firewall: fix possible expansion of "*" when rules with "option src *" are processed