prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20131126
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.5-a";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2013 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
  62 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  63 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  64 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  65 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  66 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  67 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  68 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  69 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  70 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  71 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  72 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  73 char    *html_log_dir = "/var/www/logs/html/";
  74
  75 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  76 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  77 int use_jquery_popups = TRUE;
  78 int      row_odd_even = 0; /*<tr class="odd/even"> */
  79
  80 /* === Configuraration file values defaults - stored in global variables ==== */
  81
  82 int        filter_type = 1; /*1 mark, 2 classify*/
  83 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  84 char             *mark = "MARK";
  85 char    *mark_iptables = "MARK --set-mark ";
  86 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  87 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  88 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  89 FILE    *iptables_file = NULL;
  90 FILE   *ip6tables_file = NULL;
  91 int      enable_credit = TRUE; /* enable credit file */
  92 int         use_credit = FALSE; /* use credit file (if enabled)*/
  93 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  94 int       hall_of_fame = TRUE; /* enable hall of fame */
  95 char              *lan = "eth0"; /* LAN interface */
  96 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  97 char              *wan = "eth1"; /* WAN/ISP interface */
  98 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  99 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
 100 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 101 char    *qos_free_zone = NULL; /* QoS free zone */
 102 /* int          qos_proxy = TRUE; include proxy port to QoS */
 103 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 104 int     include_upload = TRUE; /* upload+download=total traffic */
 105 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 106 /* int         proxy_port = 3128; proxy port number */
 107 long long int     line = 1024; /* WAN/ISP download in kbps */
 108 long long int       up = 1024; /* WAN/ISP upload in kbps */
 109 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 110 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 111 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 112 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 113 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 114 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 115 int        max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */
 116 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 117 int              burst = 8; /* HTB burst (in kbits) */
 118 int         burst_main = 64;
 119 int        burst_group = 32;
 120 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 121 int       keywordcount = 0;
 122 int        class_count = 0;
 123 int           ip_count = 0;
 124 FILE         *log_file = NULL;
 125 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 126
 127 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 128 const int lowest_priority    = 7; /* lowest HTB priority (HTB built-in value is 7) */
 129 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 130 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 131 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 132 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 133
 134 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 135 struct Group *groups = NULL, *group;
 136 struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 137 struct Macro *macro, *macros = NULL;
 138
 139 #define FREE_CLASS      3
 140 #define OVERLIMIT_CLASS 4
 141
 142 void help(void);
 143 /* implemented in help.c */
 144
 145 void get_traffic_statistics(const char *whichiptables, int ipv6);
 146 /* implemented in parseiptables.c */
 147
 148 void parse_ip_log(int argc, char **argv);
 149 /* implemented in parselog.c */
 150
 151 void parse_hosts(char *hosts);
 152 /* implemented in parsehosts.c */
 153
 154 void write_json_traffic(char *json);
 155 /* implemented in json.c */
 156
 157 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 158 /* implemented in htmlandlogs.c */
 159
 160 void analyse_topology(char *traceroute);
 161 /* implemented in networks.c */
 162
 163
 164 const char *tr_odd_even(void)
 165 {
 166  row_odd_even = 1 - row_odd_even;
 167  if(row_odd_even)
 168  {
 169   return "<tr class=\"even\">\n";
 170  }
 171  else
 172  {
 173   return "<tr class=\"odd\">\n";
 174  }
 175 }
 176
 177 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 178 /* (except that this code uses obsolete, archaic version of this header file...)     */
 179
 180 struct Index
 181 {
 182  char *addr;
 183  char *id;
 184  struct Index *parent;
