prometheus.c

   1 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   2 /* Prometheus QoS - you can "steal fire" from your ISP         */
   3 /* "fair-per-IP" quality of service (QoS) utility              */
   4 /* requires Linux 2.4.x or 2.6.x with HTB support              */
   5 /* Copyright(C) 2005-2015 Michael Polak, Arachne Aerospace     */
   6 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
   7 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
   8 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
   9
  10 /* Modified by: xChaos, 20150315
  11                  ludva, 20080415
  12
  13    Prometheus QoS is free software; you can redistribute it and/or
  14    modify it under the terms of the GNU General Public License as
  15    published by the Free Software Foundation; either version 2.1 of
  16    the License, or (at your option) any later version.
  17
  18    Prometheus QoS is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21    General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with Prometheus Qos; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  26
  27    GNU General Public License is located in file COPYING */
  28
  29 #include "cll1-0.6.2.h"
  30 #include "ipstruct.h"
  31
  32 const char *version = "0.8.5-c";
  33
  34 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  35 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */
  36 /* Official Trac URL: https://dev.arachne.cz/svn/prometheus        */
  37 /* Official SVN URL: https://dev.arachne.cz/repos/prometheus       */
  38 /* BTC donations account: 19rriLx8vR19wGefPaMhakqnCYNYwjLvxq       */
  39 /* CZK donations account: 2900242944/2010 (transparent account)    */
  40 /* Warning: unofficial Github mirror is not supported by author!  */
  41 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
  42
  43 const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2015 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
  44
  45 #define STRLEN 512
  46 #undef DEBUG
  47
  48 /* ======= All path names are defined here (for RPM patch) =======  */
  49
  50 const char               *tc = "/sbin/tc"; /* requires tc with HTB support */
  51 const char         *iptables = "/sbin/iptables"; /* requires iptables utility */
  52 const char        *ip6tables = "/sbin/ip6tables"; /* requires iptables utility */
  53 const char     *iptablessave = "/sbin/iptables-save"; /* not yet required */
  54 const char  *iptablesrestore = "/sbin/iptables-restore";  /* requires iptables-restore */
  55 const char    *ip6tablessave = "/sbin/ip6tables-save"; /* not yet required */
  56 const char *ip6tablesrestore = "/sbin/ip6tables-restore";  /* requires iptables-restore */
  57 const char               *ls = "/bin/ls"; /* this is not user configurable :-) */
  58
  59 char          *config = "/etc/prometheus/prometheus.conf"; /* main configuration file */
  60 char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition file */
  61 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
  62 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
  63 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
  64 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
  65 char        *classmap = "/var/lib/misc/prometheus.classes"; /* credit log file */
  66 char            *html = "/var/www/traffic.html"; /* hall of fame - html version */
  67 char         *preview = "/var/www/preview.html"; /* hall of fame preview - html version */
  68 char    *json_traffic = "/var/www/logs/traffic.json"; /* hall of fame - json version */
  69 char    *json_preview = "/var/www/logs/preview.json"; /* hall of fame preview - json version */
  70 char          *cmdlog = "/var/log/prometheuslog"; /* command log filename */
  71 char         *log_dir = "/var/www/logs/"; /* log directory pathname, ended with slash */
  72 char         *log_url = "/logs/"; /* log directory relative URI prefix (partial URL) */
  73 char    *html_log_dir = "/var/www/logs/html/";
  74
  75 char      *jquery_url = "http://code.jquery.com/jquery-latest.js";
  76 char         *lms_url = "/lms/?m=customerinfo&amp;id=";
  77 int use_jquery_popups = TRUE;
  78 int      row_odd_even = 0; /*<tr class="odd/even"> */
  79
  80 /* === Configuraration file values defaults - stored in global variables ==== */
  81
  82 int        filter_type = 1; /*1 mark, 2 classify*/
  83 char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible in mangle */
  84 char             *mark = "MARK";
  85 char    *mark_iptables = "MARK --set-mark ";
  86 int            dry_run = FALSE; /* preview - use puts() instead of system() */
  87 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
  88 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
  89 FILE    *iptables_file = NULL;
  90 FILE   *ip6tables_file = NULL;
  91 int      enable_credit = TRUE; /* enable credit file */
  92 int         use_credit = FALSE; /* use credit file (if enabled)*/
  93 char            *title = "Hall of Fame - Greatest Suckers"; /* hall of fame title */
  94 int       hall_of_fame = TRUE; /* enable hall of fame */
  95 char              *lan = "eth0"; /* LAN interface */
  96 char       *lan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
  97 char              *wan = "eth1"; /* WAN/ISP interface */
  98 char        *ip6prefix = NULL; /* Prefix for global /48 IPv6 subnet */
  99 char       *wan_medium = "100Mbit"; /* 10Mbit/100Mbit ethernet */
 100 char         *qos_leaf = "sfq perturb 5"; /* leaf discipline */
 101 char    *qos_free_zone = NULL; /* QoS free zone */
 102 /* int          qos_proxy = TRUE; include proxy port to QoS */
 103 int        found_lmsid = FALSE; /* show links to users in LMS information system */
 104 int     include_upload = TRUE; /* upload+download=total traffic */
 105 /* char         *proxy_ip = "192.168.1.1/32";  our IP with proxy port */
 106 /* int         proxy_port = 3128; proxy port number */
 107 long long int     line = 1024; /* WAN/ISP download in kbps */
 108 long long int       up = 1024; /* WAN/ISP upload in kbps */
 109 int           free_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 110 int           free_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 111 int      overlimit_min = 256; /* minimum guaranted bandwidth for all undefined hosts */
 112 int      overlimit_max = 512; /* maximum allowed bandwidth for all undefined hosts */
