In latest kernel versions has been fixed behavior of packet mark when mangling:
netfilter: use actual socket sk rather than skb sk when routing harder (Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")). It's change signature of ip_route_me_harder/ip6_route_me_harder, so firmware cannot be build due of errors in xtables-addons. With simple patches firmware can be build succesfully
--- a/extensions/xt_DELUDE.c
+++ b/extensions/xt_DELUDE.c
@@ -122,7 +122,11 @@
/* ip_route_me_harder expects skb->dst to be set */
skb_dst_set(nskb, dst_clone(skb_dst(oldskb)));
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 78)
+ if (ip_route_me_harder(net, nskb->sk, nskb, addr_type))
+#else
if (ip_route_me_harder(net, nskb, addr_type))
+#endif
goto free_nskb;
else
niph = ip_hdr(nskb);
--- a/extensions/xt_ECHO.c
+++ b/extensions/xt_ECHO.c
@@ -192,7 +192,11 @@
/* ip_route_me_harder expects the skb's dst to be set */
skb_dst_set(newskb, dst_clone(skb_dst(oldskb)));
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 78)
+ if (ip_route_me_harder(par_net(par), newskb->sk, newskb, RTN_UNSPEC) != 0)
+#else
if (ip_route_me_harder(par_net(par), newskb, RTN_UNSPEC) != 0)
+#endif
goto free_nskb;
newip->ttl = ip4_dst_hoplimit(skb_dst(newskb));
--- a/extensions/xt_TARPIT.c
+++ a/extensions/xt_TARPIT.c
@@ -265,7 +265,11 @@
#endif
addr_type = RTN_LOCAL;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 78)
+ if (ip_route_me_harder(net, nskb->sk, nskb, addr_type))
+#else
if (ip_route_me_harder(net, nskb, addr_type))
+#endif
goto free_nskb;
else
niph = ip_hdr(nskb);
@@ -399,7 +403,11 @@
IPPROTO_TCP,
csum_partial(tcph, sizeof(struct tcphdr), 0));
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 78)
+ if (ip6_route_me_harder(net, nskb->sk, nskb))
+#else
if (ip6_route_me_harder(net, nskb))
+#endif
goto free_nskb;
nskb->ip_summed = CHECKSUM_NONE;