prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2014 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20140812
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.5-b";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2014 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
  62 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  63 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  64 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  65 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  66 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  67 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  68 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  69 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  70 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  71 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  72 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  73 char    *html_log_dir = "/var/www/logs/html/";
  74
  75 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  76 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  77 int use_jquery_popups = TRUE;
  78 int      row_odd_even = 0; /*<tr class="odd/even"> */
  79
  80 /* === Configuraration file values defaults - stored in global variables ==== */
  81
  82 int        filter_type = 1; /*1 mark, 2 classify*/
  83 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  84 char             *mark = "MARK";
  85 char    *mark_iptables = "MARK --set-mark ";
  86 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  87 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  88 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  89 FILE    *iptables_file = NULL;
  90 FILE   *ip6tables_file = NULL;
  91 int      enable_credit = TRUE; /* enable credit file */
  92 int         use_credit = FALSE; /* use credit file (if enabled)*/
  93 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  94 int       hall_of_fame = TRUE; /* enable hall of fame */
  95 char              *lan = "eth0"; /* LAN interface */
  96 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  97 char              *wan = "eth1"; /* WAN/ISP interface */
  98 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  99 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
 100 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 101 char    *qos_free_zone = NULL; /* QoS free zone */
 102 /* int          qos_proxy = TRUE; include proxy port to QoS */
 103 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 104 int     include_upload = TRUE; /* upload+download=total traffic */
 105 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 106 /* int         proxy_port = 3128; proxy port number */
 107 long long int     line = 1024; /* WAN/ISP download in kbps */
 108 long long int       up = 1024; /* WAN/ISP upload in kbps */
 109 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 110 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 111 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 112 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 113 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 114 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 115 int        max_nesting = 5; /* /include/uapi/linux/pkt_sched.h: #define TC_HTB_MAXDEPTH 8 [... - 3 parent classes] */
 116 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 117 int              burst = 8; /* HTB burst (in kbits) */
 118 int         burst_main = 64;
 119 int        burst_group = 32;
 120 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 121 int       keywordcount = 0;
 122 int        class_count = 0;
 123 int           ip_count = 0;
 124 FILE         *log_file = NULL;
 125 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 126
 127 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 128 const int lowest_priority    = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */
 129 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 130 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 131 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 132 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 133
 134 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 135 struct Group *groups = NULL, *group;
 136 struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 137 struct Macro *macro, *macros = NULL;
 138
 139 #define FREE_CLASS      3
 140 #define OVERLIMIT_CLASS 4
 141
 142 void help(void);
 143 /* implemented in help.c */
 144
 145 void get_traffic_statistics(const char *whichiptables, int ipv6);
 146 /* implemented in parseiptables.c */
 147
 148 void parse_ip_log(int argc, char **argv);
 149 /* implemented in parselog.c */
 150
 151 void parse_hosts(char *hosts);
 152 /* implemented in parsehosts.c */
 153
 154 void write_json_traffic(char *json);
 155 /* implemented in json.c */
 156
 157 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 158 /* implemented in htmlandlogs.c */
 159
 160 void analyse_topology(char *traceroute);
 161 /* implemented in networks.c */
 162
 163
 164 const char *tr_odd_even(void)
 165 {
 166  row_odd_even = 1 - row_odd_even;
 167  if(row_odd_even)
 168  {
 169   return "<tr class=\"even\">\n";
 170  }
 171  else
 172  {
 173   return "<tr class=\"odd\">\n";
 174  }
 175 }
 176
 177 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 178 /* (except that this code uses obsolete, archaic version of this header file...)     */
 179
 180 struct Index
 181 {
 182  char *addr;
