prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2017 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20171012
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.9.0-a";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.9.0 is development release, 1.0 will be "stable"    */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2017 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
  62 char    *upstreamfile = "/etc/prometheus/upstream.interfaces"; /* list of interfaces to manage */
  63 char  *downstreamfile = "/etc/prometheus/downstream.interfaces"; /* list of interfaces to manage */
  64 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  65 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  66 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  67 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  68 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  69 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  70 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  71 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  72 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  73 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  74 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  75 char    *html_log_dir = "/var/www/logs/html/";
  76
  77 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  78 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  79 int use_jquery_popups = TRUE;
  80 int      row_odd_even = 0; /*<tr class="odd/even"> */
  81
  82 /* === Configuraration file values defaults - stored in global variables ==== */
  83
  84 int        filter_type = 1; /*1 mark, 2 classify*/
  85 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  86 char             *mark = "MARK";
  87 char    *mark_iptables = "MARK --set-mark ";
  88 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  89 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  90 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  91 FILE    *iptables_file = NULL;
  92 FILE   *ip6tables_file = NULL;
  93 int      enable_credit = TRUE; /* enable credit file */
  94 int         use_credit = FALSE; /* use credit file (if enabled)*/
  95 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  96 int       hall_of_fame = TRUE; /* enable hall of fame */
  97 char           *medium = "1000Mbit"; /* 10Mbit/100Mbit ethernet */
  98 //obsolete: char              *lan = "eth0"; /* LAN interface */
  99 //obsolete: char       *lan_medium = "1000Mbit"; /* 10Mbit/100Mbit ethernet */
 100 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
 101 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 102 char    *qos_free_zone = NULL; /* QoS free zone */
 103 /* int          qos_proxy = TRUE; include proxy port to QoS */
 104 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 105 int     include_upload = TRUE; /* upload+download=total traffic */
 106 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 107 /* int         proxy_port = 3128; proxy port number */
 108 //obsolete: long long int     line = 1024; /* WAN/ISP download in kbps */
 109 //obsolete: long long int       up = 1024; /* WAN/ISP upload in kbps */
 110 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 111 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 112 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 113 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 114 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 115 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 116 int        max_nesting = 5; /* /include/uapi/linux/pkt_sched.h: #define TC_HTB_MAXDEPTH 8 [... - 3 parent classes] */
 117 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 118 int              burst = 8; /* HTB burst (in kbits) */
 119 int         burst_main = 64;
 120 int        burst_group = 32;
 121 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 122 int       keywordcount = 0;
 123 int        class_count = 0;
 124 int           ip_count = 0;
 125 FILE         *log_file = NULL;
 126 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 127
 128 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 129 const int lowest_priority    = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */
 130 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 131 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 132 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 133 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 134
 135 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 136 struct Group *groups = NULL, *group;
 137 struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 138 struct Macro *macro, *macros = NULL;
 139 struct Index *idxs = NULL, *idx, *metaindex;
 140 struct Interface *interfaces = NULL, *interface;
 141
 142 #define FREE_CLASS      3
 143 #define OVERLIMIT_CLASS 4
 144
 145 void help(void);
 146 /* implemented in help.c */
 147
 148 void get_traffic_statistics(const char *whichiptables, int ipv6);
 149 /* implemented in parseiptables.c */
 150
 151 void parse_ip_log(int argc, char **argv);
 152 /* implemented in parselog.c */
 153
 154 void parse_hosts(char *hosts);
 155 /* implemented in parsehosts.c */
 156
 157 void write_json_traffic(char *json);
 158 /* implemented in json.c */
 159
 160 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 161 /* implemented in htmlandlogs.c */
 162
 163 void analyse_topology(char *traceroute);
 164 /* implemented in networks.c */
 165
 166 char *parse_datafile_line(char *str);
 167 /* implemented in utils.c */
 168
 169 time_t get_mtime(const char *path);
