contrib/linux-tor-prio.sh

   1 #!/bin/bash
   2 # Written by Marco Bonetti & Mike Perry
   3 # Based on instructions from Dan Singletary's ADSL BW Management HOWTO:
   4 # http://www.faqs.org/docs/Linux-HOWTO/ADSL-Bandwidth-Management-HOWTO.html
   5 # This script is Public Domain.
   6
   7 ############################### README #################################
   8
   9 # This script provides prioritization of Tor traffic below other
  10 # traffic on a Linux server. It has two modes of operation: UID based
  11 # and IP based. The UID based method requires that Tor be launched from
  12 # a specific user ID. The "User" and "Group" Tor config settings are
  13 # insufficient, as they set the UID after the socket is created.
  14 # Here is a three line C wrapper you can use to execute Tor and drop
  15 # privs to UID 501 before it creates any sockets. Change the UID
  16 # to the UID for your tor server user, and compile with
  17 # 'gcc tor_wrap.c -o tor_wrap':
  18
  19 # #include <unistd.h>
  20 # int main(int argc, char **argv) {
  21 # if(setresuid(501, 501, 501) == -1) { perror("setresuid"); return 1; }
  22 # execl("/bin/tor", "/bin/tor", "-f", "/etc/tor/torrc", NULL);
  23 # perror("execl"); return 1;
  24 # }
  25
  26 # The IP setting requires that a separate IP address be dedicated to Tor.
  27 # Your Torrc should be set to bind to this IP for "OutboundBindAddress",
  28 # "ListenAddress", and "Address".
  29
  30 # You should also tune the individual connection rate parameters below
  31 # to your individual connection. In particular, you should leave *some*
  32 # minimum amount of bandwidth for Tor, so that Tor users are not
  33 # completely choked out when you use your server's bandwidth. 30% is
  34 # probably a polite choice.
  35
  36 # To start the shaping, run it as:
  37 #   ./linux-tor-prio.sh
  38
  39 # To get status information (useful to verify packets are getting marked
  40 # and prioritized), run:
  41 #   ./linux-tor-prio.sh status
  42
  43 # And to stop prioritization:
  44 #   ./linux-tor-prio.sh stop
  45
  46 ########################################################################
  47
  48 # BEGIN USER TUNABLE PARAMETERS
  49
  50 DEV=eth0
  51
  52 # NOTE! You must START Tor under this UID. Using the Tor User/Group
  53 # config setting is NOT sufficient.
  54 TOR_UID=$(id -u tor)
  55
  56 # If the UID mechanism doesn't work for you, you can set this parameter
  57 # instead. If set, it will take precedence over the UID setting. Note that
  58 # you need multiple IPs for this to work.
  59 #TOR_IP="42.42.42.42"
  60
  61 # Average ping to most places on the net, milliseconds
  62 RTT_LATENCY=40
  63
  64 # RATE_UP must be less than your connection's upload capacity. If it is
  65 # larger, then the bottleneck will be at your router's queue, which you
  66 # do not control. This will cause congestion and a revert to normal TCP
  67 # fairness no matter what the queing priority is.
  68 RATE_UP=5000
  69
  70 # RATE_UP_TOR is the minimum speed your Tor connections will have.
  71 # They will have at least this much bandwidth for upload. In general,
  72 # you probably shouldn't set this too low, or else Tor users who use
  73 # your node will be completely choked out whenever your machine
  74 # does any other network activity. That is not very fun.
  75 RATE_UP_TOR=1500
  76
  77 # RATE_UP_TOR_CEIL is the maximum rate allowed for all Tor trafic
  78 RATE_UP_TOR_CEIL=5000
  79
  80 CHAIN=OUTPUT
  81 #CHAIN=PREROUTING
  82 #CHAIN=POSTROUTING
  83
  84 MTU=1500
  85 AVG_PKT=900 # should be more like 600 for non-exit nodes
  86
  87 # END USER TUNABLE PARAMETERS
  88
  89 # The queue size should be no larger than your bandwidth-delay
  90 # product. This is RT latency*bandwidth/MTU/2
  91
  92 BDP=$(expr $RTT_LATENCY \* $RATE_UP / $AVG_PKT)
  93
  94 # Further research indicates that the BDP calculations should use
  95 # RTT/sqrt(n) where n is the expected number of active connections..
