contrib/linux-tor-prio.sh

   1 #!/bin/bash
   2 # Written by Marco Bonetti & Mike Perry
   3 # Based on instructions from Dan Singletary's ADSL BW Management HOWTO:
   4 # http://www.faqs.org/docs/Linux-HOWTO/ADSL-Bandwidth-Management-HOWTO.html
   5 # This script is Public Domain.
   6
   7 ############################### README #################################
   8
   9 # This script provides prioritization of Tor traffic below other
  10 # traffic on a Linux server. It has two modes of operation: UID based
  11 # and IP based.
  12
  13 # UID BASED PRIORITIZATION
  14 #
  15 # The UID based method requires that Tor be launched from
  16 # a specific user ID. The "User" Tor config setting is
  17 # insufficient, as it sets the UID after the socket is created.
  18 # Here is a C wrapper you can use to execute Tor and drop privs before
  19 # it creates any sockets.
  20 #
  21 # Compile with:
  22 # gcc -DUID=`id -u tor` -DGID=`id -g tor` tor_wrap.c -o tor_wrap
  23 #
  24 # #include <unistd.h>
  25 # int main(int argc, char **argv) {
  26 # if(initgroups("tor", GID) == -1) { perror("initgroups"); return 1; }
  27 # if(setresgid(GID, GID, GID) == -1) { perror("setresgid"); return 1; }
  28 # if(setresuid(UID, UID, UID) == -1) { perror("setresuid"); return 1; }
  29 # execl("/bin/tor", "/bin/tor", "-f", "/etc/tor/torrc", NULL);
  30 # perror("execl"); return 1;
  31 # }
  32
  33 # IP BASED PRIORITIZATION
  34 #
  35 # The IP setting requires that a separate IP address be dedicated to Tor.
  36 # Your Torrc should be set to bind to this IP for "OutboundBindAddress",
  37 # "ListenAddress", and "Address".
  38
  39 # GENERAL USAGE
  40 #
  41 # You should also tune the individual connection rate parameters below
  42 # to your individual connection. In particular, you should leave *some*
  43 # minimum amount of bandwidth for Tor, so that Tor users are not
  44 # completely choked out when you use your server's bandwidth. 30% is
  45 # probably a reasonable choice. More is better of course.
  46 #
  47 # To start the shaping, run it as:
  48 #   ./linux-tor-prio.sh
  49 #
  50 # To get status information (useful to verify packets are getting marked
  51 # and prioritized), run:
  52 #   ./linux-tor-prio.sh status
  53 #
  54 # And to stop prioritization:
  55 #   ./linux-tor-prio.sh stop
  56 #
  57 ########################################################################
  58
  59 # BEGIN USER TUNABLE PARAMETERS
  60
  61 DEV=eth0
  62
  63 # NOTE! You must START Tor under this UID. Using the Tor User
  64 # config setting is NOT sufficient. See above.
  65 TOR_UID=$(id -u tor)
  66
  67 # If the UID mechanism doesn't work for you, you can set this parameter
  68 # instead. If set, it will take precedence over the UID setting. Note that
  69 # you need multiple IPs with one specifically devoted to Tor for this to
  70 # work.
  71 #TOR_IP="42.42.42.42"
  72
  73 # Average ping to most places on the net, milliseconds
  74 RTT_LATENCY=40
  75
  76 # RATE_UP must be less than your connection's upload capacity in
  77 # kbits/sec. If it is larger, then the bottleneck will be at your
  78 # router's queue, which you do not control. This will cause congestion
  79 # and a revert to normal TCP fairness no matter what the queing
  80 # priority is.
  81 RATE_UP=5000
  82
  83 # RATE_UP_TOR is the minimum speed your Tor connections will have in
  84 # kbits/sec.  They will have at least this much bandwidth for upload.
  85 # In general, you probably shouldn't set this too low, or else Tor
  86 # users who use your node will be completely choked out whenever your
  87 # machine does any other network activity. That is not very fun.
  88 RATE_UP_TOR=1500
  89
  90 # RATE_UP_TOR_CEIL is the maximum rate allowed for all Tor trafic in
  91 # kbits/sec.
