- /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
- /* Prometheus QoS - you can "steal fire" from your ISP */\r
-/* "fair-per-IP" quality of service (QoS) utility */\r
-/* requires Linux 2.4.x or 2.6.x with HTB support */\r
-/* Copyright(C) 2005-2012 Michael Polak, Arachne Labs */\r
-/* iptables-restore support Copyright(C) 2007-2008 ludva */\r
-/* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf */\r
-/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
-\r
-/* Modified by: xChaos, 20121011\r
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
+/* Prometheus QoS - you can "steal fire" from your ISP */\r
+/* "fair-per-IP" quality of service (QoS) utility */\r
+/* requires Linux 2.4.x or 2.6.x with HTB support */\r
+/* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace */\r
+/* iptables-restore support Copyright(C) 2007-2008 ludva */\r
+/* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf */\r
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
+\r
+/* Modified by: xChaos, 20131029\r
ludva, 20080415\r
\r
Prometheus QoS is free software; you can redistribute it and/or\r
\r
GNU General Public License is located in file COPYING */\r
\r
-#define STRLEN 512\r
-#undef DEBUG\r
-\r
#include "cll1-0.6.2.h"\r
#include "ipstruct.h"\r
\r
-const char *version = "0.8.3-g";\r
+const char *version = "0.8.3-i";\r
\r
-/* Version numbers: 0.8.3 is development releases ("beta"), 0.8.4 will be "stable" */\r
-/* Debian(RPM) package versions/patchlevels: 0.7.9-2, 0.8.0-1, 0.8.0-2, etc. */\r
-/* C source code development versions ("beta"): 0.7.9-a, 0.8.1-b, etc. */\r
-/* C source code release versions: 0.8.0, 0.8.2, 0.8.4, etc. */\r
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
+/* Versions: 0.8.3 is development release, 0.8.4 will be "stable" */\r
+/* Official Trac URL: https://dev.arachne.cz/svn/prometheus */\r
+/* Official SVN URL: https://dev.arachne.cz/repos/prometheus */\r
+/* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq */\r
+/* CZK donations account: 2900242944/2010 (transparent account) */\r
+/* Warning: unofficial Github mirror is not supported by author! */\r
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
\r
-const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-201
2 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
\r+const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-201
3 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
\r \r
-/* ======= Help screen is hopefuly self-documenting part of code :-) ======= */\r
-\r
-void help(void)\r
-{\r
- puts("Command line switches:\n\\r
-\n\\r
--d Dry run (preview tc and iptables commands on stdout)\n\\r
--r Run (reset all statistics and start shaping - daily usage)\n\\r
--p just generate Preview of data transfer statistics and exit (after -r)\n\\r
--s start Shaping FUP limits (keeps data transfer stat like -p) (after -r)\n\\r
--n run Now (like -r delay - overrides qos-free-delay keyword, after boot)\n\\r
--f just Flush iptables and tc classes and exit (stop shaping, no QiS)\n\\r
--9 emergency iptables flush (like -f, but dumps data transfer statistics)\n\\r
-\n\\r
--c filename force alternative /etc/prometheus/prometheus.conf filename\n\\r
--h filename force alternative /etc/hosts filename (overrides hosts keyword)\n\\r
--l Mmm YYYY generate HTML summary of Logged traffic (Mmm=Jan-Dec) (and exit)\n\\r
--m generate HTML summary of traffic for yesterday's Month (and exit)\n\\r
--y generate HTML summary of traffic for yesterday's Year (and exit)\n\\r
--? --help show this help scree (and exit)\n\\r
--v --version show Version number of this utility (and exit)\n");\r
-}\r
+#define STRLEN 512\r
+#undef DEBUG\r
\r
/* ======= All path names are defined here (for RPM patch) ======= */\r
\r
-const char *tc = "/sbin/tc"; /* requires tc with HTB support */\r
-const char *iptables = "/sbin/iptables"; /* requires iptables utility */\r
-const char *iptablessave = "/sbin/iptables-save"; /* not yet required */\r
-const char *iptablesrestore = "/sbin/iptables-restore"; /* requires iptables-restore */\r
-const char *ls = "/bin/ls"; /* this is not user configurable :-) */\r
+const char *tc = "/sbin/tc"; /* requires tc with HTB support */\r
+const char *iptables = "/sbin/iptables"; /* requires iptables utility */\r
