]> The Tcpdump Group git mirrors - libpcap/blobdiff - gencode.c
projects / libpcap / blobdiff
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Get ready for libpcap 0.7.2
[libpcap] / gencode.c
diff --git a/gencode.c b/gencode.c
index 502d9cdac093b6d4fd9a5917af2fe9877bc17e16..f18bad5c01a3287bca8349041d4eafe05d31ceb8 100644 (file)
--- a/gencode.c
+++ b/gencode.c
@@ -21,7 +21,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.144 2001-01-14 08:09:58 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.160.2.4 2002-06-01 23:23:20 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -35,8 +35,8 @@ static const char rcsid[] =
 #include <sys/param.h>
 #endif
 
 #include <sys/param.h>
 #endif
 
-struct mbuf;
-struct rtentry;
+struct mbuf;           /* Squelch compiler warnings on some platforms for */
+struct rtentry;                /* declarations in <net/if.h> */
 #include <net/if.h>
 
 #include <netinet/in.h>
 #include <net/if.h>
 
 #include <netinet/in.h>
@@ -51,28 +51,22 @@ struct rtentry;
 
 #include "ethertype.h"
 #include "nlpid.h"
 
 #include "ethertype.h"
 #include "nlpid.h"
+#include "llc.h"
 #include "gencode.h"
 #include "ppp.h"
 #include "sll.h"
 #include "gencode.h"
 #include "ppp.h"
 #include "sll.h"
-#include <pcap-namedb.h>
+#include "arcnet.h"
 #ifdef INET6
 #ifdef INET6
-#include <netdb.h>
-#include <sys/socket.h>
+#include <netdb.h>     /* for "struct addrinfo" */
 #endif /*INET6*/
 #endif /*INET6*/
-
-/*
- * LLC SAP values.
- * Note that these fit in one byte, and are thus less than 1500, and
- * are thus distinguishable from ETHERTYPE_ values, so we can use them
- * as protocol types values.
- */
-#define LLC_SNAP_LSAP  0xaa
-#define LLC_ISO_LSAP   0xfe
-#define LLC_STP_LSAP   0x42
-#define LLC_IPX_LSAP   0xe0
+#include <pcap-namedb.h>
 
 #define ETHERMTU       1500
 
 
 #define ETHERMTU       1500
 
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
+
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
 #endif
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
 #endif
@@ -83,6 +77,9 @@ struct rtentry;
 static jmp_buf top_ctx;
 static pcap_t *bpf_pcap;
 
 static jmp_buf top_ctx;
 static pcap_t *bpf_pcap;
 
+/* Hack for updating VLAN offsets. */
+static u_int   orig_linktype = -1, orig_nl = -1, orig_nl_nosnap = -1;
+
 /* XXX */
 #ifdef PCAP_FDDIPAD
 int    pcap_fddipad = PCAP_FDDIPAD;
 /* XXX */
 #ifdef PCAP_FDDIPAD
 int    pcap_fddipad = PCAP_FDDIPAD;
@@ -151,6 +148,7 @@ static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int
 #ifdef INET6
 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
 #endif
 #ifdef INET6
 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
 #endif
+static struct block *gen_ahostop(const u_char *, int);
 static struct block *gen_ehostop(const u_char *, int);
 static struct block *gen_fhostop(const u_char *, int);
 static struct block *gen_thostop(const u_char *, int);
 static struct block *gen_ehostop(const u_char *, int);
 static struct block *gen_fhostop(const u_char *, int);
 static struct block *gen_thostop(const u_char *, int);
@@ -542,11 +540,55 @@ gen_bcmp(offset, size, v)
 
 /*
  * Various code constructs need to know the layout of the data link
 
 /*
  * Various code constructs need to know the layout of the data link
- * layer.  These variables give the necessary offsets.  off_linktype
- * is set to -1 for no encapsulation, in which case, IP is assumed.
+ * layer.  These variables give the necessary offsets.
+ */
+
+/*
+ * "off_linktype" is the offset to information in the link-layer header
+ * giving the packet type.
+ *
+ * For Ethernet, it's the offset of the Ethernet type field.
+ *
+ * For link-layer types that always use 802.2 headers, it's the
+ * offset of the LLC header.
+ *
+ * For PPP, it's the offset of the PPP type field.
+ *
+ * For Cisco HDLC, it's the offset of the CHDLC type field.
+ *
+ * For BSD loopback, it's the offset of the AF_ value.
+ *
+ * For Linux cooked sockets, it's the offset of the type field.
+ *
+ * It's set to -1 for no encapsulation, in which case, IP is assumed.
  */
 static u_int off_linktype;
  */
 static u_int off_linktype;
+
+/*
+ * These are offsets to the beginning of the network-layer header.
+ *
+ * If the link layer never uses 802.2 LLC:
+ *
+ *     "off_nl" and "off_nl_nosnap" are the same.
+ *
+ * If the link layer always uses 802.2 LLC:
+ *
+ *     "off_nl" is the offset if there's a SNAP header following
+ *     the 802.2 header;
+ *
+ *     "off_nl_nosnap" is the offset if there's no SNAP header.
+ *
+ * If the link layer is Ethernet:
+ *
+ *     "off_nl" is the offset if the packet is an Ethernet II packet
+ *     (we assume no 802.3+802.2+SNAP);
+ *
+ *     "off_nl_nosnap" is the offset if the packet is an 802.3 packet
+ *     with an 802.2 header following it.
+ */
 static u_int off_nl;
 static u_int off_nl;
+static u_int off_nl_nosnap;
+
 static int linktype;
 
 static void
 static int linktype;
 
 static void
@@ -555,11 +597,22 @@ init_linktype(type)
 {
        linktype = type;
 