 113 int     qos_free_delay = 0; /* seconds to sleep before applying new QoS rules */
 114 int     digital_divide = 2; /* controls digital divide weirdness ratio, 1...3 */
 115 int        max_nesting = 5; /* /include/uapi/linux/pkt_sched.h: #define TC_HTB_MAXDEPTH 8 [... - 3 parent classes] */
 116 int            htb_r2q = 256; /* should work for leaf values 512 kbps to 8 Mbps */
 117 int              burst = 8; /* HTB burst (in kbits) */
 118 int         burst_main = 64;
 119 int        burst_group = 32;
 120 int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shaping) */
 121 int       keywordcount = 0;
 122 int        class_count = 0;
 123 int           ip_count = 0;
 124 FILE         *log_file = NULL;
 125 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 126
 127 const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
 128 const int lowest_priority    = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */
 129 const int idxtable_treshold1 = 24;      /* this is no longer configurable */
 130 const int idxtable_treshold2 = 12;      /* this is no longer configurable */
 131 const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
 132 const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
 133
 134 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 135 struct Group *groups = NULL, *group;
 136 struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 137 struct Macro *macro, *macros = NULL;
 138
 139 #define FREE_CLASS      3
 140 #define OVERLIMIT_CLASS 4
 141
 142 void help(void);
 143 /* implemented in help.c */
 144
 145 void get_traffic_statistics(const char *whichiptables, int ipv6);
 146 /* implemented in parseiptables.c */
 147
 148 void parse_ip_log(int argc, char **argv);
 149 /* implemented in parselog.c */
 150
 151 void parse_hosts(char *hosts);
 152 /* implemented in parsehosts.c */
 153
 154 void write_json_traffic(char *json);
 155 /* implemented in json.c */
 156
 157 void write_htmlandlogs(char *html, char *d, int total, int just_preview);
 158 /* implemented in htmlandlogs.c */
 159
 160 void analyse_topology(char *traceroute);
 161 /* implemented in networks.c */
 162
 163 char *parse_datafile_line(char *str);
 164 /* implemented in utils.c */
 165
 166 time_t get_mtime(const char *path);
 167 /* implemented in utils.c */
 168
 169 const char *tr_odd_even(void)
 170 {
 171  row_odd_even = 1 - row_odd_even;
 172  if(row_odd_even)
 173  {
 174   return "<tr class=\"even\">\n";
 175  }
 176  else
 177  {
 178   return "<tr class=\"odd\">\n";
 179  }
 180 }
 181
 182 /* ==== This is C<<1 stuff - learn C<<1 first! https://dev.arachne.cz/svn/cll1h ==== */
 183 /* (except that this code uses obsolete, archaic version of this header file...)     */
 184
 185 struct Index
 186 {
 187  char *addr;
 188  char *id;
 189  struct Index *parent;
 190  int bitmask;
 191  int children;
 192  int ipv6;
 193  list(Index);
 194 } *idxs=NULL, *idx, *metaindex;
 195
 196
 197 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 198
 199 char *index_id(char *ip, int bitmask);
 200 /* function implemented in ipv4subnets.c */
 201
 202 char *subnet_id(char *ip, int bitmask);
 203 /* function implemented in ipv4subnets.c */
 204
 205 char *index6_id(char *ip, int bitmask);
 206 /* function implemented in ipv6subnets.c */
 207
 208 char *subnet6_id(char *ip, int bitmask);
 209 /* function implemented in ipv6subnets.c */
 210
 211 /* ================= Let's parse configuration file here ================ */
 212
 213 void reject_config_and_exit(char *filename)
 214 {
 215  printf("Configuration file %s rejected - abnormal exit.",filename);
 216  exit(-1);
 217 }
 218
 219 void get_config(char *config_filename)
 220 {
 221  char *cnf="mark";
 222
 223  printf("Configured keywords: ");
 224  parse(config_filename)
 225  {
 226   option("keyword",kwd);
 227   if(kwd)
 228   {
 229    printf("%s ",kwd);
 230
 231    create(keyword,Keyword);
 232    keyword->key = kwd;
 233    keyword->asymetry_ratio = 1;          /* ratio for ADSL-like upload */
 234    keyword->asymetry_fixed = 0;          /* fixed treshold for ADSL-like upload */
 235    keyword->data_limit = 8;              /* hard shaping: apply magic_treshold if max*data_limit MB exceeded */
 236    keyword->data_prio = 4;               /* soft shaping (qos): reduce HTB prio if max*data_prio MB exceeded */
 237    keyword->fixed_limit = 0;             /* fixed data limit for setting lower HTB ceil */
 238    keyword->fixed_prio = 0;              /* fixed data limit for setting lower HTB prio */
 239    keyword->reserve_min = 8;             /* bonus for nominal HTB rate bandwidth (in kbps) */
 240    keyword->reserve_max = 0;             /* malus for nominal HTB ceil (in kbps) */
 241    keyword->default_prio = highest_priority+1;
 242    keyword->download_aggregation = keyword->upload_aggregation = 0; /* disable by default */
 243    keyword->html_color = "000000";
 244    keyword->ip_count = 0;
 245    keyword->leaf_discipline = "";
 246    keyword->allowed_avgmtu = 0;
 247    keyword->download_aggregation = keyword->upload_aggregation = 1;
 248
 249    push(keyword, keywords);
 250    if(!defaultkeyword)
 251    {
 252     defaultkeyword = keyword;
 253    }
 254    keywordcount++;
 255
 256    kwd=NULL;
 257   }
 258   else
 259   {
 260     for_each(keyword,keywords)
 261     {
 262      int l=strlen(keyword->key);
 263
 264      if(!strncmp(keyword->key,_,l) && strlen(_)>l+2)
 265      {
 266       char *tmptr=_; /*  <---- l+1 ----> */
 267       _+=l+1;        /*  via-prometheus-asymetry-ratio, etc. */
 268       foption("asymetry-ratio", keyword->asymetry_ratio);
 269       ioption("asymetry-treshold", keyword->asymetry_fixed);
 270       ioption("magic-relative-limit", keyword->data_limit);
 271       ioption("magic-relative-prio", keyword->data_prio);
 272       loption("magic-fixed-limit", keyword->fixed_limit);
 273       loption("magic-fixed-prio", keyword->fixed_prio);
 274       ioption("htb-default-prio", keyword->default_prio);
 275       ioption("htb-rate-bonus", keyword->reserve_min);
 276       ioption("htb-ceil-malus", keyword->reserve_max);
 277       ioption("download-aggregation", keyword->download_aggregation);
 278       ioption("upload-aggregation", keyword->upload_aggregation);
 279       option("leaf-discipline", keyword->leaf_discipline);
 280       option("html-color", keyword->html_color);
 281       ioption("allowed-avgmtu" ,keyword->allowed_avgmtu);
 282       _=tmptr;
