[pve-devel] [PATCH firewall] fix #2686: don't add arp-ip-src filter for dhcp

[Mira Limbeck]

On 4/30/20 12:00 PM, Mira Limbeck wrote:
> When the IPFilter setting is enabled and the container has DHCP
> configured on an interface no 'arp-ip-src' filter should be added for
> this interface as we don't have an IP address.
>
> Previously '--arp-ip-src dhcp' was passed to ebtables which led to an error.
>
> Signed-off-by: Mira Limbeck <m.limbeck at proxmox.com>
> ---
>   src/PVE/Firewall.pm | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
> index d22b15a..19f1400 100644
> --- a/src/PVE/Firewall.pm
> +++ b/src/PVE/Firewall.pm
> @@ -3904,7 +3904,9 @@ sub compile_ebtables_filter {
>   		    # ebtables changes this to a .0/MASK network but we just
>   		    # want the address here, no network - see #2193
>   		    $ip =~ s|/(\d+)$||;
> -		    push @$arpfilter, $ip;
> +		    if ($ip !~ m/^dhcp$/) {
With the anchored regex we could simply change that to $ip ne 'dhcp', 
will send a v2.
> +			push @$arpfilter, $ip;
> +		    }
>   		}
>   		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
>   	    }