 183  char *id;
 184  struct Index *parent;
 185  int bitmask;
 186  int children;
 187  int ipv6;
 188  list(Index);
 189 } *idxs=NULL, *idx, *metaindex;
 190
 191
 192 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 193
 194 char *index_id(char *ip, int bitmask);
 195 /* function implemented in ipv4subnets.c */
 196
 197 char *subnet_id(char *ip, int bitmask);
 198 /* function implemented in ipv4subnets.c */
 199
 200 char *index6_id(char *ip, int bitmask);
 201 /* function implemented in ipv6subnets.c */
 202
 203 char *subnet6_id(char *ip, int bitmask);
 204 /* function implemented in ipv6subnets.c */
 205
 206 /* ================= Let's parse configuration file here ================ */
 207
 208 void reject_config_and_exit(char *filename)
 209 {
 210  printf("Configuration file %s rejected - abnormal exit.",filename);
 211  exit(-1);
 212 }
 213
 214 void get_config(char *config_filename)
 215 {
 216  char *cnf="mark";
 217
 218  printf("Configured keywords: ");
 219  parse(config_filename)
 220  {
 221   option("keyword",kwd);
 222   if(kwd)
 223   {
 224    printf("%s ",kwd);
 225
 226    create(keyword,Keyword);
 227    keyword->key = kwd;
 228    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 229    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 230    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 231    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 232    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 233    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 234    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 235    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 236    keyword->default_prio = highest_priority+1;
 237    keyword->html_color = "000000";
 238    keyword->ip_count = 0;
 239    keyword->leaf_discipline = "";
 240    keyword->allowed_avgmtu = 0;
 241
 242    push(keyword, keywords);
 243    if(!defaultkeyword)
 244    {
 245     defaultkeyword = keyword;
 246    }
 247    keywordcount++;
 248
 249    kwd=NULL;
 250   }
 251   else
 252   {
 253     for_each(keyword,keywords)
 254     {
 255      int l=strlen(keyword->key);
 256
 257      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 258      {
 259       char *tmptr=_; /*  <---- l+1 ----> */
 260       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 261       foption("asymetry-ratio", keyword->asymetry_ratio);
 262       ioption("asymetry-treshold", keyword->asymetry_fixed);
 263       ioption("magic-relative-limit", keyword->data_limit);
 264       ioption("magic-relative-prio", keyword->data_prio);
 265       loption("magic-fixed-limit", keyword->fixed_limit);
 266       loption("magic-fixed-prio", keyword->fixed_prio);
 267       ioption("htb-default-prio", keyword->default_prio);
 268       ioption("htb-rate-bonus", keyword->reserve_min);
 269       ioption("htb-ceil-malus", keyword->reserve_max);
 270       option("leaf-discipline", keyword->leaf_discipline);
 271       option("html-color", keyword->html_color);
 272       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 273       _=tmptr;
 274
 275       if(keyword->data_limit || keyword->fixed_limit ||
 276          keyword->data_prio || keyword->fixed_prio)
 277       {
 278        use_credit=1;
 279       }
 280      }
 281     }
 282   }
 283
 284   option("tc",tc);
 285   option("iptables",iptables);
 286   option("iptables-save",iptablessave);
 287   option("iptables-restore",iptablesrestore);
 288   option("ip6tables",ip6tables);
 289   option("ip6tables-save",ip6tablessave);
 290   option("ip6tables-restore",ip6tablesrestore);
 291   option("iptables-in-filename",iptablesfile);
 292   option("ip6tables-in-filename",ip6tablesfile);
 293   option("hosts",hosts);
 294   option("lan-interface",lan);
 295   option("wan-interface",wan);
 296   option("ip6-prefix",ip6prefix);
 297   option("lan-medium",lan_medium);
 298   option("wan-medium",wan_medium);
 299   lloption("wan-download",line);
 300   lloption("wan-upload",up);
 301   ioption("hall-of-fame-enable",hall_of_fame);
 302   option("hall-of-fame-title",title);
 303   option("hall-of-fame-filename",html);
 304   option("json-filename",json_traffic);
 305   option("hall-of-fame-preview",preview);
 306   option("json-preview",json_preview);
 307   option("log-filename",cmdlog);
 308   option("credit-filename",credit);
 309   option("classmap-filename",classmap);
 310   ioption("credit-enable",enable_credit);
 311   option("log-traffic-directory",log_dir);
 312   option("log-traffic-html-directory",html_log_dir);
 313   option("log-traffic-url-path",log_url);
 314   option("jquery-url",jquery_url);
 315   option("lms-url",lms_url);
 316   ioption("use-jquery-popups",use_jquery_popups);
 317   option("qos-free-zone",qos_free_zone);
 318   ioption("qos-free-delay",qos_free_delay);
 319 /*  ioption("qos-proxy-enable",qos_proxy); */
 320 /*  option("qos-proxy-ip",proxy_ip);*/
 321   option("htb-leaf-discipline",qos_leaf);
 322 /*  ioption("qos-proxy-port",proxy_port); */
 323   ioption("free-rate",free_min);
 324   ioption("free-ceil",free_max);
 325   ioption("overlimit-rate",overlimit_min);
 326   ioption("overlimit-ceil",overlimit_max);
 327   ioption("htb-burst",burst);
 328   ioption("htb-burst-main",burst_main);
 329   ioption("htb-burst-group",burst_group);
 330   ioption("htb-nesting-limit",max_nesting);
 331   ioption("htb-r2q",htb_r2q);
 332   ioption("magic-include-upload",include_upload);
