nftable field to field matching, to support garp filtering
Dion Bosschieter <[email protected]> Wed, 1 Apr 2026 10:18:46 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hi In order to support filtering on garp in the nftables driver of nwfilter for libvirt: https://lists.libvirt.org/archives/list/[email protected]/thread/4VYYUJE2MF6IBAO6R6YT2FA456LTKHC7/ I have tried to come up with a solution to support the equivalent of ebtables --arp-gratuitous: [!] --arp-gratuitous Checks for ARP gratuitous packets: checks equality of IPv4 source address and IPv4 destination address inside the ARP header. I havee not found an easy solution to field to field matching using nft For example: arp saddr ip == arp daddr ip In order to compare "arp saddr ip" against "arp daddr ip" I have now written the following solution: // create a concatenation set of identical IP pairs same-ip-set { 0.0.0.0 . 0.0.0.0, 1.0.0.0 . 1.0.0.0, ... In order to not list all possible ipv4 ips in the same-ip-set, we will mask with either 255.0.0.0 0.255.0.0 0.0.255.0 or 0.0.0.255 this ensures that we only have 1024 entries in that same-ip-set. This results in the following rule: arp saddr ip & 255.0.0.0 . arp daddr ip & 255.0.0.0 @same-ip-set arp saddr ip & 0.255.0.0 . arp daddr ip & 0.255.0.0 @same-ip-set arp saddr ip & 0.0.255.0 . arp daddr ip & 0.0.255.0 @same-ip-set arp saddr ip & 0.0.0.255 . arp daddr ip & 0.0.0.255 @same-ip-set accept This appears to correctly match GARP traffic. My questions are: - Is there an easier approach to this? - Are there plans to support packet data to packet data matching or otherwise specifically garp filtering? With regards, Dion