prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         *//* "fair-per-IP" quality of service (QoS) utility              */
   3 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   4 /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace     */
   5 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   6 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   7 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   8
   9 /* Modified by: xChaos, 20130124
  10                  ludva, 20080415
  11
  12    Prometheus QoS is free software; you can redistribute it and/or
  13    modify it under the terms of the GNU General Public License as
  14    published by the Free Software Foundation; either version 2.1 of
  15    the License, or (at your option) any later version.
  16
  17    Prometheus QoS is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  20    General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with Prometheus Qos; if not, write to the Free Software
  24    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  25
  26    GNU General Public License is located in file COPYING */
  27
  28 #include "cll1-0.6.2.h"
  29 #include "ipstruct.h"
  30
  31 const char *version = "0.8.3-i";
  32
  33 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  34 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  35 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  36 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  37 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  38 /* CZK donations account: 2900242944/2010 (transparent account)    */
  39 /* Warning: unofficial Github mirror is not supported by author!  */
  40 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  41
  42 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2013 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  43
  44 #define STRLEN 512
  45 #undef DEBUG
  46
  47 /* ======= All path names are defined here (for RPM patch) =======  */
  48
  49 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  50 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  51 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  52 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  53 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  54 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  55 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  56 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  57
  58 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  59 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  60 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  61 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  62 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  63 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  64 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  65 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  66 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  67 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  68 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  69 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  70 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  71 char    *html_log_dir = "/var/www/logs/html/";
  72
  73 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  74 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  75 int use_jquery_popups = TRUE;
  76 int      row_odd_even = 0; /*<tr class="odd/even"> */
  77
  78 /* === Configuraration file values defaults - stored in global variables ==== */
  79
  80 int        filter_type = 1; /*1 mark, 2 classify*/
  81 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  82 char             *mark = "MARK";
  83 char    *mark_iptables = "MARK --set-mark ";
  84 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  85 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  86 FILE    *iptables_file = NULL;
  87 FILE   *ip6tables_file = NULL;
  88 int      enable_credit = TRUE; /* enable credit file */
  89 int         use_credit = FALSE; /* use credit file (if enabled)*/
  90 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  91 int       hall_of_fame = TRUE; /* enable hall of fame */
  92 char              *lan = "eth0"; /* LAN interface */
  93 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  94 char              *wan = "eth1"; /* WAN/ISP interface */
  95 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  96 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  97 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
  98 char    *qos_free_zone = NULL; /* QoS free zone */
  99 int          qos_proxy = TRUE; /* include proxy port to QoS */
 100 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 101 int     include_upload = TRUE; /* upload+download=total traffic */
 102 char         *proxy_ip = "192.168.1.1/32"; /* our IP with proxy port */
 103 int         proxy_port = 3128; /* proxy port number */
 104 long long int     line = 1024; /* WAN/ISP download in kbps */
 105 long long int       up = 1024; /* WAN/ISP upload in kbps */
 106 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 107 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 108 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 109 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 110 int        max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */
 111 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 112 int              burst = 8; /* HTB burst (in kbits) */
 113 int         burst_main = 64;
 114 int        burst_group = 32;
 115 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 116 int       keywordcount = 0;
 117 int        class_count = 0;
 118 int           ip_count = 0;
 119 /* not yet implemented:
 120 int      fixed_packets = 0; maximum number of pps per IP address (not class!)
 121 int       packet_limit = 5; maximum number of pps to htn CEIL, not rate !!!