 333   ioption("magic-treshold",magic_treshold);
 334   option("filter-type", cnf);
 335 /* not yet implemented:
 336   ioption("magic-fixed-packets",fixed_packets);
 337   ioption("magic-relative-packets",packet_limit);
 338 */
 339  }
 340  fail
 341  {
 342   perror(config_filename);
 343   puts("Warning - using built-in defaults instead ...");
 344  }
 345  done; /* ugly macro end */
 346  printf("\n");
 347
 348  /* leaf discipline for keywords */
 349  for_each(keyword,keywords)
 350  {
 351   if(!strcmpi(keyword->leaf_discipline, ""))
 352   {
 353    keyword->leaf_discipline = qos_leaf;
 354   }
 355  }
 356
 357  if(strcmpi(cnf, "mark"))
 358  {
 359   filter_type = 2;
 360   mark = "CLASSIFY";
 361   mark_iptables = "CLASSIFY --set-class 1:";
 362  }
 363  else
 364  {
 365   filter_type = 1;
 366   mark = "MARK";
 367   mark_iptables = "MARK --set-mark ";
 368  }
 369
 370  /* are supplied values meaningful ?*/
 371  if(line<=0 || up<=0)
 372  {
 373   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 374   reject_config_and_exit(config_filename);
 375  }
 376 }
 377
 378
 379 /* ========== This function executes, logs OR ALSO prints command ========== */
 380
 381 void safe_run(char *cmd)
 382 {
 383  if(dry_run)
 384  {
 385   printf("\n=>%s\n",cmd);
 386  }
 387  else
 388  {
 389   system(cmd);
 390  }
 391  if(log_file)
 392  {
 393   fprintf(log_file,"%s\n",cmd);
 394  }
 395 }
 396
 397 void iptables_save_line(char *line, int ipv6)
 398 {
 399  if(ipv6)
 400  {
 401   fprintf(ip6tables_file,"%s\n",line);
 402  }
 403  else
 404  {
 405   fprintf(iptables_file,"%s\n",line);
 406  }
 407 }
 408
 409 void run_iptables_restore(void)
 410 {
 411  char *restor;
 412  string(restor,STRLEN);
 413
 414  /*-----------------------------------------------------------------*/
 415  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 416  /*-----------------------------------------------------------------*/
 417
 418  iptables_save_line("COMMIT", FALSE);
 419  fclose(iptables_file);
 420  if(dry_run)
 421  {
 422   parse(iptablesfile)
 423   {
 424    printf("%s\n",_);
 425   }
 426   done; /* ugly macro end */
 427  }
 428
 429  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 430  safe_run(restor);
 431
 432  if(ip6prefix)
 433  {
 434   /*-----------------------------------------------------------------*/
 435   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 436   /*-----------------------------------------------------------------*/
 437   iptables_save_line("COMMIT", TRUE);
 438   fclose(ip6tables_file);
 439   if(dry_run)
 440   {
 441    parse(ip6tablesfile)
 442    {
 443     printf("%s\n",_);
 444    }
 445    done; /* ugly macro end */
 446   }
 447   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 448   safe_run(restor);
 449  }
 450  free(restor);
 451 }
 452
 453 char *parse_datafile_line(char *str)
 454 {
 455  char *ptr = strchr(str,' ');
 456  if(!ptr)
 457  {
 458   ptr = strchr(str,'\t');
 459  }
 460
 461  if(ptr)
 462  {
 463   *ptr = 0;
 464   ptr++;
 465   while(*ptr == ' ' || *ptr == '\t')
 466   {
 467    ptr++;
 468   }
 469   return ptr;
 470  }
 471  else
 472  {
 473   return NULL;
 474  }
 475 }
 476
 477
 478 /*-----------------------------------------------------------------*/
 479 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 480 /*-----------------------------------------------------------------*/
 481
 482 program
 483 {
 484  int i=0;                    /* just plain old Fortran style integer :-) */
 485  FILE *f=NULL;               /* everything is just stream of bytes... */
 486  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 487  char *substring, *limit_pkts;
 488
 489  int parent        = 1;
 490  int just_networks = FALSE;
 491  int just_flush    = FALSE;       /* deactivates all previous actions */
 492  int nodelay       = FALSE;
 493  int just_preview  = FALSE;       /* preview - generate just stats */
 494  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 495  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 496  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 497  int just_logs     = FALSE;       /* just parse logs */
 498  int run           = FALSE;
 499  int total         = 0;
 500
 501  char *chain_forward, *chain_postrouting;
 502  char *althosts=NULL;
 503
 504  printf("\n\
 505 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 506 Version %s - Copyright (C)2005-2014 Michael Polak, Arachne Labs\n\
 507 iptables-restore & burst tunning & classify modification by Ludva\n\
 508 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 509
 510  /*----- Boring... we have to check command line options first: ----*/
 511  arguments
 512  {
 513   argument("-c") { nextargument(config); }
 514   argument("-h") { nextargument(althosts);}
 515   argument("-d") { run=TRUE; dry_run=TRUE; }
 516   argument("-f") { run=TRUE; just_flush=TRUE; }
 517   argument("-9") { run=TRUE; just_flush=9; }
 518   argument("-p") { run=TRUE; just_preview=TRUE; }
 519   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 520   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 521   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 522   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 523   argument("-r") { run=TRUE; }
 524   argument("-n") { run=TRUE; nodelay=TRUE; }
 525   argument("-a") { run=TRUE; just_networks=TRUE; }
 526   argument("-l") { just_logs=TRUE; }
 527   argument("-m") { just_logs=TRUE; }
