prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2013 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20131126
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.3-j";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2013 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  62 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  63 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  64 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  65 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  66 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  67 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  68 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  69 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  70 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  71 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  72 char    *html_log_dir = "/var/www/logs/html/";
  73
  74 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  75 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  76 int use_jquery_popups = TRUE;
  77 int      row_odd_even = 0; /*<tr class="odd/even"> */
  78
  79 /* === Configuraration file values defaults - stored in global variables ==== */
  80
  81 int        filter_type = 1; /*1 mark, 2 classify*/
  82 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  83 char             *mark = "MARK";
  84 char    *mark_iptables = "MARK --set-mark ";
  85 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  86 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  87 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  88 FILE    *iptables_file = NULL;
  89 FILE   *ip6tables_file = NULL;
  90 int      enable_credit = TRUE; /* enable credit file */
  91 int         use_credit = FALSE; /* use credit file (if enabled)*/
  92 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  93 int       hall_of_fame = TRUE; /* enable hall of fame */
  94 char              *lan = "eth0"; /* LAN interface */
  95 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  96 char              *wan = "eth1"; /* WAN/ISP interface */
  97 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  98 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  99 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 100 char    *qos_free_zone = NULL; /* QoS free zone */
 101 /* int          qos_proxy = TRUE; include proxy port to QoS */
 102 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 103 int     include_upload = TRUE; /* upload+download=total traffic */
 104 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 105 /* int         proxy_port = 3128; proxy port number */
 106 long long int     line = 1024; /* WAN/ISP download in kbps */
 107 long long int       up = 1024; /* WAN/ISP upload in kbps */
 108 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 109 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 110 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 111 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 112 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 113 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 114 int        max_nesting = 3; /* maximum nesting of HTB clases, built-in maximum seems to be 4 */
 115 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 116 int              burst = 8; /* HTB burst (in kbits) */
 117 int         burst_main = 64;
 118 int        burst_group = 32;
 119 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 120 int       keywordcount = 0;
 121 int        class_count = 0;
 122 int           ip_count = 0;
 123 FILE         *log_file = NULL;
 124 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 125
 126 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 127 const int lowest_priority    = 7; /* lowest HTB priority (HTB built-in value is 7) */
 128 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 129 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 130 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 131 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 132
 133 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 134 struct Group *groups = NULL, *group;
 135 struct Keyword *keyword, *defaultkeyword=NULL, *keywords=NULL;
 136
 137 #define FREE_CLASS      3
 138 #define OVERLIMIT_CLASS 4
 139
 140 void help(void);
 141 /* implemented in help.c */
 142
 143 void get_traffic_statistics(const char *whichiptables, int ipv6);
 144 /* implemented in parseiptables.c */
 145
 146 void parse_ip_log(int argc, char **argv);
 147 /* implemented in parselog.c */
 148
 149 void parse_hosts(char *hosts);
 150 /* implemented in parsehosts.c */
 151
 152 void write_json_traffic(char *json);
 153 /* implemented in json.c */
 154
 155 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 156 /* implemented in htmlandlogs.c */
 157
 158 void analyse_topology(char *traceroute);
 159 /* implemented in networks.c */
 160
 161
 162 const char *tr_odd_even(void)
 163 {
 164  row_odd_even = 1 - row_odd_even;
 165  if(row_odd_even)
 166  {
 167   return "<tr class=\"even\">\n";
 168  }
 169  else
 170  {
 171   return "<tr class=\"odd\">\n";
 172  }
 173 }
 174
 175 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 176 /* (except that this code uses obsolete, archaic version of this header file...)     */
 177
