From 0b9c3c198771800cc6c5fbacfc0272549626bcfd Mon Sep 17 00:00:00 2001 From: xchaos Date: Thu, 24 Jan 2013 01:06:21 +0000 Subject: [PATCH] preliminary ipv6 support - not tested git-svn-id: https://dev.arachne.cz/repos/prometheus/trunk@211 251d49ef-1d17-4917-a970-b30cf55b089b --- Makefile | 2 +- htmlandlogs.c | 14 +- ipstruct.h | 1 + ipv4subnets.c | 9 +- ipv6subnets.c | 98 ++++++++++++++ parsehosts.c | 5 +- prometheus.c | 365 ++++++++++++++++++++++++++++++++------------------ 7 files changed, 351 insertions(+), 143 deletions(-) create mode 100644 ipv6subnets.c diff --git a/Makefile b/Makefile index 6564397..0ca93d5 100644 --- a/Makefile +++ b/Makefile @@ -5,7 +5,7 @@ prefix=/usr mandir=$(prefix)/share/man sbindir=$(prefix)/sbin sysconfdir=/etc -OBJECTS=parsehosts.o parseiptables.o parselogs.o ipv4subnets.o json.o htmlandlogs.o help.o prometheus.o +OBJECTS=parsehosts.o parseiptables.o parselogs.o ipv4subnets.o ipv6subnets.o json.o htmlandlogs.o help.o prometheus.o HEADERS=cll1-0.6.2.h ipstruct.h main: prometheus diff --git a/htmlandlogs.c b/htmlandlogs.c index 8bcfe71..e11af1a 100644 --- a/htmlandlogs.c +++ b/htmlandlogs.c @@ -191,14 +191,14 @@ void write_htmlandlogs(char *html, char *d, int total, int just_preview) { fprintf(f,"",i); popup_button=0; - for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,':')) /* IPv4 only */ + for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !sharedip->v6) /* IPv4 only */ { fprintf(f,"
%s\n", log_url, sharedip->name, sharedip->name); popup_button++; } - for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,'.')) /* IPv6 only */ + for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && sharedip->v6) /* IPv6 only */ { - fprintf(f,"
%s\n", log_url, sharedip->name, sharedip->addr); + fprintf(f,"
%s/64\n", log_url, sharedip->addr, sharedip->addr); popup_button++; } fputs("\n",f); @@ -234,11 +234,11 @@ void write_htmlandlogs(char *html, char *d, int total, int just_preview) if(use_jquery_popups) { fprintf(f,"",i); - for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,':')) /* IPv4 only */ + for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !sharedip->v6) /* IPv4 only */ { fprintf(f,"
%Lu", sharedip->direct); } - for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,'.')) /* IPv6 only */ + for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && sharedip->v6) /* IPv6 only */ { fprintf(f,"
%Lu", sharedip->direct); } @@ -256,11 +256,11 @@ void write_htmlandlogs(char *html, char *d, int total, int just_preview) if(use_jquery_popups) { fprintf(f,"",i); - for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,':')) /* IPv4 only */ + for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && !sharedip->v6) /* IPv4 only */ { fprintf(f,"
%Lu", sharedip->upload); } - for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,'.')) /* IPv6 only */ + for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && sharedip->v6) /* IPv6 only */ { fprintf(f,"
%Lu", sharedip->upload); } diff --git a/ipstruct.h b/ipstruct.h index dab37fc..ea79749 100644 --- a/ipstruct.h +++ b/ipstruct.h @@ -20,6 +20,7 @@ struct IP unsigned long pktsup; unsigned long pktsdown; struct Keyword *keyword; + int v6; list(IP); }; diff --git a/ipv4subnets.c b/ipv4subnets.c index 0b40229..e606cb7 100644 --- a/ipv4subnets.c +++ b/ipv4subnets.c @@ -1,10 +1,9 @@ #include "cll1-0.6.2.h" -/* ====== iptables indexes are used to reduce complexity to log8(N) ===== */ +/* ====== iptables indexes are used to reduce complexity to log(N) ===== */ char *very_ugly_ipv4_code(char *inip, int bitmask, int format_as_chainname) { - /* warning: this function was debugged only for bitmask values 20,24,28 !!!