From patchwork Mon Oct 4 17:52:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 4758 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx111zRz3xCR for ; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HNSx029Cvz1qH; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HNSx00zp0z31s2; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HNSwz49WJz2x9h for ; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HNSwz1QM9zhl; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633369971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=yIncbeIUKlB/F5F4eNaZpV62vjw6w3Te1AJZtBdtH7Y=; b=0o4oHmbrfhOOj3ZH0+VDj6nhWN0Vq2jN9lDCEINMcvHxZX5I2C/Ic1/0OHDaMIPdN3o4WC jaq9xICyoaX130BA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633369971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=yIncbeIUKlB/F5F4eNaZpV62vjw6w3Te1AJZtBdtH7Y=; b=KKCa/V+SuXPpvw6k+wQ8L8sd9LBbpxrvtTwktO5QFFTKcqqM+sgzGAUhPm5mLJc0KdFtOw wDOW+NRwbZvCzDN2H3viT4dNL/buYp2SvTJK0hMI3znypnGoyQA3tTXwQEiAF/qGqne3ma 0sKWdFiM3QeY7RXCaI6Zng+VCqX2JbFnXqVAIXyEHX9Gaot1pSxN0ecFRhjMMq38vD3OlK eOs+d5Ton2nGUvgLi6KNDW4Y5/g9JOcixouZyMY9olW1MTkmhqJ6hnLMfPuXENW4LSA5qi cFZWmK5I7O8mNW6zqAA7jvRs68BGoKcvnF3hN9uWa8YJVFsQH4k+VLpCqeEa3Q== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 1/6] firewall: Only check relevant bits for NAT fix rules Date: Mon, 4 Oct 2021 18:52:17 +0100 Message-Id: <20211004175222.9208-1-michael.tremer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" In order to use the highest two bits for surciata bypass, we will need to make sure that whenever we compare any other marks, we do not care about anything else. Signed-off-by: Michael Tremer --- config/firewall/rules.pl | 11 +++++++---- src/initscripts/system/firewall | 8 +++++--- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index 0dd1c9024..9d280045a 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -55,6 +55,9 @@ my @PRIVATE_NETWORKS = ( "100.64.0.0/10", ); +# MARK masks +my $NAT_MASK = 0x0f000000; + my %fwdfwsettings=(); my %fwoptions = (); my %defaultNetworks=(); @@ -829,10 +832,8 @@ sub add_dnat_mangle_rules { my $interface = shift; my @options = @_; - my $mark = 0; + my $mark = 0x01000000; foreach my $zone ("GREEN", "BLUE", "ORANGE") { - $mark++; - # Skip rule if not all required information exists. next unless (exists $defaultNetworks{$zone . "_NETADDRESS"}); next unless (exists $defaultNetworks{$zone . "_NETMASK"}); @@ -845,9 +846,11 @@ sub add_dnat_mangle_rules { $netaddress .= "/" . $defaultNetworks{$zone . "_NETMASK"}; push(@mangle_options, ("-s", $netaddress, "-d", $nat_address)); - push(@mangle_options, ("-j", "MARK", "--set-mark", $mark)); + push(@mangle_options, ("-j", "MARK", "--set-xmark", "$mark/$NAT_MASK")); run("$IPTABLES -t mangle -A $CHAIN_MANGLE_NAT_DESTINATION_FIX @mangle_options"); + + $mark <<= 1; } } diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index baa39abe1..9d023a349 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -12,6 +12,8 @@ if [ -f /var/ipfire/red/device ]; then DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'` fi +NAT_MASK="0x0f000000" + function iptables() { /sbin/iptables --wait "$@" } @@ -282,17 +284,17 @@ iptables_init() { if [ -n "${GREEN_ADDRESS}" ]; then iptables -t nat -A NAT_DESTINATION_FIX \ - -m mark --mark 1 -j SNAT --to-source "${GREEN_ADDRESS}" + -m mark --mark "0x01000000/${NAT_MASK}" -j SNAT --to-source "${GREEN_ADDRESS}" fi if [ -n "${BLUE_ADDRESS}" ]; then iptables -t nat -A NAT_DESTINATION_FIX \ - -m mark --mark 2 -j SNAT --to-source "${BLUE_ADDRESS}" + -m