prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2015 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20160622
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.5-e";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.5 is development release, 0.8.6 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2015 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
  62 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  63 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  64 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  65 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  66 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  67 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  68 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  69 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  70 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  71 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  72 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  73 char    *html_log_dir = "/var/www/logs/html/";
  74
  75 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  76 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  77 int use_jquery_popups = TRUE;
  78 int      row_odd_even = 0; /*<tr class="odd/even"> */
  79
  80 /* === Configuraration file values defaults - stored in global variables ==== */
  81
  82 int        filter_type = 1; /*1 mark, 2 classify*/
  83 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  84 char             *mark = "MARK";
  85 char    *mark_iptables = "MARK --set-mark ";
  86 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  87 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  88 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  89 FILE    *iptables_file = NULL;
  90 FILE   *ip6tables_file = NULL;
  91 int      enable_credit = TRUE; /* enable credit file */
  92 int         use_credit = FALSE; /* use credit file (if enabled)*/
  93 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  94 int       hall_of_fame = TRUE; /* enable hall of fame */
  95 char              *lan = "eth0"; /* LAN interface */
  96 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  97 char              *wan = "eth1"; /* WAN/ISP interface */
  98 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  99 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
 100 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 101 char    *qos_free_zone = NULL; /* QoS free zone */
 102 /* int          qos_proxy = TRUE; include proxy port to QoS */
 103 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 104 int     include_upload = TRUE; /* upload+download=total traffic */
 105 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 106 /* int         proxy_port = 3128; proxy port number */
 107 long long int     line = 1024; /* WAN/ISP download in kbps */
 108 long long int       up = 1024; /* WAN/ISP upload in kbps */
 109 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 110 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 111 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 112 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 113 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 114 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 115 int        max_nesting = 5; /* /include/uapi/linux/pkt_sched.h: #define TC_HTB_MAXDEPTH 8 [... - 3 parent classes] */
 116 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 117 int              burst = 8; /* HTB burst (in kbits) */
 118 int         burst_main = 64;
 119 int        burst_group = 32;
 120 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 121 int       keywordcount = 0;
 122 int        class_count = 0;
 123 int           ip_count = 0;
 124 FILE         *log_file = NULL;
 125 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 126
 127 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 128 const int lowest_priority    = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */
 129 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 130 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 131 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 132 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 133
 134 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 135 struct Group *groups = NULL, *group;
 136 struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 137 struct Macro *macro, *macros = NULL;
 138
 139 #define FREE_CLASS      3
 140 #define OVERLIMIT_CLASS 4
 141
 142 void help(void);
 143 /* implemented in help.c */
 144
 145 void get_traffic_statistics(const char *whichiptables, int ipv6);
 146 /* implemented in parseiptables.c */
 147
 148 void parse_ip_log(int argc, char **argv);
 149 /* implemented in parselog.c */
 150
 151 void parse_hosts(char *hosts);
 152 /* implemented in parsehosts.c */
 153
 154 void write_json_traffic(char *json);
 155 /* implemented in json.c */
 156
 157 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 158 /* implemented in htmlandlogs.c */
 159
 160 void analyse_topology(char *traceroute);
 161 /* implemented in networks.c */
 162
 163 char *parse_datafile_line(char *str);
 164 /* implemented in utils.c */
 165
 166 time_t get_mtime(const char *path);
 167 /* implemented in utils.c */
 168
 169 const char *tr_odd_even(void)
 170 {
 171  row_odd_even = 1 - row_odd_even;
 172  if(row_odd_even)
 173  {
 174   return "<tr class=\"even\">\n";
 175  }
 176  else
 177  {
 178   return "<tr class=\"odd\">\n";
 179  }
 180 }
 181
 182 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 183 /* (except that this code uses obsolete, archaic version of this header file...)     */
 184
 185 struct Index
 186 {
 187  char *addr;
 188  char *id;
 189  struct Index *parent;
 190  int bitmask;
 191  int children;
 192  int ipv6;
 193  list(Index);
