X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/11732033b49fdd106db47e677bcce8a1ca81460a..31c0a1076869a8595716b0ea2666f5cc8123379e:/functions.m4

diff --git a/functions.m4 b/functions.m4
index d7b42b2..3cd570d 100644
--- a/functions.m4
+++ b/functions.m4
@@ -130,7 +130,7 @@ errorchain () {
   clearchain $table:$chain
   run ip46tables -t $table -A $chain -j LOG \
 	  -m limit --limit 3/minute --limit-burst 10 \
-	  --log-prefix "fw: $chain " --log-level notice
+	  --log-prefix "fw: $chain " --log-level notice || :
   run ip46tables -t $table -A $chain -j "$@" \
 	  -m limit --limit 20/second --limit-burst 100
   run ip46tables -t $table -A $chain -j DROP
@@ -355,7 +355,7 @@ m4_divert(20)m4_dnl
 ###			`defnetclass'.
 ### net_inet_NET	List of IPv4 address ranges in the network.
 ### net_inet6_NET	List of IPv6 address ranges in the network.
-### net_fwd_NET		List of other networks that this one forwards to.
+### net_via_NET		List of other networks that this one forwards via.
 ### net_hosts_NET	List of hosts known to be in the network.
 ### host_inet_HOST	IPv4 address of the named HOST.
 ### host_inet6_HOST	IPv6 address of the named HOST.
@@ -427,9 +427,9 @@ defnetclass () {
 	from=$(( $from + $bit ))
       done
       to=$(( ($netclassindex << $BIT_TO) ))
-      tomask=$(( $MASK_MASK ^ (1 << ($netclassindex + $BIT_MASK)) ))
+      tomask=$(( $MASK_TO | $MASK_MASK ^ (1 << ($netclassindex + $BIT_MASK)) ))
       trace "from $name --> set $(printf %08x/%08x $from $frommask)"
-      trace "  to $name --> and $(printf %08x/%08x $to $tomask)"
+      trace "  to $name --> set $(printf %08x/%08x $to $tomask)"
 
       ## Now establish the mark-from-NAME and mark-to-NAME chains.
       clearchain mangle:mark-from-$name mangle:mark-to-$name
@@ -444,7 +444,7 @@ defnetclass () {
 
 ## defnet NET CLASS
 ##
-## Define a network.  Follow by calls to `addr', `forwards', etc. to define
+## Define a network.  Follow by calls to `addr', `via', etc. to define
 ## properties of the network.  Networks are processed in order, so if their
 ## addresses overlap then the more specific addresses should be defined
 ## earlier.
@@ -467,11 +467,11 @@ addr () {
   done
 }
 
-## forwards NET ...
+## via NET ...
 ##
 ## Declare that packets from this network are forwarded to the other NETs.
-forwards () {
-  eval "net_fwd_$net=\"$*\""
+via () {
+  eval "net_via_$net=\"$*\""
 }
 
 ## noxit NET ...
@@ -721,8 +721,8 @@ net_interfaces () {
     nextnets=""
     any=nil
     for net in $nets; do
-      eval fwd=\$net_fwd_$net
-      for n in $fwd; do
+      eval via=\$net_via_$net
+      for n in $via; do
 	case $seen in *":$n:"*) continue ;; esac
 	seen=$seen$n:
 	eval noxit=\$net_noxit_$n