fireqos

#!/bin/bash
#
# FireQOS - A traffic shaper for humans...
#
#   Copyright
#
#       Copyright (C) 2013-2017 Costa Tsaousis <costa@tsaousis.gr>
#       Copyright (C) 2013-2017 Phil Whineray <phil@sanewall.org>
#
#   License
#
#       This program is free software; you can redistribute it and/or modify
#       it under the terms of the GNU General Public License as published by
#       the Free Software Foundation; either version 2 of the License, or
#       (at your option) any later version.
#
#       This program is distributed in the hope that it will be useful,
#       but WITHOUT ANY WARRANTY; without even the implied warranty of
#       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
#       GNU General Public License for more details.
#
#       You should have received a copy of the GNU General Public License
#       along with this program. If not, see <http://www.gnu.org/licenses/>.
#
#       See the file COPYING for details.
#
READLINK_CMD=${READLINK_CMD:-readlink}
BASENAME_CMD=${BASENAME_CMD:-basename}
DIRNAME_CMD=${DIRNAME_CMD:-dirname}
function realdir {
	local r="$1"; local t=$($READLINK_CMD "$r")
	while [ "$t" ]; do
		r=$(cd $($DIRNAME_CMD "$r") && cd $($DIRNAME_CMD "$t") && pwd -P)/$($BASENAME_CMD "$t")
		t=$($READLINK_CMD "$r")
	done
	$DIRNAME_CMD "$r"
}
PROGRAM_FILE="$0"
PROGRAM_DIR="${FIREHOL_OVERRIDE_PROGRAM_DIR:-$(realdir "$0")}"
PROGRAM_PWD="${PWD}"
declare -a PROGRAM_ORIGINAL_ARGS=("${@}")

for functions_file in install.config functions.common services.common services.fireqos
do
	if [ -r "$PROGRAM_DIR/$functions_file" ]
	then
		source "$PROGRAM_DIR/$functions_file"
	else
		1>&2 echo "Cannot access $PROGRAM_DIR/$functions_file"
		exit 1
	fi
done

common_disable_localization || exit
common_public_umask || exit
common_require_root || exit

# make sure sbin is included in the path
# it seems that pppd ip-up.d script need this
export PATH="$PATH:/sbin:/usr/sbin:/usr/local/sbin"

# enabled extended pattern matching in bash
shopt -s extglob

FIREQOS_SYSLOG_FACILITY="daemon"
FIREQOS_CONFIG="${FIREHOL_CONFIG_DIR}/fireqos.conf"
FIREQOS_LOCK_FILE="$LOCALSTATEDIR/run/fireqos.lock"
FIREQOS_LOCK_FILE_TIMEOUT=600
FIREQOS_DIR="$LOCALSTATEDIR/run/fireqos"
FIREQOS_SAVE="${FIREQOS_DIR}/.tmp.save.$$.$RANDOM"

# Gets set to 1 if this system cannot handle sub-second resolution
FIREQOS_LOWRES_TIMER=0

# Set it to 1 to see the tc commands generated.
# Set it in the config file to overwrite this default.
FIREQOS_DEBUG=0

# These are finer debugging options.
FIREQOS_DEBUG_STACK=${FIREQOS_DEBUG_STACK-0}
FIREQOS_DEBUG_PORTS=${FIREQOS_DEBUG_PORTS-0}
FIREQOS_DEBUG_CLASS=${FIREQOS_DEBUG_CLASS-0}
FIREQOS_DEBUG_QDISC=${FIREQOS_DEBUG_QDISC-0}
FIREQOS_DEBUG_FILTER=${FIREQOS_DEBUG_FILTER-0}
FIREQOS_DEBUG_COMMAND=${FIREQOS_DEBUG_COMMAND-0}
FIREQOS_DEBUG_FLOW=${FIREQOS_DEBUG_FLOW-0}
FIREQOS_DEBUG_BIDIRECTIONAL=${FIREQOS_DEBUG_BIDIRECTIONAL-0}

# The default and minimum rate for all classes is 1/100
# of the interface bandwidth
FIREQOS_MIN_RATE_DIVISOR=100

# if set to 1, it will print a line per match statement
FIREQOS_SHOW_MATCHES=0

# the classes priority in balanced mode
FIREQOS_BALANCED_PRIO=4

# step to increment between matches
FIREQOS_MATCHES_STEP=10

# the default class for all interfaces
# additional default classes may be added (incrementing
# this, when classes with device emulation are added)
FIREQOS_INTERFACE_DEFAULT_CLASSID=8000

# load the defaults if they exist, ignoring any mark definitions
marksreset() { :; }
markdef() { :; }
if [ -r "${FIREHOL_CONFIG_DIR}/firehol-defaults.conf" ]
then
	source "${FIREHOL_CONFIG_DIR}/firehol-defaults.conf" || exit 1
fi

RUNNING_ON_TERMINAL=0
if [ "z$1" = "z-nc" ]
then
	shift
else
	common_setup_terminal && RUNNING_ON_TERMINAL=1
fi

# -----------------------------------------------------------------------------
# Default FireHOL marks

declare -A MARKS_BITS='([connmark]="6" [usermark]="7" )'
declare -A MARKS_MASKS='([connmark]="0x0000003f" [usermark]="0x00001fc0" )'
declare -A MARKS_MAX='([connmark]="63" [usermark]="127" )'
declare -A MARKS_SHIFT='([connmark]="0" [usermark]="6" )'

if [ -f "${FIREHOL_SPOOL_DIR}/marks.conf" ]
then
	source "${FIREHOL_SPOOL_DIR}/marks.conf" || exit 1
fi

mark_value() {
	local name="${1}"; shift
	local x=

	if [ -z "${name}" ]
	then
		error "Cannot find the value of mark with name '${name}'."
		return 1
	fi

	if [ -z "${1}" ]
	then
		error "Empty mark value given for mark ${name}."
		return 1
	fi

	if [ -z "${MARKS_MASKS[$name]}" ]
	then
		error "Mark $name does not exist."
		return 1
	fi

	for x in ${@//,/ }
	do
		local x=$[ x + 1 - 1 ]
		if [ $x -gt ${MARKS_MAX[$name]} -o $x -lt 0 ]
		then
			error "Cannot get mark $name of value $x. Mark $name is configured to get values from 0 to ${MARKS_MAX[$name]}. Change firehol-defaults.conf to add more."
			return 1
		fi

		#echo "$[ x << ${MARKS_SHIFT[$name]} ]/${MARKS_MASKS[$name]}"
		printf "0x%08x/${MARKS_MASKS[$name]}\n" "$[ x << ${MARKS_SHIFT[$name]} ]"
	done

	return 0
}


# -----------------------------------------------------------------------------

save() {
	[ ! $interface_save -eq 1 ] && return 0

	local ipv=${force_ipv}
	if [ ! -z "$ipv" ]
	then
		local ipv="ipv$ipv"
	fi
	config_line -ne
	printf "FORCE_CONFIG_LINEID=\"${LAST_CONFIG_LINE}\"\n" >>"${FIREQOS_SAVE}"
	printf "%q " $ipv "$@" >>"${FIREQOS_SAVE}"
	printf "\n" >>"${FIREQOS_SAVE}"
}

simple_service() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	[ $interface_save -eq 1 ] && save ${FUNCNAME} "$@"

	local direction="$1" service="$2" s= sports= reverse= p= proto= ports=
	shift 2

	for s in ${service//,/ }
	do
		eval "sports=\${server_${s}_ports}"
		if [ -z "${sports}" ]
		then
			error "Service '${s}' is not defined."
			exit 1
		fi

		# INPUT
		# server_x_ports=tcp/SPORT
		# server x src CLIENT dst SERVER ==>         dport SPORT, src CLIENT, dst SERVER ==> dport SPORT, src CLIENT, dst SERVER
		# client x src CLIENT dst SERVER ==> reverse dport SPORT, src CLIENT, dst SERVER ==> sport SPORT, dst CLIENT, src SERVER

		# OUTPUT
		# server_x_ports=tcp/SPORT
		# server x src CLIENT dst SERVER ==> reverse dport SPORT, src CLIENT, dst SERVER ==> sport SPORT, dst CLIENT, src SERVER
		# client x src CLIENT dst SERVER ==>         dport SPORT, src CLIENT, dst SERVER ==> dport SPORT, src CLIENT, dst SERVER

		# So:
		# 1. use 'server' when you are the server
		# 2. use 'client' when you are the client
		# 3. use 'src' and 'dst' to match the REQUEST, i.e. src=CLIENT, dst=SERVER
		# 4. forget about INPUT and OUTPUT interfaces, FireQOS will figure it out

		case $direction in
			server)
				[ "${interface_inout}" = "output" ] && reverse="reverse"
				;;

			client)
				[ "${interface_inout}" = "input" ] && reverse="reverse"
				;;

			*)
				error "A service cannot be applied as '${direction}'."
				exit 1
				;;
		esac

		for p in ${sports}
		do
			proto=${p/\/*/}
			ports=${p/*\//}
			match -ns ${reverse} proto ${proto} dports ${ports} "${@}"
		done
	done
}

server4() { ipv4 server "${@}"; }
server6() { ipv6 server "${@}"; }
server46() { ipv46 server "${@}"; }
server() { simple_service server "${@}"; }

client4() { ipv4 client "${@}"; }
client6() { ipv6 client "${@}"; }
client46() { ipv46 client "${@}"; }
client() { simple_service client "${@}"; }

service() {
	error "the 'service' match is no longer supported."
	exit 1
}

fireqos_active_interfaces() {
	$LS_CMD $FIREQOS_DIR/ 2>/dev/null |\
		$GREP_CMD ".conf" |\
		$TR_CMD "\n" " " |\
		$SED_CMD -e "s/\.conf//g" -e "s/ \+/ /g"
}

FIREQOS_COMPLETED=
fireqos_exit() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	if [ "$FIREQOS_COMPLETED" = "0" ]
	then
		echo >&2 "FAILED TO ACTIVATE TRAFFIC CONTROL."

		if [ ! -z "$interface_realdev" ]
		then
			# clear only the interface failed.

			echo >&2
			echo >&2 "Clearing failed interface: $interface_name ($interface_dev $interface_inout => $interface_realdev)..."
			echo >&2
			printf >&2 " %16.16s: " $interface_realdev
			echo >&2 "cleared traffic control ${interface_inout}"

			if [ $interface_inout = input ]
			then
				runcmd $TC_CMD qdisc del dev $interface_dev ingress >/dev/null 2>&1
				runcmd $TC_CMD qdisc del dev $interface_realdev root >/dev/null 2>&1

				if [ -f "$FIREQOS_DIR/ifbs/$interface_realdev" ]
				then
					printf >&2 " %16.16s: " $interface_realdev
					echo >&2 "removed IFB device"
					runcmd $IP_CMD del dev $interface_realdev name $interface_realdev type ifb >/dev/null 2>&1
				fi
			else
				runcmd $TC_CMD qdisc del dev $interface_realdev root >/dev/null 2>&1
			fi
			$RM_CMD $FIREQOS_DIR/$interface_name.conf 2>/dev/null

			local a=
			local ifs="`fireqos_active_interfaces`"
			if [ ! -z "$ifs" ]
			then
				local a="Traffic control on these interfaces is operational: $ifs"
			else
				local a="No traffic control is operational by FireQOS."
			fi
			echo >&2
			echo >&2 "$a"
			echo >&2

			syslog error "FireQOS FAILED. Cleared all FireQOS changes on interface '$interface_realdev'. $a"

		else
			clear_everything
		fi

	elif [ "$FIREQOS_COMPLETED" = "1" ]
	then
		syslog info "QoS applied ok ($tc_count tc commands applied)"

	fi
	echo >&2 "bye..."

	[ -f "${FIREQOS_LOCK_FILE}" ] && $RM_CMD -f "${FIREQOS_LOCK_FILE}" >/dev/null 2>&1

	enable trap
	enable exit
	trap exit EXIT
	if [ "$FIREQOS_COMPLETED" = "0" ]
	then
		exit 1
	fi
	exit 0
}

fireqos_concurrent_run_lock() {
	# open the 200th file descriptor
	exec 200>"${FIREQOS_LOCK_FILE}"
	if [ $? -ne 0 ]
	then
		echo "Cannot setup file locking. Exiting..."
		exit 1
	fi

	# open an exclusive lock on the 200th file descriptor
	${FLOCK_CMD} -n 200
	if [ $? -ne 0 ]
	then
		echo >&2 "FireQOS is already running. Exiting..."
		exit 1
	fi

	return 0
}

syslog() {
	local p="$1"; shift

	$LOGGER_CMD -p ${FIREQOS_SYSLOG_FACILITY}.$p -t "FireQOS[$$]" "${@}"
	return 0
}

# Find in the BASH execution stack, the line and the source file that has called us.
# Before first use the variable PROGRAM_FILE should be set to the file to be excluded.
# It also sets the variable LAST_CONFIG_LINE on each run.
FORCE_CONFIG_LINEID=
LAST_CONFIG_LINE=
config_line() {
	if [ ! -z "${FORCE_CONFIG_LINEID}" ]
	then
		LAST_CONFIG_LINE="${FORCE_CONFIG_LINEID}"
	else
		# find the config line in the BASH stack
		# start from 2
		#   0 is this line
		#   1 is the caller - our line for sure
		#   2 is the caller's caller - possibly a config file line
		local i= all=${#BASH_SOURCE}
		for (( i = 2; i < $all; i++ ))
		do
			[ ! "${BASH_SOURCE[$i]}" = "${PROGRAM_FILE}" ] && break
		done
		LAST_CONFIG_LINE="${BASH_LINENO[$[i-1]]}@${BASH_SOURCE[$i]}: ${FUNCNAME[$[i-1]]}:"
	fi
	test ! "z$1" = "z-ne" && echo "${LAST_CONFIG_LINE}"
}

error() {
	echo >&2 -e "$COLOR_RED$COLOR_BOLD"
	echo >&2
	echo >&2
	echo >&2 "ERROR: $(config_line)"
	echo -e >&2 "$@"
	echo >&2
	echo >&2 -e "$COLOR_RESET"
	exit 1
}

warning() {
	echo >&2
	echo >&2 -e " ${COLOR_YELLOW}${COLOR_BOLD}WARNING: $(config_line)"
	echo >&2 -e " $* ${COLOR_RESET}"
	echo >&2
}

runcmd() {
	local debug=$FIREQOS_DEBUG_COMMAND

	if [ $debug -eq 1 ]
	then
		printf " %q" "${@}"
		printf "\n"
		[ $FIREQOS_DEBUG -eq 1 ] && return 0
	fi

	"${@}"
}

tc_count=0
tc() {
	tc_count=$[tc_count + 1]

	local noerror=0
	if [ "$1" = "ignore-error" ]
	then
		local noerror=1
		shift
	fi

	local debug=$FIREQOS_DEBUG
	[ $FIREQOS_DEBUG_CLASS  -eq 1 -a "$1" = "class"  ] && local debug=1
	[ $FIREQOS_DEBUG_QDISC  -eq 1 -a "$1" = "qdisc"  ] && local debug=1
	[ $FIREQOS_DEBUG_FILTER -eq 1 -a "$1" = "filter" ] && local debug=1

	if [ $debug -eq 1 ]
	then
		printf " %q" $TC_CMD "${@}"
		printf "\n"
		return 0
	fi

	if [ $noerror -eq 1 ]
	then
		$TC_CMD "${@}" >/dev/null 2>&1
	else
		$TC_CMD "${@}"
		local ret=$?

		if [ $ret -ne 0 ]
		then
			echo >&2 -e "$COLOR_RED$COLOR_BOLD"
			echo >&2
			echo >&2
			echo >&2 "ERROR:"
			echo >&2 "tc failed with error $ret, while executing the command:"
			printf >&2 "%q " $TC_CMD "${@}"
			echo >&2
			echo >&2
			echo >&2 -e "$COLOR_RESET"
			exit 1
		fi
	fi
}

device_mtu() {
	$IP_CMD link show dev "${1}" | $SED_CMD "s/^.* \(mtu [0-9]\+\) .*$/\1/g" | $GREP_CMD ^mtu | $CUT_CMD -d ' ' -f 2
}

rate2bps() {
	local r="${1}" p="${2}" # is assumed to be the base rate in bytes per second

