/* Prometheus QoS - you can "steal fire" from your ISP */\r
/* "fair-per-IP" quality of service (QoS) utility */\r
/* requires Linux 2.4.x or 2.6.x with HTB support */\r
-/* Copyright(C) 2005-2017 Michael Polak, Arachne Aerospace */\r
+/* Copyright(C) 2005-2019 Michael Polak, Arachne Aerospace */\r
/* iptables-restore support Copyright(C) 2007-2008 ludva */\r
/* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf */\r
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
\r
-/* Modified by: xChaos, 20171012\r
+/* Modified by: xChaos, 20190127\r
ludva, 20080415\r
\r
Prometheus QoS is free software; you can redistribute it and/or\r
#include "cll1-0.6.2.h"\r
#include "ipstruct.h"\r
\r
-const char *version = "0.9.0-a";\r
+const char *version = "0.9.1";\r
\r
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
/* Versions: 0.9.0 is development release, 1.0 will be "stable" */\r
char *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */\r
char *upstreamfile = "/etc/prometheus/upstream.interfaces"; /* list of interfaces to manage */\r
char *downstreamfile = "/etc/prometheus/downstream.interfaces"; /* list of interfaces to manage */\r
+char *qosfreefile = "/etc/prometheus/qosfree.interfaces"; /* list of interfaces to manage */\r
char *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/\r
char *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/\r
char *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */\r
char *mark = "MARK";\r
char *mark_iptables = "MARK --set-mark ";\r
int dry_run = FALSE; /* preview - use puts() instead of system() */\r
+int mix_new_hosts = FALSE; /* execute only commands not already in log of iptables */\r
char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";\r
char *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";\r
FILE *iptables_file = NULL;\r
FILE *log_file = NULL;\r
char *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */\r
\r
-const int highest_priority = 0; /* highest HTB priority (HTB built-in value is 0) */\r
-const int lowest_priority = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */\r
-const int idxtable_treshold1 = 24; /* this is no longer configurable */\r
-const int idxtable_treshold2 = 12; /* this is no longer configurable */\r
-const int idxtable_bitmask1 = 3; /* this is no longer configurable */\r
-const int idxtable_bitmask2 = 3; /* this is no longer configurable */\r
+const int highest_priority = 0; /* highest HTB priority (HTB built-in value is 0) */\r
+const int lowest_priority = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */\r
+const int idxtable_treshold1 = 24; /* this is no longer configurable */\r
+const int idxtable_treshold2 = 12; /* this is no longer configurable */\r
+const int idxtable_bitmask1 = 3; /* this is no longer configurable */\r
+const int idxtable_bitmask2 = 3; /* this is no longer configurable */\r
\r
struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;\r
struct Group *groups = NULL, *group;\r
struct Macro *macro, *macros = NULL;\r
struct Index *idxs = NULL, *idx, *metaindex;\r
struct Interface *interfaces = NULL, *interface;\r
+struct QosFreeInterface *qosfreeinterfaces = NULL, *qosfreeinterface;\r
+struct Textfile *previous_commands = NULL, *previous_iptables = NULL, *previous_ip6tables = NULL, *textline;\r
\r
#define FREE_CLASS 3\r
#define OVERLIMIT_CLASS 4\r
}\r
}\r
\r
-\r
/* ====== iptables indexes are used to reduce complexity to log8(N) ===== */\r
\r
char *index_id(char *ip, int bitmask);\r
option("hosts",hosts);\r