mark --mark "0x02000000/${NAT_MASK}" -j SNAT --to-source "${BLUE_ADDRESS}" fi if [ -n "${ORANGE_ADDRESS}" ]; then iptables -t nat -A NAT_DESTINATION_FIX \ - -m mark --mark 3 -j SNAT --to-source "${ORANGE_ADDRESS}" + -m mark --mark "0x04000000/${NAT_MASK}" -j SNAT --to-source "${ORANGE_ADDRESS}" fi # RED chain, used for the red interface From patchwork Mon Oct 4 17:52:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 4759 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx320ngz3xCR for ; Mon, 4 Oct 2021 17:52:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HNSx12Rz7z188; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HNSx11dqdz32KQ; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HNSwz5VhKz2x9h for ; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HNSwz48fCz131; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633369971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wEPcVkI+Uv2gVaoQqfOKfvUp3ScAwXZ2myT4+jHe8GQ=; b=OfeycR0HAOmSeqLWcA0j5Ki5RFcwu7IWJ/d9rk3OJSr6BkWmi3lfjXHri0mM3sRMo054Qj r3XJcyH/xDKAAeAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633369971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wEPcVkI+Uv2gVaoQqfOKfvUp3ScAwXZ2myT4+jHe8GQ=; b=M8yTVT2EdKGfZeoLaQf3O3nOjM/TbZGLKV++hSLIB1wPaHpoTl9fuoriWhR0UyAkSpBdz9 gf+R7MIx1HvTpgRf76M2zBtfzGTfhiGSX36AzBNLBh4bkmsZm4YqtxfyUcfdbON8OLlZfc oJqQoq3h67adTiTZlVhSiMFtXBecZUPc7DaCoGZuTCu5aYVG2HB3p8d7InOxWRh3pGR9HJ H0TcW6c4fdMFBxP01Iu1knBmvzeB0n2E1789imbLOO0A1/RS/1rF/l9//qhzK4gxjlWvxB kOSVF+vbN788iKxuyjdjKdPzbs0Xjr9HVxuyWP6eHvjjp+POWfnY8HmhZkDnKQ== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 2/6] QoS: Use the two right hand bytes to mark packets Date: Mon, 4 Oct 2021 18:52:18 +0100 Message-Id: <20211004175222.9208-2-michael.tremer@ipfire.org> In-Reply-To: <20211004175222.9208-1-michael.tremer@ipfire.org> References: <20211004175222.9208-1-michael.tremer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" In order to not deal with any marks from NAT and the IPS, this patch adds masks to all places where packets are being marked for individual QoS classes. Instead of being able to use the "fw" match in tc, we have to use the u32 to apply the mask. Signed-off-by: Michael Tremer --- config/qos/makeqosscripts.pl | 57 ++++++++++++++++++++++-------------- 1 file changed, 35 insertions(+), 22 deletions(-) diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index cbbbf70f8..3af046ac3 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -56,6 +56,12 @@ my $portfile = "/var/ipfire/qos/portconfig"; my $tosfile = "/var/ipfire/qos/tosconfig"; my $fqcodel_options = "limit 10240 quantum 1514"; +# Define iptables MARKs +my $QOS_INC_MASK = 0x0000ff00; +my $QOS_INC_SHIFT = 8; +my $QOS_OUT_MASK = 0x000000ff; +my $QOS_OUT_SHIFT = 0; + &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); $qossettings{'ENABLED'} = 'off'; @@ -74,6 +80,10 @@ $qossettings{'VALID'} = 'yes'; &General::readhash("${General::swroot}/qos/settings", \%qossettings); +my $ACK_MARK = ($qossettings{'ACK'} << $QOS_OUT_SHIFT) . "/$QOS_OUT_MASK"; +my $DEF_OUT_MARK = ($qossettings{'DEFCLASS_OUT'} << $QOS_OUT_SHIFT) . "/$QOS_OUT_MASK"; +my $DEF_INC_MARK = ($qossettings{'DEFCLASS_INC'} << $QOS_INC_SHIFT) . "/$QOS_INC_MASK"; + open( FILE, "< $classfile" ) or die "Unable to read $classfile"; @classes = ; close FILE; @@ -200,9 +210,11 @@ foreach $classentry (sort @classes) if ($qossettings{'RED_DEV'} eq $classline[0]) { $qossettings{'DEVICE'} = $classline[0]; $qossettings{'CLASS'} = $classline[1]; - print "\ttc filter