prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20131126
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.5-a";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2013 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
  62 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  63 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  64 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  65 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  66 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  67 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  68 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  69 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  70 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  71 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  72 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  73 char    *html_log_dir = "/var/www/logs/html/";
  74
  75 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  76 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  77 int use_jquery_popups = TRUE;
  78 int      row_odd_even = 0; /*<tr class="odd/even"> */
  79
  80 /* === Configuraration file values defaults - stored in global variables ==== */
  81
  82 int        filter_type = 1; /*1 mark, 2 classify*/
  83 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  84 char             *mark = "MARK";
  85 char    *mark_iptables = "MARK --set-mark ";
  86 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  87 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  88 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  89 FILE    *iptables_file = NULL;
  90 FILE   *ip6tables_file = NULL;
  91 int      enable_credit = TRUE; /* enable credit file */
  92 int         use_credit = FALSE; /* use credit file (if enabled)*/
  93 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  94 int       hall_of_fame = TRUE; /* enable hall of fame */
  95 char              *lan = "eth0"; /* LAN interface */
  96 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  97 char              *wan = "eth1"; /* WAN/ISP interface */
  98 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  99 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
 100 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 101 char    *qos_free_zone = NULL; /* QoS free zone */
 102 /* int          qos_proxy = TRUE; include proxy port to QoS */
 103 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 104 int     include_upload = TRUE; /* upload+download=total traffic */
 105 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 106 /* int         proxy_port = 3128; proxy port number */
 107 long long int     line = 1024; /* WAN/ISP download in kbps */
 108 long long int       up = 1024; /* WAN/ISP upload in kbps */
 109 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 110 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 111 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 112 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 113 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 114 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 115 int        max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */
 116 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 117 int              burst = 8; /* HTB burst (in kbits) */
 118 int         burst_main = 64;
 119 int        burst_group = 32;
 120 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 121 int       keywordcount = 0;
 122 int        class_count = 0;
 123 int           ip_count = 0;
 124 FILE         *log_file = NULL;
 125 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 126
 127 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 128 const int lowest_priority    = 7; /* lowest HTB priority (HTB built-in value is 7) */
 129 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 130 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 131 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 132 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 133
 134 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 135 struct Group *groups = NULL, *group;
 136 struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 137 struct Macro *macro, *macros = NULL;
 138
 139 #define FREE_CLASS      3
 140 #define OVERLIMIT_CLASS 4
 141
 142 void help(void);
 143 /* implemented in help.c */
 144
 145 void get_traffic_statistics(const char *whichiptables, int ipv6);
 146 /* implemented in parseiptables.c */
 147
 148 void parse_ip_log(int argc, char **argv);
 149 /* implemented in parselog.c */
 150
 151 void parse_hosts(char *hosts);
 152 /* implemented in parsehosts.c */
 153
 154 void write_json_traffic(char *json);
 155 /* implemented in json.c */
 156
 157 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 158 /* implemented in htmlandlogs.c */
 159
 160 void analyse_topology(char *traceroute);
 161 /* implemented in networks.c */
 162
 163
 164 const char *tr_odd_even(void)
 165 {
 166  row_odd_even = 1 - row_odd_even;
 167  if(row_odd_even)
 168  {
 169   return "<tr class=\"even\">\n";
 170  }
 171  else
 172  {
 173   return "<tr class=\"odd\">\n";
 174  }
 175 }
 176
 177 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 178 /* (except that this code uses obsolete, archaic version of this header file...)     */
 179
 180 struct Index
 181 {
 182  char *addr;
 183  char *id;