option("downstream-interfaces-list-filename",downstreamfile);\r
option("upstream-interfaces-list-filename",upstreamfile);\r
+ option("qos-free-interfaces-list-filename",qosfreefile);\r
option("macros-filename",macrosfile);\r
option("ip6-prefix",ip6prefix);\r
option("medium",medium);\r
}\r
else\r
{\r
- system(cmd);\r
+ int skip_cmd = FALSE;\r
+ if(mix_new_hosts)\r
+ for_each(textline, previous_commands)\r
+ if(eq(textline->str, cmd))\r
+ {\r
+ skip_cmd = TRUE;\r
+ break;\r
+ }\r
+ \r
+ if(!skip_cmd)\r
+ {\r
+ if(mix_new_hosts)\r
+ {\r
+ printf("Executing command: %s\n", cmd);\r
+ }\r
+ system(cmd);\r
+ }\r
}\r
if(log_file)\r
{\r
}\r
\r
void iptables_save_line(char *line, int ipv6)\r
-{\r
+{ \r
if(ipv6)\r
{\r
+ if(mix_new_hosts)\r
+ for_each(textline, previous_ip6tables)\r
+ if(eq(textline->str, line))\r
+ return;\r
+\r
fprintf(ip6tables_file,"%s\n",line);\r
}\r
else\r
{\r
+ if(mix_new_hosts)\r
+ for_each(textline, previous_iptables)\r
+ if(eq(textline->str, line))\r
+ return; \r
+\r
fprintf(iptables_file,"%s\n",line);\r
}\r
+ if(mix_new_hosts)\r
+ {\r
+ printf("Adding iptables/ip6tables rule: %s\n", line);\r
+ } \r
}\r
\r
+#define IPv4 FALSE\r
+#define IPv6 TRUE\r
+\r
+\r
void run_iptables_restore(void)\r
{\r
char *restor;\r
printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);\r
/*-----------------------------------------------------------------*/\r
\r
- iptables_save_line("COMMIT", FALSE);\r
+ iptables_save_line("COMMIT", IPv4);\r
fclose(iptables_file);\r
if(dry_run) \r
{\r
/*-----------------------------------------------------------------*/\r
printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);\r
/*-----------------------------------------------------------------*/\r
- iptables_save_line("COMMIT", TRUE);\r
+ iptables_save_line("COMMIT", IPv6);\r
fclose(ip6tables_file);\r
if(dry_run) \r
{\r
int just_preview = FALSE; /* preview - generate just stats */\r
int start_shaping = FALSE; /* apply FUP - requires classmap file */\r
int stop_shaping = FALSE; /* lift FUP - requires classmap file */\r
- int reduce_ceil = 0; /* allow only rate+(ceil-rate)/2, /4, etc. */\r
+ int reduce_ceil = 0; /* allow only rate+(ceil-rate)/2, /4, etc. */\r
int just_logs = FALSE; /* just parse logs */\r
int run = FALSE;\r
int total = 0;\r
\r
printf("\n\\r
Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\\r
-Version %s - Copyright (C)2005-2017 Michael Polak, Arachne Labs\n\\r
+Version %s - Copyright (C)2005-2019 Michael Polak, Arachne Labs\n\\r
iptables-restore & burst tunning & classify modification by Ludva\n\\r
Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);\r
\r
{\r
argument("-c") { nextargument(config); }\r
argument("-h") { nextargument(althosts);}\r
- argument("-d") { run=TRUE; dry_run=TRUE; }\r
- argument("-f") { run=TRUE; just_flush=TRUE; }\r
- argument("-9") { run=TRUE; just_flush=9; }\r
- argument("-p") { run=TRUE; just_preview=TRUE; }\r
- argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }\r
- argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }\r
- argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }\r
- argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }\r
- argument("-r") { run=TRUE; }\r
- argument("-n") { run=TRUE; nodelay=TRUE; }\r
- argument("-a") { run=TRUE; just_networks=TRUE; }\r
- argument("-l") { just_logs=TRUE; }\r
- argument("-m") { just_logs=TRUE; }\r
- argument("-y") { just_logs=TRUE; }\r
+ argument("-d") { run = TRUE; dry_run = TRUE; }\r
+ argument("-f") { run = TRUE; just_flush = TRUE; }\r