 122 */
 123 FILE         *log_file = NULL;
 124 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 125
 126 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 127 const int lowest_priority    = 7; /* lowest HTB priority (HTB built-in value is 7) */
 128 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 129 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 130 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 131 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 132
 133 struct IP *ips = NULL, *ip, *sharedip;
 134 struct Group *groups = NULL, *group;
 135 struct Keyword *keyword, *defaultkeyword=NULL, *keywords=NULL;
 136
 137 void help(void);
 138 /* implemented in help.c */
 139
 140 void get_traffic_statistics(const char *whichiptables);
 141 /* implemented in parseiptables.c */
 142
 143 void parse_ip_log(int argc, char **argv);
 144 /* implemented in parselog.c */
 145
 146 void parse_hosts(char *hosts);
 147 /* implemented in parsehosts.c */
 148
 149 void write_json_traffic(char *json);
 150 /* implemented in json.c */
 151
 152 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 153 /* implemented in htmlandlogs.c */
 154
 155 const char *tr_odd_even(void)
 156 {
 157  row_odd_even = 1 - row_odd_even;
 158  if(row_odd_even)
 159  {
 160   return "<tr class=\"even\">\n";
 161  }
 162  else
 163  {
 164   return "<tr class=\"odd\">\n";
 165  }
 166 }
 167
 168 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 169 /* (except that this code uses obsolete, archaic version of this header file...)     */
 170
 171 struct Index
 172 {
 173  char *addr;
 174  char *id;
 175  struct Index *parent;
 176  int bitmask;
 177  int children;
 178  int ipv6;
 179  list(Index);
 180 } *idxs=NULL, *idx, *metaindex;
 181
 182
 183 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 184
 185 char *index_id(char *ip, int bitmask);
 186 /* function implemented in ipv4subnets.c */
 187
 188 char *subnet_id(char *ip, int bitmask);
 189 /* function implemented in ipv4subnets.c */
 190
 191 char *index6_id(char *ip, int bitmask);
 192 /* function implemented in ipv6subnets.c */
 193
 194 char *subnet6_id(char *ip, int bitmask);
 195 /* function implemented in ipv6subnets.c */
 196
 197 /* ================= Let's parse configuration file here ================ */
 198
 199 void reject_config_and_exit(char *filename)
 200 {
 201  printf("Configuration file %s rejected - abnormal exit.",filename);
 202  exit(-1);
 203 }
 204
 205 void get_config(char *config_filename)
 206 {
 207  char *cnf="mark";
 208
 209  printf("Configured keywords: ");
 210  parse(config_filename)
 211  {
 212   option("keyword",kwd);
 213   if(kwd)
 214   {
 215    printf("%s ",kwd);
 216
 217    create(keyword,Keyword);
 218    keyword->key=kwd;
 219    keyword->asymetry_ratio=1;          /* ratio for ADSL-like upload */
 220    keyword->asymetry_fixed=0;          /* fixed treshold for ADSL-like upload */
 221    keyword->data_limit=8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 222    keyword->data_prio=4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 223    keyword->fixed_limit=0;             /* fixed data limit for setting lower HTB ceil */
 224    keyword->fixed_prio=0;              /* fixed data limit for setting lower HTB prio */
 225    keyword->reserve_min=8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 226    keyword->reserve_max=0;             /* malus for nominal HTB ceil (in kbps) */
 227    keyword->default_prio=highest_priority+1;
 228    keyword->html_color="000000";
 229    keyword->ip_count=0;
 230    keyword->leaf_discipline="";
 231
 232    push(keyword,keywords);
 233    if(!defaultkeyword)
 234    {
 235     defaultkeyword=keyword;
 236    }
 237    keywordcount++;
 238
 239    kwd=NULL;
 240   }
 241   else
 242   {
 243     for_each(keyword,keywords)
 244     {
 245      int l=strlen(keyword->key);
 246
 247      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 248      {
 249       char *tmptr=_; /*  <---- l+1 ----> */
 250       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 251       ioption("asymetry-ratio",keyword->asymetry_ratio);
 252       ioption("asymetry-treshold",keyword->asymetry_fixed);
 253       ioption("magic-relative-limit",keyword->data_limit);
 254       ioption("magic-relative-prio",keyword->data_prio);
 255       loption("magic-fixed-limit",keyword->fixed_limit);
 256       loption("magic-fixed-prio",keyword->fixed_prio);
 257       ioption("htb-default-prio",keyword->default_prio);
 258       ioption("htb-rate-bonus",keyword->reserve_min);
 259       ioption("htb-ceil-malus",keyword->reserve_max);
 260       option("leaf-discipline",keyword->leaf_discipline);
 261       option("html-color",keyword->html_color);
 262       _=tmptr;
 263
 264       if(keyword->data_limit || keyword->fixed_limit ||
 265          keyword->data_prio || keyword->fixed_prio)
 266       {
 267        use_credit=1;
 268       }
 269      }
 270     }
 271   }
 272
 273   option("tc",tc);
 274   option("iptables",iptables);
 275   option("iptables-save",iptablessave);
 276   option("iptables-restore",iptablesrestore);
