ess format \"%s\" (expected 3 periods)\n", tbuf);
			exit (1);

		}

	}

	free (tbuf);

	if (mask == NULL)
	{

		if (*p != '\0')
		{
			fprintf (stderr, "ipfirewall:  ip netmask not allowed here (%s)\n", (char *) addr);
			exit (1);
		}

	}
	else
	{

		if (*p == ':')
		{

			get_ipaddr (p + 1, mask, NULL, usage, kind);

		}
		else if (*p == '/')
		{

			int bits;
			char *end;

			p += 1;
			if (*p == '\0')
			{
				fprintf (stderr, "ipfirewall:  missing mask value (%s)\n", arg);
				exit (1);
			}
			else if (!isdigit (*p))
			{
				fprintf (stderr, "ipfirewall:  non-numeric mask value (%s)\n", arg);
				exit (1);
			}

			bits = strtol (p, &end, 10);
			if (*end != '\0')
			{
				fprintf (stderr, "ipfirewall:  junk after mask (%s)\n", arg);
				exit (1);
			}

			if (bits < 0 || bits > sizeof (u_long) * 8)
			{
				fprintf (stderr, "ipfirewall:  mask length value out of range (%s)\n", arg);
				exit (1);
			}

			if (bits == 0)
			{	/* left shifts of 32 aren't defined */
				mask->s_addr = 0;
			}
			else
			{
				((char *) mask)[0] = (-1 << (32 - bits)) >> 24;
				((char *) mask)[1] = (-1 << (32 - bits)) >> 16;
				((char *) mask)[2] = (-1 << (32 - bits)) >> 8;
				((char *) mask)[3] = (-1 << (32 - bits)) >> 0;
			}

		}
		else if (*p == '\0')
		{
			mask->s_addr = 0xffffffff;
		}
		else
		{

			fprintf (stderr, "ipfirewall:  junk after ip address (%s)\n", arg);
			exit (1);

		}

		/*
	 * Mask off any bits in the address that are zero in the mask.
	 * Th