From 96632b2ec3bb88764c5b136af2bef5253d3cb9a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ermal=20Lu=C3=A7i?= Date: Fri, 18 Jan 2008 17:34:55 +0000 Subject: [PATCH] Unbreak filter_rules_generate broked by previous wrong commit which was against HEAD. Second attempt at reorganizing the logic of pfSense rules. --- etc/inc/filter.inc | 941 +++++++++++++++++++++++++-------------------- 1 file changed, 515 insertions(+), 426 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 6b8ada9d32..0181e039d2 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1880,7 +1880,7 @@ function generate_user_filter_rule($rule, $ngcounter) { return "# at the break!"; } - $aline['src'] = "from $src "; + $aline['src'] = " from $src "; if (in_array($rule['protocol'], array("tcp","udp","tcp/udp"))) { @@ -2212,11 +2212,11 @@ function generate_user_filter_rule($rule, $ngcounter) { } function filter_rules_generate() { - global $config, $g; + global $config, $g, $table_cache, $used_pftpx_ports; update_filter_reload_status("Creating default rules"); - if (isset ($config['system']['developerspew'])) { + if(isset($config['system']['developerspew'])) { $mt = microtime(); echo "filter_rules_generate() being called $mt\n"; } @@ -2227,7 +2227,6 @@ function filter_rules_generate() { $pppoecfg = $config['pppoe']; $lanif = $lancfg['if']; - $lan_net = $lanif . ":network"; $wanif = get_real_wan_interface(); $lanip = $lancfg['ipaddr']; @@ -2236,24 +2235,35 @@ function filter_rules_generate() { $wanip = find_interface_ip(get_real_wan_interface()); - if ($lansa) - $lansa_sn_combo = $lan_net; + if($lansa) + $lansa_sn_combo = "{$lansa}/{$lansn}"; else $lansa_sn_combo = "192.168.1.1/32"; /* optional interfaces */ - $optcfg = array (); + $optcfg = array(); generate_optcfg_array($optcfg); - /* XXX: package stuff doesn't belong here, some day, this needs to be fixed */ if (is_package_installed('squid') && file_exists('/usr/local/pkg/squid.inc')) { - require_once ('squid.inc'); + require_once('squid.inc'); $ipfrules .= squid_generate_rules('filter'); } + if (is_package_installed('clamav') && file_exists('/usr/local/pkg/clamav.inc')) { - require_once ('clamav.inc'); + require_once('clamav.inc'); $ipfrules .= clamav_generate_rules('filter'); } + + if (is_package_installed('squid') && file_exists('/usr/local/pkg/squid.inc')) { + require_once('squid.inc'); + $ipfrules .= squid_generate_rules('filter'); + } + + if (is_package_installed('clamav') && file_exists('/usr/local/pkg/clamav.inc')) { + require_once('clamav.inc'); + $ipfrules .= clamav_generate_rules('filter'); + } + if (is_package_installed('frickin') && file_exists('/usr/local/pkg/frickin.inc')) { require_once ('frickin.inc'); $ipfrules .= frickin_generate_rules('filter'); @@ -2263,7 +2273,6 @@ function filter_rules_generate() { $ipfrules .= siproxd_generate_rules('filter'); } - /* if captive portal is enabled, ensure that access to this port * is allowed on a locked down interface */ @@ -2275,11 +2284,17 @@ function filter_rules_generate() { $ipfrules .= "pass in quick on {$cp_interface_real} proto tcp from any to {$cp_interface_ip} port { 8000 8001 } keep state\n"; } + /* ftp-sesame */ + $ipfrules .= "anchor \"ftpsesame/*\" \n"; + + # BEGIN OF firewall rules + $ipfrules .