Merge pull request #58 from cloudflare/feature/ppp

Add PPP decoding

pb/flow.proto

@@ -113,6 +113,10 @@ message FlowMessage {
   uint32 MPLSLastTTL = 61; // Last TTL
   uint32 MPLSLastLabel = 62; // Last Label
 
+  // PPP information
+  bool HasPPP = 63;
+  uint32 PPPAddressControl = 64;
+
   // Custom fields: start after ID 1000:
   // uint32 MyCustomField = 1000;
 

producer/producer_sf.go

@@ -39,6 +39,8 @@ func ParseSampledHeaderConfig(flowMessage *flowmessage.FlowMessage, sampledHeade
 	data := (*sampledHeader).HeaderData
 	switch (*sampledHeader).Protocol {
 	case 1: // Ethernet
+		var hasPPP bool
+		var pppAddressControl uint16
 		var hasMPLS bool
 		var countMpls uint32
 		var firstLabelMpls uint32
@@ -188,12 +190,28 @@ func ParseSampledHeaderConfig(flowMessage *flowmessage.FlowMessage, sampledHeade
 			// GRE
 			if len(data) >= offset+4 && nextHeader == 47 {
 				etherTypeEncap = data[offset+2 : offset+4]
+				offset += 4
 				if (etherTypeEncap[0] == 0x8 && etherTypeEncap[1] == 0x0) ||
 					(etherTypeEncap[0] == 0x86 && etherTypeEncap[1] == 0xdd) {
 					encap = true
 					hasEncap = true
 				}
-				offset += 4
+				if etherTypeEncap[0] == 0x88 && etherTypeEncap[1] == 0x0b && len(data) >= offset+12 {
+					offset += 8
+					encap = true
+					hasPPP = true
+					pppAddressControl = binary.BigEndian.Uint16(data[offset : offset+2])
+					pppEtherType := data[offset+2 : offset+4]
+					if pppEtherType[0] == 0x0 && pppEtherType[1] == 0x21 {
+						etherTypeEncap = []byte{0x8, 0x00}
+						hasEncap = true
+					} else if pppEtherType[0] == 0x0 && pppEtherType[1] == 0x57 {
+						etherTypeEncap = []byte{0x86, 0xdd}
+						hasEncap = true
+					}
+					offset += 4
+
+				}
 
 				if hasEncap {
 					srcIPEncap = srcIP
@@ -249,6 +267,9 @@ func ParseSampledHeaderConfig(flowMessage *flowmessage.FlowMessage, sampledHeade
 			flowLabel = flowLabelTmp
 		}
 
+		(*flowMessage).HasPPP = hasPPP
+		(*flowMessage).PPPAddressControl = uint32(pppAddressControl)
+
 		(*flowMessage).HasMPLS = hasMPLS
 		(*flowMessage).MPLSCount = countMpls
 		(*flowMessage).MPLS1Label = firstLabelMpls