 528   argument("-y") { just_logs=TRUE; }
 529   argument("-?") { help(); exit(0); }
 530   argument("--help") { help(); exit(0); }
 531   argument("-v") { exit(0); }
 532   argument("--version") { exit(0); }
 533  }
 534
 535  if(dry_run)
 536  {
 537   puts("*** THIS IS JUST DRY RUN ! ***\n");
 538  }
 539
 540  date(d); /* this is typical cll1.h macro - prints current date */
 541
 542  /*-----------------------------------------------------------------*/
 543  printf("Parsing configuration file %s ...\n", config);
 544  /*-----------------------------------------------------------------*/
 545  get_config(config);
 546
 547  if(just_logs)
 548  {
 549   parse_ip_log(argc,argv);
 550   exit(0);
 551  }
 552  else if(not run)
 553  {
 554   help();
 555   exit(0);
 556  }
 557
 558  if(althosts)
 559  {
 560   hosts = althosts;
 561  }
 562
 563  if(just_flush<9)
 564  {
 565   /*-----------------------------------------------------------------*/
 566   puts("Parsing iptables verbose output ...");
 567   /*-----------------------------------------------------------------*/
 568   get_traffic_statistics(iptables, FALSE);
 569   if(ip6prefix)
 570   {
 571    /*-----------------------------------------------------------------*/
 572    puts("Parsing ip6tables verbose output ...");
 573    /*-----------------------------------------------------------------*/
 574    get_traffic_statistics(ip6tables, TRUE);
 575   }
 576  }
 577
 578  /*-----------------------------------------------------------------*/
 579  /* cll1.h - let's allocate brand new character buffer...           */
 580  /*-----------------------------------------------------------------*/
 581  string(str, STRLEN);
 582  string(limit_pkts, STRLEN);
 583
 584  /*-----------------------------------------------------------------*/
 585  printf("Parsing macro definition file %s ...\n", macrosfile);
 586  /*-----------------------------------------------------------------*/
 587  parse(macrosfile)
 588  {
 589   ptr = parse_datafile_line(_);
 590   if(ptr)
 591   {
 592    create(macro, Macro);
 593    macro->rewrite_from = _;
 594    macro->rewrite_to = ptr;
 595    push(macro, macros);
 596    printf("%s -> %s\n", macro->rewrite_from, macro->rewrite_to);
 597   }
 598  }
 599  done; /* ugly macro end */
 600
 601  /*-----------------------------------------------------------------*/
 602  printf("Parsing class defintion file %s ...\n", hosts);
 603  /*-----------------------------------------------------------------*/
 604  parse_hosts(hosts);
 605  if(just_networks)
 606  {
 607   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 608   exit(-1);
 609  }
 610
 611  /*-----------------------------------------------------------------*/
 612  puts("Resolving shared connections ...");
 613  /*-----------------------------------------------------------------*/
 614  for_each(ip, ips) if(ip->sharing)
 615  {
 616   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 617   {
 618    sharedip->traffic += ip->traffic;
 619    ip->traffic = 0;
 620    ip->mark = sharedip->mark;
 621    ip->lmsid = sharedip->lmsid;
 622    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 623
 624    /* Ugly hack: append IPv4 addresses of sharedip to IPv6 uplinks */
 625    ptr = strchr(ip->addr, '+');
 626    if(ptr && ptr-ip->addr > 1 && !sharedip->v6)
 627    {
 628     *(--ptr) = 0;
 629     concatenate(ip->addr, sharedip->addr, ptr);
 630     ip->name = ip->addr = ptr;
 631     ptr = strchr(ip->addr, '.');
 632     while(ptr && *ptr)
 633     {
 634      *ptr = ':';
 635      ptr = strchr(ptr, '.');
 636     }
 637     ip->mask += 64;
 638    }
 639
 640    break;
 641   }
 642   if(not sharedip)
 643   {
 644    printf("Unresolved shared connection: %s %s sharing-%s\n",
 645           ip->addr, ip->name, ip->sharing);
 646   }
 647  }
 648
 649  if(enable_credit && just_flush<9)
 650  {
 651   /*-----------------------------------------------------------------*/
 652   printf("Parsing credit file %s ...\n", credit);
 653   /*-----------------------------------------------------------------*/
 654   parse(credit)
 655   {
 656    ptr = parse_datafile_line(_);
 657    if(ptr)
 658    {
 659     if_exists(ip,ips,eq(ip->addr,_))
 660     {
 661      sscanf(ptr,"%Lu",&(ip->credit));
 662     }
 663    }
 664   }
 665   done; /* ugly macro end */
 666  }
 667
 668
 669  if(!just_preview)
 670  {
 671   /*-----------------------------------------------------------------*/
 672   puts("Initializing iptables and tc classes ...");
 673   /*-----------------------------------------------------------------*/
 674
 675   iptables_file = fopen(iptablesfile, "w");
 676   if(iptables_file == NULL)
 677   {
 678     perror(iptablesfile);
 679     exit(-1);
 680   }
 681   iptables_save_line(iptablespreamble, FALSE);
 682
 683   if(ip6prefix)
 684   {
 685    ip6tables_file = fopen(ip6tablesfile, "w");
 686    if(ip6tables_file == NULL)
 687    {
 688      perror(ip6tablesfile);
 689      exit(-1);
 690    }
 691    iptables_save_line(iptablespreamble, TRUE);
 692    iptables_save_line(ip6preamble, TRUE);
 693   }
 694
 695   run_iptables_restore();
 696
 697   log_file = fopen(cmdlog, "w");
 698   if(log_file == NULL)
 699   {
 700     perror(cmdlog);
 701     exit(-1);
 702   }
 703
 704   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 705   safe_run(str);
 706
 707   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 708   safe_run(str);
