support negation in mark/connmark

support negation in mark/connmark

The following works OK in iptables

  iptables -t mangle -A PREROUTING -m connmark \! --mark 0 \
    -j CONNMARK --restore-mark

but the corresponding ferm snippet doesn't:

  table mangle chain PREROUTING mod connmark
      !mark 0 CONNMARK restore-mark;

trying to feed that into ferm gives:

 $ sudo /usr/sbin/ferm --lines --noexec test.ferm
 Error in test.ferm line 1:
 table mangle chain PREROUTING mod connmark ! mark 0 <--
 Doesn't support negation: mark

Applying the following trivial patch to connmark definition allows
negation of the mark parameter.