From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject:
 [PATCH v2 10/15] QoS: Use CONNMARK to mark connections in connection tracking
Date: Mon, 21 Oct 2019 20:45:34 +0200
Message-ID: <20191021184539.12758-10-michael.tremer@ipfire.org>
In-Reply-To: <20191021184539.12758-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8168071215212968663=="
List-Id: <development.lists.ipfire.org>

--===============8168071215212968663==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

From: Daniel Weism=C3=BCller <daniel.weismueller(a)ipfire.org>

This patch modifies the connection tracking in that ways that
it sets a connection mark which will be retrieved when a packet
is being redirected to the IFB interface.

This way, we can use classification without having the packet
being sent through iptables first.

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Daniel Weism=C3=BCller <daniel.weismueller(a)ipfire.org>
---
 config/qos/makeqosscripts.pl | 40 ++++++++++------------------------------
 1 file changed, 10 insertions(+), 30 deletions(-)

diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl
index 51d818699..1754c45fd 100644
--- a/config/qos/makeqosscripts.pl
+++ b/config/qos/makeqosscripts.pl
@@ -371,6 +371,7 @@ print <<END
 	ip link set $qossettings{'IMQ_DEV'} up
=20
 	tc filter add dev $qossettings{'RED_DEV'} parent ffff: protocol all u32 mat=
ch u32 0 0 \\
+		action connmark \\
 		action mirred egress redirect dev $qossettings{'IMQ_DEV'}
=20
 	### ADD HTB QDISC FOR $qossettings{'IMQ_DEV'}
@@ -435,6 +436,9 @@ print <<END
 	iptables -t mangle -I FORWARD -i $qossettings{'RED_DEV'} -j QOS-INC
 	iptables -t mangle -A FORWARD -i $qossettings{'RED_DEV'} -j QOS-TOS
=20
+	# If the packet is already marked, then skip the processing
+	iptables -t mangle -A QOS-INC -m mark ! --mark 0 -j RETURN
+
 	### SET TOS
 END
 ;
@@ -445,8 +449,7 @@ END
 		$qossettings{'TOS'} =3D abs $tosruleline[2] * 2;
   		if ( $tosruleline[1] eq $qossettings{'IMQ_DEV'} )
   		{
-			print "\tiptables -t mangle -A QOS-INC -m tos --tos $qossettings{'TOS'} -=
j MARK --set-mark $qossettings{'CLASS'}\n";
-			print "\tiptables -t mangle -A QOS-INC -m tos --tos $qossettings{'TOS'} -=
j RETURN\n";
+			print "\tiptables -t mangle -A QOS-INC -m mark --mark 0 -m tos --tos $qos=
settings{'TOS'} -j MARK --set-mark $qossettings{'CLASS'}\n";
 		}
=20
 	}
@@ -464,7 +467,7 @@ print "\n\t### SET PORT-RULES\n";
 			$qossettings{'QPORT'} =3D $portruleline[4];
 			$qossettings{'DIP'} =3D $portruleline[5];
 			$qossettings{'DPORT'} =3D $portruleline[6];
-			print "\tiptables -t mangle -A QOS-INC ";
+			print "\tiptables -t mangle -A QOS-INC -m mark --mark 0 ";
 			if ($qossettings{'QIP'} ne ''){
 				print "-s $qossettings{'QIP'} ";
 			}
@@ -482,24 +485,6 @@ print "\n\t### SET PORT-RULES\n";
 				print "--dport $qossettings{'DPORT'} ";
 			}
 			print "-j MARK --set-mark $qossettings{'CLASS'}\n";
-			print "\tiptables -t mangle -A QOS-INC ";
-			if ($qossettings{'QIP'} ne ''){
-				print "-s $qossettings{'QIP'} ";
-			}
-			if ($qossettings{'DIP'} ne ''){
-				print "-d $qossettings{'DIP'} ";
-			}
-			print "-p $qossettings{'PPROT'} ";
-#			if (($qossettings{'QPORT'} ne '') || ($qossettings{'DPORT'} ne '')){
-#				print "-m multiport ";
-#			}
-			if ($qossettings{'QPORT'} ne ''){
-				print "--sport $qossettings{'QPORT'} ";
-			}
-			if ($qossettings{'DPORT'} ne ''){
-				print "--dport $qossettings{'DPORT'} ";
-			}
-			print "-j RETURN\n\n";
 		}
 	}
=20
@@ -518,7 +503,7 @@ END
 			$qossettings{'L7PROT'} =3D $l7ruleline[2];
 			$qossettings{'QIP'} =3D $l7ruleline[3];
 			$qossettings{'DIP'} =3D $l7ruleline[4];
-  			print "\tiptables -t mangle -A QOS-INC ";
+			print "\tiptables -t mangle -A QOS-INC -m mark --mark 0 ";
 			if ($qossettings{'QIP'} ne ''){
 				print "-s $qossettings{'QIP'} ";
 			}
@@ -526,14 +511,6 @@ END
 				print "-d $qossettings{'DIP'} ";
 			}
 			print "-m layer7 --l7dir /etc/l7-protocols/protocols --l7proto $qossettin=
gs{'L7PROT'} -j MARK --set-mark $qossettings{'CLASS'}\n";
-  			print "\tiptables -t mangle -A QOS-INC ";
-			if ($qossettings{'QIP'} ne ''){
-				print "-s $qossettings{'QIP'} ";
-			}
-			if ($qossettings{'DIP'} ne ''){
-				print "-d $qossettings{'DIP'} ";
-			}
-			print "-m layer7 --l7dir /etc/l7-protocols/protocols --l7proto $qossettin=
gs{'L7PROT'} -j RETURN\n";
   		}
   	}
=20
@@ -541,6 +518,9 @@ print <<END
 	### REDUNDANT: SET ALL NONMARKED PACKETS TO DEFAULT CLASS
 	iptables -t mangle -A QOS-INC -m mark --mark 0 -j MARK --set-mark $qossetti=
ngs{'DEFCLASS_INC'}
=20
+	# Save mark in connection tracking
+	iptables -t mangle -A QOS-INC -j CONNMARK --save-mark
+
 	### SETTING TOS BITS
 END
 ;
--=20
2.12.2


--===============8168071215212968663==--