 178 struct Index
 179 {
 180  char *addr;
 181  char *id;
 182  struct Index *parent;
 183  int bitmask;
 184  int children;
 185  int ipv6;
 186  list(Index);
 187 } *idxs=NULL, *idx, *metaindex;
 188
 189
 190 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 191
 192 char *index_id(char *ip, int bitmask);
 193 /* function implemented in ipv4subnets.c */
 194
 195 char *subnet_id(char *ip, int bitmask);
 196 /* function implemented in ipv4subnets.c */
 197
 198 char *index6_id(char *ip, int bitmask);
 199 /* function implemented in ipv6subnets.c */
 200
 201 char *subnet6_id(char *ip, int bitmask);
 202 /* function implemented in ipv6subnets.c */
 203
 204 /* ================= Let's parse configuration file here ================ */
 205
 206 void reject_config_and_exit(char *filename)
 207 {
 208  printf("Configuration file %s rejected - abnormal exit.",filename);
 209  exit(-1);
 210 }
 211
 212 void get_config(char *config_filename)
 213 {
 214  char *cnf="mark";
 215
 216  printf("Configured keywords: ");
 217  parse(config_filename)
 218  {
 219   option("keyword",kwd);
 220   if(kwd)
 221   {
 222    printf("%s ",kwd);
 223
 224    create(keyword,Keyword);
 225    keyword->key = kwd;
 226    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 227    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 228    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 229    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 230    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 231    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 232    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 233    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 234    keyword->default_prio = highest_priority+1;
 235    keyword->html_color = "000000";
 236    keyword->ip_count = 0;
 237    keyword->leaf_discipline = "";
 238    keyword->allowed_avgmtu = 0;
 239
 240    push(keyword,keywords);
 241    if(!defaultkeyword)
 242    {
 243     defaultkeyword = keyword;
 244    }
 245    keywordcount++;
 246
 247    kwd=NULL;
 248   }
 249   else
 250   {
 251     for_each(keyword,keywords)
 252     {
 253      int l=strlen(keyword->key);
 254
 255      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 256      {
 257       char *tmptr=_; /*  <---- l+1 ----> */
 258       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 259       ioption("asymetry-ratio", keyword->asymetry_ratio);
 260       ioption("asymetry-treshold", keyword->asymetry_fixed);
 261       ioption("magic-relative-limit", keyword->data_limit);
 262       ioption("magic-relative-prio", keyword->data_prio);
 263       loption("magic-fixed-limit", keyword->fixed_limit);
 264       loption("magic-fixed-prio", keyword->fixed_prio);
 265       ioption("htb-default-prio", keyword->default_prio);
 266       ioption("htb-rate-bonus", keyword->reserve_min);
 267       ioption("htb-ceil-malus", keyword->reserve_max);
 268       option("leaf-discipline", keyword->leaf_discipline);
 269       option("html-color", keyword->html_color);
 270       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 271       _=tmptr;
 272
 273       if(keyword->data_limit || keyword->fixed_limit ||
 274          keyword->data_prio || keyword->fixed_prio)
 275       {
 276        use_credit=1;
 277       }
 278      }
 279     }
 280   }
 281
 282   option("tc",tc);
 283   option("iptables",iptables);
 284   option("iptables-save",iptablessave);
 285   option("iptables-restore",iptablesrestore);
 286   option("ip6tables",ip6tables);
 287   option("ip6tables-save",ip6tablessave);
 288   option("ip6tables-restore",ip6tablesrestore);
 289   option("iptables-in-filename",iptablesfile);
 290   option("ip6tables-in-filename",ip6tablesfile);
 291   option("hosts",hosts);
 292   option("lan-interface",lan);
 293   option("wan-interface",wan);
 294   option("ip6-prefix",ip6prefix);
 295   option("lan-medium",lan_medium);
 296   option("wan-medium",wan_medium);
 297   lloption("wan-download",line);
 298   lloption("wan-upload",up);
 299   ioption("hall-of-fame-enable",hall_of_fame);
 300   option("hall-of-fame-title",title);
 301   option("hall-of-fame-filename",html);
 302   option("json-filename",json_traffic);
 303   option("hall-of-fame-preview",preview);
 304   option("json-preview",json_preview);
 305   option("log-filename",cmdlog);
 306   option("credit-filename",credit);
 307   option("classmap-filename",classmap);
 308   ioption("credit-enable",enable_credit);
 309   option("log-traffic-directory",log_dir);
 310   option("log-traffic-html-directory",html_log_dir);
 311   option("log-traffic-url-path",log_url);
 312   option("jquery-url",jquery_url);
 313   option("lms-url",lms_url);
 314   ioption("use-jquery-popups",use_jquery_popups);
 315   option("qos-free-zone",qos_free_zone);
 316   ioption("qos-free-delay",qos_free_delay);
 317 /*  ioption("qos-proxy-enable",qos_proxy); */
 318 /*  option("qos-proxy-ip",proxy_ip);*/
 319   option("htb-leaf-discipline",qos_leaf);
 320 /*  ioption("qos-proxy-port",proxy_port); */
 321   ioption("free-rate",free_min);
 322   ioption("free-ceil",free_max);
 323   ioption("overlimit-rate",overlimit_min);
 324   ioption("overlimit-ceil",overlimit_max);
 325   ioption("htb-burst",burst);
 326   ioption("htb-burst-main",burst_main);
