jablonka.czprosek.czf

hotsanic

 Subversion Repositories:
[/] [trunk/] [modules/] [networks/] [init] - Blame information for rev 20

 

Line No. Rev Author Line
11simandl#!/usr/bin/env perl
2use warnings;
3use diagnostics;
4 
5use lib "../../lib";
6use HotSaNICparser;
7 
8# read global settings
9#
10$MODNAME=HotSaNICparser::get_module_name();
11 
12# read module-specific settings
13#
14 
15foreach (HotSaNICparser::read_settings(".")) {
16 ($var,$value)=HotSaNICparser::parse_line($_);
17 if ($var eq "INTIF") { $INTIF=$value; }
18 if ($var eq "IPTABLES") { $IPTABLES=$value; }
19 if ($var eq "EXTIF") { $EXTIF=$value; }
20 if ($var eq "DEVEXT") {
21 ($dev,$maxin,$maxout,$descr)=split(/,/,$value);
22 push @WORLDDEST,$dev;
23 }
24 if ($var eq "DEVINT") {
25 ($dev,$maxin,$maxout,$descr)=split(/,/,$value);
26 push @LOCALDEST,$dev;
27 }
28 }
29 
30if ( ! defined $IPTABLES) { die time," ",$MODNAME,": IPTABLES not configured in module settings...\n"; }
31 
325simandlprint "\nclearing old and setting up new accounting chains\n";
339simandl#removing links in main chains
34system("$IPTABLES -D INPUT -j acct_input > /dev/null");
35system("$IPTABLES -D OUTPUT -j acct_output > /dev/null");
36system("$IPTABLES -D FORWARD -j acct_forward > /dev/null");
37 
38#recreating main accounting tables
39foreach $chain ("input","output","forward") {
40 system("$IPTABLES -F acct_$chain > /dev/null");
41 system("$IPTABLES -X acct_$chain > /dev/null");
42 system("$IPTABLES -N acct_$chain > /dev/null");
43 }
44 
45#recreating particular accounting tables
466simandlforeach $prt ("tcp","udp","other") {
475simandl system("$IPTABLES -F acct_ext_$prt > /dev/null");
489simandl system("$IPTABLES -F acct_int_$prt > /dev/null");
495simandl system("$IPTABLES -X acct_ext_$prt > /dev/null");
50 system("$IPTABLES -X acct_int_$prt > /dev/null");
51 system("$IPTABLES -N acct_ext_$prt > /dev/null");
52 system("$IPTABLES -N acct_int_$prt > /dev/null");
531simandl }
54 
559simandl#linking back accounting to main chains
56system("$IPTABLES -I INPUT -j acct_input > /dev/null");
57system("$IPTABLES -I OUTPUT -j acct_output > /dev/null");
58system("$IPTABLES -I FORWARD -j acct_forward > /dev/null");
59 
601simandl#
61# set up Accounting for unique IPs in subnet...
62#
63 
64print "\naccounting for local targets\n";
65 
66foreach $host (@LOCALDEST) {
67 print " ",$host,"\n";
686simandl foreach $prt ("tcp","udp") {
695simandl system("$IPTABLES -A acct_int_$prt -s $host");
70 system("$IPTABLES -A acct_int_$prt -d $host");
711simandl }
726simandl system("$IPTABLES -A acct_int_other -s $host");
73 system("$IPTABLES -A acct_int_other -d $host");
741simandl }
756simandl#this will kick out all tcp and udp from other accounting chain
76system("$IPTABLES -I acct_int_other -p tcp -j RETURN");
77system("$IPTABLES -I acct_int_other -p udp -j RETURN");
781simandl 
79#
805simandl# set up accounting for dedicated networks to local subnet
811simandl#
82 
83print "\naccounting for externel targets\n";
84 
85foreach $host (@WORLDDEST) {
86 print " ",$host,"\n";
876simandl foreach $prt ("tcp","udp") {
885simandl system("$IPTABLES -A acct_ext_$prt -s $host");
89 system("$IPTABLES -A acct_ext_$prt -d $host");
901simandl }
916simandl system("$IPTABLES -A acct_ext_other -s $host");
92 system("$IPTABLES -A acct_ext_other -d $host");
931simandl }
946simandl#this will kick out all tcp and udp from other accounting chain
95system("$IPTABLES -I acct_ext_other -p tcp -j RETURN");
96system("$IPTABLES -I acct_ext_other -p udp -j RETURN");
971simandl 
98print "\nlinking accounting chains to INPUT/OUTPUT chain\n";
99foreach $dev (split(/,/,$EXTIF)) {
100 if ($IPTABLES =~ /ipchains/) {
101 system("$IPTABLES -I input -i $dev -j acct_ext > /dev/null");
102 system("$IPTABLES -I output -i $dev -j acct_ext > /dev/null");
103 }
104 else {
1056simandl #this will sent ALL to other chain
1069simandl system("$IPTABLES -I acct_input -i $dev -p all -j acct_ext_other > /dev/null");
107 system("$IPTABLES -I acct_output -o $dev -p all -j acct_ext_other > /dev/null");
108 system("$IPTABLES -I acct_forward -i $dev -p all -j acct_ext_other > /dev/null");
109 system("$IPTABLES -I acct_forward -o $dev -p all -j acct_ext_other > /dev/null");
1106simandl foreach $prt ("tcp","udp") {
1119simandl system("$IPTABLES -I acct_input -i $dev -p $prt -j acct_ext_$prt > /dev/null");
112 system("$IPTABLES -I acct_output -o $dev -p $prt -j acct_ext_$prt > /dev/null");
113 system("$IPTABLES -I acct_forward -i $dev -p $prt -j acct_ext_$prt > /dev/null");
114 system("$IPTABLES -I acct_forward -o $dev -p $prt -j acct_ext_$prt > /dev/null");
1155simandl }
1161simandl }
117 }
1185simandl 
1191simandlforeach $dev (split(/,/,$INTIF)) {
120 if ($IPTABLES =~ /ipchains/) {
121 system("$IPTABLES -I input -i $dev -j acct_int > /dev/null");
122 system("$IPTABLES -I output -i $dev -j acct_int > /dev/null");
123 }
124 else {
1256simandl #this will sent ALL to other chain
1269simandl system("$IPTABLES -I acct_input -i $dev -p all -j acct_int_other > /dev/null");
127 system("$IPTABLES -I acct_output -o $dev -p all -j acct_int_other > /dev/null");
128 system("$IPTABLES -I acct_forward -i $dev -p all -j acct_int_other > /dev/null");
129 system("$IPTABLES -I acct_forward -o $dev -p all -j acct_int_other > /dev/null");
1306simandl foreach $prt ("tcp","udp") {
1319simandl system("$IPTABLES -I acct_input -i $dev -p $prt -j acct_int_$prt > /dev/null");
132 system("$IPTABLES -I acct_output -o $dev -p $prt -j acct_int_$prt > /dev/null");
133 system("$IPTABLES -I acct_forward -i $dev -p $prt -j acct_int_$prt > /dev/null");
134 system("$IPTABLES -I acct_forward -o $dev -p $prt -j acct_int_$prt > /dev/null");
1355simandl }
1361simandl }
137 }
138print "\n\nAll done! - accounting should be running now!\n";
139 

Powered by WebSVN 2.2.1