= "anchor \"firewallrules\"\n"; + if ($pptpdcfg['mode'] == "server") { $pptpip = $pptpdcfg['localip']; $pptpsa = $pptpdcfg['remoteip']; $pptpsn = $g['pptp_subnet']; - if ($config['pptp']['pptp_subnet'] <> "") + if($config['pptp']['pptp_subnet'] <> "") $pptpsn = $config['pptp']['pptp_subnet']; } @@ -2287,21 +2302,20 @@ function filter_rules_generate() { $pppoeip = $pppoecfg['localip']; $pppoesa = $pppoecfg['remoteip']; $pppoesn = $g['pppoe_subnet']; - if ($config['pppoe']['pppoe_subnet'] <> "") + if($config['pppoe']['pppoe_subnet'] <> "") $pppoesn = $config['pppoe']['pppoe_subnet']; } /* default block logging? */ - if (!isset ($config['syslog']['nologdefaultblock'])) + if (!isset($config['syslog']['nologdefaultblock'])) $log = "log"; else $log = ""; - $ipfrules .=<< persist block quick from to any label "Block snort2c hosts" block quick from any to label "Block snort2c hosts" + + # loopback anchor "loopback" pass in quick on \$loopback all label "pass loopback" @@ -2326,169 +2342,96 @@ anchor "packageearly" # carp anchor "carp" -# NAT Reflection rules +EOD; + + /* + * Support for allow limiting of TCP connections by establishment rate + * Useful for protecting against sudden outburts, etc. + */ + $ipfrules .= << +block in quick from to any label "virusprot overload table" + +EODF; + + /* block bogon networks on WAN */ + /* http://www.cymru.com/Documents/bogon-bn-nonagg.txt */ + /* file is automatically in cron every 3000 minutes */ + if (isset($config['interfaces']['wan']['blockbogons'])) { + $ipfrules .= << persist file "/etc/bogons" +block in $log quick on \$wan from to any label "block bogon networks from wan" + +EOD; + } + + /* install wan spoof check rule if lan address exists */ + if($lansa) { + if(!isset($config['interfaces']['wan']['spoofmac'])) { + $ipfrules .= << "LAN" - ); - for ($i = 1; isset ($config['interfaces']['opt' . $i]); $i++) - $iflist['opt' . $i] = "opt{$i}"; - - foreach ($iflist as $ifent => $ifname) { - - /* do not process interfaces with gateways*/ - if ($config['interfaces'][$ifname]['gateway'] <> "") - continue; - - /* do not process interfaces that will end up with gateways */ - if ($config['interfaces'][$ifname]['ipaddr'] == "dhcp" or $config['interfaces'][$ifname]['ipaddr'] == "pppoe" or $config['interfaces'][$ifname]['ipaddr'] == "pptp") - continue; - - $ifname_real = convert_friendly_interface_to_real_interface_name($ifname); - - if ($extport[1]) - $range_end = ($extport[1]); - else - $range_end = ($extport[0]); - - $range_end++; - - if ($rule['local-port']) - $lrange_start = $rule['local-port']; - - if ($range_end - $extport[0] > 500) { - $range_end = $extport[0] + 1; - log_error("Not installing nat reflection rules for a port range > 500"); - } elseif ($starting_localhost_port < 19991) { - /* only install reflection rules for < 19991 items */ - $loc_pt = $lrange_start; - for ($x = $extport[0]; $x < $range_end; $x++) { - - $starting_localhost_port++; - $ifname_friendly = convert_real_interface_to_friendly_interface_name($ifname_real); - switch ($rule['protocol']) { - case "tcp/udp" : - $protocol = "{ tcp udp }"; - $ipfrules .= "pass in quick on \${$ifname_friendly} inet proto tcp from any to \$loopback port {$starting_localhost_port} keep state (no-sync) label \"NAT REFLECT: Allow traffic to localhost\"\n"; - $starting_localhost_port++; - $ipfrules .= "pass in quick on \${$ifname_friendly} inet proto udp from any to \$loopback port {$starting_localhost_port} keep state (no-sync) label \"NAT REFLECT: Allow traffic to localhost\"\n"; - break; - case "tcp" : - case "udp" : - $protocol = $rule['protocol']; - $ipfrules .= "pass in quick on \${$ifname_friendly} inet proto {$rule['protocol']} from any to \$loopback port {$starting_localhost_port} keep state label \"NAT REFLECT: Allow traffic to localhost\"\n"; - break; - default : - break; - } - $loc_pt++; - if ($starting_localhost_port > 19990) { - log_error("Not installing nat reflection rules. Maximum 1,000 reached."); - $x = $range_end +1; - } - } - } - } - - } } } + foreach ($optcfg as $oc) { + if (!