 327   ioption("htb-burst-group",burst_group);
 328   ioption("htb-nesting-limit",max_nesting);
 329   ioption("htb-r2q",htb_r2q);
 330   ioption("magic-include-upload",include_upload);
 331   ioption("magic-treshold",magic_treshold);
 332   option("filter-type", cnf);
 333 /* not yet implemented:
 334   ioption("magic-fixed-packets",fixed_packets);
 335   ioption("magic-relative-packets",packet_limit);
 336 */
 337  }
 338  fail
 339  {
 340   perror(config_filename);
 341   puts("Warning - using built-in defaults instead ...");
 342  }
 343  done; /* ugly macro end */
 344  printf("\n");
 345
 346  /* leaf discipline for keywords */
 347  for_each(keyword,keywords)
 348  {
 349   if(!strcmpi(keyword->leaf_discipline, ""))
 350   {
 351    keyword->leaf_discipline = qos_leaf;
 352   }
 353  }
 354
 355  if(strcmpi(cnf, "mark"))
 356  {
 357   filter_type = 2;
 358   mark = "CLASSIFY";
 359   mark_iptables = "CLASSIFY --set-class 1:";
 360  }
 361  else
 362  {
 363   filter_type = 1;
 364   mark = "MARK";
 365   mark_iptables = "MARK --set-mark ";
 366  }
 367
 368  /* are supplied values meaningful ?*/
 369  if(line<=0 || up<=0)
 370  {
 371   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 372   reject_config_and_exit(config_filename);
 373  }
 374 }
 375
 376
 377 /* ========== This function executes, logs OR ALSO prints command ========== */
 378
 379 void safe_run(char *cmd)
 380 {
 381  if(dry_run)
 382  {
 383   printf("\n=>%s\n",cmd);
 384  }
 385  else
 386  {
 387   system(cmd);
 388  }
 389  if(log_file)
 390  {
 391   fprintf(log_file,"%s\n",cmd);
 392  }
 393 }
 394
 395 void iptables_save_line(char *line, int ipv6)
 396 {
 397  if(ipv6)
 398  {
 399   fprintf(ip6tables_file,"%s\n",line);
 400  }
 401  else
 402  {
 403   fprintf(iptables_file,"%s\n",line);
 404  }
 405 }
 406
 407 void run_iptables_restore(void)
 408 {
 409  char *restor;
 410  string(restor,STRLEN);
 411
 412  /*-----------------------------------------------------------------*/
 413  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 414  /*-----------------------------------------------------------------*/
 415
 416  iptables_save_line("COMMIT", FALSE);
 417  fclose(iptables_file);
 418  if(dry_run)
 419  {
 420   parse(iptablesfile)
 421   {
 422    printf("%s\n",_);
 423   }
 424   done; /* ugly macro end */
 425  }
 426
 427  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 428  safe_run(restor);
 429
 430  if(ip6prefix)
 431  {
 432   /*-----------------------------------------------------------------*/
 433   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 434   /*-----------------------------------------------------------------*/
 435   iptables_save_line("COMMIT", TRUE);
 436   fclose(ip6tables_file);
 437   if(dry_run)
 438   {
 439    parse(ip6tablesfile)
 440    {
 441     printf("%s\n",_);
 442    }
 443    done; /* ugly macro end */
 444   }
 445   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 446   safe_run(restor);
 447  }
 448  free(restor);
 449 }
 450
 451 char *parse_datafile_line(char *str)
 452 {
 453  char *ptr=strchr(str,' ');
 454
 455  if(ptr)
 456  {
 457   *ptr=0;
 458   ptr++;
 459   return ptr;
 460  }
 461  else
 462  {
 463   return NULL;
 464  }
 465 }
 466
 467
 468 /*-----------------------------------------------------------------*/
 469 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 470 /*-----------------------------------------------------------------*/
 471
 472 program
 473 {
 474  int i=0;                    /* just plain old Fortran style integer :-) */
 475  FILE *f=NULL;               /* everything is just stream of bytes... */
 476  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 477  char *substring, *limit_pkts;
 478
 479  int parent        = 1;
 480  int just_networks = FALSE;
 481  int just_flush    = FALSE;       /* deactivates all previous actions */
 482  int nodelay       = FALSE;
 483  int just_preview  = FALSE;       /* preview - generate just stats */
 484  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 485  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 486  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 487  int just_logs     = FALSE;       /* just parse logs */
 488  int run           = FALSE;
 489  int total         = 0;
 490
 491  char *chain_forward, *chain_postrouting;
 492  char *althosts=NULL;
 493
 494  printf("\n\
 495 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 496 Version %s - Copyright (C)2005-2013 Michael Polak, Arachne Labs\n\
 497 iptables-restore & burst tunning & classify modification by Ludva\n\
 498 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 499
 500  /*----- Boring... we have to check command line options first: ----*/
 501  arguments
 502  {
 503   argument("-c") { nextargument(config); }
 504   argument("-h") { nextargument(althosts);}
 505   argument("-d") { run=TRUE; dry_run=TRUE; }
 506   argument("-f") { run=TRUE; just_flush=TRUE; }
 507   argument("-9") { run=TRUE; just_flush=9; }
 508   argument("-p") { run=TRUE; just_preview=TRUE; }
 509   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 510   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 511   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 512   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 513   argument("-r") { run=TRUE; }