 170 /* implemented in utils.c */
 171
 172 const char *tr_odd_even(void)
 173 {
 174  row_odd_even = 1 - row_odd_even;
 175  if(row_odd_even)
 176  {
 177   return "<tr class=\"even\">\n";
 178  }
 179  else
 180  {
 181   return "<tr class=\"odd\">\n";
 182  }
 183 }
 184
 185
 186 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 187
 188 char *index_id(char *ip, int bitmask);
 189 /* function implemented in ipv4subnets.c */
 190
 191 char *subnet_id(char *ip, int bitmask);
 192 /* function implemented in ipv4subnets.c */
 193
 194 char *index6_id(char *ip, int bitmask);
 195 /* function implemented in ipv6subnets.c */
 196
 197 char *subnet6_id(char *ip, int bitmask);
 198 /* function implemented in ipv6subnets.c */
 199
 200 /* ================= Let's parse configuration file here ================ */
 201
 202 void reject_config_and_exit(char *filename)
 203 {
 204  printf("Configuration file %s rejected - abnormal exit.",filename);
 205  exit(-1);
 206 }
 207
 208 void get_config(char *config_filename)
 209 {
 210  char *cnf="mark";
 211
 212  printf("Configured keywords: ");
 213  parse(config_filename)
 214  {
 215   option("keyword",kwd);
 216   if(kwd)
 217   {
 218    printf("%s ",kwd);
 219
 220    create(keyword,Keyword);
 221    keyword->key = kwd;
 222    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 223    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 224    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 225    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 226    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 227    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 228    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 229    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 230    keyword->default_prio = highest_priority+1;
 231    keyword->download_aggregation = keyword->upload_aggregation = 0; /* disable by default */
 232    keyword->html_color = "000000";
 233    keyword->ip_count = 0;
 234    keyword->leaf_discipline = "";
 235    keyword->allowed_avgmtu = 0;
 236
 237    push(keyword, keywords);
 238    if(!defaultkeyword)
 239    {
 240     defaultkeyword = keyword;
 241    }
 242    keywordcount++;
 243
 244    kwd=NULL;
 245   }
 246   else
 247   {
 248     for_each(keyword,keywords)
 249     {
 250      int l=strlen(keyword->key);
 251
 252      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 253      {
 254       char *tmptr=_; /*  <---- l+1 ----> */
 255       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 256       foption("asymetry-ratio", keyword->asymetry_ratio);
 257       ioption("asymetry-treshold", keyword->asymetry_fixed);
 258       ioption("magic-relative-limit", keyword->data_limit);
 259       ioption("magic-relative-prio", keyword->data_prio);
 260       loption("magic-fixed-limit", keyword->fixed_limit);
 261       loption("magic-fixed-prio", keyword->fixed_prio);
 262       ioption("htb-default-prio", keyword->default_prio);
 263       ioption("htb-rate-bonus", keyword->reserve_min);
 264       ioption("htb-ceil-malus", keyword->reserve_max);
 265       ioption("download-aggregation", keyword->download_aggregation);
 266       ioption("upload-aggregation", keyword->upload_aggregation);
 267       option("leaf-discipline", keyword->leaf_discipline);
 268       option("html-color", keyword->html_color);
 269       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 270       _=tmptr;
 271
 272       if(keyword->data_limit || keyword->fixed_limit ||
 273          keyword->data_prio || keyword->fixed_prio)
 274       {
 275        use_credit=1;
 276       }
 277      }
 278     }
 279   }
 280
 281   option("tc",tc);
 282   option("iptables",iptables);
 283   option("iptables-save",iptablessave);
 284   option("iptables-restore",iptablesrestore);
 285   option("ip6tables",ip6tables);
 286   option("ip6tables-save",ip6tablessave);
 287   option("ip6tables-restore",ip6tablesrestore);
 288   option("iptables-in-filename",iptablesfile);
 289   option("ip6tables-in-filename",ip6tablesfile);
 290   option("hosts",hosts);
 291   option("downstream-interfaces-list-filename",downstreamfile);
 292   option("upstream-interfaces-list-filename",upstreamfile);
 293   option("macros-filename",macrosfile);
 294   option("ip6-prefix",ip6prefix);
 295   option("medium",medium);
 296   ioption("hall-of-fame-enable",hall_of_fame);
 297   ioption("digital-divide-weirdness-ratio",digital_divide);
 298   option("hall-of-fame-title",title);
 299   option("hall-of-fame-filename",html);
 300   option("json-filename",json_traffic);
 301   option("hall-of-fame-preview",preview);
 302   option("json-preview",json_preview);
 303   option("log-filename",cmdlog);
 304   option("credit-filename",credit);
 305   option("classmap-filename",classmap);
 306   ioption("credit-enable",enable_credit);
 307   option("log-traffic-directory",log_dir);
 308   option("log-traffic-html-directory",html_log_dir);
 309   option("log-traffic-url-path",log_url);
 310   option("jquery-url",jquery_url);
 311   option("lms-url",lms_url);
 312   ioption("use-jquery-popups",use_jquery_popups);
 313   option("qos-free-zone",qos_free_zone);
 314   ioption("qos-free-delay",qos_free_delay);
 315 /*  ioption("qos-proxy-enable",qos_proxy); */
 316 /*  option("qos-proxy-ip",proxy_ip);*/
 317   option("htb-leaf-discipline",qos_leaf);
 318 /*  ioption("qos-proxy-port",proxy_port); */
 319   ioption("free-rate",free_min);
 320   ioption("free-ceil",free_max);
 321   ioption("overlimit-rate",overlimit_min);
 322   ioption("overlimit-ceil",overlimit_max);
 323   ioption("htb-burst",burst);