 185  int bitmask;
 186  int children;
 187  int ipv6;
 188  list(Index);
 189 } *idxs=NULL, *idx, *metaindex;
 190
 191
 192 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 193
 194 char *index_id(char *ip, int bitmask);
 195 /* function implemented in ipv4subnets.c */
 196
 197 char *subnet_id(char *ip, int bitmask);
 198 /* function implemented in ipv4subnets.c */
 199
 200 char *index6_id(char *ip, int bitmask);
 201 /* function implemented in ipv6subnets.c */
 202
 203 char *subnet6_id(char *ip, int bitmask);
 204 /* function implemented in ipv6subnets.c */
 205
 206 /* ================= Let's parse configuration file here ================ */
 207
 208 void reject_config_and_exit(char *filename)
 209 {
 210  printf("Configuration file %s rejected - abnormal exit.",filename);
 211  exit(-1);
 212 }
 213
 214 void get_config(char *config_filename)
 215 {
 216  char *cnf="mark";
 217
 218  printf("Configured keywords: ");
 219  parse(config_filename)
 220  {
 221   option("keyword",kwd);
 222   if(kwd)
 223   {
 224    printf("%s ",kwd);
 225
 226    create(keyword,Keyword);
 227    keyword->key = kwd;
 228    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 229    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 230    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 231    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 232    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 233    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 234    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 235    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 236    keyword->default_prio = highest_priority+1;
 237    keyword->html_color = "000000";
 238    keyword->ip_count = 0;
 239    keyword->leaf_discipline = "";
 240    keyword->allowed_avgmtu = 0;
 241
 242    push(keyword, keywords);
 243    if(!defaultkeyword)
 244    {
 245     defaultkeyword = keyword;
 246    }
 247    keywordcount++;
 248
 249    kwd=NULL;
 250   }
 251   else
 252   {
 253     for_each(keyword,keywords)
 254     {
 255      int l=strlen(keyword->key);
 256
 257      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 258      {
 259       char *tmptr=_; /*  <---- l+1 ----> */
 260       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 261       ioption("asymetry-ratio", keyword->asymetry_ratio);
 262       ioption("asymetry-treshold", keyword->asymetry_fixed);
 263       ioption("magic-relative-limit", keyword->data_limit);
 264       ioption("magic-relative-prio", keyword->data_prio);
 265       loption("magic-fixed-limit", keyword->fixed_limit);
 266       loption("magic-fixed-prio", keyword->fixed_prio);
 267       ioption("htb-default-prio", keyword->default_prio);
 268       ioption("htb-rate-bonus", keyword->reserve_min);
 269       ioption("htb-ceil-malus", keyword->reserve_max);
 270       option("leaf-discipline", keyword->leaf_discipline);
 271       option("html-color", keyword->html_color);
 272       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 273       _=tmptr;
 274
 275       if(keyword->data_limit || keyword->fixed_limit ||
 276          keyword->data_prio || keyword->fixed_prio)
 277       {
 278        use_credit=1;
 279       }
 280      }
 281     }
 282   }
 283
 284   option("tc",tc);
 285   option("iptables",iptables);
 286   option("iptables-save",iptablessave);
 287   option("iptables-restore",iptablesrestore);
 288   option("ip6tables",ip6tables);
 289   option("ip6tables-save",ip6tablessave);
 290   option("ip6tables-restore",ip6tablesrestore);
 291   option("iptables-in-filename",iptablesfile);
 292   option("ip6tables-in-filename",ip6tablesfile);
 293   option("hosts",hosts);
 294   option("lan-interface",lan);
 295   option("wan-interface",wan);
 296   option("ip6-prefix",ip6prefix);
 297   option("lan-medium",lan_medium);
 298   option("wan-medium",wan_medium);
 299   lloption("wan-download",line);
 300   lloption("wan-upload",up);
 301   ioption("hall-of-fame-enable",hall_of_fame);
 302   option("hall-of-fame-title",title);
 303   option("hall-of-fame-filename",html);
 304   option("json-filename",json_traffic);
 305   option("hall-of-fame-preview",preview);
 306   option("json-preview",json_preview);
 307   option("log-filename",cmdlog);
 308   option("credit-filename",credit);
 309   option("classmap-filename",classmap);
 310   ioption("credit-enable",enable_credit);
 311   option("log-traffic-directory",log_dir);
 312   option("log-traffic-html-directory",html_log_dir);
 313   option("log-traffic-url-path",log_url);
 314   option("jquery-url",jquery_url);
 315   option("lms-url",lms_url);
 316   ioption("use-jquery-popups",use_jquery_popups);
 317   option("qos-free-zone",qos_free_zone);
 318   ioption("qos-free-delay",qos_free_delay);
 319 /*  ioption("qos-proxy-enable",qos_proxy); */
 320 /*  option("qos-proxy-ip",proxy_ip);*/
 321   option("htb-leaf-discipline",qos_leaf);
 322 /*  ioption("qos-proxy-port",proxy_port); */
 323   ioption("free-rate",free_min);
 324   ioption("free-ceil",free_max);
 325   ioption("overlimit-rate",overlimit_min);
 326   ioption("overlimit-ceil",overlimit_max);
 327   ioption("htb-burst",burst);
 328   ioption("htb-burst-main",burst_main);
 329   ioption("htb-burst-group",burst_group);
 330   ioption("htb-nesting-limit",max_nesting);
 331   ioption("htb-r2q",htb_r2q);
 332   ioption("magic-include-upload",include_upload);