 194 } *idxs=NULL, *idx, *metaindex;
 195
 196
 197 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 198
 199 char *index_id(char *ip, int bitmask);
 200 /* function implemented in ipv4subnets.c */
 201
 202 char *subnet_id(char *ip, int bitmask);
 203 /* function implemented in ipv4subnets.c */
 204
 205 char *index6_id(char *ip, int bitmask);
 206 /* function implemented in ipv6subnets.c */
 207
 208 char *subnet6_id(char *ip, int bitmask);
 209 /* function implemented in ipv6subnets.c */
 210
 211 /* ================= Let's parse configuration file here ================ */
 212
 213 void reject_config_and_exit(char *filename)
 214 {
 215  printf("Configuration file %s rejected - abnormal exit.",filename);
 216  exit(-1);
 217 }
 218
 219 void get_config(char *config_filename)
 220 {
 221  char *cnf="mark";
 222
 223  printf("Configured keywords: ");
 224  parse(config_filename)
 225  {
 226   option("keyword",kwd);
 227   if(kwd)
 228   {
 229    printf("%s ",kwd);
 230
 231    create(keyword,Keyword);
 232    keyword->key = kwd;
 233    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 234    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 235    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 236    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 237    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 238    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 239    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 240    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 241    keyword->default_prio = highest_priority+1;
 242    keyword->download_aggregation = keyword->upload_aggregation = 0; /* disable by default */
 243    keyword->html_color = "000000";
 244    keyword->ip_count = 0;
 245    keyword->leaf_discipline = "";
 246    keyword->allowed_avgmtu = 0;
 247
 248    push(keyword, keywords);
 249    if(!defaultkeyword)
 250    {
 251     defaultkeyword = keyword;
 252    }
 253    keywordcount++;
 254
 255    kwd=NULL;
 256   }
 257   else
 258   {
 259     for_each(keyword,keywords)
 260     {
 261      int l=strlen(keyword->key);
 262
 263      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 264      {
 265       char *tmptr=_; /*  <---- l+1 ----> */
 266       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 267       foption("asymetry-ratio", keyword->asymetry_ratio);
 268       ioption("asymetry-treshold", keyword->asymetry_fixed);
 269       ioption("magic-relative-limit", keyword->data_limit);
 270       ioption("magic-relative-prio", keyword->data_prio);
 271       loption("magic-fixed-limit", keyword->fixed_limit);
 272       loption("magic-fixed-prio", keyword->fixed_prio);
 273       ioption("htb-default-prio", keyword->default_prio);
 274       ioption("htb-rate-bonus", keyword->reserve_min);
 275       ioption("htb-ceil-malus", keyword->reserve_max);
 276       ioption("download-aggregation", keyword->download_aggregation);
 277       ioption("upload-aggregation", keyword->upload_aggregation);
 278       option("leaf-discipline", keyword->leaf_discipline);
 279       option("html-color", keyword->html_color);
 280       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 281       _=tmptr;
 282
 283       if(keyword->data_limit || keyword->fixed_limit ||
 284          keyword->data_prio || keyword->fixed_prio)
 285       {
 286        use_credit=1;
 287       }
 288      }
 289     }
 290   }
 291
 292   option("tc",tc);
 293   option("iptables",iptables);
 294   option("iptables-save",iptablessave);
 295   option("iptables-restore",iptablesrestore);
 296   option("ip6tables",ip6tables);
 297   option("ip6tables-save",ip6tablessave);
 298   option("ip6tables-restore",ip6tablesrestore);
 299   option("iptables-in-filename",iptablesfile);
 300   option("ip6tables-in-filename",ip6tablesfile);
 301   option("hosts",hosts);
 302   option("lan-interface",lan);
 303   option("wan-interface",wan);
 304   option("ip6-prefix",ip6prefix);
 305   option("lan-medium",lan_medium);
 306   option("wan-medium",wan_medium);
 307   lloption("wan-download",line);
 308   lloption("wan-upload",up);
 309   ioption("hall-of-fame-enable",hall_of_fame);
 310   ioption("digital-divide-weirdness-ratio",digital_divide);
 311   option("hall-of-fame-title",title);
 312   option("hall-of-fame-filename",html);
 313   option("json-filename",json_traffic);
 314   option("hall-of-fame-preview",preview);
 315   option("json-preview",json_preview);
 316   option("log-filename",cmdlog);
 317   option("credit-filename",credit);
 318   option("classmap-filename",classmap);
 319   ioption("credit-enable",enable_credit);
 320   option("log-traffic-directory",log_dir);
 321   option("log-traffic-html-directory",html_log_dir);
 322   option("log-traffic-url-path",log_url);
 323   option("jquery-url",jquery_url);
 324   option("lms-url",lms_url);
 325   ioption("use-jquery-popups",use_jquery_popups);
 326   option("qos-free-zone",qos_free_zone);
 327   ioption("qos-free-delay",qos_free_delay);
 328 /*  ioption("qos-proxy-enable",qos_proxy); */
 329 /*  option("qos-proxy-ip",proxy_ip);*/
 330   option("htb-leaf-discipline",qos_leaf);
 331 /*  ioption("qos-proxy-port",proxy_port); */
 332   ioption("free-rate",free_min);
 333   ioption("free-ceil",free_max);
 334   ioption("overlimit-rate",overlimit_min);
 335   ioption("overlimit-ceil",overlimit_max);
 336   ioption("htb-burst",burst);
 337   ioption("htb-burst-main",burst_main);
 338   ioption("htb-burst-group",burst_group);
 339   ioption("htb-nesting-limit",max_nesting);
 340   ioption("htb-r2q",htb_r2q);
 341   ioption("magic-include-upload",include_upload);
 342   ioption("magic-treshold",magic_treshold);
 343   option("filter-type", cnf);
 344 /* not yet implemented:
 345   ioption("magic-fixed-packets",fixed_packets);
