Add "pppoed" and "pppoes" keywords, for PPPoE Discovery and Session
packets (based on the Ethernet type). "pppoes" has the side-effect that subsequent filter expressions will test the PPP header and headers in the PPP payload, not the link-layer header and headers in the link-layer payload.
This commit is contained in:
parent
a8302b7a2b
commit
7fb15ab846
|
@ -18,7 +18,7 @@
|
|||
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.13 2004-06-16 08:20:28 hannes Exp $ (LBL)
|
||||
* @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.14 2005-09-05 09:06:58 guy Exp $ (LBL)
|
||||
*/
|
||||
|
||||
/*
|
||||
|
@ -108,6 +108,12 @@
|
|||
#ifndef ETHERTYPE_MPLS_MULTI
|
||||
#define ETHERTYPE_MPLS_MULTI 0x8848
|
||||
#endif
|
||||
#ifndef ETHERTYPE_PPPOED
|
||||
#define ETHERTYPE_PPPOED 0x8863
|
||||
#endif
|
||||
#ifndef ETHERTYPE_PPPOES
|
||||
#define ETHERTYPE_PPPOES 0x8864
|
||||
#endif
|
||||
#ifndef ETHERTYPE_LOOPBACK
|
||||
#define ETHERTYPE_LOOPBACK 0x9000
|
||||
#endif
|
||||
|
|
76
gencode.c
76
gencode.c
|
@ -21,7 +21,7 @@
|
|||
*/
|
||||
#ifndef lint
|
||||
static const char rcsid[] _U_ =
|
||||
"@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.259 2005-08-31 06:51:05 guy Exp $ (LBL)";
|
||||
"@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.260 2005-09-05 09:06:59 guy Exp $ (LBL)";
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_CONFIG_H
|
||||
|
@ -100,7 +100,7 @@ static const char rcsid[] _U_ =
|
|||
static jmp_buf top_ctx;
|
||||
static pcap_t *bpf_pcap;
|
||||
|
||||
/* Hack for updating VLAN, MPLS offsets. */
|
||||
/* Hack for updating VLAN, MPLS, and PPPoE offsets. */
|
||||
static u_int orig_linktype = -1U, orig_nl = -1U, label_stack_depth = -1U;
|
||||
|
||||
/* XXX */
|
||||
|
@ -6391,6 +6391,78 @@ gen_mpls(label_num)
|
|||
return (b0);
|
||||
}
|
||||
|
||||
/*
|
||||
* Support PPPOE discovery and session.
|
||||
*/
|
||||
struct block *
|
||||
gen_pppoed()
|
||||
{
|
||||
/* check for PPPoE discovery */
|
||||
return gen_linktype((bpf_int32)ETHERTYPE_PPPOED);
|
||||
}
|
||||
|
||||
struct block *
|
||||
gen_pppoes()
|
||||
{
|
||||
struct block *b0;
|
||||
|
||||
/*
|
||||
* Test against the PPPoE session link-layer type.
|
||||
*/
|
||||
b0 = gen_linktype((bpf_int32)ETHERTYPE_PPPOES);
|
||||
|
||||
/*
|
||||
* Change the offsets to point to the type and data fields within
|
||||
* the PPP packet.
|
||||
*
|
||||
* XXX - this is a bit of a kludge. If we were to split the
|
||||
* compiler into a parser that parses an expression and
|
||||
* generates an expression tree, and a code generator that
|
||||
* takes an expression tree (which could come from our
|
||||
* parser or from some other parser) and generates BPF code,
|
||||
* we could perhaps make the offsets parameters of routines
|
||||
* and, in the handler for an "AND" node, pass to subnodes
|
||||
* other than the PPPoE node the adjusted offsets.
|
||||
*
|
||||
* This would mean that "pppoes" would, instead of changing the
|
||||
* behavior of *all* tests after it, change only the behavior
|
||||
* of tests ANDed with it. That would change the documented
|
||||
* semantics of "pppoes", which might break some expressions.
|
||||
* However, it would mean that "(pppoes and ip) or ip" would check
|
||||
* both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
|
||||
* checking only for VLAN-encapsulated IP, so that could still
|
||||
* be considered worth doing; it wouldn't break expressions
|
||||
* that are of the form "pppoes and ..." which I suspect are the
|
||||
* most common expressions involving "pppoes". "pppoes or ..."