 {
        linktype = type;
 
+       orig_linktype = -1;
+       orig_nl = -1;
+       orig_nl_nosnap = -1;
+
        switch (type) {
 
        switch (type) {
 
+       case DLT_ARCNET:
+               off_linktype = 2;
+               off_nl = 6;     /* XXX in reality, variable! */
+               off_nl_nosnap = 6;      /* no 802.2 LLC */
+               return;
+
        case DLT_EN10MB:
                off_linktype = 12;
        case DLT_EN10MB:
                off_linktype = 12;
-               off_nl = 14;
+               off_nl = 14;            /* Ethernet II */
+               off_nl_nosnap = 17;     /* 802.3+802.2 */
                return;
 
        case DLT_SLIP:
                return;
 
        case DLT_SLIP:
@@ -569,6 +622,7 @@ init_linktype(type)
                 */
                off_linktype = -1;
                off_nl = 16;
                 */
                off_linktype = -1;
                off_nl = 16;
+               off_nl_nosnap = 16;     /* no 802.2 LLC */
                return;
 
        case DLT_SLIP_BSDOS:
                return;
 
        case DLT_SLIP_BSDOS:
@@ -576,24 +630,38 @@ init_linktype(type)
                off_linktype = -1;
                /* XXX end */
                off_nl = 24;
                off_linktype = -1;
                /* XXX end */
                off_nl = 24;
+               off_nl_nosnap = 24;     /* no 802.2 LLC */
                return;
 
        case DLT_NULL:
        case DLT_LOOP:
                off_linktype = 0;
                off_nl = 4;
                return;
 
        case DLT_NULL:
        case DLT_LOOP:
                off_linktype = 0;
                off_nl = 4;
+               off_nl_nosnap = 4;      /* no 802.2 LLC */
                return;
 
        case DLT_PPP:
                return;
 
        case DLT_PPP:
-       case DLT_C_HDLC:
-       case DLT_PPP_SERIAL:
+       case DLT_C_HDLC:                /* BSD/OS Cisco HDLC */
+       case DLT_PPP_SERIAL:            /* NetBSD sync/async serial PPP */
                off_linktype = 2;
                off_nl = 4;
                off_linktype = 2;
                off_nl = 4;
+               off_nl_nosnap = 4;      /* no 802.2 LLC */
+               return;
+
+       case DLT_PPP_ETHER:
+               /*
+                * This does no include the Ethernet header, and
+                * only covers session state.
+                */
+               off_linktype = 6;
+               off_nl = 8;
+               off_nl_nosnap = 8;      /* no 802.2 LLC */
                return;
 
        case DLT_PPP_BSDOS:
                off_linktype = 5;
                off_nl = 24;
                return;
 
        case DLT_PPP_BSDOS:
                off_linktype = 5;
                off_nl = 24;
+               off_nl_nosnap = 24;     /* no 802.2 LLC */
                return;
 
        case DLT_FDDI:
                return;
 
        case DLT_FDDI:
@@ -609,9 +677,11 @@ init_linktype(type)
 #ifdef PCAP_FDDIPAD
                off_linktype += pcap_fddipad;
 #endif
 #ifdef PCAP_FDDIPAD
                off_linktype += pcap_fddipad;
 #endif
-               off_nl = 21;
+               off_nl = 21;            /* FDDI+802.2+SNAP */
+               off_nl_nosnap = 16;     /* FDDI+802.2 */
 #ifdef PCAP_FDDIPAD
                off_nl += pcap_fddipad;
 #ifdef PCAP_FDDIPAD
                off_nl += pcap_fddipad;
+               off_nl_nosnap += pcap_fddipad;
 #endif
                return;
 
 #endif
                return;
 
@@ -640,31 +710,76 @@ init_linktype(type)
                 * 8 - figure out which byte that is).
                 */
                off_linktype = 14;
                 * 8 - figure out which byte that is).
                 */
                off_linktype = 14;
-               off_nl = 22;
+               off_nl = 22;            /* Token Ring+802.2+SNAP */
+               off_nl_nosnap = 17;     /* Token Ring+802.2 */
+               return;
+
+       case DLT_IEEE802_11:
+               /*
+                * 802.11 doesn't really have a link-level type field.
+                * We set "off_linktype" to the offset of the LLC header.
+                *
+                * To check for Ethernet types, we assume that SSAP = SNAP
+                * is being used and pick out the encapsulated Ethernet type.
+                * XXX - should we generate code to check for SNAP?
+                *
+                * XXX - the header is actually variable-length.  We
+                * assume a 24-byte link-layer header, as appears in
+                * data frames in networks with no bridges.
+                */
+               off_linktype = 24;
+               off_nl = 32;            /* 802.11+802.2+SNAP */
+               off_nl_nosnap = 27;     /* 802.22+802.2 */
+               return;
+
+       case DLT_PRISM_HEADER:
+               /*
+                * Same as 802.11, but with an additional header before
+                * the 802.11 header, containing a bunch of additional
+                * information including radio-level information.
+                *
+                * The header is 144 bytes long.
+                *
+                * XXX - same variable-length header problem; at least
+                * the Prism header is fixed-length.
+                */
+               off_linktype = 144+24;
+               off_nl = 144+32;        /* Prism+802.11+802.2+SNAP */
+               off_nl_nosnap = 144+27; /* Prism+802.11+802.2 */
                return;
 
        case DLT_ATM_RFC1483:
                return;
 
        case DLT_ATM_RFC1483:
+       case DLT_ATM_CLIP:      /* Linux ATM defines this */
                /*
                 * assume routed, non-ISO PDUs
                 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
                 */
                /*
                 * assume routed, non-ISO PDUs
                 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
                 */
-               off_linktype = 6;
-               off_nl = 8;
+               off_linktype = 0;
+               off_nl = 8;             /* 802.2+SNAP */
+               off_nl_nosnap = 3;      /* 802.2 */
                return;
 
