X-Git-Url: http://git.harvie.cz/?p=svn%2FPrometheus-QoS%2F.git;a=blobdiff_plain;f=prometheus.c;h=279da9b75d28b4fd245b28ed4e6165eaae86fc91;hp=094008789cd56e3029e1e57641805463d2fb09bd;hb=06733b885c35e5bf83505d064c55ccdda848ac01;hpb=3bf40f9b7d9850a43a3a53374dac3cde20adf587
diff --git a/prometheus.c b/prometheus.c
index 0940087..279da9b 100644
--- a/prometheus.c
+++ b/prometheus.c
@@ -1,13 +1,13 @@
- /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
- /* Prometheus QoS - you can "steal fire" from your ISP */
-/* "fair-per-IP" quality of service (QoS) utility */
-/* requires Linux 2.4.x or 2.6.x with HTB support */
-/* Copyright(C) 2005-2013 Michael Polak, Arachne Labs */
-/* iptables-restore support Copyright(C) 2007-2008 ludva */
-/* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf */
-/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
-
-/* Modified by: xChaos, 20130107
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+/* Prometheus QoS - you can "steal fire" from your ISP */
+/* "fair-per-IP" quality of service (QoS) utility */
+/* requires Linux 2.4.x or 2.6.x with HTB support */
+/* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace */
+/* iptables-restore support Copyright(C) 2007-2008 ludva */
+/* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf */
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+/* Modified by: xChaos, 20131118
ludva, 20080415
Prometheus QoS is free software; you can redistribute it and/or
@@ -26,56 +26,40 @@
GNU General Public License is located in file COPYING */
-#define STRLEN 512
-#undef DEBUG
-
#include "cll1-0.6.2.h"
#include "ipstruct.h"
-const char *version = "0.8.3-g";
+const char *version = "0.8.3-j";
-/* Version numbers: 0.8.3 is development releases ("beta"), 0.8.4 will be "stable" */
-/* Debian(RPM) package versions/patchlevels: 0.7.9-2, 0.8.0-1, 0.8.0-2, etc. */
-/* C source code development versions ("beta"): 0.7.9-a, 0.8.1-b, etc. */
-/* C source code release versions: 0.8.0, 0.8.2, 0.8.4, etc. */
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+/* Versions: 0.8.3 is development release, 0.8.4 will be "stable" */
+/* Official Trac URL: https://dev.arachne.cz/svn/prometheus */
+/* Official SVN URL: https://dev.arachne.cz/repos/prometheus */
+/* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq */
+/* CZK donations account: 2900242944/2010 (transparent account) */
+/* Warning: unofficial Github mirror is not supported by author! */
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
const char *stats_html_signature = "Statistics generated by Prometheus QoS version %s
GPL+Copyright(C)2005-2013 Michael Polak, Arachne Labs\n";
-/* ======= Help screen is hopefuly self-documenting part of code :-) ======= */
-
-void help(void)
-{
- puts("Command line switches:\n\
-\n\
--d Dry run (preview tc and iptables commands on stdout)\n\
--r Run (reset all statistics and start shaping - daily usage)\n\
--p just generate Preview of data transfer statistics and exit (after -r)\n\
--s start Shaping FUP limits (keeps data transfer stat like -p) (after -r)\n\
--n run Now (like -r delay - overrides qos-free-delay keyword, after boot)\n\
--f just Flush iptables and tc classes and exit (stop shaping, no QiS)\n\
--9 emergency iptables flush (like -f, but dumps data transfer statistics)\n\
-\n\
--c filename force alternative /etc/prometheus/prometheus.conf filename\n\
--h filename force alternative /etc/hosts filename (overrides hosts keyword)\n\
--l Mmm YYYY generate HTML summary of Logged traffic (Mmm=Jan-Dec) (and exit)\n\
--m generate HTML summary of traffic for yesterday's Month (and exit)\n\
--y generate HTML summary of traffic for yesterday's Year (and exit)\n\
--? --help show this help scree (and exit)\n\
--v --version show Version number of this utility (and exit)\n");
-}
+#define STRLEN 512
+#undef DEBUG
/* ======= All path names are defined here (for RPM patch) ======= */
-const char *tc = "/sbin/tc"; /* requires tc with HTB support */
-const char *iptables = "/sbin/iptables"; /* requires iptables utility */
-const char *iptablessave = "/sbin/iptables-save"; /* not yet required */
-const char *iptablesrestore = "/sbin/iptables-restore"; /* requires iptables-restore */
-const char *ls = "/bin/ls"; /* this is not user configurable :-) */
+const char *tc = "/sbin/tc"; /* requires tc with HTB support */
+const char *iptables = "/sbin/iptables"; /* requires iptables utility */
