Remove redundant logging of packets passing the tap chain.

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index e6791278ecc1fec1e8f4b6dda37b97d577a0ae30..abcc1e858ebb34d87f262e90a45f40d971c4f987 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2387,10 +2387,10 @@ sub generate_tap_rules_direction {
     # plug the tap chain to bridge chain
     if ($direction eq 'IN') {
        ruleset_addrule($ruleset, "PVEFW-FWBR-IN",
     # plug the tap chain to bridge chain
     if ($direction eq 'IN') {
        ruleset_addrule($ruleset, "PVEFW-FWBR-IN",

-                       "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain", $loglevel, 'FWBR-IN: ', $vmid);
+                       "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain");

     } else {
        ruleset_addrule($ruleset, "PVEFW-FWBR-OUT",
     } else {
        ruleset_addrule($ruleset, "PVEFW-FWBR-OUT",

-                       "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain", $loglevel, 'FWBR-OUT: ', $vmid);
+                       "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain");

     }
 }
 
     }
 }
 


@@ -3782,9 +3782,11 @@ sub compile_ebtables_filter {
                        push(@$arpfilter, $ip);
                    }
                }
                        push(@$arpfilter, $ip);
                    }
                }

-               if($net->{ip} && $vmfw_conf->{options}->{ipfilter}) {
-                   $net->{ip} =~ s|/(\d+)$||;
-                   push(@$arpfilter, $net->{ip});
+               if (my $ip = $net->{ip} && $vmfw_conf->{options}->{ipfilter}) {
+                   # ebtables changes this to a .0/MASK network but we just
+                   # want the address here, no network - see #2193
+                   $ip =~ s|/(\d+)$||;
+                   push @$arpfilter, $ip;

                }
                generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
            }
                }
                generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
            }