|
||||
* doesn't necessarily do what the user would really want, now,
|
||||
* as all the "or ..." tests would be done assuming PPPoE, even
|
||||
* though the "or" could be viewed as meaning "or, if this isn't
|
||||
* a PPPoE packet...".
|
||||
*/
|
||||
orig_linktype = off_linktype; /* save original values */
|
||||
orig_nl = off_nl;
|
||||
|
||||
/*
|
||||
* The "network-layer" protocol is PPPoE, which has a 6-byte
|
||||
* PPPoE header, followed by PPP payload, so we set the
|
||||
* offsets to the network layer offset plus 6 bytes for
|
||||
* the PPPoE header plus the values appropriate for PPP when
|
||||
* encapsulated in Ethernet (which means there's no HDLC
|
||||
* encapsulation).
|
||||
*/
|
||||
off_linktype = orig_nl + 6;
|
||||
off_nl = orig_nl + 6 + 2;
|
||||
off_nl_nosnap = orig_nl + 6 + 2;
|
||||
|
||||
/*
|
||||
* Set the link-layer type to PPP, as all subsequent tests will
|
||||
* be on the encapsulated PPP header.
|
||||
*/
|
||||
linktype = DLT_PPP;
|
||||
|
||||
return b0;
|
||||
}
|
||||
|
||||
struct block *
|
||||
gen_atmfield_code(atmfield, jvalue, jtype, reverse)
|
||||
int atmfield;
|
||||
|
|
|
@ -18,7 +18,7 @@
|
|||
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.65 2005-06-20 21:27:09 guy Exp $ (LBL)
|
||||
* @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.66 2005-09-05 09:07:00 guy Exp $ (LBL)
|
||||
*/
|
||||
|
||||
/*
|
||||
|
@ -289,6 +289,9 @@ struct block *gen_inbound(int);
|
|||
struct block *gen_vlan(int);
|
||||
struct block *gen_mpls(int);
|
||||
|
||||
struct block *gen_pppoed(void);
|
||||
struct block *gen_pppoes(void);
|
||||
|
||||
struct block *gen_atmfield_code(int atmfield, bpf_int32 jvalue, bpf_u_int32 jtype, int reverse);
|
||||
struct block *gen_atmtype_abbrev(int type);
|
||||
struct block *gen_atmmulti_abbrev(int type);
|
||||
|
|
|
@ -22,7 +22,7 @@
|
|||
*/
|
||||
#ifndef lint
|
||||
static const char rcsid[] _U_ =
|
||||
"@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.90 2005-06-20 21:27:09 guy Exp $ (LBL)";
|
||||
"@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.91 2005-09-05 09:07:00 guy Exp $ (LBL)";
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_CONFIG_H
|
||||
|
@ -131,6 +131,7 @@ pcap_parse()
|
|||
%token LEN
|
||||
%token IPV6 ICMPV6 AH ESP
|
||||
%token VLAN MPLS
|
||||
%token PPPOED PPPOES
|
||||
%token ISO ESIS CLNP ISIS L1 L2 IIH LSP SNP CSNP PSNP
|
||||
%token STP
|
||||
%token IPX
|
||||
|
@ -333,6 +334,8 @@ other: pqual TK_BROADCAST { $$ = gen_broadcast($1); }
|
|||
| VLAN { $$ = gen_vlan(-1); }
|
||||
| MPLS pnum { $$ = gen_mpls($2); }
|
||||
| MPLS { $$ = gen_mpls(-1); }
|
||||
| PPPOED { $$ = gen_pppoed(); }
|
||||
| PPPOES { $$ = gen_pppoes(); }
|
||||
| pfvar { $$ = $1; }
|
||||
;
|
||||
|
||||
|
|
|
@ -22,7 +22,7 @@
|
|||
|
||||
#ifndef lint
|
||||
static const char rcsid[] _U_ =
|
||||
"@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.102 2005-06-20 21:27:11 guy Exp $ (LBL)";
|
||||
"@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.103 2005-09-05 09:07:01 guy Exp $ (LBL)";
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_CONFIG_H
|
||||
|
@ -263,6 +263,8 @@ outbound return OUTBOUND;
|
|||
|
||||
vlan return VLAN;
|
||||
mpls return MPLS;
|
||||
pppoed return PPPOED;
|
||||
pppoes return PPPOES;
|
||||
|
||||
lane return LANE;
|
||||
llc return LLC;
|
||||
|
|
Reference in New Issue