From 5a6c33f69368fa0df0eb41f85f18ca6c9e14ae7a Mon Sep 17 00:00:00 2001
From: Toastman <toastman@galactic_core>
Date: Sat, 5 May 2012 17:17:08 +0700
Subject: [PATCH] revised QOS/BWLimiter

(removed the default limits for unlisted clients)
---
 release/src/router/httpd/bwm.c            |   8 +-
 release/src/router/httpd/tomato.c         |   6 +
 release/src/router/nvram/defaults.c       |   6 +
 release/src/router/rc/Makefile            |   1 +
 release/src/router/rc/firewall.c          |   5 +
 release/src/router/rc/qoslimit.c          | 377 ++++++++++++++++++++++++++++++
 release/src/router/rc/rc.h                |   5 +
 release/src/router/rc/services.c          |  11 +
 release/src/router/rc/wan.c               |   2 +
 release/src/router/www/about.asp          |   3 +-
 release/src/router/www/bwm-common.js      |   8 +
 release/src/router/www/qos-qoslimit.asp   | 277 ++++++++++++++++++++++
 release/src/router/www/status-devices.asp |  11 +-
 release/src/router/www/tomato.js          |   3 +-
 14 files changed, 717 insertions(+), 6 deletions(-)
 create mode 100644 release/src/router/rc/qoslimit.c
 create mode 100644 release/src/router/www/qos-qoslimit.asp

diff --git a/release/src/router/httpd/bwm.c b/release/src/router/httpd/bwm.c
index dbd83f0bbc..5ae4029846 100644
--- a/release/src/router/httpd/bwm.c
+++ b/release/src/router/httpd/bwm.c
@@ -232,7 +232,13 @@ void asp_netdev(int argc, char **argv)
 
 			// <rx bytes, packets, errors, dropped, fifo errors, frame errors, compressed, multicast><tx ...>
 			if (sscanf(p + 1, "%lu%*u%*u%*u%*u%*u%*u%*u%lu", &rx, &tx) != 2) continue;
-				web_printf("%c'%s':{rx:0x%lx,tx:0x%lx}", comma, ifname, rx, tx);				
+			if (!strcmp(ifname, "imq1"))
+				web_printf("%c'%s':{rx:0x0,tx:0x%lx}", comma, ifname, rx, tx);
+			else if (!strcmp(ifname, "imq2"))
+				web_printf("%c'%s':{rx:0x%lx,tx:0x0}", comma, ifname, rx, tx);
+			else
+				web_printf("%c'%s':{rx:0x%lx,tx:0x%lx}", comma, ifname, rx, tx);
+				
 			comma = ',';
 		}
 
diff --git a/release/src/router/httpd/tomato.c b/release/src/router/httpd/tomato.c
index 71f0976915..0a522e765a 100644
--- a/release/src/router/httpd/tomato.c
+++ b/release/src/router/httpd/tomato.c
@@ -1128,6 +1128,12 @@ static const nvset_t nvset_list[] = {
 	{ "ne_vbeta",			V_NUM				},
 	{ "ne_vgamma",			V_NUM				},
 
+// qos-bw-limiter
+	{ "qosl_enable",		V_01                   },
+	{ "qosl_rules",			V_LENGTH(0, 4096)      },
+	/*qosl_ibw unused - qos_ibw shared*/
+	/*qosl_obw unused - qos_obw shared*/
+
 //NoCatSplash. Victek.
 #ifdef TCONFIG_NOCAT
 	{ "NC_enable",			V_01				},
diff --git a/release/src/router/nvram/defaults.c b/release/src/router/nvram/defaults.c
index 8b74d62916..0922c7ec91 100644
--- a/release/src/router/nvram/defaults.c
+++ b/release/src/router/nvram/defaults.c
@@ -532,6 +532,12 @@ const defaults_t defaults[] = {
 	{ "ne_vbeta",			"3"				},	// "
 	{ "ne_vgamma",			"2"				},	// "
 
+// qos-bw-limiter
+	{ "qosl_enable",		"0"			},
+//	{ "qosl_obw",			""			},	//unused - used qos_obw
+//	{ "qosl_ibw",			""			},	//unused - used qos_obw
+	{ "qosl_rules",			"" 			},
+
 // access restrictions
 	{ "rruleN",				"0"				},
 	{ "rrule0",				"0|1320|300|31|||word text\n^begins-with.domain.\n.ends-with.net$\n^www.exact-domain.net$|0|example" },
diff --git a/release/src/router/rc/Makefile b/release/src/router/rc/Makefile
index e955804bf2..6a95f19e60 100644
--- a/release/src/router/rc/Makefile
+++ b/release/src/router/rc/Makefile
@@ -15,6 +15,7 @@ OBJS += firewall.o ppp.o telssh.o wnas.o
 OBJS += listen.o redial.o led.o qos.o forward.o misc.o mtd.o
 OBJS += buttons.o restrict.o gpio.o sched.o
 OBJS += arpbind.o
+OBJS += qoslimit.o
 #	heartbeat.o
 