add dev $qossettings{'DEVICE'} parent 1:0 prio 0 protocol ip handle $qossettings{'CLASS'} fw flowid 1:$qossettings{'CLASS'}\n"; + print "\ttc filter add dev $qossettings{'DEVICE'} parent 1:0 prio 0 protocol ip"; + printf(" u32 match mark 0x%x 0x%x flowid 1:%d\n", ($qossettings{'CLASS'} << $QOS_OUT_SHIFT), $QOS_OUT_MASK, $qossettings{'CLASS'}); } } + print </dev/null 2>&1 From patchwork Mon Oct 4 17:52:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 4762 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx56mfLz46Kn for ; Mon, 4 Oct 2021 17:52:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HNSx14sdYz6mJ; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HNSx12Jbfz32KX; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HNSwz6YHFz2xd1 for ; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HNSwz5YGdzhl; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633369971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hyEcbRuSLLrhIgqOR7m0SobbBSY8bLJtLutx2aFUY6E=; b=pEeQgJVsihbnhAAFYwl20DxuWaQ2ba6NQKeqhCdtwCZ4cHb8449IDILUBaeXTtCYu6P/tW IdnKA1lGBvh3ckDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633369971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hyEcbRuSLLrhIgqOR7m0SobbBSY8bLJtLutx2aFUY6E=; b=CO5diUz9IRh0gJoH/3/NxhIB8tboTUut5GYEmEI9jlrc6dS2/KJTWSY1rjSXdRGNraBhO0 9NhiwgKHRvVMu+Vum4Ygzgmfpk5ldPXtQtXz2NdroYVA76cCOEwNs5r9M6+cqwGOClrgor r+qLgq+h6bxisYotmE+baEv70fJP0m9ORLEG6oueD44BO916+YusLuVsJAnul/nvi/BvzY Qfv+isf6YvoFxWv3TTPYykatpLYCptV/h4mJ8U7tJPrBrSF8y28pkLssiJf845Qf+mhOyK sxYFz+XYXUy0cVoL1pfvFtD8JdME3DM3/F0V9dKclgLIcS+MEdDnrMZAAkwUvw== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 3/6] firewall: Always restore all connection marks Date: Mon, 4 Oct 2021 18:52:19 +0100 Message-Id: <20211004175222.9208-3-michael.tremer@ipfire.org> In-Reply-To: <20211004175222.9208-1-michael.tremer@ipfire.org> References: <20211004175222.9208-1-michael.tremer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This was done by tc only when QoS was enabled Signed-off-by: Michael Tremer --- config/qos/makeqosscripts.pl | 1 - src/initscripts/system/firewall | 3 +++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 3af046ac3..5bdd5b811 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -370,7 +370,6 @@ print < X-Patchwork-Id: 4760 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx5053Sz3xCR for ; Mon, 4 Oct 2021 17:52:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HNSx1566Qz35q; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HNSx1308Mz32Kb; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx00k7Mz2xd1 for ; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HNSwz6fPGz131; Mon, 4 Oct 2021 17:52:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633369972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rmIkiq5RKPrcu8Vb3YTeL74kfA764H0lziRz1K8QUNI=; b=vQ1ekYeglcfic3+j0ikciGkHn5mrkIxCAz7XZp+EGg1EVMJLfUDi/45XI1THHCCcQJV/jE N5W20A5196RfPgCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633369972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rmIkiq5RKPrcu8Vb3YTeL74kfA764H0lziRz1K8QUNI=; b=WMrBJxTEOryMeNyjNYnmnEN9I4tkL0zB5R09WqNPEGqFKUv/+oR1OQ06Tr4WTwd13U2Khi IdLLSjeKYhdY3nvcJ0Z9M1c/dkw1Su6X6kkyvZQOtAbhbcIXU4MK0T8iPKnh0sNxH7nC0L ZKBBKzW2g5Bc7TdWQfYhfwuo2UqCU7JyxsPVpCt2NDjd0Lq7AFaYoUqj7teDBPYnh3K/fi sj9xNcPL7R/a3f19e63JJBPP8EnP/S3vk0wvyi+SXPte0zJ/zgdTjCAYEYf1mWlf0wNo1r 5RXQHDHTSgcdO0kTk8SQhHv0PCARf2GQ9nRUdGwqInyjFv0diecR/ExLm8W6Pw== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 4/6] QoS: Drop support for