From 57b16c964eb67e2d6f13b58da67141e522ee9aba Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Tue, 26 May 2026 23:06:49 +0200
Subject: [PATCH] detect/firewall: drop in fw mode does not include alert

In TD mode the drop action also includes alert.

In firewall mode it should not to stay in line with accept.

Ticket: #8601.
---
 src/detect-parse.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 94e5fdd391..05e7cc0b5c 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1587,6 +1587,12 @@ static int SigParseActionDo(const char *action_in, const int idx, const bool fw_
         return -1;
 
     if (fw_rule) {
+        /* in firewall mode, drop is just drop. Whereas in IDS/IPS mode, drop is drop+alert.
+         * Same for reject which includes ACTION_DROP. */
+        if (flags & ACTION_DROP) {
+            flags &= ~ACTION_ALERT;
+        }
+
         if (idx == 0 &&
                 !(flags & (ACTION_ACCEPT | ACTION_DROP | ACTION_REJECT_ANY | ACTION_CONFIG))) {
             SCLogError("only accept, config, drop and reject actions allowed as primary action "