 324   ioption("htb-burst-main",burst_main);
 325   ioption("htb-burst-group",burst_group);
 326   ioption("htb-nesting-limit",max_nesting);
 327   ioption("htb-r2q",htb_r2q);
 328   ioption("magic-include-upload",include_upload);
 329   ioption("magic-treshold",magic_treshold);
 330   option("filter-type", cnf);
 331 /* not yet implemented:
 332   ioption("magic-fixed-packets",fixed_packets);
 333   ioption("magic-relative-packets",packet_limit);
 334 */
 335  }
 336  fail
 337  {
 338   perror(config_filename);
 339   puts("Warning - using built-in defaults instead ...");
 340  }
 341  done; /* ugly macro end */
 342  printf("\n");
 343
 344  /* leaf discipline for keywords */
 345  for_each(keyword,keywords)
 346  {
 347   if(!strcmpi(keyword->leaf_discipline, ""))
 348   {
 349    keyword->leaf_discipline = qos_leaf;
 350   }
 351  }
 352
 353  if(strcmpi(cnf, "mark"))
 354  {
 355   filter_type = 2;
 356   mark = "CLASSIFY";
 357   mark_iptables = "CLASSIFY --set-class 1:";
 358  }
 359  else
 360  {
 361   filter_type = 1;
 362   mark = "MARK";
 363   mark_iptables = "MARK --set-mark ";
 364  }
 365 }
 366
 367
 368 /* ========== This function executes, logs OR ALSO prints command ========== */
 369
 370 void safe_run(char *cmd)
 371 {
 372  if(dry_run)
 373  {
 374   printf("\n=>%s\n",cmd);
 375  }
 376  else
 377  {
 378   system(cmd);
 379  }
 380  if(log_file)
 381  {
 382   fprintf(log_file,"%s\n",cmd);
 383  }
 384 }
 385
 386 void iptables_save_line(char *line, int ipv6)
 387 {
 388  if(ipv6)
 389  {
 390   fprintf(ip6tables_file,"%s\n",line);
 391  }
 392  else
 393  {
 394   fprintf(iptables_file,"%s\n",line);
 395  }
 396 }
 397
 398 #define IPv4 FALSE
 399 #define IPv6 TRUE
 400
 401
 402 void run_iptables_restore(void)
 403 {
 404  char *restor;
 405  string(restor, STRLEN);
 406
 407  /*-----------------------------------------------------------------*/
 408  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 409  /*-----------------------------------------------------------------*/
 410
 411  iptables_save_line("COMMIT", IPv4);
 412  fclose(iptables_file);
 413  if(dry_run)
 414  {
 415   parse(iptablesfile)
 416   {
 417    printf("%s\n",_);
 418   }
 419   done; /* ugly macro end */
 420  }
 421
 422  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 423  safe_run(restor);
 424
 425  if(ip6prefix)
 426  {
 427   /*-----------------------------------------------------------------*/
 428   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 429   /*-----------------------------------------------------------------*/
 430   iptables_save_line("COMMIT", IPv6);
 431   fclose(ip6tables_file);
 432   if(dry_run)
 433   {
 434    parse(ip6tablesfile)
 435    {
 436     printf("%s\n",_);
 437    }
 438    done; /* ugly macro end */
 439   }
 440   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 441   safe_run(restor);
 442  }
 443  free(restor);
 444 }
 445
 446 /**/
 447
 448 char *parse_datafile_line(char *str);
 449 time_t get_mtime(const char *path);
 450
 451 /*-----------------------------------------------------------------*/
 452 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 453 /*-----------------------------------------------------------------*/
 454
 455 program
 456 {
 457  int i=0;                    /* just plain old Fortran style integer :-) */
 458  FILE *f=NULL;               /* everything is just stream of bytes... */
 459  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 460  char *substring, *limit_pkts;
 461
 462  int parent        = 1;
 463  int just_networks = FALSE;
 464  int just_flush    = FALSE;       /* deactivates all previous actions */
 465  int nodelay       = FALSE;
 466  int just_preview  = FALSE;       /* preview - generate just stats */
 467  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 468  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 469  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 470  int just_logs     = FALSE;       /* just parse logs */
 471  int run           = FALSE;
 472  int total         = 0;
 473
 474  char *althosts=NULL;
 475
 476  printf("\n\
 477 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 478 Version %s - Copyright (C)2005-2017 Michael Polak, Arachne Labs\n\
 479 iptables-restore & burst tunning & classify modification by Ludva\n\
 480 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 481
 482  /*----- Boring... we have to check command line options first: ----*/
 483  arguments
 484  {
 485   argument("-c") { nextargument(config); }
 486   argument("-h") { nextargument(althosts);}
 487   argument("-d") { run=TRUE; dry_run=TRUE; }
 488   argument("-f") { run=TRUE; just_flush=TRUE; }
 489   argument("-9") { run=TRUE; just_flush=9; }
 490   argument("-p") { run=TRUE; just_preview=TRUE; }
 491   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 492   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 493   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 494   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 495   argument("-r") { run=TRUE; }
 496   argument("-n") { run=TRUE; nodelay=TRUE; }
 497   argument("-a") { run=TRUE; just_networks=TRUE; }
 498   argument("-l") { just_logs=TRUE; }
 499   argument("-m") { just_logs=TRUE; }
 500   argument("-y") { just_logs=TRUE; }
 501   argument("-?") { help(); exit(0); }
 502   argument("--help") { help(); exit(0); }
 503   argument("-v") { exit(0); }
 504   argument("--version") { exit(0); }
 505  }
 506
 507  if(dry_run)
 508  {
 509   puts("*** THIS IS JUST DRY RUN ! ***\n");
 510  }
 511