+const char *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
+const char *iptablessave = "/sbin/iptables-save"; /* not yet required */
+const char *iptablesrestore = "/sbin/iptables-restore"; /* requires iptables-restore */
+const char *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
+const char *ip6tablesrestore = "/sbin/ip6tables-restore"; /* requires iptables-restore */
+const char *ls = "/bin/ls"; /* this is not user configurable :-) */
char *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
char *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
-
char *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
+char *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
char *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
char *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
char *html = "/var/www/traffic.html"; /* hall of fame - html version */
@@ -95,11 +79,14 @@ int row_odd_even = 0; /* */
/* === Configuraration file values defaults - stored in global variables ==== */
int filter_type = 1; /*1 mark, 2 classify*/
+char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
char *mark = "MARK";
char *mark_iptables = "MARK --set-mark ";
int dry_run = FALSE; /* preview - use puts() instead of system() */
char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
+char *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
FILE *iptables_file = NULL;
+FILE *ip6tables_file = NULL;
int enable_credit = TRUE; /* enable credit file */
int use_credit = FALSE; /* use credit file (if enabled)*/
char *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
@@ -107,6 +94,7 @@ int hall_of_fame = TRUE; /* enable hall of fame */
char *lan = "eth0"; /* LAN interface */
char *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
char *wan = "eth1"; /* WAN/ISP interface */
+char *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
char *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
char *qos_leaf = "sfq perturb 5"; /* leaf discipline */
char *qos_free_zone = NULL; /* QoS free zone */
@@ -117,8 +105,8 @@ char *proxy_ip = "192.168.1.1/32"; /* our IP with proxy port */
int proxy_port = 3128; /* proxy port number */
long long int line = 1024; /* WAN/ISP download in kbps */
long long int up = 1024; /* WAN/ISP upload in kbps */
-int free_min = 32; /* minimum guaranted bandwidth for all undefined hosts */
-int free_max = 64; /* maximum allowed bandwidth for all undefined hosts */
+int free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
+int free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
int qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
int digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
int max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */
@@ -130,10 +118,6 @@ int magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shapi
int keywordcount = 0;
int class_count = 0;
int ip_count = 0;
-/* not yet implemented:
-int fixed_packets = 0; maximum number of pps per IP address (not class!)
-int packet_limit = 5; maximum number of pps to htn CEIL, not rate !!!
-*/
FILE *log_file = NULL;
char *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
@@ -144,10 +128,16 @@ const int idxtable_treshold2 = 12; /* this is no longer configurable */
const int idxtable_bitmask1 = 3; /* this is no longer configurable */
const int idxtable_bitmask2 = 3; /* this is no longer configurable */
-struct IP *ips = NULL, *ip, *sharedip;
+struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
struct Group *groups = NULL, *group;
struct Keyword *keyword, *defaultkeyword=NULL, *keywords=NULL;
+void help(void);
+/* implemented in help.c */
+
+void get_traffic_statistics(const char *whichiptables, int ipv6);
+/* implemented in parseiptables.c */
+
void parse_ip_log(int argc, char **argv);
/* implemented in parselog.c */
@@ -160,6 +150,10 @@ void write_json_traffic(char *json);
void write_htmlandlogs(char *html, char *d, int total, int just_preview);
/* implemented in htmlandlogs.c */
+void analyse_topology(char *traceroute);
+/* implemented in networks.c */
+
+
const char *tr_odd_even(void)
{
row_odd_even = 1 - row_odd_even;
@@ -174,6 +168,7 @@ const char *tr_odd_even(void)
}
/* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
+/* (except that this code uses obsolete, archaic version of this header file...) */
struct Index
{
@@ -182,11 +177,10 @@ struct Index