 184  struct Index *parent;
 185  int bitmask;
 186  int children;
 187  int ipv6;
 188  list(Index);
 189 } *idxs=NULL, *idx, *metaindex;
 190
 191
 192 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 193
 194 char *index_id(char *ip, int bitmask);
 195 /* function implemented in ipv4subnets.c */
 196
 197 char *subnet_id(char *ip, int bitmask);
 198 /* function implemented in ipv4subnets.c */
 199
 200 char *index6_id(char *ip, int bitmask);
 201 /* function implemented in ipv6subnets.c */
 202
 203 char *subnet6_id(char *ip, int bitmask);
 204 /* function implemented in ipv6subnets.c */
 205
 206 /* ================= Let's parse configuration file here ================ */
 207
 208 void reject_config_and_exit(char *filename)
 209 {
 210  printf("Configuration file %s rejected - abnormal exit.",filename);
 211  exit(-1);
 212 }
 213
 214 void get_config(char *config_filename)
 215 {
 216  char *cnf="mark";
 217
 218  printf("Configured keywords: ");
 219  parse(config_filename)
 220  {
 221   option("keyword",kwd);
 222   if(kwd)
 223   {
 224    printf("%s ",kwd);
 225
 226    create(keyword,Keyword);
 227    keyword->key = kwd;
 228    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 229    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 230    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 231    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 232    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 233    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 234    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 235    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 236    keyword->default_prio = highest_priority+1;
 237    keyword->html_color = "000000";
 238    keyword->ip_count = 0;
 239    keyword->leaf_discipline = "";
 240    keyword->allowed_avgmtu = 0;
 241
 242    push(keyword, keywords);
 243    if(!defaultkeyword)
 244    {
 245     defaultkeyword = keyword;
 246    }
 247    keywordcount++;
 248
 249    kwd=NULL;
 250   }
 251   else
 252   {
 253     for_each(keyword,keywords)
 254     {
 255      int l=strlen(keyword->key);
 256
 257      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 258      {
 259       char *tmptr=_; /*  <---- l+1 ----> */
 260       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 261       ioption("asymetry-ratio", keyword->asymetry_ratio);
 262       ioption("asymetry-treshold", keyword->asymetry_fixed);
 263       ioption("magic-relative-limit", keyword->data_limit);
 264       ioption("magic-relative-prio", keyword->data_prio);
 265       loption("magic-fixed-limit", keyword->fixed_limit);
 266       loption("magic-fixed-prio", keyword->fixed_prio);
 267       ioption("htb-default-prio", keyword->default_prio);
 268       ioption("htb-rate-bonus", keyword->reserve_min);
 269       ioption("htb-ceil-malus", keyword->reserve_max);
 270       option("leaf-discipline", keyword->leaf_discipline);
 271       option("html-color", keyword->html_color);
 272       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 273       _=tmptr;
 274
 275       if(keyword->data_limit || keyword->fixed_limit ||
 276          keyword->data_prio || keyword->fixed_prio)
 277       {
 278        use_credit=1;
 279       }
 280      }
 281     }
 282   }
 283
 284   option("tc",tc);
 285   option("iptables",iptables);
 286   option("iptables-save",iptablessave);
 287   option("iptables-restore",iptablesrestore);
 288   option("ip6tables",ip6tables);
 289   option("ip6tables-save",ip6tablessave);
 290   option("ip6tables-restore",ip6tablesrestore);
 291   option("iptables-in-filename",iptablesfile);
 292   option("ip6tables-in-filename",ip6tablesfile);
 293   option("hosts",hosts);
 294   option("lan-interface",lan);
 295   option("wan-interface",wan);
 296   option("ip6-prefix",ip6prefix);
 297   option("lan-medium",lan_medium);
 298   option("wan-medium",wan_medium);
 299   lloption("wan-download",line);
 300   lloption("wan-upload",up);
 301   ioption("hall-of-fame-enable",hall_of_fame);
 302   option("hall-of-fame-title",title);
 303   option("hall-of-fame-filename",html);
 304   option("json-filename",json_traffic);
 305   option("hall-of-fame-preview",preview);
 306   option("json-preview",json_preview);
 307   option("log-filename",cmdlog);
 308   option("credit-filename",credit);
 309   option("classmap-filename",classmap);
 310   ioption("credit-enable",enable_credit);
 311   option("log-traffic-directory",log_dir);
 312   option("log-traffic-html-directory",html_log_dir);
 313   option("log-traffic-url-path",log_url);
 314   option("jquery-url",jquery_url);
 315   option("lms-url",lms_url);
 316   ioption("use-jquery-popups",use_jquery_popups);
 317   option("qos-free-zone",qos_free_zone);
 318   ioption("qos-free-delay",qos_free_delay);
 319 /*  ioption("qos-proxy-enable",qos_proxy); */
 320 /*  option("qos-proxy-ip",proxy_ip);*/
 321   option("htb-leaf-discipline",qos_leaf);
 322 /*  ioption("qos-proxy-port",proxy_port); */
 323   ioption("free-rate",free_min);
 324   ioption("free-ceil",free_max);
 325   ioption("overlimit-rate",overlimit_min);
 326   ioption("overlimit-ceil",overlimit_max);
 327   ioption("htb-burst",burst);
 328   ioption("htb-burst-main",burst_main);
 329   ioption("htb-burst-group",burst_group);
 330   ioption("htb-nesting-limit",max_nesting);
 331   ioption("htb-r2q",htb_r2q);
 332   ioption("magic-include-upload",include_upload);
