From: Arne Fitzenreiter <arne_f@ipfire.org>
Date: Mon, 25 Oct 2021 09:42:16 +0000 (+0200)
Subject: makeqosscript: replace marks b< ipt  policy match for upsec
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=36b00b8ed130601a9aab14036c81c2ea788aa000;p=people%2Fms%2Fipfire-2.x.git

makeqosscript: replace marks b< ipt  policy match for upsec

this is more reliable at not loose some connections.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
---

diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl
index b029a885f2..0694bb78cf 100644
--- a/config/qos/makeqosscripts.pl
+++ b/config/qos/makeqosscripts.pl
@@ -61,9 +61,8 @@ my $QOS_INC_MASK = 0x0000ff00;
 my $QOS_INC_SHIFT = 8;
 my $QOS_OUT_MASK = 0x000000ff;
 my $QOS_OUT_SHIFT = 0;
-my $IPSEC_MASK = 0x00800000;
-my $QOS_INC_SKIP_MASK = $QOS_INC_MASK | $IPSEC_MASK;
-my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK | $IPSEC_MASK;
+my $QOS_INC_SKIP_MASK = $QOS_INC_MASK;
+my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK;
 
 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
 
@@ -322,13 +321,15 @@ print <<END
 
 	ip link set $qossettings{'IMQ_DEV'} up
 
-	### Restore conmark and continue with next filter
-	tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all u32 \\
-		match u32 0 0 \\
-		action connmark continue
-	### Send all traffic except IPSec to $qossettings{'IMQ_DEV'}
+	### Pass IPSec traffic without redirect
+	tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all basic \\
+		match "ipt(-m policy --pol ipsec --dir in)" \\
+		action pass
+
+	### Restore connmark and send rest of the traffic to $qossettings{'IMQ_DEV'}
 	tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 2 protocol all u32 \\
-		match mark 0 $IPSEC_MASK \\
+		match u32 0 0 \\
+		action connmark \\
 		action mirred egress redirect dev $qossettings{'IMQ_DEV'}
 
 	### ADD HTB QDISC FOR $qossettings{'IMQ_DEV'}