[PATCH pve-firewall 0/2] ebtables: fix ARP filter for alias and nomatch ipfilter entries

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Following this forum post [0], I looked into what might be generating
the 

    value does not look like a valid IP address or CIDR network

log lines, which show up once per affected guest on every update cycle.

When building the ARP filter from an ipfilter-netX ipset, entries were 
passed verbatim to parse_ip_or_cidr(), so an alias entry, or one the 
parser already flagged as invalid, makes it die. The error aborts the 
whole guest in compile_ebtables_filter(), so the guest ends up with no 
ebtables rules at all. 

Before bbd02dae ("firewall: log compilation errors in syslog"), the 
error went to warn(), which the daemon ignores, so the layer-2 filter
was missing silently.

Patch 1 resolves entries the same way generate_ipset_chains() does, 
skips entries the parser errored on, and logs errors per entry with 
more context to make debugging easier.

While looking into this, I also noticed that nomatch entries were added
to the ARP filter as allowed sources. Patch 2 emits DROP for them to 
honor nomatch.

[0] https://forum.proxmox.com/threads/pve-firewall-log-value-does-not-look-like-a-valid-ip-address-or-cidr-network.186990/#post-872700

Arthur Bied-Charreton (2):
  firewall: ebtables: resolve aliases in ipfilter ipsets
  firewall: ebtables: honor nomatch in ipfilter ipsets

 src/PVE/Firewall.pm                |  86 +++++++++++++-------
 src/test/Makefile                  |   2 +-
 src/test/test_ebtables_ipfilter.pl | 123 +++++++++++++++++++++++++++++
 3 files changed, 183 insertions(+), 28 deletions(-)
 create mode 100755 src/test/test_ebtables_ipfilter.pl

-- 
2.47.3