+const char *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */\r
+const char *iptablessave = "/sbin/iptables-save"; /* not yet required */\r
+const char *iptablesrestore = "/sbin/iptables-restore"; /* requires iptables-restore */\r
+const char *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */\r
+const char *ip6tablesrestore = "/sbin/ip6tables-restore"; /* requires iptables-restore */\r
+const char *ls = "/bin/ls"; /* this is not user configurable :-) */\r
\r
char *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */\r
char *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */\r
-\r
char *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/\r
+char *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/\r
char *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */\r
char *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */\r
char *html = "/var/www/traffic.html"; /* hall of fame - html version */\r
/* === Configuraration file values defaults - stored in global variables ==== */\r
\r
int filter_type = 1; /*1 mark, 2 classify*/\r
+char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */\r
char *mark = "MARK";\r
char *mark_iptables = "MARK --set-mark ";\r
int dry_run = FALSE; /* preview - use puts() instead of system() */\r
char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";\r
+char *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";\r
FILE *iptables_file = NULL;\r
+FILE *ip6tables_file = NULL;\r
int enable_credit = TRUE; /* enable credit file */\r
int use_credit = FALSE; /* use credit file (if enabled)*/\r
char *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */\r
char *lan = "eth0"; /* LAN interface */\r
char *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */\r
char *wan = "eth1"; /* WAN/ISP interface */\r
+char *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */\r
char *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */\r
char *qos_leaf = "sfq perturb 5"; /* leaf discipline */\r
char *qos_free_zone = NULL; /* QoS free zone */\r
int proxy_port = 3128; /* proxy port number */\r
long long int line = 1024; /* WAN/ISP download in kbps */\r
long long int up = 1024; /* WAN/ISP upload in kbps */\r
-int free_min = 32; /* minimum guaranted bandwidth for all undefined hosts */\r
-int free_max = 64; /* maximum allowed bandwidth for all undefined hosts */\r
+int free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */\r
+int free_max = 512; /* maximum allowed bandwidth for all undefined hosts */\r
int qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */\r
int digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */ \r
int max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */\r
const int idxtable_bitmask1 = 3; /* this is no longer configurable */\r
const int idxtable_bitmask2 = 3; /* this is no longer configurable */\r
\r
-struct IP *ips = NULL, *ip, *sharedip;\r
+struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;\r
struct Group *groups = NULL, *group;\r
struct Keyword *keyword, *defaultkeyword=NULL, *keywords=NULL;\r
\r
+void help(void);\r
+/* implemented in help.c */
+\r
+void get_traffic_statistics(const char *whichiptables, int ipv6);\r
+/* implemented in parseiptables.c */\r
+\r
void parse_ip_log(int argc, char **argv);\r
/* implemented in parselog.c */\r
\r
void write_htmlandlogs(char *html, char *d, int total, int just_preview);\r
/* implemented in htmlandlogs.c */\r
\r
+void analyse_topology(char *traceroute);\r
+/* implemented in networks.c */\r
+\r
+\r
const char *tr_odd_even(void)\r
{\r
row_odd_even = 1 - row_odd_even;\r
}\r
\r
/* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */\r
+/* (except that this code uses obsolete, archaic version of this header file...) */\r
\r
struct Index\r
{\r
struct Index *parent;\r
int bitmask;\r
int children;\r
+ int ipv6;\r
list(Index);\r
} *idxs=NULL, *idx, *metaindex;\r
\r
-void TheIP(void);\r
-/* function implemented in parsehosts.c */\r
\r
/* ====== iptables indexes are used to reduce complexity to log8(N) ===== */\r
\r
char *subnet_id(char *ip, int bitmask);\r
/* function implemented in ipv4subnets.c */\r
\r
+char *index6_id(char *ip, int bitmask);\r
+/* function implemented in ipv6subnets.c */\r
+\r
+char *subnet6_id(char *ip, int bitmask);\r
+/* function implemented in ipv6subnets.c */\r