 514   argument("-n") { run=TRUE; nodelay=TRUE; }
 515   argument("-a") { run=TRUE; just_networks=TRUE; }
 516   argument("-l") { just_logs=TRUE; }
 517   argument("-m") { just_logs=TRUE; }
 518   argument("-y") { just_logs=TRUE; }
 519   argument("-?") { help(); exit(0); }
 520   argument("--help") { help(); exit(0); }
 521   argument("-v") { exit(0); }
 522   argument("--version") { exit(0); }
 523  }
 524
 525  if(dry_run)
 526  {
 527   puts("*** THIS IS JUST DRY RUN ! ***\n");
 528  }
 529
 530  date(d); /* this is typical cll1.h macro - prints current date */
 531
 532  /*-----------------------------------------------------------------*/
 533  printf("Parsing configuration file %s ...\n", config);
 534  /*-----------------------------------------------------------------*/
 535  get_config(config);
 536
 537  if(just_logs)
 538  {
 539   parse_ip_log(argc,argv);
 540   exit(0);
 541  }
 542  else if(not run)
 543  {
 544   help();
 545   exit(0);
 546  }
 547
 548  if(althosts)
 549  {
 550   hosts = althosts;
 551  }
 552
 553  if(just_flush<9)
 554  {
 555   /*-----------------------------------------------------------------*/
 556   puts("Parsing iptables verbose output ...");
 557   /*-----------------------------------------------------------------*/
 558   get_traffic_statistics(iptables, FALSE);
 559   if(ip6prefix)
 560   {
 561    /*-----------------------------------------------------------------*/
 562    puts("Parsing ip6tables verbose output ...");
 563    /*-----------------------------------------------------------------*/
 564    get_traffic_statistics(ip6tables, TRUE);
 565   }
 566  }
 567
 568  /*-----------------------------------------------------------------*/
 569  /* cll1.h - let's allocate brand new character buffer...           */
 570  /*-----------------------------------------------------------------*/
 571  string(str, STRLEN);
 572  string(limit_pkts, STRLEN);
 573
 574  /*-----------------------------------------------------------------*/
 575  printf("Parsing class defintion file %s ...\n", hosts);
 576  /*-----------------------------------------------------------------*/
 577  parse_hosts(hosts);
 578  if(just_networks)
 579  {
 580   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 581   exit(-1);
 582  }
 583
 584  /*-----------------------------------------------------------------*/
 585  puts("Resolving shared connections ...");
 586  /*-----------------------------------------------------------------*/
 587  for_each(ip, ips) if(ip->sharing)
 588  {
 589   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 590   {
 591    sharedip->traffic += ip->traffic;
 592    ip->traffic = 0;
 593    ip->mark = sharedip->mark;
 594    ip->lmsid = sharedip->lmsid;
 595    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 596    break;
 597   }
 598   if(not sharedip)
 599   {
 600    printf("Unresolved shared connection: %s %s sharing-%s\n",
 601           ip->addr, ip->name, ip->sharing);
 602   }
 603  }
 604
 605  if(enable_credit && just_flush<9)
 606  {
 607   /*-----------------------------------------------------------------*/
 608   printf("Parsing credit file %s ...\n", credit);
 609   /*-----------------------------------------------------------------*/
 610   parse(credit)
 611   {
 612    ptr=parse_datafile_line(_);
 613    if(ptr)
 614    {
 615     if_exists(ip,ips,eq(ip->addr,_))
 616     {
 617      sscanf(ptr,"%Lu",&(ip->credit));
 618     }
 619    }
 620   }
 621   done; /* ugly macro end */
 622  }
 623
 624  if(!just_preview)
 625  {
 626   /*-----------------------------------------------------------------*/
 627   puts("Initializing iptables and tc classes ...");
 628   /*-----------------------------------------------------------------*/
 629
 630   iptables_file = fopen(iptablesfile, "w");
 631   if(iptables_file == NULL)
 632   {
 633     perror(iptablesfile);
 634     exit(-1);
 635   }
 636   iptables_save_line(iptablespreamble, FALSE);
 637
 638   if(ip6prefix)
 639   {
 640    ip6tables_file = fopen(ip6tablesfile, "w");
 641    if(ip6tables_file == NULL)
 642    {
 643      perror(ip6tablesfile);
 644      exit(-1);
 645    }
 646    iptables_save_line(iptablespreamble, TRUE);
 647    iptables_save_line(ip6preamble, TRUE);
 648   }
 649
 650   run_iptables_restore();
 651
 652   log_file = fopen(cmdlog, "w");
 653   if(log_file == NULL)
 654   {
 655     perror(cmdlog);
 656     exit(-1);
 657   }
 658
 659   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 660   safe_run(str);
 661
 662   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 663   safe_run(str);
 664
 665   iptables_file=fopen(iptablesfile,"w");
 666   iptables_save_line(iptablespreamble, FALSE);
 667   if(ip6prefix)
 668   {
 669    ip6tables_file=fopen(ip6tablesfile,"w");
 670    iptables_save_line(iptablespreamble, TRUE);
 671    iptables_save_line(ip6preamble, TRUE);
 672   }
 673
 674   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 675   {
 676    char *chain;
 677
 678    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 679    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 680
 681 /*
 682    if(qos_proxy)
 683    {
 684     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 685     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 686     iptables_save_line(str , FALSE);