$oc['bridge']) + if($oc['sa'] <> "") + if(isset($oc['enable'])) + $ipfrules .= "block in $log quick on \$wan from {$oc['sa']}/{$oc['sn']} to any label \"interface spoof check\"\n"; + } + +if($config['interfaces']['lan']['bridge'] <> "wan" and $config['interfaces']['wan']['bridge'] <> "lan") + $ipfrules .= "block in $log quick on \$wan proto udp from any port = 67 to {$lansa_sn_combo} port = 68 label \"block dhcp client out wan\"\n"; + + $ipfrules .= << $oc) { - $isbridged = false; + $isbridged = false; foreach ($optcfg as $on2 => $oc2) { if ($oc2['bridge'] && $oc2['bridge'] == $on) { $isbridged = true; break; } } - if ($oc['ip'] && !(($oc['bridge'] || $isbridged) && isset ($config['bridge']['filteringbridge']))) + if ($oc['ip'] && !(($oc['bridge'] || $isbridged) && isset($config['bridge']['filteringbridge']))) $ipfrules .= filter_rules_spoofcheck_generate($on, $oc['if'], $oc['sa'], $oc['sn'], $log); } - $ipfrules .= "\nanchor \"spoofing\"\n"; /* block private networks on WAN? */ - if (isset ($config['interfaces']['wan']['blockpriv'])) { + if (isset($config['interfaces']['wan']['blockpriv'])) { if($wanbridge == false) { - $ipfrules .=<< persist file "/etc/bogons" -block in $log quick on \$wan from to any label "block bogon networks from wan" -EOD; - } +if($wanip) + $ipfrules .= << -block in quick from to any label "virusprot overload table" - -EODF; - - /* install wan spoof check rule if lan address exists */ - if ($lansa) { - if (!isset ($config['interfaces']['wan']['spoofmac'])) { - $ipfrules .=<< "" && isset($oc['enable'])) - $ipfrules .= "block in $log quick on \$wan from ({$oc['if']}:network) to any label \"interface spoof check\"\n"; - } - - - $ipfrules .=<< $oc) { - if ($config[interfaces][$on][ipaddr] == "dhcp" ) { - $friendly_on = filter_get_opt_interface_descr($on); - $ipfrules .= << "wan" and $config['interfaces']['wan']['bridge'] <> "lan") - $ipfrules .= "block in $log quick on \$wan proto udp from any port = 67 to {$lansa_sn_combo} port = 68 label \"block dhcp client out wan\"\n"; - - $ipfrules .=<< $oc) { - $friendly_on = convert_friendly_interface_to_friendly_descr($on); - $ipfrules .=<< "any") + $extaddr = $rule['external-address'] . "/32"; + else + $extaddr = $rule['external-address']; + else + $extaddr = get_current_wan_address($rule['interface']); + + if (!$rule['interface'] || ($rule['interface'] == "wan")) + $natif = $wanif; + else if($rule['interface'] == "\$pptp") + $natif = "pptp"; + else if($rule['interface'] == "\$pppoe") + $natif = "pppoe"; + else + $natif = $config['interfaces'][$rule['interface']]['if']; + + $lanif = $lancfg['if']; + + /* + * Expand aliases + * XXX: may want to integrate this into pf macros + */ + if(alias_expand($target)) + $target = alias_expand($target); + if(alias_expand($extaddr)) + $extaddr = alias_expand($extaddr); + + if(!isset($config['system']['disablenatreflection'])) { + + /* if list */ + $iflist = array("lan" => "LAN"); + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) + $iflist['opt' . $i] = "opt{$i}"; + + foreach ($iflist as $ifent => $ifname) { + + /* do not process interfaces with gateways*/ + if($config['interfaces'][$ifname]['gateway'] <> "") + continue; + + /* do not process interfaces that will end up with gateways */ + if($config['interfaces'][$ifname]['ipaddr'] == "dhcp" or + $config['interfaces'][$ifname]['ipaddr'] == "bigpond" or + $config['interfaces'][$ifname]['ipaddr'] == "pppoe" or + $config['interfaces'][$ifname]['ipaddr'] == "pptp") + + continue; + + $ifname_real = convert_friendly_interface_to_real_interface_name($ifname); + + if($extport[1]) + $range_end = ($extport[1]); + else + $range_end = ($extport[0]); + + $range_end++; + + if($rule['local-port']) + $lrange_start = $rule['local-port']; + + if($range_end - $extport[0] > 500) { + $range_end = $extport[0]+1; + log_error("Not installing nat reflection rules for a port range > 500"); + } else { + /* only install reflection rules for < 19991 items */ + if($starting_localhost_port < 19991) { + $loc_pt = $lrange_start; + for($x=$extport[0]; $x<$range_end; $x++) { + + $starting_localhost_port++; + $ifname_real = convert_friendly_interface_to_friendly_descr(strtolower($ifname)); + + switch($rule['protocol']) { + case "tcp/udp": + $protocol = "{ tcp udp }"; + $ipfrules .= "pass in on \${$ifname_real} inet proto tcp from any to \$loopback port {$starting_localhost_port} keep state label \"NAT REFLECT: Allow traffic to localhost\"\n"; + $starting_localhost_port++; + $ipfrules .= "pass in on \${$ifname_real} inet proto udp from any to \$loopback port {$starting_localhost_port} keep state label \"NAT REFLECT: Allow traffic to localhost\"\n"; + break; + case "tcp": + case "udp": + $protocol = $rule['protocol']; + $ipfrules .= "pass in on \${$ifname_real} inet proto {$rule['protocol']} from any to \$loopback port {$starting_localhost_port} keep state label \"NAT REFLECT: Allow traffic to localhost\"\n"; + break; + default: + break; + } + $loc_pt++; + if($starting_localhost_port > 19990) { + log_error("Not installing nat reflection rules. Maximum 1,000 reached."); + $x = $range_end+1; + } + } + } + } + } + + } + } + } + + if ($wancfg['ipaddr'] == "dhcp") + $ipfrules .= "anchor \"wandhcp\""; + + $ipfrules .= << $oc) { + if ($config[interfaces][$on][ipaddr] == "dhcp" ) { + $friendly_on = filter_get_opt_interface_descr($on); + $ipfrules .= << "") + $nif = $config['pptp']['n_pptp_units']; + /* + * now that PPTP server are user rules, detect + * that user is setting the pptp server rule + * and setup for all netgraph interfaces + */ + $rule_arr[] = generate_user_filter_rule_arr($rule, 0); + } else if($rule['interface'] == "pppoe") { + if(!$config['pppoe']['mode'] == "server") + continue; + $n_pppoe_units = $g['n_pppoe_units']; + if($config['pppoe']['n_pppoe_units'] <> "") + $nif = $config['pppoe']['n_pppoe_units']; + /* + * now that pppoe server are user rules, detect + * that user is setting the pppoe server rule + * and setup for all netgraph interfaces + */ + $rule_arr[] = generate_user_filter_rule_arr($rule, 0); + } else { + $rule_arr[] = generate_user_filter_rule_arr($rule, 0); + } + } + } + + $ipfrules .= "\n# User-defined aliases follow\n"; + /* tables for aliases */ + foreach($table_cache as $table) { + $ipfrules .= $table; + } + + $ipfrules .= "\n# User-defined rules follow\n"; + /* Generate user rule lines */ + foreach($rule_arr as $rule) { + $line = ""; + if (!isset($rule['disabled'])) { + $line = $rule['rule']; + if($line <> "") { + /* label */ + $line .= " {$rule['descr']}"; + } + } + $line .= "\n"; + $ipfrules .