struct Index *parent;
int bitmask;
int children;
+ int ipv6;
list(Index);
} *idxs=NULL, *idx, *metaindex;
-void TheIP(void);
-/* function implemented in parsehosts.c */
/* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
@@ -196,6 +190,12 @@ char *index_id(char *ip, int bitmask);
char *subnet_id(char *ip, int bitmask);
/* function implemented in ipv4subnets.c */
+char *index6_id(char *ip, int bitmask);
+/* function implemented in ipv6subnets.c */
+
+char *subnet6_id(char *ip, int bitmask);
+/* function implemented in ipv6subnets.c */
+
/* ================= Let's parse configuration file here ================ */
void reject_config_and_exit(char *filename)
@@ -274,12 +274,17 @@ void get_config(char *config_filename)
option("tc",tc);
option("iptables",iptables);
- option("iptables-save",iptablessave); /* new */
- option("iptables-restore",iptablesrestore); /* new */
- option("iptables-in-filename",iptablesfile); /* new */
+ option("iptables-save",iptablessave);
+ option("iptables-restore",iptablesrestore);
+ option("ip6tables",ip6tables);
+ option("ip6tables-save",ip6tablessave);
+ option("ip6tables-restore",ip6tablesrestore);
+ option("iptables-in-filename",iptablesfile);
+ option("ip6tables-in-filename",ip6tablesfile);
option("hosts",hosts);
option("lan-interface",lan);
option("wan-interface",wan);
+ option("ip6-prefix",ip6prefix);
option("lan-medium",lan_medium);
option("wan-medium",wan_medium);
lloption("wan-download",line);
@@ -332,10 +337,10 @@ void get_config(char *config_filename)
/* leaf discipline for keywords */
for_each(keyword,keywords)
{
- if(!strcmpi(keyword->leaf_discipline, ""))
- {
- keyword->leaf_discipline = qos_leaf;
- }
+ if(!strcmpi(keyword->leaf_discipline, ""))
+ {
+ keyword->leaf_discipline = qos_leaf;
+ }
}
if(strcmpi(cnf, "mark"))
@@ -359,159 +364,6 @@ void get_config(char *config_filename)
}
}
-/* ===================== traffic analyser - uses iptables ================ */
-
-void get_traffic_statistics(void)
-{
- char *str,*cmd;
- int downloadflag=0;
-
- textfile(Pipe,str) *line,*lines=NULL;
- string(str,STRLEN);
- string(cmd,STRLEN);
-
- sprintf(cmd,"%s -L -v -x -n -t mangle",iptables);
- shell(cmd);
- input(str,STRLEN)
- {
- create(line,Pipe);
- line->str=str;
- string(str,STRLEN);
- append(line,lines);
- }
-
- for_each(line,lines)
- {
- int col, accept=0,proxyflag=0,valid=1,setchainname=0,commonflag=0;
- unsigned long long traffic=0;
- unsigned long pkts=0;
- char *ipaddr=NULL,*ptr;
-
- /* debug puts(line->str); */
- valid_columns(ptr,line->str,' ',col)
- if(valid) switch(col)
- {
- case 1: if(eq(ptr,"Chain"))
- {
- setchainname=1;
- }
- else if(eq(ptr,"pkts"))
- {
- valid=0;
- }
- else
- {
- sscanf(ptr,"%lu",&pkts);
- }
- break;
- case 2: if(setchainname)
- {
- if(!strncmp(ptr,"post_",5) || eq(ptr,"POSTROUTING"))
- {
- downloadflag = 1;
- }
- else
- {
- if(!strncmp(ptr,"forw_",5) || eq(ptr,"FORWARD"))
- {
- downloadflag = 0;
- }
- }
- if(eq(ptr,"post_common") || eq(ptr,"forw_common"))
- {
- commonflag = 1;
- }
- }
- else
- {
- sscanf(ptr,"%Lu",&traffic);
- traffic += (1<<19);
- traffic >>= 20;
- }
- break;
- case 3: if((strncmp(ptr,"post_",5) && strncmp(ptr,"forw_",5)) || commonflag)
- {
- accept=eq(ptr,mark);
- }
- /*if(filter_type==1) accept=eq(ptr,"MARK"); else accept=eq(ptr,"CLASSIFY");*/
- break;
- case 8: if(downloadflag)
- {
- if(strstr(proxy_ip,ptr))
- {
- proxyflag=1;
- }
- }
- else
- {
- ipaddr=ptr;
- }
- break;
- case 9: if(downloadflag)ipaddr=ptr;break;
- }
-
- if(accept && traffic>0 && ipaddr)
- {
- if(proxyflag)
- {
- printf("(proxy) ");
- }
- else if(!downloadflag)
- {
- printf("(upload) ");
- }
- printf("IP %s: %Lu MB (%ld pkts)\n", ipaddr, traffic, pkts);
-
- if_exists(ip,ips,eq(ip->addr,ipaddr));
- else
- {
- TheIP();
- ip->addr = ipaddr;
- if(eq(ip->addr,"0.0.0.0/0"))
- {
- ip->name = "(unregistered)";
- ip->min = free_min;
- ip->max = ip->desired=free_max;
- }
- else
- {
- ip->name = ipaddr;
- }
- }
-
- if(downloadflag)
- {
- if(proxyflag)
- {
- ip->proxy=traffic;
- }
- else
- {
- ip->traffic+=traffic;
- }
- ip->direct=ip->traffic-ip->upload-ip->proxy;
- ip->pktsdown=pkts;
- }
- else
- {
- ip->upload=traffic;
- ip->pktsup=pkts;
- if(include_upload)
- {
- ip->traffic+=traffic;
- }
- else
- {
- if(traffic>ip->traffic)
- {
- ip->traffic=traffic;
- }
- }
- }
- }
- }
- free(cmd);
-}
/* ========== This function executes, logs OR ALSO prints command ========== */