        case DLT_RAW:
                off_linktype = -1;
                off_nl = 0;
                return;
 
        case DLT_RAW:
                off_linktype = -1;
                off_nl = 0;
-               return;
-
-       case DLT_ATM_CLIP:      /* Linux ATM defines this */
-               off_linktype = 6;
-               off_nl = 8;
+               off_nl_nosnap = 0;      /* no 802.2 LLC */
                return;
 
        case DLT_LINUX_SLL:     /* fake header for Linux cooked socket */
                off_linktype = 14;
                off_nl = 16;
                return;
 
        case DLT_LINUX_SLL:     /* fake header for Linux cooked socket */
                off_linktype = 14;
                off_nl = 16;
+               off_nl_nosnap = 16;     /* no 802.2 LLC */
+               return;
+
+       case DLT_LTALK:
+               /*
+                * LocalTalk does have a 1-byte type field in the LLAP header,
+                * but really it just indicates whether there is a "short" or
+                * "long" DDP packet following.
+                */
+               off_linktype = -1;
+               off_nl = 0;
+               off_nl_nosnap = 0;      /* no 802.2 LLC */
                return;
        }
        bpf_error("unknown data link type %d", linktype);
                return;
        }
        bpf_error("unknown data link type %d", linktype);
@@ -717,7 +832,7 @@ gen_linktype(proto)
        case DLT_EN10MB:
                switch (proto) {
 
        case DLT_EN10MB:
                switch (proto) {
 
-               case LLC_ISO_LSAP:
+               case LLCSAP_ISONS:
                        /*
                         * OSI protocols always use 802.2 encapsulation.
                         * XXX - should we check both the DSAP and the
                        /*
                         * OSI protocols always use 802.2 encapsulation.
                         * XXX - should we check both the DSAP and the
@@ -727,30 +842,70 @@ gen_linktype(proto)
                        b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
                        gen_not(b0);
                        b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
                        b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
                        gen_not(b0);
                        b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-                                    ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
+                                    ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
                        gen_and(b0, b1);
                        return b1;
 
                        gen_and(b0, b1);
                        return b1;
 
-               case LLC_IPX_LSAP:
+               case LLCSAP_NETBEUI:
                        /*
                        /*
-                        * Check both for the IPX LSAP as the DSAP and
-                        * for Netware 802.3, where the type/length
-                        * field is a length field (i.e., <= ETHERMTU)
-                        * and the first two bytes after the LLC header
-                        * are 0xFFFF.
+                        * NetBEUI always uses 802.2 encapsulation.
+                        * XXX - should we check both the DSAP and the
+                        * SSAP, like this, or should we check just the
+                        * DSAP?
+                        */
+                       b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+                       gen_not(b0);
+                       b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
+                                    ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
+                       gen_and(b0, b1);
+                       return b1;
+
+               case LLCSAP_IPX:
+                       /*
+                        * Check for;
+                        *
+                        *      Ethernet_II frames, which are Ethernet
+                        *      frames with a frame type of ETHERTYPE_IPX;
+                        *
+                        *      Ethernet_802.3 frames, which are 802.3
+                        *      frames (i.e., the type/length field is
+                        *      a length field, <= ETHERMTU, rather than
+                        *      a type field) with the first two bytes
+                        *      after the Ethernet/802.3 header being
+                        *      0xFFFF;
+                        *
+                        *      Ethernet_802.2 frames, which are 802.3
+                        *      frames with an 802.2 LLC header and
+                        *      with the IPX LSAP as the DSAP in the LLC
+                        *      header;
                         *
                         *
-                        * XXX - check for the IPX Ethertype, 0x8137,
-                        * as well?
+                        *      Ethernet_SNAP frames, which are 802.3
+                        *      frames with an LLC header and a SNAP
+                        *      header and with an OUI of 0x000000
+                        *      (encapsulated Ethernet) and a protocol
+                        *      ID of ETHERTYPE_IPX in the SNAP header.
                         *
                         *
+                        * XXX - should we generate the same code both
+                        * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
+                        */
+
+                       /*
                         * This generates code to check both for the
                         * This generates code to check both for the
-                        * IPX LSAP and for Netware 802.3.
+                        * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
                         */
                        b0 = gen_cmp(off_linktype + 2, BPF_B,
                         */
                        b0 = gen_cmp(off_linktype + 2, BPF_B,
-                           (bpf_int32)LLC_IPX_LSAP);
+                           (bpf_int32)LLCSAP_IPX);
                        b1 = gen_cmp(off_linktype + 2, BPF_H,
                            (bpf_int32)0xFFFF);
                        gen_or(b0, b1);
 
                        b1 = gen_cmp(off_linktype + 2, BPF_H,
                            (bpf_int32)0xFFFF);
                        gen_or(b0, b1);
 
+                       /*
+                        * Now we add code to check for SNAP frames with
+                        * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
+                        */
+                       b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
+                       gen_or(b0, b1);
+
                        /*
                         * Now we generate code to check for 802.3
                         * frames in general.
                        /*
                         * Now we generate code to check for 802.3
                         * frames in general.
@@ -759,10 +914,21 @@ gen_linktype(proto)
                        gen_not(b0);
 
                        /*
                        gen_not(b0);
 
