applications/luci-splash: Fix clients upload and download limiting

2 files changed, 265 insertions, 121 deletions

diff --git a/applications/luci-splash/root/etc/init.d/luci_splash b/applications/luci-splash/root/etc/init.d/luci_splash
index d2628c86fe..d1f7c2b996 100755
--- a/applications/luci-splash/root/etc/init.d/luci_splash
+++ b/applications/luci-splash/root/etc/init.d/luci_splash
@@ -5,24 +5,27 @@ EXTRA_COMMANDS=clear_leases
 LIMIT_DOWN=0
 LIMIT_DOWN_BURST=0
 LIMIT_UP=0
+TC=/usr/sbin/tc
+IPT=/usr/sbin/iptables
+IPT6=/usr/sbin/ip6tables
 
 IPT_REPLAY=/var/run/luci_splash.iptlog
 LOCK=/var/run/luci_splash.lock
-[ -x /usr/sbin/ip6tables ] && [ -f /proc/net/ipv6_route ] && HAS_IPV6=1
+[ -x $IPT6 ] && [ -f /proc/net/ipv6_route ] && HAS_IPV6=1
 
 silent() {
 	"$@" 2>/dev/null
 }
 
 ipt_log() {
-	iptables -I "$@"
-	echo iptables -D "$@" >> $IPT_REPLAY
+	$IPT -I "$@"
+	echo $IPT -D "$@" >> $IPT_REPLAY
 }
 
 ipt6_log() {
 	[ "$HAS_IPV6" = 1 ] || return
-	ip6tables -I "$@"
-	echo ip6tables -D "$@" >> $IPT_REPLAY
+	$IPT6 -I "$@"
+	echo $IPT6 -D "$@" >> $IPT_REPLAY
 }
 
 
@@ -70,16 +73,16 @@ iface_add() {
 	fi
 
 	### Allow traffic to the same subnet
-	iptables -t nat    -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN
-	iptables -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN
+	$IPT -t nat    -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN
+	$IPT -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN
 
 	### Allow traffic to the mesh subnet
 	[ "$parentproto" = "static" -a -n "$parentipaddr" ] && {
-		iptables -t nat    -I luci_splash_prerouting -d "$parentipaddr/${parentnetmask:-32}" -j RETURN
-		iptables -t filter -I luci_splash_forwarding -d "$parentipaddr/${parentnetmask:-32}" -j RETURN
+		$IPT -t nat    -I luci_splash_prerouting -d "$parentipaddr/${parentnetmask:-32}" -j RETURN
+		$IPT -t filter -I luci_splash_forwarding -d "$parentipaddr/${parentnetmask:-32}" -j RETURN
 	}
 
-	qos_iface_add "$ifname"
+	qos_iface_add "$ifname" "$NETWORK" "$PREFIX"
 }
 
 iface_del() {
@@ -107,6 +110,14 @@ mac_add() {
 	append MACS "$mac"
 }
 
+whitelist_add() {
+	config_get mac "$1" mac
+	iface=$2
+	$TC filter add dev "$iface" parent ffff: protocol ip prio 1 u32 match ether src $mac police pass
+	$TC filter add dev "$iface" parent 1:0 protocol ip prio 1 u32 match ether dst classid 1:1
+}
+
+
 subnet_add() {
 	local cfg="$1"
 
@@ -114,52 +125,54 @@ subnet_add() {
 	config_get netmask "$cfg" netmask
 
 	[ -n "$ipaddr" ] && {
-		iptables -t nat    -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN
-		iptables -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN
+		$IPT -t nat    -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN
+		$IPT -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN
 	}
 }
 
 qos_iface_add() {
 	local iface="$1"
+	local network="$2"
+	local prefix="$3"
 
-	# 77 -> download root qdisc
-	# 78 -> upload root qdisc
-	# 79 -> fwmark: client->inet
-	# 80 -> fwmark: inet->client
+	# 77   -> download root qdisc
+	# ffff -> upload root qdisc
 