 ifeq ($(TCONFIG_USB),y)
diff --git a/release/src/router/rc/firewall.c b/release/src/router/rc/firewall.c
index ec9e0ff8ba..c8ab39e5cd 100644
--- a/release/src/router/rc/firewall.c
+++ b/release/src/router/rc/firewall.c
@@ -559,6 +559,8 @@ static void mangle_table(void)
 	if (wanup) {
 
 		ipt_qos();
+		//1 for mangle
+		ipt_qoslimit(1);
 
 		p = nvram_safe_get("nf_ttl");
 		if (strncmp(p, "c:", 2) == 0) {
@@ -637,6 +639,9 @@ static void nat_table(void)
 		":%s - [0:0]\n",
 		chain_wan_prerouting);
 	
+	//2 for nat
+	ipt_qoslimit(2);
+	
 	if (gateway_mode) {
 		strlcpy(lanaddr, nvram_safe_get("lan_ipaddr"), sizeof(lanaddr));
 		strlcpy(lanmask, nvram_safe_get("lan_netmask"), sizeof(lanmask));
diff --git a/release/src/router/rc/qoslimit.c b/release/src/router/rc/qoslimit.c
new file mode 100644
index 0000000000..90c965d65a
--- /dev/null
+++ b/release/src/router/rc/qoslimit.c
@@ -0,0 +1,377 @@
+/*
+
+	Tomato Firmware
+	Copyright (C) 2006-2008 Jonathan Zarate
+	Copyright (C) 2011 Deon 'PrinceAMD' Thomas 
+	rate limit & connection limit by conanxu
+*/
+
+#include "rc.h"
+
+#include <sys/stat.h>
+static const char *qoslimitfn = "/etc/qoslimit";
+
+/*int  chain
+1 = MANGLE
+2 = NAT
+*/
+
+#define IP_ADDRESS 0
+#define MAC_ADDRESS 1
+#define IP_RANGE 2
+
+void address_checker (int * address_type, char *ipaddr_old, char *ipaddr)
+{
+	char * second_part, *last_dot;
+	int length_to_minus, length_to_dot;
+	
+	second_part = strchr(ipaddr_old, '-');
+	if (second_part != NULL) {
+		/* ip range */
+		*address_type = IP_RANGE;
+		if (strchr(second_part+1, '.') != NULL) {
+			/* long notation */
+			strcpy (ipaddr, ipaddr_old);
+		}
+		else {
+			/* short notation */
+			last_dot = strrchr(ipaddr_old, '.');
+			length_to_minus = second_part - ipaddr_old;
+			length_to_dot = last_dot- ipaddr_old;
+			strncpy(ipaddr, ipaddr_old, length_to_minus + 1);
+			strncpy(ipaddr + length_to_minus + 1, ipaddr, length_to_dot + 1);
+			strcpy(ipaddr + length_to_minus + length_to_dot + 2, second_part +1); 
+		}
+	}
+	else {
+		/* mac address of ipaddres */
+		if (strlen(ipaddr_old) != 17) {
+			/* IP_ADDRESS */
+			*address_type = IP_ADDRESS;
+		}
+		else {
+			/* MAC ADDRESS */
+			*address_type = MAC_ADDRESS;
+		}
+		strcpy (ipaddr, ipaddr_old);
+	}
+}
+		
+void ipt_qoslimit(int chain)
+{
+	char *buf;
+	char *g;
+	char *p;
+	char *ibw,*obw;//bandwidth
+	char seq[4];//mark number
+	int iSeq = 10;
+	char *ipaddr_old;
+	char ipaddr[30];//ip address
+	char *dlrate,*dlceil;//guaranteed rate & maximum rate for download
+	char *ulrate,*ulceil;//guaranteed rate & maximum rate for upload
+	char *priority;//priority
+	char *lanipaddr; //lan ip address
+	char *lanmask; //lan netmask
+	char *tcplimit,*udplimit;//tcp connection limit & udp packets per second
+	char *laninface; // lan interface
+	int priority_num;
+	int i, address_type;
+
+	//qosl is enabled?
+	if (!nvram_get_int("qosl_enable")) return;
+	
+	//read qos1rules from nvram
+	g = buf = strdup(nvram_safe_get("qosl_rules"));
+
+	ibw = nvram_safe_get("qos_ibw");  // Read from QOS setting - KRP
+	obw = nvram_safe_get("qos_obw");  // Read from QOS setting - KRP
+	
+	lanipaddr = nvram_safe_get("lan_ipaddr");
+	lanmask = nvram_safe_get("lan_netmask");
+	laninface = nvram_safe_get("lan_ifname");
+	
+	
+	//MANGLE
+	if (chain == 1)
+	{
+		ipt_write(
+			"-A PREROUTING -j IMQ -i %s --todev 1\n"
+			"-A POSTROUTING -j IMQ -o %s --todev 2\n"
+			,laninface,laninface);
+	}
+	
+	while (g) {
+		/*
+		ipaddr_old<dlrate<dlceil<ulrate<ulceil<priority<tcplimit<udplimit
+		*/
+		if ((p = strsep(&g, ">")) == NULL) break;
+		i = vstrsep(p, "<", &ipaddr_old, &dlrate, &dlceil, &ulrate, &ulceil, &priority, &tcplimit, &udplimit);
+		if (i!=8) continue;
+
+		priority_num = atoi(priority);
+		if ((priority_num < 0) || (priority_num > 5)) continue;
+
+		if (!strcmp(ipaddr_old,"")) continue;
+
+		address_checker (&address_type, ipaddr_old, ipaddr); 