 709
 710   iptables_file=fopen(iptablesfile,"w");
 711   iptables_save_line(iptablespreamble, FALSE);
 712   if(ip6prefix)
 713   {
 714    ip6tables_file=fopen(ip6tablesfile,"w");
 715    iptables_save_line(iptablespreamble, TRUE);
 716    iptables_save_line(ip6preamble, TRUE);
 717   }
 718
 719   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 720   {
 721    char *chain;
 722
 723    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 724    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 725
 726 /*
 727    if(qos_proxy)
 728    {
 729     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 730     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 731     iptables_save_line(str , FALSE);
 732     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 733     iptables_save_line(str, FALSE);
 734     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 735     iptables_save_line(str, FALSE);
 736
 737     chain="post_noproxy";
 738    }
 739
 740    else
 741    {
 742 */
 743    chain = "POSTROUTING";
 744 //   }
 745
 746    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 747    iptables_save_line(str, FALSE);
 748   }
 749
 750   if(ip_count > idxtable_treshold1 && !just_flush)
 751   {
 752    int idxcount=0, bitmask=32-idxtable_bitmask1;
 753    char *subnet, *buf;
 754    /*-----------------------------------------------------------------*/
 755    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 756    /*-----------------------------------------------------------------*/
 757
 758    iptables_save_line(":post_common - [0:0]", FALSE);
 759    iptables_save_line(":forw_common - [0:0]", FALSE);
 760    if(ip6prefix)
 761    {
 762     iptables_save_line(":post_common - [0:0]", TRUE);
 763     iptables_save_line(":forw_common - [0:0]", TRUE);
 764    }
 765
 766    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 767    {
 768     if(ip->v6)
 769     {
 770      buf=index6_id(ip->addr,bitmask+32);
 771     }
 772     else
 773     {
 774      buf=index_id(ip->addr, bitmask);
 775     }
 776
 777     if_exists(idx,idxs,eq(idx->id,buf))
 778     {
 779      idx->children++;
 780     }
 781     else
 782     {
 783      create(idx,Index);
 784      idx->addr = ip->addr;
 785      idx->id = buf;
 786      idx->bitmask = bitmask+32*ip->v6;
 787      idx->parent = NULL;
 788      idx->children = 0;
 789      idx->ipv6 = ip->v6;
 790      idxcount++;
 791      push(idx,idxs);
 792     }
 793    }
 794
 795    /* brutal perfomance optimalization */
 796    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 797    {
 798     bitmask -= idxtable_bitmask2;
 799     idxcount = 0;
 800
 801     for_each(idx,idxs) if(idx->parent == NULL)
 802     {
 803      if(idx->ipv6)
 804      {
 805       buf = index6_id(idx->addr, bitmask+32);
 806      }
 807      else
 808      {
 809       buf = index_id(idx->addr, bitmask);
 810      }
 811      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 812      {
 813       metaindex->children++;
 814      }
 815      else
 816      {
 817       create(metaindex,Index);
 818       metaindex->addr = idx->addr;
 819       metaindex->id = buf;
 820       metaindex->bitmask = bitmask+32*idx->ipv6;
 821       metaindex->parent = NULL;
 822       metaindex->children = 0;
 823       metaindex->ipv6 = idx->ipv6;
 824       idxcount++;
 825       push(metaindex,idxs);
 826      }
 827      idx->parent=metaindex;
 828     }
 829    }
 830
 831    /* this should slightly optimize throughput ... */
 832    sort(idx,idxs,desc_order_by,children);
 833    sort(idx,idxs,order_by,bitmask);
 834
 835    i=0;
 836    for_each(idx,idxs)
 837    {
 838     if(idx->ipv6)
 839     {
 840      subnet=subnet6_id(idx->addr, idx->bitmask);
 841     }
 842     else
 843     {
 844      subnet=subnet_id(idx->addr, idx->bitmask);
 845     }
 846     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 847
 848     sprintf(str,":post_%s - [0:0]", idx->id);
 849     iptables_save_line(str, idx->ipv6);
 850
 851     sprintf(str,":forw_%s - [0:0]", idx->id);
 852     iptables_save_line(str, idx->ipv6);
 853
 854     if(idx->parent)
 855     {
 856      string(buf,strlen(idx->parent->id)+6);
 857      sprintf(buf,"post_%s", idx->parent->id);
 858     }
 859     else
 860     {
 861      buf="POSTROUTING";
 862     }
 863
 864     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 865     iptables_save_line(str, idx->ipv6);
 866
 867     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 868     iptables_save_line(str, idx->ipv6);
 869
 870     if(idx->parent)
 871     {
 872      string(buf,strlen(idx->parent->id)+6);
 873      sprintf(buf,"forw_%s",idx->parent->id);
 874     }
 875     else
 876     {
 877      buf="FORWARD";
 878     }
 879
 880     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 881     iptables_save_line(str, idx->ipv6);
 882
 883     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 884     iptables_save_line(str, idx->ipv6);
 885    }
 886    printf("Total indexed iptables chains created: %d\n", i);
 887
 888    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 889    iptables_save_line(str, FALSE);
 890
 891    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 892    iptables_save_line(str, FALSE);
 893
 894    if(ip6prefix)
 895    {
 896     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 897     iptables_save_line(str, TRUE);
 898