-	silent tc qdisc del dev "$iface" root handle 77:
+	silent $TC qdisc del dev "$iface" root handle 1:
+	silent $TC class del dev "$iface" parent 1: classid 1:ffff
+	silent $TC class del dev "$iface" parent 1: classid 1:1
+	silent $TC filter del dev "$iface" parent ffff: protocol ip prio 1 u32
+	silent $TC filter del dev "$iface" parent ffff: protocol ip prio 2 u32
+	silent $TC filter del dev "$iface" parent ffff: protocol ip prio 3 u32
 
 	if [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ]; then
-		tc qdisc add dev "$iface" root handle 77: htb
-
-		# assume maximum rate of 20.000 kilobit for wlan
-		tc class add dev "$iface" parent 77: classid 77:1 htb rate 20000kbit
+		# Setup qdiscs
+		$TC qdisc add dev "$iface" root handle 1: htb default 1
+		silent $TC qdisc add dev "$iface" ingress
 
-		# set download limit and burst
-		tc class add dev "$iface" parent 77:1 classid 77:10 htb \
-			rate ${LIMIT_DOWN}kbit ceil ${LIMIT_DOWN_BURST}kbit prio 2
+		# Default class - all clients which are not otherwise handled are put in that class
+		# and share that bandwidth.
+		$TC class add dev "$iface" parent 1: classid 1:ffff htb rate ${LIMIT_DOWN}kbit
 
-		tc qdisc add dev "$iface" parent 77:10 handle 78: sfq perturb 10
+		# default class and class for whitelisted clients = unlimited
+		$TC class add dev "$iface" parent 1: classid 1:1 htb rate 100mbit
 
-		# adding ingress can result in "File exists" if qos-scripts are active
-		silent tc qdisc add dev "$iface" ingress
+		# All traffic to the dhcp subnet is put into the limited class
+		$TC filter add dev "$iface" parent 1:0 protocol ip prio 3 u32 match ip dst $network/$prefix classid 1:ffff
+		$TC qdisc add dev "$iface" parent 1:ffff sfq perturb 10
+                $TC filter add dev "$iface" parent ffff: protocol ip prio 3 u32 match ip src $network/$prefix police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop
 
-		# set client download speed
-		tc filter add dev "$iface" parent 77: protocol ip prio 2 \
-			handle 80 fw flowid 77:10
+		# classify packets by their iptables MARK set in luci_splash_mark_in (mangle table)
+		# every client gets his own class and so his own bandwidth limit
+		$TC filter add dev "$iface" parent 1:0 protocol ip prio 2 fw
 
-		# set client upload speed
-		tc filter add dev "$iface" parent ffff: protocol ip prio 1 \
-			handle 79 fw police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop
+		config_foreach whitelist_add whitelist $iface
 	fi
 }
 
 qos_iface_del() {
 	local iface="$1"
-
-	silent tc qdisc del dev "$iface" root handle 77:
-	silent tc qdisc del dev "$iface" root handle 78:
-	silent tc filter del dev "$iface" parent ffff: protocol ip prio 1 handle 79 fw
+	silent $TC qdisc del dev "$iface" root handle 77:
 }
 
 boot() {
@@ -210,58 +223,63 @@ start() {
 	}
 
 	### Create subchains
-	iptables -t nat    -N luci_splash_prerouting
-	iptables -t nat    -N luci_splash_leases
-	iptables -t filter -N luci_splash_forwarding
-	iptables -t filter -N luci_splash_filter
+	$IPT -t nat    -N luci_splash_prerouting
+	$IPT -t nat    -N luci_splash_leases
+	$IPT -t filter -N luci_splash_forwarding
+	$IPT -t filter -N luci_splash_filter
 
 	if [ "$HAS_IPV6" = 1 ]; then
-		ip6tables -t filter -N luci_splash_forwarding
-		ip6tables -t filter -N luci_splash_filter
+		$IPT6 -t filter -N luci_splash_forwarding
+		$IPT6 -t filter -N luci_splash_filter
 	fi
 
