prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20131119
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.3-j";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2013 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  62 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  63 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  64 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  65 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  66 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  67 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  68 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  69 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  70 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  71 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  72 char    *html_log_dir = "/var/www/logs/html/";
  73
  74 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  75 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  76 int use_jquery_popups = TRUE;
  77 int      row_odd_even = 0; /*<tr class="odd/even"> */
  78
  79 /* === Configuraration file values defaults - stored in global variables ==== */
  80
  81 int        filter_type = 1; /*1 mark, 2 classify*/
  82 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  83 char             *mark = "MARK";
  84 char    *mark_iptables = "MARK --set-mark ";
  85 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  86 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  87 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  88 FILE    *iptables_file = NULL;
  89 FILE   *ip6tables_file = NULL;
  90 int      enable_credit = TRUE; /* enable credit file */
  91 int         use_credit = FALSE; /* use credit file (if enabled)*/
  92 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  93 int       hall_of_fame = TRUE; /* enable hall of fame */
  94 char              *lan = "eth0"; /* LAN interface */
  95 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  96 char              *wan = "eth1"; /* WAN/ISP interface */
  97 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  98 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  99 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 100 char    *qos_free_zone = NULL; /* QoS free zone */
 101 int          qos_proxy = TRUE; /* include proxy port to QoS */
 102 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 103 int     include_upload = TRUE; /* upload+download=total traffic */
 104 char         *proxy_ip = "192.168.1.1/32"; /* our IP with proxy port */
 105 int         proxy_port = 3128; /* proxy port number */
 106 long long int     line = 1024; /* WAN/ISP download in kbps */
 107 long long int       up = 1024; /* WAN/ISP upload in kbps */
 108 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 109 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 110 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 111 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 112 int        max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */
 113 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 114 int              burst = 8; /* HTB burst (in kbits) */
 115 int         burst_main = 64;
 116 int        burst_group = 32;
 117 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 118 int       keywordcount = 0;
 119 int        class_count = 0;
 120 int           ip_count = 0;
 121 FILE         *log_file = NULL;
 122 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 123
 124 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 125 const int lowest_priority    = 7; /* lowest HTB priority (HTB built-in value is 7) */
 126 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 127 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 128 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 129 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 130
 131 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 132 struct Group *groups = NULL, *group;
 133 struct Keyword *keyword, *defaultkeyword=NULL, *keywords=NULL;
 134
 135 #define FREE_CLASS      3
 136 #define OVERLIMIT_CLASS 4
 137
 138 void help(void);
 139 /* implemented in help.c */
 140
 141 void get_traffic_statistics(const char *whichiptables, int ipv6);
 142 /* implemented in parseiptables.c */
 143
 144 void parse_ip_log(int argc, char **argv);
 145 /* implemented in parselog.c */
 146
 147 void parse_hosts(char *hosts);
 148 /* implemented in parsehosts.c */
 149
 150 void write_json_traffic(char *json);
 151 /* implemented in json.c */
 152
 153 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 154 /* implemented in htmlandlogs.c */
 155
 156 void analyse_topology(char *traceroute);
 157 /* implemented in networks.c */
 158
 159
 160 const char *tr_odd_even(void)
 161 {
 162  row_odd_even = 1 - row_odd_even;
 163  if(row_odd_even)
 164  {
 165   return "<tr class=\"even\">\n";
 166  }
 167  else
 168  {
 169   return "<tr class=\"odd\">\n";
 170  }
 171 }
 172
 173 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 174 /* (except that this code uses obsolete, archaic version of this header file...)     */
 175
 176 struct Index
 177 {
 178  char *addr;
 179  char *id;
 180  struct Index *parent;
 181  int bitmask;
 182  int children;
 183  int ipv6;
