[PATCH] tcpdump: add ppp address/protocol compression support

[Sergey Ryazanov]

Add support for parsing ppp frames with compressed address and(or)
protocol fields. Since we have no apriory information than try to
guess such frames by inability to parse a frame in a regular way.

ok?

---
 usr.sbin/tcpdump/print-ppp.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git usr.sbin/tcpdump/print-ppp.c usr.sbin/tcpdump/print-ppp.c
index 21f5d154847..60027178942 100644
--- usr.sbin/tcpdump/print-ppp.c
+++ usr.sbin/tcpdump/print-ppp.c
@@ -341,20 +341,26 @@ void
 ppp_print(const u_char *p, u_int length)
 {
        uint16_t proto;
-       int l;
+       int l, pfl;
 
        l = snapend - p;
 
-       if (l < sizeof(proto)) {
+       /* Check for compressed protocol field */
+       if (l >= 1 && (p[0] & 0x1) != 0)
+               pfl = sizeof(uint8_t);
+       else
+               pfl = sizeof(uint16_t);
+
+       if (l < pfl) {
                printf("[|ppp]");
                return;
        }
 
-       proto = EXTRACT_16BITS(p);
+       proto = pfl == sizeof(uint8_t) ? p[0] : EXTRACT_16BITS(p);
 
-       p += sizeof(proto);
-       l -= sizeof(proto);
-       length -= sizeof(proto);
+       p += pfl;
+       l -= pfl;
+       length -= pfl;
 
        if (eflag)
                ppp_protoname(proto);
@@ -1385,12 +1391,11 @@ ppp_hdlc_print(const u_char *p, u_int length)
        address = p[0];
        control = p[1];
 
-       p += sizeof(address) + sizeof(control);
-       l -= sizeof(address) + sizeof(control);
-       length -= sizeof(address) + sizeof(control);
-
        switch (address) {
        case 0xff: /* All-Stations */
+               p += sizeof(address) + sizeof(control);
+               l -= sizeof(address) + sizeof(control);
+               length -= sizeof(address) + sizeof(control);
                if (eflag)
                        printf("%02x %02x %u ", address, control, length);
 
@@ -1402,8 +1407,8 @@ ppp_hdlc_print(const u_char *p, u_int length)
                ppp_print(p, length);
                break;
 
-       default:
-               printf("ppp address 0x%02x unknown", address);
+       default: /* Assume address compression */
+               ppp_print(p, length);
                break;
        }
        return;
-- 
2.26.0