+ argument("-9") { run = TRUE; just_flush = 9; }\r
+ argument("-p") { run = TRUE; just_preview = TRUE; }\r
+ argument("-q") { run = TRUE; just_preview = TRUE; stop_shaping = TRUE; }\r
+ argument("-2") { run = TRUE; just_preview = TRUE; reduce_ceil = 2; }\r
+ argument("-4") { run = TRUE; just_preview = TRUE; reduce_ceil = 4; }\r
+ argument("-s") { run = TRUE; just_preview = TRUE; start_shaping = TRUE; }\r
+ argument("-x") { run = TRUE; just_preview = TRUE; mix_new_hosts = TRUE; }\r
+ argument("-r") { run = TRUE; }\r
+ argument("-n") { run = TRUE; nodelay = TRUE; }\r
+ argument("-a") { run = TRUE; just_networks = TRUE; }\r
+ argument("-l") { just_logs = TRUE; }\r
+ argument("-m") { just_logs = TRUE; }\r
+ argument("-y") { just_logs = TRUE; }\r
argument("-?") { help(); exit(0); }\r
argument("--help") { help(); exit(0); }\r
argument("-v") { exit(0); } \r
}\r
}\r
done; /* ugly macro end */\r
-\r
\r
if(just_logs)\r
{\r
hosts = althosts;\r
}\r
\r
- if(just_flush<9)\r
+ if(!mix_new_hosts && just_flush<9)\r
{\r
/*-----------------------------------------------------------------*/\r
puts("Parsing iptables verbose output ...");\r
string(str, STRLEN); \r
string(limit_pkts, STRLEN);\r
\r
+ /*-----------------------------------------------------------------*/\r
+ printf("Parsing qos free interfaces file %s ...\n", qosfreefile);\r
+ /*-----------------------------------------------------------------*/\r
+ load(qosfreeinterface, qosfreeinterfaces,\r
+ qosfreefile, QosFreeInterface, name);\r
+\r
/*-----------------------------------------------------------------*/\r
printf("Parsing macro definition file %s ...\n", macrosfile);\r
/*-----------------------------------------------------------------*/\r
}\r
done; /* ugly macro end */\r
\r
-\r
-\r
/*-----------------------------------------------------------------*/\r
printf("Parsing class defintion file %s ...\n", hosts);\r
/*-----------------------------------------------------------------*/\r
}\r
*/\r
\r
+ if(mix_new_hosts)\r
+ {\r
+ char *new_filename;\r
+ /*-----------------------------------------------------------------*/\r
+ printf("Loading log of previously executed commands %s ...\n", cmdlog);\r
+ /*-----------------------------------------------------------------*/\r
+ load(textline, previous_commands, cmdlog, Textfile, str);\r
+ /*-----------------------------------------------------------------*/\r
+ printf("Loading log of iptables-restore commands %s ...\n", iptablesfile);\r
+ /*-----------------------------------------------------------------*/\r
+ load(textline, previous_iptables, iptablesfile, Textfile, str);\r
+ /*-----------------------------------------------------------------*/\r
+ printf("Loading log of ip6tables-restore commands %s ...\n", ip6tablesfile);\r
+ /*-----------------------------------------------------------------*/\r
+ load(textline, previous_ip6tables, ip6tablesfile, Textfile, str);\r
+\r
+ string(new_filename, strlen(iptablesfile)+2);\r
+ strcpy(new_filename, iptablesfile);\r
+ strcat(new_filename, "-x");\r
+ iptablesfile = new_filename;\r
+\r
+ string(new_filename, strlen(ip6tablesfile)+2);\r
+ strcpy(new_filename, ip6tablesfile);\r
+ strcat(new_filename, "-x");\r
+ ip6tablesfile = new_filename;\r
+ }\r
+\r
/*-----------------------------------------------------------------*/\r
puts("Resolving shared connections ...");\r
/*-----------------------------------------------------------------*/\r
}\r
}\r
\r
- if(enable_credit && just_flush<9)\r
+ if(!mix_new_hosts && enable_credit && just_flush<9)\r
