--- rules.orig	2007-04-26 11:09:28.000000000 +0200
+++ rules	2007-04-26 11:10:50.000000000 +0200
@@ -6,7 +6,7 @@
 # See http://shorewall.net/Documentation.htm#Rules for additional information.
 #
 #############################################################################################################
-#ACTION	SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/
+#ACTION	SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK
 #						PORT	PORT(S)		DEST		LIMIT		GROUP
 #SECTION ESTABLISHED
 #SECTION RELATED
--- manpages/shorewall-rules.5.orig	2007-04-26 11:09:44.000000000 +0200
+++ manpages/shorewall-rules.5	2007-04-26 11:12:13.000000000 +0200
@@ -527,6 +527,11 @@
 Netfilter in kernel version 2.6.14.
 .RE
 .RE
+.TP
+\fBMARK\fR (Optional) \(em [[\fB!\fR]\fImark\fR[\fB/\fR\fImasq\fR]]
+If you wish to restrict this entry to packets marked with a particular mark value.
+mark/mask values are acceptable.
+You can prepend "!" to the mark value to invert the sense of this rule.
 .SH EXAMPLE
 .TP 
 Example 1:
--- compiler.orig	2007-04-26 11:09:16.000000000 +0200
+++ compiler	2007-04-26 11:46:04.000000000 +0200
@@ -1619,6 +1619,7 @@
 #	 ratelimit	= Optional rate limiting clause
 #	 userandgroup	= -m owner clause
 #	 userspec	= User name
+#	 mark		= Packet mark
 #	 logtag		= Log tag
 #	 policy		= Applicable Policy
 #
@@ -1760,6 +1761,7 @@
     servport=$serverport
     multiport=
     user="$userandgroup"
+    mrk="$mark"
 
     # Restore $chain to the canonical chain.
 
@@ -1806,7 +1808,7 @@
 		#
 		# This function is called from process_default_macro() after rules are DONE
 		#
-		if [ -z "$proto" -a -z "$cli" -a -z "$serv" -a -z "$servport" -a -z "$user" -a -z "$excludesource" -a -z "$excludedest" ] ; then
+		if [ -z "$proto" -a -z "$cli" -a -z "$serv" -a -z "$servport" -a -z "$user" -a -z "$excludesource" -a -z "$excludedest" -a -z "$mark" ] ; then
 		    error_message "WARNING -- Rule \"$rule\" is a POLICY"
 		    error_message "	   -- and should be moved to the policy file"
 		fi
@@ -1865,7 +1867,7 @@
 			if [ -n "$addr" -a -n "$CONNTRACK_MATCH" ]; then
 			    if [ "$addr" = detect ]; then
 				indent >&3 << __EOF__
-    run_iptables -A $chain $state $proto $ratelimit $multiport $cli $sports $(dest_ip_range $srv) $dports -m conntrack --ctorigdst \$adr $user -j $target
+    run_iptables -A $chain $state $proto $ratelimit $multiport $cli $sports $(dest_ip_range $srv) $dports -m conntrack --ctorigdst \$adr $user $mrk -j $target
 done
 
 __EOF__
@@ -1873,44 +1875,44 @@
 				for adr in $(separate_list $addr); do
 				    if [ -n "$loglevel" -a -z "$natrule" ]; then
 					log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A -m conntrack --ctorigdst $adr \
-					    $user $(fix_bang $proto $sports $multiport $cli $(dest_ip_range $srv) $dports) $state
+					    $user $mrk $(fix_bang $proto $sports $multiport $cli $(dest_ip_range $srv) $dports) $state
 				    fi
 
 				    run_iptables2 -A $chain $state $proto $ratelimit $multiport $cli $sports \
-					$(dest_ip_range $srv) $dports -m conntrack --ctorigdst $adr $user -j $target
+					$(dest_ip_range $srv) $dports -m conntrack --ctorigdst $adr $user $mrk -j $target
 				done
 			    fi
 			else
 			    if [ -n "$loglevel" -a -z "$natrule" ]; then
-				log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user \
+				log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user $mrk \
 				    $state $(fix_bang $proto $sports $multiport $cli $(dest_ip_range $srv) $dports)
 			    fi
 