 346   ioption("magic-relative-packets",packet_limit);
 347 */
 348  }
 349  fail
 350  {
 351   perror(config_filename);
 352   puts("Warning - using built-in defaults instead ...");
 353  }
 354  done; /* ugly macro end */
 355  printf("\n");
 356
 357  /* leaf discipline for keywords */
 358  for_each(keyword,keywords)
 359  {
 360   if(!strcmpi(keyword->leaf_discipline, ""))
 361   {
 362    keyword->leaf_discipline = qos_leaf;
 363   }
 364  }
 365
 366  if(strcmpi(cnf, "mark"))
 367  {
 368   filter_type = 2;
 369   mark = "CLASSIFY";
 370   mark_iptables = "CLASSIFY --set-class 1:";
 371  }
 372  else
 373  {
 374   filter_type = 1;
 375   mark = "MARK";
 376   mark_iptables = "MARK --set-mark ";
 377  }
 378
 379  /* are supplied values meaningful ?*/
 380  if(line<=0 || up<=0)
 381  {
 382   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 383   reject_config_and_exit(config_filename);
 384  }
 385 }
 386
 387
 388 /* ========== This function executes, logs OR ALSO prints command ========== */
 389
 390 void safe_run(char *cmd)
 391 {
 392  if(dry_run)
 393  {
 394   printf("\n=>%s\n",cmd);
 395  }
 396  else
 397  {
 398   system(cmd);
 399  }
 400  if(log_file)
 401  {
 402   fprintf(log_file,"%s\n",cmd);
 403  }
 404 }
 405
 406 void iptables_save_line(char *line, int ipv6)
 407 {
 408  if(ipv6)
 409  {
 410   fprintf(ip6tables_file,"%s\n",line);
 411  }
 412  else
 413  {
 414   fprintf(iptables_file,"%s\n",line);
 415  }
 416 }
 417
 418 void run_iptables_restore(void)
 419 {
 420  char *restor;
 421  string(restor,STRLEN);
 422
 423  /*-----------------------------------------------------------------*/
 424  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 425  /*-----------------------------------------------------------------*/
 426
 427  iptables_save_line("COMMIT", FALSE);
 428  fclose(iptables_file);
 429  if(dry_run)
 430  {
 431   parse(iptablesfile)
 432   {
 433    printf("%s\n",_);
 434   }
 435   done; /* ugly macro end */
 436  }
 437
 438  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 439  safe_run(restor);
 440
 441  if(ip6prefix)
 442  {
 443   /*-----------------------------------------------------------------*/
 444   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 445   /*-----------------------------------------------------------------*/
 446   iptables_save_line("COMMIT", TRUE);
 447   fclose(ip6tables_file);
 448   if(dry_run)
 449   {
 450    parse(ip6tablesfile)
 451    {
 452     printf("%s\n",_);
 453    }
 454    done; /* ugly macro end */
 455   }
 456   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 457   safe_run(restor);
 458  }
 459  free(restor);
 460 }
 461
 462 /**/
 463
 464 char *parse_datafile_line(char *str);
 465 time_t get_mtime(const char *path);
 466
 467 /*-----------------------------------------------------------------*/
 468 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 469 /*-----------------------------------------------------------------*/
 470
 471 program
 472 {
 473  int i=0;                    /* just plain old Fortran style integer :-) */
 474  FILE *f=NULL;               /* everything is just stream of bytes... */
 475  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 476  char *substring, *limit_pkts;
 477
 478  int parent        = 1;
 479  int just_networks = FALSE;
 480  int just_flush    = FALSE;       /* deactivates all previous actions */
 481  int nodelay       = FALSE;
 482  int just_preview  = FALSE;       /* preview - generate just stats */
 483  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 484  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 485  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 486  int just_logs     = FALSE;       /* just parse logs */
 487  int run           = FALSE;
 488  int total         = 0;
 489
 490  char *chain_forward, *chain_postrouting;
 491  char *althosts=NULL;
 492
 493  printf("\n\
 494 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 495 Version %s - Copyright (C)2005-2015 Michael Polak, Arachne Labs\n\
 496 iptables-restore & burst tunning & classify modification by Ludva\n\
 497 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 498
 499  /*----- Boring... we have to check command line options first: ----*/
 500  arguments
 501  {
 502   argument("-c") { nextargument(config); }
 503   argument("-h") { nextargument(althosts);}
 504   argument("-d") { run=TRUE; dry_run=TRUE; }
 505   argument("-f") { run=TRUE; just_flush=TRUE; }
 506   argument("-9") { run=TRUE; just_flush=9; }
 507   argument("-p") { run=TRUE; just_preview=TRUE; }
 508   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 509   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 510   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 511   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 512   argument("-r") { run=TRUE; }
 513   argument("-n") { run=TRUE; nodelay=TRUE; }
 514   argument("-a") { run=TRUE; just_networks=TRUE; }
 515   argument("-l") { just_logs=TRUE; }
 516   argument("-m") { just_logs=TRUE; }
 517   argument("-y") { just_logs=TRUE; }
 518   argument("-?") { help(); exit(0); }
 519   argument("--help") { help(); exit(0); }
 520   argument("-v") { exit(0); }
 521   argument("--version") { exit(0); }
 522  }
 523
 524  if(dry_run)
 525  {
 526   puts("*** THIS IS JUST DRY RUN ! ***\n");
 527  }
 528
 529  date(d); /* this is typical cll1.h macro - prints current date */
 530
 531  /*-----------------------------------------------------------------*/
 532  printf("Parsing configuration file %s ...\n", config);
 533  /*-----------------------------------------------------------------*/
 534  get_config(config);
 535
 536  if(just_logs)
 537  {
 538   parse_ip_log(argc,argv);
 539   exit(0);
 540  }
 541  else if(not run)
 542  {
 543   help();
 544   exit(0);
 545  }
 546