+\r
/* ================= Let's parse configuration file here ================ */\r
\r
void reject_config_and_exit(char *filename)\r
keyword->leaf_discipline="";\r
\r
push(keyword,keywords);\r
- if(!defaultkeyword) defaultkeyword=keyword;\r
+ if(!defaultkeyword)\r
+ {\r
+ defaultkeyword=keyword;\r
+ }\r
keywordcount++;\r
\r
kwd=NULL;\r
\r
option("tc",tc);\r
option("iptables",iptables);\r
- option("iptables-save",iptablessave); /* new */\r
- option("iptables-restore",iptablesrestore); /* new */\r
- option("iptables-in-filename",iptablesfile); /* new */\r
+ option("iptables-save",iptablessave);\r
+ option("iptables-restore",iptablesrestore);\r
+ option("ip6tables",ip6tables);\r
+ option("ip6tables-save",ip6tablessave);\r
+ option("ip6tables-restore",ip6tablesrestore);\r
+ option("iptables-in-filename",iptablesfile);\r
+ option("ip6tables-in-filename",ip6tablesfile);\r
option("hosts",hosts);\r
option("lan-interface",lan);\r
option("wan-interface",wan);\r
+ option("ip6-prefix",ip6prefix);\r
option("lan-medium",lan_medium);\r
option("wan-medium",wan_medium);\r
lloption("wan-download",line);\r
/* leaf discipline for keywords */\r
for_each(keyword,keywords)\r
{\r
- if(!strcmpi(keyword->leaf_discipline, ""))\r
- {\r
- keyword->leaf_discipline = qos_leaf;\r
- }\r
+ if(!strcmpi(keyword->leaf_discipline, ""))\r
+ {\r
+ keyword->leaf_discipline = qos_leaf;\r
+ }\r
}\r
\r
if(strcmpi(cnf, "mark"))\r
}\r
}\r
\r
-/* ===================== traffic analyser - uses iptables ================ */ \r
-\r
-void get_traffic_statistics(void)\r
-{\r
- char *str,*cmd;\r
- int downloadflag=0;\r
-\r
- textfile(Pipe,str) *line,*lines=NULL;\r
- string(str,STRLEN);\r
- string(cmd,STRLEN);\r
-\r
- sprintf(cmd,"%s -L -v -x -n -t mangle",iptables);\r
- shell(cmd);\r
- input(str,STRLEN)\r
- {\r
- create(line,Pipe);\r
- line->str=str;\r
- string(str,STRLEN);\r
- append(line,lines);\r
- }\r
-\r
- for_each(line,lines)\r
- {\r
- int col, accept=0,proxyflag=0,valid=1,setchainname=0,commonflag=0; \r
- unsigned long long traffic=0;\r
- unsigned long pkts=0;\r
- char *ipaddr=NULL,*ptr;\r
- \r
- /* debug puts(line->str); */\r
- valid_columns(ptr,line->str,' ',col) \r
- if(valid) switch(col)\r
- { \r
- case 1: if(eq(ptr,"Chain"))\r
- {\r
- setchainname=1;\r
- }\r
- else if(eq(ptr,"pkts")) \r
- {\r
- valid=0;\r
- }\r
- else\r
- {\r
- sscanf(ptr,"%lu",&pkts); \r
- }\r
- break;\r
- case 2: if(setchainname)\r
- {\r
- if(!strncmp(ptr,"post_",5) || eq(ptr,"POSTROUTING"))\r
- {\r
- downloadflag = 1; \r
- }\r
- else \r
- {\r
- if(!strncmp(ptr,"forw_",5) || eq(ptr,"FORWARD"))\r
- {\r
- downloadflag = 0;\r
- }\r
- } \r
- if(eq(ptr,"post_common") || eq(ptr,"forw_common"))\r
- {\r
- commonflag = 1;\r
- }\r
- }\r
- else\r
- {\r
- sscanf(ptr,"%Lu",&traffic); \r
- traffic += (1<<19);\r
- traffic >>= 20;\r
- }\r
- break;\r
- case 3: if((strncmp(ptr,"post_",5) && strncmp(ptr,"forw_",5)) || commonflag)\r
- {\r
- accept=eq(ptr,mark);\r
- }\r
- /*if(filter_type==1) accept=eq(ptr,"MARK"); else accept=eq(ptr,"CLASSIFY");*/\r
- break;\r
- case 8: if(downloadflag)\r
- { \r
- if(strstr(proxy_ip,ptr))\r
- {\r
- proxyflag=1; \r
- }\r
- }\r
- else\r
- {\r
- ipaddr=ptr; \r
- }\r
- break;\r
- case 9: if(downloadflag)ipaddr=ptr;break;\r
- }\r
- \r
- if(accept && traffic>0 && ipaddr)\r
- {\r
- if(proxyflag)\r
- {\r
- printf("(proxy) ");\r
- }\r
- else if(!downloadflag)\r
- {\r
- printf("(upload) ");\r
- }\r
- printf("IP %s: %Lu MB (%ld pkts)\n", ipaddr, traffic, pkts);\r
-\r
- if_exists(ip,ips,eq(ip->addr,ipaddr)); \r
- else \r
- {\r
- TheIP();\r
- ip->addr=ipaddr;\r
- if(eq(ip->addr,"0.0.0.0/0"))\r
- {\r
- ip->name="(unregistered)";\r
- ip->min=free_min;\r
- ip->max=ip->desired=free_max;\r
- }\r
- }\r
- \r
- if(downloadflag)\r
- {\r
- if(proxyflag)\r
- {\r
- ip->proxy=traffic;\r
- }\r
- else\r
- {\r
- ip->traffic+=traffic;\r
- }\r
- ip->direct=ip->traffic-ip->upload-ip->proxy;\r
- ip->pktsdown=pkts;\r
- }\r
- else\r
- {\r
- ip->upload=traffic;\r
- ip->pktsup=pkts;\r
- if(include_upload)\r
- {\r
- ip->traffic+=traffic;\r
- }\r
- else \r
- {\r
- if(traffic>ip->traffic)\r
- {\r
- ip->traffic=traffic; \r
- }\r
- }\r
- }\r
- } \r
- }\r
- free(cmd);\r
-}\r
\r
/* ========== This function executes, logs OR ALSO prints command ========== */\r
\r
}\r
}\r
\r
