preliminary ipv6 support - not tested

git-svn-id: https://dev.arachne.cz/repos/prometheus/trunk@211 251d49ef-1d17-4917-a970-b30cf55b089b

diff --git a/Makefile b/Makefile
index 656439783269e742167ef0957d6f426daa55099d..0ca93d5cd3b21ef3d869194d64526361bc48d543 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,7 @@ prefix=/usr
 mandir=$(prefix)/share/man
 sbindir=$(prefix)/sbin
 sysconfdir=/etc
-OBJECTS=parsehosts.o parseiptables.o parselogs.o ipv4subnets.o json.o htmlandlogs.o help.o prometheus.o
+OBJECTS=parsehosts.o parseiptables.o parselogs.o ipv4subnets.o ipv6subnets.o json.o htmlandlogs.o help.o prometheus.o
 HEADERS=cll1-0.6.2.h ipstruct.h
 
 main: prometheus

diff --git a/htmlandlogs.c b/htmlandlogs.c
index 8bcfe71f2e36832e0633eae6ac79e895ab543a02..e11af1abac500b99e2b38d3489a4769a57e1455e 100644 (file)
--- a/htmlandlogs.c
+++ b/htmlandlogs.c
@@ -191,14 +191,14 @@ void write_htmlandlogs(char *html, char *d, int total, int just_preview)
    {\r
      fprintf(f,"<span id=\"sharing_%d\" style=\"display:none\">",i);\r
      popup_button=0;\r
-     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,':')) /* IPv4 only */\r
+     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !sharedip->v6) /* IPv4 only */\r
      {\r
       fprintf(f,"<br /><a class=\"blue\" target=\"_blank\" href=\"%s%s.log\">%s</a>\n", log_url, sharedip->name, sharedip->name);\r
       popup_button++;\r
      }\r
-     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,'.')) /* IPv6 only */\r
+     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && sharedip->v6) /* IPv6 only */\r
      {\r
-      fprintf(f,"<br /><a class=\"blue\" target=\"_blank\" href=\"%s%s.log\">%s</a>\n", log_url, sharedip->name, sharedip->addr);\r
+      fprintf(f,"<br /><a class=\"blue\" target=\"_blank\" href=\"%s%s.log\">%s/64</a>\n", log_url, sharedip->addr, sharedip->addr);\r
       popup_button++;\r
      }\r
      fputs("</span>\n",f);\r
@@ -234,11 +234,11 @@ void write_htmlandlogs(char *html, char *d, int total, int just_preview)
    if(use_jquery_popups)\r
    {\r
      fprintf(f,"<span id=\"download_%d\" style=\"display:none\">",i);\r
-     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,':')) /* IPv4 only */\r
+     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !sharedip->v6) /* IPv4 only */\r
      {\r
       fprintf(f,"<br />%Lu", sharedip->direct);\r
      }\r
-     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,'.')) /* IPv6 only */\r
+     for_each(sharedip, ips) if(eq(ip->name, sharedip->sharing) && sharedip->v6) /* IPv6 only */\r
      {\r
       fprintf(f,"<br />%Lu", sharedip->direct);\r
      }\r
@@ -256,11 +256,11 @@ void write_htmlandlogs(char *html, char *d, int total, int just_preview)
    if(use_jquery_popups)\r
    {\r
      fprintf(f,"<span id=\"upload_%d\" style=\"display:none\">",i);\r
-     for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,':')) /* IPv4 only */\r
+     for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && !sharedip->v6) /* IPv4 only */\r
      {\r
       fprintf(f,"<br />%Lu", sharedip->upload);\r
      }\r
-     for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && !strchr(sharedip->addr,'.')) /* IPv6 only */\r
+     for_each(sharedip,ips) if(eq(ip->name, sharedip->sharing) && sharedip->v6) /* IPv6 only */\r
      {\r
       fprintf(f,"<br />%Lu", sharedip->upload);\r
      }\r

diff --git a/ipstruct.h b/ipstruct.h
index dab37fcbe97f486109ee942559af9b44c62a444c..ea797499a7d2328e0b97cf116a3973c73c1d73a9 100644 (file)
--- a/ipstruct.h
+++ b/ipstruct.h
@@ -20,6 +20,7 @@ struct IP
  unsigned long pktsup;\r
  unsigned long pktsdown;\r
  struct Keyword *keyword;\r
+ int v6;\r
  list(IP);\r
 };\r
 \r