 277   option("ip6tables",ip6tables);
 278   option("ip6tables-save",ip6tablessave);
 279   option("ip6tables-restore",ip6tablesrestore);
 280   option("iptables-in-filename",iptablesfile);
 281   option("ip6tables-in-filename",ip6tablesfile);
 282   option("hosts",hosts);
 283   option("lan-interface",lan);
 284   option("wan-interface",wan);
 285   option("ip6-prefix",ip6prefix);
 286   option("lan-medium",lan_medium);
 287   option("wan-medium",wan_medium);
 288   lloption("wan-download",line);
 289   lloption("wan-upload",up);
 290   ioption("hall-of-fame-enable",hall_of_fame);
 291   option("hall-of-fame-title",title);
 292   option("hall-of-fame-filename",html);
 293   option("json-filename",json_traffic);
 294   option("hall-of-fame-preview",preview);
 295   option("json-preview",json_preview);
 296   option("log-filename",cmdlog);
 297   option("credit-filename",credit);
 298   option("classmap-filename",classmap);
 299   ioption("credit-enable",enable_credit);
 300   option("log-traffic-directory",log_dir);
 301   option("log-traffic-html-directory",html_log_dir);
 302   option("log-traffic-url-path",log_url);
 303   option("jquery-url",jquery_url);
 304   option("lms-url",lms_url);
 305   ioption("use-jquery-popups",use_jquery_popups);
 306   option("qos-free-zone",qos_free_zone);
 307   ioption("qos-free-delay",qos_free_delay);
 308   ioption("qos-proxy-enable",qos_proxy);
 309   option("qos-proxy-ip",proxy_ip);
 310   option("htb-leaf-discipline",qos_leaf);
 311   ioption("qos-proxy-port",proxy_port);
 312   ioption("free-rate",free_min);
 313   ioption("free-ceil",free_max);
 314   ioption("htb-burst",burst);
 315   ioption("htb-burst-main",burst_main);
 316   ioption("htb-burst-group",burst_group);
 317   ioption("htb-nesting-limit",max_nesting);
 318   ioption("htb-r2q",htb_r2q);
 319   ioption("magic-include-upload",include_upload);
 320   ioption("magic-treshold",magic_treshold);
 321   option("filter-type", cnf);
 322 /* not yet implemented:
 323   ioption("magic-fixed-packets",fixed_packets);
 324   ioption("magic-relative-packets",packet_limit);
 325 */
 326  }
 327  fail
 328  {
 329   perror(config_filename);
 330   puts("Warning - using built-in defaults instead ...");
 331  }
 332  done; /* ugly macro end */
 333  printf("\n");
 334
 335  /* leaf discipline for keywords */
 336  for_each(keyword,keywords)
 337  {
 338     if(!strcmpi(keyword->leaf_discipline, ""))
 339     {
 340         keyword->leaf_discipline = qos_leaf;
 341     }
 342  }
 343
 344  if(strcmpi(cnf, "mark"))
 345  {
 346   filter_type = 2;
 347   mark = "CLASSIFY";
 348   mark_iptables = "CLASSIFY --set-class 1:";
 349  }
 350  else
 351  {
 352   filter_type = 1;
 353   mark = "MARK";
 354   mark_iptables = "MARK --set-mark ";
 355  }
 356
 357  /* are supplied values meaningful ?*/
 358  if(line<=0 || up<=0)
 359  {
 360   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 361   reject_config_and_exit(config_filename);
 362  }
 363 }
 364
 365
 366 /* ========== This function executes, logs OR ALSO prints command ========== */
 367
 368 void safe_run(char *cmd)
 369 {
 370  if(dry_run)
 371  {
 372   printf("\n=>%s\n",cmd);
 373  }
 374  else
 375  {
 376   system(cmd);
 377  }
 378  if(log_file)
 379  {
 380   fprintf(log_file,"%s\n",cmd);
 381  }
 382 }
 383
 384 void iptables_save_line(char *line, int ipv6)
 385 {
 386  if(ipv6)
 387  {
 388   fprintf(ip6tables_file,"%s\n",line);
 389  }
 390  else
 391  {
 392   fprintf(iptables_file,"%s\n",line);
 393  }
 394 }
 395
 396 void run_iptables_restore(void)
 397 {
 398  char *restor;
 399  string(restor,STRLEN);
 400
 401  /*-----------------------------------------------------------------*/
 402  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 403  /*-----------------------------------------------------------------*/
 404
 405  iptables_save_line("COMMIT", FALSE);
 406  fclose(iptables_file);
 407  if(dry_run)
 408  {
 409   parse(iptablesfile)
 410   {
 411    printf("%s\n",_);
 412   }
 413   done; /* ugly macro end */
 414  }
 415
 416  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 417  safe_run(restor);
 418
 419  if(ip6prefix)
 420  {
 421   /*-----------------------------------------------------------------*/
 422   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 423   /*-----------------------------------------------------------------*/
 424   iptables_save_line("COMMIT", TRUE);
 425   fclose(ip6tables_file);
 426   if(dry_run)
 427   {
 428    parse(ip6tablesfile)
 429    {
 430     printf("%s\n",_);
 431    }
 432    done; /* ugly macro end */
 433   }
 434   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 435   safe_run(restor);
 436  }
 437  free(restor);
 438 }
 439
 440 char *parse_datafile_line(char *str)
 441 {
 442  char *ptr=strchr(str,' ');
 443
 444  if(ptr)
 445  {
 446   *ptr=0;
 447   ptr++;
 448   return ptr;
 449  }
 450  else
 451  {
 452   return NULL;
 453  }
 454 }
 455
 456
 457 /*-----------------------------------------------------------------*/