+		sprintf(seq,"%d",iSeq);
+		iSeq++;
+
+		if (!strcmp(dlceil,"")) strcpy(dlceil, dlrate);
+		if (strcmp(dlrate,"") && strcmp(dlceil, "")) {
+			if(chain == 1) {
+				switch (address_type)
+				{
+					case IP_ADDRESS:
+						ipt_write(
+							"-A POSTROUTING ! -s %s/%s -d %s -j MARK --set-mark %s\n"
+							,lanipaddr,lanmask,ipaddr,seq);
+						break;
+					case MAC_ADDRESS:
+						break;
+					case IP_RANGE:
+						ipt_write(
+							"-A POSTROUTING ! -s %s/%s -m iprange --dst-range  %s -j MARK --set-mark %s\n"
+							,lanipaddr,lanmask,ipaddr,seq);
+						break;
+				}
+			}
+		}
+
+		if (!strcmp(ulceil,"")) strcpy(ulceil, ulrate);
+		if (strcmp(ulrate,"") && strcmp(ulceil, "")) {
+			if (chain == 1) {
+				switch (address_type)
+				{
+					case IP_ADDRESS:
+						ipt_write(
+							"-A PREROUTING -s %s ! -d %s/%s -j MARK --set-mark %s\n"
+							,ipaddr,lanipaddr,lanmask,seq);
+						break;
+					case MAC_ADDRESS:
+						ipt_write(
+							"-A PREROUTING -m mac --mac-source %s ! -d %s/%s  -j MARK --set-mark %s\n"
+							,ipaddr,lanipaddr,lanmask,seq);
+						break;
+					case IP_RANGE:
+						ipt_write(
+							"-A PREROUTING -m iprange --src-range %s ! -d %s/%s -j MARK --set-mark %s\n"
+							,ipaddr,lanipaddr,lanmask,seq);
+						break;
+				}
+			}
+		}
+	
+		if(atoi(tcplimit) > 0){
+			if (chain == 2) {
+				switch (address_type)
+				{
+						case IP_ADDRESS:
+							ipt_write(
+							"-A PREROUTING -s %s -p tcp --syn -m connlimit --connlimit-above %s -j DROP\n"
+							,ipaddr,tcplimit);
+							break;
+						case MAC_ADDRESS:
+							ipt_write(
+							"-A PREROUTING -m mac --mac-source %s -p tcp --syn -m connlimit --connlimit-above %s -j DROP\n"
+							,ipaddr,tcplimit);
+							break;
+						case IP_RANGE:
+							ipt_write(
+							"-A PREROUTING -m iprange --src-range %s -p tcp --syn -m connlimit --connlimit-above %s -j DROP\n"
+							,ipaddr,tcplimit);
+							break;
+				}
+			}
+		}
+		if(atoi(udplimit) > 0){
+			if (chain == 2) {
+				switch (address_type)
+				{
+					case IP_ADDRESS:
+						ipt_write(
+							"-A PREROUTING -s %s -p udp -m limit --limit %s/sec -j ACCEPT\n"
+							,ipaddr,udplimit);
+						break;
+					case MAC_ADDRESS:
+						ipt_write(
+							"-A PREROUTING -m mac --mac-source %s -p udp -m limit --limit %s/sec -j ACCEPT\n"
+							,ipaddr,udplimit);
+						break;
+					case IP_RANGE:
+						ipt_write(
+							"-A PREROUTING -m iprange --src-range %s -p udp -m limit --limit %s/sec -j ACCEPT\n"
+							,ipaddr,udplimit);
+						break;
+				}
+			}
+		}
+	}
+	free(buf);
+}
+
+// read nvram into files
+void start_qoslimit(void)
+{
+	FILE *tc;
+	char *buf;
+	char *g;
+	char *p;
+	char *ibw,*obw;//bandwidth
+	char seq[4];//mark number
+	int iSeq = 10;
+	char *ipaddr_old; 
+	char ipaddr[30];//ip address
+	char *dlrate,*dlceil;//guaranteed rate & maximum rate for download
+	char *ulrate,*ulceil;//guaranteed rate & maximum rate for upload
+	char *priority;//priority
+	char *lanipaddr; //lan ip address
+	char *lanmask; //lan netmask
+	char *tcplimit,*udplimit;//tcp connection limit & udp packets per second
+	int priority_num;
+	int i, address_type;
+	int s[6];
+
+	//qosl is enabled?
+	if (!nvram_get_int("qosl_enable")) return;
+
+	//read qosl rules from nvram
+	g = buf = strdup(nvram_safe_get("qosl_rules"));
+
+	ibw = nvram_safe_get("qos_ibw");  // Read from QOS setting - KRP
+	obw = nvram_safe_get("qos_obw");  // Read from QOS setting - KRP
+	
+	lanipaddr = nvram_safe_get("lan_ipaddr");
+	lanmask = nvram_safe_get("lan_netmask");
+	
+	if ((tc = fopen(qoslimitfn, "w")) == NULL) return;
+
+	fprintf(tc,
+		"#!/bin/sh\n"
+		"ip link set imq1 up\n"
+		"ip link set imq2 up\n"
+		"\n"
+		"tc qdisc del dev imq1 root 2>/dev/null\n"
+		"tc qdisc del dev imq2 root 2>/dev/null\n"
+		"tc qdisc del dev br0 root 2>/dev/null\n" //fix me [why should mac get filter here??]