 333   ioption("magic-treshold",magic_treshold);
 334   option("filter-type", cnf);
 335 /* not yet implemented:
 336   ioption("magic-fixed-packets",fixed_packets);
 337   ioption("magic-relative-packets",packet_limit);
 338 */
 339  }
 340  fail
 341  {
 342   perror(config_filename);
 343   puts("Warning - using built-in defaults instead ...");
 344  }
 345  done; /* ugly macro end */
 346  printf("\n");
 347
 348  /* leaf discipline for keywords */
 349  for_each(keyword,keywords)
 350  {
 351   if(!strcmpi(keyword->leaf_discipline, ""))
 352   {
 353    keyword->leaf_discipline = qos_leaf;
 354   }
 355  }
 356
 357  if(strcmpi(cnf, "mark"))
 358  {
 359   filter_type = 2;
 360   mark = "CLASSIFY";
 361   mark_iptables = "CLASSIFY --set-class 1:";
 362  }
 363  else
 364  {
 365   filter_type = 1;
 366   mark = "MARK";
 367   mark_iptables = "MARK --set-mark ";
 368  }
 369
 370  /* are supplied values meaningful ?*/
 371  if(line<=0 || up<=0)
 372  {
 373   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 374   reject_config_and_exit(config_filename);
 375  }
 376 }
 377
 378
 379 /* ========== This function executes, logs OR ALSO prints command ========== */
 380
 381 void safe_run(char *cmd)
 382 {
 383  if(dry_run)
 384  {
 385   printf("\n=>%s\n",cmd);
 386  }
 387  else
 388  {
 389   system(cmd);
 390  }
 391  if(log_file)
 392  {
 393   fprintf(log_file,"%s\n",cmd);
 394  }
 395 }
 396
 397 void iptables_save_line(char *line, int ipv6)
 398 {
 399  if(ipv6)
 400  {
 401   fprintf(ip6tables_file,"%s\n",line);
 402  }
 403  else
 404  {
 405   fprintf(iptables_file,"%s\n",line);
 406  }
 407 }
 408
 409 void run_iptables_restore(void)
 410 {
 411  char *restor;
 412  string(restor,STRLEN);
 413
 414  /*-----------------------------------------------------------------*/
 415  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 416  /*-----------------------------------------------------------------*/
 417
 418  iptables_save_line("COMMIT", FALSE);
 419  fclose(iptables_file);
 420  if(dry_run)
 421  {
 422   parse(iptablesfile)
 423   {
 424    printf("%s\n",_);
 425   }
 426   done; /* ugly macro end */
 427  }
 428
 429  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 430  safe_run(restor);
 431
 432  if(ip6prefix)
 433  {
 434   /*-----------------------------------------------------------------*/
 435   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 436   /*-----------------------------------------------------------------*/
 437   iptables_save_line("COMMIT", TRUE);
 438   fclose(ip6tables_file);
 439   if(dry_run)
 440   {
 441    parse(ip6tablesfile)
 442    {
 443     printf("%s\n",_);
 444    }
 445    done; /* ugly macro end */
 446   }
 447   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 448   safe_run(restor);
 449  }
 450  free(restor);
 451 }
 452
 453 char *parse_datafile_line(char *str)
 454 {
 455  char *ptr = strchr(str,' ');
 456  if(!ptr)
 457  {
 458   ptr = strchr(str,'\t');
 459  }
 460
 461  if(ptr)
 462  {
 463   *ptr = 0;
 464   ptr++;
 465   while(*ptr == ' ' || *ptr == '\t')
 466   {
 467    ptr++;
 468   }
 469   return ptr;
 470  }
 471  else
 472  {
 473   return NULL;
 474  }
 475 }
 476
 477
 478 /*-----------------------------------------------------------------*/
 479 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 480 /*-----------------------------------------------------------------*/
 481
 482 program
 483 {
 484  int i=0;                    /* just plain old Fortran style integer :-) */
 485  FILE *f=NULL;               /* everything is just stream of bytes... */
 486  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 487  char *substring, *limit_pkts;
 488
 489  int parent        = 1;
 490  int just_networks = FALSE;
 491  int just_flush    = FALSE;       /* deactivates all previous actions */
 492  int nodelay       = FALSE;
 493  int just_preview  = FALSE;       /* preview - generate just stats */
 494  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 495  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 496  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 497  int just_logs     = FALSE;       /* just parse logs */
 498  int run           = FALSE;
 499  int total         = 0;
 500
 501  char *chain_forward, *chain_postrouting;
 502  char *althosts=NULL;
 503
 504  printf("\n\
 505 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 506 Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\
 507 iptables-restore & burst tunning & classify modification by Ludva\n\
 508 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 509
 510  /*----- Boring... we have to check command line options first: ----*/
 511  arguments
 512  {
 513   argument("-c") { nextargument(config); }
 514   argument("-h") { nextargument(althosts);}
 515   argument("-d") { run=TRUE; dry_run=TRUE; }
 516   argument("-f") { run=TRUE; just_flush=TRUE; }
 517   argument("-9") { run=TRUE; just_flush=9; }
 518   argument("-p") { run=TRUE; just_preview=TRUE; }
 519   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 520   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 521   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 522   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 523   argument("-r") { run=TRUE; }
 524   argument("-n") { run=TRUE; nodelay=TRUE; }
 525   argument("-a") { run=TRUE; just_networks=TRUE; }