-void save_line(char *line)\r
+void iptables_save_line(char *line, int ipv6)\r
{\r
- fprintf(iptables_file,"%s\n",line);\r
+ if(ipv6)\r
+ {\r
+ fprintf(ip6tables_file,"%s\n",line);\r
+ }\r
+ else\r
+ {\r
+ fprintf(iptables_file,"%s\n",line);\r
+ }\r
}\r
\r
-void run_restore(void)\r
+void run_iptables_restore(void)\r
{\r
char *restor;\r
string(restor,STRLEN);\r
/*-----------------------------------------------------------------*/\r
printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);\r
/*-----------------------------------------------------------------*/\r
- \r
- save_line("COMMIT");\r
+\r
+ iptables_save_line("COMMIT", FALSE);\r
fclose(iptables_file);\r
if(dry_run) \r
{\r
\r
sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);\r
safe_run(restor);\r
- \r
+\r
+ if(ip6prefix)\r
+ {\r
+ /*-----------------------------------------------------------------*/\r
+ printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);\r
+ /*-----------------------------------------------------------------*/\r
+ iptables_save_line("COMMIT", TRUE);\r
+ fclose(ip6tables_file);\r
+ if(dry_run) \r
+ {\r
+ parse(ip6tablesfile)\r
+ {\r
+ printf("%s\n",_);\r
+ }\r
+ done; /* ugly macro end */\r
+ }\r
+ sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);\r
+ safe_run(restor);\r
+ }\r
free(restor);\r
}\r
\r
char *substring;\r
\r
int parent = 1;\r
+ int just_networks = FALSE; \r
int just_flush = FALSE; /* deactivates all previous actions */\r
int nodelay = FALSE;\r
int just_preview = FALSE; /* preview - generate just stats */\r
int start_shaping = FALSE; /* apply FUP - requires classmap file */\r
+ int stop_shaping = FALSE; /* lift FUP - requires classmap file */\r
+ int reduce_ceil = 0; /* allow only rate+(ceil-rate)/2, /4, etc. */\r
int just_logs = FALSE; /* just parse logs */\r
int run = FALSE;\r
int total = 0;\r
\r
printf("\n\\r
Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\\r
-Version %s - Copyright (C)2005-2012 Michael Polak, Arachne Labs\n\\r
+Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\\r
iptables-restore & burst tunning & classify modification by Ludva\n\\r
Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);\r
\r
argument("-f") { run=TRUE; just_flush=TRUE; }\r
argument("-9") { run=TRUE; just_flush=9; }\r
argument("-p") { run=TRUE; just_preview=TRUE; }\r
+ argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }\r
+ argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }\r
+ argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }\r
argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }\r
argument("-r") { run=TRUE; }\r
argument("-n") { run=TRUE; nodelay=TRUE; }\r
+ argument("-a") { run=TRUE; just_networks=TRUE; }\r
argument("-l") { just_logs=TRUE; }\r
argument("-m") { just_logs=TRUE; }\r
argument("-y") { just_logs=TRUE; }\r
\r
if(althosts)\r
{\r
- hosts=althosts;\r
+ hosts = althosts;\r
}\r
\r
if(just_flush<9)\r
/*-----------------------------------------------------------------*/\r
puts("Parsing iptables verbose output ...");\r
/*-----------------------------------------------------------------*/\r
- get_traffic_statistics();\r
+ get_traffic_statistics(iptables, FALSE);\r
+ if(ip6prefix)\r
+ {\r
+ /*-----------------------------------------------------------------*/\r
+ puts("Parsing ip6tables verbose output ...");\r
+ /*-----------------------------------------------------------------*/ \r
+ get_traffic_statistics(ip6tables, TRUE);\r
+ }\r
}\r
\r
/*-----------------------------------------------------------------*/\r
- printf("Parsing class defintion file %s ...\n", hosts);\r
+ /* cll1.h - let's allocate brand new character buffer... */\r
/*-----------------------------------------------------------------*/\r
- parse_hosts(hosts);\r
+ string(str,STRLEN); \r
\r
/*-----------------------------------------------------------------*/\r
- /* cll1.h - let's allocate brand new character buffer... */\r
+ printf("Parsing class defintion file %s ...\n", hosts);\r
/*-----------------------------------------------------------------*/\r
- string(str,STRLEN); \r
+ parse_hosts(hosts);\r
+ if(just_networks)\r
+ {\r
+ analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");\r
+ exit(-1); \r
+ }\r
\r
/*-----------------------------------------------------------------*/\r