diff --git a/ipv4subnets.c b/ipv4subnets.c
index 0b40229dc73ad26e7bcf1ad9c4f8de3d390139ae..e606cb787cd6dcd80a429548997064d34dd72ce0 100644 (file)
--- a/ipv4subnets.c
+++ b/ipv4subnets.c
@@ -1,10 +1,9 @@
 #include "cll1-0.6.2.h"\r
 \r
-/* ====== iptables indexes are used to reduce complexity to log8(N) ===== */\r
+/* ====== iptables indexes are used to reduce complexity to log(N) ===== */\r
 \r
 char *very_ugly_ipv4_code(char *inip, int bitmask, int format_as_chainname)\r
 {\r
- /* warning: this function was debugged only for bitmask values 20,24,28 !!!*/\r
  int dot=0, n;\r
  char *ip,*outip,*outptr,*fmt;\r
 \r
@@ -13,7 +12,7 @@ char *very_ugly_ipv4_code(char *inip, int bitmask, int format_as_chainname)
 \r
  if(ip && *ip && bitmask>=0 && bitmask<=32)\r
  {\r
-  string(outip,strlen(ip)+10); /*fuck unicode? assertion: 10>strlen("_%d_%d") */\r
+  string(outip,strlen(ip)+10); /* assertion: 10>strlen("_%d_%d") */\r
  }\r
  else \r
  {\r
@@ -90,12 +89,12 @@ char *very_ugly_ipv4_code(char *inip, int bitmask, int format_as_chainname)
  return outip;\r
 }\r
 \r
-char *index_id(char *ip,int bitmask)\r
+char *index_id(char *ip, int bitmask)\r
 { \r
  return very_ugly_ipv4_code(ip,bitmask,1);\r
 }\r
 \r
-char *subnet_id(char *ip,int bitmask)\r
+char *subnet_id(char *ip, int bitmask)\r
 {\r
  return very_ugly_ipv4_code(ip,bitmask,0);\r
 }\r

diff --git a/ipv6subnets.c b/ipv6subnets.c
new file mode 100644 (file)
index 0000000..ce8f709
--- /dev/null
+++ b/ipv6subnets.c
@@ -0,0 +1,98 @@
+#include "cll1-0.6.2.h"
+
+/* ====== iptables indexes are used to reduce complexity to log(N) ===== */
+
+char *very_ugly_ipv6_code(char *inip, int bitmask, int format_as_chainname)
+{
+ int colon=0, n, h;
+ char *ip,*outip,*outptr,*fmt;
+
+ duplicate(inip,ip);
+ /* debug printf("(%s,%d) -> ",ip,bitmask); */
+
+ if(ip && *ip && bitmask>=0 && bitmask<=64)
+ {
+  string(outip,strlen(ip)+10); /* assertion: 10>strlen("_%d_%d") */
+ }
+ else
+ {
+  /* should never exit here */
+  return "undefined";
+ }
+ outptr=outip;
+ while(ip && *ip)
+ {
+  if(*ip==':')
+  {
+   if(colon<(bitmask/16-1))
+   {
+    if(format_as_chainname)
+    {
+     *outptr='_';
+    }
+    else
+    {
+     *outptr=':';
+    }
+    outptr++;
+    colon++;
+   }
+   else
+   {
+    char *cutcolon=strchr(ip+1,':');
+    if(cutcolon)
+    {
+     *cutcolon = '\0';
+    }
+    
+    if(format_as_chainname)
+    {
+     fmt = "_%x_%d";
+    }
+    else
+    {
+     fmt = ":%x";
+    }
+    
+    if(bitmask%16)
+    {
+     sscanf(ip+1, "%x", &h);
+/*    printf("[debug - %s scanned hexa as %x]\n",ip+1,h);*/
+     n = h-h%(1<<(16-bitmask%16));
+    }
+    else
+    {
+     n = 0;
+    }
+
+/*  printf("%d/%d => [_%d_%d]\n",h,bitmask,n,bitmask); */
+    sprintf(outptr,fmt,n,bitmask);
+    if(!format_as_chainname)
+    {
+     strcat(outip,"::");  /* ahem :-) */
+    }
+    /* debug printf("[%s]\n",outip); */
+    return outip;
+   }
+  }
+  else
+  {
+   *outptr=*ip;
+   outptr++;
+  }
+  ip++;
+ }
+ /*should never exit here*/
+ *outptr='\0';
+ return outip;
+}
+
+char *index6_id(char *ip,int bitmask)
+{ 
+ return very_ugly_ipv6_code(ip,bitmask,1);
+}
+
+char *subnet6_id(char *ip,int bitmask)
+{
+ return very_ugly_ipv6_code(ip,bitmask,0);
+}

diff --git a/parsehosts.c b/parsehosts.c
index 528f376ce38fa5333bb6305d3d15c5db47021451..d37a71657236390195709271a7af41ea61dcdee2 100644 (file)
--- a/parsehosts.c
+++ b/parsehosts.c
@@ -39,6 +39,7 @@ void TheIP(char *ipaddr)
  ip->pktsup      = \\r
  ip->pktsdown    = 0;\r
  ip->keyword     = keywords;\r
+ ip->v6          = (strchr(ip->addr,':')!=NULL);\r
  push(ip,ips);\r
 }\r
 \r
@@ -96,13 +97,13 @@ void parse_ip(char *str)
  if(ip6range)\r
  {\r
   concatenate(ip6prefix,ip6range,ptr);\r