+		"\n"
+		"TCAM=\"tc class add dev br0\"\n" //fix me
+		"TFAM=\"tc filter add dev br0\"\n" //fix me
+		"TQAM=\"tc qdisc add dev br0\"\n" //fix me
+		"\n"
+		"TCA=\"tc class add dev imq2\"\n"
+		"TFA=\"tc filter add dev imq2\"\n"
+		"TQA=\"tc qdisc add dev imq2\"\n"
+		"\n"
+		"SFQ=\"sfq perturb 10\"\n"
+		"\n"
+		"TCAU=\"tc class add dev imq1\"\n"
+		"TFAU=\"tc filter add dev imq1\"\n"
+		"TQAU=\"tc qdisc add dev imq1\"\n"
+		"\n"
+		"tc qdisc add dev imq2 root handle 1: htb\n"
+		"tc class add dev imq2 parent 1: classid 1:1 htb rate %skbit\n"
+		"\n"
+		"tc qdisc add dev br0 root handle 1: htb\n"
+		"tc class add dev br0 parent 1: classid 1:1 htb rate %skbit\n"
+		"\n"
+		"tc qdisc add dev imq1 root handle 1: htb\n"
+		"tc class add dev imq1 parent 1: classid 1:1 htb rate %skbit\n"
+		"\n"
+		,ibw,ibw,obw
+	);
+		
+	while (g) {
+		/*
+		ipaddr_old<dlrate<dlceil<ulrate<ulceil<priority<tcplimit<udplimit
+		*/
+		if ((p = strsep(&g, ">")) == NULL) break;
+		i = vstrsep(p, "<", &ipaddr_old, &dlrate, &dlceil, &ulrate, &ulceil, &priority, &tcplimit, &udplimit);
+		if (i!=8) continue;
+		priority_num = atoi(priority);
+		if ((priority_num < 0) || (priority_num > 5)) continue;
+		if (!strcmp(ipaddr_old,"")) continue;
+
+		address_checker(&address_type, ipaddr_old, ipaddr);
+		sprintf(seq,"%d",iSeq);
+		iSeq++;
+		if (!strcmp(dlceil,"")) strcpy(dlceil, dlrate);
+		if (strcmp(dlrate,"") && strcmp(dlceil, "")) {
+			if (address_type != MAC_ADDRESS) {
+				fprintf(tc,
+					"$TCA parent 1:1 classid 1:%s htb rate %skbit ceil %skbit prio %s\n"
+					"$TQA parent 1:%s handle %s: $SFQ\n"
+					"$TFA parent 1:0 prio %s protocol ip handle %s fw flowid 1:%s\n"
+					"\n"
+					,seq,dlrate,dlceil,priority
+					,seq,seq
+					,priority,seq,seq);
+			}
+			else if (address_type == MAC_ADDRESS ) {
+				sscanf(ipaddr, "%02X:%02X:%02X:%02X:%02X:%02X",&s[0],&s[1],&s[2],&s[3],&s[4],&s[5]);
+				
+				fprintf(tc,
+					"$TCAM parent 1:1 classid 1:%s htb rate %skbit ceil %skbit prio %s\n"
+					"$TQAM parent 1:%s handle %s: $SFQ\n"
+					"$TFAM parent 1:0 protocol ip prio %s u32 match u16 0x0800 0xFFFF at -2 match u32 0x%02X%02X%02X%02X 0xFFFFFFFF at -12 match u16 0x%02X%02X 0xFFFF at -14 flowid 1:%s\n"
+					"\n"
+					,seq,dlrate,dlceil,priority
+					,seq,seq
+					,priority,s[2],s[3],s[4],s[5],s[0],s[1],seq);
+			}
+		}
+		
+		if (!strcmp(ulceil,"")) strcpy(ulceil, dlrate);
+		if (strcmp(ulrate,"") && strcmp(ulceil, "")) {
+			fprintf(tc,
+				"$TCAU parent 1:1 classid 1:%s htb rate %skbit ceil %skbit prio %s\n"
+				"$TQAU parent 1:%s handle %s: $SFQ\n"
+				"$TFAU parent 1:0 prio %s protocol ip handle %s fw flowid 1:%s\n"
+				"\n"
+				,seq,ulrate,ulceil,priority
+				,seq,seq
+				,priority,seq,seq);
+		}
+	}
+	free(buf);
+
+	fclose(tc);
+	chmod(qoslimitfn, 0700);
+	
+	//fake start
+	eval((char *)qoslimitfn, "start");
+}
+
+void stop_qoslimit(void)
+{
+	FILE *f;
+	char *s = "/tmp/stop_qoslimittc.sh";
+
+	if ((f = fopen(s, "w")) == NULL) return;
+
+	fprintf(f,
+		"#!/bin/sh\n"
+		"tc qdisc del dev imq2 root\n"
+		"tc qdisc del dev imq1 root\n"
+		"tc qdisc del dev br0 root\n" 	//fix me
+		"ip link set imq1 down\n"
+		"ip link set imq2 down\n"	//take imq's down - Toastman
+
+		"\n"
+	);
+
+	fclose(f);
+	chmod(s, 0700);
+	//fake stop
+	eval((char *)s, "stop");
+}
+/*
+
+PREROUTING (mn) ----> x ----> FORWARD (f) ----> + ----> POSTROUTING (n)
+           QD         |                         ^
+                      |                         |
+                      v                         |
+                    INPUT (f)                 OUTPUT (mnf)
+
+
+*/
diff --git a/release/src/router/rc/rc.h b/release/src/router/rc/rc.h
index 008206e598..bdf7aab919 100644
--- a/release/src/router/rc/rc.h
+++ b/release/src/router/rc/rc.h
@@ -475,6 +475,11 @@ static inline void stop_vpn_eas() { }
 #define write_vpn_resolv(f) (0)
 #endif
 
