From fa9ee6d69e362a97350711f1cedfcfac8b78717a Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sat, 24 Sep 2016 15:46:04 -0700 Subject: [PATCH] Clear packet marks in PREROUTING and OUTPUT Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Providers.pm | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Shorewall/Perl/Shorewall/Providers.pm b/Shorewall/Perl/Shorewall/Providers.pm index 5ddcf2e42..a2d6e7e99 100644 --- a/Shorewall/Perl/Shorewall/Providers.pm +++ b/Shorewall/Perl/Shorewall/Providers.pm @@ -125,6 +125,10 @@ sub setup_route_marking() { my $exmask = have_capability( 'EXMARK' ) ? "/$mask" : ''; require_capability( $_ , q(The provider 'track' option) , 's' ) for qw/CONNMARK_MATCH CONNMARK/; + # + # Clear the mark -- we have seen cases where the mark is non-zero even in the raw table chains! + # + add_ijump( $mangle_table->{$_}, j => 'MARK', targetopts => '--set-mark 0' ) for qw/PREROUTING OUTPUT/; if ( $config{RESTORE_ROUTEMARKS} ) { add_ijump $mangle_table->{$_} , j => 'CONNMARK', targetopts => "--restore-mark --mask $mask" for qw/PREROUTING OUTPUT/;