Allow filtering ARP packets in fw rule.

[luqmana]

I know the external IP hack is on the way out but in the meantime you need to add a firewall rule to allow incoming ARP packets past the firewall layer.

It's currently possible to do this via adding an overly permissive rule:

$ opteadm add-fw-rule -p vm_test0 --action allow --dir in --hosts any --ports any --priority 65534 --protocol any
$ opteadm dump-layer -p vm_test0 firewall
[...snip...]
Inbound Rules
----------------------------------------------------------------------
ID     PRI    HITS   PREDICATES                             ACTION            
0      65534  0      *                                      "Stateful Allow"

With this PR you can make that a bit more fine grained:

$ opteadm add-fw-rule -p vm_test0 --action allow --dir in --hosts any --ports any --priority 65534 --protocol arp
$ opteadm dump-layer -p vm_test0 firewall
[...snip...]
Inbound Rules
----------------------------------------------------------------------
ID     PRI    HITS   PREDICATES                             ACTION            
0      65534  0      inner.ether.ether_type=ARP             "Stateful Allow"

[rcgoodfellow]

Should this be

ProtoFilter::Proto(Protocol::ARP)

to be consistent with the others?

[luqmana]

Considered it but if anything maybe that variant should just be called ProtoFilter::IpProto since into_predicate just converts it as-is:

ProtoFilter::Proto(p) => Predicate::InnerIpProto(vec![IpProtoMatch::Exact(p)])

which wouldn't work for ARP.

[rcgoodfellow]

Ahh I see. Yeah seems like ProtoFilter::IpProto would be better there.

[rcgoodfellow]

LGTM!