+// qoslimit.c
+extern void ipt_qoslimit(int chain);
+extern void start_qoslimit(void);
+extern void stop_qoslimit(void);
+
 // arpbind.c
 extern void start_arpbind(void);
 extern void stop_arpbind(void);
diff --git a/release/src/router/rc/services.c b/release/src/router/rc/services.c
index b258afd4f1..399dad4597 100644
--- a/release/src/router/rc/services.c
+++ b/release/src/router/rc/services.c
@@ -2239,6 +2239,17 @@ TOP:
 		goto CLEAR;
 	}
 
+	if (strcmp(service, "qoslimit") == 0) {
+		if (action & A_STOP) {
+			stop_qoslimit();
+		}
+		stop_firewall(); start_firewall();		// always restarted
+		if (action & A_START) {
+			start_qoslimit();
+		}
+		goto CLEAR;
+	}
+
 	if (strcmp(service, "upnp") == 0) {
 		if (action & A_STOP) {
 			stop_upnp();
diff --git a/release/src/router/rc/wan.c b/release/src/router/rc/wan.c
index 2b1a5c9d4e..3c39abd518 100644
--- a/release/src/router/rc/wan.c
+++ b/release/src/router/rc/wan.c
@@ -937,6 +937,7 @@ void start_wan_done(char *wan_ifname)
 	start_dnsmasq();
 	start_firewall();
 	start_qos();
+	start_qoslimit();
 	start_arpbind();
 