 687     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 688     iptables_save_line(str, FALSE);
 689     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 690     iptables_save_line(str, FALSE);
 691
 692     chain="post_noproxy";
 693    }
 694
 695    else
 696    {
 697 */
 698    chain = "POSTROUTING";
 699 //   }
 700
 701    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 702    iptables_save_line(str, FALSE);
 703   }
 704
 705   if(ip_count > idxtable_treshold1 && !just_flush)
 706   {
 707    int idxcount=0, bitmask=32-idxtable_bitmask1;
 708    char *subnet, *buf;
 709    /*-----------------------------------------------------------------*/
 710    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 711    /*-----------------------------------------------------------------*/
 712
 713    iptables_save_line(":post_common - [0:0]", FALSE);
 714    iptables_save_line(":forw_common - [0:0]", FALSE);
 715    if(ip6prefix)
 716    {
 717     iptables_save_line(":post_common - [0:0]", TRUE);
 718     iptables_save_line(":forw_common - [0:0]", TRUE);
 719    }
 720
 721    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 722    {
 723     if(ip->v6)
 724     {
 725      buf=index6_id(ip->addr,bitmask+32);
 726     }
 727     else
 728     {
 729      buf=index_id(ip->addr, bitmask);
 730     }
 731
 732     if_exists(idx,idxs,eq(idx->id,buf))
 733     {
 734      idx->children++;
 735     }
 736     else
 737     {
 738      create(idx,Index);
 739      idx->addr = ip->addr;
 740      idx->id = buf;
 741      idx->bitmask = bitmask+32*ip->v6;
 742      idx->parent = NULL;
 743      idx->children = 0;
 744      idx->ipv6 = ip->v6;
 745      idxcount++;
 746      push(idx,idxs);
 747     }
 748    }
 749
 750    /* brutal perfomance optimalization */
 751    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 752    {
 753     bitmask -= idxtable_bitmask2;
 754     idxcount = 0;
 755
 756     for_each(idx,idxs) if(idx->parent == NULL)
 757     {
 758      if(idx->ipv6)
 759      {
 760       buf = index6_id(idx->addr, bitmask+32);
 761      }
 762      else
 763      {
 764       buf = index_id(idx->addr, bitmask);
 765      }
 766      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 767      {
 768       metaindex->children++;
 769      }
 770      else
 771      {
 772       create(metaindex,Index);
 773       metaindex->addr = idx->addr;
 774       metaindex->id = buf;
 775       metaindex->bitmask = bitmask+32*idx->ipv6;
 776       metaindex->parent = NULL;
 777       metaindex->children = 0;
 778       metaindex->ipv6 = idx->ipv6;
 779       idxcount++;
 780       push(metaindex,idxs);
 781      }
 782      idx->parent=metaindex;
 783     }
 784    }
 785
 786    /* this should slightly optimize throughput ... */
 787    sort(idx,idxs,desc_order_by,children);
 788    sort(idx,idxs,order_by,bitmask);
 789
 790    i=0;
 791    for_each(idx,idxs)
 792    {
 793     if(idx->ipv6)
 794     {
 795      subnet=subnet6_id(idx->addr, idx->bitmask);
 796     }
 797     else
 798     {
 799      subnet=subnet_id(idx->addr, idx->bitmask);
 800     }
 801     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 802
 803     sprintf(str,":post_%s - [0:0]", idx->id);
 804     iptables_save_line(str, idx->ipv6);
 805
 806     sprintf(str,":forw_%s - [0:0]", idx->id);
 807     iptables_save_line(str, idx->ipv6);
 808
 809     if(idx->parent)
 810     {
 811      string(buf,strlen(idx->parent->id)+6);
 812      sprintf(buf,"post_%s", idx->parent->id);
 813     }
 814     else
 815     {
 816      buf="POSTROUTING";
 817     }
 818
 819     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 820     iptables_save_line(str, idx->ipv6);
 821
 822     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 823     iptables_save_line(str, idx->ipv6);
 824
 825     if(idx->parent)
 826     {
 827      string(buf,strlen(idx->parent->id)+6);
 828      sprintf(buf,"forw_%s",idx->parent->id);
 829     }
 830     else
 831     {
 832      buf="FORWARD";
 833     }
 834
 835     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 836     iptables_save_line(str, idx->ipv6);
 837
 838     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 839     iptables_save_line(str, idx->ipv6);
 840    }
 841    printf("Total indexed iptables chains created: %d\n", i);
 842
 843    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 844    iptables_save_line(str, FALSE);
 845
 846    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 847    iptables_save_line(str, FALSE);
 848
 849    if(ip6prefix)
 850    {
 851     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 852     iptables_save_line(str, TRUE);
 853
 854     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 855     iptables_save_line(str, TRUE);
 856    }
 857   }
 858  }
 859
 860  if(just_flush)
 861  {
 862   fclose(iptables_file);
 863   if(log_file)
 864   {
 865    fclose(log_file);
 866   }
 867   puts("Just flushed iptables and tc classes - now exiting ...");
 868   exit(0);
 869  }
 870
 871  if(!just_preview)
 872  {
 873   if(!dry_run && !nodelay && qos_free_delay)
 874   {
 875    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 876    sleep(qos_free_delay);
 877   }
 878
 879   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 880               tc,lan,htb_r2q);