  92 RATE_UP_TOR_CEIL=5000
  93
  94 CHAIN=OUTPUT
  95 #CHAIN=PREROUTING
  96 #CHAIN=POSTROUTING
  97
  98 MTU=1500
  99 AVG_PKT=900 # should be more like 600 for non-exit nodes
 100
 101 # END USER TUNABLE PARAMETERS
 102
 103
 104
 105 # The queue size should be no larger than your bandwidth-delay
 106 # product. This is RT latency*bandwidth/MTU/2
 107
 108 BDP=$(expr $RTT_LATENCY \* $RATE_UP / $AVG_PKT)
 109
 110 # Further research indicates that the BDP calculations should use
 111 # RTT/sqrt(n) where n is the expected number of active connections..
 112
 113 BDP=$(expr $BDP / 4)
 114
 115 if [ "$1" = "status" ]
 116 then
 117         echo "[qdisc]"
 118         tc -s qdisc show dev $DEV
 119         tc -s qdisc show dev imq0
 120         echo "[class]"
 121         tc -s class show dev $DEV
 122         tc -s class show dev imq0
 123         echo "[filter]"
 124         tc -s filter show dev $DEV
 125         tc -s filter show dev imq0
 126         echo "[iptables]"
 127         iptables -t mangle -L TORSHAPER-OUT -v -x 2> /dev/null
 128         exit
 129 fi
 130
 131
 132 # Reset everything to a known state (cleared)
 133 tc qdisc del dev $DEV root 2> /dev/null > /dev/null
 134 tc qdisc del dev imq0 root 2> /dev/null > /dev/null
 135 iptables -t mangle -D POSTROUTING -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
 136 iptables -t mangle -D PREROUTING -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
 137 iptables -t mangle -D OUTPUT -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
 138 iptables -t mangle -F TORSHAPER-OUT 2> /dev/null > /dev/null
 139 iptables -t mangle -X TORSHAPER-OUT 2> /dev/null > /dev/null
 140 ip link set imq0 down 2> /dev/null > /dev/null
 141 rmmod imq 2> /dev/null > /dev/null
 142
 143 if [ "$1" = "stop" ]
 144 then
 145         echo "Shaping removed on $DEV."
 146         exit
 147 fi
 148
 149 # Outbound Shaping (limits total bandwidth to RATE_UP)
 150
 151 ip link set dev $DEV qlen $BDP
 152
 153 # Add HTB root qdisc, default is high prio
 154 tc qdisc add dev $DEV root handle 1: htb default 20
 155
 156 # Add main rate limit class
 157 tc class add dev $DEV parent 1: classid 1:1 htb rate ${RATE_UP}kbit
 158
 159 # Create the two classes, giving Tor at least RATE_UP_TOR kbit and capping
 160 # total upstream at RATE_UP so the queue is under our control.
 161 tc class add dev $DEV parent 1:1 classid 1:20 htb rate $(expr $RATE_UP - $RATE_UP_TOR)kbit ceil ${RATE_UP}kbit prio 0
 162 tc class add dev $DEV parent 1:1 classid 1:21 htb rate $[$RATE_UP_TOR]kbit ceil ${RATE_UP_TOR_CEIL}kbit prio 10
 163
 164 # Start up pfifo
 165 tc qdisc add dev $DEV parent 1:20 handle 20: pfifo limit $BDP
 166 tc qdisc add dev $DEV parent 1:21 handle 21: pfifo limit $BDP
 167
 168 # filter traffic into classes by fwmark
 169 tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
 170 tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
 171
 172 # add TORSHAPER-OUT chain to the mangle table in iptables
 173 iptables -t mangle -N TORSHAPER-OUT
 174 iptables -t mangle -I $CHAIN -o $DEV -j TORSHAPER-OUT
 175
 176
 177 # Set firewall marks
 178 # Low priority to Tor
 179 if [ ""$TOR_IP == "" ]
 180 then
 181         echo "Using UID-based QoS. UID $TOR_UID marked as low priority."
 182         iptables -t mangle -A TORSHAPER-OUT -m owner --uid-owner $TOR_UID -j MARK --set-mark 21
 183 else
 184         echo "Using IP-based QoS. $TOR_IP marked as low priority."
 185         iptables -t mangle -A TORSHAPER-OUT -s $TOR_IP -j MARK --set-mark 21
 186 fi
 187
 188 # High prio for everything else
 189 iptables -t mangle -A TORSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 20
 190
 191 echo "Outbound shaping added to $DEV.  Rate for Tor upload at least: ${RATE_UP_TOR}Kbyte/sec."
 192