                        /*
-                        * Now check for 802.3 frames and, if that passes,
-                        * check for either of the flavors of IPX.
+                        * Now add the check for 802.3 frames before the
+                        * check for Ethernet_802.2 and Ethernet_802.3,
+                        * as those checks should only be done on 802.3
+                        * frames, not on Ethernet frames.
                         */
                        gen_and(b0, b1);
                         */
                        gen_and(b0, b1);
+
+                       /*
+                        * Now add the check for Ethernet_II frames, and
+                        * do that before checking for the other frame
+                        * types.
+                        */
+                       b0 = gen_cmp(off_linktype, BPF_H,
+                           (bpf_int32)ETHERTYPE_IPX);
+                       gen_or(b0, b1);
                        return b1;
 
                case ETHERTYPE_ATALK:
                        return b1;
 
                case ETHERTYPE_ATALK:
@@ -839,6 +1005,8 @@ gen_linktype(proto)
                }
                break;
 
                }
                break;
 
+       case DLT_IEEE802_11:
+       case DLT_PRISM_HEADER:
        case DLT_FDDI:
        case DLT_IEEE802:
        case DLT_ATM_RFC1483:
        case DLT_FDDI:
        case DLT_IEEE802:
        case DLT_ATM_RFC1483:
@@ -848,9 +1016,21 @@ gen_linktype(proto)
                 */
                switch (proto) {
 
                 */
                switch (proto) {
 
-               case LLC_ISO_LSAP:
+               case LLCSAP_ISONS:
+                       return gen_cmp(off_linktype, BPF_H, (long)
+                                    ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
+
+               case LLCSAP_NETBEUI:
                        return gen_cmp(off_linktype, BPF_H, (long)
                        return gen_cmp(off_linktype, BPF_H, (long)
-                                    ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
+                                    ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
+
+               case LLCSAP_IPX:
+                       /*
+                        * XXX - are there ever SNAP frames for IPX on
+                        * non-Ethernet 802.x networks?
+                        */
+                       return gen_cmp(off_linktype, BPF_B,
+                           (bpf_int32)LLCSAP_IPX);
 
                case ETHERTYPE_ATALK:
                        /*
 
                case ETHERTYPE_ATALK:
                        /*
@@ -910,7 +1090,7 @@ gen_linktype(proto)
        case DLT_LINUX_SLL:
                switch (proto) {
 
        case DLT_LINUX_SLL:
                switch (proto) {
 
-               case LLC_ISO_LSAP:
+               case LLCSAP_ISONS:
                        /*
                         * OSI protocols always use 802.2 encapsulation.
                         * XXX - should we check both the DSAP and the
                        /*
                         * OSI protocols always use 802.2 encapsulation.
                         * XXX - should we check both the DSAP and the
@@ -919,21 +1099,55 @@ gen_linktype(proto)
                         */
                        b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
                        b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
                         */
                        b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
                        b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-                                    ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
+                                    ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
+                       gen_and(b0, b1);
+                       return b1;
+
+               case LLCSAP_NETBEUI:
+                       /*
+                        * NetBEUI always uses 802.2 encapsulation.
+                        * XXX - should we check both the DSAP and the
+                        * LSAP, like this, or should we check just the
+                        * DSAP?
+                        */
+                       b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+                       b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
+                                    ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
                        gen_and(b0, b1);
                        return b1;
 
                        gen_and(b0, b1);
                        return b1;
 
-               case LLC_IPX_LSAP:
+               case LLCSAP_IPX:
                        /*
                        /*
-                        * Check both for 802.2 frames with the IPX LSAP as
-                        * the DSAP and for Netware 802.3 frames.
+                        *      Ethernet_II frames, which are Ethernet
+                        *      frames with a frame type of ETHERTYPE_IPX;
                         *
                         *
-                        * This generates code to check for 802.2 frames
-                        * with the IPX LSAP.
+                        *      Ethernet_802.3 frames, which have a frame
+                        *      type of LINUX_SLL_P_802_3;
+                        *
+                        *      Ethernet_802.2 frames, which are 802.3
+                        *      frames with an 802.2 LLC header (i.e, have
+                        *      a frame type of LINUX_SLL_P_802_2) and
+                        *      with the IPX LSAP as the DSAP in the LLC
+                        *      header;
+                        *
+                        *      Ethernet_SNAP frames, which are 802.3
+                        *      frames with an LLC header and a SNAP
+                        *      header and with an OUI of 0x000000
+                        *      (encapsulated Ethernet) and a protocol
+                        *      ID of ETHERTYPE_IPX in the SNAP header.
+                        *
+                        * First, do the checks on LINUX_SLL_P_802_2
+                        * frames; generate the check for either
+                        * Ethernet_802.2 or Ethernet_SNAP frames, and
+                        * then put a check for LINUX_SLL_P_802_2 frames
+                        * before it.
                         */
                         */
+                       b0 = gen_cmp(off_linktype + 2, BPF_B,
+                           (bpf_int32)LLCSAP_IPX);
+                       b1 = gen_snap(0x000000, ETHERTYPE_IPX,
+                           off_linktype + 2);
+                       gen_or(b0, b1);
                        b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
                        b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
-                       b1 = gen_cmp(off_linktype + 2, BPF_B,
-                           (bpf_int32)LLC_IPX_LSAP);
                        gen_and(b0, b1);
 
                        /*
                        gen_and(b0, b1);
 