 526   argument("-l") { just_logs=TRUE; }
 527   argument("-m") { just_logs=TRUE; }
 528   argument("-y") { just_logs=TRUE; }
 529   argument("-?") { help(); exit(0); }
 530   argument("--help") { help(); exit(0); }
 531   argument("-v") { exit(0); }
 532   argument("--version") { exit(0); }
 533  }
 534
 535  if(dry_run)
 536  {
 537   puts("*** THIS IS JUST DRY RUN ! ***\n");
 538  }
 539
 540  date(d); /* this is typical cll1.h macro - prints current date */
 541
 542  /*-----------------------------------------------------------------*/
 543  printf("Parsing configuration file %s ...\n", config);
 544  /*-----------------------------------------------------------------*/
 545  get_config(config);
 546
 547  if(just_logs)
 548  {
 549   parse_ip_log(argc,argv);
 550   exit(0);
 551  }
 552  else if(not run)
 553  {
 554   help();
 555   exit(0);
 556  }
 557
 558  if(althosts)
 559  {
 560   hosts = althosts;
 561  }
 562
 563  if(just_flush<9)
 564  {
 565   /*-----------------------------------------------------------------*/
 566   puts("Parsing iptables verbose output ...");
 567   /*-----------------------------------------------------------------*/
 568   get_traffic_statistics(iptables, FALSE);
 569   if(ip6prefix)
 570   {
 571    /*-----------------------------------------------------------------*/
 572    puts("Parsing ip6tables verbose output ...");
 573    /*-----------------------------------------------------------------*/
 574    get_traffic_statistics(ip6tables, TRUE);
 575   }
 576  }
 577
 578  /*-----------------------------------------------------------------*/
 579  /* cll1.h - let's allocate brand new character buffer...           */
 580  /*-----------------------------------------------------------------*/
 581  string(str, STRLEN);
 582  string(limit_pkts, STRLEN);
 583
 584  /*-----------------------------------------------------------------*/
 585  printf("Parsing macro definition file %s ...\n", macrosfile);
 586  /*-----------------------------------------------------------------*/
 587  parse(macrosfile)
 588  {
 589   ptr = parse_datafile_line(_);
 590   if(ptr)
 591   {
 592    create(macro, Macro);
 593    macro->rewrite_from = _;
 594    macro->rewrite_to = ptr;
 595    push(macro, macros);
 596    printf("%s -> %s\n", macro->rewrite_from, macro->rewrite_to);
 597   }
 598  }
 599  done; /* ugly macro end */
 600
 601  /*-----------------------------------------------------------------*/
 602  printf("Parsing class defintion file %s ...\n", hosts);
 603  /*-----------------------------------------------------------------*/
 604  parse_hosts(hosts);
 605  if(just_networks)
 606  {
 607   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 608   exit(-1);
 609  }
 610
 611  /*-----------------------------------------------------------------*/
 612  puts("Resolving shared connections ...");
 613  /*-----------------------------------------------------------------*/
 614  for_each(ip, ips) if(ip->sharing)
 615  {
 616   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 617   {
 618    sharedip->traffic += ip->traffic;
 619    ip->traffic = 0;
 620    ip->mark = sharedip->mark;
 621    ip->lmsid = sharedip->lmsid;
 622    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 623    break;
 624   }
 625   if(not sharedip)
 626   {
 627    printf("Unresolved shared connection: %s %s sharing-%s\n",
 628           ip->addr, ip->name, ip->sharing);
 629   }
 630  }
 631
 632  if(enable_credit && just_flush<9)
 633  {
 634   /*-----------------------------------------------------------------*/
 635   printf("Parsing credit file %s ...\n", credit);
 636   /*-----------------------------------------------------------------*/
 637   parse(credit)
 638   {
 639    ptr = parse_datafile_line(_);
 640    if(ptr)
 641    {
 642     if_exists(ip,ips,eq(ip->addr,_))
 643     {
 644      sscanf(ptr,"%Lu",&(ip->credit));
 645     }
 646    }
 647   }
 648   done; /* ugly macro end */
 649  }
 650
 651
 652  if(!just_preview)
 653  {
 654   /*-----------------------------------------------------------------*/
 655   puts("Initializing iptables and tc classes ...");
 656   /*-----------------------------------------------------------------*/
 657
 658   iptables_file = fopen(iptablesfile, "w");
 659   if(iptables_file == NULL)
 660   {
 661     perror(iptablesfile);
 662     exit(-1);
 663   }
 664   iptables_save_line(iptablespreamble, FALSE);
 665
 666   if(ip6prefix)
 667   {
 668    ip6tables_file = fopen(ip6tablesfile, "w");
 669    if(ip6tables_file == NULL)
 670    {
 671      perror(ip6tablesfile);
 672      exit(-1);
 673    }
 674    iptables_save_line(iptablespreamble, TRUE);
 675    iptables_save_line(ip6preamble, TRUE);
 676   }
 677
 678   run_iptables_restore();
 679
 680   log_file = fopen(cmdlog, "w");
 681   if(log_file == NULL)
 682   {
 683     perror(cmdlog);
 684     exit(-1);
 685   }
 686
 687   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 688   safe_run(str);
 689
 690   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 691   safe_run(str);
 692
 693   iptables_file=fopen(iptablesfile,"w");
 694   iptables_save_line(iptablespreamble, FALSE);
 695   if(ip6prefix)
 696   {
 697    ip6tables_file=fopen(ip6tablesfile,"w");
 698    iptables_save_line(iptablespreamble, TRUE);
 699    iptables_save_line(ip6preamble, TRUE);
 700   }
 701