-  concatenate(ptr,"/64",ip6range);\r
+  ip6range=ptr;\r
   if_exists(ip, ips, eq(ip->addr,ip6range));\r
   else\r
   {\r
    TheIP(ip6range);\r
   }\r
-  ip->name = ptr;\r
+  ip->name = ip6range;\r
   ip->sharing = ipname;\r
   if(lmsid)\r
   {\r

diff --git a/prometheus.c b/prometheus.c
index 70bea1f2355559c9dca504dde27523d95bc36558..62ebbc8b3e2fa8eb94eeea1684096f9f0905d668 100644 (file)
--- a/prometheus.c
+++ b/prometheus.c
@@ -1,13 +1,12 @@
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
-/* Prometheus QoS - you can "steal fire" from your ISP         */\r
-/* "fair-per-IP" quality of service (QoS) utility              */\r
+/* Prometheus QoS - you can "steal fire" from your ISP         *//* "fair-per-IP" quality of service (QoS) utility              */\r
 /* requires Linux 2.4.x or 2.6.x with HTB support              */\r
 /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace     */\r
 /* iptables-restore support Copyright(C) 2007-2008 ludva       */\r
 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */\r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 \r
-/* Modified by: xChaos, 20130116\r
+/* Modified by: xChaos, 20130124\r
                  ludva, 20080415\r
  \r
    Prometheus QoS is free software; you can redistribute it and/or\r
@@ -29,7 +28,7 @@
 #include "cll1-0.6.2.h"\r
 #include "ipstruct.h"\r
 \r
-const char *version = "0.8.3-h";\r
+const char *version = "0.8.3-i";\r
 \r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */\r
@@ -79,11 +78,13 @@ int      row_odd_even = 0; /*<tr class="odd/even"> */
 /* === Configuraration file values defaults - stored in global variables ==== */\r
 \r
 int        filter_type = 1; /*1 mark, 2 classify*/\r
+char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */\r
 char             *mark = "MARK";\r
 char    *mark_iptables = "MARK --set-mark ";\r
 int            dry_run = FALSE; /* preview - use puts() instead of system() */\r
 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";\r
 FILE    *iptables_file = NULL;\r
+FILE   *ip6tables_file = NULL;\r
 int      enable_credit = TRUE; /* enable credit file */\r
 int         use_credit = FALSE; /* use credit file (if enabled)*/\r
 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */\r
@@ -102,8 +103,8 @@ char         *proxy_ip = "192.168.1.1/32"; /* our IP with proxy port */
 int         proxy_port = 3128; /* proxy port number */\r
 long long int     line = 1024; /* WAN/ISP download in kbps */\r
 long long int       up = 1024; /* WAN/ISP upload in kbps */\r
-int           free_min = 32; /* minimum guaranted bandwidth for all undefined hosts */\r
-int           free_max = 64; /* maximum allowed bandwidth for all undefined hosts */\r
+int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */\r
+int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */\r
 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */\r
 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */ \r
 int        max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */\r
@@ -174,6 +175,7 @@ struct Index
  struct Index *parent;\r
  int bitmask;\r
  int children;\r
+ int ipv6;\r
  list(Index);\r
 } *idxs=NULL, *idx, *metaindex;\r
 \r
@@ -186,6 +188,12 @@ char *index_id(char *ip, int bitmask);
 char *subnet_id(char *ip, int bitmask);\r
 /* function implemented in ipv4subnets.c */\r
 \r
+char *index6_id(char *ip, int bitmask);\r
+/* function implemented in ipv6subnets.c */\r
+\r
+char *subnet6_id(char *ip, int bitmask);\r
+/* function implemented in ipv6subnets.c */\r
+\r
 /* ================= Let's parse configuration file here ================ */\r
 \r
 void reject_config_and_exit(char *filename)\r
@@ -373,12 +381,19 @@ void safe_run(char *cmd)