 184  list(Index);
 185 } *idxs=NULL, *idx, *metaindex;
 186
 187
 188 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 189
 190 char *index_id(char *ip, int bitmask);
 191 /* function implemented in ipv4subnets.c */
 192
 193 char *subnet_id(char *ip, int bitmask);
 194 /* function implemented in ipv4subnets.c */
 195
 196 char *index6_id(char *ip, int bitmask);
 197 /* function implemented in ipv6subnets.c */
 198
 199 char *subnet6_id(char *ip, int bitmask);
 200 /* function implemented in ipv6subnets.c */
 201
 202 /* ================= Let's parse configuration file here ================ */
 203
 204 void reject_config_and_exit(char *filename)
 205 {
 206  printf("Configuration file %s rejected - abnormal exit.",filename);
 207  exit(-1);
 208 }
 209
 210 void get_config(char *config_filename)
 211 {
 212  char *cnf="mark";
 213
 214  printf("Configured keywords: ");
 215  parse(config_filename)
 216  {
 217   option("keyword",kwd);
 218   if(kwd)
 219   {
 220    printf("%s ",kwd);
 221
 222    create(keyword,Keyword);
 223    keyword->key=kwd;
 224    keyword->asymetry_ratio=1;          /* ratio for ADSL-like upload */
 225    keyword->asymetry_fixed=0;          /* fixed treshold for ADSL-like upload */
 226    keyword->data_limit=8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 227    keyword->data_prio=4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 228    keyword->fixed_limit=0;             /* fixed data limit for setting lower HTB ceil */
 229    keyword->fixed_prio=0;              /* fixed data limit for setting lower HTB prio */
 230    keyword->reserve_min=8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 231    keyword->reserve_max=0;             /* malus for nominal HTB ceil (in kbps) */
 232    keyword->default_prio=highest_priority+1;
 233    keyword->html_color="000000";
 234    keyword->ip_count=0;
 235    keyword->leaf_discipline="";
 236
 237    push(keyword,keywords);
 238    if(!defaultkeyword)
 239    {
 240     defaultkeyword=keyword;
 241    }
 242    keywordcount++;
 243
 244    kwd=NULL;
 245   }
 246   else
 247   {
 248     for_each(keyword,keywords)
 249     {
 250      int l=strlen(keyword->key);
 251
 252      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 253      {
 254       char *tmptr=_; /*  <---- l+1 ----> */
 255       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 256       ioption("asymetry-ratio",keyword->asymetry_ratio);
 257       ioption("asymetry-treshold",keyword->asymetry_fixed);
 258       ioption("magic-relative-limit",keyword->data_limit);
 259       ioption("magic-relative-prio",keyword->data_prio);
 260       loption("magic-fixed-limit",keyword->fixed_limit);
 261       loption("magic-fixed-prio",keyword->fixed_prio);
 262       ioption("htb-default-prio",keyword->default_prio);
 263       ioption("htb-rate-bonus",keyword->reserve_min);
 264       ioption("htb-ceil-malus",keyword->reserve_max);
 265       option("leaf-discipline",keyword->leaf_discipline);
 266       option("html-color",keyword->html_color);
 267       _=tmptr;
 268
 269       if(keyword->data_limit || keyword->fixed_limit ||
 270          keyword->data_prio || keyword->fixed_prio)
 271       {
 272        use_credit=1;
 273       }
 274      }
 275     }
 276   }
 277
 278   option("tc",tc);
 279   option("iptables",iptables);
 280   option("iptables-save",iptablessave);
 281   option("iptables-restore",iptablesrestore);
 282   option("ip6tables",ip6tables);
 283   option("ip6tables-save",ip6tablessave);
 284   option("ip6tables-restore",ip6tablesrestore);
 285   option("iptables-in-filename",iptablesfile);
 286   option("ip6tables-in-filename",ip6tablesfile);
 287   option("hosts",hosts);
 288   option("lan-interface",lan);
 289   option("wan-interface",wan);
 290   option("ip6-prefix",ip6prefix);
 291   option("lan-medium",lan_medium);
 292   option("wan-medium",wan_medium);
 293   lloption("wan-download",line);
 294   lloption("wan-upload",up);
 295   ioption("hall-of-fame-enable",hall_of_fame);
 296   option("hall-of-fame-title",title);
 297   option("hall-of-fame-filename",html);
 298   option("json-filename",json_traffic);
 299   option("hall-of-fame-preview",preview);
 300   option("json-preview",json_preview);
 301   option("log-filename",cmdlog);
 302   option("credit-filename",credit);
 303   option("classmap-filename",classmap);
 304   ioption("credit-enable",enable_credit);
 305   option("log-traffic-directory",log_dir);
 306   option("log-traffic-html-directory",html_log_dir);
 307   option("log-traffic-url-path",log_url);
 308   option("jquery-url",jquery_url);
 309   option("lms-url",lms_url);
 310   ioption("use-jquery-popups",use_jquery_popups);
 311   option("qos-free-zone",qos_free_zone);
 312   ioption("qos-free-delay",qos_free_delay);
 313   ioption("qos-proxy-enable",qos_proxy);
 314   option("qos-proxy-ip",proxy_ip);
 315   option("htb-leaf-discipline",qos_leaf);
 316   ioption("qos-proxy-port",proxy_port);
 317   ioption("free-rate",free_min);
 318   ioption("free-ceil",free_max);
 319   ioption("htb-burst",burst);
 320   ioption("htb-burst-main",burst_main);
 321   ioption("htb-burst-group",burst_group);
 322   ioption("htb-nesting-limit",max_nesting);
 323   ioption("htb-r2q",htb_r2q);
 324   ioption("magic-include-upload",include_upload);