*/ int dot=0, n; char *ip,*outip,*outptr,*fmt; @@ -13,7 +12,7 @@ char *very_ugly_ipv4_code(char *inip, int bitmask, int format_as_chainname) if(ip && *ip && bitmask>=0 && bitmask<=32) { - string(outip,strlen(ip)+10); /*fuck unicode? assertion: 10>strlen("_%d_%d") */ + string(outip,strlen(ip)+10); /* assertion: 10>strlen("_%d_%d") */ } else { @@ -90,12 +89,12 @@ char *very_ugly_ipv4_code(char *inip, int bitmask, int format_as_chainname) return outip; } -char *index_id(char *ip,int bitmask) +char *index_id(char *ip, int bitmask) { return very_ugly_ipv4_code(ip,bitmask,1); } -char *subnet_id(char *ip,int bitmask) +char *subnet_id(char *ip, int bitmask) { return very_ugly_ipv4_code(ip,bitmask,0); } diff --git a/ipv6subnets.c b/ipv6subnets.c new file mode 100644 index 0000000..ce8f709 --- /dev/null +++ b/ipv6subnets.c @@ -0,0 +1,98 @@ +#include "cll1-0.6.2.h" + +/* ====== iptables indexes are used to reduce complexity to log(N) ===== */ + +char *very_ugly_ipv6_code(char *inip, int bitmask, int format_as_chainname) +{ + int colon=0, n, h; + char *ip,*outip,*outptr,*fmt; + + duplicate(inip,ip); + /* debug printf("(%s,%d) -> ",ip,bitmask); */ + + if(ip && *ip && bitmask>=0 && bitmask<=64) + { + string(outip,strlen(ip)+10); /* assertion: 10>strlen("_%d_%d") */ + } + else + { + /* should never exit here */ + return "undefined"; + } + outptr=outip; + while(ip && *ip) + { + if(*ip==':') + { + if(colon<(bitmask/16-1)) + { + if(format_as_chainname) + { + *outptr='_'; + } + else + { + *outptr=':'; + } + outptr++; + colon++; + } + else + { + char *cutcolon=strchr(ip+1,':'); + if(cutcolon) + { + *cutcolon = '\0'; + } + + if(format_as_chainname) + { + fmt = "_%x_%d"; + } + else + { + fmt = ":%x"; + } + + if(bitmask%16) + { + sscanf(ip+1, "%x", &h); +/* printf("[debug - %s scanned hexa as %x]\n",ip+1,h);*/ + n = h-h%(1<<(16-bitmask%16)); + } + else + { + n = 0; + } + +/* printf("%d/%d => [_%d_%d]\n",h,bitmask,n,bitmask); */ + sprintf(outptr,fmt,n,bitmask); + if(!format_as_chainname) + { + strcat(outip,"::"); /* ahem :-) */ + } + /* debug printf("[%s]\n",outip); */ + return outip; + } + } + else + { + *outptr=*ip; + outptr++; + } + ip++; + } + /*should never exit here*/ + *outptr='\0'; + return outip; +} + +char *index6_id(char *ip,int bitmask) +{ + return very_ugly_ipv6_code(ip,bitmask,1); +} + +char *subnet6_id(char *ip,int bitmask) +{ + return very_ugly_ipv6_code(ip,bitmask,0); +} diff --git a/parsehosts.c b/parsehosts.c index 528f376..d37a716 100644 --- a/parsehosts.c +++ b/parsehosts.c @@ -39,6 +39,7 @@ void TheIP(char *ipaddr) ip->pktsup = \ ip->pktsdown = 0; ip->keyword = keywords; + ip->v6 = (strchr(ip->addr,':')!=NULL); push(ip,ips); } @@ -96,13 +97,13 @@ void parse_ip(char *str) if(ip6range) { concatenate(ip6prefix,ip6range,ptr); - concatenate(ptr,"/64",ip6range); + ip6range=ptr; if_exists(ip, ips, eq(ip->addr,ip6range)); else { TheIP(ip6range); } - ip->name = ptr; + ip->name = ip6range; ip->sharing = ipname; if(lmsid) { diff --git a/prometheus.c b/prometheus.c index 70bea1f..62ebbc8 100644 --- a/prometheus.c +++ b/prometheus.c @@ -1,13 +1,12 @@ /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */ -/* Prometheus QoS - you can "steal fire" from your ISP */ -/* "fair-per-IP" quality of service (QoS) utility */ +/* Prometheus QoS - you can "steal fire" from your ISP *//* "fair-per-IP" quality of service (QoS) utility */ /* requires Linux 2.4.x or 2.6.x with HTB support */ /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace */ /* iptables-restore support Copyright(C) 2007-2008 ludva */ /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf */ /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */ -/* Modified by: xChaos, 20130116 +/* Modified by: xChaos, 20130124 ludva, 20080415 Prometheus QoS is free software; you can redistribute it and/or @@ -29,7 +28,7 @@ #include "cll1-0.6.2.h" #include "ipstruct.h" -const char *version = "0.8.3-h"; +const char *version = "0.8.3-i"; /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */ /* Versions: 0.8.3 is development release, 0.8.4 will be "stable" */ @@ -79,11 +78,13 @@ int row_odd_even = 0; /* */ /* === Configuraration file values defaults - stored in global variables ==== */ int filter_type = 1; /*1 mark, 2 classify*/ +char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */ char *mark = "MARK"; char *mark_iptables = "MARK --set-mark "; int dry_run = FALSE; /* preview - use puts() instead of system() */ char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]"; FILE *iptables_file = NULL; +FILE *ip6tables_file = NULL; int enable_credit = TRUE; /* enable credit file */ int use_credit = FALSE; /* use credit file (if enabled)*/ char *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */ @@ -102,8 +103,8 @@ char *proxy_ip = "192.168.1.1/32"; /* our IP with proxy port */ int proxy_port = 3128; /* proxy port number */ long long int line = 