                        /*
@@ -942,6 +1156,15 @@ gen_linktype(proto)
                         */
                        b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
                        gen_or(b0, b1);
                         */
                        b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
                        gen_or(b0, b1);
+
+                       /*
+                        * Now add the check for Ethernet_II frames, and
+                        * do that before checking for the other frame
+                        * types.
+                        */
+                       b0 = gen_cmp(off_linktype, BPF_H,
+                           (bpf_int32)ETHERTYPE_IPX);
+                       gen_or(b0, b1);
                        return b1;
 
                case ETHERTYPE_ATALK:
                        return b1;
 
                case ETHERTYPE_ATALK:
@@ -1043,6 +1266,7 @@ gen_linktype(proto)
 
        case DLT_PPP:
        case DLT_PPP_SERIAL:
 
        case DLT_PPP:
        case DLT_PPP_SERIAL:
+       case DLT_PPP_ETHER:
                /*
                 * We use Ethernet protocol types inside libpcap;
                 * map them to the corresponding PPP protocol types.
                /*
                 * We use Ethernet protocol types inside libpcap;
                 * map them to the corresponding PPP protocol types.
@@ -1071,11 +1295,11 @@ gen_linktype(proto)
                        proto = PPP_NS;
                        break;
 
                        proto = PPP_NS;
                        break;
 
-               case LLC_ISO_LSAP:
+               case LLCSAP_ISONS:
                        proto = PPP_OSI;
                        break;
 
                        proto = PPP_OSI;
                        break;
 
-               case LLC_STP_LSAP:
+               case LLCSAP_8021D:
                        /*
                         * I'm assuming the "Bridging PDU"s that go
                         * over PPP are Spanning Tree Protocol
                        /*
                         * I'm assuming the "Bridging PDU"s that go
                         * over PPP are Spanning Tree Protocol
@@ -1084,7 +1308,7 @@ gen_linktype(proto)
                        proto = PPP_BRPDU;
                        break;
 
                        proto = PPP_BRPDU;
                        break;
 
-               case LLC_IPX_LSAP:
+               case LLCSAP_IPX:
                        proto = PPP_IPX;
                        break;
                }
                        proto = PPP_IPX;
                        break;
                }
@@ -1124,11 +1348,11 @@ gen_linktype(proto)
                        proto = PPP_NS;
                        break;
 
                        proto = PPP_NS;
                        break;
 
-               case LLC_ISO_LSAP:
+               case LLCSAP_ISONS:
                        proto = PPP_OSI;
                        break;
 
                        proto = PPP_OSI;
                        break;
 
-               case LLC_STP_LSAP:
+               case LLCSAP_8021D:
                        /*
                         * I'm assuming the "Bridging PDU"s that go
                         * over PPP are Spanning Tree Protocol
                        /*
                         * I'm assuming the "Bridging PDU"s that go
                         * over PPP are Spanning Tree Protocol
@@ -1137,7 +1361,7 @@ gen_linktype(proto)
                        proto = PPP_BRPDU;
                        break;
 
                        proto = PPP_BRPDU;
                        break;
 
-               case LLC_IPX_LSAP:
+               case LLCSAP_IPX:
                        proto = PPP_IPX;
                        break;
                }
                        proto = PPP_IPX;
                        break;
                }
@@ -1204,6 +1428,49 @@ gen_linktype(proto)
                        proto = htonl(proto);
                }
                return (gen_cmp(0, BPF_W, (bpf_int32)proto));
                        proto = htonl(proto);
                }
                return (gen_cmp(0, BPF_W, (bpf_int32)proto));
+
+       case DLT_ARCNET:
+               /*
+                * XXX should we check for first fragment if the protocol
+                * uses PHDS?
+                */
+               switch(proto) {
+               default:
+                       return gen_false();
+#ifdef INET6
+               case ETHERTYPE_IPV6:
+                       return(gen_cmp(2, BPF_B,
+                                       (bpf_int32)htonl(ARCTYPE_INET6)));
+#endif /* INET6 */
+               case ETHERTYPE_IP:
+                       b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP));
+                       b1 = gen_cmp(2, BPF_B,
+                                       (bpf_int32)htonl(ARCTYPE_IP_OLD));
+                       gen_or(b0, b1);
+                       return(b1);
+               case ETHERTYPE_ARP:
+                       b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP));
+                       b1 = gen_cmp(2, BPF_B,
+                                       (bpf_int32)htonl(ARCTYPE_ARP_OLD));
+                       gen_or(b0, b1);
+                       return(b1);
+               case ETHERTYPE_REVARP:
+                       return(gen_cmp(2, BPF_B,
+                                       (bpf_int32)htonl(ARCTYPE_REVARP)));
+               case ETHERTYPE_ATALK:
+                       return(gen_cmp(2, BPF_B,
+                                       (bpf_int32)htonl(ARCTYPE_ATALK)));
+               }
+               break;
+
+       case DLT_LTALK:
+               switch (proto) {
+               case ETHERTYPE_ATALK:
+                       return gen_true();
+               default:
+                       return gen_false();
+               }
+               break;
        }
 
        /*
        }
 
        /*
@@ -1246,8 +1513,8 @@ gen_snap(orgcode, ptype, offset)
 {
        u_char snapblock[8];
 
 {
        u_char snapblock[8];
 
-       snapblock[0] = LLC_SNAP_LSAP;   /* DSAP = SNAP */
-       snapblock[1] = LLC_SNAP_LSAP;   /* SSAP = SNAP */
+       snapblock[0] = LLCSAP_SNAP;     /* DSAP = SNAP */
+       snapblock[1] = LLCSAP_SNAP;     /* SSAP = SNAP */
        snapblock[2] = 0x03;    /* control = UI */
        snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
        snapblock[4] = (orgcode >> 8);  /* middle 8 bits of organization code */
        snapblock[2] = 0x03;    /* control = UI */
        snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
        snapblock[4] = (orgcode >> 8);  /* middle 8 bits of organization code */
@@ -1587,6 +1854,9 @@ gen_host(addr, mask, proto, dir)
        case Q_TCP:
                bpf_error("'tcp' modifier applied to host");
 
        case Q_TCP:
                bpf_error("'tcp' modifier applied to host");
 
