fix support for /32 entries in the invert subnet protection option