hardcoded ACK rules Date: Mon, 4 Oct 2021 18:52:20 +0100 Message-Id: <20211004175222.9208-4-michael.tremer@ipfire.org> In-Reply-To: <20211004175222.9208-1-michael.tremer@ipfire.org> References: <20211004175222.9208-1-michael.tremer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This feature has to go in order to take advantage of CONNMARK which will drastically decrease CPU load when passing packets. We no longer will see every packet in the QOS-INC chain in order to change classification of that packet. It is also party counter-intuitive to have parts of one connection in one class and the corresponding ACK packets in another. Signed-off-by: Michael Tremer --- config/qos/makeqosscripts.pl | 27 --------------------------- html/cgi-bin/qos.cgi | 22 ++-------------------- 2 files changed, 2 insertions(+), 47 deletions(-) diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 5bdd5b811..230dc3265 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -72,7 +72,6 @@ $qossettings{'DEF_OUT_SPD'} = ''; $qossettings{'DEF_INC_SPD'} = ''; $qossettings{'DEFCLASS_INC'} = ''; $qossettings{'DEFCLASS_OUT'} = ''; -$qossettings{'ACK'} = ''; $qossettings{'RED_DEV'} = `cat /var/ipfire/red/iface`; $qossettings{'IMQ_DEV'} = 'imq0'; $qossettings{'TOS'} = ''; @@ -80,7 +79,6 @@ $qossettings{'VALID'} = 'yes'; &General::readhash("${General::swroot}/qos/settings", \%qossettings); -my $ACK_MARK = ($qossettings{'ACK'} << $QOS_OUT_SHIFT) . "/$QOS_OUT_MASK"; my $DEF_OUT_MARK = ($qossettings{'DEFCLASS_OUT'} << $QOS_OUT_SHIFT) . "/$QOS_OUT_MASK"; my $DEF_INC_MARK = ($qossettings{'DEFCLASS_INC'} << $QOS_INC_SHIFT) . "/$QOS_INC_MASK"; @@ -224,31 +222,6 @@ print < @@ -668,7 +666,6 @@ END
$Lang::tr{'downlink std class'}: $qossettings{'DEFCLASS_INC'}
$Lang::tr{'uplink std class'}: $qossettings{'DEFCLASS_OUT'} -
ACKs: $qossettings{'ACK'}
@@ -692,7 +689,7 @@ if ( ($qossettings{'OUT_SPD'} eq '') || ($qossettings{'INC_SPD'} eq '') ) { exit } -if ( ($qossettings{'DEFCLASS_INC'} eq '') || ($qossettings{'DEFCLASS_OUT'} eq '') || ($qossettings{'ACK'} eq '') ) { +if ( ($qossettings{'DEFCLASS_INC'} eq '') || ($qossettings{'DEFCLASS_OUT'} eq '') ) { &changedefclasses(); &Header::closebigbox(); &Header::closepage(); @@ -742,21 +739,6 @@ END else { print "\n"; } } print <  - -
- -
$Lang::tr{'enter ack class'} -
ACKs:
From patchwork Mon Oct 4 17:52:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 4761 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx541BMz46JS for ; Mon, 4 Oct 2021 17:52:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HNSx21tJLz131; Mon, 4 Oct 2021 17:52:54 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HNSx13dnmz2yZk; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx01qdbz2yZk for ; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HNSx00pvZzhl; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633369972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EQc1yOOE2pd85wKqE1gxt+NyhKLrObGw5/rLrZoyoaE=; b=DKqKrGKY5tPWI+lnGibaevz0uXIXAl/4mbayt5XwEivcEQU1il8Q2VJq1S4nr2pevOYnbD O9ui8aF6kcvfKOCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633369972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EQc1yOOE2pd85wKqE1gxt+NyhKLrObGw5/rLrZoyoaE=; b=G4v5wSaWxdXS9R5khTH3d00tbzeE39nz4/oXy8Bg9KoBvcZ/B5CA3Dps7SX+rfr/UyrwrO XXwD1+rbWZdJqgVGXnMJ7kM9c9XWjt+4mH37qcPitHHjZrJq3lkCTvIhwWC47KL94ko8ZV +VTEKwOoJokFA1SGXwYCQdot+X1s0wNM1167YL1K9EITMRYbPbWDanaM5lUDSE4fvOirH0 K9XIiGaSeH26KwYF0kSW1qASp6Xe9Di3vqKV3iWfdO6Aozr7CXaraDaYi359cnttQDE05k