1 | 1 | simandl | #!/usr/bin/env perl |
2 | | | use warnings; |
3 | | | use diagnostics; |
4 | | | |
5 | | | use lib "../../lib"; |
6 | | | use HotSaNICparser; |
7 | | | |
8 | | | # read global settings |
9 | | | # |
10 | | | $MODNAME=HotSaNICparser::get_module_name(); |
11 | | | |
12 | | | # read module-specific settings |
13 | | | # |
14 | | | |
15 | | | foreach (HotSaNICparser::read_settings(".")) { |
16 | | | ($var,$value)=HotSaNICparser::parse_line($_); |
17 | | | if ($var eq "INTIF") { $INTIF=$value; } |
18 | | | if ($var eq "IPTABLES") { $IPTABLES=$value; } |
19 | | | if ($var eq "EXTIF") { $EXTIF=$value; } |
20 | | | if ($var eq "DEVEXT") { |
21 | | | ($dev,$maxin,$maxout,$descr)=split(/,/,$value); |
22 | | | push @WORLDDEST,$dev; |
23 | | | } |
24 | | | if ($var eq "DEVINT") { |
25 | | | ($dev,$maxin,$maxout,$descr)=split(/,/,$value); |
26 | | | push @LOCALDEST,$dev; |
27 | | | } |
28 | | | } |
29 | | | |
30 | | | if ( ! defined $IPTABLES) { die time," ",$MODNAME,": IPTABLES not configured in module settings...\n"; } |
31 | | | |
32 | 5 | simandl | print "\nclearing old and setting up new accounting chains\n"; |
33 | | | foreach $prt ("tcp","udp","icmp","all") { |
34 | | | system("$IPTABLES -F acct_ext_$prt > /dev/null"); |
35 | | | system("$IPTABLES -X acct_ext_$prt > /dev/null"); |
36 | | | system("$IPTABLES -F acct_int_$prt > /dev/null "); |
37 | | | system("$IPTABLES -X acct_int_$prt > /dev/null"); |
38 | | | system("$IPTABLES -N acct_ext_$prt > /dev/null"); |
39 | | | system("$IPTABLES -N acct_int_$prt > /dev/null"); |
40 | 1 | simandl | } |
41 | | | |
42 | | | # |
43 | | | # set up Accounting for unique IPs in subnet... |
44 | | | # |
45 | | | |
46 | | | print "\naccounting for local targets\n"; |
47 | | | |
48 | | | foreach $host (@LOCALDEST) { |
49 | | | print " ",$host,"\n"; |
50 | | | foreach $prt ("tcp","udp","icmp","all") { |
51 | 5 | simandl | system("$IPTABLES -A acct_int_$prt -s $host"); |
52 | | | system("$IPTABLES -A acct_int_$prt -d $host"); |
53 | 1 | simandl | } |
54 | | | } |
55 | | | |
56 | | | # |
57 | 5 | simandl | # set up accounting for dedicated networks to local subnet |
58 | 1 | simandl | # |
59 | | | |
60 | | | print "\naccounting for externel targets\n"; |
61 | | | |
62 | | | foreach $host (@WORLDDEST) { |
63 | | | print " ",$host,"\n"; |
64 | | | foreach $prt ("tcp","udp","icmp","all") { |
65 | 5 | simandl | system("$IPTABLES -A acct_ext_$prt -s $host"); |
66 | | | system("$IPTABLES -A acct_ext_$prt -d $host"); |
67 | 1 | simandl | } |
68 | | | } |
69 | | | |
70 | | | print "\nlinking accounting chains to INPUT/OUTPUT chain\n"; |
71 | | | foreach $dev (split(/,/,$EXTIF)) { |
72 | | | if ($IPTABLES =~ /ipchains/) { |
73 | | | system("$IPTABLES -I input -i $dev -j acct_ext > /dev/null"); |
74 | | | system("$IPTABLES -I output -i $dev -j acct_ext > /dev/null"); |
75 | | | } |
76 | | | else { |
77 | 5 | simandl | foreach $prt ("tcp","udp","icmp","all") { |
78 | | | system("$IPTABLES -I INPUT -i $dev -p $prt -j acct_ext_$prt > /dev/null"); |
79 | | | system("$IPTABLES -I OUTPUT -o $dev -p $prt -j acct_ext_$prt > /dev/null"); |
80 | | | system("$IPTABLES -I FORWARD -i $dev -p $prt -j acct_ext_$prt > /dev/null"); |
81 | | | system("$IPTABLES -I FORWARD -o $dev -p $prt -j acct_ext_$prt > /dev/null"); |
82 | | | } |
83 | 1 | simandl | } |
84 | | | } |
85 | 5 | simandl | |
86 | 1 | simandl | foreach $dev (split(/,/,$INTIF)) { |
87 | | | if ($IPTABLES =~ /ipchains/) { |
88 | | | system("$IPTABLES -I input -i $dev -j acct_int > /dev/null"); |
89 | | | system("$IPTABLES -I output -i $dev -j acct_int > /dev/null"); |
90 | | | } |
91 | | | else { |
92 | 5 | simandl | foreach $prt ("tcp","udp","icmp","all") { |
93 | | | system("$IPTABLES -I INPUT -i $dev -p $prt -j acct_int_$prt > /dev/null"); |
94 | | | system("$IPTABLES -I OUTPUT -o $dev -p $prt -j acct_int_$prt > /dev/null"); |
95 | | | system("$IPTABLES -I FORWARD -i $dev -p $prt -j acct_int_$prt > /dev/null"); |
96 | | | system("$IPTABLES -I FORWARD -o $dev -p $prt -j acct_int_$prt > /dev/null"); |
97 | | | } |
98 | 1 | simandl | } |
99 | | | } |
100 | | | print "\n\nAll done! - accounting should be running now!\n"; |
101 | | | |