 458 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 459 /*-----------------------------------------------------------------*/
 460
 461 program
 462 {
 463  int i=0;                    /* just plain old Fortran style integer :-) */
 464  FILE *f=NULL;               /* everything is just stream of bytes... */
 465  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 466  char *substring;
 467
 468  int parent        = 1;
 469  int just_flush    = FALSE;       /* deactivates all previous actions */
 470  int nodelay       = FALSE;
 471  int just_preview  = FALSE;       /* preview - generate just stats */
 472  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 473  int just_logs     = FALSE;       /* just parse logs */
 474  int run           = FALSE;
 475  int total         = 0;
 476
 477  char *chain_forward, *chain_postrouting;
 478  char *althosts=NULL;
 479
 480  printf("\n\
 481 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 482 Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\
 483 iptables-restore & burst tunning & classify modification by Ludva\n\
 484 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 485
 486  /*----- Boring... we have to check command line options first: ----*/
 487  arguments
 488  {
 489   argument("-c") { nextargument(config); }
 490   argument("-h") { nextargument(althosts);}
 491   argument("-d") { run=TRUE; dry_run=TRUE; }
 492   argument("-f") { run=TRUE; just_flush=TRUE; }
 493   argument("-9") { run=TRUE; just_flush=9; }
 494   argument("-p") { run=TRUE; just_preview=TRUE; }
 495   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 496   argument("-r") { run=TRUE; }
 497   argument("-n") { run=TRUE; nodelay=TRUE; }
 498   argument("-l") { just_logs=TRUE; }
 499   argument("-m") { just_logs=TRUE; }
 500   argument("-y") { just_logs=TRUE; }
 501   argument("-?") { help(); exit(0); }
 502   argument("--help") { help(); exit(0); }
 503   argument("-v") { exit(0); }
 504   argument("--version") { exit(0); }
 505  }
 506
 507  if(dry_run)
 508  {
 509   puts("*** THIS IS JUST DRY RUN ! ***\n");
 510  }
 511
 512  date(d); /* this is typical cll1.h macro - prints current date */
 513
 514  /*-----------------------------------------------------------------*/
 515  printf("Parsing configuration file %s ...\n", config);
 516  /*-----------------------------------------------------------------*/
 517  get_config(config);
 518
 519  if(just_logs)
 520  {
 521   parse_ip_log(argc,argv);
 522   exit(0);
 523  }
 524  else if(not run)
 525  {
 526   help();
 527   exit(0);
 528  }
 529
 530  if(althosts)
 531  {
 532   hosts=althosts;
 533  }
 534
 535  if(just_flush<9)
 536  {
 537   /*-----------------------------------------------------------------*/
 538   puts("Parsing iptables verbose output ...");
 539   /*-----------------------------------------------------------------*/
 540   get_traffic_statistics(iptables);
 541   if(ip6prefix)
 542   {
 543    /*-----------------------------------------------------------------*/
 544    puts("Parsing ip6tables verbose output ...");
 545    /*-----------------------------------------------------------------*/
 546    get_traffic_statistics(ip6tables);
 547   }
 548  }
 549
 550  /*-----------------------------------------------------------------*/
 551  printf("Parsing class defintion file %s ...\n", hosts);
 552  /*-----------------------------------------------------------------*/
 553  parse_hosts(hosts);
 554
 555  /*-----------------------------------------------------------------*/
 556  /* cll1.h - let's allocate brand new character buffer...           */
 557  /*-----------------------------------------------------------------*/
 558  string(str,STRLEN);
 559
 560  /*-----------------------------------------------------------------*/
 561  puts("Resolving shared connections ...");
 562  /*-----------------------------------------------------------------*/
 563  for_each(ip,ips) if(ip->sharing)
 564  {
 565   for_each(sharedip,ips) if(eq(sharedip->name,ip->sharing))
 566   {
 567    sharedip->traffic+=ip->traffic;
 568    ip->traffic=0;
 569    ip->mark=sharedip->mark;
 570    ip->lmsid=sharedip->lmsid;
 571    break;
 572   }
 573   if(not sharedip)
 574   {
 575    printf("Unresolved shared connection: %s %s sharing-%s\n",
 576           ip->addr, ip->name, ip->sharing);
 577   }
 578  }
 579
 580  if(enable_credit && just_flush<9)
 581  {
 582   /*-----------------------------------------------------------------*/
 583   printf("Parsing credit file %s ...\n", credit);
 584   /*-----------------------------------------------------------------*/
 585   parse(credit)
 586   {
 587    ptr=parse_datafile_line(_);
 588    if(ptr)
 589    {
 590     if_exists(ip,ips,eq(ip->addr,_))
 591     {
 592      sscanf(ptr,"%Lu",&(ip->credit));
 593     }
 594    }
 595   }
 596   done; /* ugly macro end */
 597  }
 598
 599  if(!just_preview)
 600  {
 601   /*-----------------------------------------------------------------*/
 602   puts("Initializing iptables and tc classes ...");
 603   /*-----------------------------------------------------------------*/
 604
 605   iptables_file = fopen(iptablesfile, "w");