  }\r
 }\r
 \r
-void save_line(char *line)\r
+void iptables_save_line(char *line, int ipv6)\r
 {\r
- fprintf(iptables_file,"%s\n",line);\r
+ if(ipv6)\r
+ {\r
+  fprintf(ip6tables_file,"%s\n",line);\r
+ }\r
+ else\r
+ {\r
+  fprintf(iptables_file,"%s\n",line);\r
+ }\r
 }\r
 \r
-void run_restore(void)\r
+void run_iptables_restore(void)\r
 {\r
  char *restor;\r
  string(restor,STRLEN);\r
@@ -386,8 +401,8 @@ void run_restore(void)
  /*-----------------------------------------------------------------*/\r
  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);\r
  /*-----------------------------------------------------------------*/\r
- \r
- save_line("COMMIT");\r
+\r
+ iptables_save_line("COMMIT", FALSE);\r
  fclose(iptables_file);\r
  if(dry_run) \r
  {\r
@@ -400,7 +415,25 @@ void run_restore(void)
 \r
  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);\r
  safe_run(restor);\r
- \r
+\r
+ if(ip6prefix)\r
+ {\r
+  /*-----------------------------------------------------------------*/\r
+  printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);\r
+  /*-----------------------------------------------------------------*/\r
+  iptables_save_line("COMMIT", TRUE);\r
+  fclose(ip6tables_file);\r
+  if(dry_run) \r
+  {\r
+   parse(ip6tablesfile)\r
+   {\r
+    printf("%s\n",_);\r
+   }\r
+   done; /* ugly macro end */\r
+  }\r
+  sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);\r
+  safe_run(restor);\r
+ }\r
  free(restor);\r
 }\r
 \r
@@ -446,7 +479,7 @@ program
   \r
  printf("\n\\r
 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\\r
-Version %s - Copyright (C)2005-2012 Michael Polak, Arachne Labs\n\\r
+Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\\r
 iptables-restore & burst tunning & classify modification by Ludva\n\\r
 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);\r
 \r
@@ -505,6 +538,13 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   puts("Parsing iptables verbose output ...");\r
   /*-----------------------------------------------------------------*/\r
   get_traffic_statistics(iptables);\r
+  if(ip6prefix)\r
+  {\r
+   /*-----------------------------------------------------------------*/\r
+   puts("Parsing ip6tables verbose output ...");\r
+   /*-----------------------------------------------------------------*/  \r
+   get_traffic_statistics(ip6tables);\r
+  }\r
  }\r
 \r
  /*-----------------------------------------------------------------*/\r
@@ -568,6 +608,20 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
     perror(iptablesfile);\r
     exit(-1);\r
   }\r
+  iptables_save_line(iptablespreamble, FALSE);\r
+\r
+  if(ip6prefix)\r
+  {\r
+   ip6tables_file = fopen(ip6tablesfile, "w");\r
+   if(ip6tables_file == NULL)\r
+   {\r
+     perror(ip6tablesfile);\r
+     exit(-1);\r
+   }\r
+   iptables_save_line(iptablespreamble, TRUE);\r
+  }\r
+\r
+  run_iptables_restore();\r
   \r
   log_file = fopen(cmdlog, "w");\r
   if(log_file == NULL) \r
@@ -576,8 +630,6 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
     exit(-1);\r
   }\r
   \r
-  save_line(iptablespreamble);\r
-  run_restore();\r
   \r
   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);\r
   safe_run(str);\r
@@ -586,24 +638,29 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   safe_run(str);\r
   \r
   iptables_file=fopen(iptablesfile,"w");\r
-  save_line(iptablespreamble);\r
+  iptables_save_line(iptablespreamble, FALSE);\r
+  if(ip6prefix)\r
+  {\r
+   ip6tables_file=fopen(ip6tablesfile,"w");\r
+   iptables_save_line(iptablespreamble, TRUE);\r
+  }\r
 \r
-  if(qos_free_zone && *qos_free_zone!='0')\r
+  if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */\r
   {\r
    char *chain;\r
    \r