 512  date(d); /* this is typical cll1.h macro - prints current date */
 513
 514  /*-----------------------------------------------------------------*/
 515  printf("Parsing configuration file %s ...\n", config);
 516  /*-----------------------------------------------------------------*/
 517  get_config(config);
 518  /*-----------------------------------------------------------------*/
 519  printf("Parsing upstream interfaces list %s ...\n", upstreamfile);
 520  /*-----------------------------------------------------------------*/
 521  parse(upstreamfile)
 522  {
 523   ptr = parse_datafile_line(_);
 524   if(ptr)
 525   {
 526    create(interface, Interface);
 527    interface->name = _;
 528    interface->speed = (long long)atol(ptr);
 529    /* is supplied value meaningful ?*/
 530    if(interface->speed <= 0)
 531    {
 532     printf("Illegal value of %s interface bandwidth.\n", interface->name);
 533     reject_config_and_exit(upstreamfile);
 534    }
 535    interface->is_upstream = TRUE;
 536    interface->chain = "FORWARD";
 537    interface->idxprefix = "forw";
 538    push(interface, interfaces);
 539    printf("Upstream interface %s: medium %s capacity %ld kbps\n", interface->name, medium, interface->speed);
 540   }
 541  }
 542  done; /* ugly macro end */
 543
 544  /*-----------------------------------------------------------------*/
 545  printf("Parsing downstream interfaces list %s ...\n", downstreamfile);
 546  /*-----------------------------------------------------------------*/
 547  parse(downstreamfile)
 548  {
 549   ptr = parse_datafile_line(_);
 550   if(ptr)
 551   {
 552    create(interface, Interface);
 553    interface->name = _;
 554    interface->speed = (long long)atol(ptr);
 555    /* is supplied value meaningful ?*/
 556    if(interface->speed <= 0)
 557    {
 558     printf("Illegal value of %s interface bandwidth.\n", interface->name);
 559     reject_config_and_exit(downstreamfile);
 560    }
 561    interface->is_upstream = FALSE;
 562    interface->chain = "POSTROUTING";
 563    interface->idxprefix = "post";
 564    push(interface, interfaces);
 565    printf("Downstream interface %s: medium %s capacity %ld kbps\n", interface->name, medium, interface->speed);
 566   }
 567  }
 568  done; /* ugly macro end */
 569
 570
 571  if(just_logs)
 572  {
 573   parse_ip_log(argc,argv);
 574   exit(0);
 575  }
 576  else if(not run)
 577  {
 578   help();
 579   exit(0);
 580  }
 581
 582  if(althosts)
 583  {
 584   hosts = althosts;
 585  }
 586
 587  if(just_flush<9)
 588  {
 589   /*-----------------------------------------------------------------*/
 590   puts("Parsing iptables verbose output ...");
 591   /*-----------------------------------------------------------------*/
 592   get_traffic_statistics(iptables, FALSE);
 593   if(ip6prefix)
 594   {
 595    /*-----------------------------------------------------------------*/
 596    puts("Parsing ip6tables verbose output ...");
 597    /*-----------------------------------------------------------------*/
 598    get_traffic_statistics(ip6tables, TRUE);
 599   }
 600  }
 601
 602  /*-----------------------------------------------------------------*/
 603  /* cll1.h - let's allocate brand new character buffer...           */
 604  /*-----------------------------------------------------------------*/
 605  string(str, STRLEN);
 606  string(limit_pkts, STRLEN);
 607
 608  /*-----------------------------------------------------------------*/
 609  printf("Parsing macro definition file %s ...\n", macrosfile);
 610  /*-----------------------------------------------------------------*/
 611  parse(macrosfile)
 612  {
 613   ptr = parse_datafile_line(_);
 614   if(ptr)
 615   {
 616    create(macro, Macro);
 617    macro->rewrite_from = _;
 618    macro->rewrite_to = ptr;
 619    push(macro, macros);
 620    printf("%s -> %s\n", macro->rewrite_from, macro->rewrite_to);
 621   }
 622  }
 623  done; /* ugly macro end */
 624
 625
 626
 627  /*-----------------------------------------------------------------*/
 628  printf("Parsing class defintion file %s ...\n", hosts);
 629  /*-----------------------------------------------------------------*/
 630  parse_hosts(hosts);
 631 /*
 632  //this was pretty dumb idea anyway...
 633  if(just_networks)
 634  {
 635   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 636   exit(-1);
 637  }
 638 */
 639
 640  /*-----------------------------------------------------------------*/
 641  puts("Resolving shared connections ...");
 642  /*-----------------------------------------------------------------*/
 643  for_each(ip, ips) if(ip->sharing)
 644  {
 645   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 646   {
 647    sharedip->traffic += ip->traffic;
 648    sharedip->traffic_down += ip->direct;
 649    sharedip->traffic_up += ip->upload;
 650    ip->traffic = 0;
 651    ip->mark = sharedip->mark;
 652    ip->lmsid = sharedip->lmsid;
 653    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 654
 655    /* Ugly hack: append IPv4 addresses of sharedip to IPv6 uplinks */
 656    ptr = strchr(ip->addr, '+');
 657    if(ptr && ptr-ip->addr > 1 && !sharedip->v6)
 658    {
 659     *(--ptr) = 0;
 660     concatenate(ip->addr, sharedip->addr, ptr);
 661     ip->name = ip->addr = ptr;
 662     ptr = strchr(ip->addr, '.');
 663     while(ptr && *ptr)
 664     {
 665      *ptr = ':';
 666      ptr = strchr(ptr, '.');
 667     }
 668     ip->mask += 64;
 669    }
 670
 671    break;
 672   }
 673   if(not sharedip)
 674   {
 675    printf("Unresolved shared connection: %s %s sharing-%s\n",