 899     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 900     iptables_save_line(str, TRUE);
 901    }
 902   }
 903  }
 904
 905  if(just_flush)
 906  {
 907   fclose(iptables_file);
 908   if(log_file)
 909   {
 910    fclose(log_file);
 911   }
 912   puts("Just flushed iptables and tc classes - now exiting ...");
 913   exit(0);
 914  }
 915
 916  if(!just_preview)
 917  {
 918   if(!dry_run && !nodelay && qos_free_delay)
 919   {
 920    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 921    sleep(qos_free_delay);
 922   }
 923
 924   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 925               tc,lan,htb_r2q);
 926   safe_run(str);
 927
 928   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 929                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 930   safe_run(str);
 931
 932   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 933                 tc,lan,line,line,burst_main,highest_priority);
 934   safe_run(str);
 935
 936   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 937   safe_run(str);
 938
 939   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 940                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 941   safe_run(str);
 942
 943   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 944                tc,wan,up,up,burst_main,highest_priority);
 945   safe_run(str);
 946  }
 947
 948  /*-----------------------------------------------------------------*/
 949  puts("Locating heavy downloaders and generating root classes ...");
 950  /*-----------------------------------------------------------------*/
 951  sort(ip,ips,desc_order_by,traffic);
 952
 953  /*-----------------------------------------------------------------*/
 954  /* sub-scope - local variables */
 955  {
 956   long long int rate = line;
 957   long long int max = line;
 958   int group_count = 0;
 959   FILE *credit_file = NULL;
 960
 961   if(!just_preview && !dry_run && enable_credit)
 962   {
 963    credit_file = fopen(credit,"w");
 964   }
 965
 966   for_each(group,groups)
 967   {
 968    if(!just_preview)
 969    {
 970     //download
 971     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 972                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 973     safe_run(str);
 974
 975     //upload
 976     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 977                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 978     safe_run(str);
 979    }
 980
 981    if(group_count++ < max_nesting)
 982    {
 983     parent = group->id;
 984    }
 985
 986    rate -= digital_divide*group->min;
 987    if(rate < group->min)
 988    {
 989     rate = group->min;
 990    }
 991
 992    /*shaping of aggresive downloaders, with credit file support */
 993    if(use_credit)
 994    {
 995     int group_rate = group->min, priority_sequence = lowest_priority;
 996
 997     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 998     {
 999      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
1000      if(     ip->keyword->data_limit
1001          and not ip->fixedprio
1002          and ip->traffic > ip->realquota )
1003      {
1004       if(group_rate < ip->max)
1005       {
1006        ip->max = group_rate;
1007       }
1008       group_rate+=magic_treshold;
1009       ip->prio=lowest_priority;
1010       if(ip->prio<highest_priority+2)
1011       {
1012        ip->prio=highest_priority+2;
1013       }
1014      }
1015      else
1016      {
1017       if(    ip->keyword->data_prio
1018           && !ip->fixedprio
1019           && (   ip->traffic >   ip->credit + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
1020       {
1021        ip->prio=priority_sequence--;
1022        if(ip->prio<highest_priority+1)
1023        {
1024         ip->prio=highest_priority+1;
1025        }
1026       }
1027
1028       if(credit_file)
1029       {
1030        unsigned long long lcredit=0;
1031
1032        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
1033        {
1034         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
1035        }
1036        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
1037       }
1038      }
1039     }
1040    }
1041   }
1042   if(credit_file)
1043   {
1044    fclose(credit_file);
1045   }
1046  }
1047
1048  if(just_preview)
1049  {
1050   if(start_shaping || stop_shaping || reduce_ceil)
1051   {
1052    printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
1053    parse(classmap)
1054    {
1055     ptr=strchr(_,' ');
1056     if(ptr)
1057     {
1058      *ptr=0;
1059      ptr++;
1060      if_exists(ip,ips,eq(ip->addr,_))
1061      {
1062       ip->mark=atoi(ptr);
1063       if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */
1064       {
1065        if(stop_shaping)
1066        {
1067         ip->max = ip->desired;
1068         printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1069        }
1070        else
1071        {
1072         printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1073         if(reduce_ceil)
1074         {
1075          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1076         }
1077        }
1078        printf("(down: %dk-%dk ", ip->min, ip->max);
1079        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1080                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1081        safe_run(str);