1024; /* WAN/ISP download in kbps */ long long int up = 1024; /* WAN/ISP upload in kbps */ -int free_min = 32; /* minimum guaranted bandwidth for all undefined hosts */ -int free_max = 64; /* maximum allowed bandwidth for all undefined hosts */ +int free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */ +int free_max = 512; /* maximum allowed bandwidth for all undefined hosts */ int qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */ int digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */ int max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */ @@ -174,6 +175,7 @@ struct Index struct Index *parent; int bitmask; int children; + int ipv6; list(Index); } *idxs=NULL, *idx, *metaindex; @@ -186,6 +188,12 @@ char *index_id(char *ip, int bitmask); char *subnet_id(char *ip, int bitmask); /* function implemented in ipv4subnets.c */ +char *index6_id(char *ip, int bitmask); +/* function implemented in ipv6subnets.c */ + +char *subnet6_id(char *ip, int bitmask); +/* function implemented in ipv6subnets.c */ + /* ================= Let's parse configuration file here ================ */ void reject_config_and_exit(char *filename) @@ -373,12 +381,19 @@ void safe_run(char *cmd) } } -void save_line(char *line) +void iptables_save_line(char *line, int ipv6) { - fprintf(iptables_file,"%s\n",line); + if(ipv6) + { + fprintf(ip6tables_file,"%s\n",line); + } + else + { + fprintf(iptables_file,"%s\n",line); + } } -void run_restore(void) +void run_iptables_restore(void) { char *restor; string(restor,STRLEN); @@ -386,8 +401,8 @@ void run_restore(void) /*-----------------------------------------------------------------*/ printf("Running %s <%s ...\n", iptablesrestore, iptablesfile); /*-----------------------------------------------------------------*/ - - save_line("COMMIT"); + + iptables_save_line("COMMIT", FALSE); fclose(iptables_file); if(dry_run) { @@ -400,7 +415,25 @@ void run_restore(void) sprintf(restor,"%s <%s",iptablesrestore, iptablesfile); safe_run(restor); - + + if(ip6prefix) + { + /*-----------------------------------------------------------------*/ + printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile); + /*-----------------------------------------------------------------*/ + iptables_save_line("COMMIT", TRUE); + fclose(ip6tables_file); + if(dry_run) + { + parse(ip6tablesfile) + { + printf("%s\n",_); + } + done; /* ugly macro end */ + } + sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile); + safe_run(restor); + } free(restor); } @@ -446,7 +479,7 @@ program printf("\n\ Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\ -Version %s - Copyright (C)2005-2012 Michael Polak, Arachne Labs\n\ +Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\ iptables-restore & burst tunning & classify modification by Ludva\n\ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); @@ -505,6 +538,13 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); puts("Parsing iptables verbose output ..."); /*-----------------------------------------------------------------*/ get_traffic_statistics(iptables); + if(ip6prefix) + { + /*-----------------------------------------------------------------*/ + puts("Parsing ip6tables verbose output ..."); + /*-----------------------------------------------------------------*/ + get_traffic_statistics(ip6tables); + } } /*-----------------------------------------------------------------*/ @@ -568,6 +608,20 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); perror(iptablesfile); exit(-1); } + iptables_save_line(iptablespreamble, FALSE); + + if(ip6prefix) + { + ip6tables_file = fopen(ip6tablesfile, "w"); + if(ip6tables_file == NULL) + { + perror(ip6tablesfile); + exit(-1); + } + iptables_save_line(iptablespreamble, TRUE); + } + + run_iptables_restore(); log_file = fopen(cmdlog, "w"); if(log_file == NULL) @@ -576,8 +630,6 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); exit(-1); } - save_line(iptablespreamble); - run_restore(); sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan); safe_run(str); @@ -586,24 +638,29 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); safe_run(str); iptables_file=fopen(iptablesfile,"w"); - save_line(iptablespreamble); + iptables_save_line(iptablespreamble, FALSE); + if(ip6prefix) + { + ip6tables_file=fopen(ip6tablesfile,"w"); + iptables_save_line(iptablespreamble, TRUE); + } - if(qos_free_zone && *qos_free_zone!