@@ -531,12 +383,19 @@ void safe_run(char *cmd)
}
}
-void save_line(char *line)
+void iptables_save_line(char *line, int ipv6)
{
- fprintf(iptables_file,"%s\n",line);
+ if(ipv6)
+ {
+ fprintf(ip6tables_file,"%s\n",line);
+ }
+ else
+ {
+ fprintf(iptables_file,"%s\n",line);
+ }
}
-void run_restore(void)
+void run_iptables_restore(void)
{
char *restor;
string(restor,STRLEN);
@@ -544,8 +403,8 @@ void run_restore(void)
/*-----------------------------------------------------------------*/
printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
/*-----------------------------------------------------------------*/
-
- save_line("COMMIT");
+
+ iptables_save_line("COMMIT", FALSE);
fclose(iptables_file);
if(dry_run)
{
@@ -558,7 +417,25 @@ void run_restore(void)
sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
safe_run(restor);
-
+
+ if(ip6prefix)
+ {
+ /*-----------------------------------------------------------------*/
+ printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
+ /*-----------------------------------------------------------------*/
+ iptables_save_line("COMMIT", TRUE);
+ fclose(ip6tables_file);
+ if(dry_run)
+ {
+ parse(ip6tablesfile)
+ {
+ printf("%s\n",_);
+ }
+ done; /* ugly macro end */
+ }
+ sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
+ safe_run(restor);
+ }
free(restor);
}
@@ -588,13 +465,16 @@ program
int i=0; /* just plain old Fortran style integer :-) */
FILE *f=NULL; /* everything is just stream of bytes... */
char *str, *ptr, *d; /* LET A$=B$ :-) */
- char *substring;
+ char *substring, *limit_pkts;
int parent = 1;
+ int just_networks = FALSE;
int just_flush = FALSE; /* deactivates all previous actions */
int nodelay = FALSE;
int just_preview = FALSE; /* preview - generate just stats */
int start_shaping = FALSE; /* apply FUP - requires classmap file */
+ int stop_shaping = FALSE; /* lift FUP - requires classmap file */
+ int reduce_ceil = 0; /* allow only rate+(ceil-rate)/2, /4, etc. */
int just_logs = FALSE; /* just parse logs */
int run = FALSE;
int total = 0;
@@ -604,7 +484,7 @@ program
printf("\n\
Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
-Version %s - Copyright (C)2005-2012 Michael Polak, Arachne Labs\n\
+Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\
iptables-restore & burst tunning & classify modification by Ludva\n\
Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
@@ -617,9 +497,13 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
argument("-f") { run=TRUE; just_flush=TRUE; }
argument("-9") { run=TRUE; just_flush=9; }
argument("-p") { run=TRUE; just_preview=TRUE; }
+ argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
+ argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
+ argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
argument("-r") { run=TRUE; }
argument("-n") { run=TRUE; nodelay=TRUE; }
+ argument("-a") { run=TRUE; just_networks=TRUE; }
argument("-l") { just_logs=TRUE; }
argument("-m") { just_logs=TRUE; }
argument("-y") { just_logs=TRUE; }
@@ -654,7 +538,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
if(althosts)
{
- hosts=althosts;
+ hosts = althosts;
}
if(just_flush<9)
@@ -662,30 +546,44 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
/*-----------------------------------------------------------------*/
puts("Parsing iptables verbose output ...");
/*-----------------------------------------------------------------*/
- get_traffic_statistics();
+ get_traffic_statistics(iptables, FALSE);
+ if(ip6prefix)
+ {
+ /*-----------------------------------------------------------------*/
+ puts("Parsing ip6tables verbose output ...");
+ /*-----------------------------------------------------------------*/
+ get_traffic_statistics(ip6tables, TRUE);
+ }
}
/*-----------------------------------------------------------------*/
- printf("Parsing class defintion file %s ...\n", hosts);
+ /* cll1.h - let's allocate brand new character buffer... */
/*-----------------------------------------------------------------*/
- parse_hosts(hosts);
+ string(str, STRLEN);
+ string(limit_pkts, STRLEN);
/*-----------------------------------------------------------------*/
- /* cll1.h - let's allocate brand new character buffer... */
+ printf("Parsing class defintion file %s ...\n", hosts);
/*-----------------------------------------------------------------*/
- string(str,STRLEN);
+ parse_hosts(hosts);