 			    if [ -n "$nonat" ]; then
 				addnatrule $(dnat_chain $source) $proto $multiport \
-				    $cli $sports $(dest_ip_range $srv) $dports $ratelimit $user -j RETURN
+				    $cli $sports $(dest_ip_range $srv) $dports $ratelimit $user $mrk -j RETURN
 			    fi
 
 			    if [ "$logtarget" != NONAT ]; then
 				run_iptables2 -A $chain $state $proto $multiport $cli $sports \
-				    $(dest_ip_range $srv) $dports $ratelimit $user -j $target
+				    $(dest_ip_range $srv) $dports $ratelimit $user $mrk -j $target
 			    fi
 			fi
 		    done
 		done
 	    else
 		if [ -n "$loglevel" -a -z "$natrule" ]; then
-		    log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user \
+		    log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user $mrk \
 			$state $(fix_bang $proto $sports $multiport $cli $dports)
 		fi
 
 		[ -n "$nonat" ] && \
 		    addnatrule $(dnat_chain $source) $proto $multiport \
-		    $cli $sports $dports $ratelimit $user -j RETURN
+		    $cli $sports $dports $ratelimit $user $mrk -j RETURN
 
 		    [ "$logtarget" != NONAT ] && \
 			run_iptables2 -A $chain $state $proto $multiport $cli $sports \
-			$dports $ratelimit $user -j $target
+			$dports $ratelimit $user $mrk -j $target
 	    fi
 	fi
     else
@@ -1924,37 +1926,37 @@
 	if [ -n "$addr" ]; then
 	    for adr in $(separate_list $addr); do
 		if [ -n "$loglevel" ]; then
-		    log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user \
+		    log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user $mrk \
 			$state $(fix_bang $proto $multiport $cli $dest_interface $sports $dports -m conntrack --ctorigdst $adr)
 		fi
 
 		if [ "$logtarget" != LOG ]; then
 		    if [ -n "$nonat" ]; then
 			addnatrule $(dnat_chain $source) $proto $multiport \
-			    $cli $sports $dports $ratelimit $user  -m conntrack --ctorigdst $adr -j RETURN
+			    $cli $sports $dports $ratelimit $user $mrk  -m conntrack --ctorigdst $adr -j RETURN
 		    fi
 
 		    if [ "$logtarget" != NONAT ]; then
 			run_iptables2 -A $chain $state $proto $multiport $cli $dest_interface \
-			    $sports $dports $ratelimit $user  -m conntrack --ctorigdst $adr -j $target
+			    $sports $dports $ratelimit $user $mrk  -m conntrack --ctorigdst $adr -j $target
 		    fi
 		fi
 	    done
 	else
 	    if [ -n "$loglevel" ]; then
-		log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user \
+		log_rule_limit $loglevel $chain $logchain $logtarget "$ratelimit" "$logtag" -A $user $mrk \
 		    $state $(fix_bang $proto $multiport $cli $dest_interface $sports $dports)
 	    fi
 
 	    if [ "$logtarget" != LOG ]; then
 		if [ -n "$nonat" ]; then
 		    addnatrule $(dnat_chain $source) $proto $multiport \
-			$cli $sports $dports $ratelimit $user -j RETURN
+			$cli $sports $dports $ratelimit $user $mrk -j RETURN
 		fi
 
 		if [ "$logtarget" != NONAT ]; then
 		    run_iptables2 -A $chain $state $proto $multiport $cli $dest_interface \
-			$sports $dports $ratelimit $user -j $target
+			$sports $dports $ratelimit $user $mrk -j $target
 		fi
 	    fi
 	fi
@@ -2036,6 +2038,21 @@
 }
 