 325   ioption("magic-treshold",magic_treshold);
 326   option("filter-type", cnf);
 327 /* not yet implemented:
 328   ioption("magic-fixed-packets",fixed_packets);
 329   ioption("magic-relative-packets",packet_limit);
 330 */
 331  }
 332  fail
 333  {
 334   perror(config_filename);
 335   puts("Warning - using built-in defaults instead ...");
 336  }
 337  done; /* ugly macro end */
 338  printf("\n");
 339
 340  /* leaf discipline for keywords */
 341  for_each(keyword,keywords)
 342  {
 343   if(!strcmpi(keyword->leaf_discipline, ""))
 344   {
 345    keyword->leaf_discipline = qos_leaf;
 346   }
 347  }
 348
 349  if(strcmpi(cnf, "mark"))
 350  {
 351   filter_type = 2;
 352   mark = "CLASSIFY";
 353   mark_iptables = "CLASSIFY --set-class 1:";
 354  }
 355  else
 356  {
 357   filter_type = 1;
 358   mark = "MARK";
 359   mark_iptables = "MARK --set-mark ";
 360  }
 361
 362  /* are supplied values meaningful ?*/
 363  if(line<=0 || up<=0)
 364  {
 365   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 366   reject_config_and_exit(config_filename);
 367  }
 368 }
 369
 370
 371 /* ========== This function executes, logs OR ALSO prints command ========== */
 372
 373 void safe_run(char *cmd)
 374 {
 375  if(dry_run)
 376  {
 377   printf("\n=>%s\n",cmd);
 378  }
 379  else
 380  {
 381   system(cmd);
 382  }
 383  if(log_file)
 384  {
 385   fprintf(log_file,"%s\n",cmd);
 386  }
 387 }
 388
 389 void iptables_save_line(char *line, int ipv6)
 390 {
 391  if(ipv6)
 392  {
 393   fprintf(ip6tables_file,"%s\n",line);
 394  }
 395  else
 396  {
 397   fprintf(iptables_file,"%s\n",line);
 398  }
 399 }
 400
 401 void run_iptables_restore(void)
 402 {
 403  char *restor;
 404  string(restor,STRLEN);
 405
 406  /*-----------------------------------------------------------------*/
 407  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 408  /*-----------------------------------------------------------------*/
 409
 410  iptables_save_line("COMMIT", FALSE);
 411  fclose(iptables_file);
 412  if(dry_run)
 413  {
 414   parse(iptablesfile)
 415   {
 416    printf("%s\n",_);
 417   }
 418   done; /* ugly macro end */
 419  }
 420
 421  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 422  safe_run(restor);
 423
 424  if(ip6prefix)
 425  {
 426   /*-----------------------------------------------------------------*/
 427   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 428   /*-----------------------------------------------------------------*/
 429   iptables_save_line("COMMIT", TRUE);
 430   fclose(ip6tables_file);
 431   if(dry_run)
 432   {
 433    parse(ip6tablesfile)
 434    {
 435     printf("%s\n",_);
 436    }
 437    done; /* ugly macro end */
 438   }
 439   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 440   safe_run(restor);
 441  }
 442  free(restor);
 443 }
 444
 445 char *parse_datafile_line(char *str)
 446 {
 447  char *ptr=strchr(str,' ');
 448
 449  if(ptr)
 450  {
 451   *ptr=0;
 452   ptr++;
 453   return ptr;
 454  }
 455  else
 456  {
 457   return NULL;
 458  }
 459 }
 460
 461
 462 /*-----------------------------------------------------------------*/
 463 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 464 /*-----------------------------------------------------------------*/
 465
 466 program
 467 {
 468  int i=0;                    /* just plain old Fortran style integer :-) */
 469  FILE *f=NULL;               /* everything is just stream of bytes... */
 470  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 471  char *substring, *limit_pkts;
 472
 473  int parent        = 1;
 474  int just_networks = FALSE;
 475  int just_flush    = FALSE;       /* deactivates all previous actions */
 476  int nodelay       = FALSE;
 477  int just_preview  = FALSE;       /* preview - generate just stats */
 478  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 479  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 480  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 481  int just_logs     = FALSE;       /* just parse logs */
 482  int run           = FALSE;
 483  int total         = 0;
 484
 485  char *chain_forward, *chain_postrouting;
 486  char *althosts=NULL;
 487
 488  printf("\n\
 489 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 490 Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\
 491 iptables-restore & burst tunning & classify modification by Ludva\n\
 492 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 493
 494  /*----- Boring... we have to check command line options first: ----*/
 495  arguments
 496  {
 497   argument("-c") { nextargument(config); }
 498   argument("-h") { nextargument(althosts);}
 499   argument("-d") { run=TRUE; dry_run=TRUE; }
 500   argument("-f") { run=TRUE; just_flush=TRUE; }
 501   argument("-9") { run=TRUE; just_flush=9; }
 502   argument("-p") { run=TRUE; just_preview=TRUE; }
 503   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 504   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 505   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 506   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 507   argument("-r") { run=TRUE; }
 508   argument("-n") { run=TRUE; nodelay=TRUE; }
 509   argument("-a") { run=TRUE; just_networks=TRUE; }
