nftable field to field matching, to support garp filtering

nftable field to field matching, to support garp filtering

[Dion Bosschieter]

Hi

In order to support filtering on garp in the nftables driver of nwfilter 
for libvirt:

https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/4VYYUJE2MF6IBAO6R6YT2FA456LTKHC7/

I have tried to come up with a solution to support the equivalent of 
ebtables --arp-gratuitous:

   [!] --arp-gratuitous
          Checks for ARP gratuitous packets: checks equality of IPv4
          source address and IPv4 destination address inside the ARP
          header.

I havee not found an easy solution to field to field matching using nft
For example: arp saddr ip == arp daddr ip

In order to compare "arp saddr ip" against "arp daddr ip" I have now 
written the following solution:

// create a concatenation set of identical IP pairs

same-ip-set { 0.0.0.0 . 0.0.0.0, 1.0.0.0 . 1.0.0.0, ...

In order to not list all possible ipv4 ips in the same-ip-set, we will 
mask with either 255.0.0.0 0.255.0.0 0.0.255.0 or 0.0.0.255
this ensures that we only have 1024 entries in that same-ip-set.

This results in the following rule:
arp saddr ip & 255.0.0.0 . arp daddr ip & 255.0.0.0 @same-ip-set
arp saddr ip & 0.255.0.0 . arp daddr ip & 0.255.0.0 @same-ip-set
arp saddr ip & 0.0.255.0 . arp daddr ip & 0.0.255.0 @same-ip-set
arp saddr ip & 0.0.0.255 . arp daddr ip & 0.0.0.255 @same-ip-set
accept

This appears to correctly match GARP traffic.

My questions are:
- Is there an easier approach to this?
- Are there plans to support packet data to packet data matching or 
otherwise specifically garp filtering?

With regards,

Dion