diff mbox series

QoS: Do no classify as default when L7 filter isn't done

Message ID 20191022154814.10388-1-michael.tremer@ipfire.org
State Accepted
Commit d704e75d750b38e77d01ca32fd5a4d70470467ce
Headers
Series QoS: Do no classify as default when L7 filter isn't done |

Commit Message

Michael Tremer Oct. 22, 2019, 3:48 p.m. UTC 
  We need to allow some more packets to pass through the
mangle chains so that the layer 7 filter can determine
what protocol it finds.

If L7 filter decides that a connection is of type "unknown",
we mark it as default, or it is marked with the correct class.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 config/qos/makeqosscripts.pl | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)
diff mbox series

Patch

diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl
index 1a5d01d52..cbbbf70f8 100644
--- a/config/qos/makeqosscripts.pl
+++ b/config/qos/makeqosscripts.pl
@@ -205,9 +205,6 @@  foreach $classentry (sort @classes)
 }
 print <<END
 
-	### add l7-filter to PREROUTING chain to see all traffic
-	iptables -t mangle -A PREROUTING -m layer7 --l7proto unset
-
 	### ADD QOS-OUT CHAIN TO THE MANGLE TABLE IN IPTABLES
 	iptables -t mangle -N QOS-OUT
 	iptables -t mangle -I POSTROUTING -o $qossettings{'RED_DEV'} -j QOS-OUT
@@ -502,7 +499,7 @@  END
 
 print <<END
 	### REDUNDANT: SET ALL NONMARKED PACKETS TO DEFAULT CLASS
-	iptables -t mangle -A QOS-INC -m mark --mark 0 -j MARK --set-mark $qossettings{'DEFCLASS_INC'}
+	iptables -t mangle -A QOS-INC -m mark --mark 0 -m layer7 ! --l7proto unset -j MARK --set-mark $qossettings{'DEFCLASS_INC'}
 
 	# Save mark in connection tracking
 	iptables -t mangle -A QOS-INC -j CONNMARK --save-mark
@@ -540,8 +537,6 @@  print <<END
 	iptables -t mangle --delete-chain QOS-OUT >/dev/null 2>&1
 	iptables -t mangle --flush  QOS-INC >/dev/null 2>&1
 	iptables -t mangle --delete-chain QOS-INC >/dev/null 2>&1
-	# remove l7-filter
-	iptables -t mangle --delete PREROUTING -m layer7 --l7proto unset
 
 	rmmod sch_htb >/dev/null 2>&1