+       case Q_SCTP:
+               bpf_error("'sctp' modifier applied to host");
+
        case Q_UDP:
                bpf_error("'udp' modifier applied to host");
 
        case Q_UDP:
                bpf_error("'udp' modifier applied to host");
 
@@ -1602,6 +1872,9 @@ gen_host(addr, mask, proto, dir)
        case Q_PIM:
                bpf_error("'pim' modifier applied to host");
 
        case Q_PIM:
                bpf_error("'pim' modifier applied to host");
 
+       case Q_VRRP:
+               bpf_error("'vrrp' modifier applied to host");
+
        case Q_ATALK:
                bpf_error("ATALK host filtering not implemented");
 
        case Q_ATALK:
                bpf_error("ATALK host filtering not implemented");
 
@@ -1655,6 +1928,9 @@ gen_host(addr, mask, proto, dir)
        case Q_IPX:
                bpf_error("IPX host filtering not implemented");
 
        case Q_IPX:
                bpf_error("IPX host filtering not implemented");
 
+       case Q_NETBEUI:
+               bpf_error("'netbeui' modifier applied to host");
+
        default:
                abort();
        }
        default:
                abort();
        }
@@ -1683,6 +1959,9 @@ gen_host6(addr, mask, proto, dir)
        case Q_ARP:
                bpf_error("'arp' modifier applied to ip6 host");
 
        case Q_ARP:
                bpf_error("'arp' modifier applied to ip6 host");
 
+       case Q_SCTP:
+               bpf_error("'sctp' modifier applied to host");
+
        case Q_TCP:
                bpf_error("'tcp' modifier applied to host");
 
        case Q_TCP:
                bpf_error("'tcp' modifier applied to host");
 
@@ -1701,6 +1980,9 @@ gen_host6(addr, mask, proto, dir)
        case Q_PIM:
                bpf_error("'pim' modifier applied to host");
 
        case Q_PIM:
                bpf_error("'pim' modifier applied to host");
 
+       case Q_VRRP:
+               bpf_error("'vrrp' modifier applied to host");
+
        case Q_ATALK:
                bpf_error("ATALK host filtering not implemented");
 
        case Q_ATALK:
                bpf_error("ATALK host filtering not implemented");
 
@@ -1753,6 +2035,9 @@ gen_host6(addr, mask, proto, dir)
        case Q_IPX:
                bpf_error("IPX host filtering not implemented");
 
        case Q_IPX:
                bpf_error("IPX host filtering not implemented");
 
+       case Q_NETBEUI:
+               bpf_error("'netbeui' modifier applied to host");
+
        default:
                abort();
        }
        default:
                abort();
        }
@@ -1814,6 +2099,14 @@ gen_proto_abbrev(proto)
 
        switch (proto) {
 
 
        switch (proto) {
 
+       case Q_SCTP:
+               b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT);
+#ifdef INET6
+               b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT);
+               gen_or(b0, b1);
+#endif
+               break;
+
        case Q_TCP:
                b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
 #ifdef INET6
        case Q_TCP:
                b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
 #ifdef INET6
@@ -1861,6 +2154,14 @@ gen_proto_abbrev(proto)
 #endif
                break;
 
 #endif
                break;
 
+#ifndef IPPROTO_VRRP
+#define IPPROTO_VRRP   112
+#endif
+
+       case Q_VRRP:
+               b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT);
+               break;
+
        case Q_IP:
                b1 =  gen_linktype(ETHERTYPE_IP);
                break;
        case Q_IP:
                b1 =  gen_linktype(ETHERTYPE_IP);
                break;
@@ -1940,7 +2241,7 @@ gen_proto_abbrev(proto)
                break;
 
        case Q_ISO:
                break;
 
        case Q_ISO:
-               b1 = gen_linktype(LLC_ISO_LSAP);
+               b1 = gen_linktype(LLCSAP_ISONS);
                break;
 
        case Q_ESIS:
                break;
 
        case Q_ESIS:
@@ -1956,11 +2257,15 @@ gen_proto_abbrev(proto)
                break;
 
        case Q_STP:
                break;
 
        case Q_STP:
-               b1 = gen_linktype(LLC_STP_LSAP);
+               b1 = gen_linktype(LLCSAP_8021D);
                break;
 
        case Q_IPX:
                break;
 
        case Q_IPX:
-               b1 = gen_linktype(LLC_IPX_LSAP);
+               b1 = gen_linktype(LLCSAP_IPX);
+               break;
+
+       case Q_NETBEUI:
+               b1 = gen_linktype(LLCSAP_NETBEUI);
                break;
 
        default:
                break;
 
        default:
@@ -2072,6 +2377,7 @@ gen_port(port, ip_proto, dir)
        switch (ip_proto) {
        case IPPROTO_UDP:
        case IPPROTO_TCP:
        switch (ip_proto) {
        case IPPROTO_UDP:
        case IPPROTO_TCP:
+       case IPPROTO_SCTP:
                b1 = gen_portop(port, ip_proto, dir);
                break;
 
                b1 = gen_portop(port, ip_proto, dir);
                break;
 
@@ -2079,6 +2385,8 @@ gen_port(port, ip_proto, dir)
                tmp = gen_portop(port, IPPROTO_TCP, dir);
                b1 = gen_portop(port, IPPROTO_UDP, dir);
                gen_or(tmp, b1);
                tmp = gen_portop(port, IPPROTO_TCP, dir);
                b1 = gen_portop(port, IPPROTO_UDP, dir);
                gen_or(tmp, b1);
+               tmp = gen_portop(port, IPPROTO_SCTP, dir);
+               gen_or(tmp, b1);
                break;
 
        default:
                break;
 
        default:
@@ -2142,6 +2450,7 @@ gen_port6(port, ip_proto, dir)
        switch (ip_proto) {
        case IPPROTO_UDP:
        case IPPROTO_TCP:
        switch (ip_proto) {
        case IPPROTO_UDP:
        case IPPROTO_TCP:
+       case IPPROTO_SCTP:
                b1 = gen_portop6(port, ip_proto, dir);
                break;
 
                b1 = gen_portop6(port, ip_proto, dir);
                break;
 
