From fcb0e8c2275f108b595f37defbe3c6de5bfc849e Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@us.ibm.com>
Date: Mon, 23 May 2011 19:41:18 -0400
Subject: nwfilter: enable filtering of gratuitous ARP packets

This patch enables filtering of gratuitous ARP packets using the following XML:

<rule action='accept' direction='in' priority='425'>
<arp gratuitous='true'/>
</rule>
---
 examples/xml/nwfilter/no-arp-spoofing.xml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'examples')

diff --git a/examples/xml/nwfilter/no-arp-spoofing.xml b/examples/xml/nwfilter/no-arp-spoofing.xml
index c6c858dad..96c58c153 100644
--- a/examples/xml/nwfilter/no-arp-spoofing.xml
+++ b/examples/xml/nwfilter/no-arp-spoofing.xml
@@ -12,7 +12,11 @@
    <rule action='drop' direction='out' priority='400' >
        <arp match='no' arpsrcipaddr='$IP' />
    </rule>
-   <!-- drop if ipaddr or macaddr odes not belong to guest -->
+   <!-- allow gratuitous arp -->
+   <rule action='accept' direction='in' priority='425'>
+       <arp gratuitous='true'/>
+   </rule>
+   <!-- drop if ipaddr or macaddr does not belong to guest -->
    <rule action='drop' direction='in' priority='450' >
        <arp match='no' arpdstmacaddr='$MAC'/>
        <arp opcode='reply'/>
-- 
cgit v1.2.3-65-gdbad