	# # convert $r to kbit / sec ; the default rate in fireqos

	# Gbit / sec
	r="${r//gbit/ * 1000 * 1000}"
	r="${r//Gbit/ * 1000 * 1000}"

	# Mbit / sec
	r="${r//mbit/ * 1000}"
	r="${r//Mbit/ * 1000}"

	# kbit / sec
	r="${r//kbit/}"
	r="${r//Kbit/}"

	# GBytes / sec
	r="${r//gbps/ * 8 * 1024 * 1024 * 1024 / 1000}"
	r="${r//Gbps/ * 8 * 1024 * 1024 * 1024 / 1000}"

	# MBytes / sec
	r="${r//mbps/ * 8 * 1024 * 1024 / 1000}"
	r="${r//Mbps/ * 8 * 1024 * 1024 / 1000}"

	# kBytes / sec
	r="${r//kbps/ * 8 * 1024 / 1000}"
	r="${r//Kbps/ * 8 * 1024 / 1000}"

	# Bytes / sec
	r="${r//bps/ * 8 / 1000}"
	r="${r//Bps/ * 8 / 1000}"

	# percentage of $p
	r="${r//%/ * 8 * $p / 100 / 1000}"

	# convert $r to bytes / sec ; the default rate in tc
	echo "$((r * 1000 / 8))"

	# # calculate it in bits per second (highest resolution)
	# case "$r" in
	# 	+([0-9])kbps)
	# 		local label="Kilobytes per second"
	# 		local identifier="kbps"
	# 		local multiplier=$((8 * 1024))
	# 		;;

	# 	+([0-9])Kbps)
	# 		local label="Kilobytes per second"
	# 		local identifier="Kbps"
	# 		local multiplier=$((8 * 1024))
	# 		;;

	# 	+([0-9])mbps)
	# 		local label="Megabytes per second"
	# 		local identifier="mbps"
	# 		local multiplier=$((8 * 1024 * 1024))
	# 		;;

	# 	+([0-9])Mbps)
	# 		local label="Megabytes per second"
	# 		local identifier="Mbps"
	# 		local multiplier=$((8 * 1024 * 1024))
	# 		;;

	# 	+([0-9])gbps)
	# 		local label="Gigabytes per second"
	# 		local identifier="gbps"
	# 		local multiplier=$((8 * 1024 * 1024 * 1024))
	# 		;;

	# 	+([0-9])Gbps)
	# 		local label="Gigabytes per second"
	# 		local identifier="Gbps"
	# 		local multiplier=$((8 * 1024 * 1024 * 1024))
	# 		;;

	# 	+([0-9])bit)
	# 		local label="bits per second"
	# 		local identifier="bit"
	# 		local multiplier=1
	# 		;;

	# 	+([0-9])kbit)
	# 		local label="Kilobits per second"
	# 		local identifier="kbit"
	# 		local multiplier=1000
	# 		;;

	# 	+([0-9])Kbit)
	# 		local label="Kilobits per second"
	# 		local identifier="Kbit"
	# 		local multiplier=1000
	# 		;;

	# 	+([0-9])mbit)
	# 		local label="Megabits per second"
	# 		local identifier="mbit"
	# 		local multiplier=1000000
	# 		;;

	# 	+([0-9])Mbit)
	# 		local label="Megabits per second"
	# 		local identifier="Mbit"
	# 		local multiplier=1000000
	# 		;;

	# 	+([0-9])gbit)
	# 		local label="Gigabits per second"
	# 		local identifier="gbit"
	# 		local multiplier=1000000000
	# 		;;

	# 	+([0-9])Gbit)
	# 		local label="Gigabits per second"
	# 		local identifier="Gbit"
	# 		local multiplier=1000000000
	# 		;;

	# 	+([0-9])bps)
	# 		local label="Bytes per second"
	# 		local identifier="bps"
	# 		local multiplier=8
	# 		;;

	# 	+([0-9])%)
	# 		local label="Percent"
	# 		local identifier="bps"
	# 		local multiplier=8
	# 		#r=$((p * multiplier * `echo $r | $SED_CMD "s/%//g"` / 100))
	# 		r=$((p * multiplier * ${r//%/} / 100))
	# 		;;

	# 	+([0-9]))
	# 		local label="Kilobits per second"
	# 		local identifier="Kbit"
	# 		local multiplier=1000
	# 		r=$(( r * multiplier ))
	# 		;;

	# 	*)
	# 		echo >&2 "Invalid rate '${r}' given."
	# 		return 1
	# 		;;
	# esac

	# #local n="`echo "$r" | $SED_CMD "s|$identifier| * $multiplier|g"`"
	# #eval "local o=\$(($n / 8))"
	# #echo "$o"

	# # evaluate it in bytes per second (the default for a rate in tc)
	# echo $(( ${r//$identifier/ * $multiplier} / 8))

	return 0
}

calc_r2q() {
	# r2q is by default 10
	# It is used to find the default quantum (i.e. the size in bytes a class can burst above its ceiling).
	# At the same time quantum cannot be smaller than a single packet (ptu).
	# So, the default is good only if the minimum rate specified to any class is MTU * R2Q = 1500 * 10 = 15000 * 8(bits) = 120kbit
	#
	# To be adaptive, we allocate to the default classes 1/100 of the total bandwidth.
	# This means that we need :
	#
	#  rate = mtu * r2q
	#  or
	#  r2q = rate / mtu
	#

	# we expect the minimum rate that might be given
	local rate="${1}" mtu="${2}" r2q=
	shift 2

	[ -z "$mtu" ] && mtu=1500

	r2q=$(( rate / mtu ))

	[ $r2q -lt 1 ] && r2q=1
	# [ $r2q -gt 10 ] && r2q=10

	echo $r2q
}

parse_class_params() {
	local prefix="${1}" parent="${2}" ipv4= ipv6= priority_mode= \
		prio= qdisc= qdisc_options= minrate= rate= ceil= r2q= \
		burst= cburst= quantum= mtu= mpu= tsize= param= value= \
		linklayer= linklayer_type= linklayer_encoding= overhead= diff= \
		valid_options="$interface_inout" current_options="$interface_inout" \
		hashfilter=0 hashfilter_prefix= hashfilter_direction= hashfilter_key= \
		hashfilter_mask=
	shift 2

	eval local base_rate="\$${parent}_rate"

	# we need the ceil_rate of the parent class
	# so that the 'max/ceil' parameter can be a percentage
	# of the parent's ceil_rate.
	eval local ceil_rate="\$${parent}_ceil"
	[ -z "${ceil}" ] && ceil_rate="${base_rate}"

	case "$force_ipv" in
		4)
			ipv4=1
			ipv6=0
			;;

		6)
			ipv4=0
			ipv6=1
			;;

		46)
			ipv4=1
			ipv6=1
			;;
	esac

	# find all work_X arguments
	while [ ! -z "${1}" ]
	do
		case "${1}" in
			input|output)
					current_options="${1}"
					;;

			priority|balanced)
					priority_mode="${1}"
					;;

			prio)
					prio="${2}"
					shift
					;;

			qdisc)
					qdisc="${2}"
					qdisc_options="default"
					if [ "$3" = "options" ]
					then
						qdisc_options="$4"
						shift 2
					fi
					shift
					;;

			sfq|pfifo|bfifo|fq_codel|codel|none)
					qdisc="${1}"
					qdisc_options="default"
					if [ "${2}" = "options" ]
					then
						qdisc_options="${3}"
						shift 2
					fi
					;;

			minrate)
					[ "$prefix" = "class" ] && error "'$1' cannot be used in classes."

					if [ $valid_options = $current_options ]
					then
						minrate="`rate2bps ${2} ${base_rate}`"
					fi
					shift
					;;

			rate|min|commit)
					if [ $valid_options = $current_options ]
					then
						rate="`rate2bps $2 ${base_rate}`"
					fi
					shift
					;;

			ceil|max)
					if [ $valid_options = $current_options ]
					then
						ceil="`rate2bps $2 ${ceil_rate}`"
					fi
					shift
					;;

			r2q)
					[ "$prefix" = "class" ] && error "'$1' cannot be used in classes."

					r2q="$2"
					shift
					;;

			burst)
					burst="$2"
					shift
					;;

			cburst)
					cburst="$2"
					shift
					;;

			quantum)
					# must be as small as possible, but larger than mtu
					quantum="$2"
					shift
					;;

			mtu)
					mtu="$2"
					shift
					;;

			mpu)
					mpu="$2"
					shift
					;;

			tsize)
					tsize="$2"
					shift
					;;

			overhead)
					overhead="$2"
					shift
					;;

			adsl)
					linklayer="$1"
					linklayer_type="$2"
					linklayer_encoding="$3"
					diff=0
					case "$2" in
						local)	diff=0
							;;

						remote)	diff=-14
							;;

						*)	error "Unknown adsl option '$2'."
							return 1
							;;
					esac

					# default overhead values taken from http://ace-host.stuart.id.au/russell/files/tc/tc-atm/
					case "$3" in
						IPoA-VC/Mux|ipoa-vcmux|ipoa-vc|ipoa-mux)
								overhead=$((8 + diff))
								;;
						IPoA-LLC/SNAP|ipoa-llcsnap|ipoa-llc|ipoa-snap)
								overhead=$((16 + diff))
								;;
						Bridged-VC/Mux|bridged-vcmux|bridged-vc|bridged-mux)
								overhead=$((24 + diff))
								;;
						Bridged-LLC/SNAP|bridged-llcsnap|bridged-llc|bridged-snap)
								overhead=$((32 + diff))
								;;
						PPPoA-VC/Mux|pppoa-vcmux|pppoa-vc|pppoa-mux)
								overhead=$((10 + diff))
								[ "$2" = "remote" ] && mtu=1478
								;;
						PPPoA-LLC/SNAP|pppoa-llcsnap|pppoa-llc|pppoa-snap)
								overhead=$((14 + diff))
								;;
						PPPoE-VC/Mux|pppoe-vcmux|pppoe-vc|pppoe-mux)
								overhead=$((32 + diff))
								;;
						PPPoE-LLC/SNAP|pppoe-llcsnap|pppoe-llc|pppoe-snap)
								overhead=$((40 + diff))
								[ "$2" = "remote" ] && mtu=1492
								;;
						*)
								error "Cannot understand adsl protocol '$3'."
								return 1
								;;
					esac
					shift 2
					;;

			atm|ethernet)
					linklayer="$1"
					linklayer_type=
					linklayer_encoding=
					;;

			linklayer)
					linklayer="$2"
					linklayer_type=
					linklayer_encoding=
					shift
					;;

			hashfilter)
					if [ -z "${2}" ] || [ -z "${3}" ]
					then
					   error "Hashing filter requires additional parameters!"
					   return 1
					fi
					hashfilter=1
					if [ "${2}" == "key" ]
					then
						hashfilter_key="$3"
						shift 2
					else
						if [ -z "${4}" ]
						then
							error "Hashing filter requires additional parameters!"
						fi
						hashfilter_direction="$2"
						hashfilter_prefix="$3"
						hashfilter_mask="$4"
						shift 3
					fi
					;;

			*)		error "Cannot understand what '${1}' means."
					return 1
					;;
		esac

		shift
	done

	# export our parameters for the caller
	# for every parameter not set, use the parent value
	# for every one set, use the set value
	for param in ceil burst cburst quantum qdisc qdisc_options ipv4 ipv6 priority_mode
	do
		eval local value="\$$param"
		if [ -z "$value" ]
		then
			eval export ${prefix}_${param}="\${${parent}_${param}}"
		else
			eval export ${prefix}_${param}="\$$param"
		fi
	done

	# no inheritance for these parameters
	for param in rate mtu mpu tsize overhead linklayer linklayer_type linklayer_encoding r2q prio minrate hashfilter hashfilter_direction hashfilter_prefix hashfilter_key hashfilter_mask
	do
		eval export ${prefix}_${param}="\$$param"
	done

	return 0
}

parent_path=
parent_stack_size=0
parent_push() {
	local 	prefix="${1}" param= \
		vars="classid major sumrate default_class default_added filters_to name ceil burst cburst quantum qdisc rate mtu mpu tsize overhead linklayer linklayer_type linklayer_encoding r2q prio ipv4 ipv6 minrate priority_mode class_counter stab class_prio"
	shift

	if [ $FIREQOS_DEBUG_STACK -eq 1 ]
	then
		eval "local before=\$parent_stack_${parent_stack_size}"
		echo "PUSH $prefix: OLD(${parent_stack_size}): $before"
	fi

	# refresh the existing parent_* values to stack
	eval "parent_stack_${parent_stack_size}="
	for param in $vars
	do
		eval "parent_stack_${parent_stack_size}=\"\${parent_stack_${parent_stack_size}}parent_$param=\$parent_$param;\""
	done

	if [ $FIREQOS_DEBUG_STACK -eq 1 ]
	then
		eval "local after=\$parent_stack_${parent_stack_size}"
		echo "PUSH $prefix: REFRESHED(${parent_stack_size}): $after"
	fi

	# now push the new values into the stack
	(( parent_stack_size += 1 ))
	eval "parent_stack_${parent_stack_size}="
	for param in $vars
	do
		eval "parent_$param=\$${prefix}_$param"
		eval "parent_stack_${parent_stack_size}=\"\${parent_stack_${parent_stack_size}}parent_$param=\$${prefix}_$param;\""
	done

	if [ $FIREQOS_DEBUG_STACK -eq 1 ]
	then
		eval "local push=\$parent_stack_${parent_stack_size}"
		echo "PUSH $prefix: NEW(${parent_stack_size}): $push"
		#-- set | $GREP_CMD ^parent
	fi

	if [ "$prefix" = "interface" ]
	then
		parent_path=
	else
		parent_path="$parent_path$parent_name/"
	fi
	[ $FIREQOS_DEBUG_STACK -eq 1 ] && echo "PARENT_PATH=$parent_path"

	set_tabs
}

parent_pull() {
	if [ $parent_stack_size -lt 1 ]
	then
		error "Cannot pull a not pushed set of values from stack."
		exit 1
	fi

	parent_stack_size=$((parent_stack_size - 1))

	eval "eval \${parent_stack_${parent_stack_size}}"

	if [ $FIREQOS_DEBUG_STACK -eq 1 ]
	then
		eval "local pull=\$parent_stack_${parent_stack_size}"
		echo "PULL(${parent_stack_size}): $pull"
		#-- set | $GREP_CMD ^parent
	fi

	if [ $parent_stack_size -gt 1 ]
	then
		parent_path="`echo $parent_path | $CUT_CMD -d '/' -f 1-$((parent_stack_size - 1))`/"
	else
		parent_path=
	fi
	[ $FIREQOS_DEBUG_STACK -eq 1 ] && echo "PARENT_PATH=$parent_path"

	set_tabs
}

parent_clear() {
	parent_stack_size=0

	set_tabs
}

class_tabs=
set_tabs() {
	class_tabs=
	local x=
	for x in `$SEQ_CMD 1 $parent_stack_size`
	do
		class_tabs="$class_tabs	"
	done
}

check_constrains() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	local prefix="$1"
	eval "local mtu=\$${prefix}_mtu \
		burst=\$${prefix}_burst \
		cburst=\$${prefix}_cburst \
		quantum=\$${prefix}_quantum \
		rate=\$${prefix}_rate \
		ceil=\$${prefix}_ceil \
		minrate=\$${prefix}_minrate"

	[ -z "$mtu" ] && eval "local mtu=${parent_mtu}"
	[ -z "$mtu" ] && eval "local mtu=$interface_mtu"

