From 08cb6f0c7abca95fa898020bb9f3ba3f4bfbf148 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Fri, 28 Aug 2020 13:15:34 -0400
Subject: [PATCH 53/62] fix(nftables): packet marks with masks

(cherry picked from commit e296b926ae5dc4cbc277b6dd755d045e73ed4411)
(cherry picked from commit 371efe757f2bde20b4301a78ed3c48ec1d31bf5e)
---
 src/firewall/core/fw_zone.py  | 2 ++
 src/firewall/core/nftables.py | 9 +++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index 129306b6f969..6eaed4232405 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -1719,6 +1719,8 @@ class FirewallZone(object):
                 if enable:
                     transaction.add_chain(zone, table, "INPUT")
                     transaction.add_chain(zone, table, "FORWARD_IN")
+                if enable and type(rule.action) == Rich_Mark:
+                    transaction.add_chain(zone, "mangle", "PREROUTING")
 
                 rules = backend.build_zone_icmp_block_rules(enable, zone, ict, rule)
                 transaction.add_rules(backend, rules)
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
index 0198200b2372..76668a60468f 100644
--- a/src/firewall/core/nftables.py
+++ b/src/firewall/core/nftables.py
@@ -1043,8 +1043,13 @@ class nftables(object):
                                                 zone=zone)
             table = "mangle"
             chain = "%s_%s_%s" % (table, target, chain_suffix)
-            rule_action = {"mangle": {"key": {"meta": {"key": "mark"}},
-                                      "value": rich_rule.action.set}}
+            value = rich_rule.action.set.split("/")
+            if len(value) > 1:
+                rule_action = {"mangle": {"key": {"meta": {"key": "mark"}},
+                                          "value": {"^": [{"&": [{"meta": {"key": "mark"}}, value[1]]}, value[0]]}}}
+            else:
+                rule_action = {"mangle": {"key": {"meta": {"key": "mark"}},
+                                          "value": value[0]}}
         else:
             raise FirewallError(INVALID_RULE,
                                 "Unknown action %s" % type(rich_rule.action))
-- 
2.28.0