 510   argument("-l") { just_logs=TRUE; }
 511   argument("-m") { just_logs=TRUE; }
 512   argument("-y") { just_logs=TRUE; }
 513   argument("-?") { help(); exit(0); }
 514   argument("--help") { help(); exit(0); }
 515   argument("-v") { exit(0); }
 516   argument("--version") { exit(0); }
 517  }
 518
 519  if(dry_run)
 520  {
 521   puts("*** THIS IS JUST DRY RUN ! ***\n");
 522  }
 523
 524  date(d); /* this is typical cll1.h macro - prints current date */
 525
 526  /*-----------------------------------------------------------------*/
 527  printf("Parsing configuration file %s ...\n", config);
 528  /*-----------------------------------------------------------------*/
 529  get_config(config);
 530
 531  if(just_logs)
 532  {
 533   parse_ip_log(argc,argv);
 534   exit(0);
 535  }
 536  else if(not run)
 537  {
 538   help();
 539   exit(0);
 540  }
 541
 542  if(althosts)
 543  {
 544   hosts = althosts;
 545  }
 546
 547  if(just_flush<9)
 548  {
 549   /*-----------------------------------------------------------------*/
 550   puts("Parsing iptables verbose output ...");
 551   /*-----------------------------------------------------------------*/
 552   get_traffic_statistics(iptables, FALSE);
 553   if(ip6prefix)
 554   {
 555    /*-----------------------------------------------------------------*/
 556    puts("Parsing ip6tables verbose output ...");
 557    /*-----------------------------------------------------------------*/
 558    get_traffic_statistics(ip6tables, TRUE);
 559   }
 560  }
 561
 562  /*-----------------------------------------------------------------*/
 563  /* cll1.h - let's allocate brand new character buffer...           */
 564  /*-----------------------------------------------------------------*/
 565  string(str, STRLEN);
 566  string(limit_pkts, STRLEN);
 567
 568  /*-----------------------------------------------------------------*/
 569  printf("Parsing class defintion file %s ...\n", hosts);
 570  /*-----------------------------------------------------------------*/
 571  parse_hosts(hosts);
 572  if(just_networks)
 573  {
 574   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 575   exit(-1);
 576  }
 577
 578  /*-----------------------------------------------------------------*/
 579  puts("Resolving shared connections ...");
 580  /*-----------------------------------------------------------------*/
 581  for_each(ip, ips) if(ip->sharing)
 582  {
 583   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 584   {
 585    sharedip->traffic += ip->traffic;
 586    ip->traffic = 0;
 587    ip->mark = sharedip->mark;
 588    ip->lmsid = sharedip->lmsid;
 589    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 590    break;
 591   }
 592   if(not sharedip)
 593   {
 594    printf("Unresolved shared connection: %s %s sharing-%s\n",
 595           ip->addr, ip->name, ip->sharing);
 596   }
 597  }
 598
 599  if(enable_credit && just_flush<9)
 600  {
 601   /*-----------------------------------------------------------------*/
 602   printf("Parsing credit file %s ...\n", credit);
 603   /*-----------------------------------------------------------------*/
 604   parse(credit)
 605   {
 606    ptr=parse_datafile_line(_);
 607    if(ptr)
 608    {
 609     if_exists(ip,ips,eq(ip->addr,_))
 610     {
 611      sscanf(ptr,"%Lu",&(ip->credit));
 612     }
 613    }
 614   }
 615   done; /* ugly macro end */
 616  }
 617
 618  if(!just_preview)
 619  {
 620   /*-----------------------------------------------------------------*/
 621   puts("Initializing iptables and tc classes ...");
 622   /*-----------------------------------------------------------------*/
 623
 624   iptables_file = fopen(iptablesfile, "w");
 625   if(iptables_file == NULL)
 626   {
 627     perror(iptablesfile);
 628     exit(-1);
 629   }
 630   iptables_save_line(iptablespreamble, FALSE);
 631
 632   if(ip6prefix)
 633   {
 634    ip6tables_file = fopen(ip6tablesfile, "w");
 635    if(ip6tables_file == NULL)
 636    {
 637      perror(ip6tablesfile);
 638      exit(-1);
 639    }
 640    iptables_save_line(iptablespreamble, TRUE);
 641    iptables_save_line(ip6preamble, TRUE);
 642   }
 643
 644   run_iptables_restore();
 645
 646   log_file = fopen(cmdlog, "w");
 647   if(log_file == NULL)
 648   {
 649     perror(cmdlog);
 650     exit(-1);
 651   }
 652
 653   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 654   safe_run(str);
 655
 656   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 657   safe_run(str);
 658
 659   iptables_file=fopen(iptablesfile,"w");
 660   iptables_save_line(iptablespreamble, FALSE);
 661   if(ip6prefix)
 662   {
 663    ip6tables_file=fopen(ip6tablesfile,"w");
 664    iptables_save_line(iptablespreamble, TRUE);
 665    iptables_save_line(ip6preamble, TRUE);
 666   }
 667
 668   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 669   {
 670    char *chain;
 671
 672    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 673    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 674
 675 /*
 676    if(qos_proxy)
 677    {
 678     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 679     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 680     iptables_save_line(str , FALSE);
 681     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 682     iptables_save_line(str, FALSE);