= $line; + } } update_filter_reload_status("Creating carp rules..."); @@ -2784,13 +2880,13 @@ EOD; $lan_subnet = $config['interfaces']['lan']['subnet']; $wanif = get_real_wan_interface(); $wan_ip = find_interface_ip($wanif); - if ($wan_ip) { + if($wan_ip) { $internal_subnet = gen_subnet($lan_ip, $lan_subnet) . "/" . $config['interfaces']['lan']['subnet']; /* Is IP Compression enabled? */ - if (isset ($config['ipsec']['ipcomp'])) - mwexec("/sbin/sysctl net.inet.ipcomp.ipcomp_enable=1"); + if(isset($config['ipsec']['ipcomp'])) + exec("/sbin/sysctl net.inet.ipcomp.ipcomp_enable=1"); else - mwexec("/sbin/sysctl net.inet.ipcomp.ipcomp_enable=0"); + exec("/sbin/sysctl net.inet.ipcomp.ipcomp_enable=0"); /* build an interface collection */ $ifdescrs = array ("wan"); @@ -2799,41 +2895,43 @@ EOD; $ifdescrs['opt' . $j] = filter_get_opt_interface_descr("opt" . $j); } - if (is_array($config['ipsec']['tunnel']) && isset ($config['ipsec']['enable'])) { + if(is_array($config['ipsec']['tunnel']) && isset($config['ipsec']['enable'])) { foreach ($config['ipsec']['tunnel'] as $tunnel) { - /* if tunnel is disabled, lets skip to next item */ - if (isset ($tunnel['disabled'])) + if(isset($tunnel['disabled'])) continue; - update_filter_reload_status("Creating IPSEC tunnel items {$tunnel['descr']}..."); - $ipsec_ip = get_current_wan_address($tunnel['interface']); + update_filter_reload_status("Creating IPsec tunnel items {$tunnel['descr']}..."); + /* if tunnel is disabled, lets skip to next item */ + $ipsec_ips = array(get_current_wan_address($tunnel['interface'])); /* is this a dynamic dns hostname? */ $remote_gateway = gethostbyname($tunnel['remote-gateway']); - if ($remote_gateway == "") + if($remote_gateway == "") $remote_gateway = $tunnel['remote-gateway']; /* do not add items with blank remote_gateway */ - if (!$remote_gateway) { - $ipfrules .= "# ERROR! Remote gateway not found on ... pass on {$wanif} proto udp from {$ipsec_ip} to {$remote_gateway} port = 500 keep state label \"IPSEC: {$tunnel['descr']} udp\"\n"; + if(!$remote_gateway) { + $ipfrules .= "# ERROR! Remote gateway not found on {$tunnel['remote-gateway']}\n"; continue; } $local_subnet = return_vpn_subnet($tunnel['local-subnet']); foreach($ifdescrs as $iface) { - if ($iface == "wan") - $interface_ip = find_interface_ip(get_real_wan_interface()); - else - $interface_ip = find_interface_ip(convert_friendly_interface_to_real_interface_name($iface)); - if(!$interface_ip) - continue; - if(!$remote_gateway) - continue; - $ipfrules .= "pass out on \${$iface} proto udp from any to {$remote_gateway} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - outbound isakmp\"\n"; - $ipfrules .= "pass in on \${$iface} proto udp from {$remote_gateway} to any port = 500 keep state label \"IPSEC: {$tunnel['descr']} - inbound isakmp\"\n"; - if ($tunnel['p2']['protocol'] == 'esp') { - $ipfrules .= "pass out on \${$iface} proto esp from any to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound esp proto\"\n"; - $ipfrules .= "pass in on \${$iface} proto esp from {$remote_gateway} to any keep state label \"IPSEC: {$tunnel['descr']} - inbound esp proto\"\n"; - } - if ($tunnel['p2']['protocol'] == 'ah') { - $ipfrules .= "pass out quick on \${$iface} proto ah from any to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound ah proto\"\n"; - $ipfrules .= "pass in on \${$iface} proto ah from {$remote_gateway} to any keep state label \"IPSEC: {$tunnel['descr']} - inbound ah proto\"\n"; + foreach($ipsec_ips as $interface_ip) { + if($iface == "wan") + $interface_ip = find_interface_ip(get_real_wan_interface()); + else + $interface_ip = find_interface_ip(convert_friendly_interface_to_real_interface_name($iface)); + if(!$interface_ip) + continue; + if(!$remote_gateway) + continue; + $ipfrules .= "pass out on \${$iface} proto udp from any to {$remote_gateway} port = 500 keep state label \"IPsec: {$tunnel['descr']} - outbound isakmp\"\n"; + $ipfrules .