 606   if(iptables_file == NULL)
 607   {
 608     perror(iptablesfile);
 609     exit(-1);
 610   }
 611   iptables_save_line(iptablespreamble, FALSE);
 612
 613   if(ip6prefix)
 614   {
 615    ip6tables_file = fopen(ip6tablesfile, "w");
 616    if(ip6tables_file == NULL)
 617    {
 618      perror(ip6tablesfile);
 619      exit(-1);
 620    }
 621    iptables_save_line(iptablespreamble, TRUE);
 622   }
 623
 624   run_iptables_restore();
 625
 626   log_file = fopen(cmdlog, "w");
 627   if(log_file == NULL)
 628   {
 629     perror(cmdlog);
 630     exit(-1);
 631   }
 632
 633
 634   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 635   safe_run(str);
 636
 637   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 638   safe_run(str);
 639
 640   iptables_file=fopen(iptablesfile,"w");
 641   iptables_save_line(iptablespreamble, FALSE);
 642   if(ip6prefix)
 643   {
 644    ip6tables_file=fopen(ip6tablesfile,"w");
 645    iptables_save_line(iptablespreamble, TRUE);
 646   }
 647
 648   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 649   {
 650    char *chain;
 651
 652    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 653    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 654
 655    if(qos_proxy)
 656    {
 657     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 658     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 659     iptables_save_line(str , FALSE);
 660     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 661     iptables_save_line(str, FALSE);
 662     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 663     iptables_save_line(str, FALSE);
 664
 665     chain="post_noproxy";
 666    }
 667    else
 668    {
 669     chain="POSTROUTING";
 670    }
 671
 672    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 673    iptables_save_line(str, FALSE);
 674   }
 675
 676   if(ip_count > idxtable_treshold1 && !just_flush)
 677   {
 678    int idxcount=0, bitmask=32-idxtable_bitmask1;
 679    char *subnet, *buf;
 680    /*-----------------------------------------------------------------*/
 681    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 682    /*-----------------------------------------------------------------*/
 683
 684    iptables_save_line(":post_common - [0:0]", FALSE);
 685    iptables_save_line(":forw_common - [0:0]", FALSE);
 686    if(ip6prefix)
 687    {
 688     iptables_save_line(":post_common - [0:0]", TRUE);
 689     iptables_save_line(":forw_common - [0:0]", TRUE);
 690    }
 691
 692    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 693    {
 694     if(ip->v6)
 695     {
 696      buf=index6_id(ip->addr,bitmask+32);
 697     }
 698     else
 699     {
 700      buf=index_id(ip->addr, bitmask);
 701     }
 702
 703     if_exists(idx,idxs,eq(idx->id,buf))
 704     {
 705      idx->children++;
 706     }
 707     else
 708     {
 709      create(idx,Index);
 710      idx->addr = ip->addr;
 711      idx->id = buf;
 712      idx->bitmask = bitmask+32*ip->v6;
 713      idx->parent = NULL;
 714      idx->children = 0;
 715      idx->ipv6 = ip->v6;
 716      idxcount++;
 717      push(idx,idxs);
 718     }
 719    }
 720
 721    /* brutal perfomance optimalization */
 722    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 723    {
 724     bitmask -= idxtable_bitmask2;
 725     idxcount = 0;
 726
 727     for_each(idx,idxs) if(idx->parent == NULL)
 728     {
 729      if(idx->ipv6)
 730      {
 731       buf = index6_id(idx->addr, bitmask+32);
 732      }
 733      else
 734      {
 735       buf = index_id(idx->addr, bitmask);
 736      }
 737      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 738      {
 739       metaindex->children++;
 740      }
 741      else
 742      {
 743       create(metaindex,Index);
 744       metaindex->addr = idx->addr;
 745       metaindex->id = buf;
 746       metaindex->bitmask = bitmask+32*idx->ipv6;
 747       metaindex->parent = NULL;
 748       metaindex->children = 0;
 749       metaindex->ipv6 = idx->ipv6;
 750       idxcount++;
 751       push(metaindex,idxs);
 752      }
 753      idx->parent=metaindex;
 754     }
 755    }
 756
 757    /* this should slightly optimize throughput ... */
 758    sort(idx,idxs,desc_order_by,children);
 759    sort(idx,idxs,order_by,bitmask);
 760
 761    i=0;
 762    for_each(idx,idxs)
 763    {
 764     if(idx->ipv6)
 765     {
 766      subnet=subnet6_id(idx->addr, idx->bitmask);
 767     }
 768     else
 769     {
 770      subnet=subnet_id(idx->addr, idx->bitmask);
 771     }
 772     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 773
 774     sprintf(str,":post_%s - [0:0]", idx->id);
 775     iptables_save_line(str, idx->ipv6);
 776
 777     sprintf(str,":forw_%s - [0:0]", idx->id);
 778     iptables_save_line(str, idx->ipv6);
 779
 780     if(idx->parent)
 781     {
 782      string(buf,strlen(idx->parent->id)+6);
 783      sprintf(buf,"post_%s", idx->parent->id);
 784     }
 785     else
 786     {
 787      buf="POSTROUTING";
 788     }
 789
 790     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 791     iptables_save_line(str, idx->ipv6);
