ipset: only save ip/network once

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 74bd8d962eaad4868b0bcaaa9449c568e58a1f63..5168093d9fca75ff0cd42d9d46865ff984449fa7 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2143,7 +2143,13 @@ my $format_ipset = sub {
 
     my $raw = '';
 
+    my $nethash = {};
     foreach my $entry (@$options) {
+       $nethash->{$entry->{cidr}} = $entry;
+    }
+
+    foreach my $cidr (sort keys %$nethash) {
+       my $entry = $nethash->{$cidr};
        my $line = $entry->{nomatch} ? '!' : '';
        $line .= $entry->{cidr};
        $line .= " # " . encode('utf8', $entry->{comment})