Squid - firewall rules sanitization and fixes

[doktornotor]

Transparent proxy:

• Use rdr pass to pass traffic.
• Fix the rules so that they no longer pass traffic to 80/443 (plus 3128/3129) to everywhere except the transparent proxy interface(s), which was impossible to override by user rules due to the quick option being used.
• Fix faulty logic where no rules were generated for transparent proxy when 'Allow Users on Interface' was not checked. Split and move these checks to proper places to skip either the NAT rules or the filter rules as needed.

Non-transparent proxy:

• Pass the traffic to the configured proxy interface and ports only.
• Fix the rules so that the required traffic is passed to proxy when 'Allow Users on Interface' is checked

Others:

• Fixes/updates for PPPoE handling.
• Add lots of comments here to avoid future confusion.

XMLRPC

• Add configurable username for XMLRPC sync for 2.4. Defaults to "admin" if blank, no problems with 2.3.x

For a quick idea, here's a comparison of rules generated by the old and new code, with a really simple setup:

• LAN = igb0_vlan10 being a non-transparent interface
• WLAN = igb0_vlan88 being set up as transparent interface with SSL/MITM
  proxy ports default 3128/3129
• RFC1918 excluded from proxying

Old rules

no rdr on igb0_vlan88 inet proto tcp from any to 192.168.0.0/16 port = http
no rdr on igb0_vlan88 inet proto tcp from any to 192.168.0.0/16 port = https
no rdr on igb0_vlan88 inet proto tcp from any to 172.16.0.0/12 port = http
no rdr on igb0_vlan88 inet proto tcp from any to 172.16.0.0/12 port = https
no rdr on igb0_vlan88 inet proto tcp from any to 10.0.0.0/8 port = http
no rdr on igb0_vlan88 inet proto tcp from any to 10.0.0.0/8 port = https

rdr on igb0_vlan88 inet proto tcp from any to ! (igb0_vlan88) port = http -> 127.0.0.1 port 3128
rdr on igb0_vlan88 inet proto tcp from any to ! (igb0_vlan88) port = https -> 127.0.0.1 port 3129

pass in quick on igb0_vlan88 proto tcp from any to ! (igb0_vlan88) port = http flags S/SA keep state
pass in quick on igb0_vlan88 proto tcp from any to ! (igb0_vlan88) port = https flags S/SA keep state
pass in quick on igb0_vlan88 proto tcp from any to ! (igb0_vlan88) port = 3128 flags S/SA keep state
pass in quick on igb0_vlan88 proto tcp from any to ! (igb0_vlan88) port = 3129 flags S/SA keep state

New rules

no rdr on igb0_vlan88 inet proto tcp from any to 192.168.0.0/16 port = http
no rdr on igb0_vlan88 inet proto tcp from any to 192.168.0.0/16 port = https
no rdr on igb0_vlan88 inet proto tcp from any to 172.16.0.0/12 port = http
no rdr on igb0_vlan88 inet proto tcp from any to 172.16.0.0/12 port = https
no rdr on igb0_vlan88 inet proto tcp from any to 10.0.0.0/8 port = http
no rdr on igb0_vlan88 inet proto tcp from any to 10.0.0.0/8 port = https

rdr pass on igb0_vlan88 inet proto tcp from any to ! (igb0_vlan88) port = http -> 127.0.0.1 port 3128
rdr pass on igb0_vlan88 inet proto tcp from any to ! (igb0_vlan88) port = https -> 127.0.0.1 port 3129

pass in quick on igb0_vlan10 proto tcp from any to (igb0_vlan10) port = 3128 flags S/SA keep state
pass in quick on igb0_vlan88 proto tcp from any to (igb0_vlan88) port = 3128 flags S/SA keep state
pass in quick on lo0 proto tcp from any to (lo0) port = 3128 flags S/SA keep state
pass in quick on igb0_vlan10 proto tcp from any to (igb0_vlan10) port = 3129 flags S/SA keep state
pass in quick on igb0_vlan88 proto tcp from any to (igb0_vlan88) port = 3129 flags S/SA keep state
pass in quick on lo0 proto tcp from any to (lo0) port = 3129 flags S/SA keep state