{\r
/*-----------------------------------------------------------------*/\r
printf("Parsing credit file %s ...\n", credit);\r
}\r
\r
\r
- if(!just_preview)\r
+ if(!mix_new_hosts && !just_preview)\r
{\r
/*-----------------------------------------------------------------*/\r
puts("Initializing iptables and tc classes ...");\r
perror(iptablesfile);\r
exit(-1);\r
}\r
- iptables_save_line(iptablespreamble, FALSE);\r
+ iptables_save_line(iptablespreamble, IPv4);\r
\r
if(ip6prefix)\r
{\r
perror(ip6tablesfile);\r
exit(-1);\r
}\r
- iptables_save_line(iptablespreamble, TRUE);\r
- iptables_save_line(ip6preamble, TRUE);\r
+ iptables_save_line(iptablespreamble, IPv6);\r
+ iptables_save_line(ip6preamble, IPv6);\r
}\r
\r
run_iptables_restore();\r
}\r
\r
iptables_file=fopen(iptablesfile,"w");\r
- iptables_save_line(iptablespreamble, FALSE);\r
+ iptables_save_line(iptablespreamble, IPv4);\r
if(ip6prefix)\r
{\r
ip6tables_file=fopen(ip6tablesfile,"w");\r
- iptables_save_line(iptablespreamble, TRUE);\r
- iptables_save_line(ip6preamble, TRUE);\r
+ iptables_save_line(iptablespreamble, IPv6);\r
+ iptables_save_line(ip6preamble, IPv6);\r
}\r
\r
if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */\r
{\r
for_each(interface, interfaces)\r
{\r
- sprintf(str,"-A %s -s %s -o %s -j ACCEPT", interface->chain, qos_free_zone, interface->name);\r
- iptables_save_line(str, FALSE);\r
+ sprintf(str,"-A %s -%c %s -o %s -j ACCEPT", interface->chain, (interface->is_upstream?'d':'s'), qos_free_zone, interface->name);\r
+ iptables_save_line(str, IPv4);\r
}\r
}\r
\r
+ for_each(qosfreeinterface, qosfreeinterfaces)\r
+ {\r
+ sprintf(str,"-A FORWARD -i %s -j ACCEPT", qosfreeinterface->name);\r
+ iptables_save_line(str, IPv4); \r
+ iptables_save_line(str, IPv6);\r
+ sprintf(str,"-A POSTROUTING -o %s -j ACCEPT", qosfreeinterface->name);\r
+ iptables_save_line(str, IPv4);\r
+ iptables_save_line(str, IPv6);\r
+ }\r
+ \r
if(ip_count > idxtable_treshold1 && !just_flush)\r
{\r
int idxcount=0, bitmask=32-idxtable_bitmask1;\r
printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);\r
/*-----------------------------------------------------------------*/\r
\r
- iptables_save_line(":post_common - [0:0]", FALSE);\r
- iptables_save_line(":forw_common - [0:0]", FALSE);\r
+ iptables_save_line(":post_common - [0:0]", IPv4);\r
+ iptables_save_line(":forw_common - [0:0]", IPv4);\r
if(ip6prefix)\r
{\r
- iptables_save_line(":post_common - [0:0]", TRUE);\r
- iptables_save_line(":forw_common - [0:0]", TRUE);\r
+ iptables_save_line(":post_common - [0:0]", IPv6);\r
+ iptables_save_line(":forw_common - [0:0]", IPv6);\r
}\r
\r
for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0")) \r
buf = interface->chain;\r
}\r
\r
- sprintf(str,"-A %s -d %s/%d -o %s -j %s_%s", buf, subnet, idx->bitmask, interface->name, interface->idxprefix, idx->id);\r
+ sprintf(str, "-A %s -%c %s/%d -o %s -j %s_%s", \r
+ buf, (interface->is_upstream?'s':'d'), subnet, idx->bitmask, interface->name, interface->idxprefix, idx->id);\r
iptables_save_line(str, idx->ipv6);\r
\r
- sprintf(str,"-A %s -d %s/%d -o %s -j %s_common", buf, subnet, idx->bitmask, interface->name, interface->idxprefix);\r
+ sprintf(str, "-A %s -%c %s/%d -o %s -j %s_common",\r
+ buf, (interface->is_upstream?'s':'d'), subnet, idx->bitmask, interface->name, interface->idxprefix);\r
iptables_save_line(str, idx->ipv6);\r
}\r
}\r
for_each(interface, interfaces)\r
{\r
sprintf(str,"-A %s -o %s -j %s_common", interface->chain, interface->name, interface->idxprefix);\r