  96
  97 BDP=$(expr $BDP / 4)
  98
  99 if [ "$1" = "status" ]
 100 then
 101         echo "[qdisc]"
 102         tc -s qdisc show dev $DEV
 103         tc -s qdisc show dev imq0
 104         echo "[class]"
 105         tc -s class show dev $DEV
 106         tc -s class show dev imq0
 107         echo "[filter]"
 108         tc -s filter show dev $DEV
 109         tc -s filter show dev imq0
 110         echo "[iptables]"
 111         iptables -t mangle -L TORSHAPER-OUT -v -x 2> /dev/null
 112         exit
 113 fi
 114
 115
 116 # Reset everything to a known state (cleared)
 117 tc qdisc del dev $DEV root 2> /dev/null > /dev/null
 118 tc qdisc del dev imq0 root 2> /dev/null > /dev/null
 119 iptables -t mangle -D POSTROUTING -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
 120 iptables -t mangle -D PREROUTING -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
 121 iptables -t mangle -D OUTPUT -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
 122 iptables -t mangle -F TORSHAPER-OUT 2> /dev/null > /dev/null
 123 iptables -t mangle -X TORSHAPER-OUT 2> /dev/null > /dev/null
 124 ip link set imq0 down 2> /dev/null > /dev/null
 125 rmmod imq 2> /dev/null > /dev/null
 126
 127 if [ "$1" = "stop" ]
 128 then
 129         echo "Shaping removed on $DEV."
 130         exit
 131 fi
 132
 133 # Outbound Shaping (limits total bandwidth to RATE_UP)
 134
 135 ip link set dev $DEV qlen $BDP
 136
 137 # Add HTB root qdisc, default is high prio
 138 tc qdisc add dev $DEV root handle 1: htb default 20
 139
 140 # Add main rate limit class
 141 tc class add dev $DEV parent 1: classid 1:1 htb rate ${RATE_UP}kbit
 142
 143 # Create the two classes, giving Tor at least RATE_UP_TOR kbit and capping
 144 # total upstream at RATE_UP so the queue is under our control.
 145 tc class add dev $DEV parent 1:1 classid 1:20 htb rate $(expr $RATE_UP - $RATE_UP_TOR)kbit ceil ${RATE_UP}kbit prio 0
 146 tc class add dev $DEV parent 1:1 classid 1:21 htb rate $[$RATE_UP_TOR]kbit ceil ${RATE_UP_TOR_CEIL}kbit prio 10
 147
 148 # Start up pfifo
 149 tc qdisc add dev $DEV parent 1:20 handle 20: pfifo limit $BDP
 150 tc qdisc add dev $DEV parent 1:21 handle 21: pfifo limit $BDP
 151
 152 # filter traffic into classes by fwmark
 153 tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
 154 tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
 155
 156 # add TORSHAPER-OUT chain to the mangle table in iptables
 157 iptables -t mangle -N TORSHAPER-OUT
 158 iptables -t mangle -I $CHAIN -o $DEV -j TORSHAPER-OUT
 159
 160
 161 # Set firewall marks
 162 # Low priority to Tor
 163 if [ ""$TOR_IP == "" ]
 164 then
 165         echo "Using UID-based QoS. UID $TOR_UID marked as low priority."
 166         iptables -t mangle -A TORSHAPER-OUT -m owner --uid-owner $TOR_UID -j MARK --set-mark 21
 167 else
 168         echo "Using IP-based QoS. $TOR_IP marked as low priority."
 169         iptables -t mangle -A TORSHAPER-OUT -s $TOR_IP -j MARK --set-mark 21
 170 fi
 171
 172 # High prio for everything else
 173 iptables -t mangle -A TORSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 20
 174
 175 echo "Outbound shaping added to $DEV.  Rate for Tor upload at least: ${RATE_UP_TOR}Kbyte/sec."
 176