 #
+# Process the MARK column contents
+#
+process_mark() {
+    [ "x$mark" = "x-" ] && mark=
+
+    if [ -n "$mark" ]; then
+        if [ "$mark" = "${mark%!*}" ]; then
+            mark="-m mark --mark $mark"
+        else
+            mark="-m mark ! --mark ${mark#*!}"
+        fi
+    fi
+}
+
+#
 # Combine a source/dest from the macro body with one from the macro invocation
 #
 merge_macro_source_dest() # $1 = source/dest from macro body, $2 = source/dest from invocation
@@ -2068,6 +2085,7 @@
                # $7 = address
                # $8 = ratelimit
                # $9 = userspec
+               # $10= mark
 {
     local target="$1"
     local clients="$2"
@@ -2078,12 +2096,15 @@
     local address="$7"
     local ratelimit="$8"
     local userspec="$9"
+    local mark="${10}"
     local userandgroup=
     local logtag=
     local nonat=
 
     # # # # # F u n c t i o n   B o d y # # # # #
 
+    process_mark
+
     process_ratelimit
 
     # Isolate log level
@@ -2422,6 +2443,7 @@
                # $7 = address
                # $8 = ratelimit
                # $9 = userspec
+               # $10= mark
 {
     local itarget="$1"
     local param="$2"
@@ -2433,6 +2455,7 @@
     local iaddress="$8"
     local iratelimit="$9"
     local iuserspec="${10}"
+    local imark="${11}"
 
     progress_message "..Expanding Macro $(find_file macro.${itarget%%:*})..."
 
@@ -2501,7 +2524,7 @@
 	[ -n "$iuserspec" ]  && [ "x${iuserspec}" != x- ]  && muserspec=$iuserspec
 
 	rule="$mtarget ${mclients=-} ${mservers:=-} ${mprotocol:=-} ${mports:=-} ${mcports:=-} ${xaddress:=-} ${mratelimit:=-} ${muserspec:=-}"
-	process_rule $mtarget $mclients $mservers $mprotocol $mports $mcports ${iaddress:=-} $mratelimit $muserspec
+	process_rule $mtarget $mclients $mservers $mprotocol $mports $mcports ${iaddress:=-} $mratelimit $muserspec $imark
 
     done < $TMP_DIR/macro.${itarget%%:*}
 
@@ -2540,10 +2563,10 @@
 			    fi
 			fi
 			if [ "$1" = Yes ]; then
-			    process_macro $xtarget "$xparam" $yclients $yservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec
+			    process_macro $xtarget "$xparam" $yclients $yservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark
 			else
-			    rule="$xtarget $yclients $yservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec"
-			    process_rule $xtarget $yclients $yservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec
+			    rule="$xtarget $yclients $yservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark"
+			    process_rule $xtarget $yclients $yservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark
 			fi
 		    fi
 		fi
@@ -2607,16 +2630,16 @@
 	esac
 
 	if [ "$1" = Yes ]; then
-	    process_macro $xtarget "$xparam" $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec
+	    process_macro $xtarget "$xparam" $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark
 	else
-	    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec"
-	    process_rule $xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec
+	    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark"
+	    process_rule $xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark
 	fi
     }
 
-    while read xtarget xclients xservers xprotocol xports xcports xaddress xratelimit xuserspec; do
+    while read xtarget xclients xservers xprotocol xports xcports xaddress xratelimit xuserspec xmark; do
 	if [ "x$xclients" = xnone -o "x$servers" = xnone ]; then
-	    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec"
+	    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark"
 	    progress_message "   Rule \"$rule\" ignored."
 	    continue
 	fi
@@ -2633,7 +2656,7 @@
 		;;
 	    COMMENT)
 		if [ -n "$COMMENTS" ]; then
-		    comment=$(echo $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec)
+		    comment=$(echo $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark)
 		    save_command COMMENT=\"$comment\"
 		else
 		    error_message "COMMENT ignored --  requires comment support in iptables/Netfilter"
@@ -2698,7 +2721,7 @@
 			    strip_file $f $fn
 			    do_it Yes
 			else
-			    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec"
+			    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark"
 			    fatal_error "Invalid Action in rule \"$rule\""
 			fi
 		    fi
--- lib.actions.orig	2007-04-26 11:17:39.000000000 +0200
+++ lib.actions	2007-04-26 11:54:06.000000000 +0200
@@ -245,6 +245,7 @@
                  # $8 = cports
                  # $9 = ratelimit
                  # $10 = userspec
+                 # $11 = mark
 {
     local chain="$1"
     local action="$2"
@@ -256,6 +257,7 @@
     local cports="$8"
     local ratelimit="$9"
     local userspec="${10}"
+    local mark="${11}"
     local userandgroup=
     local logtag=
 