 333   ioption("magic-treshold",magic_treshold);
 334   option("filter-type", cnf);
 335 /* not yet implemented:
 336   ioption("magic-fixed-packets",fixed_packets);
 337   ioption("magic-relative-packets",packet_limit);
 338 */
 339  }
 340  fail
 341  {
 342   perror(config_filename);
 343   puts("Warning - using built-in defaults instead ...");
 344  }
 345  done; /* ugly macro end */
 346  printf("\n");
 347
 348  /* leaf discipline for keywords */
 349  for_each(keyword,keywords)
 350  {
 351   if(!strcmpi(keyword->leaf_discipline, ""))
 352   {
 353    keyword->leaf_discipline = qos_leaf;
 354   }
 355  }
 356
 357  if(strcmpi(cnf, "mark"))
 358  {
 359   filter_type = 2;
 360   mark = "CLASSIFY";
 361   mark_iptables = "CLASSIFY --set-class 1:";
 362  }
 363  else
 364  {
 365   filter_type = 1;
 366   mark = "MARK";
 367   mark_iptables = "MARK --set-mark ";
 368  }
 369
 370  /* are supplied values meaningful ?*/
 371  if(line<=0 || up<=0)
 372  {
 373   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 374   reject_config_and_exit(config_filename);
 375  }
 376 }
 377
 378
 379 /* ========== This function executes, logs OR ALSO prints command ========== */
 380
 381 void safe_run(char *cmd)
 382 {
 383  if(dry_run)
 384  {
 385   printf("\n=>%s\n",cmd);
 386  }
 387  else
 388  {
 389   system(cmd);
 390  }
 391  if(log_file)
 392  {
 393   fprintf(log_file,"%s\n",cmd);
 394  }
 395 }
 396
 397 void iptables_save_line(char *line, int ipv6)
 398 {
 399  if(ipv6)
 400  {
 401   fprintf(ip6tables_file,"%s\n",line);
 402  }
 403  else
 404  {
 405   fprintf(iptables_file,"%s\n",line);
 406  }
 407 }
 408
 409 void run_iptables_restore(void)
 410 {
 411  char *restor;
 412  string(restor,STRLEN);
 413
 414  /*-----------------------------------------------------------------*/
 415  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 416  /*-----------------------------------------------------------------*/
 417
 418  iptables_save_line("COMMIT", FALSE);
 419  fclose(iptables_file);
 420  if(dry_run)
 421  {
 422   parse(iptablesfile)
 423   {
 424    printf("%s\n",_);
 425   }
 426   done; /* ugly macro end */
 427  }
 428
 429  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 430  safe_run(restor);
 431
 432  if(ip6prefix)
 433  {
 434   /*-----------------------------------------------------------------*/
 435   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 436   /*-----------------------------------------------------------------*/
 437   iptables_save_line("COMMIT", TRUE);
 438   fclose(ip6tables_file);
 439   if(dry_run)
 440   {
 441    parse(ip6tablesfile)
 442    {
 443     printf("%s\n",_);
 444    }
 445    done; /* ugly macro end */
 446   }
 447   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 448   safe_run(restor);
 449  }
 450  free(restor);
 451 }
 452
 453 char *parse_datafile_line(char *str)
 454 {
 455  char *ptr = strchr(str,' ');
 456  if(!ptr)
 457  {
 458   ptr = strchr(str,'\t');
 459  }
 460
 461  if(ptr)
 462  {
 463   *ptr = 0;
 464   ptr++;
 465   while(*ptr == ' ' || *ptr == '\t')
 466   {
 467    ptr++;
 468   }
 469   return ptr;
 470  }
 471  else
 472  {
 473   return NULL;
 474  }
 475 }
 476
 477
 478 /*-----------------------------------------------------------------*/
 479 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 480 /*-----------------------------------------------------------------*/
 481
 482 program
 483 {
 484  int i=0;                    /* just plain old Fortran style integer :-) */
 485  FILE *f=NULL;               /* everything is just stream of bytes... */
 486  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 487  char *substring, *limit_pkts;
 488
 489  int parent        = 1;
 490  int just_networks = FALSE;
 491  int just_flush    = FALSE;       /* deactivates all previous actions */
 492  int nodelay       = FALSE;
 493  int just_preview  = FALSE;       /* preview - generate just stats */
 494  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 495  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 496  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 497  int just_logs     = FALSE;       /* just parse logs */
 498  int run           = FALSE;
 499  int total         = 0;
 500
 501  char *chain_forward, *chain_postrouting;
 502  char *althosts=NULL;
 503
 504  printf("\n\
 505 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 506 Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\
 507 iptables-restore & burst tunning & classify modification by Ludva\n\
 508 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 509
 510  /*----- Boring... we have to check command line options first: ----*/
 511  arguments
 512  {
 513   argument("-c") { nextargument(config); }
 514   argument("-h") { nextargument(althosts);}
 515   argument("-d") { run=TRUE; dry_run=TRUE; }
 516   argument("-f") { run=TRUE; just_flush=TRUE; }
 517   argument("-9") { run=TRUE; just_flush=9; }
 518   argument("-p") { run=TRUE; just_preview=TRUE; }
 519   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 520   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 521   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 522   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 523   argument("-r") { run=TRUE; }
 524   argument("-n") { run=TRUE; nodelay=TRUE; }
 525   argument("-a") { run=TRUE; just_networks=TRUE; }
