X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/11732033b49fdd106db47e677bcce8a1ca81460a..45da078e5fc0936d3405377f8a978544913f9b05:/functions.m4

diff --git a/functions.m4 b/functions.m4
index d7b42b2..1cd0db5 100644
--- a/functions.m4
+++ b/functions.m4
@@ -109,11 +109,19 @@ clearchain () {
 makeset () {
   set -e
   name=$1; shift
-  if ipset -nL | grep -q "^Name: $name$"; then
-    :
-  else
-    ipset -N "$name" "$@"
-  fi
+  v=$(ipset --version)
+  createp=t
+  case "$v" in
+    "ipset v4"*)
+      if ipset -nL | grep -q "^Name: $name\$"; then createp=nil; fi
+      ;;
+    *)
+      if ipset -n -L | grep -q "^$name\$"; then createp=nil; fi
+      ;;
+  esac
+  case $createp in
+    t) ipset -N "$name" "$@" ;;
+  esac
 }
 
 ## errorchain CHAIN ACTION ARGS ...
@@ -130,7 +138,7 @@ errorchain () {
   clearchain $table:$chain
   run ip46tables -t $table -A $chain -j LOG \
 	  -m limit --limit 3/minute --limit-burst 10 \
-	  --log-prefix "fw: $chain " --log-level notice
+	  --log-prefix "fw: $chain " --log-level notice || :
   run ip46tables -t $table -A $chain -j "$@" \
 	  -m limit --limit 20/second --limit-burst 100
   run ip46tables -t $table -A $chain -j DROP
@@ -355,7 +363,7 @@ m4_divert(20)m4_dnl
 ###			`defnetclass'.
 ### net_inet_NET	List of IPv4 address ranges in the network.
 ### net_inet6_NET	List of IPv6 address ranges in the network.
-### net_fwd_NET		List of other networks that this one forwards to.
+### net_via_NET		List of other networks that this one forwards via.
 ### net_hosts_NET	List of hosts known to be in the network.
 ### host_inet_HOST	IPv4 address of the named HOST.
 ### host_inet6_HOST	IPv6 address of the named HOST.
@@ -427,9 +435,9 @@ defnetclass () {
 	from=$(( $from + $bit ))
       done
       to=$(( ($netclassindex << $BIT_TO) ))
-      tomask=$(( $MASK_MASK ^ (1 << ($netclassindex + $BIT_MASK)) ))
+      tomask=$(( $MASK_TO | $MASK_MASK ^ (1 << ($netclassindex + $BIT_MASK)) ))
       trace "from $name --> set $(printf %08x/%08x $from $frommask)"
-      trace "  to $name --> and $(printf %08x/%08x $to $tomask)"
+      trace "  to $name --> set $(printf %08x/%08x $to $tomask)"
 
       ## Now establish the mark-from-NAME and mark-to-NAME chains.
       clearchain mangle:mark-from-$name mangle:mark-to-$name
@@ -444,7 +452,7 @@ defnetclass () {
 
 ## defnet NET CLASS
 ##
-## Define a network.  Follow by calls to `addr', `forwards', etc. to define
+## Define a network.  Follow by calls to `addr', `via', etc. to define
 ## properties of the network.  Networks are processed in order, so if their
 ## addresses overlap then the more specific addresses should be defined
 ## earlier.
@@ -467,11 +475,11 @@ addr () {
   done
 }
 
-## forwards NET ...
+## via NET ...
 ##
 ## Declare that packets from this network are forwarded to the other NETs.
-forwards () {
-  eval "net_fwd_$net=\"$*\""
+via () {
+  eval "net_via_$net=\"$*\""
 }
 
 ## noxit NET ...
@@ -721,8 +729,8 @@ net_interfaces () {
     nextnets=""
     any=nil
     for net in $nets; do
-      eval fwd=\$net_fwd_$net
-      for n in $fwd; do
+      eval via=\$net_via_$net
+      for n in $via; do
 	case $seen in *":$n:"*) continue ;; esac
 	seen=$seen$n:
 	eval noxit=\$net_noxit_$n