firewall: T9474: keep fragment matching working alongside packet marks

Fragments were detected by overwriting the whole packet mark with a fixed
value before reassembly. Any later mark - a raw "set mark" or a policy route
"set table" - replaced it, so "fragment match-frag" no longer matched, and
marks already present on fragments were lost.

Fragments now only get bit 31 of the mark, which no configurable firewall or
routing policy mark uses:
- fragment matching tests the bit, mark matching ignores it
- firewall and policy route mark writers keep it
- policy route and local-route ip rules mask it while fragments are routed
- it is cleared after the forward and input filters, so later consumers such
  as QoS or IPVS see the original mark

WAN load-balancing still overwrites the mark and keeps the previous
behaviour for fragments.

0 files changed, 0 insertions, 0 deletions