 283
 284       if(keyword->data_limit || keyword->fixed_limit ||
 285          keyword->data_prio || keyword->fixed_prio)
 286       {
 287        use_credit=1;
 288       }
 289      }
 290     }
 291   }
 292
 293   option("tc",tc);
 294   option("iptables",iptables);
 295   option("iptables-save",iptablessave);
 296   option("iptables-restore",iptablesrestore);
 297   option("ip6tables",ip6tables);
 298   option("ip6tables-save",ip6tablessave);
 299   option("ip6tables-restore",ip6tablesrestore);
 300   option("iptables-in-filename",iptablesfile);
 301   option("ip6tables-in-filename",ip6tablesfile);
 302   option("hosts",hosts);
 303   option("lan-interface",lan);
 304   option("wan-interface",wan);
 305   option("ip6-prefix",ip6prefix);
 306   option("lan-medium",lan_medium);
 307   option("wan-medium",wan_medium);
 308   lloption("wan-download",line);
 309   lloption("wan-upload",up);
 310   ioption("hall-of-fame-enable",hall_of_fame);
 311   option("hall-of-fame-title",title);
 312   option("hall-of-fame-filename",html);
 313   option("json-filename",json_traffic);
 314   option("hall-of-fame-preview",preview);
 315   option("json-preview",json_preview);
 316   option("log-filename",cmdlog);
 317   option("credit-filename",credit);
 318   option("classmap-filename",classmap);
 319   ioption("credit-enable",enable_credit);
 320   option("log-traffic-directory",log_dir);
 321   option("log-traffic-html-directory",html_log_dir);
 322   option("log-traffic-url-path",log_url);
 323   option("jquery-url",jquery_url);
 324   option("lms-url",lms_url);
 325   ioption("use-jquery-popups",use_jquery_popups);
 326   option("qos-free-zone",qos_free_zone);
 327   ioption("qos-free-delay",qos_free_delay);
 328 /*  ioption("qos-proxy-enable",qos_proxy); */
 329 /*  option("qos-proxy-ip",proxy_ip);*/
 330   option("htb-leaf-discipline",qos_leaf);
 331 /*  ioption("qos-proxy-port",proxy_port); */
 332   ioption("free-rate",free_min);
 333   ioption("free-ceil",free_max);
 334   ioption("overlimit-rate",overlimit_min);
 335   ioption("overlimit-ceil",overlimit_max);
 336   ioption("htb-burst",burst);
 337   ioption("htb-burst-main",burst_main);
 338   ioption("htb-burst-group",burst_group);
 339   ioption("htb-nesting-limit",max_nesting);
 340   ioption("htb-r2q",htb_r2q);
 341   ioption("magic-include-upload",include_upload);
 342   ioption("magic-treshold",magic_treshold);
 343   option("filter-type", cnf);
 344 /* not yet implemented:
 345   ioption("magic-fixed-packets",fixed_packets);
 346   ioption("magic-relative-packets",packet_limit);
 347 */
 348  }
 349  fail
 350  {
 351   perror(config_filename);
 352   puts("Warning - using built-in defaults instead ...");
 353  }
 354  done; /* ugly macro end */
 355  printf("\n");
 356
 357  /* leaf discipline for keywords */
 358  for_each(keyword,keywords)
 359  {
 360   if(!strcmpi(keyword->leaf_discipline, ""))
 361   {
 362    keyword->leaf_discipline = qos_leaf;
 363   }
 364  }
 365
 366  if(strcmpi(cnf, "mark"))
 367  {
 368   filter_type = 2;
 369   mark = "CLASSIFY";
 370   mark_iptables = "CLASSIFY --set-class 1:";
 371  }
 372  else
 373  {
 374   filter_type = 1;
 375   mark = "MARK";
 376   mark_iptables = "MARK --set-mark ";
 377  }
 378
 379  /* are supplied values meaningful ?*/
 380  if(line<=0 || up<=0)
 381  {
 382   puts("Illegal value of LAN or WAN bandwidth: 0 kbps.");
 383   reject_config_and_exit(config_filename);
 384  }
 385 }
 386
 387
 388 /* ========== This function executes, logs OR ALSO prints command ========== */
 389
 390 void safe_run(char *cmd)
 391 {
 392  if(dry_run)
 393  {
 394   printf("\n=>%s\n",cmd);
 395  }
 396  else
 397  {
 398   system(cmd);
 399  }
 400  if(log_file)
 401  {
 402   fprintf(log_file,"%s\n",cmd);
 403  }
 404 }
 405
 406 void iptables_save_line(char *line, int ipv6)
 407 {
 408  if(ipv6)
 409  {
 410   fprintf(ip6tables_file,"%s\n",line);
 411  }
 412  else
 413  {
 414   fprintf(iptables_file,"%s\n",line);
 415  }
 416 }
 417
 418 void run_iptables_restore(void)
 419 {
 420  char *restor;
 421  string(restor,STRLEN);
 422
 423  /*-----------------------------------------------------------------*/
 424  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
 425  /*-----------------------------------------------------------------*/
 426
 427  iptables_save_line("COMMIT", FALSE);
 428  fclose(iptables_file);
 429  if(dry_run)
 430  {
 431   parse(iptablesfile)
 432   {
 433    printf("%s\n",_);
 434   }
 435   done; /* ugly macro end */
 436  }
 437
 438  sprintf(restor,"%s <%s",iptablesrestore, iptablesfile);
 439  safe_run(restor);
 440
 441  if(ip6prefix)
 442  {
 443   /*-----------------------------------------------------------------*/
 444   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
 445   /*-----------------------------------------------------------------*/
 446   iptables_save_line("COMMIT", TRUE);
 447   fclose(ip6tables_file);
 448   if(dry_run)
 449   {
 450    parse(ip6tablesfile)
 451    {
 452     printf("%s\n",_);
 453    }
 454    done; /* ugly macro end */
 455   }
 456   sprintf(restor,"%s <%s",ip6tablesrestore, ip6tablesfile);
 457   safe_run(restor);
 458  }
 459  free(restor);
 460 }
 461
 462 /**/
 463
 464 char *parse_datafile_line(char *str);
 465 time_t get_mtime(const char *path);
 466
 467 /*-----------------------------------------------------------------*/
 468 /* Are you looking for int main(int argc, char **argv) ? :-))      */
 469 /*-----------------------------------------------------------------*/
 470
 471 program
 472 {
 473  int i=0;                    /* just plain old Fortran style integer :-) */
 474  FILE *f=NULL;               /* everything is just stream of bytes... */
 475  char *str, *ptr, *d;        /* LET A$=B$ :-) */
 476  char *substring, *limit_pkts;
 477
 478  int parent        = 1;
 479  int just_networks = FALSE;
 480  int just_flush    = FALSE;       /* deactivates all previous actions */
 481  int nodelay       = FALSE;
 482  int just_preview  = FALSE;       /* preview - generate just stats */
 483  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
 484  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
 485  int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
 486  int just_logs     = FALSE;       /* just parse logs */
 487  int run           = FALSE;
 488  int total         = 0;
 489
 490  char *chain_forward, *chain_postrouting;
