+ open (PORTS,"$acl_ports_ssl");
+ my @ssl_ports = <PORTS>;
+ close PORTS;
+
+ if (@ssl_ports) {
+ foreach (@ssl_ports) {
+ print FILE "acl SSL_ports port $_";
+ }
+ }
+
+ open (PORTS,"$acl_ports_safe");
+ my @safe_ports = <PORTS>;
+ close PORTS;
+
+ if (@safe_ports) {
+ foreach (@safe_ports) {
+ print FILE "acl Safe_ports port $_";
+ }
+ }
+
+ print FILE <<END
+
+acl IPFire_http port $http_port
+acl IPFire_https port $https_port
+acl IPFire_ips dst $netsettings{'GREEN_ADDRESS'}
+acl IPFire_networks src "$acl_src_subnets"
+acl IPFire_servers dst "$acl_src_subnets"
+acl IPFire_green_network src $green_cidr
+acl IPFire_green_servers dst $green_cidr
+END
+ ;
+ if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_network src $blue_cidr\n"; }
+ if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_servers dst $blue_cidr\n"; }
+ if (!-z $acl_src_banned_ip) { print FILE "acl IPFire_banned_ips src \"$acl_src_banned_ip\"\n"; }
+ if (!-z $acl_src_banned_mac) { print FILE "acl IPFire_banned_mac arp \"$acl_src_banned_mac\"\n"; }
+ if (!-z $acl_src_unrestricted_ip) { print FILE "acl IPFire_unrestricted_ips src \"$acl_src_unrestricted_ip\"\n"; }
+ if (!-z $acl_src_unrestricted_mac) { print FILE "acl IPFire_unrestricted_mac arp \"$acl_src_unrestricted_mac\"\n"; }
+ print FILE <<END
+acl CONNECT method CONNECT
+END
+ ;
+
+ if ($proxysettings{'CACHE_SIZE'} > 0) {
+ print FILE <<END
+maximum_object_size $proxysettings{'MAX_SIZE'} KB
+minimum_object_size $proxysettings{'MIN_SIZE'} KB
+
+cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256
+END
+ ;
+ } else {
+ if ($proxysettings{'CACHE_MEM'} > 0) {
+ # always 2% of CACHE_MEM defined as max object size
+ print FILE "maximum_object_size_in_memory " . int($proxysettings{'CACHE_MEM'} * 1024 * 0.02) . " KB\n\n";
+ } else {
+ print FILE "cache deny all\n\n";
+ }
+ }
+
+ print FILE <<END
+request_body_max_size $proxysettings{'MAX_OUTGOING_SIZE'} KB
+END
+ ;
+
+ if ($proxysettings{'MAX_INCOMING_SIZE'} > 0) {
+ if (!-z $acl_src_unrestricted_ip) { print FILE "reply_body_max_size none IPFire_unrestricted_ips\n"; }
+ if (!-z $acl_src_unrestricted_mac) { print FILE "reply_body_max_size none IPFire_unrestricted_mac\n"; }
+ if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
+ {
+ if (!-z $extgrp) { print FILE "reply_body_max_size none for_extended_users\n"; }
+ }
+ }
+
+ if ( $proxysettings{'MAX_INCOMING_SIZE'} != '0' )