 792
 793     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 794     iptables_save_line(str, idx->ipv6);
 795
 796     if(idx->parent)
 797     {
 798      string(buf,strlen(idx->parent->id)+6);
 799      sprintf(buf,"forw_%s",idx->parent->id);
 800     }
 801     else
 802     {
 803      buf="FORWARD";
 804     }
 805
 806     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 807     iptables_save_line(str, idx->ipv6);
 808
 809     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 810     iptables_save_line(str, idx->ipv6);
 811    }
 812    printf("Total indexed iptables chains created: %d\n", i);
 813
 814    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 815    iptables_save_line(str, FALSE);
 816
 817    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 818    iptables_save_line(str, FALSE);
 819
 820    if(ip6prefix)
 821    {
 822     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 823     iptables_save_line(str, TRUE);
 824
 825     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 826     iptables_save_line(str, TRUE);
 827    }
 828   }
 829  }
 830
 831  if(just_flush)
 832  {
 833   fclose(iptables_file);
 834   if(log_file)
 835   {
 836    fclose(log_file);
 837   }
 838   puts("Just flushed iptables and tc classes - now exiting ...");
 839   exit(0);
 840  }
 841
 842  if(!just_preview)
 843  {
 844   if(!dry_run && !nodelay && qos_free_delay)
 845   {
 846    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 847    sleep(qos_free_delay);
 848   }
 849
 850   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 851               tc,lan,htb_r2q);
 852   safe_run(str);
 853
 854   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 855                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 856   safe_run(str);
 857
 858   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 859                 tc,lan,line,line,burst_main,highest_priority);
 860   safe_run(str);
 861
 862   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 863   safe_run(str);
 864
 865   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 866                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 867   safe_run(str);
 868
 869   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 870                tc,wan,up,up,burst_main,highest_priority);
 871   safe_run(str);
 872  }
 873
 874  /*-----------------------------------------------------------------*/
 875  puts("Locating heavy downloaders and generating root classes ...");
 876  /*-----------------------------------------------------------------*/
 877  sort(ip,ips,desc_order_by,traffic);
 878
 879  /*-----------------------------------------------------------------*/
 880  /* sub-scope - local variables */
 881  {
 882   long long int rate = line;
 883   long long int max = line;
 884   int group_count = 0;
 885   FILE *credit_file = NULL;
 886
 887   if(!just_preview && !dry_run && enable_credit)
 888   {
 889    credit_file = fopen(credit,"w");
 890   }
 891
 892   for_each(group,groups)
 893   {
 894    if(!just_preview)
 895    {
 896     //download
 897     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 898                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 899     safe_run(str);
 900
 901     //upload
 902     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 903                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 904     safe_run(str);
 905    }
 906
 907    if(group_count++ < max_nesting)
 908    {
 909     parent = group->id;
 910    }
 911
 912    rate -= digital_divide*group->min;
 913    if(rate < group->min)
 914    {
 915     rate = group->min;
 916    }
 917
 918    /*shaping of aggresive downloaders, with credit file support */
 919    if(use_credit)
 920    {
 921     int group_rate = group->min, priority_sequence = lowest_priority;
 922
 923     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 924     {
 925      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 926      if(     ip->keyword->data_limit
 927          and not ip->fixedprio
 928          and ip->traffic > ip->realquota )
 929      {
 930       if(group_rate < ip->max)
 931       {
 932        ip->max = group_rate;
 933       }
 934       group_rate+=magic_treshold;
 935       ip->prio=lowest_priority;
 936       if(ip->prio<highest_priority+2)
 937       {
 938        ip->prio=highest_priority+2;
 939       }
 940      }
 941      else
 942      {
 943       if(    ip->keyword->data_prio
 944           && !ip->fixedprio
 945           && (   ip->traffic>ip->credit
 946                + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
 947       {
 948        ip->prio=priority_sequence--;
 949        if(ip->prio<highest_priority+1)
 950        {
 951         ip->prio=highest_priority+1;
 952        }
 953       }
 954
 955       if(credit_file)
 956       {
 957        unsigned long long lcredit=0;
 958
 959        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
 960        {
 961         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
 962        }