 676           ip->addr, ip->name, ip->sharing);
 677   }
 678  }
 679
 680  if(enable_credit && just_flush<9)
 681  {
 682   /*-----------------------------------------------------------------*/
 683   printf("Parsing credit file %s ...\n", credit);
 684   /*-----------------------------------------------------------------*/
 685   parse(credit)
 686   {
 687    ptr = parse_datafile_line(_);
 688    if(ptr)
 689    {
 690     if_exists(ip,ips,eq(ip->addr,_))
 691     {
 692      sscanf(ptr,"%Lu",&(ip->credit));
 693     }
 694    }
 695   }
 696   done; /* ugly macro end */
 697  }
 698
 699
 700  if(!just_preview)
 701  {
 702   /*-----------------------------------------------------------------*/
 703   puts("Initializing iptables and tc classes ...");
 704   /*-----------------------------------------------------------------*/
 705
 706   iptables_file = fopen(iptablesfile, "w");
 707   if(iptables_file == NULL)
 708   {
 709     perror(iptablesfile);
 710     exit(-1);
 711   }
 712   iptables_save_line(iptablespreamble, IPv4);
 713
 714   if(ip6prefix)
 715   {
 716    ip6tables_file = fopen(ip6tablesfile, "w");
 717    if(ip6tables_file == NULL)
 718    {
 719      perror(ip6tablesfile);
 720      exit(-1);
 721    }
 722    iptables_save_line(iptablespreamble, IPv6);
 723    iptables_save_line(ip6preamble, IPv6);
 724   }
 725
 726   run_iptables_restore();
 727
 728   log_file = fopen(cmdlog, "w");
 729   if(log_file == NULL)
 730   {
 731     perror(cmdlog);
 732     exit(-1);
 733   }
 734
 735   for_each(interface, interfaces)
 736   {
 737    sprintf(str,"%s qdisc del dev %s root 2>/dev/null", tc, interface->name);
 738    safe_run(str);
 739   }
 740
 741   iptables_file=fopen(iptablesfile,"w");
 742   iptables_save_line(iptablespreamble, IPv4);
 743   if(ip6prefix)
 744   {
 745    ip6tables_file=fopen(ip6tablesfile,"w");
 746    iptables_save_line(iptablespreamble, IPv6);
 747    iptables_save_line(ip6preamble, IPv6);
 748   }
 749
 750   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 751   {
 752    for_each(interface, interfaces)
 753    {
 754     sprintf(str,"-A %s -%c %s -o %s -j ACCEPT", interface->chain, (interface->is_upstream?'d':'s'), qos_free_zone, interface->name);
 755     iptables_save_line(str, IPv4);
 756    }
 757   }
 758
 759   if(ip_count > idxtable_treshold1 && !just_flush)
 760   {
 761    int idxcount=0, bitmask=32-idxtable_bitmask1;
 762    char *subnet, *buf;
 763    /*-----------------------------------------------------------------*/
 764    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 765    /*-----------------------------------------------------------------*/
 766
 767    iptables_save_line(":post_common - [0:0]", IPv4);
 768    iptables_save_line(":forw_common - [0:0]", IPv4);
 769    if(ip6prefix)
 770    {
 771     iptables_save_line(":post_common - [0:0]", IPv6);
 772     iptables_save_line(":forw_common - [0:0]", IPv6);
 773    }
 774
 775    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 776    {
 777     if(ip->v6)
 778     {
 779      buf=index6_id(ip->addr,bitmask+32);
 780     }
 781     else
 782     {
 783      buf=index_id(ip->addr, bitmask);
 784     }
 785
 786     if_exists(idx,idxs,eq(idx->id,buf))
 787     {
 788      idx->children++;
 789     }
 790     else
 791     {
 792      create(idx,Index);
 793      idx->addr = ip->addr;
 794      idx->id = buf;
 795      idx->bitmask = bitmask+32*ip->v6;
 796      idx->parent = NULL;
 797      idx->children = 0;
 798      idx->ipv6 = ip->v6;
 799      idxcount++;
 800      push(idx,idxs);
 801     }
 802    }
 803
 804    /* brutal perfomance optimalization */
 805    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 806    {
 807     bitmask -= idxtable_bitmask2;
 808     idxcount = 0;
 809
 810     for_each(idx,idxs) if(idx->parent == NULL)
 811     {
 812      if(idx->ipv6)
 813      {
 814       buf = index6_id(idx->addr, bitmask+32);
 815      }
 816      else
 817      {
 818       buf = index_id(idx->addr, bitmask);
 819      }
 820      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 821      {
 822       metaindex->children++;
 823      }
 824      else
 825      {
 826       create(metaindex,Index);
 827       metaindex->addr = idx->addr;
 828       metaindex->id = buf;
 829       metaindex->bitmask = bitmask+32*idx->ipv6;
 830       metaindex->parent = NULL;
 831       metaindex->children = 0;
 832       metaindex->ipv6 = idx->ipv6;
 833       idxcount++;
 834       push(metaindex,idxs);
 835      }
 836      idx->parent=metaindex;
 837     }
 838    }
 839
 840    /* this should slightly optimize throughput ... */
 841    sort(idx,idxs,desc_order_by,children);
 842    sort(idx,idxs,order_by,bitmask);
 843
 844    i=0;
 845    for_each(idx, idxs)
 846    {
 847     if(idx->ipv6)
 848     {
 849      subnet=subnet6_id(idx->addr, idx->bitmask);
 850     }
 851     else
 852     {
 853      subnet=subnet_id(idx->addr, idx->bitmask);
 854     }
 855     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 856
 857     sprintf(str,":post_%s - [0:0]", idx->id);
 858     iptables_save_line(str, idx->ipv6);
 859
 860     sprintf(str,":forw_%s - [0:0]", idx->id);
 861     iptables_save_line(str, idx->ipv6);
 862
 863     for_each(interface, interfaces)
 864     {
 865      if(idx->parent)
 866      {
 867       string(buf, strlen(idx->parent->id)+6);
 868       sprintf(buf, "%s_%s", interface->idxprefix, idx->parent->id);
 869      }
 870      else
 871      {
 872       buf = interface->chain;
 873      }
 874
 875      sprintf(str, "-A %s -%c %s/%d -o %s -j %s_%s",