 702   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 703   {
 704    char *chain;
 705
 706    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 707    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 708
 709 /*
 710    if(qos_proxy)
 711    {
 712     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 713     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 714     iptables_save_line(str , FALSE);
 715     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 716     iptables_save_line(str, FALSE);
 717     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 718     iptables_save_line(str, FALSE);
 719
 720     chain="post_noproxy";
 721    }
 722
 723    else
 724    {
 725 */
 726    chain = "POSTROUTING";
 727 //   }
 728
 729    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 730    iptables_save_line(str, FALSE);
 731   }
 732
 733   if(ip_count > idxtable_treshold1 && !just_flush)
 734   {
 735    int idxcount=0, bitmask=32-idxtable_bitmask1;
 736    char *subnet, *buf;
 737    /*-----------------------------------------------------------------*/
 738    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 739    /*-----------------------------------------------------------------*/
 740
 741    iptables_save_line(":post_common - [0:0]", FALSE);
 742    iptables_save_line(":forw_common - [0:0]", FALSE);
 743    if(ip6prefix)
 744    {
 745     iptables_save_line(":post_common - [0:0]", TRUE);
 746     iptables_save_line(":forw_common - [0:0]", TRUE);
 747    }
 748
 749    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 750    {
 751     if(ip->v6)
 752     {
 753      buf=index6_id(ip->addr,bitmask+32);
 754     }
 755     else
 756     {
 757      buf=index_id(ip->addr, bitmask);
 758     }
 759
 760     if_exists(idx,idxs,eq(idx->id,buf))
 761     {
 762      idx->children++;
 763     }
 764     else
 765     {
 766      create(idx,Index);
 767      idx->addr = ip->addr;
 768      idx->id = buf;
 769      idx->bitmask = bitmask+32*ip->v6;
 770      idx->parent = NULL;
 771      idx->children = 0;
 772      idx->ipv6 = ip->v6;
 773      idxcount++;
 774      push(idx,idxs);
 775     }
 776    }
 777
 778    /* brutal perfomance optimalization */
 779    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 780    {
 781     bitmask -= idxtable_bitmask2;
 782     idxcount = 0;
 783
 784     for_each(idx,idxs) if(idx->parent == NULL)
 785     {
 786      if(idx->ipv6)
 787      {
 788       buf = index6_id(idx->addr, bitmask+32);
 789      }
 790      else
 791      {
 792       buf = index_id(idx->addr, bitmask);
 793      }
 794      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 795      {
 796       metaindex->children++;
 797      }
 798      else
 799      {
 800       create(metaindex,Index);
 801       metaindex->addr = idx->addr;
 802       metaindex->id = buf;
 803       metaindex->bitmask = bitmask+32*idx->ipv6;
 804       metaindex->parent = NULL;
 805       metaindex->children = 0;
 806       metaindex->ipv6 = idx->ipv6;
 807       idxcount++;
 808       push(metaindex,idxs);
 809      }
 810      idx->parent=metaindex;
 811     }
 812    }
 813
 814    /* this should slightly optimize throughput ... */
 815    sort(idx,idxs,desc_order_by,children);
 816    sort(idx,idxs,order_by,bitmask);
 817
 818    i=0;
 819    for_each(idx,idxs)
 820    {
 821     if(idx->ipv6)
 822     {
 823      subnet=subnet6_id(idx->addr, idx->bitmask);
 824     }
 825     else
 826     {
 827      subnet=subnet_id(idx->addr, idx->bitmask);
 828     }
 829     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 830
 831     sprintf(str,":post_%s - [0:0]", idx->id);
 832     iptables_save_line(str, idx->ipv6);
 833
 834     sprintf(str,":forw_%s - [0:0]", idx->id);
 835     iptables_save_line(str, idx->ipv6);
 836
 837     if(idx->parent)
 838     {
 839      string(buf,strlen(idx->parent->id)+6);
 840      sprintf(buf,"post_%s", idx->parent->id);
 841     }
 842     else
 843     {
 844      buf="POSTROUTING";
 845     }
 846
 847     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 848     iptables_save_line(str, idx->ipv6);
 849
 850     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 851     iptables_save_line(str, idx->ipv6);
 852
 853     if(idx->parent)
 854     {
 855      string(buf,strlen(idx->parent->id)+6);
 856      sprintf(buf,"forw_%s",idx->parent->id);
 857     }
 858     else
 859     {
 860      buf="FORWARD";
 861     }
 862
 863     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 864     iptables_save_line(str, idx->ipv6);
 865
 866     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 867     iptables_save_line(str, idx->ipv6);
 868    }
 869    printf("Total indexed iptables chains created: %d\n", i);
 870
 871    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 872    iptables_save_line(str, FALSE);
 873
 874    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 875    iptables_save_line(str, FALSE);
 876
 877    if(ip6prefix)
 878    {
 879     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 880     iptables_save_line(str, TRUE);
 881
 882     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 883     iptables_save_line(str, TRUE);
 884    }
 885   }
 886  }
 887
 888  if(just_flush)
 889  {
 890   fclose(iptables_file);
 891   if(log_file)
 892   {
 893    fclose(log_file);
 894   }