puts("Resolving shared connections ...");\r
/*-----------------------------------------------------------------*/\r
- for_each(ip,ips) if(ip->sharing)\r
+ for_each(ip, ips) if(ip->sharing)\r
{\r
- for_each(sharedip,ips) if(eq(sharedip->name,ip->sharing))\r
+ for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))\r
{\r
- sharedip->traffic+=ip->traffic;\r
- ip->traffic=0;\r
- ip->mark=sharedip->mark; \r
- ip->lmsid=sharedip->lmsid;\r
+ sharedip->traffic += ip->traffic;\r
+ ip->traffic = 0;\r
+ ip->mark = sharedip->mark; \r
+ ip->lmsid = sharedip->lmsid;\r
break;\r
}\r
if(not sharedip)\r
puts("Initializing iptables and tc classes ...");\r
/*-----------------------------------------------------------------*/\r
\r
- iptables_file=fopen(iptablesfile,"w");\r
+ iptables_file = fopen(iptablesfile, "w");\r
if(iptables_file == NULL)\r
{\r
- puts("Cannot open iptablesfile!");\r
+ perror(iptablesfile);\r
exit(-1);\r
}\r
+ iptables_save_line(iptablespreamble, FALSE);\r
+\r
+ if(ip6prefix)\r
+ {\r
+ ip6tables_file = fopen(ip6tablesfile, "w");\r
+ if(ip6tables_file == NULL)\r
+ {\r
+ perror(ip6tablesfile);\r
+ exit(-1);\r
+ }\r
+ iptables_save_line(iptablespreamble, TRUE);\r
+ iptables_save_line(ip6preamble, TRUE);\r
+ }\r
+\r
+ run_iptables_restore();\r
\r
- log_file=fopen(cmdlog,"w");\r
+ log_file = fopen(cmdlog, "w");\r
if(log_file == NULL) \r
{\r
- puts("Cannot open logfile!");\r
+ perror(cmdlog);\r
exit(-1);\r
- }\r
- \r
- save_line(iptablespreamble);\r
- run_restore();\r
+ } \r
\r
sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);\r
safe_run(str);\r
safe_run(str);\r
\r
iptables_file=fopen(iptablesfile,"w");\r
- save_line(iptablespreamble);\r
+ iptables_save_line(iptablespreamble, FALSE);\r
+ if(ip6prefix)\r
+ {\r
+ ip6tables_file=fopen(ip6tablesfile,"w");\r
+ iptables_save_line(iptablespreamble, TRUE);\r
+ iptables_save_line(ip6preamble, TRUE);\r
+ }\r
\r
- if(qos_free_zone && *qos_free_zone!='0')\r
+ if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */\r
{\r
char *chain;\r
\r
sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);\r
- save_line(str);\r
+ iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */\r
\r
if(qos_proxy)\r
{\r
- save_line(":post_noproxy - [0:0]");\r
+ iptables_save_line(":post_noproxy - [0:0]", FALSE);\r
sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);\r
- save_line(str); \r
+ iptables_save_line(str , FALSE);\r
sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);\r
- save_line(str); \r
+ iptables_save_line(str, FALSE);\r
sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);\r
- save_line(str); \r
+ iptables_save_line(str, FALSE);\r
\r
chain="post_noproxy"; \r
}\r
}\r
\r
sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);\r
- save_line(str);\r
+ iptables_save_line(str, FALSE);\r
}\r
\r
- if(ip_count>idxtable_treshold1 && !just_flush)\r
+ if(ip_count > idxtable_treshold1 && !just_flush)\r
{\r
- int idxcount=0, bitmask=32-idxtable_bitmask1; /* default net mask: 255.255.255.240 */\r
+ int idxcount=0, bitmask=32-idxtable_bitmask1;\r
char *subnet, *buf;\r
/*-----------------------------------------------------------------*/\r
printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);\r
/*-----------------------------------------------------------------*/\r
\r
- save_line(":post_common - [0:0]");\r
- save_line(":forw_common - [0:0]");\r
+ iptables_save_line(":post_common - [0:0]", FALSE);\r
+ iptables_save_line(":forw_common - [0:0]", FALSE);\r
+ if(ip6prefix)\r
+ {\r
+ iptables_save_line(":post_common - [0:0]", TRUE);\r
+ iptables_save_line(":forw_common - [0:0]", TRUE);\r
+ }\r
\r
- for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))\r
+ for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0")) \r
{\r
- buf=index_id(ip->addr,bitmask);\r
+ if(ip->v6)\r
+ {\r
+ buf=index6_id(ip->addr,bitmask+32);\r
+ }\r
+ else\r
+ {\r
+ buf=index_id(ip->addr, bitmask);\r
+ }\r
+ \r
if_exists(idx,idxs,eq(idx->id,buf))\r
{\r
idx->children++;\r
else\r
{\r
create(idx,Index);\r
- idx->addr=ip->addr;\r
- idx->id=buf;\r
- idx->bitmask=bitmask;\r
- idx->parent=NULL;\r
- idx->children=0;\r
+ idx->addr = ip->addr;\r
+ idx->id = buf;\r
+ idx->bitmask = bitmask+32*ip->v6;\r
+ idx->parent = NULL;\r
+ idx->children = 0;\r
+ idx->ipv6 = ip->v6;\r
idxcount++;\r
push(idx,idxs);\r
}\r