1082        printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1083                                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1084        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1085                     tc, wan, ip->group, ip->mark,
1086                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1087                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1088        safe_run(str);
1089       }
1090      }
1091     }
1092    }
1093    fail
1094    {
1095     perror(classmap);
1096     puts("Warning - classmap file not fund, just generating preview ...");
1097     start_shaping=FALSE;
1098     stop_shaping=FALSE;
1099    }
1100    done; /* ugly macro end */
1101   }
1102   html=preview;
1103   json_traffic=json_preview;
1104  }
1105
1106  if(!dry_run && !just_flush)
1107  {
1108   /*-----------------------------------------------------------------*/
1109   printf("Writing json traffic overview  %s ... ", json_traffic);
1110   /*-----------------------------------------------------------------*/
1111   write_json_traffic(json_traffic);
1112
1113   /*-----------------------------------------------------------------*/
1114   printf("Writing statistics into HTML page %s ...\n", html);
1115   /*-----------------------------------------------------------------*/
1116   write_htmlandlogs(html, d, total, just_preview);
1117  }
1118
1119  if(just_preview)
1120  {
1121   char swchar='p';
1122   if(start_shaping)
1123   {
1124    swchar='s';
1125   }
1126   else if(reduce_ceil)
1127   {
1128    swchar='0'+reduce_ceil; /* -2, -4 */
1129   }
1130   else if(stop_shaping)
1131   {
1132    swchar='q';
1133   }
1134
1135   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1136   exit(0);
1137  }
1138
1139  i=0;
1140 #ifdef DEBUG
1141  printf("%-22s %-15s mark\n","name","ip");
1142 #endif
1143
1144  printf("Writing %s", classmap);
1145  f = fopen(classmap, "w");
1146  if(f < 0)
1147  {
1148   perror(classmap);
1149  }
1150
1151  /*-----------------------------------------------------------------*/
1152  printf(" + generating iptables and tc classes ... ");
1153  /*-----------------------------------------------------------------*/
1154
1155  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1156  {
1157   if(idxs)
1158   {
1159    char *buf;
1160    duplicate(ip->addr,buf);
1161    if(ip->v6)
1162    {
1163     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1164    }
1165    else
1166    {
1167     buf=index_id(ip->addr,32-idxtable_bitmask1);
1168    }
1169
1170    string(chain_forward,6+strlen(buf));
1171    strcpy(chain_forward,"forw_");
1172    strcat(chain_forward,buf);
1173
1174    string(chain_postrouting,6+strlen(buf));
1175    strcpy(chain_postrouting,"post_");
1176    strcat(chain_postrouting,buf);
1177
1178    free(buf);
1179   }
1180   else
1181   {
1182    chain_forward="FORWARD";
1183    chain_postrouting="POSTROUTING";
1184   }
1185
1186   /* packet limits - this will be optional in future */
1187   if(ip->pps_limit)
1188   {
1189    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1190                        ip->pps_limit, ip->pps_limit);
1191   }
1192   else
1193   {
1194    *limit_pkts = 0;
1195   }
1196
1197 #ifdef DEBUG
1198   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1199 #endif
1200
1201   /* -------------------------------------------------------- mark download */
1202   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1203                chain_postrouting, ip->addr, ip->mask,
1204                lan, mark_iptables, ip->mark);
1205   iptables_save_line(str, ip->v6);
1206
1207 /*
1208   if(qos_proxy)
1209   {
1210    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1211                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1212                 ip->mask, lan, mark_iptables, ip->mark);
1213    iptables_save_line(str, ip->v6);
1214   }
1215 */
1216   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1217                chain_postrouting, ip->addr, ip->mask, lan, limit_pkts);
1218   iptables_save_line(str, ip->v6);
1219
1220   /* classify overlimit packets to separate overlimit class */
1221   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1222                chain_postrouting, ip->addr, ip->mask,
1223                lan, mark_iptables, OVERLIMIT_CLASS);
1224   iptables_save_line(str, ip->v6);
1225
1226   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1227                chain_postrouting, ip->addr, ip->mask, lan);
1228   iptables_save_line(str, ip->v6);
1229
1230   /* -------------------------------------------------------- mark upload */
1231   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1232                chain_forward, ip->addr, ip->mask, wan, mark_iptables, ip->mark);
1233   iptables_save_line(str, ip->v6);
1234
1235   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1236                chain_forward, ip->addr, ip->mask, wan, limit_pkts);
1237   iptables_save_line(str, ip->v6);
1238
1239   /* classify overlimit packets to separate overlimit class */
1240   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1241                chain_forward, ip->addr, ip->mask, wan, mark_iptables, OVERLIMIT_CLASS);
1242   iptables_save_line(str, ip->v6);
1243
1244   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1245                chain_forward, ip->addr, ip->mask, wan);
1246   iptables_save_line(str, ip->v6);
1247
1248   if(ip->min)
1249   {
1250    /* -------------------------------------------------------- download class */
1251 #ifdef DEBUG