 963        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
 964       }
 965      }
 966     }
 967    }
 968   }
 969   if(credit_file)
 970   {
 971    fclose(credit_file);
 972   }
 973  }
 974
 975  if(just_preview)
 976  {
 977   if(start_shaping)
 978   {
 979    printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
 980    parse(classmap)
 981    {
 982     ptr=strchr(_,' ');
 983     if(ptr)
 984     {
 985      *ptr=0;
 986      ptr++;
 987      if_exists(ip,ips,eq(ip->addr,_))
 988      {
 989       ip->mark=atoi(ptr);
 990       if(ip->max < ip->desired) /* apply FUP limit immediately.... */
 991       {
 992        printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
 993        printf("(down: %dk-%dk ", ip->min, ip->max);
 994        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
 995                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
 996        safe_run(str);
 997        printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
 998                                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
 999        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1000                     tc, wan, ip->group, ip->mark,
1001                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1002                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1003        safe_run(str);
1004       }
1005      }
1006     }
1007    }
1008    fail
1009    {
1010     perror(classmap);
1011     puts("Warning - classmap file not fund, just generating preview ...");
1012     start_shaping=FALSE;
1013    }
1014    done; /* ugly macro end */
1015   }
1016   html=preview;
1017   json_traffic=json_preview;
1018  }
1019
1020  if(!dry_run && !just_flush)
1021  {
1022   /*-----------------------------------------------------------------*/
1023   printf("Writing json traffic overview  %s ... ", json_traffic);
1024   /*-----------------------------------------------------------------*/
1025   write_json_traffic(json_traffic);
1026
1027   /*-----------------------------------------------------------------*/
1028   printf("Writing statistics into HTML page %s ...\n", html);
1029   /*-----------------------------------------------------------------*/
1030   write_htmlandlogs(html, d, total, just_preview);
1031  }
1032
1033  if(just_preview)
1034  {
1035   char swchar='p';
1036   if(start_shaping)
1037   {
1038    swchar='s';
1039   }
1040   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1041   exit(0);
1042  }
1043
1044  i=0;
1045 #ifdef DEBUG
1046  printf("%-22s %-15s mark\n","name","ip");
1047 #endif
1048
1049  printf("Writing %s ... ", classmap);
1050  f = fopen(classmap, "w");
1051  if(f < 0)
1052  {
1053   perror(classmap);
1054  }
1055
1056  /*-----------------------------------------------------------------*/
1057  puts("Generating iptables and tc classes ... ");
1058  /*-----------------------------------------------------------------*/
1059
1060  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1061  {
1062   if(idxs)
1063   {
1064    char *buf;
1065    duplicate(ip->addr,buf);
1066    if(ip->v6)
1067    {
1068     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1069    }
1070    else
1071    {
1072     buf=index_id(ip->addr,32-idxtable_bitmask1);
1073    }
1074
1075    string(chain_forward,6+strlen(buf));
1076    strcpy(chain_forward,"forw_");
1077    strcat(chain_forward,buf);
1078
1079    string(chain_postrouting,6+strlen(buf));
1080    strcpy(chain_postrouting,"post_");
1081    strcat(chain_postrouting,buf);
1082
1083    free(buf);
1084   }
1085   else
1086   {
1087    chain_forward="FORWARD";
1088    chain_postrouting="POSTROUTING";
1089   }
1090
1091 #ifdef DEBUG
1092   printf("%-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1093 #endif
1094
1095   /* -------------------------------------------------------- mark download */
1096
1097   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1098                chain_postrouting, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);
1099   /* -m limit --limit 1/s */
1100   iptables_save_line(str, ip->v6);
1101
1102   if(qos_proxy)
1103   {
1104    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1105                 chain_postrouting, proxy_ip, proxy_port, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);
1106    iptables_save_line(str, ip->v6);
1107   }
1108
1109   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1110                chain_postrouting, ip->addr, 32*(1+ip->v6), lan);
1111   iptables_save_line(str, ip->v6);
1112
1113   /* -------------------------------------------------------- mark upload */
1114   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1115                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);
1116   iptables_save_line(str, ip->v6);
1117
1118   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1119                chain_forward, ip->addr, 32*(1+ip->v6), wan);
1120   iptables_save_line(str, ip->v6);
1121
1122   if(ip->min)
1123   {
1124    /* -------------------------------------------------------- download class */
1125 #ifdef DEBUG
