aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorguy <guy>2005-09-05 09:08:03 +0000
committerguy <guy>2005-09-05 09:08:03 +0000
commit279d705cd167d7ddebe9dc228b08486580665801 (patch)
tree6a7e72497c64711810a979de7ac53a4760e28f59
parent097cc1dd50473855902f390863c427ddd686129f (diff)
Add "pppoed" and "pppoes" keywords, for PPPoE Discovery and Session
packets (based on the Ethernet type). "pppoes" has the side-effect that subsequent filter expressions will test the PPP header and headers in the PPP payload, not the link-layer header and headers in the link-layer payload.
-rw-r--r--ethertype.h8
-rw-r--r--gencode.c76
-rw-r--r--gencode.h5
-rw-r--r--grammar.y5
-rw-r--r--scanner.l4
5 files changed, 92 insertions, 6 deletions
diff --git a/ethertype.h b/ethertype.h
index 9344e2c..c733993 100644
--- a/ethertype.h
+++ b/ethertype.h
@@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
- * @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.13 2004-06-16 08:20:28 hannes Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.13.2.1 2005-09-05 09:08:03 guy Exp $ (LBL)
*/
/*
@@ -108,6 +108,12 @@
#ifndef ETHERTYPE_MPLS_MULTI
#define ETHERTYPE_MPLS_MULTI 0x8848
#endif
+#ifndef ETHERTYPE_PPPOED
+#define ETHERTYPE_PPPOED 0x8863
+#endif
+#ifndef ETHERTYPE_PPPOES
+#define ETHERTYPE_PPPOES 0x8864
+#endif
#ifndef ETHERTYPE_LOOPBACK
#define ETHERTYPE_LOOPBACK 0x9000
#endif
diff --git a/gencode.c b/gencode.c
index f7a8aa4..f2ec8d3 100644
--- a/gencode.c
+++ b/gencode.c
@@ -21,7 +21,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.33 2005-08-31 06:50:02 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.34 2005-09-05 09:08:04 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -100,7 +100,7 @@ static const char rcsid[] _U_ =
static jmp_buf top_ctx;
static pcap_t *bpf_pcap;
-/* Hack for updating VLAN, MPLS offsets. */
+/* Hack for updating VLAN, MPLS, and PPPoE offsets. */
static u_int orig_linktype = -1U, orig_nl = -1U, label_stack_depth = -1U;
/* XXX */
@@ -6391,6 +6391,78 @@ gen_mpls(label_num)
return (b0);
}
+/*
+ * Support PPPOE discovery and session.
+ */
+struct block *
+gen_pppoed()
+{
+ /* check for PPPoE discovery */
+ return gen_linktype((bpf_int32)ETHERTYPE_PPPOED);
+}
+
+struct block *
+gen_pppoes()
+{
+ struct block *b0;
+
+ /*
+ * Test against the PPPoE session link-layer type.
+ */
+ b0 = gen_linktype((bpf_int32)ETHERTYPE_PPPOES);
+
+ /*
+ * Change the offsets to point to the type and data fields within
+ * the PPP packet.
+ *
+ * XXX - this is a bit of a kludge. If we were to split the
+ * compiler into a parser that parses an expression and
+ * generates an expression tree, and a code generator that
+ * takes an expression tree (which could come from our
+ * parser or from some other parser) and generates BPF code,
+ * we could perhaps make the offsets parameters of routines
+ * and, in the handler for an "AND" node, pass to subnodes
+ * other than the PPPoE node the adjusted offsets.
+ *
+ * This would mean that "pppoes" would, instead of changing the
+ * behavior of *all* tests after it, change only the behavior
+ * of tests ANDed with it. That would change the documented
+ * semantics of "pppoes", which might break some expressions.
+ * However, it would mean that "(pppoes and ip) or ip" would check
+ * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
+ * checking only for VLAN-encapsulated IP, so that could still
+ * be considered worth doing; it wouldn't break expressions
+ * that are of the form "pppoes and ..." which I suspect are the
+ * most common expressions involving "pppoes". "pppoes or ..."
+ * doesn't necessarily do what the user would really want, now,
+ * as all the "or ..." tests would be done assuming PPPoE, even
+ * though the "or" could be viewed as meaning "or, if this isn't
+ * a PPPoE packet...".
+ */
+ orig_linktype = off_linktype; /* save original values */
+ orig_nl = off_nl;
+
+ /*
+ * The "network-layer" protocol is PPPoE, which has a 6-byte
+ * PPPoE header, followed by PPP payload, so we set the
+ * offsets to the network layer offset plus 6 bytes for
+ * the PPPoE header plus the values appropriate for PPP when
+ * encapsulated in Ethernet (which means there's no HDLC
+ * encapsulation).
+ */
+ off_linktype = orig_nl + 6;
+ off_nl = orig_nl + 6 + 2;
+ off_nl_nosnap = orig_nl + 6 + 2;
+
+ /*
+ * Set the link-layer type to PPP, as all subsequent tests will
+ * be on the encapsulated PPP header.
+ */
+ linktype = DLT_PPP;
+
+ return b0;
+}
+
struct block *
gen_atmfield_code(atmfield, jvalue, jtype, reverse)
int atmfield;
diff --git a/gencode.h b/gencode.h
index fe727f1..a8f8dc2 100644
--- a/gencode.h
+++ b/gencode.h
@@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
- * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.60.2.5 2005-06-20 21:30:17 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.60.2.6 2005-09-05 09:08:06 guy Exp $ (LBL)
*/
/*
@@ -289,6 +289,9 @@ struct block *gen_inbound(int);
struct block *gen_vlan(int);
struct block *gen_mpls(int);
+struct block *gen_pppoed(void);
+struct block *gen_pppoes(void);
+
struct block *gen_atmfield_code(int atmfield, bpf_int32 jvalue, bpf_u_int32 jtype, int reverse);
struct block *gen_atmtype_abbrev(int type);
struct block *gen_atmmulti_abbrev(int type);
diff --git a/grammar.y b/grammar.y
index 8faea2a..0babac2 100644
--- a/grammar.y
+++ b/grammar.y
@@ -22,7 +22,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.86.2.4 2005-06-20 21:30:17 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.86.2.5 2005-09-05 09:08:06 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -131,6 +131,7 @@ pcap_parse()
%token LEN
%token IPV6 ICMPV6 AH ESP
%token VLAN MPLS
+%token PPPOED PPPOES
%token ISO ESIS CLNP ISIS L1 L2 IIH LSP SNP CSNP PSNP
%token STP
%token IPX
@@ -333,6 +334,8 @@ other: pqual TK_BROADCAST { $$ = gen_broadcast($1); }
| VLAN { $$ = gen_vlan(-1); }
| MPLS pnum { $$ = gen_mpls($2); }
| MPLS { $$ = gen_mpls(-1); }
+ | PPPOED { $$ = gen_pppoed(); }
+ | PPPOES { $$ = gen_pppoes(); }
| pfvar { $$ = $1; }
;
diff --git a/scanner.l b/scanner.l
index 799edf7..b1fe74d 100644
--- a/scanner.l
+++ b/scanner.l
@@ -22,7 +22,7 @@
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.99.2.3 2005-06-20 21:30:19 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.99.2.4 2005-09-05 09:08:07 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -263,6 +263,8 @@ outbound return OUTBOUND;
vlan return VLAN;
mpls return MPLS;
+pppoed return PPPOED;
+pppoes return PPPOES;
lane return LANE;
llc return LLC;