 526   argument("-l") { just_logs=TRUE; }
 527   argument("-m") { just_logs=TRUE; }
 528   argument("-y") { just_logs=TRUE; }
 529   argument("-?") { help(); exit(0); }
 530   argument("--help") { help(); exit(0); }
 531   argument("-v") { exit(0); }
 532   argument("--version") { exit(0); }
 533  }
 534
 535  if(dry_run)
 536  {
 537   puts("*** THIS IS JUST DRY RUN ! ***\n");
 538  }
 539
 540  date(d); /* this is typical cll1.h macro - prints current date */
 541
 542  /*-----------------------------------------------------------------*/
 543  printf("Parsing configuration file %s ...\n", config);
 544  /*-----------------------------------------------------------------*/
 545  get_config(config);
 546
 547  if(just_logs)
 548  {
 549   parse_ip_log(argc,argv);
 550   exit(0);
 551  }
 552  else if(not run)
 553  {
 554   help();
 555   exit(0);
 556  }
 557
 558  if(althosts)
 559  {
 560   hosts = althosts;
 561  }
 562
 563  if(just_flush<9)
 564  {
 565   /*-----------------------------------------------------------------*/
 566   puts("Parsing iptables verbose output ...");
 567   /*-----------------------------------------------------------------*/
 568   get_traffic_statistics(iptables, FALSE);
 569   if(ip6prefix)
 570   {
 571    /*-----------------------------------------------------------------*/
 572    puts("Parsing ip6tables verbose output ...");
 573    /*-----------------------------------------------------------------*/
 574    get_traffic_statistics(ip6tables, TRUE);
 575   }
 576  }
 577
 578  /*-----------------------------------------------------------------*/
 579  /* cll1.h - let's allocate brand new character buffer...           */
 580  /*-----------------------------------------------------------------*/
 581  string(str, STRLEN);
 582  string(limit_pkts, STRLEN);
 583
 584  /*-----------------------------------------------------------------*/
 585  printf("Parsing class defintion file %s ...\n", hosts);
 586  /*-----------------------------------------------------------------*/
 587  parse_hosts(hosts);
 588  if(just_networks)
 589  {
 590   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 591   exit(-1);
 592  }
 593
 594  /*-----------------------------------------------------------------*/
 595  puts("Resolving shared connections ...");
 596  /*-----------------------------------------------------------------*/
 597  for_each(ip, ips) if(ip->sharing)
 598  {
 599   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 600   {
 601    sharedip->traffic += ip->traffic;
 602    ip->traffic = 0;
 603    ip->mark = sharedip->mark;
 604    ip->lmsid = sharedip->lmsid;
 605    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 606    break;
 607   }
 608   if(not sharedip)
 609   {
 610    printf("Unresolved shared connection: %s %s sharing-%s\n",
 611           ip->addr, ip->name, ip->sharing);
 612   }
 613  }
 614
 615  if(enable_credit && just_flush<9)
 616  {
 617   /*-----------------------------------------------------------------*/
 618   printf("Parsing credit file %s ...\n", credit);
 619   /*-----------------------------------------------------------------*/
 620   parse(credit)
 621   {
 622    ptr = parse_datafile_line(_);
 623    if(ptr)
 624    {
 625     if_exists(ip,ips,eq(ip->addr,_))
 626     {
 627      sscanf(ptr,"%Lu",&(ip->credit));
 628     }
 629    }
 630   }
 631   done; /* ugly macro end */
 632  }
 633
 634  if(enable_credit && just_flush<9)
 635  {
 636   /*-----------------------------------------------------------------*/
 637   printf("Parsing macro definition file %s ...\n", macrosfile);
 638   /*-----------------------------------------------------------------*/
 639   parse(macrosfile)
 640   {
 641    ptr = parse_datafile_line(_);
 642    if(ptr)
 643    {
 644     create(macro, Macro);
 645     macro->rewrite_from = _;
 646     macro->rewrite_to = ptr;
 647     push(macro, macros);
 648     printf("%s -> %s\n", macro->rewrite_from, macro->rewrite_to);
 649    }
 650   }
 651   done; /* ugly macro end */
 652  }
 653
 654  if(!just_preview)
 655  {
 656   /*-----------------------------------------------------------------*/
 657   puts("Initializing iptables and tc classes ...");
 658   /*-----------------------------------------------------------------*/
 659
 660   iptables_file = fopen(iptablesfile, "w");
 661   if(iptables_file == NULL)
 662   {
 663     perror(iptablesfile);
 664     exit(-1);
 665   }
 666   iptables_save_line(iptablespreamble, FALSE);
 667
 668   if(ip6prefix)
 669   {
 670    ip6tables_file = fopen(ip6tablesfile, "w");
 671    if(ip6tables_file == NULL)
 672    {
 673      perror(ip6tablesfile);
 674      exit(-1);
 675    }
 676    iptables_save_line(iptablespreamble, TRUE);
 677    iptables_save_line(ip6preamble, TRUE);
 678   }
 679
 680   run_iptables_restore();
 681
 682   log_file = fopen(cmdlog, "w");
 683   if(log_file == NULL)
 684   {
 685     perror(cmdlog);
 686     exit(-1);
 687   }
 688
 689   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 690   safe_run(str);
 691
 692   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 693   safe_run(str);
 694
 695   iptables_file=fopen(iptablesfile,"w");
 696   iptables_save_line(iptablespreamble, FALSE);
 697   if(ip6prefix)
 698   {
 699    ip6tables_file=fopen(ip6tablesfile,"w");
 700    iptables_save_line(iptablespreamble, TRUE);
 701    iptables_save_line(ip6preamble, TRUE);
