ipsets: catch zero-prefix entries

This way the error is visible with pve-firewall compile
without breaking the rest.

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index ef74ca2fae597a882ea30e778c49cee8cfc5ff77..c7d90f82fde92a442c3255d4656d5775e6b5be67 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2773,6 +2773,10 @@ sub generic_fw_config_parser {
                $errors->{cidr} = $err;
            }
 
+           if ($cidr =~ m!/0+$!) {
+               $errors->{cidr} = "a zero prefix is not allowed in ipset entries\n";
+           }
+
            my $entry = { cidr => $cidr };
            $entry->{nomatch} = 1 if $nomatch;
            $entry->{comment} = $comment if $comment;