 547  if(althosts)
 548  {
 549   hosts = althosts;
 550  }
 551
 552  if(just_flush<9)
 553  {
 554   /*-----------------------------------------------------------------*/
 555   puts("Parsing iptables verbose output ...");
 556   /*-----------------------------------------------------------------*/
 557   get_traffic_statistics(iptables, FALSE);
 558   if(ip6prefix)
 559   {
 560    /*-----------------------------------------------------------------*/
 561    puts("Parsing ip6tables verbose output ...");
 562    /*-----------------------------------------------------------------*/
 563    get_traffic_statistics(ip6tables, TRUE);
 564   }
 565  }
 566
 567  /*-----------------------------------------------------------------*/
 568  /* cll1.h - let's allocate brand new character buffer...           */
 569  /*-----------------------------------------------------------------*/
 570  string(str, STRLEN);
 571  string(limit_pkts, STRLEN);
 572
 573  /*-----------------------------------------------------------------*/
 574  printf("Parsing macro definition file %s ...\n", macrosfile);
 575  /*-----------------------------------------------------------------*/
 576  parse(macrosfile)
 577  {
 578   ptr = parse_datafile_line(_);
 579   if(ptr)
 580   {
 581    create(macro, Macro);
 582    macro->rewrite_from = _;
 583    macro->rewrite_to = ptr;
 584    push(macro, macros);
 585    printf("%s -> %s\n", macro->rewrite_from, macro->rewrite_to);
 586   }
 587  }
 588  done; /* ugly macro end */
 589
 590  /*-----------------------------------------------------------------*/
 591  printf("Parsing class defintion file %s ...\n", hosts);
 592  /*-----------------------------------------------------------------*/
 593  parse_hosts(hosts);
 594  if(just_networks)
 595  {
 596   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 597   exit(-1);
 598  }
 599
 600  /*-----------------------------------------------------------------*/
 601  puts("Resolving shared connections ...");
 602  /*-----------------------------------------------------------------*/
 603  for_each(ip, ips) if(ip->sharing)
 604  {
 605   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 606   {
 607    sharedip->traffic += ip->traffic;
 608    sharedip->traffic_down += ip->direct;
 609    sharedip->traffic_up += ip->upload;
 610    ip->traffic = 0;
 611    ip->mark = sharedip->mark;
 612    ip->lmsid = sharedip->lmsid;
 613    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 614
 615    /* Ugly hack: append IPv4 addresses of sharedip to IPv6 uplinks */
 616    ptr = strchr(ip->addr, '+');
 617    if(ptr && ptr-ip->addr > 1 && !sharedip->v6)
 618    {
 619     *(--ptr) = 0;
 620     concatenate(ip->addr, sharedip->addr, ptr);
 621     ip->name = ip->addr = ptr;
 622     ptr = strchr(ip->addr, '.');
 623     while(ptr && *ptr)
 624     {
 625      *ptr = ':';
 626      ptr = strchr(ptr, '.');
 627     }
 628     ip->mask += 64;
 629    }
 630
 631    break;
 632   }
 633   if(not sharedip)
 634   {
 635    printf("Unresolved shared connection: %s %s sharing-%s\n",
 636           ip->addr, ip->name, ip->sharing);
 637   }
 638  }
 639
 640  if(enable_credit && just_flush<9)
 641  {
 642   /*-----------------------------------------------------------------*/
 643   printf("Parsing credit file %s ...\n", credit);
 644   /*-----------------------------------------------------------------*/
 645   parse(credit)
 646   {
 647    ptr = parse_datafile_line(_);
 648    if(ptr)
 649    {
 650     if_exists(ip,ips,eq(ip->addr,_))
 651     {
 652      sscanf(ptr,"%Lu",&(ip->credit));
 653     }
 654    }
 655   }
 656   done; /* ugly macro end */
 657  }
 658
 659
 660  if(!just_preview)
 661  {
 662   /*-----------------------------------------------------------------*/
 663   puts("Initializing iptables and tc classes ...");
 664   /*-----------------------------------------------------------------*/
 665
 666   iptables_file = fopen(iptablesfile, "w");
 667   if(iptables_file == NULL)
 668   {
 669     perror(iptablesfile);
 670     exit(-1);
 671   }
 672   iptables_save_line(iptablespreamble, FALSE);
 673
 674   if(ip6prefix)
 675   {
 676    ip6tables_file = fopen(ip6tablesfile, "w");
 677    if(ip6tables_file == NULL)
 678    {
 679      perror(ip6tablesfile);
 680      exit(-1);
 681    }
 682    iptables_save_line(iptablespreamble, TRUE);
 683    iptables_save_line(ip6preamble, TRUE);
 684   }
 685
 686   run_iptables_restore();
 687
 688   log_file = fopen(cmdlog, "w");
 689   if(log_file == NULL)
 690   {
 691     perror(cmdlog);
 692     exit(-1);
 693   }
 694
 695   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 696   safe_run(str);
 697
 698   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 699   safe_run(str);
 700
 701   iptables_file=fopen(iptablesfile,"w");
 702   iptables_save_line(iptablespreamble, FALSE);
 703   if(ip6prefix)
 704   {
 705    ip6tables_file=fopen(ip6tablesfile,"w");
 706    iptables_save_line(iptablespreamble, TRUE);
 707    iptables_save_line(ip6preamble, TRUE);
 708   }
 709
 710   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 711   {
 712    char *chain;
 713
 714    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 715    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 716
 717 /*
 718    if(qos_proxy)
 719    {
 720     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 721     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 722     iptables_save_line(str , FALSE);
 723     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 724     iptables_save_line(str, FALSE);
 725     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 726     iptables_save_line(str, FALSE);
 727
 728     chain="post_noproxy";
 729    }
 730
 731    else
 732    {
 733 */
 734    chain = "POSTROUTING";
 735 //   }
 736