    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);\r
-   save_line(str);\r
+   iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */\r
    \r
    if(qos_proxy)\r
    {\r
-    save_line(":post_noproxy - [0:0]");\r
+    iptables_save_line(":post_noproxy - [0:0]", FALSE);\r
     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);\r
-    save_line(str);   \r
+    iptables_save_line(str , FALSE);\r
     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);\r
-    save_line(str);   \r
+    iptables_save_line(str, FALSE);\r
     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);\r
-    save_line(str);   \r
+    iptables_save_line(str, FALSE);\r
 \r
     chain="post_noproxy";    \r
    }\r
@@ -613,23 +670,36 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    }\r
     \r
    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);\r
-   save_line(str);\r
+   iptables_save_line(str, FALSE);\r
   }\r
   \r
   if(ip_count > idxtable_treshold1 && !just_flush)\r
   {\r
-   int idxcount=0, bitmask=32-idxtable_bitmask1; /* default net mask: 255.255.255.240 */\r
+   int idxcount=0, bitmask=32-idxtable_bitmask1;\r
    char *subnet, *buf;\r
    /*-----------------------------------------------------------------*/\r
    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);\r
    /*-----------------------------------------------------------------*/\r
 \r
-   save_line(":post_common - [0:0]");\r
-   save_line(":forw_common - [0:0]");\r
+   iptables_save_line(":post_common - [0:0]", FALSE);\r
+   iptables_save_line(":forw_common - [0:0]", FALSE);\r
+   if(ip6prefix)\r
+   {\r
+    iptables_save_line(":post_common - [0:0]", TRUE);\r
+    iptables_save_line(":forw_common - [0:0]", TRUE);\r
+   }\r
 \r
-   for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0") && !strchr(ip->addr,':')) /* only IPv4 */\r
+   for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0")) \r
    {\r
-    buf=index_id(ip->addr,bitmask);\r
+    if(ip->v6)\r
+    {\r
+     buf=index6_id(ip->addr,bitmask+32);\r
+    }\r
+    else\r
+    {\r
+     buf=index_id(ip->addr, bitmask);\r
+    }\r
+    \r
     if_exists(idx,idxs,eq(idx->id,buf))\r
     {\r
      idx->children++;\r
@@ -637,11 +707,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
     else\r
     {\r
      create(idx,Index);\r
-     idx->addr=ip->addr;\r
-     idx->id=buf;\r
-     idx->bitmask=bitmask;\r
-     idx->parent=NULL;\r
-     idx->children=0;\r
+     idx->addr = ip->addr;\r
+     idx->id = buf;\r
+     idx->bitmask = bitmask+32*ip->v6;\r
+     idx->parent = NULL;\r
+     idx->children = 0;\r
+     idx->ipv6 = ip->v6;\r
      idxcount++;\r
      push(idx,idxs);\r
     }\r
@@ -655,7 +726,14 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 \r
     for_each(idx,idxs) if(idx->parent == NULL)\r
     {\r
-     buf = index_id(idx->addr,bitmask);\r
+     if(idx->ipv6)\r
+     {\r
+      buf = index6_id(idx->addr, bitmask+32);\r
+     }\r
+     else\r
+     {\r
+      buf = index_id(idx->addr, bitmask);\r
+     }\r
      if_exists(metaindex,idxs,eq(metaindex->id,buf))\r
      {\r
       metaindex->children++;\r
@@ -663,11 +741,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
      else\r
      {\r
       create(metaindex,Index);\r
-      metaindex->addr=idx->addr;\r
-      metaindex->id=buf;\r
-      metaindex->bitmask=bitmask;\r
-      metaindex->parent=NULL;\r
-      metaindex->children=0;\r
+      metaindex->addr = idx->addr;\r
+      metaindex->id = buf;\r
+      metaindex->bitmask = bitmask+32*idx->ipv6;\r
+      metaindex->parent = NULL;\r
+      metaindex->children = 0;\r
+      metaindex->ipv6 = idx->ipv6;\r
       idxcount++;\r
       push(metaindex,idxs);\r
      }\r
