[pve-devel] [PATCH pve-firewall] arpfilter: CT: remove mask from net ip cidr.

[Alexandre Derumier]

We need to send to ebtables an host address without prefix or with /32 prefix.

Signed-off-by: Alexandre Derumier <aderumier at odiso.com>
---
 src/PVE/Firewall.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 806fd4b..e679127 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -3782,7 +3782,10 @@ sub compile_ebtables_filter {
 			push(@$arpfilter, $ip);
 		    }
 		}
-		push(@$arpfilter, $net->{ip}) if $net->{ip} && $vmfw_conf->{options}->{ipfilter};
+		if($net->{ip} && $vmfw_conf->{options}->{ipfilter}) {
+		    $net->{ip} =~ s|/(\d+)$||;
+		    push(@$arpfilter, $net->{ip});
+		}
 		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
 	    }
 	};
-- 
2.11.0