= "pass in on \${$iface} proto udp from {$remote_gateway} to any port = 500 keep state label \"IPsec: {$tunnel['descr']} - inbound isakmp\"\n"; + if ($tunnel['p2']['protocol'] == 'esp') { + $ipfrules .= "pass out on \${$iface} proto esp from any to {$remote_gateway} keep state label \"IPsec: {$tunnel['descr']} - outbound esp proto\"\n"; + $ipfrules .= "pass in on \${$iface} proto esp from {$remote_gateway} to any keep state label \"IPsec: {$tunnel['descr']} - inbound esp proto\"\n"; + } + if ($tunnel['p2']['protocol'] == 'ah') { + $ipfrules .= "pass out on \${$iface} proto ah from any to {$remote_gateway} keep state label \"IPsec: {$tunnel['descr']} - outbound ah proto\"\n"; + $ipfrules .= "pass in on \${$iface} proto ah from {$remote_gateway} to any keep state label \"IPsec: {$tunnel['descr']} - inbound ah proto\"\n"; + } } } } @@ -2843,70 +2941,61 @@ EOD; * loose rules to allow mobile clients to phone in. */ $ipseccfg = $config['ipsec']; - if (isset ($ipseccfg['mobileclients']['enable'])) { + if (isset($ipseccfg['mobileclients']['enable'])) { foreach($ifdescrs as $iface) { - $ipfrules .= "pass in on \${$iface} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n"; - $ipfrules .= "pass in on \${$iface} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n"; - $ipfrules .= "pass in on \${$iface} proto ah from any to any keep state label \"IPSEC: Mobile - inbound ah proto\"\n"; + $ipfrules .= "pass in on \${$iface} proto udp from any to any port = 500 keep state label \"IPsec: Mobile - inbound isakmp\"\n"; + $ipfrules .= "pass in on \${$iface} proto esp from any to any keep state label \"IPsec: Mobile - inbound esp proto\"\n"; + $ipfrules .= "pass in on \${$iface} proto ah from any to any keep state label \"IPsec: Mobile - inbound ah proto\"\n"; } } } + $ipfrules .= << 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection" +pass in on $lanif inet proto tcp from any to \$loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost" +pass in on $lanif inet proto tcp from any to \$loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost" +pass in on $wanif inet proto tcp from port 20 to ($wanif) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection" EOD; - if (isset ($config['system']['rfc959workaround'])) { + if(!isset($config['system']['disableftpproxy'])) { - $ipfrules .=<< "") { + $ipfrules .= "pass in on " . $oc['if'] . " inet proto tcp from any to \$loopback port {$ftp_counter} keep state label \"FTP PROXY: Allow traffic to localhost\"\n"; + $ipfrules .= "pass in on " . $oc['if'] . " inet proto tcp from any to \$loopback port 21 keep state label \"FTP PROXY: Allow traffic to localhost\"\n"; + } + $ftp_counter++; + } + + if(isset($config['system']['rfc959workaround'])) { + $ipfrules .= << 49000 user proxy flags S/SA keep state label "FTP PROXY: RFC959 violation workaround" +pass in on $wanif inet proto tcp from any to ($wanif) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: RFC959 violation workaround" -EOD; +EODEOD; - $optcfg = array (); + $optcfg = array(); generate_optcfg_array($optcfg); - foreach ($optcfg as $oc) { - if ($oc['gateway'] <> "") { - $interface = filter_get_opt_interface_descr($oc['if']); - $ipfrules .= "pass in on\${$interface} inet proto tcp from any to ({$oc['if']}) port > 49000 user proxy flags S/SA keep state label \"FTP PROXY: RFC959 violation workaround\" \n"; - } + foreach($optcfg as $oc) { + if($oc['gateway'] <> "") + $ipfrules .= "pass in on {$oc['if']} inet proto tcp from any to ({$oc['if']}) port > 49000 user proxy flags S/SA keep state label \"FTP PROXY: RFC959 violation workaround\" \n"; } } } - $ipfrules .=<<