#!/usr/bin/perl
# Find enemy PPPoE Servers

my $admin_email= '';
my $version    = '0.01';

use Sys::Syslog;
if ($#ARGV<0){
        die "Usage: $0 <iface> [service name] [debug]\n";
}else{
        $iface=$ARGV[0];
        if ($ARGV[1] ne '' && $ARGV[1] ne 'debug'){
                $sn=":".$ARGV[1];
                $debug=$ARGV[2];
        }else{
                $debug=$ARGV[1];
        }
}

open (F, "netstat -Wni | grep Link | grep -v tun | grep -v ng | grep -v '*' | grep -v lo0 | grep $iface |") or die "Can't exec finding MAC addresses\n";
while (<F>){
        if ($_=~/^$iface\s+\d+\s\<Link#\d{1,3}\>\s+(\S{17})\s/){
                $mac=$1;
        }
}
if (!$mac){
  die "Can't find MAC for [$iface]. Exit...\n";
}

#Create config
open (F, ">/tmp/ppp.conf") or die "Can't create file '/tmp/ppp.conf' $!\n";
print F "client:
 set device PPPoE:$iface$sn
 set redial 2 2
 set mtu 1492
 set mru 1492
";
close (F);

open (F, "grep -w '/tmp/ppp.conf' /etc/ppp/ppp.conf |") or die "Can't exec grep\n";
  while (<F>){
    $c=$_;
   }
close (F);

if (!$c){
  die "Can't find include client's section\n";
 }
else{
  print "Found MAC [$mac] at $iface\n";
}

if(($pid = fork)) {
        $SIG{CHLD} = 'IGNORE';
        $cmd=sprintf "/usr/sbin/tcpdump -e -n -c 1 -i %s ether proto 0x8863 and ether dst %s and 'ether[0xF:1]=0x7' 2>&1 |",$iface,$mac;
        if ($debug){
                print "DEBUG: ===>[$cmd]<===\n";
        }
        open F,$cmd or die "Can't start tcpdump\n";
        while (<F>){
                chomp($_);
                if ($debug){
                        print "DEBUG: ===>[$_]<===\n";
                }
                if ($_=~/^.+\s(.{17})\s\>\s(.{17}).+PPPoE\sPADO\s\[(.*)\]\s\[(.*)\]\s\[(.*)\]\s\[Host\-Uniq.+/){
                        print "\nFound asshole on iface $iface (iface's MAC: $2)\n
                        ======================================================\n
                        PPPoE at MAC: [$1]\nComp name: [$3]\nListening service name: [$5]\n
                        ======================================================\n\n";
			openlog("PPPOE-search", "ndelay", "local0");
			syslog(LOG_WARNING,"Found asshole ([$3]) on iface $iface (iface's MAC: $2)");
			closelog();
                }elsif ($_=~/^.+\s(.{17})\s\>\s(.{17}).+PPPoE\sPADO\s\[(.*)\]\s\[(.*)\]\s\[Host\-Uniq.+/){
                        print "\nFound asshole on iface $iface (iface's MAC: $2)\n
                        ======================================================\n
                        PPPoE at MAC: [$1]\nComp name: [$3]\nListening service name: [$4]\n
                        ======================================================\n\n";
                        openlog("PPPOE-search", "ndelay", "local0");
                        syslog(LOG_WARNING,"Found asshole ([$3]) on iface $iface (iface's MAC: $2)");
                        closelog();
                        send_warning();
                }elsif ($_=~/ Device not configured/){
                        die "Wrong iface name [$iface]\n";
                }
        }
        close F;
 }
else {
        `/usr/sbin/ppp -foreground client`;
}


#*****************************************************
#
#*****************************************************
sub send_warning {




}