 737    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 738    iptables_save_line(str, FALSE);
 739   }
 740
 741   if(ip_count > idxtable_treshold1 && !just_flush)
 742   {
 743    int idxcount=0, bitmask=32-idxtable_bitmask1;
 744    char *subnet, *buf;
 745    /*-----------------------------------------------------------------*/
 746    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 747    /*-----------------------------------------------------------------*/
 748
 749    iptables_save_line(":post_common - [0:0]", FALSE);
 750    iptables_save_line(":forw_common - [0:0]", FALSE);
 751    if(ip6prefix)
 752    {
 753     iptables_save_line(":post_common - [0:0]", TRUE);
 754     iptables_save_line(":forw_common - [0:0]", TRUE);
 755    }
 756
 757    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 758    {
 759     if(ip->v6)
 760     {
 761      buf=index6_id(ip->addr,bitmask+32);
 762     }
 763     else
 764     {
 765      buf=index_id(ip->addr, bitmask);
 766     }
 767
 768     if_exists(idx,idxs,eq(idx->id,buf))
 769     {
 770      idx->children++;
 771     }
 772     else
 773     {
 774      create(idx,Index);
 775      idx->addr = ip->addr;
 776      idx->id = buf;
 777      idx->bitmask = bitmask+32*ip->v6;
 778      idx->parent = NULL;
 779      idx->children = 0;
 780      idx->ipv6 = ip->v6;
 781      idxcount++;
 782      push(idx,idxs);
 783     }
 784    }
 785
 786    /* brutal perfomance optimalization */
 787    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 788    {
 789     bitmask -= idxtable_bitmask2;
 790     idxcount = 0;
 791
 792     for_each(idx,idxs) if(idx->parent == NULL)
 793     {
 794      if(idx->ipv6)
 795      {
 796       buf = index6_id(idx->addr, bitmask+32);
 797      }
 798      else
 799      {
 800       buf = index_id(idx->addr, bitmask);
 801      }
 802      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 803      {
 804       metaindex->children++;
 805      }
 806      else
 807      {
 808       create(metaindex,Index);
 809       metaindex->addr = idx->addr;
 810       metaindex->id = buf;
 811       metaindex->bitmask = bitmask+32*idx->ipv6;
 812       metaindex->parent = NULL;
 813       metaindex->children = 0;
 814       metaindex->ipv6 = idx->ipv6;
 815       idxcount++;
 816       push(metaindex,idxs);
 817      }
 818      idx->parent=metaindex;
 819     }
 820    }
 821
 822    /* this should slightly optimize throughput ... */
 823    sort(idx,idxs,desc_order_by,children);
 824    sort(idx,idxs,order_by,bitmask);
 825
 826    i=0;
 827    for_each(idx,idxs)
 828    {
 829     if(idx->ipv6)
 830     {
 831      subnet=subnet6_id(idx->addr, idx->bitmask);
 832     }
 833     else
 834     {
 835      subnet=subnet_id(idx->addr, idx->bitmask);
 836     }
 837     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 838
 839     sprintf(str,":post_%s - [0:0]", idx->id);
 840     iptables_save_line(str, idx->ipv6);
 841
 842     sprintf(str,":forw_%s - [0:0]", idx->id);
 843     iptables_save_line(str, idx->ipv6);
 844
 845     if(idx->parent)
 846     {
 847      string(buf,strlen(idx->parent->id)+6);
 848      sprintf(buf,"post_%s", idx->parent->id);
 849     }
 850     else
 851     {
 852      buf="POSTROUTING";
 853     }
 854
 855     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 856     iptables_save_line(str, idx->ipv6);
 857
 858     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 859     iptables_save_line(str, idx->ipv6);
 860
 861     if(idx->parent)
 862     {
 863      string(buf,strlen(idx->parent->id)+6);
 864      sprintf(buf,"forw_%s",idx->parent->id);
 865     }
 866     else
 867     {
 868      buf="FORWARD";
 869     }
 870
 871     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 872     iptables_save_line(str, idx->ipv6);
 873
 874     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 875     iptables_save_line(str, idx->ipv6);
 876    }
 877    printf("Total indexed iptables chains created: %d\n", i);
 878
 879    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 880    iptables_save_line(str, FALSE);
 881
 882    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 883    iptables_save_line(str, FALSE);
 884
 885    if(ip6prefix)
 886    {
 887     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 888     iptables_save_line(str, TRUE);
 889
 890     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 891     iptables_save_line(str, TRUE);
 892    }
 893   }
 894  }
 895
 896  if(just_flush)
 897  {
 898   fclose(iptables_file);
 899   if(log_file)
 900   {
 901    fclose(log_file);
 902   }
 903   puts("Just flushed iptables and tc classes - now exiting ...");
 904   exit(0);
 905  }
 906
 907  if(!just_preview)
 908  {
 909   if(!dry_run && !nodelay && qos_free_delay)
 910   {
 911    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 912    sleep(qos_free_delay);
 913   }
 914
 915   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 916               tc,lan,htb_r2q);
 917   safe_run(str);
 918
 919   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 920                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 921   safe_run(str);
 922
 923   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 924                 tc,lan,line,line,burst_main,highest_priority);
 925   safe_run(str);
 926
 927   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 928   safe_run(str);
 929
 930   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 931                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 932   safe_run(str);
 933
 934   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 935                tc,wan,up,up,burst_main,highest_priority);
 936   safe_run(str);
 937  }
 938
 939  /*-----------------------------------------------------------------*/
