From: "Theo de Raadt" <deraadt@openbsd.org>
Subject: Re: libpcap: teach the pcap grammer all the documented wifi subtypes
To: tech@openbsd.org
Date: Wed, 07 Oct 2026 08:24:48 -0600

Good enough.

Claudio Jeker <cjeker@diehard.n-r-g.com> wrote:

> Noticed this why trying to filter on subtype probe-resp.
> That just does not work since the documentation and code do not match.
> Also most of the documented subtypes currently do not exist.
> This tries to fix this. It is not pretty, this could use a lookup table.
> Also it still misses some undocumented subtypes like action, 
> action-noack, bar and ba.
> 
> I went with the documented keywords since those are also used by
> the "upstream" libpcap.
> -- 
> :wq Claudio
> 
> Index: grammar.y
> ===================================================================
> RCS file: /cvs/src/lib/libpcap/grammar.y,v
> diff -u -p -r1.24 grammar.y
> --- grammar.y	8 Apr 2024 02:51:14 -0000	1.24
> +++ grammar.y	7 Oct 2026 11:45:40 -0000
> @@ -353,17 +353,17 @@ type:	  NUM
>  	;
>  
>  subtype:  NUM
> -	| ID			{ if (strcasecmp($1, "assocreq") == 0)
> +	| ID			{ if (strcasecmp($1, "assoc-req") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
> -				  else if (strcasecmp($1, "assocresp") == 0)
> +				  else if (strcasecmp($1, "assoc-resp") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
> -				  else if (strcasecmp($1, "reassocreq") == 0)
> +				  else if (strcasecmp($1, "reassoc-req") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_REASSOC_REQ;
> -				  else if (strcasecmp($1, "reassocresp") == 0)
> +				  else if (strcasecmp($1, "reassoc-resp") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
> -				  else if (strcasecmp($1, "probereq") == 0)
> +				  else if (strcasecmp($1, "probe-req") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_PROBE_REQ;
> -				  else if (strcasecmp($1, "proberesp") == 0)
> +				  else if (strcasecmp($1, "probe-resp") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_PROBE_RESP;
>  				  else if (strcasecmp($1, "beacon") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_BEACON;
> @@ -378,8 +378,42 @@ subtype:  NUM
>  				  else if (strcasecmp($1, "deauth") == 0 ||
>  				      strcasecmp($1, "deauthentication") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_DEAUTH;
> +				  else if (strcasecmp($1, "ps-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_PS_POLL;
> +				  else if (strcasecmp($1, "rts") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_RTS;
> +				  else if (strcasecmp($1, "cts") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_CTS;
> +				  else if (strcasecmp($1, "ack") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_ACK;
> +				  else if (strcasecmp($1, "cf-end") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_CF_END;
> +				  else if (strcasecmp($1, "cf-end-ack") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_CF_END_ACK;
>  				  else if (strcasecmp($1, "data") == 0)
>  					$$ = IEEE80211_FC0_SUBTYPE_DATA;
> +				  else if (strcasecmp($1, "data-cf-ack") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_DATA_CF_ACK;
> +				  else if (strcasecmp($1, "data-cf-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_DATA_CF_POLL;
> +				  else if (strcasecmp($1, "data-cf-ack-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_DATA_CF_ACKPOLL;
> +				  else if (strcasecmp($1, "null") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_NODATA;
> +				  else if (strcasecmp($1, "cf-ack") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_NODATA_CF_ACK;
> +				  else if (strcasecmp($1, "cf-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_NODATA_CF_POLL;
> +				  else if (strcasecmp($1, "cf-ack-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_NODATA_CF_ACKPOLL;
> +				  else if (strcasecmp($1, "qos") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_QOS;
> +				  else if (strcasecmp($1, "qos-cf-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_QOS |
> +					    IEEE80211_FC0_SUBTYPE_DATA_CF_POLL;
> +				  else if (strcasecmp($1, "qos-cf-ack-poll") == 0)
> +					$$ = IEEE80211_FC0_SUBTYPE_QOS |
> +					    IEEE80211_FC0_SUBTYPE_DATA_CF_ACKPOLL;
>  				  else
>  					  bpf_error("unknown 802.11 subtype");
>  				}
>