@@ -2149,6 +2458,8 @@ gen_port6(port, ip_proto, dir)
                tmp = gen_portop6(port, IPPROTO_TCP, dir);
                b1 = gen_portop6(port, IPPROTO_UDP, dir);
                gen_or(tmp, b1);
                tmp = gen_portop6(port, IPPROTO_TCP, dir);
                b1 = gen_portop6(port, IPPROTO_UDP, dir);
                gen_or(tmp, b1);
+               tmp = gen_portop6(port, IPPROTO_SCTP, dir);
+               gen_or(tmp, b1);
                break;
 
        default:
                break;
 
        default:
@@ -2170,6 +2481,7 @@ lookup_proto(name, proto)
 
        case Q_DEFAULT:
        case Q_IP:
 
        case Q_DEFAULT:
        case Q_IP:
+       case Q_IPV6:
                v = pcap_nametoproto(name);
                if (v == PROTO_UNDEF)
                        bpf_error("unknown ip proto '%s'", name);
                v = pcap_nametoproto(name);
                if (v == PROTO_UNDEF)
                        bpf_error("unknown ip proto '%s'", name);
@@ -2534,8 +2846,8 @@ gen_proto(v, proto, dir)
                return b1;
 
        case Q_ISO:
                return b1;
 
        case Q_ISO:
-               b0 = gen_linktype(LLC_ISO_LSAP);
-               b1 = gen_cmp(off_nl + 3, BPF_B, (long)v);
+               b0 = gen_linktype(LLCSAP_ISONS);
+               b1 = gen_cmp(off_nl_nosnap, BPF_B, (long)v);
                gen_and(b0, b1);
                return b1;
 
                gen_and(b0, b1);
                return b1;
 
@@ -2582,6 +2894,10 @@ gen_proto(v, proto, dir)
                bpf_error("'tcp proto' is bogus");
                /* NOTREACHED */
 
                bpf_error("'tcp proto' is bogus");
                /* NOTREACHED */
 
+       case Q_SCTP:
+               bpf_error("'sctp proto' is bogus");
+               /* NOTREACHED */
+
        case Q_ICMP:
                bpf_error("'icmp proto' is bogus");
                /* NOTREACHED */
        case Q_ICMP:
                bpf_error("'icmp proto' is bogus");
                /* NOTREACHED */
@@ -2598,6 +2914,10 @@ gen_proto(v, proto, dir)
                bpf_error("'pim proto' is bogus");
                /* NOTREACHED */
 
                bpf_error("'pim proto' is bogus");
                /* NOTREACHED */
 
+       case Q_VRRP:
+               bpf_error("'vrrp proto' is bogus");
+               /* NOTREACHED */
+
 #ifdef INET6
        case Q_IPV6:
                b0 = gen_linktype(ETHERTYPE_IPV6);
 #ifdef INET6
        case Q_IPV6:
                b0 = gen_linktype(ETHERTYPE_IPV6);
@@ -2625,6 +2945,9 @@ gen_proto(v, proto, dir)
        case Q_IPX:
                bpf_error("'ipx proto' is bogus");
 
        case Q_IPX:
                bpf_error("'ipx proto' is bogus");
 
+       case Q_NETBEUI:
+               bpf_error("'netbeui proto' is bogus");
+
        default:
                abort();
                /* NOTREACHED */
        default:
                abort();
                /* NOTREACHED */
@@ -2678,21 +3001,27 @@ gen_scode(name, q)
                                if (eaddr == NULL)
                                        bpf_error(
                                            "unknown ether host '%s'", name);
                                if (eaddr == NULL)
                                        bpf_error(
                                            "unknown ether host '%s'", name);
-                               return gen_ehostop(eaddr, dir);
+                               b = gen_ehostop(eaddr, dir);
+                               free(eaddr);
+                               return b;
 
                        case DLT_FDDI:
                                eaddr = pcap_ether_hostton(name);
                                if (eaddr == NULL)
                                        bpf_error(
                                            "unknown FDDI host '%s'", name);
 
                        case DLT_FDDI:
                                eaddr = pcap_ether_hostton(name);
                                if (eaddr == NULL)
                                        bpf_error(
                                            "unknown FDDI host '%s'", name);
-                               return gen_fhostop(eaddr, dir);
+                               b = gen_fhostop(eaddr, dir);
+                               free(eaddr);
+                               return b;
 
                        case DLT_IEEE802:
                                eaddr = pcap_ether_hostton(name);
                                if (eaddr == NULL)
                                        bpf_error(
                                            "unknown token ring host '%s'", name);
 
                        case DLT_IEEE802:
                                eaddr = pcap_ether_hostton(name);
                                if (eaddr == NULL)
                                        bpf_error(
                                            "unknown token ring host '%s'", name);
-                               return gen_thostop(eaddr, dir);
+                               b = gen_thostop(eaddr, dir);
+                               free(eaddr);
+                               return b;
 