 702   }
 703
 704   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 705   {
 706    char *chain;
 707
 708    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 709    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 710
 711 /*
 712    if(qos_proxy)
 713    {
 714     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 715     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 716     iptables_save_line(str , FALSE);
 717     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 718     iptables_save_line(str, FALSE);
 719     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 720     iptables_save_line(str, FALSE);
 721
 722     chain="post_noproxy";
 723    }
 724
 725    else
 726    {
 727 */
 728    chain = "POSTROUTING";
 729 //   }
 730
 731    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 732    iptables_save_line(str, FALSE);
 733   }
 734
 735   if(ip_count > idxtable_treshold1 && !just_flush)
 736   {
 737    int idxcount=0, bitmask=32-idxtable_bitmask1;
 738    char *subnet, *buf;
 739    /*-----------------------------------------------------------------*/
 740    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 741    /*-----------------------------------------------------------------*/
 742
 743    iptables_save_line(":post_common - [0:0]", FALSE);
 744    iptables_save_line(":forw_common - [0:0]", FALSE);
 745    if(ip6prefix)
 746    {
 747     iptables_save_line(":post_common - [0:0]", TRUE);
 748     iptables_save_line(":forw_common - [0:0]", TRUE);
 749    }
 750
 751    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 752    {
 753     if(ip->v6)
 754     {
 755      buf=index6_id(ip->addr,bitmask+32);
 756     }
 757     else
 758     {
 759      buf=index_id(ip->addr, bitmask);
 760     }
 761
 762     if_exists(idx,idxs,eq(idx->id,buf))
 763     {
 764      idx->children++;
 765     }
 766     else
 767     {
 768      create(idx,Index);
 769      idx->addr = ip->addr;
 770      idx->id = buf;
 771      idx->bitmask = bitmask+32*ip->v6;
 772      idx->parent = NULL;
 773      idx->children = 0;
 774      idx->ipv6 = ip->v6;
 775      idxcount++;
 776      push(idx,idxs);
 777     }
 778    }
 779
 780    /* brutal perfomance optimalization */
 781    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 782    {
 783     bitmask -= idxtable_bitmask2;
 784     idxcount = 0;
 785
 786     for_each(idx,idxs) if(idx->parent == NULL)
 787     {
 788      if(idx->ipv6)
 789      {
 790       buf = index6_id(idx->addr, bitmask+32);
 791      }
 792      else
 793      {
 794       buf = index_id(idx->addr, bitmask);
 795      }
 796      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 797      {
 798       metaindex->children++;
 799      }
 800      else
 801      {
 802       create(metaindex,Index);
 803       metaindex->addr = idx->addr;
 804       metaindex->id = buf;
 805       metaindex->bitmask = bitmask+32*idx->ipv6;
 806       metaindex->parent = NULL;
 807       metaindex->children = 0;
 808       metaindex->ipv6 = idx->ipv6;
 809       idxcount++;
 810       push(metaindex,idxs);
 811      }
 812      idx->parent=metaindex;
 813     }
 814    }
 815
 816    /* this should slightly optimize throughput ... */
 817    sort(idx,idxs,desc_order_by,children);
 818    sort(idx,idxs,order_by,bitmask);
 819
 820    i=0;
 821    for_each(idx,idxs)
 822    {
 823     if(idx->ipv6)
 824     {
 825      subnet=subnet6_id(idx->addr, idx->bitmask);
 826     }
 827     else
 828     {
 829      subnet=subnet_id(idx->addr, idx->bitmask);
 830     }
 831     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 832
 833     sprintf(str,":post_%s - [0:0]", idx->id);
 834     iptables_save_line(str, idx->ipv6);
 835
 836     sprintf(str,":forw_%s - [0:0]", idx->id);
 837     iptables_save_line(str, idx->ipv6);
 838
 839     if(idx->parent)
 840     {
 841      string(buf,strlen(idx->parent->id)+6);
 842      sprintf(buf,"post_%s", idx->parent->id);
 843     }
 844     else
 845     {
 846      buf="POSTROUTING";
 847     }
 848
 849     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 850     iptables_save_line(str, idx->ipv6);
 851
 852     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 853     iptables_save_line(str, idx->ipv6);
 854
 855     if(idx->parent)
 856     {
 857      string(buf,strlen(idx->parent->id)+6);
 858      sprintf(buf,"forw_%s",idx->parent->id);
 859     }
 860     else
 861     {
 862      buf="FORWARD";
 863     }
 864
 865     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 866     iptables_save_line(str, idx->ipv6);
 867
 868     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 869     iptables_save_line(str, idx->ipv6);
 870    }
 871    printf("Total indexed iptables chains created: %d\n", i);
 872
 873    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 874    iptables_save_line(str, FALSE);
 875
 876    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 877    iptables_save_line(str, FALSE);
 878
 879    if(ip6prefix)
 880    {
 881     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 882     iptables_save_line(str, TRUE);
 883
 884     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 885     iptables_save_line(str, TRUE);
 886    }
 887   }
 888  }
 889
 890  if(just_flush)
 891  {
 892   fclose(iptables_file);
 893   if(log_file)
 894   {
 895    fclose(log_file);