 683     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 684     iptables_save_line(str, FALSE);
 685
 686     chain="post_noproxy";
 687    }
 688
 689    else
 690    {
 691 */
 692    chain = "POSTROUTING";
 693 //   }
 694
 695    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 696    iptables_save_line(str, FALSE);
 697   }
 698
 699   if(ip_count > idxtable_treshold1 && !just_flush)
 700   {
 701    int idxcount=0, bitmask=32-idxtable_bitmask1;
 702    char *subnet, *buf;
 703    /*-----------------------------------------------------------------*/
 704    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 705    /*-----------------------------------------------------------------*/
 706
 707    iptables_save_line(":post_common - [0:0]", FALSE);
 708    iptables_save_line(":forw_common - [0:0]", FALSE);
 709    if(ip6prefix)
 710    {
 711     iptables_save_line(":post_common - [0:0]", TRUE);
 712     iptables_save_line(":forw_common - [0:0]", TRUE);
 713    }
 714
 715    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 716    {
 717     if(ip->v6)
 718     {
 719      buf=index6_id(ip->addr,bitmask+32);
 720     }
 721     else
 722     {
 723      buf=index_id(ip->addr, bitmask);
 724     }
 725
 726     if_exists(idx,idxs,eq(idx->id,buf))
 727     {
 728      idx->children++;
 729     }
 730     else
 731     {
 732      create(idx,Index);
 733      idx->addr = ip->addr;
 734      idx->id = buf;
 735      idx->bitmask = bitmask+32*ip->v6;
 736      idx->parent = NULL;
 737      idx->children = 0;
 738      idx->ipv6 = ip->v6;
 739      idxcount++;
 740      push(idx,idxs);
 741     }
 742    }
 743
 744    /* brutal perfomance optimalization */
 745    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 746    {
 747     bitmask -= idxtable_bitmask2;
 748     idxcount = 0;
 749
 750     for_each(idx,idxs) if(idx->parent == NULL)
 751     {
 752      if(idx->ipv6)
 753      {
 754       buf = index6_id(idx->addr, bitmask+32);
 755      }
 756      else
 757      {
 758       buf = index_id(idx->addr, bitmask);
 759      }
 760      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 761      {
 762       metaindex->children++;
 763      }
 764      else
 765      {
 766       create(metaindex,Index);
 767       metaindex->addr = idx->addr;
 768       metaindex->id = buf;
 769       metaindex->bitmask = bitmask+32*idx->ipv6;
 770       metaindex->parent = NULL;
 771       metaindex->children = 0;
 772       metaindex->ipv6 = idx->ipv6;
 773       idxcount++;
 774       push(metaindex,idxs);
 775      }
 776      idx->parent=metaindex;
 777     }
 778    }
 779
 780    /* this should slightly optimize throughput ... */
 781    sort(idx,idxs,desc_order_by,children);
 782    sort(idx,idxs,order_by,bitmask);
 783
 784    i=0;
 785    for_each(idx,idxs)
 786    {
 787     if(idx->ipv6)
 788     {
 789      subnet=subnet6_id(idx->addr, idx->bitmask);
 790     }
 791     else
 792     {
 793      subnet=subnet_id(idx->addr, idx->bitmask);
 794     }
 795     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 796
 797     sprintf(str,":post_%s - [0:0]", idx->id);
 798     iptables_save_line(str, idx->ipv6);
 799
 800     sprintf(str,":forw_%s - [0:0]", idx->id);
 801     iptables_save_line(str, idx->ipv6);
 802
 803     if(idx->parent)
 804     {
 805      string(buf,strlen(idx->parent->id)+6);
 806      sprintf(buf,"post_%s", idx->parent->id);
 807     }
 808     else
 809     {
 810      buf="POSTROUTING";
 811     }
 812
 813     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 814     iptables_save_line(str, idx->ipv6);
 815
 816     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 817     iptables_save_line(str, idx->ipv6);
 818
 819     if(idx->parent)
 820     {
 821      string(buf,strlen(idx->parent->id)+6);
 822      sprintf(buf,"forw_%s",idx->parent->id);
 823     }
 824     else
 825     {
 826      buf="FORWARD";
 827     }
 828
 829     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 830     iptables_save_line(str, idx->ipv6);
 831
 832     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 833     iptables_save_line(str, idx->ipv6);
 834    }
 835    printf("Total indexed iptables chains created: %d\n", i);
 836
 837    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 838    iptables_save_line(str, FALSE);
 839
 840    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 841    iptables_save_line(str, FALSE);
 842
 843    if(ip6prefix)
 844    {
 845     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 846     iptables_save_line(str, TRUE);
 847
 848     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 849     iptables_save_line(str, TRUE);
 850    }
 851   }
 852  }
 853
 854  if(just_flush)
 855  {
 856   fclose(iptables_file);
 857   if(log_file)
 858   {
 859    fclose(log_file);
 860   }
 861   puts("Just flushed iptables and tc classes - now exiting ...");
 862   exit(0);
 863  }
 864
 865  if(!just_preview)
 866  {
 867   if(!dry_run && !nodelay && qos_free_delay)
 868   {
 869    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 870    sleep(qos_free_delay);
 871   }
 872
 873   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 874               tc,lan,htb_r2q);
