as primary action "