	# check the constrains
	if [ ! -z "$mtu" ]
	then
		if [ ! -z "$quantum" ]
		then
			if [ $quantum -lt $mtu ]
			then
				warning "quantum ($quantum bytes) is less than MTU ($mtu bytes). Fixed it by setting quantum to MTU."
				eval "${prefix}_quantum=$mtu"
			fi
		fi

		if [ ! -z "$burst" ]
		then
			if [ $burst -lt $mtu ]
			then
				warning "burst ($burst bytes) is less than MTU ($mtu bytes). Fixed it by setting burst to MTU."
				eval "${prefix}_burst=$mtu"
			fi
		fi

		if [ ! -z "$cburst" ]
		then
			if [ $cburst -lt $mtu ]
			then
				warning "cburst ($cburst bytes) is less than MTU ($mtu bytes). Fixed it by setting cburst to MTU."
				eval "${prefix}_cburst=$mtu"
			fi
		fi

		if [ ! -z "$minrate" ]
		then
			if [ $minrate -lt $mtu ]
			then
				warning "minrate ($minrate bytes per second) is less than MTU ($mtu bytes). Fixed it by setting minrate to MTU."
				eval "${prefix}_minrate=$mtu"
			fi
		fi
	fi

	if [ ! -z "$ceil" ]
	then
		if [ $ceil -lt $rate ]
		then
			warning "ceil ($((ceil * 8 / 1000))kbit) is less than rate ($((rate * 8 / 1000))kbit). Fixed it by setting ceil to rate."
			eval "${prefix}_ceil=$rate"
		fi
	fi

	[ "$prefix" = "interface" ] && return 0

	if [ ! -z "$ceil" ]
	then
		if [ $ceil -gt $parent_ceil ]
		then
			warning "ceil ($((ceil * 8 / 1000))kbit) is higher than its parent's ceil ($((parent_ceil * 8 / 1000))kbit). Fixed it by setting ceil to parent's ceil."
			eval "${prefix}_ceil=$parent_ceil"
		fi
	fi

	if [ ! -z "$burst" -a ! -z "$parent_burst" ]
	then
		if [ $burst -gt $parent_burst ]
		then
			warning "burst ($burst bytes) is higher than its parent's burst ($parent_burst bytes). Fixed it by setting burst to parent's burst."
			eval "${prefix}_burst=$parent_burst"
		fi
	fi

	if [ ! -z "$cburst" -a ! -z "$parent_cburst" ]
	then
		if [ $cburst -gt $parent_cburst ]
		then
			warning "cburst ($cburst bytes) is higher than its parent's cburst ($parent_cburst bytes). Fixed it by setting cburst to parent's cburst."
			eval "${prefix}_cburst=$parent_cburst"
		fi
	fi

	return 0
}

check_committed_rate() {
	if [ ${parent_rate} -ge ${parent_sumrate} ]
	then
		echo >&2 -e ": $class_tabs${COLOR_GREEN}${COLOR_BOLD}committed rate $((parent_sumrate * 8 / 1000))kbit ($((parent_sumrate * 100 / parent_rate))%), the remaining $(((parent_rate - parent_sumrate)*8/1000))kbit will be spare bandwidth.${COLOR_RESET}"
	else
		echo >&2 -e ": $class_tabs${COLOR_RED}${COLOR_BOLD}committed rate $((parent_sumrate * 8 / 1000))kbit, ($((parent_sumrate * 100 / parent_rate))%), overbooked by $((-(parent_rate - parent_sumrate)*8/1000))kbit. PLEASE FIX.${COLOR_RESET}"
	fi
}

interface_major=
interface_dev=
interface_name=
interface_inout=
interface_realdev=
interface_minrate=
interface_global_class_counter=
interface_class_counter=
interface_class_prio=0
interface_qdisc_counter=
interface_default_added=
interface_default_class=${FIREQOS_INTERFACE_DEFAULT_CLASSID}
interface_classes=
interface_classes_ids=
interface_classes_monitor=
interface_sumrate=0
interface_classid=
interface_stab=
interface_save=0
interface_default_counter=0
interface_priority_mode=

ifb_interfaces=0
class_matchid=0
force_ipv=

interface_close() {
	local nosave=0
	if [ "$1" = "nosave" ]
		then
		nosave=1
		shift
	fi

	if [ -f "${FIREQOS_SAVE}" -a $nosave -eq 0 ]
	then
		[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@} (save mode while closing $interface_dev)"

		# we have the output of a bidirectional interface to run

		# close the existing, input, interface
		interface_close nosave

		# move the exiting file to a new place, to avoid recursion
		$MV_CMD "${FIREQOS_SAVE}" "${FIREQOS_SAVE}.run"

		if [ ${FIREQOS_DEBUG_BIDIRECTIONAL} -eq 1 ]
			then
			echo >&2
			echo >&2 "# BEGIN - GENERATED OUTPUT INTERFACE"
			$CAT_CMD >&2 "${FIREQOS_SAVE}.run"
			echo >&2 "# END - GENERATED OUTPUT INTERFACE"
			echo >&2
		fi

		# run the new, output, interface
		[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> Sourcing generated output interface..."
		source "${FIREQOS_SAVE}.run"
		if [ $? -ne 0 ]
			then
			error "Cannot run the generated statements for the output interface of $interface_dev."
			echo >&2 "# BEGIN - FAILED OUTPUT INTERFACE"
			$CAT_CMD >&2 "${FIREQOS_SAVE}.run"
			echo >&2 "# END - FAILED OUTPUT INTERFACE"
			exit 1
		fi
		FORCE_CONFIG_LINEID=

		# delete the file, we don't need it any more
		$RM_CMD "${FIREQOS_SAVE}.run"

		# continue running this interface_close function, to close the output interface too
	fi

	if [ ! -z "$interface_dev" ]
	then
		[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@} (of $interface_dev)"

		# close all open class groups
		while [ $parent_stack_size -gt 1 ]
		do
			class group end
		done

		# if we have not added the default class
		# for the interface, add it now
		if [ $parent_default_added -eq 0 ]
		then
			class default
			parent_default_added=1
		fi

		check_committed_rate

		# NOT NEEDED - the default for interfaces works via kernel.
		# match all class default flowid $interface_major:${parent_default_class} prio 0xffff

		FIREQOS_INTERFACES_COMPLETED="$interface_name $FIREQOS_INTERFACES_COMPLETED"

		echo "interface_classes='TOTAL|${interface_major}:1 $interface_classes'" >>"${FIREQOS_DIR}/${interface_name}.conf"
		echo "interface_classes_ids='${interface_major}_1 $interface_classes_ids'" >>"${FIREQOS_DIR}/${interface_name}.conf"
		echo "interface_classes_monitor='$interface_classes_monitor'" >>"${FIREQOS_DIR}/${interface_name}.conf"
	else
		[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> (dummy) ${FUNCNAME} ${@}"
	fi

	echo >&2
	parent_clear

	interface_major=1
	interface_dev=
	interface_name=
	interface_inout=
	interface_realdev=
	interface_minrate=
	interface_global_class_counter=1
	interface_class_counter=10
	interface_class_prio=0
	interface_qdisc_counter=10
	interface_default_added=0
	interface_default_class=${FIREQOS_INTERFACE_DEFAULT_CLASSID}
	interface_default_counter=0
	interface_classes=
	interface_classes_ids=
	interface_classes_monitor=
	interface_sumrate=0
	interface_classid=
	interface_stab=1
	interface_save=0
	interface_priority_mode=

	class_matchid=1
	parent_stack_size=0

	class_name=
	class_filters_flowid=
	class_classid=
	class_major=
	class_group=0

	last_class_prio=0

	return 0
}

ipv4() {
	force_ipv="4"
	"${@}"
	force_ipv=
}

ipv6() {
	force_ipv="6"
	"${@}"
	force_ipv=
}

ipv46() {
	force_ipv="46"
	"${@}"
	force_ipv=
}

interface4() {
	ipv4 interface "${@}"
}

interface6() {
	ipv6 interface "${@}"
}

interface46() {
	ipv46 interface "${@}"
}

#
## supports only 'xt'
#FIREQOS_CONNMARK_SAVE="${FIREQOS_CONNMARK_SAVE-}"

# supports either 'act_connmark' or empty
# 'act_connmark' needs kernel module act_connmark
FIREQOS_CONNMARK_RESTORE="${FIREQOS_CONNMARK_RESTORE-}"
FIREQOS_MARKS_ON_INPUT_USED=0

interface_count=0
interface() {
	if [ "$3" = "both" -o "$3" = "bidirectional" ]
	then
		[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> (bidirectional) ${FUNCNAME} ${@}"

		local a1="$1" a2="$2" a3="$3"
		shift 3

		interface "$a1" "${a2}-in" input "$@" || return $?
		interface_save=1

		save interface "$a1" "${a2}-out" output "$@"
		return 0
	fi

	interface_close

	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	(( interface_count += 1 ))

	printf >&2 ": ${FUNCNAME} %s" "$*"

	interface_dev="$1"; shift
	interface_name="$1"; shift
	interface_inout="$1"; shift

	if [ "${interface_inout}" = "input" ]
	then
		ifb_interfaces=$((ifb_interfaces + 1))

		interface_realdev=${interface_dev:0:11}-ifb

		runcmd $IP_CMD link add dev ${interface_realdev} name ${interface_realdev} type ifb 2>/dev/null
		if [ $? -ne 0 -a $? -ne 2 ]
		then
			error "Cannot add IFB device ${interface_realdev}."
			exit 1
		fi

		# remember we used this interface
		$TOUCH_CMD $FIREQOS_DIR/ifbs/${interface_realdev}

		runcmd $IP_CMD link set dev ${interface_realdev} up
		if [ $? -ne 0 ]
		then
			error "Cannot bring device ${interface_realdev} UP. Do you have 'ifb' enabled in the kernel?"
			exit 1
		fi
	else
		# for 'output' interfaces, realdev is dev
		interface_realdev=${interface_dev}
	fi

	# parse the parameters given
	parse_class_params interface noparent "${@}"

	[ -z "${interface_priority_mode}" ] && interface_priority_mode="priority"

	# IPv, this is only used by matches
	# here we just give the defaults for inheritance to work
	if [ -z "${interface_ipv4}" -a -z "${interface_ipv6}" ]
	then
		interface_ipv4=1
		interface_ipv6=0
	elif [ -z "${interface_ipv4}" ]
	then
		interface_ipv4=0
	elif [ -z "${interface_ipv6}" ]
	then
		interface_ipv6=0
	fi

	# check important arguments
	if [ -z "${interface_rate}" ]
	then
		error "Cannot figure out the rate of interface '${interface_dev}'."
		return 1
	fi

	if [ -z "${interface_mtu}" ]
	then
		# to find the mtu, we query the original device, not an ifb device
		interface_mtu=`device_mtu ${interface_dev}`

		if [ -z "${interface_mtu}" ]
		then
			interface_mtu=1500
			warning "Device MTU cannot be detected. Setting it to 1500 bytes."
		fi
	fi

	# fix stab
	local stab=
	if [ ! -z "${interface_linklayer}" ]
	then
		stab="stab"
		test ! -z "${interface_linklayer}"	&& stab="$stab linklayer ${interface_linklayer}"
		test ! -z "${interface_overhead}"	&& stab="$stab overhead ${interface_overhead}"
		test ! -z "${interface_tsize}"		&& stab="$stab tsize ${interface_tsize}"
		test ! -z "${interface_mtu}"		&& stab="$stab mtu ${interface_mtu}"
		test ! -z "${interface_mpu}"		&& stab="$stab mpu ${interface_mpu}"
	fi

	# the default ceiling for the interface, is the rate of the interface
	# if we don't respect this, all unclassified traffic will get just 1kbit!
	[ -z "${interface_ceil}" ] && interface_ceil=${interface_rate}

	# set the default qdisc for all classes
	if [ -z "${interface_qdisc}" ]
	then
		interface_qdisc="${FIREQOS_DEFAULT_QDISC}"
		interface_qdisc_options="${FIREQOS_DEFAULT_QDISC_OPTIONS}"
	fi

	# the desired minimum rate for all classes
	[ -z "${interface_minrate}" ] && interface_minrate=$((interface_rate / FIREQOS_MIN_RATE_DIVISOR))

	# calculate the default r2q for this interface
	# *** THIS MAY NOT BE NEEDED ANYMORE, SINCE WE ALWAYS SET QUANTUM ***
	if [ -z "${interface_r2q}" ]
	then
		interface_r2q=`calc_r2q ${interface_minrate} ${interface_mtu}`
	fi

	# the actual minimum rate we can get
	local r=$((interface_r2q * interface_mtu))
	[ ${r} -gt ${interface_minrate} ] && interface_minrate=${r}

	# set the default quantum
	[ -z "${interface_quantum}" ] && interface_quantum=${interface_mtu}

	check_constrains interface

	local 	rate="rate $((interface_rate * 8 / 1000))kbit" \
		minrate="rate $((interface_minrate * 8 / 1000))kbit" \
		ceil= burst= cburst= quantum= r2q=
	[ ! -z "${interface_ceil}" ]			&& ceil="ceil $((interface_ceil * 8 / 1000))kbit"
	[ ! -z "${interface_burst}" ]			&& burst="burst ${interface_burst}"
	[ ! -z "${interface_cburst}" ]			&& cburst="cburst ${interface_cburst}"
	[ ! -z "${interface_quantum}" ]			&& quantum="quantum ${interface_quantum}"
	[ ! -z "${interface_r2q}" ]			&& r2q="r2q ${interface_r2q}"

	echo >&2 -e " ${COLOR_BOLD}${COLOR_GREEN}(${interface_realdev}, $((interface_rate*8/1000))kbit, mtu ${interface_mtu}, quantum ${interface_quantum}, minrate $(( interface_minrate * 8 / 1000 ))kbit)${COLOR_RESET}"

	# remember we used this interface
	echo "$interface_name" >$FIREQOS_DIR/ifaces/${interface_realdev}

	# Add root qdisc with proper linklayer and overheads
	tc ignore-error qdisc del dev $interface_realdev root
	tc qdisc add dev ${interface_realdev} root handle ${interface_major}: ${stab} htb default ${FIREQOS_INTERFACE_DEFAULT_CLASSID} ${r2q}

	# redirect all incoming traffic to ifb
	if [ ${interface_inout} = input ]
	then
		# Redirect all incoming traffic to ifb
		# We then shape the traffic in the output of ifb
		tc ignore-error qdisc del dev ${interface_dev} ingress
		tc qdisc add dev ${interface_dev} ingress

		local cm=
		case "${FIREQOS_CONNMARK_RESTORE}" in
			act_connmark)
				cm="action connmark"
				;;
			#xt)
			#	cm="action xt -j CONNMARK --restore-mark"
			#	;;

			*)
				if [ ! -z "${FIREQOS_CONNMARK_RESTORE}" ]
				then
					error "Unknown connmark restoration method '${FIREQOS_CONNMARK_RESTORE}'."
					return 1
				fi
				;;
		esac
		tc filter add dev $interface_dev parent ffff: protocol all prio 39999 u32 match u32 0 0 ${cm} action mirred egress redirect dev ${interface_realdev}
	fi

	interface_classid="${interface_major}:1"

	# Add the root class for the interface
	tc class add dev ${interface_realdev} parent ${interface_major}: classid ${interface_classid} htb $rate $ceil $burst $cburst $quantum

	#if [ $interface_inout = output ]
	#then
	#	if [ "${FIREQOS_CONNMARK_SAVE}" = "xt" ]
	#	then
	#		tc filter add dev ${interface_realdev} parent ${interface_major}: protocol ip prio 0 u32 match u32 0 0 classid ${interface_classid} action xt -j CONNMARK --save-mark
	#	fi
	#fi

	interface_filters_to="${interface_major}:0"

	parent_push interface

	# default IPv for the classes
	class_ipv4=$interface_ipv4
	class_ipv6=$interface_ipv6
	class_name=root

	[ -f "${FIREQOS_DIR}/${interface_name}.conf" ] && $RM_CMD "${FIREQOS_DIR}/${interface_name}.conf"
	$CAT_CMD >"${FIREQOS_DIR}/${interface_name}.conf" <<EOF
interface_name="$interface_name"
interface_rate="$interface_rate"
interface_ceil="$interface_ceil"
interface_dev="$interface_dev"
interface_realdev="$interface_realdev"
interface_inout="$interface_inout"
interface_minrate="$interface_minrate"
interface_linklayer="$interface_linklayer"
interface_linklayer_type="$interface_linklayer_type"
interface_linklayer_encoding="$interface_linklayer_encoding"
interface_overhead="$interface_overhead"
interface_minrate="$interface_minrate"
interface_r2q="$interface_r2q"
interface_burst="$interface_burst"
interface_cburst="$interface_cburst"
interface_quantum="$interface_quantum"
interface_mtu="$interface_mtu"
interface_mpu="$interface_mpu"
interface_tsize="$interface_tsize"
interface_qdisc="$interface_qdisc"
interface_qdisc_options="$interface_qdisc_options"
class_${interface_major}_1_name="TOTAL"
class_${interface_major}_1_classid="CLASSID"
class_${interface_major}_1_priority="PRIORITY"
class_${interface_major}_1_rate="COMMIT"
class_${interface_major}_1_ceil="MAX"
class_${interface_major}_1_burst="BURST"
class_${interface_major}_1_cburst="CBURST"
class_${interface_major}_1_quantum="QUANTUM"
class_${interface_major}_1_qdisc="QDISC"
EOF

	return 0
}

class_name=
class_classid=
class_major=
class_group=0

class4() {
	ipv4 class "${@}"
}

class6() {
	ipv6 class "${@}"
}

class46() {
	ipv46 class "${@}"
}

class_count=0
class() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	[ ${interface_save} -eq 1 ] && save ${FUNCNAME} "$@"

