2 # Written by Marco Bonetti & Mike Perry
3 # Based on instructions from Dan Singletary's ADSL BW Management HOWTO:
4 # http://www.faqs.org/docs/Linux-HOWTO/ADSL-Bandwidth-Management-HOWTO.html
5 # This script is Public Domain.
7 ############################### README #################################
9 # This script provides prioritization of Tor traffic below other
10 # traffic on a Linux server. It has two modes of operation: UID based
13 # UID BASED PRIORITIZATION
15 # The UID based method requires that Tor be launched from
16 # a specific user ID. The "User" Tor config setting is
17 # insufficient, as it sets the UID after the socket is created.
18 # Here is a C wrapper you can use to execute Tor and drop privs before
19 # it creates any sockets.
22 # gcc -DUID=`id -u tor` -DGID=`id -g tor` tor_wrap.c -o tor_wrap
25 # int main(int argc, char **argv) {
26 # if(initgroups("tor", GID) == -1) { perror("initgroups"); return 1; }
27 # if(setresgid(GID, GID, GID) == -1) { perror("setresgid"); return 1; }
28 # if(setresuid(UID, UID, UID) == -1) { perror("setresuid"); return 1; }
29 # execl("/bin/tor", "/bin/tor", "-f", "/etc/tor/torrc", NULL);
30 # perror("execl"); return 1;
33 # IP BASED PRIORITIZATION
35 # The IP setting requires that a separate IP address be dedicated to Tor.
36 # Your Torrc should be set to bind to this IP for "OutboundBindAddress",
37 # "ListenAddress", and "Address".
41 # You should also tune the individual connection rate parameters below
42 # to your individual connection. In particular, you should leave *some*
43 # minimum amount of bandwidth for Tor, so that Tor users are not
44 # completely choked out when you use your server's bandwidth. 30% is
45 # probably a reasonable choice. More is better of course.
47 # To start the shaping, run it as:
50 # To get status information (useful to verify packets are getting marked
51 # and prioritized), run:
52 # ./linux-tor-prio.sh status
54 # And to stop prioritization:
55 # ./linux-tor-prio.sh stop
57 ########################################################################
59 # BEGIN USER TUNABLE PARAMETERS
63 # NOTE! You must START Tor under this UID. Using the Tor User
64 # config setting is NOT sufficient. See above.
67 # If the UID mechanism doesn't work for you, you can set this parameter
68 # instead. If set, it will take precedence over the UID setting. Note that
69 # you need multiple IPs with one specifically devoted to Tor for this to
73 # Average ping to most places on the net, milliseconds
76 # RATE_UP must be less than your connection's upload capacity in
77 # kbits/sec. If it is larger, then the bottleneck will be at your
78 # router's queue, which you do not control. This will cause congestion
79 # and a revert to normal TCP fairness no matter what the queing
83 # RATE_UP_TOR is the minimum speed your Tor connections will have in
84 # kbits/sec. They will have at least this much bandwidth for upload.
85 # In general, you probably shouldn't set this too low, or else Tor
86 # users who use your node will be completely choked out whenever your
87 # machine does any other network activity. That is not very fun.
90 # RATE_UP_TOR_CEIL is the maximum rate allowed for all Tor traffic in
99 AVG_PKT
=900 # should be more like 600 for non-exit nodes
101 # END USER TUNABLE PARAMETERS
105 # The queue size should be no larger than your bandwidth-delay
106 # product. This is RT latency*bandwidth/MTU/2
108 BDP
=$
(expr $RTT_LATENCY \
* $RATE_UP / $AVG_PKT)
110 # Further research indicates that the BDP calculations should use
111 # RTT/sqrt(n) where n is the expected number of active connections..
115 if [ "$1" = "status" ]
118 tc
-s qdisc show dev
$DEV
119 tc
-s qdisc show dev imq0
121 tc
-s class show dev
$DEV
122 tc
-s class show dev imq0
124 tc
-s filter show dev
$DEV
125 tc
-s filter show dev imq0
127 iptables
-t mangle
-L TORSHAPER-OUT
-v -x 2> /dev
/null
132 # Reset everything to a known state (cleared)
133 tc qdisc del dev
$DEV root
2> /dev
/null
> /dev
/null
134 tc qdisc del dev imq0 root
2> /dev
/null
> /dev
/null
135 iptables
-t mangle
-D POSTROUTING
-o $DEV -j TORSHAPER-OUT
2> /dev
/null
> /dev
/null
136 iptables
-t mangle
-D PREROUTING
-o $DEV -j TORSHAPER-OUT
2> /dev
/null
> /dev
/null
137 iptables
-t mangle
-D OUTPUT
-o $DEV -j TORSHAPER-OUT
2> /dev
/null
> /dev
/null
138 iptables
-t mangle
-F TORSHAPER-OUT
2> /dev
/null
> /dev
/null
139 iptables
-t mangle
-X TORSHAPER-OUT
2> /dev
/null
> /dev
/null
140 ip link
set imq0 down
2> /dev
/null
> /dev
/null
141 rmmod imq
2> /dev
/null
> /dev
/null
145 echo "Shaping removed on $DEV."
149 # Outbound Shaping (limits total bandwidth to RATE_UP)
151 ip link
set dev
$DEV qlen
$BDP
153 # Add HTB root qdisc, default is high prio
154 tc qdisc add dev
$DEV root handle
1: htb default
20
156 # Add main rate limit class
157 tc class add dev
$DEV parent
1: classid
1:1 htb rate
${RATE_UP}kbit
159 # Create the two classes, giving Tor at least RATE_UP_TOR kbit and capping
160 # total upstream at RATE_UP so the queue is under our control.
161 tc class add dev
$DEV parent
1:1 classid
1:20 htb rate $
(expr $RATE_UP - $RATE_UP_TOR)kbit ceil
${RATE_UP}kbit prio
0
162 tc class add dev
$DEV parent
1:1 classid
1:21 htb rate $
[$RATE_UP_TOR]kbit ceil
${RATE_UP_TOR_CEIL}kbit prio
10
165 tc qdisc add dev
$DEV parent
1:20 handle
20: pfifo limit
$BDP
166 tc qdisc add dev
$DEV parent
1:21 handle
21: pfifo limit
$BDP
168 # filter traffic into classes by fwmark
169 tc filter add dev
$DEV parent
1:0 prio
0 protocol ip handle
20 fw flowid
1:20
170 tc filter add dev
$DEV parent
1:0 prio
0 protocol ip handle
21 fw flowid
1:21
172 # add TORSHAPER-OUT chain to the mangle table in iptables
173 iptables
-t mangle
-N TORSHAPER-OUT
174 iptables
-t mangle
-I $CHAIN -o $DEV -j TORSHAPER-OUT
178 # Low priority to Tor
179 if [ ""$TOR_IP == "" ]
181 echo "Using UID-based QoS. UID $TOR_UID marked as low priority."
182 iptables
-t mangle
-A TORSHAPER-OUT
-m owner
--uid-owner $TOR_UID -j MARK
--set-mark 21
184 echo "Using IP-based QoS. $TOR_IP marked as low priority."
185 iptables
-t mangle
-A TORSHAPER-OUT
-s $TOR_IP -j MARK
--set-mark 21
188 # High prio for everything else
189 iptables
-t mangle
-A TORSHAPER-OUT
-m mark
--mark 0 -j MARK
--set-mark 20
191 echo "Outbound shaping added to $DEV. Rate for Tor upload at least: ${RATE_UP_TOR}Kbyte/sec."