@@ -682,20 +761,26 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    i=0;\r
    for_each(idx,idxs)\r
    {\r
-    subnet=subnet_id(idx->addr,idx->bitmask);\r
-    printf("%d: %s/%d\n",\r
-           ++i, subnet, idx->bitmask);\r
+    if(idx->ipv6)\r
+    {\r
+     subnet=subnet6_id(idx->addr, idx->bitmask);\r
+    }\r
+    else\r
+    {\r
+     subnet=subnet_id(idx->addr, idx->bitmask);\r
+    }\r
+    printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);\r
        \r
     sprintf(str,":post_%s - [0:0]", idx->id);\r
-    save_line(str);\r
+    iptables_save_line(str, idx->ipv6);\r
 \r
     sprintf(str,":forw_%s - [0:0]", idx->id);\r
-    save_line(str);\r
+    iptables_save_line(str, idx->ipv6);\r
 \r
     if(idx->parent)\r
     {\r
      string(buf,strlen(idx->parent->id)+6);\r
-     sprintf(buf,"post_%s",idx->parent->id);\r
+     sprintf(buf,"post_%s", idx->parent->id);\r
     }\r
     else\r
     {\r
@@ -703,10 +788,10 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
     }\r
 \r
     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);\r
-    save_line(str);\r
+    iptables_save_line(str, idx->ipv6);\r
 \r
     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);\r
-    save_line(str);\r
+    iptables_save_line(str, idx->ipv6);\r
 \r
     if(idx->parent)\r
     {\r
@@ -719,20 +804,28 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
     }\r
 \r
     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);\r
-    save_line(str);\r
+    iptables_save_line(str, idx->ipv6);\r
 \r
     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);\r
-    save_line(str);\r
+    iptables_save_line(str, idx->ipv6);\r
    }\r
    printf("Total indexed iptables chains created: %d\n", i);\r
 \r
    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);\r
-   save_line(str);\r
+   iptables_save_line(str, FALSE);\r
    \r
    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);\r
-   save_line(str);\r
+   iptables_save_line(str, FALSE);\r
+\r
+   if(ip6prefix)\r
+   {\r
+    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);\r
+    iptables_save_line(str, TRUE);\r
+    \r
+    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);\r
+    iptables_save_line(str, TRUE);\r
+   }\r
   }\r
- \r
  }\r
 \r
  if(just_flush)\r
@@ -930,12 +1023,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   printf("Writing json traffic overview  %s ... ", json_traffic);\r
   /*-----------------------------------------------------------------*/\r
   write_json_traffic(json_traffic);\r
- }\r
 \r
- /*-----------------------------------------------------------------*/\r
- printf("Writing statistics into HTML page %s ...\n", html);\r
- /*-----------------------------------------------------------------*/\r
- write_htmlandlogs(html, d,total, just_preview);\r
+  /*-----------------------------------------------------------------*/\r
+  printf("Writing statistics into HTML page %s ...\n", html);\r
+  /*-----------------------------------------------------------------*/\r
+  write_htmlandlogs(html, d, total, just_preview);\r
+ }\r
 \r
  if(just_preview)\r
  {\r
@@ -964,13 +1057,20 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  puts("Generating iptables and tc classes ... ");\r
  /*-----------------------------------------------------------------*/\r
 \r
- for_each(ip, ips) if(ip->mark > 0 && !strchr(ip->addr,':')) /* works only for IPv4 so far */\r
+ for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */\r
  {\r
   if(idxs)\r
   {\r
    char *buf;\r
    duplicate(ip->addr,buf);\r
-   buf=index_id(ip->addr,32-idxtable_bitmask1); \r
+   if(ip->v6)\r
+   {\r
+    buf=index6_id(ip->addr,64-idxtable_bitmask1);\r
+   }\r
+   else\r
+   {\r