 940  puts("Locating heavy downloaders and generating root classes ...");
 941  /*-----------------------------------------------------------------*/
 942  sort(ip,ips,desc_order_by,traffic);
 943
 944  /*-----------------------------------------------------------------*/
 945  /* sub-scope - local variables */
 946  {
 947   long long int rate = line;
 948   long long int max = line;
 949   int group_count = 0;
 950   FILE *credit_file = NULL;
 951
 952   if(!just_preview && !dry_run && enable_credit)
 953   {
 954    credit_file = fopen(credit,"w");
 955   }
 956
 957   for_each(group,groups)
 958   {
 959    if(!just_preview)
 960    {
 961     //download
 962     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 963                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 964     safe_run(str);
 965
 966     //upload
 967     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 968                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 969     safe_run(str);
 970    }
 971
 972    if(group_count++ < max_nesting)
 973    {
 974     parent = group->id;
 975    }
 976
 977    rate -= digital_divide*group->min;
 978    if(rate < group->min)
 979    {
 980     rate = group->min;
 981    }
 982
 983    /*shaping of aggresive downloaders, with credit file support */
 984    if(use_credit)
 985    {
 986     int group_rate = group->min, priority_sequence = lowest_priority;
 987
 988     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 989     {
 990      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 991      if(     ip->keyword->data_limit
 992          and not ip->fixedprio
 993          and ip->traffic > ip->realquota )
 994      {
 995       if(group_rate < ip->max)
 996       {
 997        ip->max = group_rate;
 998       }
 999       group_rate+=magic_treshold;
1000       ip->prio=lowest_priority;
1001       if(ip->prio<highest_priority+2)
1002       {
1003        ip->prio=highest_priority+2;
1004       }
1005      }
1006      else
1007      {
1008       if(    ip->keyword->data_prio
1009           && !ip->fixedprio
1010           && (   ip->traffic >   ip->credit + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
1011       {
1012        ip->prio=priority_sequence--;
1013        if(ip->prio<highest_priority+1)
1014        {
1015         ip->prio=highest_priority+1;
1016        }
1017       }
1018
1019       if(credit_file)
1020       {
1021        unsigned long long lcredit=0;
1022
1023        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
1024        {
1025         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
1026        }
1027        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
1028       }
1029      }
1030     }
1031    }
1032   }
1033   if(credit_file)
1034   {
1035    fclose(credit_file);
1036   }
1037  }
1038
1039  if(just_preview)
1040  {
1041   if(start_shaping || stop_shaping || reduce_ceil)
1042   {
1043    time_t how_much_seconds = time(NULL) - get_mtime(classmap); /* sice start of daily aggregation session */
1044    printf("Reading %s (%ld seconds old) and applying Fair Use Policy and Aggregation rules... \n", classmap, how_much_seconds);
1045
1046    parse(classmap)
1047    {
1048     ptr=strchr(_,' ');
1049     if(ptr)
1050     {
1051      *ptr=0;
1052      ptr++;
1053      if_exists(ip,ips,eq(ip->addr,_))
1054      {
1055       int unshape_this_ip = 0;
1056       long avg_mbps_down = ip->traffic_down * 8 / how_much_seconds;
1057       long avg_mbps_up = ip->traffic_up * 8 / how_much_seconds;
1058       int agreg = 1, print_stats = 1;
1059
1060       if(ip->keyword->download_aggregation)
1061       {
1062        int min_mbps = (ip->min/ip->keyword->download_aggregation)>>10;
1063        if(min_mbps < 1)
1064        {
1065         min_mbps = 1;
1066        }
1067
1068        if(min_mbps <= avg_mbps_down)
1069        {
1070         unshape_this_ip = 0;
1071         agreg = (int)((float)(avg_mbps_down+1)/min_mbps+.5);
1072         ip->max /= agreg;
1073         ip->pps_limit /= agreg;
1074         printf("Download aggregation 1:%d for %s (min: %lu Mbps avg: %ld Mbps)\n", agreg, ip->name, min_mbps, avg_mbps_down);
1075        }
1076        else
1077        {
1078         unshape_this_ip = 1;
1079        }
1080       }
1081       else if(ip->keyword->upload_aggregation)
1082       {
1083        int min_mbps = (ip->min/ip->keyword->upload_aggregation)>>10;
1084        if(min_mbps < 1)
1085        {
1086         min_mbps = 1;
1087        }
1088
1089        if(min_mbps <= avg_mbps_up)
1090        {
1091         unshape_this_ip = 0;
1092         agreg = (int)((float)(avg_mbps_up+1)/min_mbps+.5);
1093         ip->max /= agreg;
1094         printf("Upload aggregation 1:%d for %s: (min: %lu Mbps avg: %ld Mbps)\n", agreg, ip->name, min_mbps, avg_mbps_up);
1095        }
1096        else
1097        {
1098         unshape_this_ip = 1;
1099        }
1100       }
1101       if(stop_shaping)
1102       {
1103        unshape_this_ip = 1;
1104       }
1105       ip->aggregated = agreg;
1106       ip->mark = atoi(ptr);
1107       if(ip->max < ip->desired || unshape_this_ip || reduce_ceil) /* apply or disable FUP limit immediately.... */
1108       {
1109        if(unshape_this_ip)
1110        {
1111         ip->max = ip->desired;
1112         if(stop_shaping) /* all limits removed, but not printed with -s (start_shaping) switch */
1113         {
1114          printf("Removing limit for %s (%s) ", ip->name, ip->addr);
1115         }
1116         else
1117         {
1118          print_stats = 0;
1119         }
1120        }
1121        else
1122        {
1123         printf("Applying limit for %s (%s) ", ip->name, ip->addr);
1124         if(reduce_ceil)
1125         {
1126          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1127         }
1128         else if(ip->max < ip->min)
