mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ensure that we only add a state type on pass, and that we only add flags to a TCP reject rule if they were not added previously. Fixes #3050

Browse Source
This commit is contained in:
jim-p 2013-06-18 10:51:25 -04:00
parent d17c7b79f1
commit 5015ec4cd0
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/inc/filter.inc
View File

@ -2293,7 +2293,8 @@ function filter_generate_user_rule($rule) {
} else {
$aline['flags'] = "flags S/SA ";
}
}
if (($rule['protocol'] == "tcp") && ($type == "pass")) {
/*
* # keep state
* works with TCP, UDP, and ICMP.
@ -2369,7 +2370,7 @@ function filter_generate_user_rule($rule) {
$aline['flags'] .= " ) ";
}
}
if($type == "reject" && $rule['protocol'] == "tcp") {
if($type == "reject" && $rule['protocol'] == "tcp" && (strpos($aline['flags'], 'flags') === false)) {
/* special reject packet */
$aline['flags'] .= "flags S/SA ";
}