1126    printf("(down: %dk-%dk ", ip->min, ip->max);
1127 #endif
1128
1129    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1130                 tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1131    safe_run(str);
1132
1133    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1134    {
1135     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1136                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1137     safe_run(str);
1138    }
1139
1140    if(filter_type == 1)
1141    {
1142     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1143                  tc, lan, ip->mark, ip->mark);
1144     safe_run(str);
1145    }
1146
1147    /* -------------------------------------------------------- upload class */
1148 #ifdef DEBUG
1149    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1150                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1151 #endif
1152
1153    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1154                 tc, wan, ip->group, ip->mark,
1155                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1156                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1157    safe_run(str);
1158
1159    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1160    {
1161     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1162                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1163     safe_run(str);
1164    }
1165
1166    if(filter_type == 1)
1167    {
1168     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1169                  tc, wan, ip->mark, ip->mark);
1170     safe_run(str);
1171    }
1172
1173    if(f > 0)
1174    {
1175     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1176    }
1177   }
1178   else
1179   {
1180 #ifdef DEBUG
1181    printf("(sharing %s)\n", ip->sharing);
1182 #endif
1183   }
1184   i++;
1185  }
1186  if(f > 0)
1187  {
1188   puts("done.");
1189   fclose(f);
1190  }
1191
1192  if(idxs)
1193  {
1194   chain_forward = "forw_common";
1195   chain_postrouting = "post_common";
1196  }
1197  else
1198  {
1199   chain_forward = "FORWARD";
1200   chain_postrouting = "POSTROUTING";
1201  }
1202
1203  if(free_min)
1204  {
1205   final_chain = "ACCEPT";
1206  }
1207
1208  if(qos_proxy)
1209  {
1210   if(free_min)
1211   {
1212    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1213                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1214    iptables_save_line(str, FALSE); /* only for IPv4 */
1215   }
1216   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1217                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1218   iptables_save_line(str, FALSE); /* only for IPv4 */
1219  }
1220
1221  if(free_min)
1222  {
1223   sprintf(str, "-A %s -o %s -j %s%d",
1224                chain_postrouting, lan, mark_iptables, 3);
1225   iptables_save_line(str, FALSE); /* only for IPv4 */
1226  }
1227
1228  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1229  iptables_save_line(str, FALSE);
1230  if(ip6prefix)
1231  {
1232   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1233   iptables_save_line(str, TRUE);
1234  }
1235
1236  if(free_min)
1237  {
1238   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);
1239   iptables_save_line(str, FALSE); /* only for IPv4 */
1240  }
1241
1242  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1243  iptables_save_line(str, FALSE);
1244  if(ip6prefix)
1245  {
1246   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1247   iptables_save_line(str, TRUE);
1248  }
1249
1250  if(free_min) /* allocate free bandwith if it is not zero... */
1251  {
1252    /*-----------------------------------------------------------------*/
1253    puts("Generating free bandwith classes ...");
1254    /*-----------------------------------------------------------------*/
1255    sprintf(str, "%s class add dev %s parent 1:%d classid 1:3 htb rate %dkbit ceil %dkbit burst %dk prio %d",
1256                 tc, lan, parent, free_min, free_max,burst, lowest_priority);
1257    safe_run(str);
1258    sprintf(str, "%s class add dev %s parent 1:%d classid 1:3 htb rate %dkbit ceil %dkbit burst %dk prio %d",
1259                 tc, wan, parent, free_min, free_max, burst, lowest_priority);
1260    safe_run(str);
1261    /* tc SFQ */
1262    if(strcmpi(qos_leaf, "none"))
1263    {
1264      sprintf(str,"%s qdisc add dev %s parent 1:3 handle 3 %s", tc, lan, qos_leaf);
1265      safe_run(str);
1266
1267      sprintf(str,"%s qdisc add dev %s parent 1:3 handle 3 %s", tc, wan, qos_leaf);
1268      safe_run(str);
1269    }
1270    /* tc handle 1 fw flowid */
1271    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle 3 fw flowid 1:3", tc, lan);
1272    safe_run(str);
1273
1274    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle 3 fw flowid 1:3", tc, wan);
1275    safe_run(str);
1276  }
1277  printf("Total IP count: %d\n", i);
1278  run_iptables_restore();
1279  if(log_file)
1280  {
1281   fclose(log_file);
1282  }
1283  return 0;
1284  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1285  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1286 }