- iptables_save_line(str, FALSE);\r
+ iptables_save_line(str, IPv4);\r
if(ip6prefix)\r
{\r
sprintf(str,"-A %s -o %s -j %s_common", interface->chain, interface->name, interface->idxprefix);\r
- iptables_save_line(str, TRUE);\r
+ iptables_save_line(str, IPv6);\r
}\r
}\r
}\r
exit(0);\r
}\r
\r
- if(!just_preview)\r
+ if(!mix_new_hosts && !just_preview)\r
{\r
if(!dry_run && !nodelay && qos_free_delay)\r
{\r
}\r
}\r
\r
- /*-----------------------------------------------------------------*/\r
- puts("Locating heavy downloaders and generating root classes ...");\r
- /*-----------------------------------------------------------------*/\r
- sort(ip,ips,desc_order_by,traffic); \r
+ if(mix_new_hosts)\r
+ {\r
+ /*-----------------------------------------------------------------*/\r
+ puts("Locating heavy downloaders and generating root classes ...");\r
+ /*-----------------------------------------------------------------*/\r
+ sort(ip,ips,desc_order_by,traffic);\r
+ }\r
\r
/*-----------------------------------------------------------------*/\r
for_each(interface, interfaces)\r
json_traffic=json_preview;\r
}\r
\r
- if(!dry_run && !just_flush)\r
+ if(!mix_new_hosts && !dry_run && !just_flush)\r
{\r
/*-----------------------------------------------------------------*/\r
printf("Writing json traffic overview %s ... ", json_traffic);\r
\r
printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);\r
exit(0);\r
- } \r
-\r
+ }\r
+ \r
i=0;\r
#ifdef DEBUG\r
printf("%-22s %-15s mark\n","name","ip");\r
#endif\r
\r
/* ------------------------------------------------ iptables classify */\r
- sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r
- chain, ip->addr, ip->mask,\r
+ sprintf(str, "-A %s -%c %s/%d -o %s -j %s%d",\r
+ chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,\r
interface->name, mark_iptables, ip->mark);\r
iptables_save_line(str, ip->v6);\r
\r
- sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",\r
- chain, ip->addr, ip->mask, interface->name, limit_pkts);\r
+ sprintf(str, "-A %s -%c %s/%d -o %s %s-j ACCEPT",\r
+ chain, (interface->is_upstream?'s':'d'),ip->addr, ip->mask,\r
+ interface->name, limit_pkts);\r
iptables_save_line(str, ip->v6);\r
\r
- if(limit_pkts)\r
+ if(*limit_pkts) /* non-empty string?*/\r
{\r
/* classify overlimit packets to separate overlimit class */\r
- sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r
- chain, ip->addr, ip->mask,\r
+ sprintf(str, "-A %s -%c %s/%d -o %s -j %s%d",\r
+ chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,\r
interface->name, mark_iptables, OVERLIMIT_CLASS);\r
iptables_save_line(str, ip->v6);\r
\r
- sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",\r
- chain, ip->addr, ip->mask, interface->name);\r
+ sprintf(str, "-A %s -%c %s/%d -o %s -j ACCEPT",\r
+ chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,\r
+ interface->name);\r
iptables_save_line(str, ip->v6);\r
}\r
\r
\r
sprintf(str, "-A %s -o %s -j %s%d",\r
chain, interface->name, mark_iptables, FREE_CLASS);\r
- iptables_save_line(str, FALSE); /* only for IPv4 */\r
+ iptables_save_line(str, IPv4); /* only for IPv4 */\r
}\r
\r
sprintf(str,"-A %s -o %s -j %s", chain, interface->name, final_chain);\r
- iptables_save_line(str, FALSE);\r
+ iptables_save_line(str, IPv4);\r
if(ip6prefix)\r
{\r
sprintf(str,"-A %s -o %s -j %s", chain, interface->name, final_chain);\r
- iptables_save_line(str, TRUE);\r
+ iptables_save_line(str, IPv6);\r
}\r
\r
if(free_min) /* allocate free bandwith if it is not zero... */ \r