 881   safe_run(str);
 882
 883   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 884                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 885   safe_run(str);
 886
 887   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 888                 tc,lan,line,line,burst_main,highest_priority);
 889   safe_run(str);
 890
 891   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 892   safe_run(str);
 893
 894   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 895                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 896   safe_run(str);
 897
 898   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 899                tc,wan,up,up,burst_main,highest_priority);
 900   safe_run(str);
 901  }
 902
 903  /*-----------------------------------------------------------------*/
 904  puts("Locating heavy downloaders and generating root classes ...");
 905  /*-----------------------------------------------------------------*/
 906  sort(ip,ips,desc_order_by,traffic);
 907
 908  /*-----------------------------------------------------------------*/
 909  /* sub-scope - local variables */
 910  {
 911   long long int rate = line;
 912   long long int max = line;
 913   int group_count = 0;
 914   FILE *credit_file = NULL;
 915
 916   if(!just_preview && !dry_run && enable_credit)
 917   {
 918    credit_file = fopen(credit,"w");
 919   }
 920
 921   for_each(group,groups)
 922   {
 923    if(!just_preview)
 924    {
 925     //download
 926     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 927                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 928     safe_run(str);
 929
 930     //upload
 931     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 932                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 933     safe_run(str);
 934    }
 935
 936    if(group_count++ < max_nesting)
 937    {
 938     parent = group->id;
 939    }
 940
 941    rate -= digital_divide*group->min;
 942    if(rate < group->min)
 943    {
 944     rate = group->min;
 945    }
 946
 947    /*shaping of aggresive downloaders, with credit file support */
 948    if(use_credit)
 949    {
 950     int group_rate = group->min, priority_sequence = lowest_priority;
 951
 952     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 953     {
 954      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 955      if(     ip->keyword->data_limit
 956          and not ip->fixedprio
 957          and ip->traffic > ip->realquota )
 958      {
 959       if(group_rate < ip->max)
 960       {
 961        ip->max = group_rate;
 962       }
 963       group_rate+=magic_treshold;
 964       ip->prio=lowest_priority;
 965       if(ip->prio<highest_priority+2)
 966       {
 967        ip->prio=highest_priority+2;
 968       }
 969      }
 970      else
 971      {
 972       if(    ip->keyword->data_prio
 973           && !ip->fixedprio
 974           && (   ip->traffic>ip->credit
 975                + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
 976       {
 977        ip->prio=priority_sequence--;
 978        if(ip->prio<highest_priority+1)
 979        {
 980         ip->prio=highest_priority+1;
 981        }
 982       }
 983
 984       if(credit_file)
 985       {
 986        unsigned long long lcredit=0;
 987
 988        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
 989        {
 990         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
 991        }
 992        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
 993       }
 994      }
 995     }
 996    }
 997   }
 998   if(credit_file)
 999   {
1000    fclose(credit_file);
1001   }
1002  }
1003
1004  if(just_preview)
1005  {
1006   if(start_shaping || stop_shaping || reduce_ceil)
1007   {
1008    printf("Reading %s and applying Fair Use Policy rules ... \n", classmap);
1009    parse(classmap)
1010    {
1011     ptr=strchr(_,' ');
1012     if(ptr)
1013     {
1014      *ptr=0;
1015      ptr++;
1016      if_exists(ip,ips,eq(ip->addr,_))
1017      {
1018       ip->mark=atoi(ptr);
1019       if(ip->max < ip->desired || stop_shaping || reduce_ceil) /* apply or disable FUP limit immediately.... */
1020       {
1021        if(stop_shaping)
1022        {
1023         ip->max = ip->desired;
1024         printf("Removing limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1025        }
1026        else
1027        {
1028         printf("Applying limit for %-22s %-16s %04d ", ip->name, ip->addr, ip->mark);
1029         if(reduce_ceil)
1030         {
1031          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1032         }
1033        }
1034        printf("(down: %dk-%dk ", ip->min, ip->max);
1035        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1036                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1037        safe_run(str);
1038        printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1039                                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1040        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1041                     tc, wan, ip->group, ip->mark,
1042                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1043                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1044        safe_run(str);
