nft-arp: adds nft_arp_save_firewall

Adds nft_arp_save_firewall to arp family. (Avoids the segfault in
xtables-events)

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables-events: prints arp rules

This patch permits to print arp rules, avoiding the segfault that
you got currently.

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft-arp: fix is_same_interfaces arguments

Wrong arguments are passed to is_same_interfaces
that causes sometimes to delete a wrong rule.
See the example below:

arptables-compat -A INPUT -i eth0 -j ACCEPT
arptables-compat -A INPUT -i eth1 -j ACCEPT
arptables-compat -A INPUT -i eth2 -j ACCEPT

arptables-compat -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
-j ACCEPT -i eth0
-j ACCEPT -i eth1
-j ACCEPT -i eth2

arptables-compat -D INPUT -i eth2 -j ACCEPT

arptables-compat -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
-j ACCEPT -i eth1
-j ACCEPT -i eth2

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft-arp: wrong condition in parse_payload

the current condition doesn't permit to parse ip addresses
when they should be. Obviously they are not printed.

arptables-compat -A INPUT -s 1.1.1.1 -i eth0 -j ACCEPT
arptables-compat -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
-j ACCEPT -i eth0

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>