+ if(just_networks)
+ {
+ analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
+ exit(-1);
+ }
/*-----------------------------------------------------------------*/
puts("Resolving shared connections ...");
/*-----------------------------------------------------------------*/
- for_each(ip,ips) if(ip->sharing)
+ for_each(ip, ips) if(ip->sharing)
{
- for_each(sharedip,ips) if(eq(sharedip->name,ip->sharing))
+ for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
{
- sharedip->traffic+=ip->traffic;
- ip->traffic=0;
- ip->mark=sharedip->mark;
- ip->lmsid=sharedip->lmsid;
+ sharedip->traffic += ip->traffic;
+ ip->traffic = 0;
+ ip->mark = sharedip->mark;
+ ip->lmsid = sharedip->lmsid;
+ ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
break;
}
if(not sharedip)
@@ -720,22 +618,34 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
puts("Initializing iptables and tc classes ...");
/*-----------------------------------------------------------------*/
- iptables_file=fopen(iptablesfile,"w");
+ iptables_file = fopen(iptablesfile, "w");
if(iptables_file == NULL)
{
- puts("Cannot open iptablesfile!");
+ perror(iptablesfile);
exit(-1);
}
+ iptables_save_line(iptablespreamble, FALSE);
+
+ if(ip6prefix)
+ {
+ ip6tables_file = fopen(ip6tablesfile, "w");
+ if(ip6tables_file == NULL)
+ {
+ perror(ip6tablesfile);
+ exit(-1);
+ }
+ iptables_save_line(iptablespreamble, TRUE);
+ iptables_save_line(ip6preamble, TRUE);
+ }
+
+ run_iptables_restore();
- log_file=fopen(cmdlog,"w");
+ log_file = fopen(cmdlog, "w");
if(log_file == NULL)
{
- puts("Cannot open logfile!");
+ perror(cmdlog);
exit(-1);
- }
-
- save_line(iptablespreamble);
- run_restore();
+ }
sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
safe_run(str);
@@ -744,24 +654,30 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
safe_run(str);
iptables_file=fopen(iptablesfile,"w");
- save_line(iptablespreamble);
+ iptables_save_line(iptablespreamble, FALSE);
+ if(ip6prefix)
+ {
+ ip6tables_file=fopen(ip6tablesfile,"w");
+ iptables_save_line(iptablespreamble, TRUE);
+ iptables_save_line(ip6preamble, TRUE);
+ }
- if(qos_free_zone && *qos_free_zone!='0')
+ if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
{
char *chain;
sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
- save_line(str);
+ iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
if(qos_proxy)
{
- save_line(":post_noproxy - [0:0]");
+ iptables_save_line(":post_noproxy - [0:0]", FALSE);
sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
- save_line(str);
+ iptables_save_line(str , FALSE);
sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
- save_line(str);
+ iptables_save_line(str, FALSE);
sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
- save_line(str);
+ iptables_save_line(str, FALSE);
chain="post_noproxy";
}
@@ -771,23 +687,36 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
}
sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
- save_line(str);
+ iptables_save_line(str, FALSE);
}
- if(ip_count>idxtable_treshold1 && !just_flush)
+ if(ip_count > idxtable_treshold1 && !just_flush)
{
- int idxcount=0, bitmask=32-idxtable_bitmask1; /* default net mask: 255.255.255.240 */
+ int idxcount=0, bitmask=32-idxtable_bitmask1;
char *subnet, *buf;
/*-----------------------------------------------------------------*/
printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
/*-----------------------------------------------------------------*/
- save_line(":post_common - [0:0]");
- save_line(":forw_common - [0:0]");
+ iptables_save_line(":post_common - [0:0]", FALSE);
+ iptables_save_line(":forw_common - [0:0]", FALSE);
+ if(ip6prefix)
+ {
+ iptables_save_line(":post_common - [0:0]", TRUE);
+ iptables_save_line(":forw_common - [0:0]", TRUE);
+ }
- for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
+ for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
{
- buf=index_id(ip->addr,bitmask);
+ if(ip->v6)
+ {
+ buf=index6_id(ip->addr,bitmask+32);
+ }
+ else
+ {
+ buf=index_id(ip->addr, bitmask);
+ }
+
if_exists(idx,idxs,eq(idx->id,buf))
{
idx->children++;
@@ -795,25 +724,33 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
else
{
create(idx,Index);
- idx->addr=ip->addr;
- idx->id=buf;
- idx->bitmask=bitmask;
- idx->parent=NULL;
- idx->children=0;
+ idx->addr = ip->addr;
+ idx->id = buf;
+ idx->bitmask = bitmask+32*ip->v6;
+ idx->parent = NULL;
+ idx->children = 0;
