From 5015ec4cd0c497ca1db68e7393d2898ba57efb0b Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 18 Jun 2013 10:51:25 -0400
Subject: Ensure that we only add a state type on pass, and that we only add
 flags to a TCP reject rule if they were not added previously. Fixes #3050

---
 etc/inc/filter.inc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 7635cc8..6d7bd9e 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -2293,7 +2293,8 @@ function filter_generate_user_rule($rule) {
 		} else {
 			$aline['flags'] = "flags S/SA ";
 		}
-
+	}
+	if (($rule['protocol'] == "tcp") && ($type == "pass")) {
 		/*
 		 *	# keep state
 		 *		works with TCP, UDP, and ICMP.
@@ -2369,7 +2370,7 @@ function filter_generate_user_rule($rule) {
 					$aline['flags'] .= " ) ";
 				}
 	}
-	if($type == "reject" && $rule['protocol'] == "tcp") {
+	if($type == "reject" && $rule['protocol'] == "tcp" && (strpos($aline['flags'], 'flags') === false)) {
 		/* special reject packet */
 		$aline['flags'] .= "flags S/SA ";
 	}
-- 
cgit v1.1