 	### Clear iptables replay log
 	[ -s $IPT_REPLAY ] && . $IPT_REPLAY
 	echo -n > $IPT_REPLAY
 
-	### Build the main and portal rule
-	config_foreach iface_add iface
-	config_foreach subnet_add subnet
-
 	### Add interface independant prerouting rules
-	iptables -t nat -A luci_splash_prerouting -j luci_splash_leases
-	iptables -t nat -A luci_splash_leases -p udp --dport 53 -j REDIRECT --to-ports 53
-	iptables -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082
+	$IPT -t nat -A luci_splash_prerouting -j luci_splash_leases
+	$IPT -t nat -A luci_splash_leases -p udp --dport 53 -j REDIRECT --to-ports 53
+	$IPT -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082
 
 	### Add interface independant forwarding rules
-	iptables -t filter -A luci_splash_forwarding -j luci_splash_filter
-	iptables -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset
-	iptables -t filter -A luci_splash_filter -j REJECT --reject-with icmp-net-prohibited
+	$IPT -t filter -A luci_splash_forwarding -j luci_splash_filter
+	$IPT -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset
+	$IPT -t filter -A luci_splash_filter -j REJECT --reject-with icmp-net-prohibited
 
 	if [ "$HAS_IPV6" = 1 ]; then
-		ip6tables -t filter -A luci_splash_forwarding -j luci_splash_filter
-		ip6tables -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset
-		ip6tables -t filter -A luci_splash_filter -j REJECT --reject-with adm-prohibited
+		$IPT6 -t filter -A luci_splash_forwarding -j luci_splash_filter
+		$IPT6 -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset
+		$IPT6 -t filter -A luci_splash_filter -j REJECT --reject-with adm-prohibited
 	fi
 
 	### Add QoS chain
-    iptables -t mangle -N luci_splash_mark_out
-    iptables -t mangle -N luci_splash_mark_in
-    iptables -t mangle -I PREROUTING  -j luci_splash_mark_out
-    iptables -t mangle -I POSTROUTING -j luci_splash_mark_in
-    if [ "$HAS_IPV6" = 1 ]; then
-        ip6tables -t mangle -N luci_splash_mark_out
-        ip6tables -t mangle -N luci_splash_mark_in
-        ip6tables -t mangle -I PREROUTING  -j luci_splash_mark_out
-        ip6tables -t mangle -I POSTROUTING -j luci_splash_mark_in
-    fi
+	$IPT -t mangle -N luci_splash_mark_out
+	$IPT -t mangle -N luci_splash_mark_in
+	$IPT -t mangle -I PREROUTING  -j luci_splash_mark_out
+	$IPT -t mangle -I POSTROUTING -j luci_splash_mark_in
+
+	if [ "$HAS_IPV6" = 1 ]; then
+		$IPT6 -t mangle -N luci_splash_mark_out
+		$IPT6 -t mangle -N luci_splash_mark_in
+		$IPT6 -t mangle -I PREROUTING  -j luci_splash_mark_out
+		$IPT6 -t mangle -I POSTROUTING -j luci_splash_mark_in
+	fi
+
+	### Build the main and portal rule
+	config_foreach iface_add iface
+	config_foreach subnet_add subnet
 
 	### Find active mac addresses
 	MACS=""
-	config_foreach mac_add lease
+
+	
 	config_foreach mac_add blacklist
 	config_foreach mac_add whitelist
 
+	#config_load luci_splash_leases
+	config_foreach mac_add lease
+
 	### Add crontab entry
 	test -f /etc/crontabs/root || touch /etc/crontabs/root
 	grep -q luci-splash /etc/crontabs/root || {
@@ -284,41 +302,41 @@ stop() {
 	### Clear interface rules
 	config_foreach iface_del iface
 
-	silent iptables -t mangle -D PREROUTING  -j luci_splash_mark_out
-	silent iptables -t mangle -D POSTROUTING -j luci_splash_mark_in
+	silent $IPT -t mangle -D PREROUTING  -j luci_splash_mark_out
+	silent $IPT -t mangle -D POSTROUTING -j luci_splash_mark_in
 
 	if [ "$HAS_IPV6" = 1 ]; then
-		silent ip6tables -t mangle -D PREROUTING  -j luci_splash_mark_out
-		silent ip6tables -t mangle -D POSTROUTING -j luci_splash_mark_in
+		silent $IPT6 -t mangle -D PREROUTING  -j luci_splash_mark_out
+		silent $IPT6 -t mangle -D POSTROUTING -j luci_splash_mark_in
 	fi
 