='0') + if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */ { char *chain; sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan); - save_line(str); + iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */ if(qos_proxy) { - save_line(":post_noproxy - [0:0]"); + iptables_save_line(":post_noproxy - [0:0]", FALSE); sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan); - save_line(str); + iptables_save_line(str , FALSE); sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan); - save_line(str); + iptables_save_line(str, FALSE); sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan); - save_line(str); + iptables_save_line(str, FALSE); chain="post_noproxy"; } @@ -613,23 +670,36 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); } sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan); - save_line(str); + iptables_save_line(str, FALSE); } if(ip_count > idxtable_treshold1 && !just_flush) { - int idxcount=0, bitmask=32-idxtable_bitmask1; /* default net mask: 255.255.255.240 */ + int idxcount=0, bitmask=32-idxtable_bitmask1; char *subnet, *buf; /*-----------------------------------------------------------------*/ printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count); /*-----------------------------------------------------------------*/ - save_line(":post_common - [0:0]"); - save_line(":forw_common - [0:0]"); + iptables_save_line(":post_common - [0:0]", FALSE); + iptables_save_line(":forw_common - [0:0]", FALSE); + if(ip6prefix) + { + iptables_save_line(":post_common - [0:0]", TRUE); + iptables_save_line(":forw_common - [0:0]", TRUE); + } - for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0") && !strchr(ip->addr,':')) /* only IPv4 */ + for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0")) { - buf=index_id(ip->addr,bitmask); + if(ip->v6) + { + buf=index6_id(ip->addr,bitmask+32); + } + else + { + buf=index_id(ip->addr, bitmask); + } + if_exists(idx,idxs,eq(idx->id,buf)) { idx->children++; @@ -637,11 +707,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); else { create(idx,Index); - idx->addr=ip->addr; - idx->id=buf; - idx->bitmask=bitmask; - idx->parent=NULL; - idx->children=0; + idx->addr = ip->addr; + idx->id = buf; + idx->bitmask = bitmask+32*ip->v6; + idx->parent = NULL; + idx->children = 0; + idx->ipv6 = ip->v6; idxcount++; push(idx,idxs); } @@ -655,7 +726,14 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); for_each(idx,idxs) if(idx->parent == NULL) { - buf = index_id(idx->addr,bitmask); + if(idx->ipv6) + { + buf = index6_id(idx->addr, bitmask+32); + } + else + { + buf = index_id(idx->addr, bitmask); + } if_exists(metaindex,idxs,eq(metaindex->id,buf)) { metaindex->children++; @@ -663,11 +741,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); else { create(metaindex,Index); - metaindex->addr=idx->addr; - metaindex->id=buf; - metaindex->bitmask=bitmask; - metaindex->parent=NULL; - metaindex->children=0; + metaindex->addr = idx->addr; + metaindex->id = buf; + metaindex->bitmask = bitmask+32*idx->ipv6; + metaindex->parent = NULL; + metaindex->children = 0; + metaindex->ipv6 = idx->ipv6; idxcount++; push(metaindex,idxs); } @@ -682,20 +761,26 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); i=0; for_each(idx,idxs) { - subnet=subnet_id(idx->addr,idx->bitmask); - printf("%d: %s/%d\n", - ++i, subnet, idx->bitmask); + if(idx->ipv6) + { + subnet=subnet6_id(idx->addr, idx->bitmask); + } + else + { + subnet=subnet_id(idx->addr, idx->bitmask); + } + printf("%d: %s/%d\n", ++i, subnet, idx->bitmask); sprintf(str,":post_%s - [0:0]", idx->id); - save_line(str); + iptables_save_line(str, idx->ipv6); sprintf(str,":forw_%s - [0:0]", idx->id); - save_line(str); + iptables_save_line(str, idx->ipv6); if(idx->parent) { string(buf,strlen(idx->parent->id)+6); - sprintf(buf,"post_%s",idx->parent->id); + sprintf(buf,"post_%s", idx->parent->id); } else { @@ -703,10 +788,10 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); } sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id); - save_line(str); + iptables_save_line(str, idx->ipv6); sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan); - save_line(str); + iptables_save_line(str, idx->ipv6); if(idx->parent) { @@ -719,20 +804,28 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); } sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id); - save_line(str); + iptables_save_line(str, idx->ipv6); sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan); - save_line(str); + iptables_save_line(str, idx->ipv6); } printf("Total indexed iptables chains created: %d\n", i); sprintf(str,"-A FORWARD -o %s -j forw_common", wan); - save_line(str); + iptables_save_line(str, FALSE); sprintf(str,"-A POSTROUTING -o %s -j post_common", lan); - save_line(str); + iptables_save_line(str, FALSE); + + if(ip6prefix) + { + sprintf(str,"-A FORWARD -o %s -j forw_common", wan); + iptables_save_line(str, TRUE); + + sprintf(str,"-A POSTROUTING -o %s -j post_common", lan); + iptables_save_line(str, TRUE); + } } - } if(just_flush) @@ -930,12 +1023,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); printf("Writing json traffic overview %s ... ", json_traffic); /*-----------------------------------------------------------------*/ write_json_traffic(json_traffic); - } - /*-----------------------------------------------------------------*/ - printf("Writing statistics into HTML page %s ...\n", html); - /*-----------------------------------------------------------------*/ - write_htmlandlogs(html, d,total, just_preview); + /*-----------------------------------------------------------------*/ + printf("Writing statistics into HTML page %s ...\n", html); + /*-----------------------------------------------------------------*/ + write_htmlandlogs(html, d, total, just_preview); + } if(just_preview) { @@ -964,13 +1057,20 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); puts("Generating iptables and tc classes ... "); /*-----------------------------------------------------------------*/ - for_each(ip, ips) if(ip->mark > 0 && !strchr(ip->addr,':')) /* works only for IPv4 so far */ + for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */ { if(idxs) { char *buf; duplicate(ip->addr,buf); - buf=index_id(ip->addr,32-idxtable_bitmask1); + if(ip->v6) + { + buf=index6_id(ip->addr,64-idxtable_bitmask1); + } + else + { + buf=index_id(ip->addr,32-idxtable_bitmask1); + } string(chain_forward,6+strlen(buf)); strcpy(chain_forward,"forw_"); @@ -994,33 +1094,30 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); /* -------------------------------------------------------- mark download */ - sprintf(str, "-A %s -d %s/32 -o %s -j %s%d", - chain_postrouting, ip->addr, lan, mark_iptables, ip->mark); - /*sprintf(str,"-A %s -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,ip->addr,lan,ip->mark);*/ + sprintf(str, "-A %s -d %s/%d -o %s -j %s%d", + chain_postrouting, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark); /* -m limit --limit 1/s */ - save_line(str); + iptables_save_line(str, ip->v6); if(qos_proxy) { - sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j %s%d", - chain_postrouting, proxy_ip, proxy_port, ip->addr, lan, mark_iptables, ip->mark); - /*sprintf(str,"-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,proxy_ip,proxy_port,ip->addr,lan,ip->mark);*/ - save_line(str); + sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d", + chain_postrouting, proxy_ip, proxy_port, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark); + iptables_save_line(str, ip->v6); } - sprintf(str, "-A %s -d %s/32 -o %s -j ACCEPT", - chain_postrouting, ip->addr, lan); - save_line(str); + sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT", + chain_postrouting, ip->addr, 32*(1+ip->v6), lan); + iptables_save_line(str, ip->v6); /* -------------------------------------------------------- mark upload */ - sprintf(str, "-A %s -s %s/32 -o %s -j %s%d", - chain_forward, ip->addr, wan, mark_iptables, ip->mark); - /* sprintf(str,"-A %s -s %s/32 -o %s -j MARK --set-mark %d",chain_forward,ip->addr,wan,ip->mark);*/ - save_line(str); + sprintf(str, "-A %s -s %s/%d -o %s -j %s%d", + chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark); + iptables_save_line(str, ip->v6); - sprintf(str, "-A %s -s %s/32 -o %s -j ACCEPT", - chain_forward, ip->addr, wan); - save_line(str); + sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT", + chain_forward, ip->addr, 32*(1+ip->v6), wan); + iptables_save_line(str, ip->v6); if(ip->min) { @@ -1035,16 +1132,16 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); if(strcmpi(ip->keyword->leaf_discipline, "none")) { - sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", - tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/ - safe_run(str); + sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", + tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/ + safe_run(str); } if(filter_type == 1) { - sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", - tc, lan, ip->mark, ip->mark); - safe_run(str); + sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", + tc, lan, ip->mark, ip->mark); + safe_run(str); } /* -------------------------------------------------------- upload class */ @@ -1061,21 +1158,21 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); if(strcmpi(ip->keyword->leaf_discipline, "none")) { - sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", - tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/ - safe_run(str); + sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", + tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/ + safe_run(str); } if(filter_type == 1) { - sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", - tc, wan, ip->mark, ip->mark); - safe_run(str); + sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", + tc, wan, ip->mark, ip->mark); + safe_run(str); } if(f > 0) { - fprintf(f, "%s %d\n", ip->addr, ip->mark); + fprintf(f, "%s %d\n", ip->addr, ip->mark); } } else @@ -1094,48 +1191,60 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); if(idxs) { - chain_forward = "forw_common"; - chain_postrouting = "post_common"; + chain_forward = "forw_common"; + chain_postrouting = "post_common"; } else { - chain_forward = "FORWARD"; - chain_postrouting = "POSTROUTING"; + chain_forward = "FORWARD"; + chain_postrouting = "POSTROUTING"; } - /* -------------------------------- classify or reject free download */ + + if(free_min) { - char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */ - if(free_min) - { - final_chain = "ACCEPT"; - } - if(qos_proxy) - { - if(free_min) - { - sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s%d", - chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables,3); - save_line(str); - } - sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s", - chain_postrouting,proxy_ip,proxy_port,lan,final_chain); - save_line(str); - } - if(free_min) - { - sprintf(str,"-A %s -o %s -j %s%d", chain_postrouting, lan, mark_iptables, 3); - save_line(str); - } - sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain); - save_line(str); - /* ------------------------------- classify or reject free upload */ - if(free_min) - { - sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3); - save_line(str); - } - sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain); - save_line(str); + final_chain = "ACCEPT"; + } + + if(qos_proxy) + { + if(free_min) + { + sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d", + chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3); + iptables_save_line(str, FALSE); /* only for IPv4 */ + } + sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s", + chain_postrouting,proxy_ip,proxy_port,lan,final_chain); + iptables_save_line(str, FALSE); /* only for IPv4 */ + } + + if(free_min) + { + sprintf(str, "-A %s -o %s -j %s%d", + chain_postrouting, lan, mark_iptables, 3); + iptables_save_line(str, FALSE); /* only for IPv4 */ + } + + sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain); + iptables_save_line(str, FALSE); + if(ip6prefix) + { + sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain); + iptables_save_line(str, TRUE); + } + + if(free_min) + { + sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3); + iptables_save_line(str, FALSE); /* only for IPv4 */ + } + + sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain); + iptables_save_line(str, FALSE); + if(ip6prefix) + { + sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain); + iptables_save_line(str, TRUE); } if(free_min) /* allocate free bandwith if it is not zero... */ @@ -1166,7 +1275,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version); safe_run(str); } printf("Total IP count: %d\n", i); - run_restore(); + run_iptables_restore(); if(log_file) { fclose(log_file); -- 2.30.2