 895   puts("Just flushed iptables and tc classes - now exiting ...");
 896   exit(0);
 897  }
 898
 899  if(!just_preview)
 900  {
 901   if(!dry_run && !nodelay && qos_free_delay)
 902   {
 903    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 904    sleep(qos_free_delay);
 905   }
 906
 907   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 908               tc,lan,htb_r2q);
 909   safe_run(str);
 910
 911   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 912                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 913   safe_run(str);
 914
 915   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 916                 tc,lan,line,line,burst_main,highest_priority);
 917   safe_run(str);
 918
 919   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 920   safe_run(str);
 921
 922   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 923                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 924   safe_run(str);
 925
 926   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 927                tc,wan,up,up,burst_main,highest_priority);
 928   safe_run(str);
 929  }
 930
 931  /*-----------------------------------------------------------------*/
 932  puts("Locating heavy downloaders and generating root classes ...");
 933  /*-----------------------------------------------------------------*/
 934  sort(ip,ips,desc_order_by,traffic);
 935
 936  /*-----------------------------------------------------------------*/
 937  /* sub-scope - local variables */
 938  {
 939   long long int rate = line;
 940   long long int max = line;
 941   int group_count = 0;
 942   FILE *credit_file = NULL;
 943
 944   if(!just_preview && !dry_run && enable_credit)
 945   {
 946    credit_file = fopen(credit,"w");
 947   }
 948
 949   for_each(group,groups)
 950   {
 951    if(!just_preview)
 952    {
 953     //download
 954     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 955                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 956     safe_run(str);
 957
 958     //upload
 959     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 960                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 961     safe_run(str);
 962    }
 963
 964    if(group_count++ < max_nesting)
 965    {
 966     parent = group->id;
 967    }
 968
 969    rate -= digital_divide*group->min;
 970    if(rate < group->min)
 971    {
 972     rate = group->min;
 973    }
 974
 975    /*shaping of aggresive downloaders, with credit file support */
 976    if(use_credit)
 977    {
 978     int group_rate = group->min, priority_sequence = lowest_priority;
 979
 980     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 981     {
 982      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 983      if(     ip->keyword->data_limit
 984          and not ip->fixedprio
 985          and ip->traffic > ip->realquota )
 986      {
 987       if(group_rate < ip->max)
 988       {
 989        ip->max = group_rate;
 990       }
 991       group_rate+=magic_treshold;
 992       ip->prio=lowest_priority;
 993       if(ip->prio<highest_priority+2)
 994       {
 995        ip->prio=highest_priority+2;
 996       }
 997      }
 998      else
 999      {
1000       if(    ip->keyword->data_prio
1001           && !ip->fixedprio
1002           && (   ip->traffic>ip->credit
1003                + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
1004       {
1005        ip->prio=priority_sequence--;
1006        if(ip->prio<highest_priority+1)
1007        {
1008         ip->prio=highest_priority+1;
1009        }
1010       }
1011
1012       if(credit_file)
1013       {
1014        unsigned long long lcredit=0;
1015
1016        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
1017        {
1018         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
1019        }
1020        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
1021       }
1022      }
1023     }
1024    }
1025   }
1026   if(credit_file)
1027   {
1028    fclose(credit_file);
1029   }
1030  }
1031
1032  if(just_preview)
1033  {
1034   if(start_shaping || stop_shaping || reduce_ceil)
1035   {
1036    printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
1037    parse(classmap)
1038    {
1039     ptr=strchr(_,' ');
1040     if(ptr)
1041     {
1042      *ptr=0;
1043      ptr++;
1044      if_exists(ip,ips,eq(ip->addr,_))
1045      {
1046       ip->mark=atoi(ptr);
1047       if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */
1048       {
1049        if(stop_shaping)
1050        {
1051         ip->max = ip->desired;
1052         printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1053        }
1054        else
1055        {
1056         printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1057         if(reduce_ceil)
1058         {
1059          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1060         }
1061        }
1062        printf("(down: %dk-%dk ", ip->min, ip->max);
1063        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1064                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1065        safe_run(str);
1066        printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1067                                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1068        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1069                     tc, wan, ip->group, ip->mark,