	(( class_count += 1 ))

	# check if the have to push into the stack the last class (if it was a group class)
	if [ ${class_group} -eq 1 ]
	then
		# the last class was a group
		# filters have been added to it, and now we have reached its first child class
		# we push the previous class, into the our parents stack

		class_default_added=0
		parent_push class

		# the current command is the first child class
	fi

	# reset the values of the current class
	class_name=
	class_classid=
	class_major=
	class_group=0

	# if this is a group class
	if [ "${1}" = "group" ]
	then
		shift

		# if this is the end of a group class
		if [ "${1}" = "end" ]
		then
			shift

			if [ ${parent_stack_size} -le 1 ]
			then
				error "No open class group to end."
				exit 1
			fi

			# make sure we don't save these statements too
			local isave=${interface_save}
			interface_save=0

			if [ ${parent_default_added} -eq 0 ]
			then
				class default
			fi

			# In nested classes, the default of the parent class is not respected
			# by the kernel. This rule, sends all remaining traffic to the inner default.
			match all class default flowid ${parent_major}:${parent_default_class} prio 0xfffe

			check_committed_rate

			# restore the previous save status
			interface_save=${isave}

			if [ ${parent_stab} -eq 1 ]
			then
				parent_pull
			else
				local pc=${parent_class_counter}
				parent_pull
				parent_class_counter=${pc}
			fi
			return 0
		elif [ "${1}" = "default" ]
		then
			error "The default class cannot have subclasses."
			exit 1
		fi

		class_group=1
	fi

	printf >&2 ": ${class_tabs}${FUNCNAME} %s" "$*"

	class_name="${1}"; shift

	# increase the interface global class counter
	(( interface_global_class_counter += 1 ))

	# increase the parent's class counter
	# this is used for determining the minor of the class
	(( parent_class_counter += 1 ))

	# if this is the default class, use the pre-defined id,
	# otherwise use the classid we just increased
	if [ "${class_name}" = "default" ]
	then
		local id=${parent_default_class}
	else
		local id=${parent_class_counter}
	fi

	# the tc classid that we will create
	# this is used for the parent of all child classed
	class_classid="${parent_major}:${id}"

	# the flowid the matches on this class will classify the packets
	class_filters_flowid="${parent_major}:${id}"

	# the id of the class in the config, for getting status info about it
	local ncid="${parent_major}_${id}"

	# the handle of the new qdisc we will create
	(( interface_qdisc_counter += 1 ))
	class_major=${interface_qdisc_counter}

	parse_class_params class parent quantum "RESET" "${@}"

	if [ "$class_quantum" = "RESET" ]
	then
		if [ ! -z "${class_mtu}" ]
		then
			class_quantum=${class_mtu}
		else
			class_quantum=${parent_quantum}
		fi
	fi

	# the priority of this class, compared to the others in the same interface
	if [ "${class_prio}" = "keep" -o "${class_prio}" = "last" ]
	then
		class_prio=${last_class_prio}
	elif [ -z "${class_prio}" ]
	then
		if [ "${parent_priority_mode}" = "balanced" ]
		then
			class_prio=${FIREQOS_BALANCED_PRIO}
		else
			class_prio=${parent_class_prio}

			# increase the parent's priority of subclasses
			(( parent_class_prio += 1 ))
		fi
	else
		parent_class_prio=$((class_prio + 1))
	fi

	if [ ${class_prio} -lt 0 ]
		then
		warning "Class '${class_name}' has been assigned priority ${class_prio}, but HTB allows 0-7. Setting it to 0."
		class_prio=0
	fi

	if [ ${class_prio} -gt 7 ]
		then
		warning "Class '${class_name}' has been assigned priority ${class_prio}, but HTB allows 0-7. Setting it to 7."
		class_prio=7
	fi

	# remember this prio, in case we need it later
	last_class_prio="${class_prio}"

	# if not specified, set the minimum rate
	if [ -z "${class_rate}" ]
	then
		[ ${class_group} -eq 1 ] && error "Class group '${class_name}' does not specify a committed rate.\nClass groups should have a committed rate."
		class_rate=${interface_minrate}
	fi

	if [ ${class_hashfilter} -eq 1 ]
	then
		if [ ${class_group} -eq 0 ]
		then
			( [ ! -z "${class_hashfilter_prefix}" ] || [ ! -z "${class_hashfilter_direction}" ] || [ ! -z "${class_hashfilter_mask}" ] ) && error "Class group '${class_name}' has hashfilter group parameters set, but class is not defined as a group!"
			if ! [[ "${class_hashfilter_key}" =~ ^[[:digit:]]{1,3}$ ]]
			then
				error "Class group '${class_name}' has hashfilter key parameter set in incorrect notation!"
			fi
         class_hashfilter_key=$(printf '%x' ${class_hashfilter_key})
		else
			[ ! -z "${class_hashfilter_key}" ]  && error "Class group '${class_name}' has hashfilter key parameters set, but class is defined as a group!"

			if ! [[ "${class_hashfilter_prefix}" =~ ^([[:graph:]]+)/([[:graph:]]+)$ ]]
			then
				error "hashfilter prefix parameter for class '${class_name}' is in incorrect notation!"
			fi
			class_hashfilter_prefix_network=${BASH_REMATCH[1]}
			class_hashfilter_prefix_mask=${BASH_REMATCH[2]}
			if ! [[ "${class_hashfilter_prefix_network}" =~ ^[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}$ ]]
			then
				error "Hashfilter prefix parameter for class '${class_name}' has an invalid network address!"
			fi
			if ! [[ "${class_hashfilter_prefix_mask}" =~ ^[[:digit:]]+$ ]] &&
				! [[ "${class_hashfilter_prefix_mask}" =~ ^[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}$ ]]
			then
				error "Hashfilter prefix parameter for class '${class_name}' has an invalid network mask!"
			fi
			if [[ "${class_hashfilter_prefix_mask}" =~ ^[[:digit:]]+$ ]]
			then
				class_hashfilter_prefix_mask=$(cidr_length_to_mask ${class_hashfilter_prefix_mask})
				if ! [[ "${class_hashfilter_prefix_mask}" =~ ^[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}$ ]]
				then
					error "Hashfilter prefix parameter for class '${class_name}' has an incorrect mask defined!"
				fi
			fi
			if [ "${class_hashfilter_direction}" != "src" ] && [ "${class_hashfilter_direction}" != "dst" ]
			then
				error "Hashfilter direction parameter for class '${class_name}' is neither 'src' nor 'dst'!"
			fi
	   fi
   fi

	# class rate cannot go below 1/100 of the interface rate
	if [ ${class_rate} -lt ${interface_minrate} ]
	then
		warning "class rate ($((class_rate * 8 /1000))kbit) was less than the interface minrate ($((interface_minrate * 8 /1000))kbit). Fixed it by setting class rate to minrate."
		class_rate=${interface_minrate}
	fi

	check_constrains class

	[ ! -z "${class_rate}" ]	&& local rate="rate $((class_rate * 8 / 1000))kbit"
	[ ! -z "$class_ceil" ]		&& local ceil="ceil $((class_ceil * 8 / 1000))kbit"
	[ ! -z "$class_burst" ]		&& local burst="burst $class_burst"
	[ ! -z "$class_cburst" ]	&& local cburst="cburst $class_cburst"
	[ ! -z "$class_quantum" ]	&& local quantum="quantum $class_quantum"

	# construct the stab for group class
	# later we will check if this is accidentally used in leaf classes
	local stab=
	if [ ! -z "${class_linklayer}" ]
	then
		[ -z "$class_mtu" ] && class_mtu="${parent_mtu}"

		stab="stab"
		test ! -z "${class_linklayer}"	&& stab="${stab} linklayer ${class_linklayer}"
		test ! -z "${class_overhead}"	&& stab="${stab} overhead ${class_overhead}"
		test ! -z "${class_tsize}"	&& stab="${stab} tsize ${class_tsize}"
		test ! -z "${class_mtu}"	&& stab="${stab} mtu ${class_mtu}"
		test ! -z "${class_mpu}"	&& stab="${stab} mpu ${class_mpu}"
	fi

	# check it the user overbooked the parent
	parent_sumrate=$(( parent_sumrate + class_rate ))
	local info_color="${COLOR_GREEN}"
	[ ${parent_sumrate} -gt ${parent_rate} ] && local info_color="${COLOR_RED}"

	if [ ${class_group} -eq 1 -a ! -z "${stab}" ]
	then
		echo >&2 -e " ${info_color}${COLOR_BOLD}(${class_classid}, $((class_rate*8/1000))/$((class_ceil*8/1000))kbit, prio ${class_prio}, MTU ${class_mtu}, quantum ${class_quantum})${COLOR_RESET}"
	else
		echo >&2 -e " ${info_color}${COLOR_BOLD}(${class_classid}, $((class_rate*8/1000))/$((class_ceil*8/1000))kbit, prio ${class_prio})${COLOR_RESET}"
	fi

	# keep track of all classes in the interface, so that the matches can name them to get their flowid
	interface_classes="${interface_classes} ${class_name}|${class_filters_flowid}"
	interface_classes_ids="${interface_classes_ids} ${ncid}"

	class_default_class=
	if [ ${class_group} -eq 1 ]
	then
		# this class will have subclasses

		class_class_prio=0
		(( interface_default_counter += 1 ))

		# the default class that all unmatched traffic will be sent to
		class_default_class="$((interface_default_class + interface_default_counter))"

		# if the user added a stab, we need a qdisc and a slave class below the qdisc
		if [ ! -z "${stab}" ]
		then
			# this is a group class with a linklayer
			# we add a qdisc with the stab, and an HTB class below it

			# add the class
			tc class add dev ${interface_realdev} parent ${parent_classid} classid ${class_classid} htb ${rate} ${ceil} ${burst} ${cburst} prio ${class_prio} ${quantum}

			# attach a qdisc
			tc qdisc add dev ${interface_realdev} parent ${class_classid} handle ${class_major}: ${stab} htb default ${class_default_class}

			# attach a class below the qdisc
			tc class add dev ${interface_realdev} parent ${class_major}: classid ${class_major}:1 htb ${rate} ${ceil} ${burst} ${cburst} ${quantum}

			# the parent of the child classes
			class_classid="${class_major}:1"

			# the qdisc the filters of all child classes should be attached to
			class_filters_to="${class_major}:0"

			class_class_counter=10
			class_stab=1
		else
			# this is a group class without a linklayer

			# add the class
			tc class add dev ${interface_realdev} parent ${parent_classid} classid ${class_classid} htb ${rate} ${ceil} ${burst} ${cburst} prio ${class_prio} ${quantum}

			# there is no need for a qdisc (HTB class directly attached to an HTB class)

			class_major=${parent_major}
			class_filters_to="${class_classid}"

			class_class_counter=${parent_class_counter}
			class_stab=0
		fi

		# if the user didn't give an mtu, set it to our parent's mtu.
		# we do this, just for maintaining inheritance.
		# (we don't set it to this class - will only be used by the subclasses)
		[ -z "${class_mtu}" ] && class_mtu=${parent_mtu}

		# this class will become a parent [parent_push()], as soon as we encounter the next class.
		# we don't push it now as the parent, because we need to add filters to its parent, redirecting traffic to this class.
		# so we add the filters and when we encounter the next class, we push it into the parents' stack, so that it becomes
		# the parent for all classes following, until we encounter its matching 'class group end'.

		if [ ${class_hashfilter} -eq 1 ]
		then
			local mask_hex="$(ip_to_hex ${class_hashfilter_mask})"
			[ "${class_hashfilter_direction}" == "src" ] && local hashkey_pos=12
			[ "${class_hashfilter_direction}" == "dst" ] && local hashkey_pos=16
			[[ "${mask_hex}" =~ ^[[:alnum:]]{8}$ ]] || error "Unable to convert ${class_hashfilter_mask} to hex!"
			tc filter add dev ${interface_realdev} parent 1:0 protocol all prio 2 handle 10: u32 divisor 256
			tc filter add dev ${interface_realdev} parent 1:0 protocol all prio 2 u32 ht 800:: match ip ${class_hashfilter_direction} ${class_hashfilter_prefix_network}/${class_hashfilter_prefix_mask} hashkey mask 0x${mask_hex} at ${hashkey_pos} link 10:
		fi
	else
		# this is a leaf class (no child classes possible)

		if [ ! -z "${stab}" ]
		then
			error "Linklayer can be used only in interfaces and group classes."
			exit 1
		fi

		# add the class
		tc class add dev ${interface_realdev} parent ${parent_classid} classid ${class_classid} htb ${rate} ${ceil} ${burst} ${cburst} prio ${class_prio} ${quantum}

		# default qdisc options
		if [ -z "${class_qdisc_options}" -o "${class_qdisc_options}" = "default" ]
		then
			# the user didn't give options to this class' qdisc
			# find the global qdisc default

			eval "local qdisc_options=\${FIREQOS_DEFAULT_QDISC_OPTIONS_$class_qdisc}"

			if [ -z "${qdisc_options}" ]
			then
				# there is no global default
				# check if we have an internal default for it

				case "${class_qdisc}" in
					sfq)	qdisc_options="perturb 10 quantum ${class_quantum}"
						;;
				esac
			fi
		else
			local qdisc_options="${class_qdisc_options}"
		fi
		local qdisc="${class_qdisc} ${qdisc_options}"

		# attach a qdisc, if we have to
		if [ ! "${class_qdisc}" = "none" ]
		then
			local qdisc_command="dev ${interface_realdev} ${stab} parent ${class_classid} handle ${class_major}: ${qdisc}"
			tc qdisc add ${qdisc_command}
		fi

		# if this is the default, make sure we don't added again
		if [ "${class_name}" = "default" ]
		then
			parent_default_added=1
			interface_classes_monitor="${interface_classes_monitor} ${parent_path}${class_name}|$parent_path${class_name}|${class_classid}|${class_major}:"
		else
			interface_classes_monitor="${interface_classes_monitor} ${class_name}|$parent_path${class_name}|${class_classid}|${class_major}:"
		fi
	fi

	local name="${class_name}"
	[ ${parent_stack_size} -gt 1 ] && local name="${parent_name:0:2}/${class_name}"

