From: Claudio Jeker <cjeker@diehard.n-r-g.com>
Subject: libpcap: teach the pcap grammer all the documented wifi subtypes
To: tech@openbsd.org
Date: Wed, 7 Oct 2026 13:56:03 +0200

Noticed this why trying to filter on subtype probe-resp.
That just does not work since the documentation and code do not match.
Also most of the documented subtypes currently do not exist.
This tries to fix this. It is not pretty, this could use a lookup table.
Also it still misses some undocumented subtypes like action, 
action-noack, bar and ba.

I went with the documented keywords since those are also used by
the "upstream" libpcap.
-- 
:wq Claudio

Index: grammar.y
===================================================================
RCS file: /cvs/src/lib/libpcap/grammar.y,v
diff -u -p -r1.24 grammar.y
--- grammar.y	8 Apr 2024 02:51:14 -0000	1.24
+++ grammar.y	7 Oct 2026 11:45:40 -0000
@@ -353,17 +353,17 @@ type:	  NUM
 	;
 
 subtype:  NUM
-	| ID			{ if (strcasecmp($1, "assocreq") == 0)
+	| ID			{ if (strcasecmp($1, "assoc-req") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
-				  else if (strcasecmp($1, "assocresp") == 0)
+				  else if (strcasecmp($1, "assoc-resp") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
-				  else if (strcasecmp($1, "reassocreq") == 0)
+				  else if (strcasecmp($1, "reassoc-req") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_REASSOC_REQ;
-				  else if (strcasecmp($1, "reassocresp") == 0)
+				  else if (strcasecmp($1, "reassoc-resp") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
-				  else if (strcasecmp($1, "probereq") == 0)
+				  else if (strcasecmp($1, "probe-req") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_PROBE_REQ;
-				  else if (strcasecmp($1, "proberesp") == 0)
+				  else if (strcasecmp($1, "probe-resp") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_PROBE_RESP;
 				  else if (strcasecmp($1, "beacon") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_BEACON;
@@ -378,8 +378,42 @@ subtype:  NUM
 				  else if (strcasecmp($1, "deauth") == 0 ||
 				      strcasecmp($1, "deauthentication") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_DEAUTH;
+				  else if (strcasecmp($1, "ps-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_PS_POLL;
+				  else if (strcasecmp($1, "rts") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_RTS;
+				  else if (strcasecmp($1, "cts") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_CTS;
+				  else if (strcasecmp($1, "ack") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_ACK;
+				  else if (strcasecmp($1, "cf-end") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_CF_END;
+				  else if (strcasecmp($1, "cf-end-ack") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_CF_END_ACK;
 				  else if (strcasecmp($1, "data") == 0)
 					$$ = IEEE80211_FC0_SUBTYPE_DATA;
+				  else if (strcasecmp($1, "data-cf-ack") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_DATA_CF_ACK;
+				  else if (strcasecmp($1, "data-cf-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_DATA_CF_POLL;
+				  else if (strcasecmp($1, "data-cf-ack-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_DATA_CF_ACKPOLL;
+				  else if (strcasecmp($1, "null") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_NODATA;
+				  else if (strcasecmp($1, "cf-ack") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_NODATA_CF_ACK;
+				  else if (strcasecmp($1, "cf-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_NODATA_CF_POLL;
+				  else if (strcasecmp($1, "cf-ack-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_NODATA_CF_ACKPOLL;
+				  else if (strcasecmp($1, "qos") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_QOS;
+				  else if (strcasecmp($1, "qos-cf-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_QOS |
+					    IEEE80211_FC0_SUBTYPE_DATA_CF_POLL;
+				  else if (strcasecmp($1, "qos-cf-ack-poll") == 0)
+					$$ = IEEE80211_FC0_SUBTYPE_QOS |
+					    IEEE80211_FC0_SUBTYPE_DATA_CF_ACKPOLL;
 				  else
 					  bpf_error("unknown 802.11 subtype");
 				}