 875   safe_run(str);
 876
 877   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 878                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 879   safe_run(str);
 880
 881   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 882                 tc,lan,line,line,burst_main,highest_priority);
 883   safe_run(str);
 884
 885   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 886   safe_run(str);
 887
 888   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 889                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 890   safe_run(str);
 891
 892   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 893                tc,wan,up,up,burst_main,highest_priority);
 894   safe_run(str);
 895  }
 896
 897  /*-----------------------------------------------------------------*/
 898  puts("Locating heavy downloaders and generating root classes ...");
 899  /*-----------------------------------------------------------------*/
 900  sort(ip,ips,desc_order_by,traffic);
 901
 902  /*-----------------------------------------------------------------*/
 903  /* sub-scope - local variables */
 904  {
 905   long long int rate = line;
 906   long long int max = line;
 907   int group_count = 0;
 908   FILE *credit_file = NULL;
 909
 910   if(!just_preview && !dry_run && enable_credit)
 911   {
 912    credit_file = fopen(credit,"w");
 913   }
 914
 915   for_each(group,groups)
 916   {
 917    if(!just_preview)
 918    {
 919     //download
 920     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 921                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 922     safe_run(str);
 923
 924     //upload
 925     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 926                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 927     safe_run(str);
 928    }
 929
 930    if(group_count++ < max_nesting)
 931    {
 932     parent = group->id;
 933    }
 934
 935    rate -= digital_divide*group->min;
 936    if(rate < group->min)
 937    {
 938     rate = group->min;
 939    }
 940
 941    /*shaping of aggresive downloaders, with credit file support */
 942    if(use_credit)
 943    {
 944     int group_rate = group->min, priority_sequence = lowest_priority;
 945
 946     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 947     {
 948      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 949      if(     ip->keyword->data_limit
 950          and not ip->fixedprio
 951          and ip->traffic > ip->realquota )
 952      {
 953       if(group_rate < ip->max)
 954       {
 955        ip->max = group_rate;
 956       }
 957       group_rate+=magic_treshold;
 958       ip->prio=lowest_priority;
 959       if(ip->prio<highest_priority+2)
 960       {
 961        ip->prio=highest_priority+2;
 962       }
 963      }
 964      else
 965      {
 966       if(    ip->keyword->data_prio
 967           && !ip->fixedprio
 968           && (   ip->traffic>ip->credit
 969                + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
 970       {
 971        ip->prio=priority_sequence--;
 972        if(ip->prio<highest_priority+1)
 973        {
 974         ip->prio=highest_priority+1;
 975        }
 976       }
 977
 978       if(credit_file)
 979       {
 980        unsigned long long lcredit=0;
 981
 982        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
 983        {
 984         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
 985        }
 986        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
 987       }
 988      }
 989     }
 990    }
 991   }
 992   if(credit_file)
 993   {
 994    fclose(credit_file);
 995   }
 996  }
 997
 998  if(just_preview)
 999  {
1000   if(start_shaping || stop_shaping || reduce_ceil)
1001   {
1002    printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
1003    parse(classmap)
1004    {
1005     ptr=strchr(_,' ');
1006     if(ptr)
1007     {
1008      *ptr=0;
1009      ptr++;
1010      if_exists(ip,ips,eq(ip->addr,_))
1011      {
1012       ip->mark=atoi(ptr);
1013       if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */
1014       {
1015        if(stop_shaping)
1016        {
1017         ip->max = ip->desired;
1018         printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1019        }
1020        else
1021        {
1022         printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1023         if(reduce_ceil)
1024         {
1025          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1026         }
1027        }
1028        printf("(down: %dk-%dk ", ip->min, ip->max);
1029        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1030                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1031        safe_run(str);
1032        printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1033                                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1034        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1035                     tc, wan, ip->group, ip->mark,
1036                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1037                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1038        safe_run(str);
1039       }
1040      }
1041     }
1042    }
1043    fail
1044    {