 
@@ -1030,6 +1031,7 @@ void stop_wan(void)
 #endif
 	stop_vpn_eas();
 	stop_arpbind();
+	stop_qoslimit();
 	stop_qos();
 	stop_upnp();	//!!TB - moved from stop_services()
 	stop_firewall();
diff --git a/release/src/router/www/about.asp b/release/src/router/www/about.asp
index 198e84aa2e..6e4da902db 100644
--- a/release/src/router/www/about.asp
+++ b/release/src/router/www/about.asp
@@ -146,7 +146,6 @@ Captive Portal Copyright (C) 2011 Ofer Chen & Vicente Soriano<br>
 Copyright (C) 2011 Michał Rupental<br>
 <a href='http://openlinksys.info' target='_new'>http://openlinksys.info</a><br>
 <br>
-
 <!-- JYAVENARD-BEGIN -->
 <b>"JYAvenard" Features:</b><br>
 <!-- OPENVPN-BEGIN -->
@@ -159,7 +158,6 @@ Copyright (C) 2010-2011 Jean-Yves Avenard<br>
 <a href='mailto:jean-yves@avenard.org'>jean-yves@avenard.org</a><br>
 <br>
 <!-- JYAVENARD-END -->
-
 <b>"Teaman" Features:</b><br>
 - QOS-detailed & ctrate improved filters<br>
 - Per-IP bandwidth monitoring of LAN clients [cstats v2]<br>
@@ -188,6 +186,7 @@ Copyright (C) 2012 Tiomo<br>
 - 250 entry limit in Static DHCP  & Wireless Filter<br>
 - 500 entry limit in Access Restriction rules<br>
 - Up to 80 QOS rules<br>
+- IMQ based QOS/Bandwidth Limiter<br>
 - Configurable QOS class names<br>
 - Comprehensive QOS rule examples set by default<br>
 - GPT support for HDD by Yaniv Hamo<br>
diff --git a/release/src/router/www/bwm-common.js b/release/src/router/www/bwm-common.js
index a4595e7420..a9ba0cb4f9 100644
--- a/release/src/router/www/bwm-common.js
+++ b/release/src/router/www/bwm-common.js
@@ -233,6 +233,14 @@ REMOVE-END */
 				t = 'WL <small>(' + i + ')</small>';
 			}
 
