linux-tor-prio.sh 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192
  1. #!/bin/bash
  2. # Written by Marco Bonetti & Mike Perry
  3. # Based on instructions from Dan Singletary's ADSL BW Management HOWTO:
  4. # http://www.faqs.org/docs/Linux-HOWTO/ADSL-Bandwidth-Management-HOWTO.html
  5. # This script is Public Domain.
  6. ############################### README #################################
  7. # This script provides prioritization of Tor traffic below other
  8. # traffic on a Linux server. It has two modes of operation: UID based
  9. # and IP based.
  10. # UID BASED PRIORITIZATION
  11. #
  12. # The UID based method requires that Tor be launched from
  13. # a specific user ID. The "User" Tor config setting is
  14. # insufficient, as it sets the UID after the socket is created.
  15. # Here is a C wrapper you can use to execute Tor and drop privs before
  16. # it creates any sockets.
  17. #
  18. # Compile with:
  19. # gcc -DUID=`id -u tor` -DGID=`id -g tor` tor_wrap.c -o tor_wrap
  20. #
  21. # #include <unistd.h>
  22. # int main(int argc, char **argv) {
  23. # if(initgroups("tor", GID) == -1) { perror("initgroups"); return 1; }
  24. # if(setresgid(GID, GID, GID) == -1) { perror("setresgid"); return 1; }
  25. # if(setresuid(UID, UID, UID) == -1) { perror("setresuid"); return 1; }
  26. # execl("/bin/tor", "/bin/tor", "-f", "/etc/tor/torrc", NULL);
  27. # perror("execl"); return 1;
  28. # }
  29. # IP BASED PRIORITIZATION
  30. #
  31. # The IP setting requires that a separate IP address be dedicated to Tor.
  32. # Your Torrc should be set to bind to this IP for "OutboundBindAddress",
  33. # "ListenAddress", and "Address".
  34. # GENERAL USAGE
  35. #
  36. # You should also tune the individual connection rate parameters below
  37. # to your individual connection. In particular, you should leave *some*
  38. # minimum amount of bandwidth for Tor, so that Tor users are not
  39. # completely choked out when you use your server's bandwidth. 30% is
  40. # probably a reasonable choice. More is better of course.
  41. #
  42. # To start the shaping, run it as:
  43. # ./linux-tor-prio.sh
  44. #
  45. # To get status information (useful to verify packets are getting marked
  46. # and prioritized), run:
  47. # ./linux-tor-prio.sh status
  48. #
  49. # And to stop prioritization:
  50. # ./linux-tor-prio.sh stop
  51. #
  52. ########################################################################
  53. # BEGIN USER TUNABLE PARAMETERS
  54. DEV=eth0
  55. # NOTE! You must START Tor under this UID. Using the Tor User
  56. # config setting is NOT sufficient. See above.
  57. TOR_UID=$(id -u tor)
  58. # If the UID mechanism doesn't work for you, you can set this parameter
  59. # instead. If set, it will take precedence over the UID setting. Note that
  60. # you need multiple IPs with one specifically devoted to Tor for this to
  61. # work.
  62. #TOR_IP="42.42.42.42"
  63. # Average ping to most places on the net, milliseconds
  64. RTT_LATENCY=40
  65. # RATE_UP must be less than your connection's upload capacity in
  66. # kbits/sec. If it is larger, then the bottleneck will be at your
  67. # router's queue, which you do not control. This will cause congestion
  68. # and a revert to normal TCP fairness no matter what the queing
  69. # priority is.
  70. RATE_UP=5000
  71. # RATE_UP_TOR is the minimum speed your Tor connections will have in
  72. # kbits/sec. They will have at least this much bandwidth for upload.
  73. # In general, you probably shouldn't set this too low, or else Tor
  74. # users who use your node will be completely choked out whenever your
  75. # machine does any other network activity. That is not very fun.
  76. RATE_UP_TOR=1500
  77. # RATE_UP_TOR_CEIL is the maximum rate allowed for all Tor trafic in
  78. # kbits/sec.