	# save the configuration
	$CAT_CMD >>"${FIREQOS_DIR}/${interface_name}.conf" <<EOF
class_${ncid}_name="${name}"
class_${ncid}_path="${parent_path}${class_name}"
class_${ncid}_dev="${interface_realdev}"
class_${ncid}_classid="${class_classid}"
class_${ncid}_priority="${class_prio}"
class_${ncid}_rate="${class_rate}"
class_${ncid}_ceil="${class_ceil}"
class_${ncid}_burst="${class_burst}"
class_${ncid}_cburst="${class_cburst}"
class_${ncid}_quantum="${class_quantum}"
class_${ncid}_qdisc="${class_qdisc}"
class_${ncid}_qdisc_parent="${class_classid}"
class_${ncid}_qdisc_handle="${class_major}:"
class_${ncid}_qdisc_stab="${stab}"
class_${ncid}_qdisc_options="${qdisc_options}"
class_${ncid}_qdisc_command="${qdisc_command}"
class_${ncid}_group="${class_group}"
class_${ncid}_hashfilter="${class_hashfilter}"
class_${ncid}_hashfilter_direction="${class_hashfilter_direction}"
class_${ncid}_hashfilter_prefix="${class_hashfilter_prefix}"
class_${ncid}_hashfilter_prefix_network="${class_hashfilter_prefix_network}"
class_${ncid}_hashfilter_prefix_mask="${class_hashfilter_prefix_mask}"
class_${ncid}_hashfilter_mask="${class_hashfilter_mask}"
class_${ncid}_hashfilter_key="${class_hashfilter_key}"
EOF
	return 0
}

find_port_masks() {
	# echo >&2 "${FUNCNAME} ${@}"
	local from=$(($1)) to=$(($2)) i= base= end= mask= next=

	test -z "${from}" && from="${to}"
	test -z "${from}" && return 1

	if [ -z "${to}" ]
	then
		[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && echo >&2 "${from}/0xffff"
		echo "${from}/0xffff"
		return 0
	fi

	if [ ${from} -ge ${to} ]
	then
		[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && echo >&2 "${from}/0xffff"
		echo "${from}/0xffff"
		return 0
	fi

	# find the biggest power of two that fits in the range
	# starting from $from
	for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
	do
		base=$(( (from >> i) << i ))
		end=$(( base + (1 << i) - 1 ))

		[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && printf >&2 ": >>> examine bit %d, from 0x%04x (%s) to 0x%04x (%s), " ${i} ${base} ${base} ${end} ${end}

		[ ${base} -ne ${from} ] && break
		[ ${end} -gt ${to} ] && break

		[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && echo >&2 " ok"
	done
	[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && echo >&2 " failed"

	(( i += -1 ))
	base=$(( (from >> i) << i ))
	end=$(( base + (1 << i) - 1 ))
	mask=$(( (0xffff >> i) << i ))

	[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && printf >&2 ": 0x%04x (%d) to 0x%04x (%d),  match 0x%04x (%d) to 0x%04x (%d) with mask 0x%04x \n" ${from} ${from} ${to} ${to} ${base} ${base} ${end} $$
	printf "%d/0x%04x\n" ${base} ${mask}
	if [ ${end} -lt ${to} ]
	then
		next=$[end + 1]
		[ ${FIREQOS_DEBUG_PORTS} -eq 1 ] && printf >&2 "\n: next range 0x%04x (%d) to 0x%04x (%d)\n" ${next} ${next} ${to} ${to}
		find_port_masks ${next} ${to}
	fi
	return 0
}

expand_ports() {
	# echo >&2 "${FUNCNAME} ${@}"
	local i=
	for i in ${@//,/ }
	do
		case "${i}" in
			any|all)
				echo "${i}"
				;;

			*:*)
				find_port_masks ${i//:/ }
				;;

			*-*)
				find_port_masks ${i//-/ }
				;;

			*)	find_port_masks ${i}
				;;
		esac
		shift
	done
	return 0
}

match_count=0
match4() { ipv4 match "${@}"; }
match6() { ipv6 match "${@}"; }
match46() { ipv46 match "${@}"; }
match() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	(( match_count += 1 ))

	if [ "z${1}" = "z-ns" ]
	then
		shift
	else
		[ ${interface_save} -eq 1 ] && save ${FUNCNAME} "$@"
	fi

	[ ${FIREQOS_DEBUG} -eq 1 -o ${FIREQOS_SHOW_MATCHES} -eq 1 ] && echo >&2 -e "${COLOR_GREEN}:		${FUNCNAME} $*${COLOR_RESET}"

	local 	proto=any port=any sport=any dport=any src=any dst=any ip=any tos=any dscp=any mark= \
		srcmac=any dstmac=any class=${class_name} flowid=${class_filters_flowid} \
		ack=0 syn=0 at= custom= tcproto= ipv4=${class_ipv4} ipv6=${class_ipv6} \
		reverse=0 estimator_interval= estimator_decay= police_arg= \
		prio= limit_rate= t= insidegre=0 hashtable=

	case "${force_ipv}" in
		4)
			ipv4=1
			ipv6=0
			;;

		6)
			ipv4=0
			ipv6=1
			;;

		46)
			ipv4=1
			ipv6=1
			;;
	esac

	while [ ! -z "${1}" ]
	do
		case "${1}" in
			input|output)
				reverse=1
				[ "${interface_inout}" = "${1}" ] && reverse=0
				;;

			reverse)
				reverse=1
				;;

			at)
				at="$2"
				shift
				;;

			root)
				at="root"
				;;

			syn|syns)
				syn=1
				;;

			ack|acks)
				ack=1
				;;

			insidegre)
				insidegre=1
				;;

			arp)
				tcproto="$1"
				;;

			tcp|TCP|udp|UDP|icmp|ICMP|gre|GRE|ipv6|IPv6|all)
				proto="$1"
				;;

			tos)
				tos="${2//,/ }"
				shift
				;;

			dscp)
				dscp="${2//,/ }"
				shift
				;;

			connmark|connmarks)
				mark="${mark} $(mark_value connmark ${2//,/ })"
				shift
				;;

			mark|marks)
				mark="${mark} $(mark_value usermark ${2//,/ })"
				shift
				;;

			custommark|custommarks)
				mark="${mark} $(mark_value $2 ${3//,/ })"
				shift 2
				;;

			rawmark|rawmarks)
				local m
				for m in ${2//,/ }
				do
					[[ ! ${m} =~ '/' ]] && m="${m}/0xffffffff"
					mark="${mark} ${m}"
				done
				shift
				;;

			proto|protocol|protocols)
				proto="${2//,/ }"
				shift
				;;

			port|ports)
				port="${2//,/ }"
				shift
				;;

			sport|sports)
				sport="${2//,/ }"
				shift
				;;

			dport|dports)
				dport="${2//,/ }"
				shift
				;;

			src)
				src="${2//,/ }"
				shift
				;;

			dst)
				dst="${2//,/ }"
				shift
				;;

			prio)
				prio="$2"
				shift
				;;

			ip|ips|net|nets|host|hosts)
				ip="${2//,/ }"
				shift
				;;

			class)
				class="$2"
				shift
				;;

			flowid)
				flowid="$2"
				shift
				;;

			custom)
				custom="$2"
				shift
				;;

			estimator)
				estimator_interval="$2"
				estimator_decay="$3"
				shift 2
				;;

			police)
				police_arg="$2"
				shift
				;;

			limit)
				limit_rate="`rate2bps $2 ${class_rate}`"
				estimator_interval="500msec"
				estimator_decay="1sec"
				police_arg="rate $[limit_rate * 8 / 1000]kbit burst 50kb continue"
				shift
				;;

			srcmac|smac)
				srcmac="${2//,/ }"
				srcmac="${srcmac//:/}"
				shift
				;;

			dstmac|dmac)
				dstmac="${2//,/ }"
				dstmac="${dstmac//:/}"
				shift
				;;

			*)	error "Cannot understand what the filter '${1}' is."
				return 1
				;;
		esac
		shift
	done

	if [ -z "${mark}" ]
	then
		mark="any"
	else
		if [ ${interface_inout} = input -a -z "${FIREQOS_CONNMARK_RESTORE}" ]
		then
			(( FIREQOS_MARKS_ON_INPUT_USED += 1 ))
		fi
	fi

	# if reverse, flip src/dst sport/dport
	if [ ${reverse} -eq 1 ]
	then
		t="${src}"
		src="${dst}"
		dst="${t}"

		t="${sport}"
		sport="${dport}"
		dport="${t}"

		t="${srcmac}"
		srcmac="${dstmac}"
		dstmac="${t}"
	fi

	if [ -z "${prio}" ]
	then
		prio=$((class_matchid * FIREQOS_MATCHES_STEP))
		(( class_matchid += 1 ))
	fi

	port="$(expand_ports ${port})"
	sport="$(expand_ports ${sport})"
	dport="$(expand_ports ${dport})"

	[ -z "${proto}" ]	&& error "Cannot accept empty protocol."			&& return 1
	[ -z "${port}" ]	&& error "Cannot accept empty ports."				&& return 1
	[ -z "${sport}" ]	&& error "Cannot accept empty source ports."		&& return 1
	[ -z "${dport}" ]	&& error "Cannot accept empty destination ports."	&& return 1
	[ -z "${src}" ]		&& error "Cannot accept empty source IPs."			&& return 1
	[ -z "${dst}" ]		&& error "Cannot accept empty destination IPs."		&& return 1
	[ -z "${ip}" ]		&& error "Cannot accept empty IPs."					&& return 1
	[ -z "${tos}" ]		&& error "Cannot accept empty TOS."					&& return 1
	[ -z "${dscp}" ]	&& error "Cannot accept empty DSCP."				&& return 1
	[ -z "${mark}" ]	&& error "Cannot accept empty MARK."				&& return 1
	[ -z "${srcmac}" ] 	&& error "Cannot accept empty source MAC."			&& return 1
	[ -z "${dstmac}" ] 	&& error "Cannot accept empty destination MAC."		&& return 1

	[ ! "${port}" = "any" -a ! "${sport}" = "any" ]	&& error "Cannot match 'port' and 'sport'." && exit 1
	[ ! "${port}" = "any" -a ! "${dport}" = "any" ]	&& error "Cannot match 'port' and 'dport'." && exit 1
	[ ! "${ip}" = "any" -a ! "${src}" = "any" ]	&& error "Cannot match 'ip' and 'src'." && exit 1
	[ ! "${ip}" = "any" -a ! "${dst}" = "any" ]	&& error "Cannot match 'ip' and 'dst'." && exit 1
	[ ! "${dscp}" = "any" -a ! "${tos}" = "any" ]   && error "Cannot match both 'dscp' and 'tos''." && exit 1

	local device=${interface_realdev}
	local parent="${parent_filters_to}"
	if [ -z "${flowid}" ]
	then
		error "Please set 'flowid' for match statements above all classes."
		exit 1
	elif [ ! "${class}" = "${class_name}" ]
	then
		local c=
		for c in ${interface_classes}
		do
			local cn="`echo $c | ${CUT_CMD} -d '|' -f 1`"
			local cf="`echo $c | ${CUT_CMD} -d '|' -f 2`"

			if [ "${class}" = "${cn}" ]
			then
				local flowid=${cf}
				break
			fi
		done

		if [ -z "${flowid}" ]
		then
			error "Cannot find class '${class}'"
			exit 1
		fi
	fi

	if [ ! -z "${at}" ]
	then
		case "${at}" in
			root)
				local parent="${interface_filters_to}"
				;;

			*)
				local c=
				for c in ${interface_classes}
				do
					local cn="`echo $c | ${CUT_CMD} -d '|' -f 1`"
					local cf="`echo $c | ${CUT_CMD} -d '|' -f 2`"

					if [ "${class}" = "${cn}" ]
					then
						local parent=${cf}
						break
					fi
				done

				if [ -z "${parent}" ]
				then
					error "Cannot find class '${class}'"
					exit 1
				fi
				;;
		esac
	fi

	if [ -z "${tcproto}" ]
	then
		[ ${ipv4} -eq 1 ] && tcproto="${tcproto} ip"
		[ ${ipv6} -eq 1 ] && tcproto="${tcproto} ipv6"
	fi

	local 	ipvx= ether_type= ack_arg= syn_arg= proto_arg= tcproto_arg= tproto= \
		pid= tip= mtip= otherip= ip_arg= tsrc= src_arg= tdst= dst_arg= \
		tport= mtport= otherport= port_arg= mportmask= tsport= sport_arg= tdport= dport_arg= \
		u32= ttos= tos_arg= tos_value= tos_mask= tdscp= estimator= police= sm1= sm2= dm1= dm2= \
		dmac= dmac_arg= smac= smac_arg= tmark= mark_arg=

	# create all tc filter statements
	for tcproto_arg in ${tcproto}
	do
		ipvx=
		ether_type=

		case ${tcproto_arg} in
			ip)
				ether_type="0x0800"
				;;

			ipv6)
				ether_type="0x86DD"
				ipvx="6"
				;;

			*)
		esac

	for tproto in $proto
	do
		ack_arg=
		syn_arg=
		proto_arg=
		case ${tproto} in
			any)	;;

			all)
				proto_arg="match ip${ipvx} protocol 0 0x00"
				;;

			ipv6|IPv6)
				proto_arg="match ip${ipvx} protocol 41 0xff"
				;;

			icmp|ICMP)
				if [ "${ipvx}" = "6" ]
				then
					proto_arg="match ip${ipvx} protocol 58 0xff"
				else
					proto_arg="match ip${ipvx} protocol 1 0xff"
				fi
				;;

			tcp|TCP)
				if [ "${insidegre}" -eq 1 ]
					then
					proto_arg="match u8 0x06 0xff at 33"
				else
					proto_arg="match ip${ipvx} protocol 6 0xff"
				fi

				# http://www.lartc.org/lartc.html#LARTC.ADV-FILTER
				if [ ${ack} -eq 1 ]
				then
					if [ "${insidegre}" -eq 1 ]
					then
						ack_arg="match u8 0x05 0x0f at 24 match u16 0x0000 0xffc0 at 26 match u8 0x10 0xff at 57"
					else
						if [ "${ipvx}" = "6" ]
						then
							ack_arg="match u8 0x10 0xff at nexthdr+13"
							error "I don't know how to match ACKs in ipv6"
							exit 1
						else
							ack_arg="match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2 match u8 0x10 0xff at 33"
						fi
					fi
				fi

				if [ ${syn} -eq 1 ]
				then
					if [ "${ipvx}" = "6" ]
					then
						# I figured this out, based on the ACK match
						syn_arg="match u8 0x02 0x02 at nexthdr+13"

						error "I don't know how to match SYNs in ipv6"
						exit 1
					else
						# I figured this out, based on the ACK match
						syn_arg="match u8 0x02 0x02 at 33"
					fi
				fi
				;;

			udp|UDP)
				if [ ${insidegre} -eq 1 ]
				then
					proto_arg="match u8 0x11 0xff at 33"
				else
					proto_arg="match ip${ipvx} protocol 17 0xff"
				fi
				;;

			gre|GRE)
				if [ ${insidegre} -eq 1 ]
				then
					proto_arg="match u8 0x2f 0xff at 33"
				else
					proto_arg="match ip${ipvx} protocol 47 0xff"
				fi
				;;

			+([0-9]))
				if [ ${insidegre} -eq 1 ]
				then
					tproto_hex=$(printf '%02X' ${tproto})
					proto_arg="match u8 0x${tproto_hex} 0xff at 33"
				else
					proto_arg="match ip${ipvx} protocol ${tproto} 0xff"
				fi
				;;

			*)	pid=`${CAT_CMD} /etc/protocols | ${EGREP_CMD} -i "^${tproto}[[:space:]]" | $TAIL_CMD -n 1 | ${SED_CMD} "s/[[:space:]]\+/ /g" | ${CUT_CMD} -d ' ' -f 2`
				if [ -z "${pid}" ]
				then
					error "Cannot find protocol '${tproto}' in /etc/protocols."
					return 1
				fi
				if [ ${insidegre} -eq 1 ]
				then
					tproto_hex=$(printf '%02X' ${pid})
					proto_arg="match u8 0x${tproto_hex} 0xff at 33"
				else
					proto_arg="match ip${ipvx} protocol ${pid} 0xff"
				fi
				;;
		esac

	mtip=src
	otherip="dst ${ip}"
	[ "${ip}" = "any" ] && otherip=
	for tip in ${ip} ${otherip}
	do
		[ "${tip}" = "dst" ] && mtip="dst" && continue

		ip_arg=
		case "${tip}" in
			any)
				;;

			all)
				ip_arg="match ip${ipvx} $mtip 0.0.0.0/0"
				;;

