This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 36b00b8ed130601a9aab14036c81c2ea788aa000 (commit) from 66bc17dcc16f465fed435f366a8ccf01c6e6d814 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 36b00b8ed130601a9aab14036c81c2ea788aa000 Author: Arne Fitzenreiter arne_f@ipfire.org Date: Mon Oct 25 11:42:16 2021 +0200

makeqosscript: replace marks b< ipt policy match for upsec

this is more reliable at not loose some connections.

Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/qos/makeqosscripts.pl | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)

Difference in files: diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index b029a885f..0694bb78c 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -61,9 +61,8 @@ my $QOS_INC_MASK = 0x0000ff00; my $QOS_INC_SHIFT = 8; my $QOS_OUT_MASK = 0x000000ff; my $QOS_OUT_SHIFT = 0; -my $IPSEC_MASK = 0x00800000; -my $QOS_INC_SKIP_MASK = $QOS_INC_MASK | $IPSEC_MASK; -my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK | $IPSEC_MASK; +my $QOS_INC_SKIP_MASK = $QOS_INC_MASK; +my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK;

&General::readhash("${General::swroot}/ethernet/settings", %netsettings);

@@ -322,13 +321,15 @@ print <<END

ip link set $qossettings{'IMQ_DEV'} up

- ### Restore conmark and continue with next filter - tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all u32 \ - match u32 0 0 \ - action connmark continue - ### Send all traffic except IPSec to $qossettings{'IMQ_DEV'} + ### Pass IPSec traffic without redirect + tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all basic \ + match "ipt(-m policy --pol ipsec --dir in)" \ + action pass + + ### Restore connmark and send rest of the traffic to $qossettings{'IMQ_DEV'} tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 2 protocol all u32 \ - match mark 0 $IPSEC_MASK \ + match u32 0 0 \ + action connmark \ action mirred egress redirect dev $qossettings{'IMQ_DEV'}

### ADD HTB QDISC FOR $qossettings{'IMQ_DEV'}

hooks/post-receive -- IPFire 2.x development tree