dect
/
libpcap
Archived
13
0
Fork 0

Add "pppoed" and "pppoes" keywords, for PPPoE Discovery and Session

packets (based on the Ethernet type).  "pppoes" has the side-effect that
subsequent filter expressions will test the PPP header and headers
in the PPP payload, not the link-layer header and headers in the
link-layer payload.
This commit is contained in:
guy 2005-09-05 09:06:58 +00:00
parent a8302b7a2b
commit 7fb15ab846
5 changed files with 92 additions and 6 deletions

View File

@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
* @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.13 2004-06-16 08:20:28 hannes Exp $ (LBL)
* @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.14 2005-09-05 09:06:58 guy Exp $ (LBL)
*/
/*
@ -108,6 +108,12 @@
#ifndef ETHERTYPE_MPLS_MULTI
#define ETHERTYPE_MPLS_MULTI 0x8848
#endif
#ifndef ETHERTYPE_PPPOED
#define ETHERTYPE_PPPOED 0x8863
#endif
#ifndef ETHERTYPE_PPPOES
#define ETHERTYPE_PPPOES 0x8864
#endif
#ifndef ETHERTYPE_LOOPBACK
#define ETHERTYPE_LOOPBACK 0x9000
#endif

View File

@ -21,7 +21,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
"@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.259 2005-08-31 06:51:05 guy Exp $ (LBL)";
"@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.260 2005-09-05 09:06:59 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@ -100,7 +100,7 @@ static const char rcsid[] _U_ =
static jmp_buf top_ctx;
static pcap_t *bpf_pcap;
/* Hack for updating VLAN, MPLS offsets. */
/* Hack for updating VLAN, MPLS, and PPPoE offsets. */
static u_int orig_linktype = -1U, orig_nl = -1U, label_stack_depth = -1U;
/* XXX */
@ -6391,6 +6391,78 @@ gen_mpls(label_num)
return (b0);
}
/*
* Support PPPOE discovery and session.
*/
struct block *
gen_pppoed()
{
/* check for PPPoE discovery */
return gen_linktype((bpf_int32)ETHERTYPE_PPPOED);
}
struct block *
gen_pppoes()
{
struct block *b0;
/*
* Test against the PPPoE session link-layer type.
*/
b0 = gen_linktype((bpf_int32)ETHERTYPE_PPPOES);
/*
* Change the offsets to point to the type and data fields within
* the PPP packet.
*
* XXX - this is a bit of a kludge. If we were to split the
* compiler into a parser that parses an expression and
* generates an expression tree, and a code generator that
* takes an expression tree (which could come from our
* parser or from some other parser) and generates BPF code,
* we could perhaps make the offsets parameters of routines
* and, in the handler for an "AND" node, pass to subnodes
* other than the PPPoE node the adjusted offsets.
*
* This would mean that "pppoes" would, instead of changing the
* behavior of *all* tests after it, change only the behavior
* of tests ANDed with it. That would change the documented
* semantics of "pppoes", which might break some expressions.
* However, it would mean that "(pppoes and ip) or ip" would check
* both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
* checking only for VLAN-encapsulated IP, so that could still
* be considered worth doing; it wouldn't break expressions
* that are of the form "pppoes and ..." which I suspect are the
* most common expressions involving "pppoes". "pppoes or ..."
* doesn't necessarily do what the user would really want, now,
* as all the "or ..." tests would be done assuming PPPoE, even
* though the "or" could be viewed as meaning "or, if this isn't
* a PPPoE packet...".
*/
orig_linktype = off_linktype; /* save original values */
orig_nl = off_nl;
/*
* The "network-layer" protocol is PPPoE, which has a 6-byte
* PPPoE header, followed by PPP payload, so we set the
* offsets to the network layer offset plus 6 bytes for
* the PPPoE header plus the values appropriate for PPP when
* encapsulated in Ethernet (which means there's no HDLC
* encapsulation).
*/
off_linktype = orig_nl + 6;
off_nl = orig_nl + 6 + 2;
off_nl_nosnap = orig_nl + 6 + 2;
/*
* Set the link-layer type to PPP, as all subsequent tests will
* be on the encapsulated PPP header.
*/
linktype = DLT_PPP;
return b0;
}
struct block *
gen_atmfield_code(atmfield, jvalue, jtype, reverse)
int atmfield;

View File

@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
* @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.65 2005-06-20 21:27:09 guy Exp $ (LBL)
* @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.66 2005-09-05 09:07:00 guy Exp $ (LBL)
*/
/*
@ -289,6 +289,9 @@ struct block *gen_inbound(int);
struct block *gen_vlan(int);
struct block *gen_mpls(int);
struct block *gen_pppoed(void);
struct block *gen_pppoes(void);
struct block *gen_atmfield_code(int atmfield, bpf_int32 jvalue, bpf_u_int32 jtype, int reverse);
struct block *gen_atmtype_abbrev(int type);
struct block *gen_atmmulti_abbrev(int type);

View File

@ -22,7 +22,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
"@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.90 2005-06-20 21:27:09 guy Exp $ (LBL)";
"@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.91 2005-09-05 09:07:00 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@ -131,6 +131,7 @@ pcap_parse()
%token LEN
%token IPV6 ICMPV6 AH ESP
%token VLAN MPLS
%token PPPOED PPPOES
%token ISO ESIS CLNP ISIS L1 L2 IIH LSP SNP CSNP PSNP
%token STP
%token IPX
@ -333,6 +334,8 @@ other: pqual TK_BROADCAST { $$ = gen_broadcast($1); }
| VLAN { $$ = gen_vlan(-1); }
| MPLS pnum { $$ = gen_mpls($2); }
| MPLS { $$ = gen_mpls(-1); }
| PPPOED { $$ = gen_pppoed(); }
| PPPOES { $$ = gen_pppoes(); }
| pfvar { $$ = $1; }
;

View File

@ -22,7 +22,7 @@
#ifndef lint
static const char rcsid[] _U_ =
"@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.102 2005-06-20 21:27:11 guy Exp $ (LBL)";
"@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.103 2005-09-05 09:07:01 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@ -263,6 +263,8 @@ outbound return OUTBOUND;
vlan return VLAN;
mpls return MPLS;
pppoed return PPPOED;
pppoes return PPPOES;
lane return LANE;
llc return LLC;