			*)	ip_arg="match ip${ipvx} ${mtip} ${tip}"
				;;
		esac

	for tsrc in ${src}
	do
		if [ ${insidegre} -eq 1 ] && [[ "${tsrc}" =~ ^[[:digit:]] ]]
		then
			if [[ "${tsrc}" =~ ^([[:graph:]]+)/([[:graph:]]+)$ ]]
			then
				tsrc=${BASH_REMATCH[1]}
				tmask=${BASH_REMATCH[2]}
			else
				tmask="255.255.255.255"
			fi
			if [ ! -z "${tmask}" ] && [[ "${tmask}" =~ ^[[:digit:]]+$ ]]
			then
				tmask=$(cidr_length_to_mask ${tmask})
			fi
			tsrc=$(ip_to_hex ${tsrc})
			tmask=$(ip_to_hex ${tmask})
			if [ -z "${tsrc}" ] || [ -z "${tmask}" ]
			then
				echo "incomplete tsrc/tmask found!"
				exit 1
			fi
		fi
		src_arg=
		case "${tsrc}" in
			any)	;;

			all)
				src_arg="match ip${ipvx} src 0.0.0.0/0"
				;;

			*)	if [ ${insidegre} -eq 1 ]
				then
					src_arg="match u32 0x${tsrc} ${tmask} at 36"
				else
					src_arg="match ip${ipvx} src ${tsrc}"
				fi
				;;
		esac

	for tdst in ${dst}
	do
		if [ ${insidegre} -eq 1 ] && [[ "${tdst}" =~ ^[[:digit:]] ]]
		then
			if [[ "${tdst}" =~ ^([[:graph:]]+)/([[:graph:]]+)$ ]]
			then
				tdst=${BASH_REMATCH[1]}
				tmask=${BASH_REMATCH[2]}
			else
				tmask="255.255.255.255"
			fi
			if [ ! -z "${tmask}" ] && [[ "${tmask}" =~ ^[[:digit:]]+$ ]]
			then
				tmask=$(cidr_length_to_mask ${tmask})
			fi
			tdst=$(ip_to_hex ${tdst})
			tmask=$(ip_to_hex ${tmask})
			if [ -z "${tdst}" ] || [ -z "${tmask}" ]
			then
				echo "incomplete tdst/tmask found!"
				exit 1
			fi
		fi
		dst_arg=
		case "${tdst}" in
			any)	;;

			all)	dst_arg="match ip${ipvx} dst 0.0.0.0/0"
				;;

			*)	if [ ${insidegre} -eq 1 ]
				then
					dst_arg="match u32 0x${tdst} ${tmask} at 40"
				else
					dst_arg="match ip${ipvx} dst ${tdst}"
				fi
				;;
		esac

	mtport=sport
	otherport="dport ${port}"
	[ "${port}" = "any" ] && otherport=
	for tport in ${port} ${otherport}
	do
		[ "${tport}" = "dport" ] && mtport="dport" && continue

		port_arg=
		case "${tport}" in
			any)	;;

			all)	port_arg="match ip${ipvx} ${mtport} 0 0x0000"
				;;

			*)	mportmask=`echo ${tport} | ${TR_CMD} "/" " "`
				port_arg="match ip${ipvx} ${mtport} ${mportmask}"
				;;
		esac

	for tsport in ${sport}
	do
		sport_arg=
		case "$tsport" in
			any)	;;

			all)	sport_arg="match ip${ipvx} sport 0 0x0000"
				;;

			*)	mportmask=`echo ${tsport} | ${TR_CMD} "/" " "`
				if [ ${insidegre} -eq 1 ]
				then
					sport_arg="match u16 ${mtport} ${mportmask} at 44"
				else
					sport_arg="match ip${ipvx} sport ${mportmask}"
				fi
				;;
		esac

	for tdport in $dport
	do
		dport_arg=
		case "${tdport}" in
			any)	;;

			all)	dport_arg="match ip${ipvx} dport 0 0x0000"
				;;

			*)	mportmask=`echo ${tdport} | $TR_CMD "/" " "`
				if [ ${insidegre} -eq 1 ]
				then
					dport_arg="match u16 ${tdport} ${mportmask} at 46"
				else
					dport_arg="match ip${ipvx} dport ${mportmask}"
				fi
				;;
		esac

	for ttos in ${tos}
	do
		tos_arg=
		tos_value=
		tos_mask=
		case "${ttos}" in
			any)	;;

			lowdelay|min-delay|minimize-delay|minimum-delay|low-delay|interactive)
				tos_value="0x10"
				tos_mask="0x10"
				;;

			throughput|maximize-throughput|maximum-throughput|max-throughput|high-throughput|bulk)
				tos_value="0x08"
				tos_mask="0x08"
				;;

			reliability|maximize-reliability|maximum-reliability|max-reliability|reliable)
				tos_value="0x04"
				tos_mask="0x04"
				;;

			mincost|min-cost|minimize-cost|minimum-cost|low-cost|cheap)
				tos_value="0x02"
				tos_mask="0x02"
				;;

			normal|normal-service)
				tos_value="0x00"
				tos_mask="0x1e"
				;;

			all)
				tos_value="0x00"
				tos_mask="0x00"
				;;

			*)
				tos_value="`echo "${ttos}/" | ${CUT_CMD} -d '/' -f 1`"
				tos_mask="`echo "${ttos}/" | ${CUT_CMD} -d '/' -f 2`"
				[ -z "${tos_mask}" ] && tos_mask="0xff"

				if [ -z "${tos_value}" ]
				then
					error "Empty TOS value is not allowed."
					exit 1
				fi
				;;
		esac
		if [ ! -z "${tos_value}" -a ! -z "${tos_mask}" ]
		then
			if [ "$ipvx" = "6" ]
			then
				tos_arg="match ip6 priority ${tos_value} ${tos_mask}"
			else
				tos_arg="match ip tos ${tos_value} ${tos_mask}"
			fi
		fi

	for tdscp in ${dscp}
	do
		dscp_value=
		tos_value=
		tos_mask=
		case "${tdscp^^}" in
			any)	;;

			CS0)
				tos_value="0x00"
				tos_mask="0xfc"
				;;
			CS1)
				tos_value="0x20"
				tos_mask="0xfc"
				;;
			CS2)
				tos_value="0x40"
				tos_mask="0xfc"
				;;
			CS3)
				tos_value="0x60"
				tos_mask="0xfc"
				;;
			CS4)
				tos_value="0x80"
				tos_mask="0xfc"
				;;
			CS5)
				tos_value="0xA0"
				tos_mask="0xfc"
				;;
			CS6)
				tos_value="0xC0"
				tos_mask="0xfc"
				;;
			CS7)
				tos_value="0xE0"
				tos_mask="0xfc"
				;;
			AF11)
				tos_value="0x28"
				tos_mask="0xfc"
				;;
			AF12)
				tos_value="0x30"
				tos_mask="0xfc"
				;;
			AF13)
				tos_value="0x38"
				tos_mask="0xfc"
				;;
			AF21)
				tos_value="0x48"
				tos_mask="0xfc"
				;;
			AF22)
				tos_value="0x50"
				tos_mask="0xfc"
				;;
			AF23)
				tos_value="0x58"
				tos_mask="0xfc"
				;;
			AF31)
				tos_value="0x68"
				tos_mask="0xfc"
				;;
			AF32)
				tos_value="0x70"
				tos_mask="0xfc"
				;;
			AF33)
				tos_value="0x78"
				tos_mask="0xfc"
				;;
			AF41)
				tos_value="0x88"
				tos_mask="0xfc"
				;;
			AF42)
				tos_value="0x90"
				tos_mask="0xfc"
				;;
			AF43)
				tos_value="0x98"
				tos_mask="0xfc"
				;;
			EF)
				tos_value="0xB8"
				tos_mask="0xfc"
				;;
			*)
				if [ -z "${tdscp}" ]
				then
					error "Invalid DSCP value found."
					exit 1
				fi
				;;
		esac
		if [ ! -z "${tos_value}" -a ! -z "${tos_mask}" ]
		then
			if [ "$ipvx" = "6" ]
			then
				tos_arg="match ip6 priority ${tos_value} ${tos_mask}"
			else
				if [ "${insidegre}" -eq 1 ]
				then
					tos_arg="match u8 ${tos_value} ${tos_mask} at 25"
				else
					tos_arg="match ip tos ${tos_value} ${tos_mask}"
				fi
			fi
		fi

	for tmark in ${mark}
	do
		# http://mailman.ds9a.nl/pipermail/lartc/2007q3/021364.html
		mark_arg=
		case "${tmark}" in
			any)	;;
			*)
				# mark_arg="handle $tmark fw"
				mark_arg="u32 match mark ${tmark//\// }"
				;;
		esac

	for smac in ${srcmac}
	do
		smac_arg=
		if [ ! "${smac}" = "any" ]
		then
			sm1=`echo "${smac}" | $CUT_CMD -b 1-8`
			sm2=`echo "${smac}" | $CUT_CMD -b 9-12`
			smac_arg="u32"
			test ! -z "${ether_type}" && smac_arg="${smac_arg} match u16 ${ether_type} 0xFFFF at -2"
			smac_arg="${smac_arg} match u16 0x${sm2} 0xFFFF at -4 match u32 0x${sm1} 0xFFFFFFFF at -8"
		fi

	for dmac in ${dstmac}
	do
		dmac_arg=
		if [ ! "${dmac}" = "any" ]
		then
			dm1=`echo "${dmac}" | $CUT_CMD -b 1-4`
			dm2=`echo "${dmac}" | $CUT_CMD -b 5-12`
			dmac_arg="u32"
			test ! -z "${ether_type}" && dmac_arg="${dmac_arg} match u16 ${ether_type} 0xFFFF at -2"
			dmac_arg="${dmac_arg} match u32 0x${dm2} 0xFFFFFFFF at -12 match u16 0x${dm1} 0xFFFF at -14"
		fi

	if [ "${tcproto_arg}" = "arp" ]
	then
		u32="u32 match u32 0 0"
	else
		if [ "${insidegre}" -eq 1 ]
		then
			u32="u32 match ip${ipvx} protocol 47 0xff"
		else
			u32="u32"
		fi
		[ -z "${proto_arg}${ip_arg}${src_arg}${dst_arg}${port_arg}${sport_arg}${dport_arg}${tos_arg}${ack_arg}${syn_arg}" ] && u32=
	fi

	# [ ! -z "${u32}" -a ! -z "${mark_arg}" ] && mark_arg="and ${mark_arg}"

	estimator=
	if [ ! -z "${estimator_interval}" -a ! -z "${estimator_decay}" ]
	then
		estimator="estimator ${estimator_interval} ${estimator_decay}"
	fi

	police=
	if [ ! -z "${police_arg}" ]
	then
		police="police ${police_arg}"
	fi

	if [ ${class_hashfilter} -eq 1 ]
	then
		parent="1:0"
		hashtable="ht 10:${class_hashfilter_key}"
		u32="u32 ${hashtable}"
	fi

	tc filter add \
		dev ${device} \
		parent ${parent} \
		protocol ${tcproto_arg} \
		prio ${prio} \
		${estimator} \
		${u32} \
		${proto_arg} \
		${ip_arg} \
		${src_arg} \
		${dst_arg} \
		${port_arg} \
		${sport_arg} \
		${dport_arg} \
		${tos_arg} \
		${ack_arg} \
		${syn_arg} \
		${mark_arg} \
		${smac_arg} \
		${dmac_arg} \
		${custom} \
		flowid ${flowid} \
		${police}

	done # dstmac
	done # srcmac
	done # mark
	done # tos
	done # dscp
	done # dport
	done # sport
	done # port
	done # dst
	done # src
	done # ip
	done # proto

	# increase the counter between tc protocols
	(( prio += 1 ))

	done # tcproto (ipv4, ipv6)

	return 0
}

ematch4() { ipv4 ematch "${@}"; }
ematch6() { ipv6 ematch "${@}"; }
ematch46() { ipv46 ematch "${@}"; }
ematch() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	(( match_count += 1 ))

	if [ "z${1}" = "z-ns" ]
	then
		shift
	else
		[ ${interface_save} -eq 1 ] && save ${FUNCNAME} "$@"
	fi

	[ ${FIREQOS_DEBUG} -eq 1 -o ${FIREQOS_SHOW_MATCHES} -eq 1 ] && echo >&2 -e "${COLOR_GREEN}:		${FUNCNAME} $*${COLOR_RESET}"

	local 	class=${class_name} flowid=${class_filters_flowid} \
		ipv4=${class_ipv4} ipv6=${class_ipv6} \

	case "${force_ipv}" in
		4)
			ipv4=1
			ipv6=0
			;;

		6)
			ipv4=0
			ipv6=1
			;;

		46)
			ipv4=1
			ipv6=1
			;;
	esac

	if [ -z "${prio}" ]
	then
		prio=$((class_matchid * FIREQOS_MATCHES_STEP))
		(( class_matchid += 1 ))
	fi

	local device=${interface_realdev}
	local parent="${parent_filters_to}"
	if [ -z "${flowid}" ]
	then
		error "Please set 'flowid' for match statements above all classes."
		exit 1
	elif [ ! "${class}" = "${class_name}" ]
	then
		local c=
		for c in ${interface_classes}
		do
			local cn="`echo $c | ${CUT_CMD} -d '|' -f 1`"
			local cf="`echo $c | ${CUT_CMD} -d '|' -f 2`"

			if [ "${class}" = "${cn}" ]
			then
				local flowid=${cf}
				break
			fi
		done

		if [ -z "${flowid}" ]
		then
			error "Cannot find class '${class}'"
			exit 1
		fi
	fi

	if [ ! -z "${at}" ]
	then
		case "${at}" in
			root)
				local parent="${interface_filters_to}"
				;;

			*)
				local c=
				for c in ${interface_classes}
				do
					local cn="`echo $c | ${CUT_CMD} -d '|' -f 1`"
					local cf="`echo $c | ${CUT_CMD} -d '|' -f 2`"

					if [ "${class}" = "${cn}" ]
					then
						local parent=${cf}
						break
					fi
				done

				if [ -z "${parent}" ]
				then
					error "Cannot find class '${class}'"
					exit 1
				fi
				;;
		esac
	fi

	tc filter add \
		dev ${device} \
		parent ${parent} \
		prio ${prio} \
		basic match "${@}" \
		flowid ${flowid} \
		${police}

	# increase the counter between tc protocols
	(( prio += 1 ))

	return 0
}

clear_everything() {
	[ ${FIREQOS_DEBUG_FLOW} -eq 1 ] && echo >&2 " >> ${FUNCNAME} ${@}"

	local iface= found=

	local fqifaces=
	local ifaces=
	local ifbs=

	if [ ! -z "${*}" ]
	then
		for iface in ${*}
		do
			found=0
			if [ -f "${FIREQOS_DIR}/ifaces/${iface}-ifb" ]
			then
				fqifaces="${fqifaces} `${CAT_CMD} ${FIREQOS_DIR}/ifaces/${iface}-ifb`"
				ifaces="${ifaces} ${iface}-ifb"
				ifbs="${ifbs} ${iface}-ifb"
				found=1
			fi
			if [ -f "${FIREQOS_DIR}/ifaces/${iface}" ]
			then
				fqifaces="${fqifaces} `${CAT_CMD} ${FIREQOS_DIR}/ifaces/${iface}`"
				ifaces="${ifaces} ${iface}"
				found=1
			fi

			test ${found} -eq 1 && continue
			echo >&2 "There is no device named ${iface} configured by FireQOS."
		done
	else
		fqifaces="`fireqos_active_interfaces`"
		ifaces="`$LS_CMD ${FIREQOS_DIR}/ifaces/ 2>/dev/null`"
		ifbs="`$LS_CMD ${FIREQOS_DIR}/ifbs/ 2>/dev/null`"
	fi

	echo >&2
	echo >&2 "Clearing FireQOS interface(s) ${fqifaces}..."
	echo >&2

	# remove qdiscs
	for iface in ${ifaces}
	do
		test ! -f "${FIREQOS_DIR}/ifaces/${iface}" && continue

		printf >&2 " %16.16s: " $iface
		echo >&2 "cleared traffic control"

		# remove existing qdisc from all devices
		runcmd ${TC_CMD} qdisc del dev ${iface} ingress >/dev/null 2>&1
		runcmd ${TC_CMD} qdisc del dev ${iface} root >/dev/null 2>&1
		$RM_CMD "${FIREQOS_DIR}/ifaces/${iface}"
	done