 	### Clear subchains
-	silent iptables -t nat    -F luci_splash_prerouting
-	silent iptables -t nat    -F luci_splash_leases
-	silent iptables -t filter -F luci_splash_forwarding
-	silent iptables -t filter -F luci_splash_filter
-	silent iptables -t mangle -F luci_splash_mark_out
-	silent iptables -t mangle -F luci_splash_mark_in
+	silent $IPT -t nat    -F luci_splash_prerouting
+	silent $IPT -t nat    -F luci_splash_leases
+	silent $IPT -t filter -F luci_splash_forwarding
+	silent $IPT -t filter -F luci_splash_filter
+	silent $IPT -t mangle -F luci_splash_mark_out
+	silent $IPT -t mangle -F luci_splash_mark_in
 
 	if [ "$HAS_IPV6" = 1 ]; then
-		ip6tables -t filter -F luci_splash_forwarding
-		ip6tables -t filter -F luci_splash_filter
-		ip6tables -t mangle -F luci_splash_mark_out
-		ip6tables -t mangle -F luci_splash_mark_in
+		$IPT6 -t filter -F luci_splash_forwarding
+		$IPT6 -t filter -F luci_splash_filter
+		$IPT6 -t mangle -F luci_splash_mark_out
+		$IPT6 -t mangle -F luci_splash_mark_in
 	fi
 
 	### Delete subchains
-	silent iptables -t nat    -X luci_splash_prerouting
-	silent iptables -t nat    -X luci_splash_leases
-	silent iptables -t filter -X luci_splash_forwarding
-	silent iptables -t filter -X luci_splash_filter
-	silent iptables -t mangle -X luci_splash_mark_out
-	silent iptables -t mangle -X luci_splash_mark_in
+	silent $IPT -t nat    -X luci_splash_prerouting
+	silent $IPT -t nat    -X luci_splash_leases
+	silent $IPT -t filter -X luci_splash_forwarding
+	silent $IPT -t filter -X luci_splash_filter
+	silent $IPT -t mangle -X luci_splash_mark_out
+	silent $IPT -t mangle -X luci_splash_mark_in
 	if [ "$HAS_IPV6" = 1 ]; then
-		ip6tables -t filter -X luci_splash_forwarding
-		ip6tables -t filter -X luci_splash_filter
-		ip6tables -t mangle -X luci_splash_mark_out
-		ip6tables -t mangle -X luci_splash_mark_in
+		$IPT6 -t filter -X luci_splash_forwarding
+		$IPT6 -t filter -X luci_splash_filter
+		$IPT6 -t mangle -X luci_splash_mark_out
+		$IPT6 -t mangle -X luci_splash_mark_in
 	fi
 	sed -ie '/\/usr\/sbin\/luci-splash sync/d' /var/spool/cron/crontabs/root
 
diff --git a/applications/luci-splash/root/usr/sbin/luci-splash b/applications/luci-splash/root/usr/sbin/luci-splash
index 3f08f2c6b7..e1f8d4162e 100755
--- a/applications/luci-splash/root/usr/sbin/luci-splash
+++ b/applications/luci-splash/root/usr/sbin/luci-splash
@@ -1,18 +1,19 @@
 #!/usr/bin/lua
 
-require("luci.util")
+utl = require "luci.util"
+sys = require "luci.sys"
+
 require("luci.model.uci")
-require("luci.sys")
 require("luci.sys.iptparser")
 
 -- Init state session
 local uci = luci.model.uci.cursor_state()
 local ipt = luci.sys.iptparser.IptParser()
-local net = luci.sys.net
+local net = sys.net
 local fs = require "luci.fs"
+local ip = require "luci.ip"
 
-local limit_up = 0
-local limit_down = 0
+local debug = false
 
 local has_ipv6 = fs.access("/proc/net/ipv6_route") and fs.access("/usr/sbin/ip6tables")
 
@@ -24,12 +25,80 @@ function unlock()
 	os.execute("lock -u /var/run/luci_splash.lock")
 end
 
