handle "not"

node/Network.cpp

@@ -117,7 +117,7 @@ static _doZtFilterResult _doZtFilter(
 		// First check if this is an ACTION
 		if ((unsigned int)rt <= (unsigned int)ZT_NETWORK_RULE_ACTION__MAX_ID) {
 			if (thisSetMatches) {
-				fprintf(stderr, "%02u %02u thisSetMatches. inTagRule: %u\n\n", rn, rt, inTagRule);
+				fprintf(stderr, "%02u %02d thisSetMatches. inTagRule: %u\n\n", rn, rt, inTagRule);
 				switch(rt) {
 					case ZT_NETWORK_RULE_ACTION_PRIORITY:
 						qosBucket = (rules[rn].v.qosBucket >= 0 || rules[rn].v.qosBucket <= 8) ? rules[rn].v.qosBucket : 4; // 4 = default bucket (no priority)
@@ -467,21 +467,22 @@ static _doZtFilterResult _doZtFilter(
 						}
 					} else {
 						if ((inbound)&&(!superAccept)) {
-							thisRuleMatches = 0;
+							thisRuleMatches = (rules[rn].t >> 7) ^ 0;
+							fprintf(stderr, "%02u %02u inbound, no remote tag %u %u. match %u\n", rn, rt, localTag->id(), localTag->value(), thisRuleMatches);
 						} else {
 							// Outbound side is not strict since if we have to match both tags and
 							// we are sending a first packet to a recipient, we probably do not know
 							// about their tags yet. They will filter on inbound and we will filter
 							// once we get their tag. If we are a tee/redirect target we are also
 							// not strict since we likely do not have these tags.
-							fprintf(stderr, "%02u %02u outbound, no remote tag %u %u\n", rn, rt, localTag->id(), localTag->value());
 							inTagRule = 1;
-							thisRuleMatches = 1;
+							thisRuleMatches = (rules[rn].t >> 7) ^ 1;
+							fprintf(stderr, "%02u %02u outbound, no remote tag %u %u. match %u\n", rn, rt, localTag->id(), localTag->value(), thisRuleMatches);
 						}
 					}
 				} else {
 					fprintf(stderr, "%02u %u02 no local tag?\n", rn, rt);
-					thisRuleMatches = 0;
+					thisRuleMatches = (rules[rn].t >> 7) ^ 0;
 				}
 			}	break;
 			case ZT_NETWORK_RULE_MATCH_TAG_SENDER: