On 4/30/20 12:26 PM, Mira Limbeck wrote:
> When the IPFilter setting is enabled and the container has DHCP
> configured on an interface no 'arp-ip-src' filter should be added as we
> don't have an IP address.
> Previously '--arp-ip-src dhcp' was passed to ebtables which led to an error.
>
> Signed-off-by: Mira Limbeck <m.limb...@proxmox.com>
> ---
> v2:
> - changed regex to a simple string comparison
>
applied, thanks!
> src/PVE/Firewall.pm | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
> index d22b15a..250a642 100644
> --- a/src/PVE/Firewall.pm
> +++ b/src/PVE/Firewall.pm
> @@ -3904,7 +3904,9 @@ sub compile_ebtables_filter {
> # ebtables changes this to a .0/MASK network but we just
> # want the address here, no network - see #2193
> $ip =~ s|/(\d+)$||;
> - push @$arpfilter, $ip;
> + if ($ip ne 'dhcp') {
> + push @$arpfilter, $ip;
> + }
> }
> generate_tap_layer2filter($ruleset, $iface, $macaddr,
> $vmfw_conf, $vmid, $arpfilter);
> }
>
_______________________________________________
pve-devel mailing list
pve-devel@pve.proxmox.com
https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