+    buf=index_id(ip->addr,32-idxtable_bitmask1);\r
+   }\r
    \r
    string(chain_forward,6+strlen(buf));\r
    strcpy(chain_forward,"forw_");\r
@@ -994,33 +1094,30 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 \r
   /* -------------------------------------------------------- mark download */\r
   \r
-  sprintf(str, "-A %s -d %s/32 -o %s -j %s%d",\r
-               chain_postrouting, ip->addr, lan, mark_iptables, ip->mark);\r
-  /*sprintf(str,"-A %s -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,ip->addr,lan,ip->mark);*/\r
+  sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r
+               chain_postrouting, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
   /* -m limit --limit 1/s */  \r
-  save_line(str);\r
+  iptables_save_line(str, ip->v6);\r
 \r
   if(qos_proxy)\r
   {\r
-   sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j %s%d",\r
-                chain_postrouting, proxy_ip, proxy_port, ip->addr, lan, mark_iptables, ip->mark);\r
-   /*sprintf(str,"-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,proxy_ip,proxy_port,ip->addr,lan,ip->mark);*/\r
-   save_line(str);\r
+   sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",\r
+                chain_postrouting, proxy_ip, proxy_port, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
+   iptables_save_line(str, ip->v6);\r
   }\r
 \r
-  sprintf(str, "-A %s -d %s/32 -o %s -j ACCEPT",\r
-               chain_postrouting, ip->addr, lan);\r
-  save_line(str);\r
+  sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",\r
+               chain_postrouting, ip->addr, 32*(1+ip->v6), lan);\r
+  iptables_save_line(str, ip->v6);\r
 \r
   /* -------------------------------------------------------- mark upload */\r
-  sprintf(str, "-A %s -s %s/32 -o %s -j %s%d", \r
-               chain_forward, ip->addr, wan, mark_iptables, ip->mark);\r
-  /*  sprintf(str,"-A %s -s %s/32 -o %s -j MARK --set-mark %d",chain_forward,ip->addr,wan,ip->mark);*/\r
-  save_line(str);\r
+  sprintf(str, "-A %s -s %s/%d -o %s -j %s%d", \r
+               chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);\r
+  iptables_save_line(str, ip->v6);\r
 \r
-  sprintf(str, "-A %s -s %s/32 -o %s -j ACCEPT",\r
-               chain_forward, ip->addr, wan);\r
-  save_line(str);\r
+  sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",\r
+               chain_forward, ip->addr, 32*(1+ip->v6), wan);\r
+  iptables_save_line(str, ip->v6);\r
 \r
   if(ip->min)\r
   {\r
@@ -1035,16 +1132,16 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 \r
    if(strcmpi(ip->keyword->leaf_discipline, "none"))\r
    {\r
-     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", \r
-                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
-     safe_run(str);\r
+    sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", \r
+                 tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
+    safe_run(str);\r
    }\r
 \r
    if(filter_type == 1)\r
    {\r
-     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
-                  tc, lan, ip->mark, ip->mark);\r
-     safe_run(str);\r
+    sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
+                 tc, lan, ip->mark, ip->mark);\r
+    safe_run(str);\r
    }\r
 \r
    /* -------------------------------------------------------- upload class */\r
@@ -1061,21 +1158,21 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    \r
    if(strcmpi(ip->keyword->leaf_discipline, "none"))\r
    {\r
-     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",\r
-                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
-     safe_run(str);\r
+    sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",\r