+			if (i == 'imq1')	{
+				t = 'Lim. OUT <small>(' + i + ')</small>';
+			}
+
+			if (i == 'imq2')	{
+				t = 'Lim. IN <small>(' + i + ')</small>';
+			}
+
 			else if ((nvram.wan_proto == 'pptp') || (nvram.wan_proto == 'pppoe') || (nvram.wan_proto == 'l2tp') || (nvram.wan_proto == 'ppp3g')) {
 				if (nvram.wan_iface == i) t = 'WAN <small>(' + i + ')</small>';
 				else if (nvram.wan_ifname == i && ((nvram.wan_proto != 'pppoe') && (nvram.wan_proto != 'ppp3g'))) t = 'MAN <small>(' + i + ')</small>';
diff --git a/release/src/router/www/qos-qoslimit.asp b/release/src/router/www/qos-qoslimit.asp
new file mode 100644
index 0000000000..cea186fd00
--- /dev/null
+++ b/release/src/router/www/qos-qoslimit.asp
@@ -0,0 +1,277 @@
+<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.0//EN'>
+<!--
+	Tomato GUI
+	Copyright (C) 2006-2008 Jonathan Zarate
+	http://www.polarcloud.com/tomato/
+
+	Copyright (C) 2011 Deon 'PrinceAMD' Thomas 
+	rate limit & connection limit from Conanxu, 
+	adapted by Victek, Shibby, PrinceAMD, Phykris
+
+	For use with Tomato Firmware only.
+	No part of this file may be used without permission.
+-->
+<html>
+<head>
+<meta http-equiv='content-type' content='text/html;charset=utf-8'>
+<meta name='robots' content='noindex,nofollow'>
+<title>[<% ident(); %>] QoS - Bandwidth Limiter</title>
+<link rel='stylesheet' type='text/css' href='tomato.css'>
+<link rel='stylesheet' type='text/css' href='color.css'>
+<script type='text/javascript' src='tomato.js'></script>
+
+<!-- / / / -->
+<style type='text/css'>
+#qosg-grid {
+	width: 100%;
+}
+#qosg-grid .co1 {
+	width: 30%;
+}
+#qosg-grid .co2,
+#qosg-grid .co3,
+#qosg-grid .co4,
+#qosg-grid .co5,
+#qosg-grid .co6,
+#qosg-grid .co7,
+#qosg-grid .co8 {
+	width: 10%;
+}
+</style>
+
+<script type='text/javascript' src='debug.js'></script>
+
+<script type='text/javascript'>
+// <% nvram("qosl_enable,qos_ibw,qos_obw,qosl_rules,lan_ipaddr,lan_netmask"); %>
+
+var class_prio = [['0','Highest'],['1','High'],['2','Normal'],['3','Low'],['4','Lowest']];
+var class_tcp = [['0','nolimit']];
+var class_udp = [['0','nolimit']];
+for (var i = 1; i <= 100; ++i) {
+	class_tcp.push([i*10, i*10+'']);
+	class_udp.push([i, i + '/s']);
+}
+var qosg = new TomatoGrid();
+
+qosg.setup = function() {
+	this.init('qosg-grid', '', 80, [
+		{ type: 'text', maxlen: 31 },
+		{ type: 'text', maxlen: 6 },
+		{ type: 'text', maxlen: 6 },
+		{ type: 'text', maxlen: 6 },
+		{ type: 'text', maxlen: 6 },
+		{ type: 'select', options: class_prio },
+		{ type: 'select', options: class_tcp },
+		{ type: 'select', options: class_udp }]);
+	this.headerSet(['IP | IP Range | MAC Address', 'DLRate', 'DLCeil', 'ULRate', 'ULCeil', 'Priority', 'TCP Limit', 'UDP Limit']);
+	var qoslimitrules = nvram.qosl_rules.split('>');
+	for (var i = 0; i < qoslimitrules.length; ++i) {
+		var t = qoslimitrules[i].split('<');
+		if (t.length == 8) this.insertData(-1, t);
+	}
+	this.showNewEditor();
+	this.resetNewEditor();
+}
+
+qosg.dataToView = function(data) {
+	return [data[0],data[1]+'kbps',data[2]+'kbps',data[3]+'kbps',data[4]+'kbps',class_prio[data[5]*1][1],class_tcp[data[6]*1/10][1],class_udp[data[7]*1][1]];
+}
+
+qosg.resetNewEditor = function() {
+	var f, c, n;
+
+	var f = fields.getAll(this.newEditor);
+	ferror.clearAll(f);
+	if ((c = cookie.get('addqoslimit')) != null) {
+		cookie.set('addqoslimit', '', 0);
+		c = c.split(',');
+		if (c.length == 2) {
+	f[0].value = c[0];
+	f[1].value = '';
+	f[2].value = '';
+	f[3].value = '';
+	f[4].value = '';
+	f[5].selectedIndex = '2';
+	f[6].selectedIndex = '0';
+	f[7].selectedIndex = '0';
+	return;
+		}
+	}
+
+	f[0].value = '';
+	f[1].value = '';
+	f[2].value = '';
+	f[3].value = '';
+	f[4].value = '';
+	f[5].selectedIndex = '2';
+	f[6].selectedIndex = '0';
+	f[7].selectedIndex = '0';
+	
+	}
+
+qosg.exist = function(f, v)
+{
+	var data = this.getAllData();
+	for (var i = 0; i < data.length; ++i) {
+		if (data[i][f] == v) return true;
+	}
+	return false;
+}
+
+qosg.existID = function(id)
+{
+	return this.exist(0, id);
+}
+
+qosg.existIP = function(ip)
+{
+	if (ip == "0.0.0.0") return true;
+	return this.exist(1, ip);
+}
+
+qosg.checkRate = function(rate)
+{
+	var s = parseInt(rate, 10);
+	if( isNaN(s) || s <= 0 || a >= 100000 ) return true;
+	return false;
+}
+
+qosg.checkRateCeil = function(rate, ceil)
+{
+	var r = parseInt(rate, 10);
+	var c = parseInt(ceil, 10);
+	if( r > c ) return true;
+	return false;
+}
+
+qosg.verifyFields = function(row, quiet)
+{
+	var ok = 1;
+	var f = fields.getAll(row);
+	var s;
+
+	if(v_macip(f[0], quiet, 0, nvram.lan_ipaddr, nvram.lan_netmask)) {
+		if(this.existIP(f[0].value)) {
+			ferror.set(f[0], 'duplicate IP or MAC address', quiet);
+			ok = 0;
+		}
+	}
+     
+	if( this.checkRate(f[1].value)) {
+		ferror.set(f[1], 'DLRate must between 1 and 99999', quiet);
+		ok = 0;
+	}
+
+	if( this.checkRate(f[2].value)) {
+		ferror.set(f[2], 'DLCeil must between 1 and 99999', quiet);
+		ok = 0;
+	}
+
+	if( this.checkRateCeil(f[1].value, f[2].value)) {
+		ferror.set(f[2], 'DLCeil must be greater than DLRate', quiet);
+		ok = 0;
+	}
+
+	if( this.checkRate(f[3].value)) {
+		ferror.set(f[3], 'ULRate must between 1 and 99999', quiet);
+		ok = 0;
+	}
+
+	if( this.checkRate(f[4].value)) {
+		ferror.set(f[4], 'ULCeil must between 1 and 99999', quiet);
+		ok = 0;
+	}
+
+	if( this.checkRateCeil(f[3].value, f[4].value)) {
+		ferror.set(f[4], 'ULCeil must be greater than ULRate', quiet);
+		ok = 0;
+	}
+
+	return ok;
+}
+
+function verifyFields(focused, quiet)
+{
+	var a = !E('_f_qosl_enable').checked;
+
+	E('_qos_ibw').disabled = a;
+	E('_qos_obw').disabled = a;
+
+	elem.display(PR('_qos_ibw'), PR('_qos_obw'), !a);
+
+	return 1;
+}
+
+function save()
+{
+	if (qosg.isEditing()) return;
+
+	var data = qosg.getAllData();
+	var qoslimitrules = '';
+	var i;
+
+    if (data.length != 0) qoslimitrules += data[0].join('<');	
+	for (i = 1; i < data.length; ++i) {
+		qoslimitrules += '>' + data[i].join('<');
+	}
+
+	var fom = E('_fom');
+	fom.qosl_enable.value = E('_f_qosl_enable').checked ? 1 : 0;
+	fom.qosl_rules.value = qoslimitrules;
+	form.submit(fom, 1);
+}
+
+function init()
+{
+	qosg.recolor();
+}
+</script>
+</head>
+<body onload='init()'>
+<form id='_fom' method='post' action='tomato.cgi'>
+<table id='container' cellspacing=0>
+<tr><td colspan=2 id='header'>
+	<div class='title'>Tomato</div>
+	<div class='version'>Version <% version(); %></div>
+</td></tr>
+<tr id='body'><td id='navi'><script type='text/javascript'>navi()</script></td>
+<td id='content'>
+<div id='ident'><% ident(); %></div>
+
+<!-- / / / -->
+
+<input type='hidden' name='_nextpage' value='qos-qoslimit.asp'>
+<input type='hidden' name='_nextwait' value='10'>
+<input type='hidden' name='_service' value='qoslimit-restart'>
+
+<input type='hidden' name='qosl_enable'>
+<input type='hidden' name='qosl_rules'>
+
+<div id='qoslimit'>
+
+	<div class='section-title'>Bandwidth Limiter - QOS</div>
+	<div class='section'>
+		<script type='text/javascript'>
+			createFieldTable('', [
+			{ title: 'Enable Limiter', name: 'f_qosl_enable', type: 'checkbox', value: nvram.qosl_enable != '0' },
+			{ title: 'Max Download Bandwidth <small>(also used by QOS)', name: 'qos_ibw', type: 'text', maxlen: 6, size: 8, suffix: ' <small>kbit/s</small>', value: nvram.qos_ibw },
+			{ title: 'Max Upload Bandwidth <small>(also used by QOS)', name: 'qos_obw', type: 'text', maxlen: 6, size: 8, suffix: ' <small>kbit/s</small>', value: nvram.qos_obw }
+			]);
+		</script>
+		<br>
+		<table class='tomato-grid' id='qosg-grid'></table>
+		<div>
+
+<!-- / / / -->
+
+</td></tr>
+<tr><td id='footer' colspan=2>
+	<span id='footer-msg'></span>
+	<input type='button' value='Save' id='save-button' onclick='save()'>
+	<input type='button' value='Cancel' id='cancel-button' onclick='reloadPage();'>
+</td></tr>
+</table>
+</form>
+<script type='text/javascript'>qosg.setup(); verifyFields(null, 1);</script>
+</body>
+</html>
diff --git a/release/src/router/www/status-devices.asp b/release/src/router/www/status-devices.asp
index a0cce85c87..a7b84c8e40 100644
--- a/release/src/router/www/status-devices.asp
+++ b/release/src/router/www/status-devices.asp
@@ -151,6 +151,13 @@ function addWF(n)
 	location.href = 'basic-wfilter.asp';
 }
 