1045       }
1046      }
1047     }
1048    }
1049    fail
1050    {
1051     perror(classmap);
1052     puts("Warning - classmap file not fund, just generating preview ...");
1053     start_shaping=FALSE;
1054     stop_shaping=FALSE;
1055    }
1056    done; /* ugly macro end */
1057   }
1058   html=preview;
1059   json_traffic=json_preview;
1060  }
1061
1062  if(!dry_run && !just_flush)
1063  {
1064   /*-----------------------------------------------------------------*/
1065   printf("Writing json traffic overview  %s ... ", json_traffic);
1066   /*-----------------------------------------------------------------*/
1067   write_json_traffic(json_traffic);
1068
1069   /*-----------------------------------------------------------------*/
1070   printf("Writing statistics into HTML page %s ...\n", html);
1071   /*-----------------------------------------------------------------*/
1072   write_htmlandlogs(html, d, total, just_preview);
1073  }
1074
1075  if(just_preview)
1076  {
1077   char swchar='p';
1078   if(start_shaping)
1079   {
1080    swchar='s';
1081   }
1082   else if(reduce_ceil)
1083   {
1084    swchar='0'+reduce_ceil; /* -2, -4 */
1085   }
1086   else if(stop_shaping)
1087   {
1088    swchar='q';
1089   }
1090
1091   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1092   exit(0);
1093  }
1094
1095  i=0;
1096 #ifdef DEBUG
1097  printf("%-22s %-15s mark\n","name","ip");
1098 #endif
1099
1100  printf("Writing %s", classmap);
1101  f = fopen(classmap, "w");
1102  if(f < 0)
1103  {
1104   perror(classmap);
1105  }
1106
1107  /*-----------------------------------------------------------------*/
1108  printf(" + generating iptables and tc classes ... ");
1109  /*-----------------------------------------------------------------*/
1110
1111  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1112  {
1113   if(idxs)
1114   {
1115    char *buf;
1116    duplicate(ip->addr,buf);
1117    if(ip->v6)
1118    {
1119     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1120    }
1121    else
1122    {
1123     buf=index_id(ip->addr,32-idxtable_bitmask1);
1124    }
1125
1126    string(chain_forward,6+strlen(buf));
1127    strcpy(chain_forward,"forw_");
1128    strcat(chain_forward,buf);
1129
1130    string(chain_postrouting,6+strlen(buf));
1131    strcpy(chain_postrouting,"post_");
1132    strcat(chain_postrouting,buf);
1133
1134    free(buf);
1135   }
1136   else
1137   {
1138    chain_forward="FORWARD";
1139    chain_postrouting="POSTROUTING";
1140   }
1141
1142   /* packet limits - this will be optional in future */
1143   if(ip->pps_limit)
1144   {
1145    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1146                        ip->pps_limit, ip->pps_limit);
1147   }
1148   else
1149   {
1150    *limit_pkts = 0;
1151   }
1152
1153 #ifdef DEBUG
1154   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1155 #endif
1156
1157   /* -------------------------------------------------------- mark download */
1158   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1159                chain_postrouting, ip->addr, 32*(1+ip->v6),
1160                lan, mark_iptables, ip->mark);
1161   iptables_save_line(str, ip->v6);
1162
1163 /*
1164   if(qos_proxy)
1165   {
1166    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1167                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1168                 32*(1+ip->v6), lan, mark_iptables, ip->mark);
1169    iptables_save_line(str, ip->v6);
1170   }
1171 */
1172   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1173                chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);
1174   iptables_save_line(str, ip->v6);
1175
1176   /* classify overlimit packets to separate overlimit class */
1177   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1178                chain_postrouting, ip->addr, 32*(1+ip->v6),
1179                lan, mark_iptables, OVERLIMIT_CLASS);
1180   iptables_save_line(str, ip->v6);
1181
1182   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1183                chain_postrouting, ip->addr, 32*(1+ip->v6), lan);
1184   iptables_save_line(str, ip->v6);
1185
1186   /* -------------------------------------------------------- mark upload */
1187   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1188                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);
1189   iptables_save_line(str, ip->v6);
1190
1191   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1192                chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);
1193   iptables_save_line(str, ip->v6);
1194
1195   /* classify overlimit packets to separate overlimit class */
1196   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1197                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, OVERLIMIT_CLASS);
1198   iptables_save_line(str, ip->v6);
1199
1200   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1201                chain_forward, ip->addr, 32*(1+ip->v6), wan);
1202   iptables_save_line(str, ip->v6);
1203
1204   if(ip->min)
1205   {
1206    /* -------------------------------------------------------- download class */
1207 #ifdef DEBUG
1208    printf("(down: %dk-%dk ", ip->min, ip->max);
1209 #endif
1210