}\r
\r
/* brutal perfomance optimalization */\r
- while(idxcount>idxtable_treshold2 && bitmask>2*idxtable_bitmask2)\r
+ while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)\r
{\r
- bitmask-=idxtable_bitmask2;\r
- idxcount=0;\r
+ bitmask -= idxtable_bitmask2;\r
+ idxcount = 0;\r
\r
for_each(idx,idxs) if(idx->parent == NULL)\r
{\r
- buf=index_id(idx->addr,bitmask);\r
+ if(idx->ipv6)\r
+ {\r
+ buf = index6_id(idx->addr, bitmask+32);\r
+ }\r
+ else\r
+ {\r
+ buf = index_id(idx->addr, bitmask);\r
+ }\r
if_exists(metaindex,idxs,eq(metaindex->id,buf))\r
{\r
metaindex->children++;\r
else\r
{\r
create(metaindex,Index);\r
- metaindex->addr=idx->addr;\r
- metaindex->id=buf;\r
- metaindex->bitmask=bitmask;\r
- metaindex->parent=NULL;\r
- metaindex->children=0;\r
+ metaindex->addr = idx->addr;\r
+ metaindex->id = buf;\r
+ metaindex->bitmask = bitmask+32*idx->ipv6;\r
+ metaindex->parent = NULL;\r
+ metaindex->children = 0;\r
+ metaindex->ipv6 = idx->ipv6;\r
idxcount++;\r
push(metaindex,idxs);\r
}\r
}\r
}\r
\r
- /* this should slightly optimize throughout ... */\r
+ /* this should slightly optimize throughput ... */\r
sort(idx,idxs,desc_order_by,children);\r
sort(idx,idxs,order_by,bitmask);\r
\r
i=0;\r
for_each(idx,idxs)\r
{\r
- subnet=subnet_id(idx->addr,idx->bitmask);\r
- printf("%d: %s/%d\n",\r
- ++i, subnet, idx->bitmask);\r
+ if(idx->ipv6)\r
+ {\r
+ subnet=subnet6_id(idx->addr, idx->bitmask);\r
+ }\r
+ else\r
+ {\r
+ subnet=subnet_id(idx->addr, idx->bitmask);\r
+ }\r
+ printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);\r
\r
sprintf(str,":post_%s - [0:0]", idx->id);\r
- save_line(str);\r
+ iptables_save_line(str, idx->ipv6);\r
\r
sprintf(str,":forw_%s - [0:0]", idx->id);\r
- save_line(str);\r
+ iptables_save_line(str, idx->ipv6);\r
\r
if(idx->parent)\r
{\r
string(buf,strlen(idx->parent->id)+6);\r
- sprintf(buf,"post_%s",idx->parent->id);\r
+ sprintf(buf,"post_%s", idx->parent->id);\r
}\r
else\r
{\r
}\r
\r
sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);\r
- save_line(str);\r
+ iptables_save_line(str, idx->ipv6);\r
\r
sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);\r
- save_line(str);\r
+ iptables_save_line(str, idx->ipv6);\r
\r
if(idx->parent)\r
{\r
}\r
\r
sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);\r
- save_line(str);\r
+ iptables_save_line(str, idx->ipv6);\r
\r
sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);\r
- save_line(str);\r
+ iptables_save_line(str, idx->ipv6);\r
}\r
printf("Total indexed iptables chains created: %d\n", i);\r
\r
sprintf(str,"-A FORWARD -o %s -j forw_common", wan);\r
- save_line(str);\r
+ iptables_save_line(str, FALSE);\r
\r
sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);\r
- save_line(str);\r
+ iptables_save_line(str, FALSE);\r
+\r
+ if(ip6prefix)\r
+ {\r
+ sprintf(str,"-A FORWARD -o %s -j forw_common", wan);\r
+ iptables_save_line(str, TRUE);\r
+ \r
+ sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);\r
+ iptables_save_line(str, TRUE);\r
+ }\r
}\r
- \r
}\r
\r
if(just_flush)\r
\r
for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)\r
{\r
- if( ip->keyword->data_limit && !ip->fixedprio \r
- && ( ip->traffic>ip->credit\r
- + (ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))) )\r
+ ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));\r
+ if( ip->keyword->data_limit \r
+ and not ip->fixedprio \r
+ and ip->traffic > ip->realquota )\r
{\r
- if(group_rate<ip->max)\r
+ if(group_rate < ip->max)\r
{\r
- ip->max=group_rate;\r
+ ip->max = group_rate;\r
}\r
group_rate+=magic_treshold;\r
ip->prio=lowest_priority;\r
\r
if(just_preview)\r
{\r
- if(start_shaping)\r
+ if(start_shaping || stop_shaping || reduce_ceil)\r
{\r
printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);\r
parse(classmap)\r
if_exists(ip,ips,eq(ip->addr,_))\r
{\r
ip->mark=atoi(ptr);\r
- if(ip->max < ip->desired) /* apply FUP limit immediately.... */\r
+ if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */\r
{\r
- printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark); \r
+ if(stop_shaping)\r
+ {\r
+ ip->max = ip->desired;\r
+ printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark); \r
+ }\r
+ else\r
+ {\r
+ printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);\r
+ if(reduce_ceil)\r
+ {\r
+ ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;\r
+ }\r
+ }\r
printf("(down: %dk-%dk ", ip->min, ip->max); \r
sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d", \r
tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);\r
perror(classmap);\r
puts("Warning - classmap file not fund, just generating preview ...");\r
start_shaping=FALSE;\r
+ stop_shaping=FALSE;\r
}\r
done; /* ugly macro end */\r
}\r
printf("Writing json traffic overview %s ... ", json_traffic);\r
/*-----------------------------------------------------------------*/\r
write_json_traffic(json_traffic);\r
- }\r
\r
- /*-----------------------------------------------------------------*/\r
- printf("Writing statistics into HTML page %s ...\n", html);\r
- /*-----------------------------------------------------------------*/\r
- write_htmlandlogs(json_traffic,d,total, just_preview);\r
+ /*-----------------------------------------------------------------*/\r
+ printf("Writing statistics into HTML page %s ...\n", html);\r
+ /*-----------------------------------------------------------------*/\r
+ write_htmlandlogs(html, d, total, just_preview);\r
+ }\r
\r
if(just_preview)\r
{\r
{\r
swchar='s';\r
}\r
+ else if(reduce_ceil)\r
+ {\r
+ swchar='0'+reduce_ceil; /* -2, -4 */\r
+ }\r
+ else if(stop_shaping)\r
+ {\r
+ swchar='q';\r
+ }\r
+\r
printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);\r
exit(0);\r
} \r
printf("%-22s %-15s mark\n","name","ip");\r
#endif\r
\r
- printf("Writing %s ... ", classmap); \r
+ printf("Writing %s", classmap); \r
f = fopen(classmap, "w"); \r
if(f < 0)\r
{\r
}\r
\r
/*-----------------------------------------------------------------*/\r
- puts("Generating iptables and tc classes ... ");\r
+ printf(" + generating iptables and tc classes ... ");\r
/*-----------------------------------------------------------------*/\r
\r
- for_each(ip, ips) if(ip->mark > 0)\r
+ for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */\r
{\r
if(idxs)\r
{\r
char *buf;\r
duplicate(ip->addr,buf);\r
- buf=index_id(ip->addr,32-idxtable_bitmask1); \r
+ if(ip->v6)\r
+ {\r
+ buf=index6_id(ip->addr,64-idxtable_bitmask1);\r
+ }\r
+ else\r
+ {\r
+ buf=index_id(ip->addr,32-idxtable_bitmask1);\r
+ }\r
\r
string(chain_forward,6+strlen(buf));\r
strcpy(chain_forward,"forw_");\r
\r
/* -------------------------------------------------------- mark download */\r
\r
- sprintf(str, "-A %s -d %s/32 -o %s -j %s%d",\r
- chain_postrouting, ip->addr, lan, mark_iptables, ip->mark);\r
- /*sprintf(str,"-A %s -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,ip->addr,lan,ip->mark);*/\r
+ sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r
+ chain_postrouting, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
/* -m limit --limit 1/s */ \r
- save_line(str);\r
+ iptables_save_line(str, ip->v6);\r
\r
if(qos_proxy)\r
{\r
- sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j %s%d",\r
- chain_postrouting, proxy_ip, proxy_port, ip->addr, lan, mark_iptables, ip->mark);\r
- /*sprintf(str,"-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,proxy_ip,proxy_port,ip->addr,lan,ip->mark);*/\r
- save_line(str);\r
+ sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",\r
+ chain_postrouting, proxy_ip, proxy_port, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
+ iptables_save_line(str, ip->v6);\r
}\r
\r
- sprintf(str, "-A %s -d %s/32 -o %s -j ACCEPT",\r
- chain_postrouting, ip->addr, lan);\r
- save_line(str);\r
+ sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",\r
+ chain_postrouting, ip->addr, 32*(1+ip->v6), lan);\r
+ iptables_save_line(str, ip->v6);\r
\r
/* -------------------------------------------------------- mark upload */\r
- sprintf(str, "-A %s -s %s/32 -o %s -j %s%d", \r
- chain_forward, ip->addr, wan, mark_iptables, ip->mark);\r
- /* sprintf(str,"-A %s -s %s/32 -o %s -j MARK --set-mark %d",chain_forward,ip->addr,wan,ip->mark);*/\r
- save_line(str);\r
+ sprintf(str, "-A %s -s %s/%d -o %s -j %s%d", \r
+ chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);\r
+ iptables_save_line(str, ip->v6);\r
\r
- sprintf(str, "-A %s -s %s/32 -o %s -j ACCEPT",\r
- chain_forward, ip->addr, wan);\r
- save_line(str);\r
+ sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",\r
+ chain_forward, ip->addr, 32*(1+ip->v6), wan);\r
+ iptables_save_line(str, ip->v6);\r