1045     perror(classmap);
1046     puts("Warning - classmap file not fund, just generating preview ...");
1047     start_shaping=FALSE;
1048     stop_shaping=FALSE;
1049    }
1050    done; /* ugly macro end */
1051   }
1052   html=preview;
1053   json_traffic=json_preview;
1054  }
1055
1056  if(!dry_run && !just_flush)
1057  {
1058   /*-----------------------------------------------------------------*/
1059   printf("Writing json traffic overview  %s ... ", json_traffic);
1060   /*-----------------------------------------------------------------*/
1061   write_json_traffic(json_traffic);
1062
1063   /*-----------------------------------------------------------------*/
1064   printf("Writing statistics into HTML page %s ...\n", html);
1065   /*-----------------------------------------------------------------*/
1066   write_htmlandlogs(html, d, total, just_preview);
1067  }
1068
1069  if(just_preview)
1070  {
1071   char swchar='p';
1072   if(start_shaping)
1073   {
1074    swchar='s';
1075   }
1076   else if(reduce_ceil)
1077   {
1078    swchar='0'+reduce_ceil; /* -2, -4 */
1079   }
1080   else if(stop_shaping)
1081   {
1082    swchar='q';
1083   }
1084
1085   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1086   exit(0);
1087  }
1088
1089  i=0;
1090 #ifdef DEBUG
1091  printf("%-22s %-15s mark\n","name","ip");
1092 #endif
1093
1094  printf("Writing %s", classmap);
1095  f = fopen(classmap, "w");
1096  if(f < 0)
1097  {
1098   perror(classmap);
1099  }
1100
1101  /*-----------------------------------------------------------------*/
1102  printf(" + generating iptables and tc classes ... ");
1103  /*-----------------------------------------------------------------*/
1104
1105  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1106  {
1107   if(idxs)
1108   {
1109    char *buf;
1110    duplicate(ip->addr,buf);
1111    if(ip->v6)
1112    {
1113     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1114    }
1115    else
1116    {
1117     buf=index_id(ip->addr,32-idxtable_bitmask1);
1118    }
1119
1120    string(chain_forward,6+strlen(buf));
1121    strcpy(chain_forward,"forw_");
1122    strcat(chain_forward,buf);
1123
1124    string(chain_postrouting,6+strlen(buf));
1125    strcpy(chain_postrouting,"post_");
1126    strcat(chain_postrouting,buf);
1127
1128    free(buf);
1129   }
1130   else
1131   {
1132    chain_forward="FORWARD";
1133    chain_postrouting="POSTROUTING";
1134   }
1135
1136   /* packet limits - this will be optional in future */
1137   if(ip->pps_limit)
1138   {
1139    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1140                        ip->pps_limit, ip->pps_limit);
1141   }
1142   else
1143   {
1144    *limit_pkts = 0;
1145   }
1146
1147 #ifdef DEBUG
1148   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1149 #endif
1150
1151   /* -------------------------------------------------------- mark download */
1152   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1153                chain_postrouting, ip->addr, 32*(1+ip->v6),
1154                lan, mark_iptables, ip->mark);
1155   iptables_save_line(str, ip->v6);
1156
1157 /*
1158   if(qos_proxy)
1159   {
1160    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1161                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1162                 32*(1+ip->v6), lan, mark_iptables, ip->mark);
1163    iptables_save_line(str, ip->v6);
1164   }
1165 */
1166   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1167                chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);
1168   iptables_save_line(str, ip->v6);
1169
1170   /* classify overlimit packets to separate overlimit class */
1171   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1172                chain_postrouting, ip->addr, 32*(1+ip->v6),
1173                lan, mark_iptables, OVERLIMIT_CLASS);
1174   iptables_save_line(str, ip->v6);
1175
1176   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1177                chain_postrouting, ip->addr, 32*(1+ip->v6), lan);
1178   iptables_save_line(str, ip->v6);
1179
1180   /* -------------------------------------------------------- mark upload */
1181   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1182                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);
1183   iptables_save_line(str, ip->v6);
1184
1185   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1186                chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);
1187   iptables_save_line(str, ip->v6);
1188
1189   /* classify overlimit packets to separate overlimit class */
1190   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1191                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, OVERLIMIT_CLASS);
1192   iptables_save_line(str, ip->v6);
1193
1194   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1195                chain_forward, ip->addr, 32*(1+ip->v6), wan);
1196   iptables_save_line(str, ip->v6);
1197
1198   if(ip->min)
1199   {
1200    /* -------------------------------------------------------- download class */
1201 #ifdef DEBUG
1202    printf("(down: %dk-%dk ", ip->min, ip->max);
1203 #endif
1204
1205    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1206                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1207    safe_run(str);