 491  char *althosts=NULL;
 492
 493  printf("\n\
 494 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
 495 Version %s - Copyright (C)2005-2015 Michael Polak, Arachne Labs\n\
 496 iptables-restore & burst tunning & classify modification by Ludva\n\
 497 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 498
 499  /*----- Boring... we have to check command line options first: ----*/
 500  arguments
 501  {
 502   argument("-c") { nextargument(config); }
 503   argument("-h") { nextargument(althosts);}
 504   argument("-d") { run=TRUE; dry_run=TRUE; }
 505   argument("-f") { run=TRUE; just_flush=TRUE; }
 506   argument("-9") { run=TRUE; just_flush=9; }
 507   argument("-p") { run=TRUE; just_preview=TRUE; }
 508   argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
 509   argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
 510   argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
 511   argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
 512   argument("-r") { run=TRUE; }
 513   argument("-n") { run=TRUE; nodelay=TRUE; }
 514   argument("-a") { run=TRUE; just_networks=TRUE; }
 515   argument("-l") { just_logs=TRUE; }
 516   argument("-m") { just_logs=TRUE; }
 517   argument("-y") { just_logs=TRUE; }
 518   argument("-?") { help(); exit(0); }
 519   argument("--help") { help(); exit(0); }
 520   argument("-v") { exit(0); }
 521   argument("--version") { exit(0); }
 522  }
 523
 524  if(dry_run)
 525  {
 526   puts("*** THIS IS JUST DRY RUN ! ***\n");
 527  }
 528
 529  date(d); /* this is typical cll1.h macro - prints current date */
 530
 531  /*-----------------------------------------------------------------*/
 532  printf("Parsing configuration file %s ...\n", config);
 533  /*-----------------------------------------------------------------*/
 534  get_config(config);
 535
 536  if(just_logs)
 537  {
 538   parse_ip_log(argc,argv);
 539   exit(0);
 540  }
 541  else if(not run)
 542  {
 543   help();
 544   exit(0);
 545  }
 546
 547  if(althosts)
 548  {
 549   hosts = althosts;
 550  }
 551
 552  if(just_flush<9)
 553  {
 554   /*-----------------------------------------------------------------*/
 555   puts("Parsing iptables verbose output ...");
 556   /*-----------------------------------------------------------------*/
 557   get_traffic_statistics(iptables, FALSE);
 558   if(ip6prefix)
 559   {
 560    /*-----------------------------------------------------------------*/
 561    puts("Parsing ip6tables verbose output ...");
 562    /*-----------------------------------------------------------------*/
 563    get_traffic_statistics(ip6tables, TRUE);
 564   }
 565  }
 566
 567  /*-----------------------------------------------------------------*/
 568  /* cll1.h - let's allocate brand new character buffer...           */
 569  /*-----------------------------------------------------------------*/
 570  string(str, STRLEN);
 571  string(limit_pkts, STRLEN);
 572
 573  /*-----------------------------------------------------------------*/
 574  printf("Parsing macro definition file %s ...\n", macrosfile);
 575  /*-----------------------------------------------------------------*/
 576  parse(macrosfile)
 577  {
 578   ptr = parse_datafile_line(_);
 579   if(ptr)
 580   {
 581    create(macro, Macro);
 582    macro->rewrite_from = _;
 583    macro->rewrite_to = ptr;
 584    push(macro, macros);
 585    printf("%s -> %s\n", macro->rewrite_from, macro->rewrite_to);
 586   }
 587  }
 588  done; /* ugly macro end */
 589
 590  /*-----------------------------------------------------------------*/
 591  printf("Parsing class defintion file %s ...\n", hosts);
 592  /*-----------------------------------------------------------------*/
 593  parse_hosts(hosts);
 594  if(just_networks)
 595  {
 596   analyse_topology("/usr/sbin/traceroute -n -m 10 -w 2 %s.%d");
 597   exit(-1);
 598  }
 599
 600  /*-----------------------------------------------------------------*/
 601  puts("Resolving shared connections ...");
 602  /*-----------------------------------------------------------------*/
 603  for_each(ip, ips) if(ip->sharing)
 604  {
 605   for_each(sharedip, ips) if(eq(sharedip->name, ip->sharing))
 606   {
 607    sharedip->traffic += ip->traffic;
 608    ip->traffic = 0;
 609    ip->mark = sharedip->mark;
 610    ip->lmsid = sharedip->lmsid;
 611    ip->pps_limit = sharedip->pps_limit; /* no other way to do this */
 612
 613    /* Ugly hack: append IPv4 addresses of sharedip to IPv6 uplinks */
 614    ptr = strchr(ip->addr, '+');
 615    if(ptr && ptr-ip->addr > 1 && !sharedip->v6)
 616    {
 617     *(--ptr) = 0;
 618     concatenate(ip->addr, sharedip->addr, ptr);
 619     ip->name = ip->addr = ptr;
 620     ptr = strchr(ip->addr, '.');
 621     while(ptr && *ptr)
 622     {
 623      *ptr = ':';
 624      ptr = strchr(ptr, '.');
 625     }
 626     ip->mask += 64;
 627    }
 628
 629    break;
 630   }
 631   if(not sharedip)
 632   {
 633    printf("Unresolved shared connection: %s %s sharing-%s\n",
 634           ip->addr, ip->name, ip->sharing);
 635   }
 636  }
 637
 638  if(enable_credit && just_flush<9)
 639  {
 640   /*-----------------------------------------------------------------*/
 641   printf("Parsing credit file %s ...\n", credit);
 642   /*-----------------------------------------------------------------*/
 643   parse(credit)
 644   {
 645    ptr = parse_datafile_line(_);
 646    if(ptr)
 647    {
 648     if_exists(ip,ips,eq(ip->addr,_))
 649     {
 650      sscanf(ptr,"%Lu",&(ip->credit));
 651     }
 652    }
 653   }
 654   done; /* ugly macro end */
 655  }
 656
 657
 658  if(!just_preview)
 659  {
 660   /*-----------------------------------------------------------------*/
 661   puts("Initializing iptables and tc classes ...");
 662   /*-----------------------------------------------------------------*/
 663
 664   iptables_file = fopen(iptablesfile, "w");
 665   if(iptables_file == NULL)
 666   {
 667     perror(iptablesfile);
 668     exit(-1);
 669   }
 670   iptables_save_line(iptablespreamble, FALSE);
 671
 672   if(ip6prefix)
 673   {
 674    ip6tables_file = fopen(ip6tablesfile, "w");
 675    if(ip6tables_file == NULL)
 676    {
 677      perror(ip6tablesfile);
 678      exit(-1);
 679    }
 680    iptables_save_line(iptablespreamble, TRUE);
 681    iptables_save_line(ip6preamble, TRUE);
 682   }
 683
 684   run_iptables_restore();
 685
 686   log_file = fopen(cmdlog, "w");
