hello, I try to use layer7 filter to classify packets. I have a proble with http match. This protocol seems to work well with l7-filter (http://l7-filter.sourceforge.net/protocols) but for me nothing is filtering in http class. Someone can help me ? Here is my script : #!/bin/bash IPT_BIN=/sbin/iptables TC_BIN=/sbin/tc INTER_OUT=ppp0 LINK_RATE_UP=1000Kbit RATE_ACK=200Kbit RATE_DEFAULT=100Kbit RATE_12=12Kbit RATE_13=13Kbit RATE_14=14Kbit NB_filtre_12=1 NB_filtre_13=2 NB_filtre_14=4 PROTO_12_1=http PROTO_13_1=skypeout PROTO_13_2=skypetoskype PROTO_14_1=edonkey PROTO_14_2=gnutella PROTO_14_3=applejuice PROTO_14_4=bittorrent # Delete all qdisc on $INTER_IN and $INTER_OUT $TC_BIN qdisc del dev $INTER_IN root 2> /dev/null > /dev/null $TC_BIN qdisc del dev $INTER_IN ingress 2> /dev/null > /dev/null $TC_BIN qdisc del dev $INTER_OUT root 2> /dev/null > /dev/null $TC_BIN qdisc del dev $INTER_OUT ingress 2> /dev/null > /dev/null # Delete magle's rules $IPT_BIN -t mangle -F $IPT_BIN -t mangle -X $IPT_BIN -t mangle -Z ######################## # TC Rules ######################## # initRules $TC_BIN qdisc add dev $INTER_OUT handle 1: root htb default 1 $TC_BIN class add dev $INTER_OUT parent 1: classid 1:1 htb rate $LINK_RATE_UP $TC_BIN filter add dev $INTER_OUT parent 1:0 protocol all u32 match u32 0 0 classid 1:1 ## BuildInChains $TC_BIN class add dev $INTER_OUT parent 1:1 classid 1:11 htb rate $LINK_RATE_UP ceil $LINK_RATE_UP quantum 1532 NUM_file=12 NB_class=$NB_file while [ $NB_class -ge 0 ] do PRIO=$((5-$NB_class)) case $NUM_file in 12) RATE_PIPE=$RATE_12 ;; 13) RATE_PIPE=$RATE_13 ;; 14) RATE_PIPE=$RATE_14 ;; esac $TC_BIN class add dev $INTER_OUT parent 1:11 classid 1:$NUM_file htb rate $RATE_PIPE ceil $LINK_RATE_UP prio $PRIO quantum 1532 $TC_BIN qdisc add dev $INTER_OUT handle $NUM_file: parent 1:$NUM_file sfq NUM_file=$(($NUM_file + 1)) NB_class=$(($NB_class - 1)) done ## default pipe $TC_BIN class add dev $INTER_OUT parent 1:11 classid 1:199 htb rate $RATE_DEFAULT ceil $LINK_RATE_UP prio 4 quantum 1532 $TC_BIN qdisc add dev $INTER_OUT handle 199: parent 1:199 sfq #################### # iptables rules #################### # # initRules $IPT_BIN -t mangle -N ms-all $IPT_BIN -t mangle -N ms-all-chains $IPT_BIN -t mangle -N ms-prerouting $IPT_BIN -t mangle -A PREROUTING -j ms-prerouting $IPT_BIN -t mangle -A ms-prerouting -j CONNMARK --restore-mark $IPT_BIN -t mangle -A FORWARD -o $INTER_OUT -j ms-all $IPT_BIN -t mangle -A POSTROUTING -o $INTER_OUT -j ms-all-chains # buildInChains $IPT_BIN -t mangle -N ms-chain-$INTER_OUT-1:11 $IPT_BIN -t mangle -A ms-all-chains -m connmark --mark 0xc0ed4017 -j ms-chain-$INTER_OUT-1:11 $IPT_BIN -t mangle -A ms-all -o $INTER_OUT -j ms-chain-$INTER_OUT-1:11 NUM_file=12 while [ $NB_file -ge 0 ] do while [ $((NB_filtre_$NUM_file)) -ge 1 ] do case $NUM_file in 12) case $NB_filtre_12 in 1) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_12_1 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_12_1 -j RETURN ;; esac NB_filtre_12=$(($NB_filtre_12 - 1)) ;; 13) case $NB_filtre_13 in 1) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_1 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_1 -j RETURN ;; 2) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_2 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_2 -j RETURN ;; esac NB_filtre_13=$(($NB_filtre_13 - 1)) ;; 14) case $NB_filtre_14 in 1) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_1 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_1 -j RETURN ;; 2) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_2 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_2 -j RETURN ;; 3) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_3 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_3 -j RETURN ;; 4) $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_4 -j CLASSIFY --set-class 1:$NUM_file $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_4 -j RETURN ;; esac NB_filtre_14=$(($NB_filtre_14 - 1)) ;; esac done NUM_file=$(($NUM_file + 1)) NB_file=$(($NB_file - 1)) done $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -j CLASSIFY --set-class 1:199 $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -j RETURN $IPT_BIN -t mangle -A ms-prerouting -j CONNMARK --save-mark _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
