Issue with CIDR subnets and ipset_sync

[rudybroersma]

We are seeing an issue when supplying CIDR subnets to an IPSet in puppet, e.g. we have a hash:

$iplist = [ "192.168.100.20", "10.0.0.0/24", "172.168.1.2" ]

When the agent runs, it runs ipset_sync to compare the list in the kernel with the defined list in puppet. This returns exit code 8, as the list does not match. "ipset save" shows 254 entries for 10.0.0.1-254, while the generated output simply lists the /24.

Please see the attached example:
out.txt

Due to the mismatch in output, the Exec[sync_ipset_*] is ran on every puppet agent execution.