 687   if(log_file == NULL)
 688   {
 689     perror(cmdlog);
 690     exit(-1);
 691   }
 692
 693   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,lan);
 694   safe_run(str);
 695
 696   sprintf(str,"%s qdisc del dev %s root 2>/dev/null",tc,wan);
 697   safe_run(str);
 698
 699   iptables_file=fopen(iptablesfile,"w");
 700   iptables_save_line(iptablespreamble, FALSE);
 701   if(ip6prefix)
 702   {
 703    ip6tables_file=fopen(ip6tablesfile,"w");
 704    iptables_save_line(iptablespreamble, TRUE);
 705    iptables_save_line(ip6preamble, TRUE);
 706   }
 707
 708   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
 709   {
 710    char *chain;
 711
 712    sprintf(str,"-A FORWARD -d %s -o %s -j ACCEPT", qos_free_zone, wan);
 713    iptables_save_line(str, FALSE); /* this is currently supported only for IPv4 */
 714
 715 /*
 716    if(qos_proxy)
 717    {
 718     iptables_save_line(":post_noproxy - [0:0]", FALSE);
 719     sprintf(str,"-A POSTROUTING ! -p tcp -o %s -j post_noproxy", lan);
 720     iptables_save_line(str , FALSE);
 721     sprintf(str,"-A POSTROUTING ! -s %s -o %s -j post_noproxy", proxy_ip, lan);
 722     iptables_save_line(str, FALSE);
 723     sprintf(str,"-A POSTROUTING -s %s -p tcp ! --sport %d -o %s -j post_noproxy", proxy_ip, proxy_port, lan);
 724     iptables_save_line(str, FALSE);
 725
 726     chain="post_noproxy";
 727    }
 728
 729    else
 730    {
 731 */
 732    chain = "POSTROUTING";
 733 //   }
 734
 735    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", chain, qos_free_zone, lan);
 736    iptables_save_line(str, FALSE);
 737   }
 738
 739   if(ip_count > idxtable_treshold1 && !just_flush)
 740   {
 741    int idxcount=0, bitmask=32-idxtable_bitmask1;
 742    char *subnet, *buf;
 743    /*-----------------------------------------------------------------*/
 744    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
 745    /*-----------------------------------------------------------------*/
 746
 747    iptables_save_line(":post_common - [0:0]", FALSE);
 748    iptables_save_line(":forw_common - [0:0]", FALSE);
 749    if(ip6prefix)
 750    {
 751     iptables_save_line(":post_common - [0:0]", TRUE);
 752     iptables_save_line(":forw_common - [0:0]", TRUE);
 753    }
 754
 755    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0"))
 756    {
 757     if(ip->v6)
 758     {
 759      buf=index6_id(ip->addr,bitmask+32);
 760     }
 761     else
 762     {
 763      buf=index_id(ip->addr, bitmask);
 764     }
 765
 766     if_exists(idx,idxs,eq(idx->id,buf))
 767     {
 768      idx->children++;
 769     }
 770     else
 771     {
 772      create(idx,Index);
 773      idx->addr = ip->addr;
 774      idx->id = buf;
 775      idx->bitmask = bitmask+32*ip->v6;
 776      idx->parent = NULL;
 777      idx->children = 0;
 778      idx->ipv6 = ip->v6;
 779      idxcount++;
 780      push(idx,idxs);
 781     }
 782    }
 783
 784    /* brutal perfomance optimalization */
 785    while(idxcount > idxtable_treshold2 && bitmask > 2*idxtable_bitmask2)
 786    {
 787     bitmask -= idxtable_bitmask2;
 788     idxcount = 0;
 789
 790     for_each(idx,idxs) if(idx->parent == NULL)
 791     {
 792      if(idx->ipv6)
 793      {
 794       buf = index6_id(idx->addr, bitmask+32);
 795      }
 796      else
 797      {
 798       buf = index_id(idx->addr, bitmask);
 799      }
 800      if_exists(metaindex,idxs,eq(metaindex->id,buf))
 801      {
 802       metaindex->children++;
 803      }
 804      else
 805      {
 806       create(metaindex,Index);
 807       metaindex->addr = idx->addr;
 808       metaindex->id = buf;
 809       metaindex->bitmask = bitmask+32*idx->ipv6;
 810       metaindex->parent = NULL;
 811       metaindex->children = 0;
 812       metaindex->ipv6 = idx->ipv6;
 813       idxcount++;
 814       push(metaindex,idxs);
 815      }
 816      idx->parent=metaindex;
 817     }
 818    }
 819
 820    /* this should slightly optimize throughput ... */
 821    sort(idx,idxs,desc_order_by,children);
 822    sort(idx,idxs,order_by,bitmask);
 823
 824    i=0;
 825    for_each(idx,idxs)
 826    {
 827     if(idx->ipv6)
 828     {
 829      subnet=subnet6_id(idx->addr, idx->bitmask);
 830     }
 831     else
 832     {
 833      subnet=subnet_id(idx->addr, idx->bitmask);
 834     }
 835     printf("%d: %s/%d\n", ++i, subnet, idx->bitmask);
 836
 837     sprintf(str,":post_%s - [0:0]", idx->id);
 838     iptables_save_line(str, idx->ipv6);
 839
 840     sprintf(str,":forw_%s - [0:0]", idx->id);
 841     iptables_save_line(str, idx->ipv6);
 842
 843     if(idx->parent)
 844     {
 845      string(buf,strlen(idx->parent->id)+6);
 846      sprintf(buf,"post_%s", idx->parent->id);
 847     }
 848     else
 849     {
 850      buf="POSTROUTING";
 851     }
 852
 853     sprintf(str,"-A %s -d %s/%d -o %s -j post_%s", buf, subnet, idx->bitmask, lan, idx->id);
 854     iptables_save_line(str, idx->ipv6);
 855
 856     sprintf(str,"-A %s -d %s/%d -o %s -j post_common", buf, subnet, idx->bitmask, lan);
 857     iptables_save_line(str, idx->ipv6);
 858
 859     if(idx->parent)
 860     {
 861      string(buf,strlen(idx->parent->id)+6);
 862      sprintf(buf,"forw_%s",idx->parent->id);
 863     }
 864     else
 865     {
 866      buf="FORWARD";
 867     }
 868
 869     sprintf(str,"-A %s -s %s/%d -o %s -j forw_%s", buf, subnet, idx->bitmask, wan, idx->id);
 870     iptables_save_line(str, idx->ipv6);
 871
 872     sprintf(str,"-A %s -s %s/%d -o %s -j forw_common", buf, subnet, idx->bitmask, wan);
 873     iptables_save_line(str, idx->ipv6);
 874    }
 875    printf("Total indexed iptables chains created: %d\n", i);
 876
 877    sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 878    iptables_save_line(str, FALSE);
 879
 880    sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 881    iptables_save_line(str, FALSE);
 882
 883    if(ip6prefix)
 884    {
 885     sprintf(str,"-A FORWARD -o %s -j forw_common", wan);
 886     iptables_save_line(str, TRUE);
 887
 888     sprintf(str,"-A POSTROUTING -o %s -j post_common", lan);
 889     iptables_save_line(str, TRUE);
 890    }
 891   }
 892  }
 893
 894  if(just_flush)
 895  {
 896   fclose(iptables_file);
 897   if(log_file)
 898   {
 899    fclose(log_file);
 900   }
 901   puts("Just flushed iptables and tc classes - now exiting ...");
 902   exit(0);
 903  }
 904
 905  if(!just_preview)
 906  {
 907   if(!dry_run && !nodelay && qos_free_delay)