 896   }
 897   puts("Just flushed iptables and tc classes - now exiting ...");
 898   exit(0);
 899  }
 900
 901  if(!just_preview)
 902  {
 903   if(!dry_run && !nodelay && qos_free_delay)
 904   {
 905    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 906    sleep(qos_free_delay);
 907   }
 908
 909   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 910               tc,lan,htb_r2q);
 911   safe_run(str);
 912
 913   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 914                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 915   safe_run(str);
 916
 917   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 918                 tc,lan,line,line,burst_main,highest_priority);
 919   safe_run(str);
 920
 921   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 922   safe_run(str);
 923
 924   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 925                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 926   safe_run(str);
 927
 928   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 929                tc,wan,up,up,burst_main,highest_priority);
 930   safe_run(str);
 931  }
 932
 933  /*-----------------------------------------------------------------*/
 934  puts("Locating heavy downloaders and generating root classes ...");
 935  /*-----------------------------------------------------------------*/
 936  sort(ip,ips,desc_order_by,traffic);
 937
 938  /*-----------------------------------------------------------------*/
 939  /* sub-scope - local variables */
 940  {
 941   long long int rate = line;
 942   long long int max = line;
 943   int group_count = 0;
 944   FILE *credit_file = NULL;
 945
 946   if(!just_preview && !dry_run && enable_credit)
 947   {
 948    credit_file = fopen(credit,"w");
 949   }
 950
 951   for_each(group,groups)
 952   {
 953    if(!just_preview)
 954    {
 955     //download
 956     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 957                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 958     safe_run(str);
 959
 960     //upload
 961     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 962                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 963     safe_run(str);
 964    }
 965
 966    if(group_count++ < max_nesting)
 967    {
 968     parent = group->id;
 969    }
 970
 971    rate -= digital_divide*group->min;
 972    if(rate < group->min)
 973    {
 974     rate = group->min;
 975    }
 976
 977    /*shaping of aggresive downloaders, with credit file support */
 978    if(use_credit)
 979    {
 980     int group_rate = group->min, priority_sequence = lowest_priority;
 981
 982     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 983     {
 984      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 985      if(     ip->keyword->data_limit
 986          and not ip->fixedprio
 987          and ip->traffic > ip->realquota )
 988      {
 989       if(group_rate < ip->max)
 990       {
 991        ip->max = group_rate;
 992       }
 993       group_rate+=magic_treshold;
 994       ip->prio=lowest_priority;
 995       if(ip->prio<highest_priority+2)
 996       {
 997        ip->prio=highest_priority+2;
 998       }
 999      }
1000      else
1001      {
1002       if(    ip->keyword->data_prio
1003           && !ip->fixedprio
1004           && (   ip->traffic>ip->credit
1005                + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
1006       {
1007        ip->prio=priority_sequence--;
1008        if(ip->prio<highest_priority+1)
1009        {
1010         ip->prio=highest_priority+1;
1011        }
1012       }
1013
1014       if(credit_file)
1015       {
1016        unsigned long long lcredit=0;
1017
1018        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
1019        {
1020         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
1021        }
1022        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
1023       }
1024      }
1025     }
1026    }
1027   }
1028   if(credit_file)
1029   {
1030    fclose(credit_file);
1031   }
1032  }
1033
1034  if(just_preview)
1035  {
1036   if(start_shaping || stop_shaping || reduce_ceil)
1037   {
1038    printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
1039    parse(classmap)
1040    {
1041     ptr=strchr(_,' ');
1042     if(ptr)
1043     {
1044      *ptr=0;
1045      ptr++;
1046      if_exists(ip,ips,eq(ip->addr,_))
1047      {
1048       ip->mark=atoi(ptr);
1049       if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */
1050       {
1051        if(stop_shaping)
1052        {
1053         ip->max = ip->desired;
1054         printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1055        }
1056        else
1057        {
1058         printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1059         if(reduce_ceil)
1060         {
1061          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1062         }
1063        }
1064        printf("(down: %dk-%dk ", ip->min, ip->max);
1065        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1066                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1067        safe_run(str);
1068        printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1069                                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1070        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1071                     tc, wan, ip->group, ip->mark,