1129         {
1130          ip->max = ip->min;
1131         }
1132        }
1133        if(print_stats)
1134        {
1135         printf("(down: %dk-%dk wants %dk, ", ip->min, ip->max, ip->desired);
1136        }
1137        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1138                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1139        safe_run(str);
1140        if(print_stats)
1141        {
1142         printf("up: %dk-%dk wants %dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1143                                            (int)((ip->desired/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1144                                            (int)((ip->desired/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1145        }
1146        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1147                     tc, wan, ip->group, ip->mark,
1148                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1149                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1150        safe_run(str);
1151       }
1152      }
1153     }
1154    }
1155    fail
1156    {
1157     perror(classmap);
1158     puts("Warning - classmap file not fund, just generating preview ...");
1159     start_shaping=FALSE;
1160     stop_shaping=FALSE;
1161    }
1162    done; /* ugly macro end */
1163   }
1164   html=preview;
1165   json_traffic=json_preview;
1166  }
1167
1168  if(!dry_run && !just_flush)
1169  {
1170   /*-----------------------------------------------------------------*/
1171   printf("Writing json traffic overview  %s ... ", json_traffic);
1172   /*-----------------------------------------------------------------*/
1173   write_json_traffic(json_traffic);
1174
1175   /*-----------------------------------------------------------------*/
1176   printf("Writing statistics into HTML page %s ...\n", html);
1177   /*-----------------------------------------------------------------*/
1178   write_htmlandlogs(html, d, total, just_preview);
1179  }
1180
1181  if(just_preview)
1182  {
1183   char swchar='p';
1184   if(start_shaping)
1185   {
1186    swchar='s';
1187   }
1188   else if(reduce_ceil)
1189   {
1190    swchar='0'+reduce_ceil; /* -2, -4 */
1191   }
1192   else if(stop_shaping)
1193   {
1194    swchar='q';
1195   }
1196
1197   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1198   exit(0);
1199  }
1200
1201  i=0;
1202 #ifdef DEBUG
1203  printf("%-22s %-15s mark\n","name","ip");
1204 #endif
1205
1206  printf("Writing %s", classmap);
1207  f = fopen(classmap, "w");
1208  if(f < 0)
1209  {
1210   perror(classmap);
1211  }
1212
1213  /*-----------------------------------------------------------------*/
1214  printf(" + generating iptables and tc classes ... ");
1215  /*-----------------------------------------------------------------*/
1216
1217  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1218  {
1219   if(idxs)
1220   {
1221    char *buf;
1222    duplicate(ip->addr,buf);
1223    if(ip->v6)
1224    {
1225     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1226    }
1227    else
1228    {
1229     buf=index_id(ip->addr,32-idxtable_bitmask1);
1230    }
1231
1232    string(chain_forward,6+strlen(buf));
1233    strcpy(chain_forward,"forw_");
1234    strcat(chain_forward,buf);
1235
1236    string(chain_postrouting,6+strlen(buf));
1237    strcpy(chain_postrouting,"post_");
1238    strcat(chain_postrouting,buf);
1239
1240    free(buf);
1241   }
1242   else
1243   {
1244    chain_forward="FORWARD";
1245    chain_postrouting="POSTROUTING";
1246   }
1247
1248   /* packet limits - this will be optional in future */
1249   if(ip->pps_limit)
1250   {
1251    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1252                        ip->pps_limit, ip->pps_limit);
1253   }
1254   else
1255   {
1256    *limit_pkts = 0;
1257   }
1258
1259 #ifdef DEBUG
1260   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1261 #endif
1262
1263   /* -------------------------------------------------------- mark download */
1264   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1265                chain_postrouting, ip->addr, ip->mask,
1266                lan, mark_iptables, ip->mark);
1267   iptables_save_line(str, ip->v6);
1268
1269 /*
1270   if(qos_proxy)
1271   {
1272    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1273                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1274                 ip->mask, lan, mark_iptables, ip->mark);
1275    iptables_save_line(str, ip->v6);
1276   }
1277 */
1278   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1279                chain_postrouting, ip->addr, ip->mask, lan, limit_pkts);
1280   iptables_save_line(str, ip->v6);
1281
1282   /* classify overlimit packets to separate overlimit class */
1283   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1284                chain_postrouting, ip->addr, ip->mask,
1285                lan, mark_iptables, OVERLIMIT_CLASS);
1286   iptables_save_line(str, ip->v6);
1287
1288   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1289                chain_postrouting, ip->addr, ip->mask, lan);
1290   iptables_save_line(str, ip->v6);
1291
1292   /* -------------------------------------------------------- mark upload */
1293   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1294                chain_forward, ip->addr, ip->mask, wan, mark_iptables, ip->mark);
1295   iptables_save_line(str, ip->v6);
1296
1297   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1298                chain_forward, ip->addr, ip->mask, wan, limit_pkts);
1299   iptables_save_line(str, ip->v6);
1300
1301   /* classify overlimit packets to separate overlimit class */
1302   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1303                chain_forward, ip->addr, ip->mask, wan, mark_iptables, OVERLIMIT_CLASS);