1252    printf("(down: %dk-%dk ", ip->min, ip->max);
1253 #endif
1254
1255    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1256                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1257    safe_run(str);
1258
1259    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1260    {
1261     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1262                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1263     safe_run(str);
1264    }
1265
1266    if(filter_type == 1)
1267    {
1268     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1269                  tc, lan, ip->mark, ip->mark);
1270     safe_run(str);
1271    }
1272
1273    /* -------------------------------------------------------- upload class */
1274 #ifdef DEBUG
1275    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1276                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1277 #endif
1278
1279    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1280                 tc, wan, ip->group, ip->mark,
1281                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1282                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1283    safe_run(str);
1284
1285    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1286    {
1287     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1288                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1289     safe_run(str);
1290    }
1291
1292    if(filter_type == 1)
1293    {
1294     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1295                  tc, wan, ip->mark, ip->mark);
1296     safe_run(str);
1297    }
1298
1299    if(f > 0)
1300    {
1301     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1302    }
1303   }
1304   else
1305   {
1306 #ifdef DEBUG
1307    printf("(sharing %s)\n", ip->sharing);
1308 #endif
1309   }
1310   i++;
1311  }
1312  if(f > 0)
1313  {
1314   puts("done.");
1315   fclose(f);
1316  }
1317
1318  if(idxs)
1319  {
1320   chain_forward = "forw_common";
1321   chain_postrouting = "post_common";
1322  }
1323  else
1324  {
1325   chain_forward = "FORWARD";
1326   chain_postrouting = "POSTROUTING";
1327  }
1328
1329  if(free_min)
1330  {
1331   final_chain = "ACCEPT";
1332  }
1333
1334 /*
1335  if(qos_proxy)
1336  {
1337   if(free_min)
1338   {
1339    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1340                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1341    iptables_save_line(str, FALSE); // only for IPv4
1342   }
1343   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1344                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1345   iptables_save_line(str, FALSE); // only for IPv4
1346  }
1347 */
1348
1349  if(free_min)
1350  {
1351   sprintf(str, "-A %s -o %s -j %s%d",
1352                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1353   iptables_save_line(str, FALSE); /* only for IPv4 */
1354  }
1355
1356  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1357  iptables_save_line(str, FALSE);
1358  if(ip6prefix)
1359  {
1360   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1361   iptables_save_line(str, TRUE);
1362  }
1363
1364  if(free_min)
1365  {
1366   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1367   iptables_save_line(str, FALSE); /* only for IPv4 */
1368  }
1369
1370  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1371  iptables_save_line(str, FALSE);
1372  if(ip6prefix)
1373  {
1374   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1375   iptables_save_line(str, TRUE);
1376  }
1377
1378  if(free_min) /* allocate free bandwith if it is not zero... */
1379  {
1380    /*-----------------------------------------------------------------*/
1381    puts("Generating free bandwith class ...");
1382    /*-----------------------------------------------------------------*/
1383    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1384                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1385    safe_run(str);
1386    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1387                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1388    safe_run(str);
1389    /* tc SFQ */
1390    if(strcmpi(qos_leaf, "none"))
1391    {
1392      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1393      safe_run(str);
1394
1395      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1396      safe_run(str);
1397    }
1398    /* tc handle 1 fw flowid */
1399    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1400    safe_run(str);
1401
1402    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1403    safe_run(str);
1404
1405    /*-----------------------------------------------------------------*/
1406    puts("Generating bandwith class for overlimit packets...");
1407    /*-----------------------------------------------------------------*/
1408    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1409                 tc, lan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1410    safe_run(str);
1411    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1412                 tc, wan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1413    safe_run(str);
1414  }
1415  printf("Total IP count: %d\n", i);
1416  run_iptables_restore();
1417  if(log_file)
1418  {
1419   fclose(log_file);
1420  }
1421  return 0;
1422  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1423  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1424 }