 876                   buf, (interface->is_upstream?'s':'d'), subnet, idx->bitmask, interface->name, interface->idxprefix, idx->id);
 877      iptables_save_line(str, idx->ipv6);
 878
 879      sprintf(str, "-A %s -%c %s/%d -o %s -j %s_common",
 880                   buf, (interface->is_upstream?'s':'d'), subnet, idx->bitmask, interface->name, interface->idxprefix);
 881      iptables_save_line(str, idx->ipv6);
 882     }
 883    }
 884    printf("Total indexed iptables chains created: %d\n", i);
 885
 886    for_each(interface, interfaces)
 887    {
 888     sprintf(str,"-A %s -o %s -j %s_common", interface->chain, interface->name, interface->idxprefix);
 889     iptables_save_line(str, IPv4);
 890     if(ip6prefix)
 891     {
 892      sprintf(str,"-A %s -o %s -j %s_common", interface->chain, interface->name, interface->idxprefix);
 893      iptables_save_line(str, IPv6);
 894     }
 895    }
 896   }
 897  }
 898
 899  if(just_flush)
 900  {
 901   fclose(iptables_file);
 902   if(log_file)
 903   {
 904    fclose(log_file);
 905   }
 906   puts("Just flushed iptables and tc classes - now exiting ...");
 907   exit(0);
 908  }
 909
 910  if(!just_preview)
 911  {
 912   if(!dry_run && !nodelay && qos_free_delay)
 913   {
 914    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n", qos_free_delay);
 915    sleep(qos_free_delay);
 916   }
 917
 918   for_each(interface, interfaces)
 919   {
 920    sprintf(str, "%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 921                 tc, interface->name, htb_r2q);
 922    safe_run(str);
 923
 924    sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 925                 tc, interface->name, medium, medium, burst_main, highest_priority);
 926    safe_run(str);
 927
 928    sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 929                 tc, interface->name, interface->speed, interface->speed, burst_main, highest_priority);
 930    safe_run(str);
 931   }
 932  }
 933
 934  /*-----------------------------------------------------------------*/
 935  puts("Locating heavy downloaders and generating root classes ...");
 936  /*-----------------------------------------------------------------*/
 937  sort(ip,ips,desc_order_by,traffic);
 938
 939  /*-----------------------------------------------------------------*/
 940  for_each(interface, interfaces)
 941  {
 942   long long int rate = interface->speed;
 943   long long int max = interface->speed;
 944   int group_count = 0;
 945  //obsolete: FILE *credit_file = NULL;
 946
 947  //obsolete:  if(!just_preview && !dry_run && enable_credit)
 948  //obsolete:  {
 949  //obsolete:   credit_file = fopen(credit,"w");
 950  //obsolete:  }
 951
 952   for_each(group,groups)
 953   {
 954    if(!just_preview)
 955    {
 956     sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 957                   tc, interface->name, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 958     safe_run(str);
 959    }
 960
 961    if(group_count++ < max_nesting)
 962    {
 963     parent = group->id;
 964    }
 965
 966    rate -= digital_divide*group->min;
 967    if(rate < group->min)
 968    {
 969     rate = group->min;
 970    }
 971
 972    /*shaping of aggresive downloaders, with credit file support */
 973    /* obsolete
 974    if(use_credit)
 975    {
 976     int group_rate = group->min, priority_sequence = lowest_priority;
 977
 978     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 979     {
 980      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 981      if(     ip->keyword->data_limit
 982          and not ip->fixedprio
 983          and ip->traffic > ip->realquota )
 984      {
 985       if(group_rate < ip->max)
 986       {
 987        ip->max = group_rate;
 988       }
 989       group_rate+=magic_treshold;
 990       ip->prio=lowest_priority;
 991       if(ip->prio<highest_priority+2)
 992       {
 993        ip->prio=highest_priority+2;
 994       }
 995      }
 996      else
 997      {
 998       if(    ip->keyword->data_prio
 999           && !ip->fixedprio
1000           && (   ip->traffic >   ip->credit + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
1001       {
1002        ip->prio=priority_sequence--;
1003        if(ip->prio<highest_priority+1)
1004        {
1005         ip->prio=highest_priority+1;
1006        }
1007       }
1008
1009       if(credit_file)
1010       {
1011        unsigned long long lcredit=0;
1012
1013        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
1014        {
1015         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
1016        }
1017        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
1018       }
1019      }
1020     }
1021    } obsolete */
1022   }
1023   /* obsolete
1024   if(credit_file)
1025   {
1026    fclose(credit_file);
1027   } obsolete */
1028  }
1029
1030  if(just_preview)
1031  {
1032   if(start_shaping || stop_shaping || reduce_ceil)
1033   {
1034    time_t how_much_seconds = time(NULL) - get_mtime(classmap); /* sice start of daily aggregation session */
1035    printf("Reading %s (%ld seconds old) and applying Fair Use Policy and Aggregation rules... \n", classmap, how_much_seconds);
1036
1037    parse(classmap)
1038    {
1039     ptr=strchr(_,' ');
1040     if(ptr)
1041     {
1042      *ptr=0;
1043      ptr++;
1044      if_exists(ip,ips,eq(ip->addr,_))
1045      {
1046       int unshape_this_ip = 0;
1047       long avg_mbps_down = ip->traffic_down * 8 / how_much_seconds;
1048       long avg_mbps_up = ip->traffic_up * 8 / how_much_seconds;
1049       int agreg = 1, print_stats = 1;
1050
1051       if(ip->keyword->download_aggregation)
