[PATCH] tcpdump: add ppp address/protocol compression support

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

[PATCH] tcpdump: add ppp address/protocol compression support

Sergey Ryazanov
Add support for parsing ppp frames with compressed address and(or)
protocol fields. Since we have no apriory information than try to
guess such frames by inability to parse a frame in a regular way.

ok?

---
 usr.sbin/tcpdump/print-ppp.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git usr.sbin/tcpdump/print-ppp.c usr.sbin/tcpdump/print-ppp.c
index 21f5d154847..60027178942 100644
--- usr.sbin/tcpdump/print-ppp.c
+++ usr.sbin/tcpdump/print-ppp.c
@@ -341,20 +341,26 @@ void
 ppp_print(const u_char *p, u_int length)
 {
  uint16_t proto;
- int l;
+ int l, pfl;
 
  l = snapend - p;
 
- if (l < sizeof(proto)) {
+ /* Check for compressed protocol field */
+ if (l >= 1 && (p[0] & 0x1) != 0)
+ pfl = sizeof(uint8_t);
+ else
+ pfl = sizeof(uint16_t);
+
+ if (l < pfl) {
  printf("[|ppp]");
  return;
  }
 
- proto = EXTRACT_16BITS(p);
+ proto = pfl == sizeof(uint8_t) ? p[0] : EXTRACT_16BITS(p);
 
- p += sizeof(proto);
- l -= sizeof(proto);
- length -= sizeof(proto);
+ p += pfl;
+ l -= pfl;
+ length -= pfl;
 
  if (eflag)
  ppp_protoname(proto);
@@ -1385,12 +1391,11 @@ ppp_hdlc_print(const u_char *p, u_int length)
  address = p[0];
  control = p[1];
 
- p += sizeof(address) + sizeof(control);
- l -= sizeof(address) + sizeof(control);
- length -= sizeof(address) + sizeof(control);
-
  switch (address) {
  case 0xff: /* All-Stations */
+ p += sizeof(address) + sizeof(control);
+ l -= sizeof(address) + sizeof(control);
+ length -= sizeof(address) + sizeof(control);
  if (eflag)
  printf("%02x %02x %u ", address, control, length);
 
@@ -1402,8 +1407,8 @@ ppp_hdlc_print(const u_char *p, u_int length)
  ppp_print(p, length);
  break;
 
- default:
- printf("ppp address 0x%02x unknown", address);
+ default: /* Assume address compression */
+ ppp_print(p, length);
  break;
  }
  return;
--
2.26.0

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] tcpdump: add ppp address/protocol compression support

Sergey Ryazanov
Hello!

On Mon, May 4, 2020 at 9:37 PM Sergey Ryazanov <[hidden email]> wrote:
> Add support for parsing ppp frames with compressed address and(or)
> protocol fields. Since we have no apriory information than try to
> guess such frames by inability to parse a frame in a regular way.
>
> ok?

Does someone have any objections on this diff?

--
Sergey