plXlSjST3zbasNv4y0+xeuOXq/vlknrfPO3+Cvnjur4GhPkgX56od3LtMrOIdQ== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 5/6] QoS: Make outgoing packet processing use CONNMARK Date: Mon, 4 Oct 2021 18:52:21 +0100 Message-Id: <20211004175222.9208-5-michael.tremer@ipfire.org> In-Reply-To: <20211004175222.9208-1-michael.tremer@ipfire.org> References: <20211004175222.9208-1-michael.tremer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This will significantly reduce the load when classifying outgoing traffic as there won't be any overhead as soon as the connection has been classified. The classficiation is being stored in the iptables MARK which will be copied to CONNMARK if changed. Signed-off-by: Michael Tremer --- config/qos/makeqosscripts.pl | 30 +++++++++--------------------- 1 file changed, 9 insertions(+), 21 deletions(-) diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 230dc3265..b1bb637b3 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -217,7 +217,10 @@ print </dev/null 2>&1 From patchwork Mon Oct 4 17:52:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 4763 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HNSxB6bnBz3xCR for ; Mon, 4 Oct 2021 17:53:02 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HNSx24dszz6qF; Mon, 4 Oct 2021 17:52:54 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HNSx14PzKz32KQ; Mon, 4 Oct 2021 17:52:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HNSx03Jrjz2yZk for ; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HNSx01yJ4z188; Mon, 4 Oct 2021 17:52:52 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633369972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mLXfD+gxQ5J8SYLvPioQaajteietkHsh7mjbmr8Nt1w=; b=l3fvSLld+1LaUHwmysonA8ZZaxCoYfHTrVcQH5gNt2qvhgK/ynzwOtaV0uFE3XwqhTg7A0 c8r/PxWrluYLgoBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633369972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mLXfD+gxQ5J8SYLvPioQaajteietkHsh7mjbmr8Nt1w=; b=tOaThF1Kz07PC7xLhpDepCAOXBZnFzN0QM7Vq0uJ/v/hCapU6V6YVIXn2+ocDv09m7DqDL itKFdI2fCieX7MwuK4MO1U5LxsU6o5W7eKhgcWhZbzuqGxab/Mr/LNEbPFFcEiyYAvRQ7U 6ZG0HLxvmOQBA/uz0+dkItSNdgUZxLmSw5Y18qqDf0YOpnf72Ox/PQFNYepxfI8Ypd/8wI 8qLalVymZB80Cc3CvbHXvDu87QF3/AyFAXdAQfzHmDHsTjii+LyUEuED+dUY+xilcYbLBp 5bj+uWerVdhWTfNND7TeSWQrbg98THRIlTRY4hmwbo6JbFiWUdUtwMzxv/XprQ== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 6/6] IPsec: Replace MARK 50 by 0x00800000 Date: Mon, 4 Oct 2021 18:52:22 +0100 Message-Id: <20211004175222.9208-6-michael.tremer@ipfire.org> In-Reply-To: <20211004175222.9208-1-michael.tremer@ipfire.org> References: <20211004175222.9208-1-michael.tremer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This change is necessary because we are using the right-hand two bytes for storing the QoS classes. All IPsec traffic will now be skipped and never classified by the QoS. Signed-off-by: Michael Tremer --- config/qos/makeqosscripts.pl | 10 +++++----- src/initscripts/system/firewall | 7 +++++-- src/patches/strongswan-ipfire.patch | 12 ++++++------ 3 files changed, 16 insertions(+), 13 deletions(-) diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index b1bb637b3..fc8b8b84f 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -61,6 +61,9 @@ my $QOS_INC_MASK = 0x0000ff00; my $QOS_INC_SHIFT = 8; my $QOS_OUT_MASK = 0x000000ff; my $QOS_OUT_SHIFT = 0; +my $IPSEC_MASK = 0x00800000; +my $QOS_INC_SKIP_MASK = $QOS_INC_MASK | $IPSEC_MASK; +my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK | $IPSEC_MASK; &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); @@ -220,10 +223,7 @@ print <