 908   {
 909    printf("Flushed iptables and tc classes - now sleeping for %d seconds...\n",qos_free_delay);
 910    sleep(qos_free_delay);
 911   }
 912
 913   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",
 914               tc,lan,htb_r2q);
 915   safe_run(str);
 916
 917   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 918                tc,lan,lan_medium,lan_medium,burst_main,highest_priority);
 919   safe_run(str);
 920
 921   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 922                 tc,lan,line,line,burst_main,highest_priority);
 923   safe_run(str);
 924
 925   sprintf(str,"%s qdisc add dev %s root handle 1: htb r2q %d default 1",tc,wan,htb_r2q);
 926   safe_run(str);
 927
 928   sprintf(str, "%s class add dev %s parent 1: classid 1:2 htb rate %s ceil %s burst %dk prio %d",
 929                tc,wan,wan_medium,wan_medium,burst_main,highest_priority);
 930   safe_run(str);
 931
 932   sprintf(str, "%s class add dev %s parent 1:2 classid 1:1 htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d",
 933                tc,wan,up,up,burst_main,highest_priority);
 934   safe_run(str);
 935  }
 936
 937  /*-----------------------------------------------------------------*/
 938  puts("Locating heavy downloaders and generating root classes ...");
 939  /*-----------------------------------------------------------------*/
 940  sort(ip,ips,desc_order_by,traffic);
 941
 942  /*-----------------------------------------------------------------*/
 943  /* sub-scope - local variables */
 944  {
 945   long long int rate = line;
 946   long long int max = line;
 947   int group_count = 0;
 948   FILE *credit_file = NULL;
 949
 950   if(!just_preview && !dry_run && enable_credit)
 951   {
 952    credit_file = fopen(credit,"w");
 953   }
 954
 955   for_each(group,groups)
 956   {
 957    if(!just_preview)
 958    {
 959     //download
 960     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #down desired %d",
 961                  tc, lan, parent, group->id, rate, max, burst_group, highest_priority+1, group->desired);
 962     safe_run(str);
 963
 964     //upload
 965     sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %Ldkbit ceil %Ldkbit burst %dk prio %d #up desired %d",
 966                  tc, wan, parent, group->id, rate*up/line, max*up/line, burst_group, highest_priority+1, group->desired);
 967     safe_run(str);
 968    }
 969
 970    if(group_count++ < max_nesting)
 971    {
 972     parent = group->id;
 973    }
 974
 975    rate -= digital_divide*group->min;
 976    if(rate < group->min)
 977    {
 978     rate = group->min;
 979    }
 980
 981    /*shaping of aggresive downloaders, with credit file support */
 982    if(use_credit)
 983    {
 984     int group_rate = group->min, priority_sequence = lowest_priority;
 985
 986     for_each(ip, ips) if(ip->min == group->min && ip->max > ip->min)
 987     {
 988      ip->realquota=ip->credit+(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20));
 989      if(     ip->keyword->data_limit
 990          and not ip->fixedprio
 991          and ip->traffic > ip->realquota )
 992      {
 993       if(group_rate < ip->max)
 994       {
 995        ip->max = group_rate;
 996       }
 997       group_rate+=magic_treshold;
 998       ip->prio=lowest_priority;
 999       if(ip->prio<highest_priority+2)
1000       {
1001        ip->prio=highest_priority+2;
1002       }
1003      }
1004      else
1005      {
1006       if(    ip->keyword->data_prio
1007           && !ip->fixedprio
1008           && (   ip->traffic >   ip->credit + (ip->min*ip->keyword->data_prio+(ip->keyword->fixed_prio<<20))) )
1009       {
1010        ip->prio=priority_sequence--;
1011        if(ip->prio<highest_priority+1)
1012        {
1013         ip->prio=highest_priority+1;
1014        }
1015       }
1016
1017       if(credit_file)
1018       {
1019        unsigned long long lcredit=0;
1020
1021        if((ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))>ip->traffic)
1022        {
1023         lcredit=(ip->min*ip->keyword->data_limit+(ip->keyword->fixed_limit<<20))-ip->traffic;
1024        }
1025        fprintf(credit_file,"%s %Lu\n",ip->addr,lcredit);
1026       }
1027      }
1028     }
1029    }
1030   }
1031   if(credit_file)
1032   {
1033    fclose(credit_file);
1034   }
1035  }
1036
1037  if(just_preview)
1038  {
1039   if(start_shaping || stop_shaping || reduce_ceil)
1040   {
1041    time_t how_much_seconds = time(NULL) - get_mtime(classmap); /* sice start of daily aggregation session */
1042    printf("Reading %s (%ld seconds old) and applying Fair Use Policy and Aggregation rules... \n", classmap, how_much_seconds);
1043
1044    parse(classmap)
1045    {
1046     ptr=strchr(_,' ');
1047     if(ptr)
1048     {
1049      *ptr=0;
1050      ptr++;
1051      if_exists(ip,ips,eq(ip->addr,_))
1052      {
1053       int unshape_this_ip = stop_shaping;
1054       long avg_mbps_down = ip->direct * 8 / how_much_seconds;
1055       long avg_mbps_up = ip->upload * 8 / how_much_seconds;
1056       int min_mbps = ip->min>>10;
1057       int agreg = 1, print_stats = 1;
1058
1059       if(min_mbps < 1)
1060       {
1061        min_mbps = 1;
1062       }
1063
1064       if(ip->keyword->download_aggregation)
1065       {
1066        if(min_mbps <= avg_mbps_down)
1067        {
1068         unshape_this_ip = 0;
1069         agreg = (avg_mbps_down+1)/min_mbps;
1070         ip->max /= agreg;
1071         printf("Download aggregation 1:%d for %s (min: %lu Mbps avg: %ld Mbps)\n", agreg, ip->name, min_mbps, avg_mbps_down);
1072        }
1073        else
1074        {
1075         unshape_this_ip = 1;
1076        }
1077       }
1078       else if(ip->keyword->upload_aggregation)
1079       {
1080        if(min_mbps <= avg_mbps_up)
1081        {
1082         unshape_this_ip = 0;
1083         agreg = (avg_mbps_up+1)/min_mbps;
1084         ip->max /= agreg;
1085         printf("Upload aggregation 1:%d for %s: (min: %lu Mbps avg: %ld Mbps)\n", agreg, ip->name, min_mbps, avg_mbps_up);
1086        }
1087        else
1088        {
1089         unshape_this_ip = 1;
1090        }
1091       }
1092       ip->mark=atoi(ptr);
1093       if(ip->max < ip->desired || unshape_this_ip || reduce_ceil) /* apply or disable FUP limit immediately.... */
1094       {
1095        if(unshape_this_ip)
1096        {
1097         ip->max = ip->desired;
