Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code

Shorewall/Perl/Shorewall/Chains.pm

@@ -825,12 +825,13 @@ sub get_opttype( $$ ) { # $option, $default
     $opttype{$_[0]} || $_[1];
 }
 
-# # Next a helper for setting an individual option
+#
+# Next a helper for setting an individual option
 #
 sub set_rule_option( $$$ ) {
     my ( $ruleref, $option, $value ) = @_;
 
-    assert( defined $value && reftype $ruleref , $value, $ruleref );
+    assert( defined $value && reftype $ruleref , $option, $ruleref );
 
     $ruleref->{simple} = 0;
     $ruleref->{complex} = 1 if reftype $value;
@@ -2333,7 +2334,7 @@ sub add_jump( $$$;$$$ ) {
     #
     # If the destination is a chain, mark it referenced
     #
-    $toref->{referenced} = 1, add_reference $fromref, $toref if $toref;
+    $toref->{referenced} = 1, add_reference( $fromref, $toref ) if $toref;
 
     my $param = $goto_ok && $toref && have_capability( 'GOTO_TARGET' ) ? 'g' : 'j';
 
@@ -3183,6 +3184,7 @@ sub check_optimization( $ ) {
 # Perform Optimization
 #
 # When an unreferenced chain is found, it is deleted unless its 'dont_delete' flag is set.
+#
 sub optimize_level0() {
     for my $table ( qw/raw rawpost mangle nat filter/ ) {
 	my $tableref = $chain_table{$table};
@@ -4796,11 +4798,6 @@ sub verify_mark( $ ) {
     }
 }
 
-sub verify_small_mark( $ ) {
-    verify_mark ( (my $mark) = $_[0] );
-    fatal_error "Mark value ($mark) too large" if numeric_value( $mark ) > $globals{TC_MAX};
-}
-
 sub validate_mark( $ ) {
     my $mark = shift;
     my $val;
@@ -4819,6 +4816,12 @@ sub validate_mark( $ ) {
     return numeric_value $val if defined( wantarray );
 }
 
+sub verify_small_mark( $ ) {
+    my $val = validate_mark ( (my $mark) = $_[0] );
+    fatal_error "Mark value ($mark) too large" if numeric_value( $mark ) > $globals{TC_MAX};
+    $val;
+}
+
 #
 # Generate an appropriate -m [conn]mark match string for the contents of a MARK column
 #

Shorewall/Perl/Shorewall/Tc.pm

@@ -227,8 +227,8 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
     our $designator;
     my $fw              = firewall_zone;
 
-    sub handle_mark_param( $ ) {
+    sub handle_mark_param( $$ ) {
-	my ( $option ) = @_;
+	my ( $option, $marktype ) = @_;
 	my $and_or = $1 if $params =~ s/^([|&])//;
 
 	if ( $params =~ /-/ ) {
@@ -292,16 +292,21 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
 
 	    $done = 1;
 	}  else {
-	    my $mark = $params;
-	    my $val;
-	    if ( supplied $mark ) {
-		$val = validate_mark( $mark );
-	    } else {
-		$val = numeric_value( $mark = $globals{TC_MASK} );
-	    }
 	    #
 	    # A Single Mark
 	    #
+	    my $mark = $params;
+	    my $val;
+	    if ( supplied $mark ) {
+		if ( $marktype == SMALLMARK ) {
+		    $val = verify_small_mark( $mark );
+		} else {
+		    $val = validate_mark( $mark );
+		}
+	    } else {
+		$val = numeric_value( $mark = $globals{TC_MASK} );
+	    }
+
 	    if ( $config{PROVIDER_OFFSET} ) {
 		my $limit = $globals{TC_MASK};
 		unless ( have_capability 'FWMARK_RT_MASK' ) {
@@ -375,7 +380,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
 	    maxparams      => 1,
 	    function       => sub () {
 		$target = 'CONNMARK';
-		handle_mark_param('--set-mark' );
+		handle_mark_param('--set-mark' , HIGHMARK );
 	    },
 	},
 
@@ -551,7 +556,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
 	    mask           => in_hex( $globals{TC_MASK} ),
 	    function       => sub () {
 		$target = 'MARK';
-		handle_mark_param('--set-mark');
+		handle_mark_param('--set-mark', , HIGHMARK );
 	    },
 	},
 
@@ -563,7 +568,8 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
 	    function       => sub () {
 		$target = 'CONNMARK ';
 		if ( supplied $params ) {
-		    handle_mark_param( '--restore-mark --mark ' );
+		    handle_mark_param( '--restore-mark --mask ',
+				       $config{TC_EXPERT} ? HIGHMARK : SMALLMARK );
 		} else {
 		    $target .= '--restore-mark --mask ' . in_hex( $globals{TC_MASK} );
 		}
@@ -591,7 +597,9 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$ ) {
 	    function       => sub () {
 		$target = 'CONNMARK ';
 		if ( supplied $params ) {
-		    handle_mark_param( '--save-mark --mask ' );
+		    handle_mark_param( '--save-mark --mask ' ,
+				       $config{TC_EXPERT} ? HIGHMARK : SMALLMARK );
+
 		} else {
 		    $target .= '--save-mark --mask ' . in_hex( $globals{TC_MASK} );
 		}