diff mbox series

[9/9] firewall: Keep REPEAT bit when saving rest to CONNMARK

Message ID 20211018101022.15448-9-michael.tremer@ipfire.org
State Accepted
Commit 19357bc55e63cbde3bfae3f46bfaf5e655871763
Headers
Series [1/9] suricata: Set most significant bit as repeat marker |

Commit Message

Michael Tremer Oct. 18, 2021, 10:10 a.m. UTC 
  Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 src/initscripts/system/firewall | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Stefan Schantl Oct. 19, 2021, 4:05 a.m. UTC | #1 
Tested-by: Stefan Schantl <stefan.schantl@ipfire.org>
> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
> ---
>  src/initscripts/system/firewall | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/src/initscripts/system/firewall
> b/src/initscripts/system/firewall
> index 530e8f1d6..5fc63683c 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -48,8 +48,7 @@ iptables_init() {
>  
>         # IPS Bypass Chain which stores the BYPASS bit in connection
> tracking
>         iptables -N IPSBYPASS
> -       iptables -A IPSBYPASS -j MARK --set-xmark "0/$((
> IPS_REPEAT_MASK ))"
> -       iptables -A IPSBYPASS -j CONNMARK --save-mark
> +       iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$((
> ~IPS_REPEAT_MASK & 0xffffffff ))"
>  
>         # Jump into bypass chain when the BYPASS bit is set
>         for chain in INPUT FORWARD OUTPUT; do
diff mbox series

Patch

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 530e8f1d6..5fc63683c 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -48,8 +48,7 @@  iptables_init() {
 
 	# IPS Bypass Chain which stores the BYPASS bit in connection tracking
 	iptables -N IPSBYPASS
-	iptables -A IPSBYPASS -j MARK --set-xmark "0/$(( IPS_REPEAT_MASK ))"
-	iptables -A IPSBYPASS -j CONNMARK --save-mark
+	iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$(( ~IPS_REPEAT_MASK & 0xffffffff ))"
 
 	# Jump into bypass chain when the BYPASS bit is set
 	for chain in INPUT FORWARD OUTPUT; do