+function exec(cmd)
+	local ret = sys.exec(cmd)
+	if debug then
+		print('+ ' .. cmd)
+		if ret and ret ~= "" then
+			print(ret)
+		end
+	end
+end
+
+function get_id(ip)
+	local o3, o4 = ip:match("[0-9]+%.[0-9]+%.([0-9]+)%.([0-9]+)")
+	if o3 and 04 then
+		return string.format("%02X%s", tonumber(o3), "") .. string.format("%02X%s", tonumber(o4), "")
+	else
+		return false
+	end
+end
+
+function get_device_for_ip(ipaddr)
+	local dev
+	uci:foreach("network", "interface", function(s)
+		if s.ipaddr and s.netmask then
+			local network = ip.IPv4(s.ipaddr, s.netmask)
+			if network:contains(ip.IPv4(ipaddr)) then
+				-- this should be rewritten to luci functions if possible
+				dev = utl.trim(sys.exec(". /lib/functions/network.sh; network_get_device IFNAME '" ..  s['.name'] .. "'; echo $IFNAME"))
+			end
+		end
+	end)
+	return dev
+end
+
+function get_physdev(interface)
+	local dev
+	dev = utl.trim(sys.exec(". /lib/functions/network.sh; network_get_device IFNAME '" ..  interface .. "'; echo $IFNAME"))
+	return dev
+end
+
+
+
+function get_filter_handle(parent, direction, device)
+	local input = utl.split(sys.exec('/usr/sbin/tc filter show dev ' .. device .. ' parent ' .. parent) or {})
+	local tbl = {}
+	local handle
+	for k, v in pairs(input) do
+		handle = v:match('filter protocol ip pref %d+ u32 fh (%d*:%d*:%d*) order')
+		if handle then
+			local mac1, mac2, mac3, mac4, mac5, mac6
+			if direction == 'src' then
+				mac1, mac2, mac3, mac4 = input[k+1]:match('match ([%a%d][%a%d])([%a%d][%a%d])([%a%d][%a%d])([%a%d][%a%d])/ffffffff')
+				mac5, mac6 = input[k+2]:match('match ([%a%d][%a%d])([%a%d][%a%d])0000/ffff0000')
+			else
+				mac1, mac2 = input[k+1]:match('match 0000([%a%d][%a%d])([%a%d][%a%d])/0000ffff')
+				mac3, mac4, mac5, mac6 = input[k+2]:match('match ([%a%d][%a%d])([%a%d][%a%d])([%a%d][%a%d])([%a%d][%a%d])/ffffffff')
+			end
+			if mac1 and mac2 and mac3 and mac4 and mac5 and mac6 then
+				mac = "%s:%s:%s:%s:%s:%s" % { mac1, mac2, mac3, mac4, mac5, mac6 }
+				tbl[mac] = handle
+			end
+		end
+	end
+	if tbl[mac:lower()] then
+		handle = tbl[mac:lower()]
+	end
+	return handle
+end
+
 function main(argv)
 	local cmd = table.remove(argv, 1)
 	local arg = argv[1]
 
-	limit_up = tonumber(uci:get("luci_splash", "general", "limit_up")) or 0
-	limit_down = tonumber(uci:get("luci_splash", "general", "limit_down")) or 0
+	limit_up = (tonumber(uci:get("luci_splash", "general", "limit_up")) or 0) * 8
+	limit_down = (tonumber(uci:get("luci_splash", "general", "limit_down")) or 0) * 8
 
 	if ( cmd == "lease" or cmd == "add-rules" or cmd == "remove" or
 	     cmd == "whitelist" or cmd == "blacklist" or cmd == "status" ) and #argv > 0
@@ -175,7 +244,7 @@ function ipt_delete_all(args, comp, off)
 			off[r.table] = off[r.table] or { }
 			off[r.table][r.chain] = off[r.table][r.chain] or 0
 
-			os.execute("iptables -t %q -D %q %d 2>/dev/null"
+			exec("iptables -t %q -D %q %d 2>/dev/null"
 				%{ r.table, r.chain, r.index - off[r.table][r.chain] })
 
 			off[r.table][r.chain] = off[r.table][r.chain] + 1
@@ -190,7 +259,7 @@ function ipt6_delete_all(args, comp, off)
 			off[r.table] = off[r.table] or { }
 			off[r.table][r.chain] = off[r.table][r.chain] or 0
 