1070                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1071                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1072        safe_run(str);
1073       }
1074      }
1075     }
1076    }
1077    fail
1078    {
1079     perror(classmap);
1080     puts("Warning - classmap file not fund, just generating preview ...");
1081     start_shaping=FALSE;
1082     stop_shaping=FALSE;
1083    }
1084    done; /* ugly macro end */
1085   }
1086   html=preview;
1087   json_traffic=json_preview;
1088  }
1089
1090  if(!dry_run && !just_flush)
1091  {
1092   /*-----------------------------------------------------------------*/
1093   printf("Writing json traffic overview  %s ... ", json_traffic);
1094   /*-----------------------------------------------------------------*/
1095   write_json_traffic(json_traffic);
1096
1097   /*-----------------------------------------------------------------*/
1098   printf("Writing statistics into HTML page %s ...\n", html);
1099   /*-----------------------------------------------------------------*/
1100   write_htmlandlogs(html, d, total, just_preview);
1101  }
1102
1103  if(just_preview)
1104  {
1105   char swchar='p';
1106   if(start_shaping)
1107   {
1108    swchar='s';
1109   }
1110   else if(reduce_ceil)
1111   {
1112    swchar='0'+reduce_ceil; /* -2, -4 */
1113   }
1114   else if(stop_shaping)
1115   {
1116    swchar='q';
1117   }
1118
1119   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1120   exit(0);
1121  }
1122
1123  i=0;
1124 #ifdef DEBUG
1125  printf("%-22s %-15s mark\n","name","ip");
1126 #endif
1127
1128  printf("Writing %s", classmap);
1129  f = fopen(classmap, "w");
1130  if(f < 0)
1131  {
1132   perror(classmap);
1133  }
1134
1135  /*-----------------------------------------------------------------*/
1136  printf(" + generating iptables and tc classes ... ");
1137  /*-----------------------------------------------------------------*/
1138
1139  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1140  {
1141   if(idxs)
1142   {
1143    char *buf;
1144    duplicate(ip->addr,buf);
1145    if(ip->v6)
1146    {
1147     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1148    }
1149    else
1150    {
1151     buf=index_id(ip->addr,32-idxtable_bitmask1);
1152    }
1153
1154    string(chain_forward,6+strlen(buf));
1155    strcpy(chain_forward,"forw_");
1156    strcat(chain_forward,buf);
1157
1158    string(chain_postrouting,6+strlen(buf));
1159    strcpy(chain_postrouting,"post_");
1160    strcat(chain_postrouting,buf);
1161
1162    free(buf);
1163   }
1164   else
1165   {
1166    chain_forward="FORWARD";
1167    chain_postrouting="POSTROUTING";
1168   }
1169
1170   /* packet limits - this will be optional in future */
1171   if(ip->pps_limit)
1172   {
1173    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1174                        ip->pps_limit, ip->pps_limit);
1175   }
1176   else
1177   {
1178    *limit_pkts = 0;
1179   }
1180
1181 #ifdef DEBUG
1182   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1183 #endif
1184
1185   /* -------------------------------------------------------- mark download */
1186   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1187                chain_postrouting, ip->addr, 32*(1+ip->v6),
1188                lan, mark_iptables, ip->mark);
1189   iptables_save_line(str, ip->v6);
1190
1191 /*
1192   if(qos_proxy)
1193   {
1194    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1195                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1196                 32*(1+ip->v6), lan, mark_iptables, ip->mark);
1197    iptables_save_line(str, ip->v6);
1198   }
1199 */
1200   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1201                chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);
1202   iptables_save_line(str, ip->v6);
1203
1204   /* classify overlimit packets to separate overlimit class */
1205   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1206                chain_postrouting, ip->addr, 32*(1+ip->v6),
1207                lan, mark_iptables, OVERLIMIT_CLASS);
1208   iptables_save_line(str, ip->v6);
1209
1210   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1211                chain_postrouting, ip->addr, 32*(1+ip->v6), lan);
1212   iptables_save_line(str, ip->v6);
1213
1214   /* -------------------------------------------------------- mark upload */
1215   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1216                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);
1217   iptables_save_line(str, ip->v6);
1218
1219   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1220                chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);
1221   iptables_save_line(str, ip->v6);
1222
1223   /* classify overlimit packets to separate overlimit class */
1224   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1225                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, OVERLIMIT_CLASS);
1226   iptables_save_line(str, ip->v6);
1227
1228   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1229                chain_forward, ip->addr, 32*(1+ip->v6), wan);
1230   iptables_save_line(str, ip->v6);
1231
1232   if(ip->min)
1233   {
1234    /* -------------------------------------------------------- download class */
1235 #ifdef DEBUG
1236    printf("(down: %dk-%dk ", ip->min, ip->max);
1237 #endif
1238