+ idx->ipv6 = ip->v6;
idxcount++;
push(idx,idxs);
}
}
/* brutal perfomance optimalization */
- while(idxcount>idxtable_treshold2 && bitmask>2*idxtable_bitmask2)
+ while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
{
- bitmask-=idxtable_bitmask2;
- idxcount=0;
+ bitmask -= idxtable_bitmask2;
+ idxcount = 0;
for_each(idx,idxs) if(idx->parent == NULL)
{
- buf=index_id(idx->addr,bitmask);
+ if(idx->ipv6)
+ {
+ buf = index6_id(idx->addr, bitmask+32);
+ }
+ else
+ {
+ buf = index_id(idx->addr, bitmask);
+ }
if_exists(metaindex,idxs,eq(metaindex->id,buf))
{
metaindex->children++;
@@ -821,11 +758,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
else
{
create(metaindex,Index);
- metaindex->addr=idx->addr;
- metaindex->id=buf;
- metaindex->bitmask=bitmask;
- metaindex->parent=NULL;
- metaindex->children=0;
+ metaindex->addr = idx->addr;
+ metaindex->id = buf;
+ metaindex->bitmask = bitmask+32*idx->ipv6;
+ metaindex->parent = NULL;
+ metaindex->children = 0;
+ metaindex->ipv6 = idx->ipv6;
idxcount++;
push(metaindex,idxs);
}
@@ -833,27 +771,33 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
}
}
- /* this should slightly optimize throughout ... */
+ /* this should slightly optimize throughput ... */
sort(idx,idxs,desc_order_by,children);
sort(idx,idxs,order_by,bitmask);
i=0;
for_each(idx,idxs)
{
- subnet=subnet_id(idx->addr,idx->bitmask);
- printf("%d: %s/%d\n",
- ++i, subnet, idx->bitmask);
+ if(idx->ipv6)
+ {
+ subnet=subnet6_id(idx->addr, idx->bitmask);
+ }
+ else
+ {
+ subnet=subnet_id(idx->addr, idx->bitmask);
+ }
+ printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
sprintf(str,":post_%s - [0:0]", idx->id);
- save_line(str);
+ iptables_save_line(str, idx->ipv6);
sprintf(str,":forw_%s - [0:0]", idx->id);
- save_line(str);
+ iptables_save_line(str, idx->ipv6);
if(idx->parent)
{
string(buf,strlen(idx->parent->id)+6);
- sprintf(buf,"post_%s",idx->parent->id);
+ sprintf(buf,"post_%s", idx->parent->id);
}
else
{
@@ -861,10 +805,10 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
}
sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
- save_line(str);
+ iptables_save_line(str, idx->ipv6);
sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
- save_line(str);
+ iptables_save_line(str, idx->ipv6);
if(idx->parent)
{
@@ -877,20 +821,28 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
}
sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
- save_line(str);
+ iptables_save_line(str, idx->ipv6);
sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
- save_line(str);
+ iptables_save_line(str, idx->ipv6);
}
printf("Total indexed iptables chains created: %d\n", i);
sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
- save_line(str);
+ iptables_save_line(str, FALSE);
sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
- save_line(str);
+ iptables_save_line(str, FALSE);
+
+ if(ip6prefix)
+ {
+ sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
+ iptables_save_line(str, TRUE);
+
+ sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
+ iptables_save_line(str, TRUE);
+ }
}
-
}
if(just_flush)
@@ -1039,7 +991,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
if(just_preview)
{
- if(start_shaping)
+ if(start_shaping || stop_shaping || reduce_ceil)
{
printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
parse(classmap)
@@ -1052,9 +1004,21 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
if_exists(ip,ips,eq(ip->addr,_))
{
ip->mark=atoi(ptr);
- if(ip->max < ip->desired) /* apply FUP limit immediately.... */
+ if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */
{
- printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
+ if(stop_shaping)
+ {
+ ip->max = ip->desired;
+ printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
+ }
+ else
+ {
+ printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
+ if(reduce_ceil)
+ {
+ ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
+ }
+ }
printf("(down: %dk-%dk ", ip->min, ip->max);
sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
@@ -1075,6 +1039,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
perror(classmap);
puts("Warning - classmap file not fund, just generating preview ...");
start_shaping=FALSE;
+ stop_shaping=FALSE;
}
done; /* ugly macro end */
}
@@ -1088,12 +1053,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
printf("Writing json traffic overview %s ... ", json_traffic);