@@ -322,6 +324,16 @@
 	[ "$userandgroup" = "-m owner" ] && userandgroup=
     fi
 
+    [ "x$mark" = "x-" ] && mark=
+
+    if [ -n "$mark" ]; then
+        if [ "$mark" = "${mark%!*}" ]; then
+            mark="-m mark --mark $mark"
+        else
+            mark="-m mark ! --mark ${mark#*!}"
+        fi
+    fi
+
     # Isolate log level
 
     if [ "$target" = "${target%:*}" ]; then
@@ -579,7 +591,7 @@
 		if [ -f $fn ]; then
 		    progress_message2 "   Pre-processing $fn..."
 		    strip_file $f $fn
-		    while read xtarget xclients xservers xprotocol xports xcports xratelimit $xuserspec; do
+		    while read xtarget xclients xservers xprotocol xports xcports xratelimit $xuserspec $xmark; do
 			temp="${xtarget%%:*}"
 			case "$temp" in
 			    ACCEPT|DROP|REJECT|LOG|QUEUE|CONTINUE)
@@ -600,7 +612,7 @@
 						ACCEPT|DROP|REJECT|LOG|QUEUE|CONTINUE)
 						    ;;
 						*)
-						    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec"
+						    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec $xmark"
 						    fatal_error "Invalid Macro Parameter in rule \"$rule\""
 						    ;;
 					    esac
@@ -633,7 +645,7 @@
 
 					    progress_message "   ..End Macro"
 					else
-					    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec"
+					    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec $xmark"
 					    fatal_error "Invalid TARGET in rule \"$rule\""
 					fi
 				    fi
@@ -715,7 +727,7 @@
 
     progress_message2 "$DOING $(find_file $f) for Chain $xchain..."
 
-    while read xtarget xclients xservers xprotocol xports xcports xratelimit xuserspec; do
+    while read xtarget xclients xservers xprotocol xports xcports xratelimit xuserspec xmark; do
 	#
 	# Generate the target:level:tag to pass to process_action()
 	#
@@ -734,7 +746,7 @@
 		;;
 	    COMMENT)
 		if [ -n "$COMMENTS" ]; then
-		    comment=$(echo $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec)
+		    comment=$(echo $xclients $xservers $xprotocol $xports $xcports $xaddress $xratelimit $xuserspec $xmark)
 		    save_command COMMENT=\"$comment\"
 		else
 		    error_message "COMMENT ignored --  requires comment support in iptables/Netfilter"
@@ -817,13 +829,13 @@
 		[ -n "$xratelimit" ] && [ "x${xratelimit}" != x- ] && mratelimit=$xratelimit
 		[ -n "$xuserspec" ]  && [ "x${xuserspec}" != x- ]  && muserspec=$xuserspec
 
-		rule="$mtarget ${mclients:=-} ${mservers:=-} ${mprotocol:=-} ${mports:=-} ${mcports:=-} ${mratelimit:-} ${muserspec:=-}"
-		process_action $xchain $xaction1 $mtarget $mclients $mservers $mprotocol $mports $mcports $mratelimit $muserspec
+		rule="$mtarget ${mclients:=-} ${mservers:=-} ${mprotocol:=-} ${mports:=-} ${mcports:=-} ${mratelimit:-} ${muserspec:=-} $xmark"
+		process_action $xchain $xaction1 $mtarget $mclients $mservers $mprotocol $mports $mcports $mratelimit $muserspec $xmark
 	    done < $TMP_DIR/macro.$xtarget1
 	    progress_message "..End Macro"
 	else
-	    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec"
-	    process_action $xchain $xaction1 $xaction2 $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec
+	    rule="$xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec $xmark"
+	    process_action $xchain $xaction1 $xaction2 $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec $xmark
 	fi
     done < $TMP_DIR/$f