1072                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1073                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1074        safe_run(str);
1075       }
1076      }
1077     }
1078    }
1079    fail
1080    {
1081     perror(classmap);
1082     puts("Warning - classmap file not fund, just generating preview ...");
1083     start_shaping=FALSE;
1084     stop_shaping=FALSE;
1085    }
1086    done; /* ugly macro end */
1087   }
1088   html=preview;
1089   json_traffic=json_preview;
1090  }
1091
1092  if(!dry_run && !just_flush)
1093  {
1094   /*-----------------------------------------------------------------*/
1095   printf("Writing json traffic overview  %s ... ", json_traffic);
1096   /*-----------------------------------------------------------------*/
1097   write_json_traffic(json_traffic);
1098
1099   /*-----------------------------------------------------------------*/
1100   printf("Writing statistics into HTML page %s ...\n", html);
1101   /*-----------------------------------------------------------------*/
1102   write_htmlandlogs(html, d, total, just_preview);
1103  }
1104
1105  if(just_preview)
1106  {
1107   char swchar='p';
1108   if(start_shaping)
1109   {
1110    swchar='s';
1111   }
1112   else if(reduce_ceil)
1113   {
1114    swchar='0'+reduce_ceil; /* -2, -4 */
1115   }
1116   else if(stop_shaping)
1117   {
1118    swchar='q';
1119   }
1120
1121   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1122   exit(0);
1123  }
1124
1125  i=0;
1126 #ifdef DEBUG
1127  printf("%-22s %-15s mark\n","name","ip");
1128 #endif
1129
1130  printf("Writing %s", classmap);
1131  f = fopen(classmap, "w");
1132  if(f < 0)
1133  {
1134   perror(classmap);
1135  }
1136
1137  /*-----------------------------------------------------------------*/
1138  printf(" + generating iptables and tc classes ... ");
1139  /*-----------------------------------------------------------------*/
1140
1141  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1142  {
1143   if(idxs)
1144   {
1145    char *buf;
1146    duplicate(ip->addr,buf);
1147    if(ip->v6)
1148    {
1149     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1150    }
1151    else
1152    {
1153     buf=index_id(ip->addr,32-idxtable_bitmask1);
1154    }
1155
1156    string(chain_forward,6+strlen(buf));
1157    strcpy(chain_forward,"forw_");
1158    strcat(chain_forward,buf);
1159
1160    string(chain_postrouting,6+strlen(buf));
1161    strcpy(chain_postrouting,"post_");
1162    strcat(chain_postrouting,buf);
1163
1164    free(buf);
1165   }
1166   else
1167   {
1168    chain_forward="FORWARD";
1169    chain_postrouting="POSTROUTING";
1170   }
1171
1172   /* packet limits - this will be optional in future */
1173   if(ip->pps_limit)
1174   {
1175    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1176                        ip->pps_limit, ip->pps_limit);
1177   }
1178   else
1179   {
1180    *limit_pkts = 0;
1181   }
1182
1183 #ifdef DEBUG
1184   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1185 #endif
1186
1187   /* -------------------------------------------------------- mark download */
1188   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1189                chain_postrouting, ip->addr, 32*(1+ip->v6),
1190                lan, mark_iptables, ip->mark);
1191   iptables_save_line(str, ip->v6);
1192
1193 /*
1194   if(qos_proxy)
1195   {
1196    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1197                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1198                 32*(1+ip->v6), lan, mark_iptables, ip->mark);
1199    iptables_save_line(str, ip->v6);
1200   }
1201 */
1202   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1203                chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);
1204   iptables_save_line(str, ip->v6);
1205
1206   /* classify overlimit packets to separate overlimit class */
1207   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1208                chain_postrouting, ip->addr, 32*(1+ip->v6),
1209                lan, mark_iptables, OVERLIMIT_CLASS);
1210   iptables_save_line(str, ip->v6);
1211
1212   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1213                chain_postrouting, ip->addr, 32*(1+ip->v6), lan);
1214   iptables_save_line(str, ip->v6);
1215
1216   /* -------------------------------------------------------- mark upload */
1217   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1218                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);
1219   iptables_save_line(str, ip->v6);
1220
1221   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1222                chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);
1223   iptables_save_line(str, ip->v6);
1224
1225   /* classify overlimit packets to separate overlimit class */
1226   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1227                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, OVERLIMIT_CLASS);
1228   iptables_save_line(str, ip->v6);
1229
1230   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1231                chain_forward, ip->addr, 32*(1+ip->v6), wan);
1232   iptables_save_line(str, ip->v6);
1233
1234   if(ip->min)
1235   {
1236    /* -------------------------------------------------------- download class */
1237 #ifdef DEBUG
1238    printf("(down: %dk-%dk ", ip->min, ip->max);
1239 #endif