1211    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1212                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1213    safe_run(str);
1214
1215    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1216    {
1217     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1218                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1219     safe_run(str);
1220    }
1221
1222    if(filter_type == 1)
1223    {
1224     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1225                  tc, lan, ip->mark, ip->mark);
1226     safe_run(str);
1227    }
1228
1229    /* -------------------------------------------------------- upload class */
1230 #ifdef DEBUG
1231    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1232                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1233 #endif
1234
1235    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1236                 tc, wan, ip->group, ip->mark,
1237                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1238                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1239    safe_run(str);
1240
1241    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1242    {
1243     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1244                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1245     safe_run(str);
1246    }
1247
1248    if(filter_type == 1)
1249    {
1250     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1251                  tc, wan, ip->mark, ip->mark);
1252     safe_run(str);
1253    }
1254
1255    if(f > 0)
1256    {
1257     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1258    }
1259   }
1260   else
1261   {
1262 #ifdef DEBUG
1263    printf("(sharing %s)\n", ip->sharing);
1264 #endif
1265   }
1266   i++;
1267  }
1268  if(f > 0)
1269  {
1270   puts("done.");
1271   fclose(f);
1272  }
1273
1274  if(idxs)
1275  {
1276   chain_forward = "forw_common";
1277   chain_postrouting = "post_common";
1278  }
1279  else
1280  {
1281   chain_forward = "FORWARD";
1282   chain_postrouting = "POSTROUTING";
1283  }
1284
1285  if(free_min)
1286  {
1287   final_chain = "ACCEPT";
1288  }
1289
1290 /*
1291  if(qos_proxy)
1292  {
1293   if(free_min)
1294   {
1295    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1296                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1297    iptables_save_line(str, FALSE); // only for IPv4
1298   }
1299   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1300                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1301   iptables_save_line(str, FALSE); // only for IPv4
1302  }
1303 */
1304
1305  if(free_min)
1306  {
1307   sprintf(str, "-A %s -o %s -j %s%d",
1308                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1309   iptables_save_line(str, FALSE); /* only for IPv4 */
1310  }
1311
1312  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1313  iptables_save_line(str, FALSE);
1314  if(ip6prefix)
1315  {
1316   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1317   iptables_save_line(str, TRUE);
1318  }
1319
1320  if(free_min)
1321  {
1322   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1323   iptables_save_line(str, FALSE); /* only for IPv4 */
1324  }
1325
1326  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1327  iptables_save_line(str, FALSE);
1328  if(ip6prefix)
1329  {
1330   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1331   iptables_save_line(str, TRUE);
1332  }
1333
1334  if(free_min) /* allocate free bandwith if it is not zero... */
1335  {
1336    /*-----------------------------------------------------------------*/
1337    puts("Generating free bandwith class ...");
1338    /*-----------------------------------------------------------------*/
1339    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1340                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1341    safe_run(str);
1342    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1343                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1344    safe_run(str);
1345    /* tc SFQ */
1346    if(strcmpi(qos_leaf, "none"))
1347    {
1348      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1349      safe_run(str);
1350
1351      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1352      safe_run(str);
1353    }
1354    /* tc handle 1 fw flowid */
1355    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1356    safe_run(str);
1357
1358    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1359    safe_run(str);
1360
1361    /*-----------------------------------------------------------------*/
1362    puts("Generating bandwith class for overlimit packets...");
1363    /*-----------------------------------------------------------------*/
1364    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1365                 tc, lan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1366    safe_run(str);
1367    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1368                 tc, wan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1369    safe_run(str);
1370  }
1371  printf("Total IP count: %d\n", i);
1372  run_iptables_restore();
1373  if(log_file)
1374  {
1375   fclose(log_file);
1376  }
1377  return 0;
1378  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1379  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1380 }