/*-----------------------------------------------------------------*/
write_json_traffic(json_traffic);
- }
- /*-----------------------------------------------------------------*/
- printf("Writing statistics into HTML page %s ...\n", html);
- /*-----------------------------------------------------------------*/
- write_htmlandlogs(html, d,total, just_preview);
+ /*-----------------------------------------------------------------*/
+ printf("Writing statistics into HTML page %s ...\n", html);
+ /*-----------------------------------------------------------------*/
+ write_htmlandlogs(html, d, total, just_preview);
+ }
if(just_preview)
{
@@ -1102,6 +1067,15 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
{
swchar='s';
}
+ else if(reduce_ceil)
+ {
+ swchar='0'+reduce_ceil; /* -2, -4 */
+ }
+ else if(stop_shaping)
+ {
+ swchar='q';
+ }
+
printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
exit(0);
}
@@ -1111,7 +1085,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
printf("%-22s %-15s mark\n","name","ip");
#endif
- printf("Writing %s ... ", classmap);
+ printf("Writing %s", classmap);
f = fopen(classmap, "w");
if(f < 0)
{
@@ -1119,16 +1093,23 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
}
/*-----------------------------------------------------------------*/
- puts("Generating iptables and tc classes ... ");
+ printf(" + generating iptables and tc classes ... ");
/*-----------------------------------------------------------------*/
- for_each(ip, ips) if(ip->mark > 0)
+ for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
{
if(idxs)
{
char *buf;
duplicate(ip->addr,buf);
- buf=index_id(ip->addr,32-idxtable_bitmask1);
+ if(ip->v6)
+ {
+ buf=index6_id(ip->addr,64-idxtable_bitmask1);
+ }
+ else
+ {
+ buf=index_id(ip->addr,32-idxtable_bitmask1);
+ }
string(chain_forward,6+strlen(buf));
strcpy(chain_forward,"forw_");
@@ -1146,39 +1127,46 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
chain_postrouting="POSTROUTING";
}
+ /* packet limits - this will be optional in future, hardcoded for now */
+ if(ip->pps_limit)
+ {
+ sprintf(limit_pkts, "-m limit --limit %d/s ", ip->pps_limit);
+ }
+ else
+ {
+ *limit_pkts = 0;
+ }
+
#ifdef DEBUG
- printf("%-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
+ printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
#endif
- /* -------------------------------------------------------- mark download */
-
- sprintf(str, "-A %s -d %s/32 -o %s -j %s%d",
- chain_postrouting, ip->addr, lan, mark_iptables, ip->mark);
- /*sprintf(str,"-A %s -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,ip->addr,lan,ip->mark);*/
- /* -m limit --limit 1/s */
- save_line(str);
+ /* -------------------------------------------------------- mark download */
+ sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
+ chain_postrouting, ip->addr, 32*(1+ip->v6),
+ lan, mark_iptables, ip->mark);
+ iptables_save_line(str, ip->v6);
if(qos_proxy)
{
- sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j %s%d",
- chain_postrouting, proxy_ip, proxy_port, ip->addr, lan, mark_iptables, ip->mark);
- /*sprintf(str,"-A %s -s %s -p tcp --sport %d -d %s/32 -o %s -j MARK --set-mark %d",chain_postrouting,proxy_ip,proxy_port,ip->addr,lan,ip->mark);*/
- save_line(str);
+ sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
+ chain_postrouting, proxy_ip, proxy_port, ip->addr,
+ 32*(1+ip->v6), lan, mark_iptables, ip->mark);
+ iptables_save_line(str, ip->v6);
}
- sprintf(str, "-A %s -d %s/32 -o %s -j ACCEPT",
- chain_postrouting, ip->addr, lan);
- save_line(str);
+ sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
+ chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);
+ iptables_save_line(str, ip->v6);
/* -------------------------------------------------------- mark upload */
- sprintf(str, "-A %s -s %s/32 -o %s -j %s%d",
- chain_forward, ip->addr, wan, mark_iptables, ip->mark);
- /* sprintf(str,"-A %s -s %s/32 -o %s -j MARK --set-mark %d",chain_forward,ip->addr,wan,ip->mark);*/
- save_line(str);
+ sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
+ chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);
+ iptables_save_line(str, ip->v6);
- sprintf(str, "-A %s -s %s/32 -o %s -j ACCEPT",
- chain_forward, ip->addr, wan);
- save_line(str);
+ sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
+ chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);
+ iptables_save_line(str, ip->v6);
