From: Alexandre Derumier <aderumier@odiso.com>
Date: Thu, 2 May 2019 05:04:16 +0000 (+0200)
Subject: fix #2193: arpfilter: CT: remove mask from net ip cidr.
X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=commitdiff_plain;h=556ae5c18f597f525a9d6c7e9b44e64978acd78c

fix #2193: arpfilter: CT: remove mask from net ip cidr.

We need to send to ebtables an host address without prefix or with
/32 prefix.

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 806fd4b..e679127 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -3782,7 +3782,10 @@ sub compile_ebtables_filter {
 			push(@$arpfilter, $ip);
 		    }
 		}
-		push(@$arpfilter, $net->{ip}) if $net->{ip} && $vmfw_conf->{options}->{ipfilter};
+		if($net->{ip} && $vmfw_conf->{options}->{ipfilter}) {
+		    $net->{ip} =~ s|/(\d+)$||;
+		    push(@$arpfilter, $net->{ip});
+		}
 		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
 	    }
 	};