1052       {
1053        int min_mbps = (ip->min/ip->keyword->download_aggregation)>>10;
1054        if(min_mbps < 1)
1055        {
1056         min_mbps = 1;
1057        }
1058
1059        if(min_mbps <= avg_mbps_down)
1060        {
1061         unshape_this_ip = 0;
1062         agreg = (int)((float)(avg_mbps_down+1)/min_mbps+.5);
1063         ip->max /= agreg;
1064         ip->pps_limit /= agreg;
1065         printf("Download aggregation 1:%d for %s (min: %lu Mbps avg: %ld Mbps)\n", agreg, ip->name, min_mbps, avg_mbps_down);
1066        }
1067        else
1068        {
1069         unshape_this_ip = 1;
1070        }
1071       }
1072       else if(ip->keyword->upload_aggregation)
1073       {
1074        int min_mbps = (ip->min/ip->keyword->upload_aggregation)>>10;
1075        if(min_mbps < 1)
1076        {
1077         min_mbps = 1;
1078        }
1079
1080        if(min_mbps <= avg_mbps_up)
1081        {
1082         unshape_this_ip = 0;
1083         agreg = (int)((float)(avg_mbps_up+1)/min_mbps+.5);
1084         ip->max /= agreg;
1085         printf("Upload aggregation 1:%d for %s: (min: %lu Mbps avg: %ld Mbps)\n", agreg, ip->name, min_mbps, avg_mbps_up);
1086        }
1087        else
1088        {
1089         unshape_this_ip = 1;
1090        }
1091       }
1092       if(stop_shaping)
1093       {
1094        unshape_this_ip = 1;
1095       }
1096       ip->aggregated = agreg;
1097       ip->mark = atoi(ptr);
1098       if(ip->max < ip->desired || unshape_this_ip || reduce_ceil) /* apply or disable FUP limit immediately.... */
1099       {
1100        if(unshape_this_ip)
1101        {
1102         ip->max = ip->desired;
1103         if(stop_shaping) /* all limits removed, but not printed with -s (start_shaping) switch */
1104         {
1105          printf("Removing limit for %s (%s) ", ip->name, ip->addr);
1106         }
1107         else
1108         {
1109          print_stats = 0;
1110         }
1111        }
1112        else
1113        {
1114         printf("Updating %s (%s) ", ip->name, ip->addr);
1115         if(reduce_ceil)
1116         {
1117          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1118         }
1119         else if(ip->max < ip->min)
1120         {
1121          ip->max = ip->min;
1122         }
1123        }
1124        for_each(interface, interfaces)
1125        {
1126         if(!interface->is_upstream)
1127         {
1128          if(print_stats)
1129          {
1130           printf("[down %s: %dk-%dk wants %d]", interface->name, ip->min, ip->max, ip->desired);
1131          }
1132          sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1133                       tc, interface->name, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1134          safe_run(str);
1135         }
1136         else
1137         {
1138          if(print_stats)
1139          {
1140           printf("[up %s: %dk-%dk wants %dk]", interface->name, (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1141                                              (int)((ip->desired/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1142                                              (int)((ip->desired/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1143          }
1144          sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1145                       tc, interface->name, ip->group, ip->mark,
1146                       (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1147                       (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1148          safe_run(str);
1149         }
1150        }
1151        if(print_stats)
1152        {
1153         printf("\n");
1154        }
1155       }
1156      }
1157     }
1158    }
1159    fail
1160    {
1161     perror(classmap);
1162     puts("Warning - classmap file not fund, just generating preview ...");
1163     start_shaping=FALSE;
1164     stop_shaping=FALSE;
1165    }
1166    done; /* ugly macro end */
1167   }
1168   html=preview;
1169   json_traffic=json_preview;
1170  }
1171
1172  if(!dry_run && !just_flush)
1173  {
1174   /*-----------------------------------------------------------------*/
1175   printf("Writing json traffic overview  %s ... ", json_traffic);
1176   /*-----------------------------------------------------------------*/
1177   write_json_traffic(json_traffic);
1178
1179   /*-----------------------------------------------------------------*/
1180   printf("Writing statistics into HTML page %s ...\n", html);
1181   /*-----------------------------------------------------------------*/
1182   write_htmlandlogs(html, d, total, just_preview);
1183  }
1184
1185  if(just_preview)
1186  {
1187   char swchar='p';
1188   if(start_shaping)
1189   {
1190    swchar='s';
1191   }
1192   else if(reduce_ceil)
1193   {
1194    swchar='0'+reduce_ceil; /* -2, -4 */
1195   }
1196   else if(stop_shaping)
1197   {
1198    swchar='q';
1199   }
1200
1201   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1202   exit(0);
1203  }
1204
1205  i=0;
1206 #ifdef DEBUG
1207  printf("%-22s %-15s mark\n","name","ip");
1208 #endif
1209
1210  printf("Writing %s", classmap);
1211  f = fopen(classmap, "w");
1212  if(f < 0)
1213  {
1214   perror(classmap);
1215  }
1216
1217  /*-----------------------------------------------------------------*/
1218  printf(" + generating iptables and tc classes ... ");
1219  /*-----------------------------------------------------------------*/
1220
1221  for_each(ip, ips) if(ip->mark > 0)
1222  {
1223   for_each(interface, interfaces)
1224   {
1225    char *chain;
1226    if(idxs)
1227    {