1240
1241    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1242                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1243    safe_run(str);
1244
1245    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1246    {
1247     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1248                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1249     safe_run(str);
1250    }
1251
1252    if(filter_type == 1)
1253    {
1254     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1255                  tc, lan, ip->mark, ip->mark);
1256     safe_run(str);
1257    }
1258
1259    /* -------------------------------------------------------- upload class */
1260 #ifdef DEBUG
1261    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1262                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1263 #endif
1264
1265    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1266                 tc, wan, ip->group, ip->mark,
1267                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1268                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1269    safe_run(str);
1270
1271    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1272    {
1273     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1274                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1275     safe_run(str);
1276    }
1277
1278    if(filter_type == 1)
1279    {
1280     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1281                  tc, wan, ip->mark, ip->mark);
1282     safe_run(str);
1283    }
1284
1285    if(f > 0)
1286    {
1287     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1288    }
1289   }
1290   else
1291   {
1292 #ifdef DEBUG
1293    printf("(sharing %s)\n", ip->sharing);
1294 #endif
1295   }
1296   i++;
1297  }
1298  if(f > 0)
1299  {
1300   puts("done.");
1301   fclose(f);
1302  }
1303
1304  if(idxs)
1305  {
1306   chain_forward = "forw_common";
1307   chain_postrouting = "post_common";
1308  }
1309  else
1310  {
1311   chain_forward = "FORWARD";
1312   chain_postrouting = "POSTROUTING";
1313  }
1314
1315  if(free_min)
1316  {
1317   final_chain = "ACCEPT";
1318  }
1319
1320 /*
1321  if(qos_proxy)
1322  {
1323   if(free_min)
1324   {
1325    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1326                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1327    iptables_save_line(str, FALSE); // only for IPv4
1328   }
1329   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1330                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1331   iptables_save_line(str, FALSE); // only for IPv4
1332  }
1333 */
1334
1335  if(free_min)
1336  {
1337   sprintf(str, "-A %s -o %s -j %s%d",
1338                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1339   iptables_save_line(str, FALSE); /* only for IPv4 */
1340  }
1341
1342  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1343  iptables_save_line(str, FALSE);
1344  if(ip6prefix)
1345  {
1346   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1347   iptables_save_line(str, TRUE);
1348  }
1349
1350  if(free_min)
1351  {
1352   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1353   iptables_save_line(str, FALSE); /* only for IPv4 */
1354  }
1355
1356  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1357  iptables_save_line(str, FALSE);
1358  if(ip6prefix)
1359  {
1360   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1361   iptables_save_line(str, TRUE);
1362  }
1363
1364  if(free_min) /* allocate free bandwith if it is not zero... */
1365  {
1366    /*-----------------------------------------------------------------*/
1367    puts("Generating free bandwith class ...");
1368    /*-----------------------------------------------------------------*/
1369    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1370                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1371    safe_run(str);
1372    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1373                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1374    safe_run(str);
1375    /* tc SFQ */
1376    if(strcmpi(qos_leaf, "none"))
1377    {
1378      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1379      safe_run(str);
1380
1381      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1382      safe_run(str);
1383    }
1384    /* tc handle 1 fw flowid */
1385    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1386    safe_run(str);
1387
1388    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1389    safe_run(str);
1390
1391    /*-----------------------------------------------------------------*/
1392    puts("Generating bandwith class for overlimit packets...");
1393    /*-----------------------------------------------------------------*/
1394    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1395                 tc, lan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1396    safe_run(str);
1397    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1398                 tc, wan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1399    safe_run(str);
1400  }
1401  printf("Total IP count: %d\n", i);
1402  run_iptables_restore();
1403  if(log_file)
1404  {
1405   fclose(log_file);
1406  }
1407  return 0;
1408  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1409  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1410 }