if(ip->min)
{
@@ -1188,21 +1176,21 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
#endif
sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
- tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
+ tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
safe_run(str);
if(strcmpi(ip->keyword->leaf_discipline, "none"))
{
- sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
- tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
- safe_run(str);
+ sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
+ tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
+ safe_run(str);
}
if(filter_type == 1)
{
- sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
- tc, lan, ip->mark, ip->mark);
- safe_run(str);
+ sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
+ tc, lan, ip->mark, ip->mark);
+ safe_run(str);
}
/* -------------------------------------------------------- upload class */
@@ -1219,21 +1207,21 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
if(strcmpi(ip->keyword->leaf_discipline, "none"))
{
- sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
- tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
- safe_run(str);
+ sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
+ tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
+ safe_run(str);
}
if(filter_type == 1)
{
- sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
- tc, wan, ip->mark, ip->mark);
- safe_run(str);
+ sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
+ tc, wan, ip->mark, ip->mark);
+ safe_run(str);
}
if(f > 0)
{
- fprintf(f, "%s %d\n", ip->addr, ip->mark);
+ fprintf(f, "%s %d\n", ip->addr, ip->mark);
}
}
else
@@ -1252,48 +1240,60 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
if(idxs)
{
- chain_forward = "forw_common";
- chain_postrouting = "post_common";
+ chain_forward = "forw_common";
+ chain_postrouting = "post_common";
}
else
{
- chain_forward = "FORWARD";
- chain_postrouting = "POSTROUTING";
+ chain_forward = "FORWARD";
+ chain_postrouting = "POSTROUTING";
}
- /* -------------------------------- classify or reject free download */
+
+ if(free_min)
{
- char *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
- if(free_min)
- {
- final_chain = "ACCEPT";
- }
- if(qos_proxy)
- {
- if(free_min)
- {
- sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
- chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables,3);
- save_line(str);
- }
- sprintf(str,"-A %s -s %s -p tcp --sport %d -o %s -j %s",
- chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
- save_line(str);
- }
- if(free_min)
- {
- sprintf(str,"-A %s -o %s -j %s%d", chain_postrouting, lan, mark_iptables, 3);
- save_line(str);
- }
- sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
- save_line(str);
- /* ------------------------------- classify or reject free upload */
- if(free_min)
- {
- sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);
- save_line(str);
- }
- sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
- save_line(str);
+ final_chain = "ACCEPT";
+ }
+
+ if(qos_proxy)
+ {
+ if(free_min)
+ {
+ sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
+ chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
+ iptables_save_line(str, FALSE); /* only for IPv4 */
+ }
+ sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
+ chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
+ iptables_save_line(str, FALSE); /* only for IPv4 */
+ }
+
+ if(free_min)
+ {
+ sprintf(str, "-A %s -o %s -j %s%d",
+ chain_postrouting, lan, mark_iptables, 3);
+ iptables_save_line(str, FALSE); /* only for IPv4 */
+ }
+
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
+ iptables_save_line(str, FALSE);
+ if(ip6prefix)
+ {
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
+ iptables_save_line(str, TRUE);
+ }
+
+ if(free_min)
+ {
+ sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, 3);
+ iptables_save_line(str, FALSE); /* only for IPv4 */
+ }
+
+ sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
+ iptables_save_line(str, FALSE);
+ if(ip6prefix)
+ {
+ sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
+ iptables_save_line(str, TRUE);
}
if(free_min) /* allocate free bandwith if it is not zero... */
@@ -1324,7 +1324,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
safe_run(str);
}
printf("Total IP count: %d\n", i);
- run_restore();
+ run_iptables_restore();
if(log_file)
{
fclose(log_file);