1228     char *buf;
1229     duplicate(ip->addr,buf);
1230     if(ip->v6)
1231     {
1232      buf=index6_id(ip->addr,64-idxtable_bitmask1);
1233     }
1234     else
1235     {
1236      buf=index_id(ip->addr,32-idxtable_bitmask1);
1237     }
1238
1239     string(chain, 6+strlen(buf));
1240     sprintf(chain, "%s_", interface->idxprefix);
1241     strcat(chain, buf);
1242
1243     free(buf);
1244    }
1245    else
1246    {
1247     chain = interface->chain;
1248    }
1249
1250    /* packet limits - this will be optional in future */
1251    if(ip->pps_limit)
1252    {
1253     sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1254                         ip->pps_limit, ip->pps_limit);
1255    }
1256    else
1257    {
1258     *limit_pkts = 0;
1259    }
1260
1261  #ifdef DEBUG
1262    printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1263  #endif
1264
1265    /* ------------------------------------------------ iptables classify */
1266    sprintf(str, "-A %s -%c %s/%d -o %s -j %s%d",
1267                 chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,
1268                 interface->name, mark_iptables, ip->mark);
1269    iptables_save_line(str, ip->v6);
1270
1271    sprintf(str, "-A %s -%c %s/%d -o %s %s-j ACCEPT",
1272                 chain, (interface->is_upstream?'s':'d'),ip->addr, ip->mask,
1273                 interface->name, limit_pkts);
1274    iptables_save_line(str, ip->v6);
1275
1276    if(limit_pkts)
1277    {
1278     /* classify overlimit packets to separate overlimit class */
1279     sprintf(str, "-A %s -%c %s/%d -o %s -j %s%d",
1280                  chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,
1281                  interface->name, mark_iptables, OVERLIMIT_CLASS);
1282     iptables_save_line(str, ip->v6);
1283
1284     sprintf(str, "-A %s -%c %s/%d -o %s -j ACCEPT",
1285                  chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,
1286                  interface->name);
1287     iptables_save_line(str, ip->v6);
1288    }
1289
1290    if(ip->min)
1291    {
1292     //TODO - min and max should not exceed interface->speed
1293
1294     /* -------------------------------------------------------- tc class */
1295  #ifdef DEBUG
1296     printf("[down: %dk-%dk]", ip->min, ip->max);
1297  #endif
1298
1299     sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1300                  tc, interface->name, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1301     safe_run(str);
1302
1303     if(strcmpi(ip->keyword->leaf_discipline, "none"))
1304     {
1305      sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1306                   tc, interface->name, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1307      safe_run(str);
1308     }
1309
1310     if(filter_type == 1)
1311     {
1312      sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1313                   tc, interface->name, ip->mark, ip->mark);
1314      safe_run(str);
1315     }
1316    }
1317    else
1318    {
1319  #ifdef DEBUG
1320     printf("(sharing %s)\n", ip->sharing);
1321  #endif
1322    }
1323    i++;
1324   }
1325   if(ip->min && f > 0)
1326   {
1327    fprintf(f, "%s %d\n", ip->addr, ip->mark);
1328   }
1329  }
1330  if(f > 0)
1331  {
1332   puts("done.");
1333   fclose(f);
1334  }
1335
1336  for_each(interface, interfaces)
1337  {
1338   char *chain;
1339   if(idxs)
1340   {
1341    string(chain, STRLEN);
1342    sprintf(chain, "%s_common", interface->idxprefix);
1343   }
1344   else
1345   {
1346    chain = interface->chain;
1347   }
1348
1349   if(free_min)
1350   {
1351    final_chain = "ACCEPT";
1352
1353    sprintf(str, "-A %s -o %s -j %s%d",
1354                 chain, interface->name, mark_iptables, FREE_CLASS);
1355    iptables_save_line(str, IPv4); /* only for IPv4 */
1356   }
1357
1358   sprintf(str,"-A %s -o %s -j %s", chain, interface->name, final_chain);
1359   iptables_save_line(str, IPv4);
1360   if(ip6prefix)
1361   {
1362    sprintf(str,"-A %s -o %s -j %s", chain, interface->name, final_chain);
1363    iptables_save_line(str, IPv6);
1364   }
1365
1366   if(free_min) /* allocate free bandwith if it is not zero... */
1367   {
1368    /*-----------------------------------------------------------------*/
1369    puts("Generating free bandwith class ...");
1370    /*-----------------------------------------------------------------*/
1371    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1372                 tc, interface->name, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1373    safe_run(str);
1374    /* tc SFQ */
1375    if(strcmpi(qos_leaf, "none"))
1376    {
1377      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, interface->name, FREE_CLASS, FREE_CLASS, qos_leaf);
1378      safe_run(str);
1379    }
1380    /* tc handle 1 fw flowid */
1381    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, interface->name, FREE_CLASS, FREE_CLASS);
1382    safe_run(str);
1383   }
1384   /*-----------------------------------------------------------------*/
1385   puts("Generating bandwith class for overlimit packets...");
1386   /*-----------------------------------------------------------------*/
1387   sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1388                tc, interface->name, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1389   safe_run(str);
1390  }
1391  printf("Total IP count: %d\n", i);
1392  run_iptables_restore();
1393  if(log_file)
1394  {
1395   fclose(log_file);
1396  }
1397  return 0;
1398  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1399  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1400 }