+function addqoslimit(n)
+{
+	var e = list[n];
+	cookie.set('addqoslimit', [e.ip, e.name.split(',')[0]].join(','), 1);
+	location.href = 'qos-qoslimit.asp';
+}
+
 var ref = new TomatoRefresh('update.cgi', 'exec=devlist', 0, 'status_devices_refresh');
 
 ref.refresh = function(text)
@@ -284,7 +291,8 @@ dg.populate = function()
 		if (e.mac.match(/^(..):(..):(..)/)) {
 			b += '<br><small>' +
 				'<a href="http://standards.ieee.org/cgi-bin/ouisearch?' + RegExp.$1 + '-' + RegExp.$2 + '-' + RegExp.$3 + '" target="_new" title="OUI Search">[oui]</a> ' +
-				'<a href="javascript:addStatic(' + i + ')" title="Static Lease...">[static]</a>';
+				'<a href="javascript:addStatic(' + i + ')" title="Static Lease...">[static]</a>' +
+				'<a href="javascript:addqoslimit(' + i + ')" title="QoS BW Limiter">[qoslimit]</a>';
 
 			if (e.rssi != '') {
 				b += ' <a href="javascript:addWF(' + i + ')" title="Wireless Filter...">[wfilter]</a>';
@@ -377,4 +385,3 @@ createFieldTable('', f);
 </body>
 </html>
 
-
diff --git a/release/src/router/www/tomato.js b/release/src/router/www/tomato.js
index 9ea4b63d87..5a6836ef41 100644
--- a/release/src/router/www/tomato.js
+++ b/release/src/router/www/tomato.js
@@ -2402,7 +2402,8 @@ REMOVE-END */
 			['Classification',	'classify.asp'],
 			['View Graphs',		'graphs.asp'],
 			['View Details',	'detailed.asp'],
-			['Transfer Rates',	'ctrate.asp'] ] ],
+			['Transfer Rates',	'ctrate.asp'],
+			['B/W Limiter',		'qoslimit.asp'] ] ],
 		['Access Restriction',		'restrict.asp'],
 
 /* NOCAT-BEGIN */
-- 
2.11.4.GIT