1098         if(stop_shaping) /* all limits removed, but not printed with -s (start_shaping) switch */
1099         {
1100          printf("Removing limit for %s (%s) ", ip->name, ip->addr);
1101         }
1102         else
1103         {
1104          print_stats = 0;
1105         }
1106        }
1107        else
1108        {
1109         printf("Applying limit for %s (%s) ", ip->name, ip->addr);
1110         if(reduce_ceil)
1111         {
1112          ip->max = ip->min + (ip->desired-ip->min)/reduce_ceil;
1113         }
1114         else if(ip->max < ip->min)
1115         {
1116          ip->max = ip->min;
1117         }
1118        }
1119        if(print_stats)
1120        {
1121         printf("(down: %dk-%dk wants %dk, ", ip->min, ip->max, ip->desired);
1122        }
1123        sprintf(str, "%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1124                     tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);
1125        safe_run(str);
1126        if(print_stats)
1127        {
1128         printf("up: %dk-%dk wants %dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1129                                            (int)((ip->desired/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1130                                            (int)((ip->desired/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1131        }
1132        sprintf(str,"%s class change dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1133                     tc, wan, ip->group, ip->mark,
1134                     (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1135                     (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1136        safe_run(str);
1137       }
1138      }
1139     }
1140    }
1141    fail
1142    {
1143     perror(classmap);
1144     puts("Warning - classmap file not fund, just generating preview ...");
1145     start_shaping=FALSE;
1146     stop_shaping=FALSE;
1147    }
1148    done; /* ugly macro end */
1149   }
1150   html=preview;
1151   json_traffic=json_preview;
1152  }
1153
1154  if(!dry_run && !just_flush)
1155  {
1156   /*-----------------------------------------------------------------*/
1157   printf("Writing json traffic overview  %s ... ", json_traffic);
1158   /*-----------------------------------------------------------------*/
1159   write_json_traffic(json_traffic);
1160
1161   /*-----------------------------------------------------------------*/
1162   printf("Writing statistics into HTML page %s ...\n", html);
1163   /*-----------------------------------------------------------------*/
1164   write_htmlandlogs(html, d, total, just_preview);
1165  }
1166
1167  if(just_preview)
1168  {
1169   char swchar='p';
1170   if(start_shaping)
1171   {
1172    swchar='s';
1173   }
1174   else if(reduce_ceil)
1175   {
1176    swchar='0'+reduce_ceil; /* -2, -4 */
1177   }
1178   else if(stop_shaping)
1179   {
1180    swchar='q';
1181   }
1182
1183   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
1184   exit(0);
1185  }
1186
1187  i=0;
1188 #ifdef DEBUG
1189  printf("%-22s %-15s mark\n","name","ip");
1190 #endif
1191
1192  printf("Writing %s", classmap);
1193  f = fopen(classmap, "w");
1194  if(f < 0)
1195  {
1196   perror(classmap);
1197  }
1198
1199  /*-----------------------------------------------------------------*/
1200  printf(" + generating iptables and tc classes ... ");
1201  /*-----------------------------------------------------------------*/
1202
1203  for_each(ip, ips) if(ip->mark > 0) /* works only for IPv4 so far */
1204  {
1205   if(idxs)
1206   {
1207    char *buf;
1208    duplicate(ip->addr,buf);
1209    if(ip->v6)
1210    {
1211     buf=index6_id(ip->addr,64-idxtable_bitmask1);
1212    }
1213    else
1214    {
1215     buf=index_id(ip->addr,32-idxtable_bitmask1);
1216    }
1217
1218    string(chain_forward,6+strlen(buf));
1219    strcpy(chain_forward,"forw_");
1220    strcat(chain_forward,buf);
1221
1222    string(chain_postrouting,6+strlen(buf));
1223    strcpy(chain_postrouting,"post_");
1224    strcat(chain_postrouting,buf);
1225
1226    free(buf);
1227   }
1228   else
1229   {
1230    chain_forward="FORWARD";
1231    chain_postrouting="POSTROUTING";
1232   }
1233
1234   /* packet limits - this will be optional in future */
1235   if(ip->pps_limit)
1236   {
1237    sprintf(limit_pkts, "-m limit --limit %d/s --limit-burst %d ",
1238                        ip->pps_limit, ip->pps_limit);
1239   }
1240   else
1241   {
1242    *limit_pkts = 0;
1243   }
1244
1245 #ifdef DEBUG
1246   printf("%-22s %-16s %04d %d/s\n", ip->name, ip->addr, ip->mark, ip->pps_limit);
1247 #endif
1248
1249   /* -------------------------------------------------------- mark download */
1250   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1251                chain_postrouting, ip->addr, ip->mask,
1252                lan, mark_iptables, ip->mark);
1253   iptables_save_line(str, ip->v6);
1254
1255 /*
1256   if(qos_proxy)
1257   {
1258    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",
1259                 chain_postrouting, proxy_ip, proxy_port, ip->addr,
1260                 ip->mask, lan, mark_iptables, ip->mark);
1261    iptables_save_line(str, ip->v6);
1262   }
1263 */
1264   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
1265                chain_postrouting, ip->addr, ip->mask, lan, limit_pkts);
1266   iptables_save_line(str, ip->v6);
1267
1268   /* classify overlimit packets to separate overlimit class */
1269   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
1270                chain_postrouting, ip->addr, ip->mask,
1271                lan, mark_iptables, OVERLIMIT_CLASS);
1272   iptables_save_line(str, ip->v6);
1273
1274   sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
1275                chain_postrouting, ip->addr, ip->mask, lan);
1276   iptables_save_line(str, ip->v6);
1277
1278   /* -------------------------------------------------------- mark upload */
1279   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1280                chain_forward, ip->addr, ip->mask, wan, mark_iptables, ip->mark);
1281   iptables_save_line(str, ip->v6);
1282
1283   sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",
1284                chain_forward, ip->addr, ip->mask, wan, limit_pkts);
1285   iptables_save_line(str, ip->v6);
1286
1287   /* classify overlimit packets to separate overlimit class */
1288   sprintf(str, "-A %s -s %s/%d -o %s -j %s%d",