-			os.execute("ip6tables -t %q -D %q %d 2>/dev/null"
+			exec("ip6tables -t %q -D %q %d 2>/dev/null"
 				%{ r.table, r.chain, r.index - off[r.table][r.chain] })
 
 			off[r.table][r.chain] = off[r.table][r.chain] + 1
@@ -219,15 +288,19 @@ function add_lease(mac, arp, no_uci)
 
 	-- Add lease if there is an ip addr
 	if ipaddr then
+		local device = get_device_for_ip(ipaddr)
 		if not no_uci then
 			uci:section("luci_splash_leases", "lease", convert_mac_to_secname(mac), {
 				mac    = mac,
 				ipaddr = ipaddr,
+				device = device,
+				limit_up = limit_up,
+				limit_down = limit_down,
 				start  = os.time()
 			})
 			uci:save("luci_splash_leases")
 		end
-		add_lease_rule(mac, ipaddr)
+		add_lease_rule(mac, ipaddr, device)
 	else
 		print("Found no active IP for %s, lease not added" % mac)
 	end
@@ -241,7 +314,7 @@ function remove_lease(mac)
 	uci:delete_all("luci_splash_leases", "lease",
 		function(s)
 			if s.mac:lower() == mac then
-				remove_lease_rule(mac, s.ipaddr)
+				remove_lease_rule(mac, s.ipaddr, s.device, tonumber(s.limit_up), tonumber(s.limit_down))
 				return true
 			end
 			return false
@@ -277,8 +350,21 @@ function remove_whitelist(mac)
 	uci:save("luci_splash")
 	uci:commit("luci_splash")
 	remove_lease_rule(mac)
+	remove_whitelist_tc(mac)
 end
 
+function remove_whitelist_tc(mac)
+	if debug then
+		print("Removing whitelist filters for " .. mac)
+	end
+        uci:foreach("luci_splash", "iface", function(s)
+		local device = get_physdev(s['.name'])
+		local handle = get_filter_handle('ffff:', 'src', device, mac)
+		exec('tc filter del dev "%s" parent ffff: protocol ip prio 1 handle %s u32' % { device, handle })
+		local handle = get_filter_handle('1:', 'dest', device, mac)
+		exec('tc filter del dev "%s" parent 1:0 protocol ip prio 1 handle %s u32' % { device, handle })
+        end)
+end
 
 -- Remove a blacklist entry
 function remove_blacklist(mac)
@@ -292,55 +378,94 @@ end
 
 
 -- Add an iptables rule
-function add_lease_rule(mac, ipaddr)
-	os.execute("iptables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
-	os.execute("iptables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80 -m comment --comment %s" % {ipaddr, mac:upper()})
+function add_lease_rule(mac, ipaddr, device)
+	local id
+	if ipaddr then
+		id = get_id(ipaddr)
+	end
+
+	exec("iptables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j RETURN" % mac)
+
+	if id and device then
+		exec("iptables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 0x1%s -m comment --comment %s" % {ipaddr, id, mac:upper()})
+	end
 
 	if has_ipv6 then
-	        os.execute("ip6tables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
+		exec("ip6tables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
 		-- not working yet, needs the ip6addr
-		--os.execute("ip6tables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80 -m comment --comment %s" % {ipaddr, mac:upper()})
+		--exec("ip6tables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80 -m comment --comment %s" % {ipaddr, mac:upper()})
+	end
+
+
+	if device and tonumber(limit_up) > 0 then
+		exec('tc filter add dev "%s" parent ffff: protocol ip prio 2 u32 match ether src %s police rate %skbit mtu 6k burst 6k drop' % {device, mac, limit_up})
 	end
 
+	if id and device and tonumber(limit_down) > 0 then
+		exec("tc class add dev %s parent 1: classid 1:0x%s htb rate %skbit" % { device, id, limit_down })
+		exec("tc qdisc add dev %s parent 1:%s sfq perturb 10" % { device, id })
+	end
 
