From 4b0f2a712b5792d2842d89fe68d4230e0eb05c7e Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 22 May 2019 22:06:16 +0200 Subject: src: support for arp sender and target ethernet and IPv4 addresses # nft add table arp x # nft add chain arp x y { type filter hook input priority 0\; } # nft add rule arp x y arp saddr ip 192.168.2.1 counter Testing this: # ip neigh flush dev eth0 # ping 8.8.8.8 # nft list ruleset table arp x { chain y { type filter hook input priority filter; policy accept; arp saddr ip 192.168.2.1 counter packets 1 bytes 46 } } You can also specify hardware sender address, eg. # nft add rule arp x y arp saddr ether aa:bb:cc:aa:bb:cc drop counter Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 9e632c0d..8c8cd432 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -4243,6 +4243,10 @@ arp_hdr_field : HTYPE { $$ = ARPHDR_HRD; } | HLEN { $$ = ARPHDR_HLN; } | PLEN { $$ = ARPHDR_PLN; } | OPERATION { $$ = ARPHDR_OP; } + | SADDR ETHER { $$ = ARPHDR_SADDR_ETHER; } + | DADDR ETHER { $$ = ARPHDR_DADDR_ETHER; } + | SADDR IP { $$ = ARPHDR_SADDR_IP; } + | DADDR IP { $$ = ARPHDR_DADDR_IP; } ; ip_hdr_expr : IP ip_hdr_field -- cgit v1.2.3