1289                chain_forward, ip->addr, ip->mask, wan, mark_iptables, OVERLIMIT_CLASS);
1290   iptables_save_line(str, ip->v6);
1291
1292   sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",
1293                chain_forward, ip->addr, ip->mask, wan);
1294   iptables_save_line(str, ip->v6);
1295
1296   if(ip->min)
1297   {
1298    /* -------------------------------------------------------- download class */
1299 #ifdef DEBUG
1300    printf("(down: %dk-%dk ", ip->min, ip->max);
1301 #endif
1302
1303    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1304                 tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);
1305    safe_run(str);
1306
1307    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1308    {
1309     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1310                  tc, lan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1311     safe_run(str);
1312    }
1313
1314    if(filter_type == 1)
1315    {
1316     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1317                  tc, lan, ip->mark, ip->mark);
1318     safe_run(str);
1319    }
1320
1321    /* -------------------------------------------------------- upload class */
1322 #ifdef DEBUG
1323    printf("up: %dk-%dk)\n", (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1324                             (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed));
1325 #endif
1326
1327    sprintf(str,"%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1328                 tc, wan, ip->group, ip->mark,
1329                 (int)((ip->min/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed),
1330                 (int)((ip->max/ip->keyword->asymetry_ratio)-ip->keyword->asymetry_fixed), burst, ip->prio);
1331    safe_run(str);
1332
1333    if(strcmpi(ip->keyword->leaf_discipline, "none"))
1334    {
1335     sprintf(str, "%s qdisc add dev %s parent 1:%d handle %d %s",
1336                  tc, wan, ip->mark, ip->mark, ip->keyword->leaf_discipline); /*qos_leaf*/
1337     safe_run(str);
1338    }
1339
1340    if(filter_type == 1)
1341    {
1342     sprintf(str, "%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d",
1343                  tc, wan, ip->mark, ip->mark);
1344     safe_run(str);
1345    }
1346
1347    if(f > 0)
1348    {
1349     fprintf(f, "%s %d\n", ip->addr, ip->mark);
1350    }
1351   }
1352   else
1353   {
1354 #ifdef DEBUG
1355    printf("(sharing %s)\n", ip->sharing);
1356 #endif
1357   }
1358   i++;
1359  }
1360  if(f > 0)
1361  {
1362   puts("done.");
1363   fclose(f);
1364  }
1365
1366  if(idxs)
1367  {
1368   chain_forward = "forw_common";
1369   chain_postrouting = "post_common";
1370  }
1371  else
1372  {
1373   chain_forward = "FORWARD";
1374   chain_postrouting = "POSTROUTING";
1375  }
1376
1377  if(free_min)
1378  {
1379   final_chain = "ACCEPT";
1380  }
1381
1382 /*
1383  if(qos_proxy)
1384  {
1385   if(free_min)
1386   {
1387    sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s%d",
1388                 chain_postrouting,proxy_ip,proxy_port,lan,mark_iptables, 3);
1389    iptables_save_line(str, FALSE); // only for IPv4
1390   }
1391   sprintf(str, "-A %s -s %s -p tcp --sport %d -o %s -j %s",
1392                chain_postrouting,proxy_ip,proxy_port,lan,final_chain);
1393   iptables_save_line(str, FALSE); // only for IPv4
1394  }
1395 */
1396
1397  if(free_min)
1398  {
1399   sprintf(str, "-A %s -o %s -j %s%d",
1400                chain_postrouting, lan, mark_iptables, FREE_CLASS);
1401   iptables_save_line(str, FALSE); /* only for IPv4 */
1402  }
1403
1404  sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1405  iptables_save_line(str, FALSE);
1406  if(ip6prefix)
1407  {
1408   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1409   iptables_save_line(str, TRUE);
1410  }
1411
1412  if(free_min)
1413  {
1414   sprintf(str,"-A %s -o %s -j %s%d", chain_forward, wan, mark_iptables, FREE_CLASS);
1415   iptables_save_line(str, FALSE); /* only for IPv4 */
1416  }
1417
1418  sprintf(str,"-A %s -o %s -j %s", chain_forward, wan, final_chain);
1419  iptables_save_line(str, FALSE);
1420  if(ip6prefix)
1421  {
1422   sprintf(str,"-A %s -o %s -j %s", chain_postrouting, lan, final_chain);
1423   iptables_save_line(str, TRUE);
1424  }
1425
1426  if(free_min) /* allocate free bandwith if it is not zero... */
1427  {
1428    /*-----------------------------------------------------------------*/
1429    puts("Generating free bandwith class ...");
1430    /*-----------------------------------------------------------------*/
1431    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1432                 tc, lan, parent, FREE_CLASS, free_min, free_max,burst, lowest_priority);
1433    safe_run(str);
1434    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1435                 tc, wan, parent, FREE_CLASS, free_min, free_max, burst, lowest_priority);
1436    safe_run(str);
1437    /* tc SFQ */
1438    if(strcmpi(qos_leaf, "none"))
1439    {
1440      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, lan, FREE_CLASS, FREE_CLASS, qos_leaf);
1441      safe_run(str);
1442
1443      sprintf(str,"%s qdisc add dev %s parent 1:%d handle %d %s", tc, wan, FREE_CLASS, FREE_CLASS, qos_leaf);
1444      safe_run(str);
1445    }
1446    /* tc handle 1 fw flowid */
1447    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, lan, FREE_CLASS, FREE_CLASS);
1448    safe_run(str);
1449
1450    sprintf(str,"%s filter add dev %s parent 1:0 protocol ip handle %d fw flowid 1:%d", tc, wan, FREE_CLASS, FREE_CLASS);
1451    safe_run(str);
1452
1453    /*-----------------------------------------------------------------*/
1454    puts("Generating bandwith class for overlimit packets...");
1455    /*-----------------------------------------------------------------*/
1456    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1457                 tc, lan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1458    safe_run(str);
1459    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d",
1460                 tc, wan, parent, OVERLIMIT_CLASS, overlimit_min, overlimit_max, burst, lowest_priority);
1461    safe_run(str);
1462  }
1463  printf("Total IP count: %d\n", i);
1464  run_iptables_restore();
1465  if(log_file)
1466  {
1467   fclose(log_file);
1468  }
1469  return 0;
1470  /* that's all folks, thank you for reading it all the way up to this point ;-) */
1471  /* bad luck C<<1 is not yet finished, I promise no sprintf() next time... */
1472 }