-	os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
-	os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
+	exec("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+	exec("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
 	if has_ipv6 then
-		os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+		exec("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
 	end
 end
 
 
 -- Remove lease, black- or whitelist rules
-function remove_lease_rule(mac, ipaddr)
+function remove_lease_rule(mac, ipaddr, device, limit_up, limit_down)
+	local id
+	if ipaddr then
+		id = get_id(ipaddr)
+	end
+
 	ipt:resync()
 	ipt_delete_all({table="mangle", chain="luci_splash_mark_in", options={"/*", mac:upper()}})
 	ipt_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", mac:upper()}})
 	ipt_delete_all({table="filter", chain="luci_splash_filter",   options={"MAC", mac:upper()}})
 	ipt_delete_all({table="nat",    chain="luci_splash_leases",   options={"MAC", mac:upper()}})
 	if has_ipv6 then
-		--ipt6_delete_all({table="mangle", chain="luci_splash_mark_in", options={"/*", mac:upper()}})
 		ipt6_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", mac:upper()}})
 		ipt6_delete_all({table="filter", chain="luci_splash_filter",   options={"MAC", mac:upper()}})
 	end
+	if device and tonumber(limit_up) > 0 then
+		local handle = get_filter_handle('ffff:', 'src', device, mac)
+		if handle then
+			exec('tc filter del dev "%s" parent ffff: protocol ip prio 2 handle %s u32 police rate %skbit mtu 6k burst 6k drop' % {device, handle, limit_up})
+		end
+	end
+
+	-- remove clients class
+	if device and id then
+		exec('tc class del dev "%s" classid 1:%s' % {device, id})
+		exec('tc qdisc del dev "%s" parent 1:%s sfq perturb 10' % { device, id })
+	end
+
 end
 
 
 -- Add whitelist rules
 function add_whitelist_rule(mac)
-	os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
-	os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
+	exec("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+	exec("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
 	if has_ipv6 then
-		os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+		exec("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
 	end
+        uci:foreach("luci_splash", "iface", function(s)
+		local device = get_physdev(s['.name'])
+		exec('tc filter add dev "%s" parent ffff: protocol ip prio 1 u32 match ether src %s police pass' % { device, mac })
+		exec('tc filter add dev "%s" parent 1:0 protocol ip prio 1 u32 match ether dst %s classid 1:1' % { device, mac })
+        end)
 end
 
 
 -- Add blacklist rules
 function add_blacklist_rule(mac)
-	os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
+	exec("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
 	if has_ipv6 then
-		os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
+		exec("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
 	end
 end
 
@@ -366,12 +491,15 @@ function sync()
 		if v[".type"] == "lease" then
 			if os.difftime(time, tonumber(v.start)) > leasetime then
 				-- Remove expired
-				remove_lease_rule(v.mac, v.ipaddr)
+				remove_lease_rule(v.mac, v.ipaddr, v.device, tonumber(v.limit_up), tonumber(v.limit_down))
 			else
 				-- Rewrite state
 				uci:section("luci_splash_leases", "lease", convert_mac_to_secname(v.mac), {		
 					mac    = v.mac,
 					ipaddr = v.ipaddr,
+					device = v.device,
+					limit_up = limit_up,
+					limit_down = limit_down,
 					start  = v.start
 				})
 			end
@@ -400,8 +528,6 @@ function sync()
 			function(r) return not macs[r.options[2]:lower()] end)
 		ipt6_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", "MARK", "set"}},
 			function(r) return not macs[r.options[2]:lower()] end)
-		--ipt6_delete_all({table="mangle", chain="luci_splash_mark_in", options={"/*", "MARK", "set"}},
-		--	function(r) return not macs[r.options[2]:lower()] end)
 	end
 
 	unlock()
@@ -453,7 +579,7 @@ function list()
 	end
 
 	-- Whitelist, Blacklist
-	for _, s in luci.util.spairs(leases,
+	for _, s in utl.spairs(leases,
 		function(a,b) return leases[a][".type"] > leases[b][".type"] end
 	) do
 		if (s[".type"] == "whitelist" or s[".type"] == "blacklist") and s.mac then