	# remove IFB devices
	for iface in ${ifbs}
	do
		test ! -f "${FIREQOS_DIR}/ifbs/${iface}" && continue

		printf >&2 " %16.16s: " ${iface}
		echo >&2 "removed IFB device"

		runcmd ${IP_CMD} link del dev ${iface} name ${iface} type ifb >/dev/null 2>&1
		${RM_CMD} "${FIREQOS_DIR}/ifbs/${iface}"
	done

	# remove FireQOS run status
	for iface in ${fqifaces}
	do
		printf >&2 " %16.16s: " ${iface}
		echo >&2 "cleared status info"

		$RM_CMD ${FIREQOS_DIR}/${iface}.conf
	done

	echo >&2
	syslog error "Cleared all FireQOS on ${fqifaces}"

	return 0
}

clear_all_qos_on_all_interfaces() {
	echo >&2
	echo >&2 "Clearing all QoS on all interfaces..."
	echo >&2

	local dev=
	for dev in `${CAT_CMD} /proc/net/dev | ${GREP_CMD} ':' |  ${CUT_CMD} -d ':' -f 1 | ${SED_CMD} "s/ //g" | ${GREP_CMD} -v "^lo$"`
	do
		printf >&2 " %16.16s: " ${dev}
		echo >&2 "cleared traffic control"

		# remove existing qdisc from all devices
		tc ignore-error qdisc del dev ${dev} ingress >/dev/null 2>&1
		tc ignore-error qdisc del dev ${dev} root >/dev/null 2>&1
	done

	echo >&2
	$RMMOD_CMD ifb 2>/dev/null
	echo >&2 " - removed all IFB devices"

	if [ -d ${FIREQOS_DIR} ]
	then
		cd ${FIREQOS_DIR}
		if [ $? -eq 0 ]
		then
			${RM_CMD} interfaces *.conf 2>/dev/null
		fi
		echo >&2 " - cleared FireQOS status"
	fi
	return 0
}

check_root() {
	if [ ! "${UID}" = 0 ]
	then
		echo >&2
		echo >&2
		echo >&2 "Only user root can run FireQOS."
		echo >&2
		exit 1
	fi
}

ip_to_hex () {
	if [ -z "${1}" ]; then
		echo "ip_to_hex() requires at least one parameter!"
		exit 1
	fi
	hex=$(printf '%02x' ${1//./ })
	if [ -z "${hex}" ]; then
		echo "ip_to_hex() failed!"
		exit 1
	fi
	echo ${hex}
}

# https://github.com/firehol/firehol/pull/113
mask2bits() {
        local x="${1}"

        x=$[ x - ( (x >> 1) & 0x55555555) ]
        x=$[ (x & 0x33333333) + ( (x >> 2) & 0x33333333) ]
        x=$[ (x + (x >> 4) ) & 0x0F0F0F0F ]
        x=$[ x + (x >> 8) ]
        x=$[ x + (x >> 16) ]
        echo $[ 1 << (x & 0x0000003F) ]
}

# https://github.com/firehol/firehol/pull/113
cidr_length_to_mask() {
        local n="${1}" hex

        # find the mask in hex
        hex="$(printf "%x" $[ ~(( 1 << ( 32 - n )) -1 ) ])"

        # get the last 8 digits of the number (bash uses 64 bit numbers)
        hex="${hex: -8}"

        printf "%d.%d.%d.%d\n" "0x${hex:0:2}" "0x${hex:2:2}" "0x${hex:4:2}" "0x${hex:6:2}"
}

show_interfaces() {
	if [ -d ${FIREQOS_DIR} ]
	then
		echo >&2
		echo >&2 "The following interfaces are available:"
		fireqos_active_interfaces
		echo >&2
	else
		echo >&2 "No interfaces have been configured."
	fi
}

FIREQOS_STATS_ID="stats.$$.${RANDOM}"
cleanup_stats() {
	local x=
	for x in `$LS_CMD ${FIREQOS_DIR}/${FIREQOS_STATS_ID}.* 2>/dev/null`
	do
		${RM_CMD} ${x}
	done
}

stats_colors() {
	local drops="${1}" overlimits="${2}" requeues="${3}" backlog="${4}" fcolor= bcolor=

	[ $((backlog))    -gt 0 ] && fcolor="${COLOR_BOLD}${COLOR_YELLOW}"
	[ $((requeues))   -gt 0 ] && bcolor="${COLOR_BGBLUE}"
	[ $((overlimits)) -gt 0 ] && bcolor="${COLOR_BGPURPLE}"
	[ $((drops))      -gt 0 ] && bcolor="${COLOR_BGRED}"

	echo -e -n "${fcolor}${bcolor}"
}

htb_stats() {
	local x=

	common_require_cmd $PROGRAM_FILE GAWK_CMD

	trap cleanup_stats EXIT
	trap cleanup_stats SIGHUP

	if [ "`$DATE_CMD +%N`" = "%N" -o "`$DATE_CMD +%N`" = "" ]
	then
		warning "System has low-res time, stats may be inaccurate"
		FIREQOS_LOWRES_TIMER=1
	fi

	if [ -z "$2" -o ! -f "${FIREQOS_DIR}/$2.conf" ]
	then
		echo >&2 "There is no interface named '$2' to show."
		show_interfaces
		exit 1
	fi

	# load the interface configuration
	source "${FIREQOS_DIR}/$2.conf" || exit 1

	# create the awk file to parse tc output
	local 	title="UNSET" unit="Unknown/s" maxn="0" show_speeds=0 resolution=1 show_speeds=0 show=TCDROPS \
		awk_script= number_digits= round= banner_every_lines=20 d= s= n= startedms=0 endedms=0

	case "${1}" in
		drops|dropped)
			title="Packet Drops"
			resolution=1
			unit="packets/s"
			maxn=99999
			show_speeds=0
			show=TCDROPS
			;;

		overlimits|over)
			title="Packet Overlimits"
			resolution=1
			unit="packets/s"
			maxn=99999
			show_speeds=0
			show=TCOVERS
			;;

		requeues)
			title="Packet Requeues"
			resolution=1
			unit="packets/s"
			maxn=99999
			show_speeds=0
			show=TCREQUEUES
			;;

		status)
			title="Class Utilization"
			show_speeds=1
			show=TCSTATS

			# pick the right unit for this interface (bit/s, Kbit, Mbit)
			resolution=1
			[ $((interface_rate * 8)) -gt $((100 * 1000)) ] && resolution=1000
			[ $((interface_rate * 8)) -gt $((200 * 1000000)) ] && resolution=1000000

			unit="bits/s"
			[ ${resolution} = 1000 ] && unit="Kbit/s"
			[ ${resolution} = 1000000 ] && unit="Mbit/s"

			maxn="$(( interface_rate * 8 / resolution * 120 / 100))"
			;;

		*)
			echo "Cannot understand what '$1' status is."
			exit 1
			;;
	esac
	shift

	$CAT_CMD >${FIREQOS_DIR}/${FIREQOS_STATS_ID}.stats.awk <<EOF || exit 1
{
	if( \$2 == "htb" ) {
		value = \$13;
		drops = \$18;
		overs = \$20;
		requeues = \$22;
		backlog = \$25;

		print "TCSTATS_" \$2 "_" \$3 "=\$(( (" value "*8) - OLD_TCSTATS_" \$2 "_" \$3 "));"
		print "OLD_TCSTATS_" \$2 "_" \$3 "=\$((" value "*8));"

		print "TCDROPS_" \$2 "_" \$3 "=\$(( (" drops ") - OLD_TCDROPS_" \$2 "_" \$3 "));"
		print "OLD_TCDROPS_" \$2 "_" \$3 "=\$((" drops "));"

		print "TCOVERS_" \$2 "_" \$3 "=\$(( (" overs ") - OLD_TCOVERS_" \$2 "_" \$3 "));"
		print "OLD_TCOVERS_" \$2 "_" \$3 "=\$((" overs "));"

		print "TCREQUEUES_" \$2 "_" \$3 "=\$(( (" requeues ") - OLD_TCREQUEUES_" \$2 "_" \$3 "));"
		print "OLD_TCREQUEUES_" \$2 "_" \$3 "=\$((" requeues "));"

		print "TCBACKLOG_" \$2 "_" \$3 "=\$((" backlog "));"
	}
	else {
		print "# Cannot parse " \$2 " class " \$3;
		value = 0;
	}
}
EOF
	awk_script="`$CAT_CMD ${FIREQOS_DIR}/${FIREQOS_STATS_ID}.stats.awk`"
	$RM_CMD ${FIREQOS_DIR}/${FIREQOS_STATS_ID}.stats.awk

	# attempt to shrink the list horizontally
	# find how many digits we need
	number_digits=${#maxn}
	number_digits=$((number_digits + 1))
	[ ${number_digits} -lt 6 ] && number_digits=6

	# find what number we have to add, to round to closest number
	# instead of round down (the only available in shell).
	round=0
	[ ${resolution} -gt 1 ] && round=$((resolution / 2))

	getdata() {
		eval "`${TC_CMD} -s class show dev ${1} | ${TR_CMD} "\n,()" "|   " | ${SED_CMD} \
			-e "s/[^|]|class /||class /g"          \
			-e "s/ \+/ /g"                         \
			-e "s/ *| */|/g"                       \
			-e "s/||/\n/g"                         \
			-e "s/|/ /g"                           \
			-e "s/\([0-9]\+\)Gbit /\1000000000 /g" \
			-e "s/\([0-9]\+\)Mbit /\1000000 /g"    \
			-e "s/\([0-9]\+\)Kbit /\1000 /g"       \
			-e "s/\([0-9]\+\)bit /\1 /g"           \
			-e "s/\([0-9]\+\)pps /\1 /g"           \
			-e "s/\([0-9]\+\)b /\1 /g"             \
			-e "s/\([0-9]\+\)p /\1 /g"             \
			-e "s/:/_/g"                           \
			-e "s/ prio [0-9]\+ / /g"              \
			-e "s/ root / /g"                      \
			-e "s/ parent [0-9]*_[0-9]* / /g"      \
			-e "s/ leaf [0-9]*_[0-9]* / /g"        \
			-e "s/ prio rate / rate /g"            \
			-e "s/ rate [^ ]* [^ ]* backlog / backlog /g" |\
			${GAWK_CMD} "${awk_script}"`"
	}

	getms() {
		d=`$DATE_CMD +'%s.%N'`
		s=`echo ${d} | ${CUT_CMD} -d '.' -f 1`
		n=`echo ${d} | ${CUT_CMD} -d '.' -f 2 | ${CUT_CMD} -b 1-3`
		if [ ${FIREQOS_LOWRES_TIMER} -eq 1 ]
		then
			n=000
		fi
		echo "${s}${n}"
	}

	starttime() {
		startedms=`getms`
	}

	endtime() {
		endedms=`getms`
	}

	sleepms() {
		local timetosleep="$1"

		local diffms=$((endedms - startedms))
		[ $diffms -gt $timetosleep ] && return 0

		local sleepms=$((timetosleep - diffms))
		local secs=$((sleepms / 1000))
		local ms=$((sleepms - (secs * 1000)))

		# echo "Sleeping for ${secs}.${ms} (started ${startedms}, ended ${endedms}, diffms ${diffms})"
		if [ ${FIREQOS_LOWRES_TIMER} -eq 1 ]
		then
			$SLEEP_CMD "${secs}"
		else
			$SLEEP_CMD "${secs}.${ms}"
		fi
	}

	echo
	echo "$interface_name: $interface_dev $interface_inout => $interface_realdev, type: $interface_linklayer, overhead: $interface_overhead"
	[ $show_speeds -eq 1 ] && echo "Rate: $((((interface_rate*8)+round)/resolution))$unit, min: $((((interface_minrate*8)+round)/resolution))$unit"
	echo "Values in $unit"
	echo

	starttime
	getdata $interface_realdev

	# render the configuration
	local x=
	for x in $interface_classes_ids
	do
		eval local name="\${class_${x}_name}"
		[ "$name" = "TOTAL" ] && local name="CLASS"
		printf "% ${number_digits}.${number_digits}s " $name
	done
	echo

	for x in $interface_classes_ids
	do
		eval local classid="\${class_${x}_classid}"
		printf "% ${number_digits}.${number_digits}s " $classid
	done
	echo

	if [ $show_speeds -eq 1 ]
	then
		for x in $interface_classes_ids
		do
			eval "local drops=\$TCDROPS_htb_${x}"
			eval "local overlimits=\$TCOVERS_htb_${x}"
			eval "local requeues=\$TCREQUEUES_htb_${x}"
			stats_colors "$drops" "$overlimits" "$requeues" 0

			eval local rate="\${class_${x}_rate}"
			[ ! "${rate}" = "COMMIT" ] && local rate=$(( ((rate * 8) + round) / resolution ))
			printf "% ${number_digits}.${number_digits}s " $rate

			echo -e -n "$COLOR_RESET"
		done
		echo

		for x in $interface_classes_ids
		do
			eval local ceil="\${class_${x}_ceil}"
			[ ! "${ceil}" = "MAX" ] && local ceil=$(( ((ceil * 8) + round) / resolution ))
			printf "% ${number_digits}.${number_digits}s " $ceil
		done
		echo
	fi
	echo

	for x in $interface_classes_ids
	do
		eval local priority="\${class_${x}_priority}"
		printf "% ${number_digits}.${number_digits}s " $priority
	done
	echo

	for x in $interface_classes_ids
	do
		eval local qdisc="\${class_${x}_qdisc}"
		printf "% ${number_digits}.${number_digits}s " $qdisc
	done
	echo

	# the main loop
	endtime
	sleepms 1000
	starttime
	local c=$((banner_every_lines - 1))
	while [ 1 = 1 ]
	do
		local c=$((c+1))
		getdata $interface_realdev

		if [ $c -eq ${banner_every_lines} ]
		then
			echo
			if [ "$show" = "TCSTATS" ]
			then
				echo -n " color code (packets): "
				stats_colors 0 0 0 1
				echo -e -n " backlog ${COLOR_RESET} | "
				stats_colors 1 0 0 0
				echo -e -n " dropped ${COLOR_RESET} | "
				stats_colors 0 1 0 0
				echo -e -n " delayed ${COLOR_RESET} | "
				stats_colors 0 0 1 0
				echo -e " requeued ${COLOR_RESET}"
			fi

			echo " $title on $interface_name ($interface_dev $interface_inout => $interface_realdev) - values in $unit"
			for x in $interface_classes_ids
			do
				eval local name="\${class_${x}_name}"
				printf "% ${number_digits}.${number_digits}s " $name
			done
			echo
			local c=0
		fi

		for x in $interface_classes_ids
		do
			eval "local y=\$${show}_htb_${x}"
			if [ "$show" = "TCSTATS" ]
			then
				eval "local drops=\$TCDROPS_htb_${x}"
				eval "local overlimits=\$TCOVERS_htb_${x}"
				eval "local requeues=\$TCREQUEUES_htb_${x}"
				eval "local backlog=\$TCBACKLOG_htb_${x}"
				stats_colors "$drops" "$overlimits" "$requeues" "$backlog"
			fi

			if [ -z "$y" ]
			then
				printf "% ${number_digits}.${number_digits}s " ERROR
			elif [ "$y" = "0" ]
			then
				printf "% ${number_digits}.${number_digits}s " "-"
			elif [ "$y" -lt 0 ]
			then
				printf "% ${number_digits}.${number_digits}s " RESET
			else
				printf "% ${number_digits}d " $(( (y+round) / resolution ))
			fi

			[ "$show" = "TCSTATS" ] && echo -e -n "$COLOR_RESET"
		done
		echo

		endtime
		sleepms 1000
		starttime
	done
}

FIREQOS_MONITOR_ADDED=0
remove_monitor() {
	if [ "$FIREQOS_MONITOR_ADDED" -eq 1 ]
	then
		runcmd $TC_CMD filter del dev $class_monitor_dev parent $class_monitor_qdisc_handle protocol all prio 1 u32 match u32 0 0 action mirred egress mirror dev fireqos_monitor
		runcmd $IP_CMD link set dev fireqos_monitor down
		runcmd $IP_CMD link del dev fireqos_monitor name fireqos_monitor type dummy

		case "$class_monitor_qdisc" in
			none)
					runcmd $TC_CMD qdisc del dev $class_monitor_dev parent $class_monitor_qdisc_parent handle $class_monitor_qdisc_handle htb
					;;

			htb)
					;;

			*)
					runcmd $TC_CMD qdisc del dev $class_monitor_dev parent $class_monitor_qdisc_parent handle $class_monitor_qdisc_handle htb
					runcmd $TC_CMD qdisc add $class_monitor_qdisc_command
					;;
		esac

		echo "FireQOS: monitor removed from device '$class_monitor_dev', qdisc '$class_monitor_qdisc_handle'."
		FIREQOS_MONITOR_ADDED=0
	fi

	echo >&2 "bye..."