+                 tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
+    safe_run(str);\r
    }   \r
 \r
    if(filter_type == 1)\r
    {\r
-     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
-                  tc, wan, ip->mark, ip->mark);\r
-     safe_run(str);\r
+    sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
+                 tc, wan, ip->mark, ip->mark);\r
+    safe_run(str);\r
    }\r
   \r
    if(f > 0)\r
    {\r
-     fprintf(f, "%s %d\n", ip->addr, ip->mark);\r
+    fprintf(f, "%s %d\n", ip->addr, ip->mark);\r
    }\r
   }\r
   else\r
@@ -1094,48 +1191,60 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  \r
  if(idxs)\r
  {\r
-   chain_forward = "forw_common";\r
-   chain_postrouting = "post_common";\r
+  chain_forward = "forw_common";\r
+  chain_postrouting = "post_common";\r
  }\r
  else\r
  {\r
-   chain_forward = "FORWARD";\r
-   chain_postrouting = "POSTROUTING";\r
+  chain_forward = "FORWARD";\r
+  chain_postrouting = "POSTROUTING";\r
  }\r
- /* -------------------------------- classify or reject free download */\r
+\r
+ if(free_min)\r
  {\r
-   char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */\r
-   if(free_min)\r
-   {\r
-    final_chain = "ACCEPT";\r
-   }\r
-   if(qos_proxy)\r
-   {\r
-     if(free_min)\r
-     {\r
-       sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s%d",\r
-                   chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables,3);\r
-       save_line(str);\r
-     }\r
-     sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s",\r
-                  chain_postrouting,proxy_ip,proxy_port,lan,final_chain);\r
-     save_line(str);\r
-   }\r
-   if(free_min)\r
-   {\r
-     sprintf(str,"-A %s -o %s -j %s%d", chain_postrouting, lan, mark_iptables, 3);\r
-     save_line(str);\r
-   }\r
-   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
-   save_line(str);\r
-   /* ------------------------------- classify or reject free  upload */\r
-   if(free_min)\r
-   {\r
-     sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);\r
-     save_line(str);\r
-   }\r
-   sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);\r
-   save_line(str);\r
+  final_chain = "ACCEPT";\r
+ }\r
+\r
+ if(qos_proxy)\r
+ {\r
+  if(free_min) \r
+  {\r
+   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",\r
+                chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);\r
+   iptables_save_line(str, FALSE); /* only for IPv4 */\r
+  }\r
+  sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",\r
+               chain_postrouting,proxy_ip,proxy_port,lan,final_chain);\r
+  iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+\r
+ if(free_min)\r
+ {\r
+  sprintf(str, "-A %s -o %s -j %s%d",\r
+               chain_postrouting, lan, mark_iptables, 3);\r
+  iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+\r
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
+ iptables_save_line(str, FALSE);\r
+ if(ip6prefix)\r
+ {\r
+  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
+  iptables_save_line(str, TRUE);\r
+ }\r
+\r
+ if(free_min)\r
+ {\r
+  sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);\r
+  iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+\r
+ sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);\r
+ iptables_save_line(str, FALSE);\r
+ if(ip6prefix)\r
+ {\r
+  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
+  iptables_save_line(str, TRUE);\r
  }\r
 \r
  if(free_min) /* allocate free bandwith if it is not zero... */ \r
@@ -1166,7 +1275,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    safe_run(str);\r
  }\r
  printf("Total IP count: %d\n", i);\r
- run_restore(); \r
+ run_iptables_restore();\r
  if(log_file)\r
  {\r
   fclose(log_file);\r