Skip to content
Browse files

Add "pppoed" and "pppoes" keywords, for PPPoE Discovery and Session

packets (based on the Ethernet type).  "pppoes" has the side-effect that
subsequent filter expressions will test the PPP header and headers
in the PPP payload, not the link-layer header and headers in the
link-layer payload.
  • Loading branch information...
1 parent a8302b7 commit 7fb15ab84602112b0e06f41e74d40785921385be @yuguy yuguy committed Sep 5, 2005
Showing with 92 additions and 6 deletions.
  1. +7 −1 ethertype.h
  2. +74 −2 gencode.c
  3. +4 −1 gencode.h
  4. +4 −1 grammar.y
  5. +3 −1 scanner.l
View
8 ethertype.h
@@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
- * @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.13 2004-06-16 08:20:28 hannes Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.14 2005-09-05 09:06:58 guy Exp $ (LBL)
*/
/*
@@ -108,6 +108,12 @@
#ifndef ETHERTYPE_MPLS_MULTI
#define ETHERTYPE_MPLS_MULTI 0x8848
#endif
+#ifndef ETHERTYPE_PPPOED
+#define ETHERTYPE_PPPOED 0x8863
+#endif
+#ifndef ETHERTYPE_PPPOES
+#define ETHERTYPE_PPPOES 0x8864
+#endif
#ifndef ETHERTYPE_LOOPBACK
#define ETHERTYPE_LOOPBACK 0x9000
#endif
View
76 gencode.c
@@ -21,7 +21,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.259 2005-08-31 06:51:05 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.260 2005-09-05 09:06:59 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -100,7 +100,7 @@ static const char rcsid[] _U_ =
static jmp_buf top_ctx;
static pcap_t *bpf_pcap;
-/* Hack for updating VLAN, MPLS offsets. */
+/* Hack for updating VLAN, MPLS, and PPPoE offsets. */
static u_int orig_linktype = -1U, orig_nl = -1U, label_stack_depth = -1U;
/* XXX */
@@ -6391,6 +6391,78 @@ gen_mpls(label_num)
return (b0);
}
+/*
+ * Support PPPOE discovery and session.
+ */
+struct block *
+gen_pppoed()
+{
+ /* check for PPPoE discovery */
+ return gen_linktype((bpf_int32)ETHERTYPE_PPPOED);
+}
+
+struct block *
+gen_pppoes()
+{
+ struct block *b0;
+
+ /*
+ * Test against the PPPoE session link-layer type.
+ */
+ b0 = gen_linktype((bpf_int32)ETHERTYPE_PPPOES);
+
+ /*
+ * Change the offsets to point to the type and data fields within
+ * the PPP packet.
+ *
+ * XXX - this is a bit of a kludge. If we were to split the
+ * compiler into a parser that parses an expression and
+ * generates an expression tree, and a code generator that
+ * takes an expression tree (which could come from our
+ * parser or from some other parser) and generates BPF code,
+ * we could perhaps make the offsets parameters of routines
+ * and, in the handler for an "AND" node, pass to subnodes
+ * other than the PPPoE node the adjusted offsets.
+ *
+ * This would mean that "pppoes" would, instead of changing the
+ * behavior of *all* tests after it, change only the behavior
+ * of tests ANDed with it. That would change the documented
+ * semantics of "pppoes", which might break some expressions.
+ * However, it would mean that "(pppoes and ip) or ip" would check
+ * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
+ * checking only for VLAN-encapsulated IP, so that could still
+ * be considered worth doing; it wouldn't break expressions
+ * that are of the form "pppoes and ..." which I suspect are the
+ * most common expressions involving "pppoes". "pppoes or ..."
+ * doesn't necessarily do what the user would really want, now,
+ * as all the "or ..." tests would be done assuming PPPoE, even
+ * though the "or" could be viewed as meaning "or, if this isn't
+ * a PPPoE packet...".
+ */
+ orig_linktype = off_linktype; /* save original values */
+ orig_nl = off_nl;
+
+ /*
+ * The "network-layer" protocol is PPPoE, which has a 6-byte
+ * PPPoE header, followed by PPP payload, so we set the
+ * offsets to the network layer offset plus 6 bytes for
+ * the PPPoE header plus the values appropriate for PPP when
+ * encapsulated in Ethernet (which means there's no HDLC
+ * encapsulation).
+ */
+ off_linktype = orig_nl + 6;
+ off_nl = orig_nl + 6 + 2;
+ off_nl_nosnap = orig_nl + 6 + 2;
+
+ /*
+ * Set the link-layer type to PPP, as all subsequent tests will
+ * be on the encapsulated PPP header.
+ */
+ linktype = DLT_PPP;
+
+ return b0;
+}
+
struct block *
gen_atmfield_code(atmfield, jvalue, jtype, reverse)
int atmfield;
View
5 gencode.h
@@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
- * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.65 2005-06-20 21:27:09 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.66 2005-09-05 09:07:00 guy Exp $ (LBL)
*/
/*
@@ -289,6 +289,9 @@ struct block *gen_inbound(int);
struct block *gen_vlan(int);
struct block *gen_mpls(int);
+struct block *gen_pppoed(void);
+struct block *gen_pppoes(void);
+
struct block *gen_atmfield_code(int atmfield, bpf_int32 jvalue, bpf_u_int32 jtype, int reverse);
struct block *gen_atmtype_abbrev(int type);
struct block *gen_atmmulti_abbrev(int type);
View
5 grammar.y
@@ -22,7 +22,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.90 2005-06-20 21:27:09 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.91 2005-09-05 09:07:00 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -131,6 +131,7 @@ pcap_parse()
%token LEN
%token IPV6 ICMPV6 AH ESP
%token VLAN MPLS
+%token PPPOED PPPOES
%token ISO ESIS CLNP ISIS L1 L2 IIH LSP SNP CSNP PSNP
%token STP
%token IPX
@@ -333,6 +334,8 @@ other: pqual TK_BROADCAST { $$ = gen_broadcast($1); }
| VLAN { $$ = gen_vlan(-1); }
| MPLS pnum { $$ = gen_mpls($2); }
| MPLS { $$ = gen_mpls(-1); }
+ | PPPOED { $$ = gen_pppoed(); }
+ | PPPOES { $$ = gen_pppoes(); }
| pfvar { $$ = $1; }
;
View
4 scanner.l
@@ -22,7 +22,7 @@
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.102 2005-06-20 21:27:11 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.103 2005-09-05 09:07:01 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -263,6 +263,8 @@ outbound return OUTBOUND;
vlan return VLAN;
mpls return MPLS;
+pppoed return PPPOED;
+pppoes return PPPOES;
lane return LANE;
llc return LLC;

0 comments on commit 7fb15ab

Please sign in to comment.
Something went wrong with that request. Please try again.