1239    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1240                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1241    safe_run(str);
1242
1243    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1244    {
1245     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1246                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1247     safe_run(str);
1248    }
1249
1250    if(filter_type == 1)
1251    {
1252     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1253                  tc, lan, ip->mark, ip->mark);
1254     safe_run(str);
1255    }
1256
1257    /* -------------------------------------------------------- upload class */
1258 #ifdef DEBUG
1259    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1260                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1261 #endif
1262
1263    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1264                 tc, wan, ip->group, ip->mark,
1265                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1266                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1267    safe_run(str);
1268
1269    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1270    {
1271     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1272                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1273     safe_run(str);
1274    }
1275
1276    if(filter_type == 1)
1277    {
1278     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1279                  tc, wan, ip->mark, ip->mark);
1280     safe_run(str);
1281    }
1282
1283    if(f > 0)
1284    {
1285     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1286    }
1287   }
1288   else
1289   {
1290 #ifdef DEBUG
1291    printf("(sharing %s)\n", ip->sharing);
1292 #endif
1293   }
1294   i++;
1295  }
1296  if(f > 0)
1297  {
1298   puts("done.");
1299   fclose(f);
1300  }
1301
1302  if(idxs)
1303  {
1304   chain_forward = "forw_common";
1305   chain_postrouting = "post_common";
1306  }
1307  else
1308  {
1309   chain_forward = "FORWARD";
1310   chain_postrouting = "POSTROUTING";
1311  }
1312
1313  if(free_min)
1314  {
1315   final_chain = "ACCEPT";
1316  }
1317
1318 /*
1319  if(qos_proxy)
1320  {
1321   if(free_min)
1322   {
1323    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1324                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1325    iptables_save_line(str, FALSE); // only for IPv4
1326   }
1327   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1328                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1329   iptables_save_line(str, FALSE); // only for IPv4
1330  }
1331 */
1332
1333  if(free_min)
1334  {
1335   sprintf(str, "-A %s -o %s -j %s%d",
1336                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1337   iptables_save_line(str, FALSE); /* only for IPv4 */
1338  }
1339
1340  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1341  iptables_save_line(str, FALSE);
1342  if(ip6prefix)
1343  {
1344   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1345   iptables_save_line(str, TRUE);
1346  }
1347
1348  if(free_min)
1349  {
1350   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1351   iptables_save_line(str, FALSE); /* only for IPv4 */
1352  }
1353
1354  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1355  iptables_save_line(str, FALSE);
1356  if(ip6prefix)
1357  {
1358   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1359   iptables_save_line(str, TRUE);
1360  }
1361
1362  if(free_min) /* allocate free bandwith if it is not zero... */
1363  {
1364    /*-----------------------------------------------------------------*/
1365    puts("Generating free bandwith class ...");
1366    /*-----------------------------------------------------------------*/
1367    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1368                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1369    safe_run(str);
1370    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1371                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1372    safe_run(str);
1373    /* tc SFQ */
1374    if(strcmpi(qos_leaf, "none"))
1375    {
1376      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1377      safe_run(str);
1378
1379      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1380      safe_run(str);
1381    }
1382    /* tc handle 1 fw flowid */
1383    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1384    safe_run(str);
1385
1386    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1387    safe_run(str);
1388
1389    /*-----------------------------------------------------------------*/
1390    puts("Generating bandwith class for overlimit packets...");
1391    /*-----------------------------------------------------------------*/
1392    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1393                 tc, lan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1394    safe_run(str);
1395    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1396                 tc, wan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1397    safe_run(str);
1398  }
1399  printf("Total IP count: %d\n", i);
1400  run_iptables_restore();
1401  if(log_file)
1402  {
1403   fclose(log_file);
1404  }
1405  return 0;
1406  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1407  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1408 }