\r
if(ip->min)\r
{\r
\r
if(strcmpi(ip->keyword->leaf_discipline, "none"))\r
{\r
- sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", \r
- tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
- safe_run(str);\r
+ sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s", \r
+ tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
+ safe_run(str);\r
}\r
\r
if(filter_type == 1)\r
{\r
- sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
- tc, lan, ip->mark, ip->mark);\r
- safe_run(str);\r
+ sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
+ tc, lan, ip->mark, ip->mark);\r
+ safe_run(str);\r
}\r
\r
/* -------------------------------------------------------- upload class */\r
\r
if(strcmpi(ip->keyword->leaf_discipline, "none"))\r
{\r
- sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",\r
- tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
- safe_run(str);\r
+ sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",\r
+ tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/\r
+ safe_run(str);\r
} \r
\r
if(filter_type == 1)\r
{\r
- sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
- tc, wan, ip->mark, ip->mark);\r
- safe_run(str);\r
+ sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",\r
+ tc, wan, ip->mark, ip->mark);\r
+ safe_run(str);\r
}\r
\r
if(f > 0)\r
{\r
- fprintf(f, "%s %d\n", ip->addr, ip->mark);\r
+ fprintf(f, "%s %d\n", ip->addr, ip->mark);\r
}\r
}\r
else\r
\r
if(idxs)\r
{\r
- chain_forward = "forw_common";\r
- chain_postrouting = "post_common";\r
+ chain_forward = "forw_common";\r
+ chain_postrouting = "post_common";\r
}\r
else\r
{\r
- chain_forward = "FORWARD";\r
- chain_postrouting = "POSTROUTING";\r
+ chain_forward = "FORWARD";\r
+ chain_postrouting = "POSTROUTING";\r
}\r
- /* -------------------------------- classify or reject free download */\r
+\r
+ if(free_min)\r
{\r
- char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */\r
- if(free_min)\r
- {\r
- final_chain = "ACCEPT";\r
- }\r
- if(qos_proxy)\r
- {\r
- if(free_min)\r
- {\r
- sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s%d",\r
- chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables,3);\r
- save_line(str);\r
- }\r
- sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s",\r
- chain_postrouting,proxy_ip,proxy_port,lan,final_chain);\r
- save_line(str);\r
- }\r
- if(free_min)\r
- {\r
- sprintf(str,"-A %s -o %s -j %s%d", chain_postrouting, lan, mark_iptables, 3);\r
- save_line(str);\r
- }\r
- sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
- save_line(str);\r
- /* ------------------------------- classify or reject free upload */\r
- if(free_min)\r
- {\r
- sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);\r
- save_line(str);\r
- }\r
- sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);\r
- save_line(str);\r
+ final_chain = "ACCEPT";\r
+ }\r
+\r
+ if(qos_proxy)\r
+ {\r
+ if(free_min) \r
+ {\r
+ sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",\r
+ chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);\r
+ iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+ sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",\r
+ chain_postrouting,proxy_ip,proxy_port,lan,final_chain);\r
+ iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+\r
+ if(free_min)\r
+ {\r
+ sprintf(str, "-A %s -o %s -j %s%d",\r
+ chain_postrouting, lan, mark_iptables, 3);\r
+ iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+\r
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
+ iptables_save_line(str, FALSE);\r
+ if(ip6prefix)\r
+ {\r
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
+ iptables_save_line(str, TRUE);\r
+ }\r
+\r
+ if(free_min)\r
+ {\r
+ sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);\r
+ iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ }\r
+\r
+ sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);\r
+ iptables_save_line(str, FALSE);\r
+ if(ip6prefix)\r
+ {\r
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);\r
+ iptables_save_line(str, TRUE);\r
}\r
\r
if(free_min) /* allocate free bandwith if it is not zero... */ \r
safe_run(str);\r
}\r
printf("Total IP count: %d\n", i);\r
- run_restore(); \r
+ run_iptables_restore();\r
if(log_file)\r
{\r
fclose(log_file);\r
GIT.Harvie.CZ / svn / Prometheus-QoS / .git / blobdiff