This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  36b00b8ed130601a9aab14036c81c2ea788aa000 (commit)
      from  66bc17dcc16f465fed435f366a8ccf01c6e6d814 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 36b00b8ed130601a9aab14036c81c2ea788aa000
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date:   Mon Oct 25 11:42:16 2021 +0200

    makeqosscript: replace marks b< ipt  policy match for upsec
    
    this is more reliable at not loose some connections.
    
    Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/qos/makeqosscripts.pl | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

Difference in files:
diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl
index b029a885f..0694bb78c 100644
--- a/config/qos/makeqosscripts.pl
+++ b/config/qos/makeqosscripts.pl
@@ -61,9 +61,8 @@ my $QOS_INC_MASK = 0x0000ff00;
 my $QOS_INC_SHIFT = 8;
 my $QOS_OUT_MASK = 0x000000ff;
 my $QOS_OUT_SHIFT = 0;
-my $IPSEC_MASK = 0x00800000;
-my $QOS_INC_SKIP_MASK = $QOS_INC_MASK | $IPSEC_MASK;
-my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK | $IPSEC_MASK;
+my $QOS_INC_SKIP_MASK = $QOS_INC_MASK;
+my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK;
 
 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
 
@@ -322,13 +321,15 @@ print <<END
 
 	ip link set $qossettings{'IMQ_DEV'} up
 
-	### Restore conmark and continue with next filter
-	tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all u32 \\
-		match u32 0 0 \\
-		action connmark continue
-	### Send all traffic except IPSec to $qossettings{'IMQ_DEV'}
+	### Pass IPSec traffic without redirect
+	tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all basic \\
+		match "ipt(-m policy --pol ipsec --dir in)" \\
+		action pass
+
+	### Restore connmark and send rest of the traffic to $qossettings{'IMQ_DEV'}
 	tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 2 protocol all u32 \\
-		match mark 0 $IPSEC_MASK \\
+		match u32 0 0 \\
+		action connmark \\
 		action mirred egress redirect dev $qossettings{'IMQ_DEV'}
 
 	### ADD HTB QDISC FOR $qossettings{'IMQ_DEV'}


hooks/post-receive
--
IPFire 2.x development tree