1304   iptables_save_line(str, ip->v6);
1305
1306   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1307                chain_forward, ip->addr, ip->mask, wan);
1308   iptables_save_line(str, ip->v6);
1309
1310   if(ip->min)
1311   {
1312    /* -------------------------------------------------------- download class */
1313 #ifdef DEBUG
1314    printf("(down: %dk-%dk ", ip->min, ip->max);
1315 #endif
1316
1317    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1318                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1319    safe_run(str);
1320
1321    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1322    {
1323     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1324                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1325     safe_run(str);
1326    }
1327
1328    if(filter_type == 1)
1329    {
1330     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1331                  tc, lan, ip->mark, ip->mark);
1332     safe_run(str);
1333    }
1334
1335    /* -------------------------------------------------------- upload class */
1336 #ifdef DEBUG
1337    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1338                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1339 #endif
1340
1341    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1342                 tc, wan, ip->group, ip->mark,
1343                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1344                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1345    safe_run(str);
1346
1347    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1348    {
1349     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1350                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1351     safe_run(str);
1352    }
1353
1354    if(filter_type == 1)
1355    {
1356     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1357                  tc, wan, ip->mark, ip->mark);
1358     safe_run(str);
1359    }
1360
1361    if(f > 0)
1362    {
1363     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1364    }
1365   }
1366   else
1367   {
1368 #ifdef DEBUG
1369    printf("(sharing %s)\n", ip->sharing);
1370 #endif
1371   }
1372   i++;
1373  }
1374  if(f > 0)
1375  {
1376   puts("done.");
1377   fclose(f);
1378  }
1379
1380  if(idxs)
1381  {
1382   chain_forward = "forw_common";
1383   chain_postrouting = "post_common";
1384  }
1385  else
1386  {
1387   chain_forward = "FORWARD";
1388   chain_postrouting = "POSTROUTING";
1389  }
1390
1391  if(free_min)
1392  {
1393   final_chain = "ACCEPT";
1394  }
1395
1396 /*
1397  if(qos_proxy)
1398  {
1399   if(free_min)
1400   {
1401    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1402                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1403    iptables_save_line(str, FALSE); // only for IPv4
1404   }
1405   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1406                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1407   iptables_save_line(str, FALSE); // only for IPv4
1408  }
1409 */
1410
1411  if(free_min)
1412  {
1413   sprintf(str, "-A %s -o %s -j %s%d",
1414                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1415   iptables_save_line(str, FALSE); /* only for IPv4 */
1416  }
1417
1418  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1419  iptables_save_line(str, FALSE);
1420  if(ip6prefix)
1421  {
1422   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1423   iptables_save_line(str, TRUE);
1424  }
1425
1426  if(free_min)
1427  {
1428   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1429   iptables_save_line(str, FALSE); /* only for IPv4 */
1430  }
1431
1432  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1433  iptables_save_line(str, FALSE);
1434  if(ip6prefix)
1435  {
1436   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1437   iptables_save_line(str, TRUE);
1438  }
1439
1440  if(free_min) /* allocate free bandwith if it is not zero... */
1441  {
1442    /*-----------------------------------------------------------------*/
1443    puts("Generating free bandwith class ...");
1444    /*-----------------------------------------------------------------*/
1445    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1446                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1447    safe_run(str);
1448    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1449                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1450    safe_run(str);
1451    /* tc SFQ */
1452    if(strcmpi(qos_leaf, "none"))
1453    {
1454      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1455      safe_run(str);
1456
1457      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1458      safe_run(str);
1459    }
1460    /* tc handle 1 fw flowid */
1461    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1462    safe_run(str);
1463
1464    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1465    safe_run(str);
1466
1467    /*-----------------------------------------------------------------*/
1468    puts("Generating bandwith class for overlimit packets...");
1469    /*-----------------------------------------------------------------*/
1470    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1471                 tc, lan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1472    safe_run(str);
1473    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1474                 tc, wan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1475    safe_run(str);
1476  }
1477  printf("Total IP count: %d\n", i);
1478  run_iptables_restore();
1479  if(log_file)
1480  {
1481   fclose(log_file);
1482  }
1483  return 0;
1484  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1485  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1486 }