1208
1209    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1210    {
1211     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1212                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1213     safe_run(str);
1214    }
1215
1216    if(filter_type == 1)
1217    {
1218     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1219                  tc, lan, ip->mark, ip->mark);
1220     safe_run(str);
1221    }
1222
1223    /* -------------------------------------------------------- upload class */
1224 #ifdef DEBUG
1225    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1226                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1227 #endif
1228
1229    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1230                 tc, wan, ip->group, ip->mark,
1231                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1232                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1233    safe_run(str);
1234
1235    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1236    {
1237     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1238                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1239     safe_run(str);
1240    }
1241
1242    if(filter_type == 1)
1243    {
1244     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1245                  tc, wan, ip->mark, ip->mark);
1246     safe_run(str);
1247    }
1248
1249    if(f > 0)
1250    {
1251     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1252    }
1253   }
1254   else
1255   {
1256 #ifdef DEBUG
1257    printf("(sharing %s)\n", ip->sharing);
1258 #endif
1259   }
1260   i++;
1261  }
1262  if(f > 0)
1263  {
1264   puts("done.");
1265   fclose(f);
1266  }
1267
1268  if(idxs)
1269  {
1270   chain_forward = "forw_common";
1271   chain_postrouting = "post_common";
1272  }
1273  else
1274  {
1275   chain_forward = "FORWARD";
1276   chain_postrouting = "POSTROUTING";
1277  }
1278
1279  if(free_min)
1280  {
1281   final_chain = "ACCEPT";
1282  }
1283
1284 /*
1285  if(qos_proxy)
1286  {
1287   if(free_min)
1288   {
1289    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1290                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1291    iptables_save_line(str, FALSE); // only for IPv4
1292   }
1293   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1294                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1295   iptables_save_line(str, FALSE); // only for IPv4
1296  }
1297 */
1298
1299  if(free_min)
1300  {
1301   sprintf(str, "-A %s -o %s -j %s%d",
1302                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1303   iptables_save_line(str, FALSE); /* only for IPv4 */
1304  }
1305
1306  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1307  iptables_save_line(str, FALSE);
1308  if(ip6prefix)
1309  {
1310   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1311   iptables_save_line(str, TRUE);
1312  }
1313
1314  if(free_min)
1315  {
1316   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1317   iptables_save_line(str, FALSE); /* only for IPv4 */
1318  }
1319
1320  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1321  iptables_save_line(str, FALSE);
1322  if(ip6prefix)
1323  {
1324   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1325   iptables_save_line(str, TRUE);
1326  }
1327
1328  if(free_min) /* allocate free bandwith if it is not zero... */
1329  {
1330    /*-----------------------------------------------------------------*/
1331    puts("Generating free bandwith class ...");
1332    /*-----------------------------------------------------------------*/
1333    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1334                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1335    safe_run(str);
1336    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1337                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1338    safe_run(str);
1339    /* tc SFQ */
1340    if(strcmpi(qos_leaf, "none"))
1341    {
1342      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1343      safe_run(str);
1344
1345      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1346      safe_run(str);
1347    }
1348    /* tc handle 1 fw flowid */
1349    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1350    safe_run(str);
1351
1352    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1353    safe_run(str);
1354
1355    /*-----------------------------------------------------------------*/
1356    puts("Generating bandwith class for overlimit packets...");
1357    /*-----------------------------------------------------------------*/
1358    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1359                 tc, lan, parent, OVERLIMIT_CLASS, 1024, 4096, burst, lowest_priority);
1360    safe_run(str);
1361    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1362                 tc, wan, parent, OVERLIMIT_CLASS, 1024, 4096, burst, lowest_priority);
1363    safe_run(str);
1364  }
1365  printf("Total IP count: %d\n", i);
1366  run_iptables_restore();
1367  if(log_file)
1368  {
1369   fclose(log_file);
1370  }
1371  return 0;
1372  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1373  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1374 }