  79. RATE_UP_TOR_CEIL=5000
  80. CHAIN=OUTPUT
  81. #CHAIN=PREROUTING
  82. #CHAIN=POSTROUTING
  83. MTU=1500
  84. AVG_PKT=900 # should be more like 600 for non-exit nodes
  85. # END USER TUNABLE PARAMETERS
  86. # The queue size should be no larger than your bandwidth-delay
  87. # product. This is RT latency*bandwidth/MTU/2
  88. BDP=$(expr $RTT_LATENCY \* $RATE_UP / $AVG_PKT)
  89. # Further research indicates that the BDP calculations should use
  90. # RTT/sqrt(n) where n is the expected number of active connections..
  91. BDP=$(expr $BDP / 4)
  92. if [ "$1" = "status" ]
  93. then
  94. echo "[qdisc]"
  95. tc -s qdisc show dev $DEV
  96. tc -s qdisc show dev imq0
  97. echo "[class]"
  98. tc -s class show dev $DEV
  99. tc -s class show dev imq0
  100. echo "[filter]"
  101. tc -s filter show dev $DEV
  102. tc -s filter show dev imq0
  103. echo "[iptables]"
  104. iptables -t mangle -L TORSHAPER-OUT -v -x 2> /dev/null
  105. exit
  106. fi
  107. # Reset everything to a known state (cleared)
  108. tc qdisc del dev $DEV root 2> /dev/null > /dev/null
  109. tc qdisc del dev imq0 root 2> /dev/null > /dev/null
  110. iptables -t mangle -D POSTROUTING -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
  111. iptables -t mangle -D PREROUTING -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
  112. iptables -t mangle -D OUTPUT -o $DEV -j TORSHAPER-OUT 2> /dev/null > /dev/null
  113. iptables -t mangle -F TORSHAPER-OUT 2> /dev/null > /dev/null
  114. iptables -t mangle -X TORSHAPER-OUT 2> /dev/null > /dev/null
  115. ip link set imq0 down 2> /dev/null > /dev/null
  116. rmmod imq 2> /dev/null > /dev/null
  117. if [ "$1" = "stop" ]
  118. then
  119. echo "Shaping removed on $DEV."
  120. exit
  121. fi
  122. # Outbound Shaping (limits total bandwidth to RATE_UP)
  123. ip link set dev $DEV qlen $BDP
  124. # Add HTB root qdisc, default is high prio
  125. tc qdisc add dev $DEV root handle 1: htb default 20
  126. # Add main rate limit class
  127. tc class add dev $DEV parent 1: classid 1:1 htb rate ${RATE_UP}kbit
  128. # Create the two classes, giving Tor at least RATE_UP_TOR kbit and capping
  129. # total upstream at RATE_UP so the queue is under our control.
  130. tc class add dev $DEV parent 1:1 classid 1:20 htb rate $(expr $RATE_UP - $RATE_UP_TOR)kbit ceil ${RATE_UP}kbit prio 0
  131. tc class add dev $DEV parent 1:1 classid 1:21 htb rate $[$RATE_UP_TOR]kbit ceil ${RATE_UP_TOR_CEIL}kbit prio 10
  132. # Start up pfifo
  133. tc qdisc add dev $DEV parent 1:20 handle 20: pfifo limit $BDP
  134. tc qdisc add dev $DEV parent 1:21 handle 21: pfifo limit $BDP
  135. # filter traffic into classes by fwmark
  136. tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
  137. tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
  138. # add TORSHAPER-OUT chain to the mangle table in iptables
  139. iptables -t mangle -N TORSHAPER-OUT
  140. iptables -t mangle -I $CHAIN -o $DEV -j TORSHAPER-OUT
  141. # Set firewall marks
  142. # Low priority to Tor
  143. if [ ""$TOR_IP == "" ]
  144. then
  145. echo "Using UID-based QoS. UID $TOR_UID marked as low priority."
  146. iptables -t mangle -A TORSHAPER-OUT -m owner --uid-owner $TOR_UID -j MARK --set-mark 21
  147. else
  148. echo "Using IP-based QoS. $TOR_IP marked as low priority."
  149. iptables -t mangle -A TORSHAPER-OUT -s $TOR_IP -j MARK --set-mark 21
  150. fi
  151. # High prio for everything else
  152. iptables -t mangle -A TORSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 20
  153. echo "Outbound shaping added to $DEV. Rate for Tor upload at least: ${RATE_UP_TOR}Kbyte/sec."