	[ -f "${FIREQOS_LOCK_FILE}" ] && $RM_CMD -f "${FIREQOS_LOCK_FILE}" >/dev/null 2>&1
}

add_monitor() {
	check_root

	if [ -z "$class_monitor_dev" -o -z "$class_monitor_qdisc"  -o -z "$class_monitor_qdisc_handle" ]
	then
		echo "Cannot setup monitor on device '$class_monitor_dev' for handle '$class_monitor_qdisc_handle'."
		exit 1
	fi

	FIREQOS_LOCK_FILE_TIMEOUT=$((86400 * 30))
	fireqos_concurrent_run_lock
	trap remove_monitor EXIT
	trap remove_monitor SIGHUP

	runcmd $MODPROBE_CMD dummy numdummies=0 >/dev/null 2>&1
	runcmd $IP_CMD link del dev fireqos_monitor name fireqos_monitor type dummy >/dev/null 2>&1
	runcmd $IP_CMD link add dev fireqos_monitor name fireqos_monitor type dummy || exit 1
	runcmd $IP_CMD link set dev fireqos_monitor up || exit 1

	case "$class_monitor_qdisc" in
		none)
				runcmd $TC_CMD qdisc add dev $class_monitor_dev parent $class_monitor_qdisc_parent handle $class_monitor_qdisc_handle htb || exit 1
 				;;

		htb)
				;;

		*)
				runcmd $TC_CMD qdisc del $class_monitor_qdisc_command || exit 1
				runcmd $TC_CMD qdisc add dev $class_monitor_dev parent $class_monitor_qdisc_parent handle $class_monitor_qdisc_handle htb || exit 1
				;;
	esac
	FIREQOS_MONITOR_ADDED=1

	runcmd $TC_CMD filter add dev $class_monitor_dev parent $class_monitor_qdisc_handle protocol all prio 1 u32 match u32 0 0 action mirred egress mirror dev fireqos_monitor || exit 1

	echo "FireQOS: monitor added to device '$class_monitor_dev', class '$class_monitor_classid', qdisc '$class_monitor_qdisc_handle'."
}

monitor() {
	common_require_cmd $PROGRAM_FILE TCPDUMP_CMD

	if [ -z "$1" -o ! -f "${FIREQOS_DIR}/$1.conf" ]
	then
		echo >&2 "There is no interface named '$1' to show."
		show_interfaces
		exit 1
	fi

	# load the interface configuration
	source "${FIREQOS_DIR}/$1.conf" || exit 1

	local x=
	local foundname=
	local foundflow=
	for x in $interface_classes_monitor
	do
		local name=`echo "$x|" | $CUT_CMD -d '|' -f 1`
		local name2=`echo "$x|" | $CUT_CMD -d '|' -f 2`
		local flow=`echo "$x|" | $CUT_CMD -d '|' -f 3`
		local monitor=`echo "$x|" | $CUT_CMD -d '|' -f 4`

		if [ "$name" = "$2" -o "$flow" = "$2" -o "$name2" = "$2" -o "$monitor" = "$2" ]
		then
			local foundname="$name"
			local foundname2="$name2"
			local foundflow="$flow"
			local foundmonitor="$monitor"
			local foundncid="`echo $foundflow | $TR_CMD ":" "_"`"
			break
		fi
	done

	if [ -z "$foundname" ]
	then
		echo
		echo "No class found with name '$2' in interface '$1'."
		echo
		echo "Use one of the following names, class ids or qdisc handles:"

		local x=
		for x in `echo "$interface_classes_monitor" | $TR_CMD ' ' '\n' | $GREP_CMD -v "^$"`
		do
			echo "$x" | (
				local name=
				local name2=
				local flow=
				local monitor=
				IFS="|" read name name2 flow monitor
				if [ "$name" = "$name2" -o "$name" = "default" ]
				then
					echo -e "  $COLOR_BOLD$COLOR_YELLOW $name2 $COLOR_RESET or classid $COLOR_BOLD$COLOR_YELLOW $flow $COLOR_RESET or handle $COLOR_BOLD$COLOR_YELLOW $monitor $COLOR_RESET"
				else
					echo -e "  $COLOR_BOLD$COLOR_YELLOW $name $COLOR_RESET or $COLOR_BOLD$COLOR_YELLOW $name2 $COLOR_RESET or classid $COLOR_BOLD$COLOR_YELLOW $flow $COLOR_RESET or handle $COLOR_BOLD$COLOR_YELLOW $monitor $COLOR_RESET"
				fi
			)
		done
		exit 1
	fi

	shift 2

	# make all class variables available as class_monitor_*
	eval "`set | $GREP_CMD "^class_${foundncid}_" | $SED_CMD "s/^class_${foundncid}_/class_monitor_/g"`"

	if [ $class_monitor_group -eq 1 ]
	then
		echo "Class $class_monitor_path is a class group. Please give a leaf class."
		exit 1
	fi

	local warning=
	case "$class_monitor_qdisc" in
		none)
				local warning="$COLOR_BOLD$COLOR_BGRED WARNING $COLOR_RESET\\nThe class '$class_monitor_path' does not have a qdisc attached.\\nTo monitor its traffic, FireQOS will attach an 'htb' qdisc to this class.\\nThis qdisc will be removed once you stop monitoring the traffic."
				;;

		htb)
				;;

		*)
				local warning="$COLOR_BOLD$COLOR_BGRED WARNING $COLOR_RESET\\nThe class '$class_monitor_path' cannot be monitored directly.\\nFireQOS will REMOVE the existing '$class_monitor_qdisc' qdisc from the class\\nand temporarily attach an 'htb' qdisc, to allow monitoring the traffic.\\nThe original qdisc will be restored once you stop monitoring the traffic."
				;;
	esac

	if [ "$interface_linklayer" = "adsl" -a "$interface_linklayer_type" = "local" -a "$interface_inout" = "output" ]
	then
		[ ! -z "$warning" ] && warning="$warning\\n"
		local warning="$warning\\n$COLOR_BOLD$COLOR_BGRED WARNING $COLOR_RESET\\nWhen monitoring the packets sent by a PPPoE device, tcpdump sees the\\npackets encapsulated in something that is not PPPoE or Ethernet frames.\\nTherefore they cannot be decoded by tcpdump, wireshark or other tools."
 	fi

	if [ ! -z "$warning" ]
	then
		echo
		echo -e "$warning"
		echo
		echo -n "Press ENTER to continue, or Control-C to stop now > "
		read
	fi

	FIREQOS_DEBUG_COMMAND=1
	echo "Monitoring qdisc '$class_monitor_qdisc_handle' for class '$class_monitor_path' ($class_monitor_classid)..."
	add_monitor || exit 1

	echo
	runcmd $TCPDUMP_CMD -i fireqos_monitor "${@}"
	echo

	# add_monitor() adds a trap that will remove the monitor on exit
}

$CAT_CMD >&2 <<EOF
FireQOS $VERSION
(C) 2013-2014 Costa Tsaousis, GPL

EOF

show_usage() {
local msg="

${COLOR_YELLOW}${COLOR_BOLD}${PROGRAM_FILE}${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}action${COLOR_RESET}

${COLOR_BLUE}${COLOR_BOLD}action${COLOR_RESET} can be one of:

	${COLOR_YELLOW}${COLOR_BOLD}start${COLOR_RESET} [${COLOR_BLUE}${COLOR_BOLD}filename${COLOR_RESET}] [${COLOR_YELLOW}${COLOR_BOLD}--${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}options${COLOR_RESET}]
		or
	[${COLOR_BLUE}${COLOR_BOLD}filename${COLOR_RESET}] ${COLOR_YELLOW}${COLOR_BOLD}start${COLOR_RESET} [${COLOR_YELLOW}${COLOR_BOLD}--${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}options${COLOR_RESET}]
		activates traffic shapping rules according to rules given in
		${COLOR_BLUE}${COLOR_BOLD}${FIREQOS_CONFIG}${COLOR_RESET}

		if ${COLOR_BLUE}${COLOR_BOLD}filename${COLOR_RESET} is given, it will be used instead of the
		default ${COLOR_BLUE}${COLOR_BOLD}${FIREQOS_CONFIG}${COLOR_RESET}

		all ${COLOR_BLUE}${COLOR_BOLD}options${COLOR_RESET} after ${COLOR_YELLOW}${COLOR_BOLD}--${COLOR_RESET} will be given as options to the config
		file when it will be executed by FireQOS

	${COLOR_YELLOW}${COLOR_BOLD}debug${COLOR_RESET} [${COLOR_BLUE}${COLOR_BOLD}filename${COLOR_RESET}] [${COLOR_YELLOW}${COLOR_BOLD}--${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}options${COLOR_RESET}]
		or
	[${COLOR_BLUE}${COLOR_BOLD}filename${COLOR_RESET}] ${COLOR_YELLOW}${COLOR_BOLD}debug${COLOR_RESET} [${COLOR_YELLOW}${COLOR_BOLD}--${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}options${COLOR_RESET}]
		same as ${COLOR_YELLOW}${COLOR_BOLD}start${COLOR_RESET}, but shows also the generated tc commands

	${COLOR_YELLOW}${COLOR_BOLD}stop${COLOR_RESET}
		stops all traffic shapping applied by FireQOS
		(it does not touch QoS on other interfaces and IFBs used by
			other tools)

	${COLOR_YELLOW}${COLOR_BOLD}clear_all_qos${COLOR_RESET}
		- stops all traffic shapping on all network interfaces
		- removes all IFB devices from the system
		(clears even QoS applied by other tools)

	${COLOR_YELLOW}${COLOR_BOLD}status${COLOR_RESET} [${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET} [ ${COLOR_YELLOW}${COLOR_BOLD}dump${COLOR_RESET} [${COLOR_BLUE}${COLOR_BOLD}class${COLOR_RESET}] ] ]
		shows live class utilization for the interface ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET} the
		name given matches the name of an interface statement given
		in the config

		if ${COLOR_YELLOW}${COLOR_BOLD}dump' is specified, it tcpdumps the traffic in the
		${COLOR_BLUE}${COLOR_BOLD}class${COLOR_RESET} of interface ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}

	${COLOR_YELLOW}${COLOR_BOLD}tcpdump${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}class${COLOR_RESET}
		or
	${COLOR_YELLOW}${COLOR_BOLD}dump${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}class${COLOR_RESET}
		tcpdumps all traffic in the ${COLOR_BLUE}${COLOR_BOLD}class${COLOR_RESET} of interface ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}

	${COLOR_YELLOW}${COLOR_BOLD}drops${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}
		shows packets dropped per second, per class for the
		interface ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}

	${COLOR_YELLOW}${COLOR_BOLD}overlimits${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}
		shows packets delayed per second, per class for the
		interface ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}

	${COLOR_YELLOW}${COLOR_BOLD}requeues${COLOR_RESET} ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}
		shows packets requeued per second, per class for the
		interface ${COLOR_BLUE}${COLOR_BOLD}name${COLOR_RESET}
"
echo -e "$msg"

}

FIREQOS_MODE=
while [ ! -z "$1" ]
do
	case "$1" in

		clear_all_qos)
			clear_all_qos_on_all_interfaces
			syslog info "Cleared all QOS on all interfaces"
			exit 0
			;;

		stop)
			shift
			clear_everything "${@}"
			syslog info "Cleared all FireQOS changes"
			exit 0
			;;

		status)
			shift
			if [ "$2" = "dump" -o "$2" = "tcpdump" ]
			then
				iface="$1"
				shift 2
				monitor $iface "$@"
			else
				htb_stats status "$@"
			fi
			exit 0
			;;

		drops|overlimits|requeues)
			htb_stats "$@"
			exit 0
			;;

		dump|tcpdump)
			shift
			monitor "$@"
			exit $?
			;;

		debug)
			FIREQOS_MODE=START
			FIREQOS_DEBUG=1
			;;

		start)
			FIREQOS_MODE=START
			;;

		--)
			shift
			break;
			;;

		--help|-h)
			FIREQOS_MODE=
			break;
			;;

		*)
			echo >&2 "Using file '$1' for FireQOS configuration..."
			FIREQOS_CONFIG="$1"
			;;
	esac

	shift
done

if [ -z "$FIREQOS_MODE" ]
then
	show_usage
	exit 1
fi

check_root

# ----------------------------------------------------------------------------
# Normal startup

if [ ! -f "${FIREQOS_CONFIG}" ]
then
	error "Cannot find file '${FIREQOS_CONFIG}'."
	exit 1
fi

if [ ! -d "${FIREQOS_DIR}" ]
then
	$MKDIR_CMD -p "${FIREQOS_DIR}" || exit 1
fi
if [ ! -d "${FIREQOS_DIR}/ifbs" ]
then
	$MKDIR_CMD -p "${FIREQOS_DIR}/ifbs" || exit 1
fi
if [ ! -d "${FIREQOS_DIR}/ifaces" ]
then
	$MKDIR_CMD -p "${FIREQOS_DIR}/ifaces" || exit 1
fi

FIREQOS_DEFAULT_QDISC="fq_codel"
FIREQOS_DEFAULT_QDISC_OPTIONS="default"

# check if this system has fq_codel
runcmd $MODPROBE_CMD sch_$FIREQOS_DEFAULT_QDISC >/dev/null 2>&1
[ $? -ne 0 ] && FIREQOS_DEFAULT_QDISC="codel"

# check if this system has codel
runcmd $MODPROBE_CMD sch_$FIREQOS_DEFAULT_QDISC >/dev/null 2>&1
[ $? -ne 0 ] && FIREQOS_DEFAULT_QDISC="sfq"

# make sure we are not running in parallel
fireqos_concurrent_run_lock

# enable cleanup in case of failure
FIREQOS_COMPLETED=0
trap fireqos_exit EXIT
trap fireqos_exit SIGHUP
trap fireqos_exit INT

# load the IFB kernel module
runcmd $MODPROBE_CMD ifb numifbs=0 >/dev/null 2>&1

# Run the configuration
enable -n trap					# Disable the trap buildin shell command.
{ source ${FIREQOS_CONFIG} "$@"; }		# Run the configuration as a normal script.
ret=$?
enable trap					# Enable the trap buildin shell command.

if [ $ret -ne 0 ]
then
	error "Processing of '${FIREQOS_CONFIG}' failed with code $ret."
	exit 1
fi

interface_close					# close the last interface.

if [ ${FIREQOS_MARKS_ON_INPUT_USED} -gt 0 ]
then
	echo >&2
	echo >&2 -e "${COLOR_BGRED}${COLOR_WHITE} WARNING ${COLOR_RESET}"
	echo >&2 -e "There have been encountered ${FIREQOS_MARKS_ON_INPUT_USED} rule(s) than match MARKs in incoming traffic."
	echo >&2 -e "These statements will not match incoming packets without adding:${COLOR_BOLD}"
	echo >&2 -e "FIREQOS_CONNMARK_RESTORE=\"act_connmark\""
	echo >&2 -e "${COLOR_RESET}in your config. This however requires the act_connmark kernel module."
	echo >&2 -e "For more information check: https://github.com/ktsaou/firehol/issues/49"
	echo >&2 -e "${COLOR_RESET}"
fi

echo >&2
echo >&2 "  Traffic is classified:"
echo >&2
echo >&2 "      - on $interface_count interfaces"
echo >&2 "      - to $class_count classes"
echo >&2 "      - by $match_count FireQOS matches"
echo >&2
echo >&2 "  $tc_count TC commands executed"
echo >&2
echo >&2 "All Done! Enjoy..."

# inform the trap everything is ok
FIREQOS_COMPLETED=1

exit 0