                        default:
                                bpf_error(
 
                        default:
                                bpf_error(
@@ -2753,6 +3082,8 @@ gen_scode(name, q)
                                        tmp = gen_host6(&sin6->sin6_addr,
                                                &mask128, tproto6, dir);
                                        break;
                                        tmp = gen_host6(&sin6->sin6_addr,
                                                &mask128, tproto6, dir);
                                        break;
+                               default:
+                                       continue;
                                }
                                if (b)
                                        gen_or(b, tmp);
                                }
                                if (b)
                                        gen_or(b, tmp);
@@ -2770,13 +3101,16 @@ gen_scode(name, q)
                }
 
        case Q_PORT:
                }
 
        case Q_PORT:
-               if (proto != Q_DEFAULT && proto != Q_UDP && proto != Q_TCP)
+               if (proto != Q_DEFAULT &&
+                   proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
                        bpf_error("illegal qualifier of 'port'");
                if (pcap_nametoport(name, &port, &real_proto) == 0)
                        bpf_error("unknown port '%s'", name);
                if (proto == Q_UDP) {
                        if (real_proto == IPPROTO_TCP)
                                bpf_error("port '%s' is tcp", name);
                        bpf_error("illegal qualifier of 'port'");
                if (pcap_nametoport(name, &port, &real_proto) == 0)
                        bpf_error("unknown port '%s'", name);
                if (proto == Q_UDP) {
                        if (real_proto == IPPROTO_TCP)
                                bpf_error("port '%s' is tcp", name);
+                       else if (real_proto == IPPROTO_SCTP)
+                               bpf_error("port '%s' is sctp", name);
                        else
                                /* override PROTO_UNDEF */
                                real_proto = IPPROTO_UDP;
                        else
                                /* override PROTO_UNDEF */
                                real_proto = IPPROTO_UDP;
@@ -2784,10 +3118,23 @@ gen_scode(name, q)
                if (proto == Q_TCP) {
                        if (real_proto == IPPROTO_UDP)
                                bpf_error("port '%s' is udp", name);
                if (proto == Q_TCP) {
                        if (real_proto == IPPROTO_UDP)
                                bpf_error("port '%s' is udp", name);
+
+                       else if (real_proto == IPPROTO_SCTP)
+                               bpf_error("port '%s' is sctp", name);
                        else
                                /* override PROTO_UNDEF */
                                real_proto = IPPROTO_TCP;
                }
                        else
                                /* override PROTO_UNDEF */
                                real_proto = IPPROTO_TCP;
                }
+               if (proto == Q_SCTP) {
+                       if (real_proto == IPPROTO_UDP)
+                               bpf_error("port '%s' is udp", name);
+
+                       else if (real_proto == IPPROTO_TCP)
+                               bpf_error("port '%s' is tcp", name);
+                       else
+                               /* override PROTO_UNDEF */
+                               real_proto = IPPROTO_SCTP;
+               }
 #ifndef INET6
                return gen_port(port, real_proto, dir);
 #else
 #ifndef INET6
                return gen_port(port, real_proto, dir);
 #else
@@ -2808,7 +3155,9 @@ gen_scode(name, q)
                alist = pcap_nametoaddr(name);
                if (alist == NULL || *alist == NULL)
                        bpf_error("unknown host '%s'", name);
                alist = pcap_nametoaddr(name);
                if (alist == NULL || *alist == NULL)
                        bpf_error("unknown host '%s'", name);
-               return gen_gateway(eaddr, alist, proto, dir);
+               b = gen_gateway(eaddr, alist, proto, dir);
+               free(eaddr);
+               return b;
 #else
                bpf_error("'gateway' not supported in this configuration");
 #endif /*INET6*/
 #else
                bpf_error("'gateway' not supported in this configuration");
 #endif /*INET6*/
@@ -2925,6 +3274,8 @@ gen_ncode(s, v, q)
                        proto = IPPROTO_UDP;
                else if (proto == Q_TCP)
                        proto = IPPROTO_TCP;
                        proto = IPPROTO_UDP;
                else if (proto == Q_TCP)
                        proto = IPPROTO_TCP;
+               else if (proto == Q_SCTP)
+                       proto = IPPROTO_SCTP;
                else if (proto == Q_DEFAULT)
                        proto = PROTO_UNDEF;
                else
                else if (proto == Q_DEFAULT)
                        proto = PROTO_UNDEF;
                else
@@ -2987,6 +3338,7 @@ gen_mcode6(s1, s2, masklen, q)
 
        if (sizeof(mask) * 8 < masklen)
                bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
 
        if (sizeof(mask) * 8 < masklen)
                bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
+       memset(&mask, 0, sizeof(mask));
        memset(&mask, 0xff, masklen / 8);
        if (masklen % 8) {
                mask.s6_addr[masklen / 8] =
        memset(&mask, 0xff, masklen / 8);
        if (masklen % 8) {
                mask.s6_addr[masklen / 8] =
@@ -3137,12 +3489,14 @@ gen_load(proto, index, size)
                index->b = b;
                break;
 
                index->b = b;
                break;
 
+       case Q_SCTP:
        case Q_TCP:
        case Q_UDP:
        case Q_ICMP:
        case Q_IGMP:
        case Q_IGRP:
        case Q_PIM:
        case Q_TCP:
        case Q_UDP:
        case Q_ICMP:
        case Q_IGMP:
        case Q_IGRP:
        case Q_PIM:
+       case Q_VRRP:
                s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
                s->s.k = off_nl;
                sappend(s, xfer_to_a(index));
                s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
                s->s.k = off_nl;
                sappend(s, xfer_to_a(index));
@@ -3417,6 +3771,8 @@ gen_byteop(op, idx, val)
        return b;
 }
 
        return b;
 }
 
+static u_char abroadcast[] = { 0x0 };
+
 struct block *
 gen_broadcast(proto)
        int proto;
 struct block *
 gen_broadcast(proto)
        int proto;
@@ -3429,6 +3785,8 @@ gen_broadcast(proto)
 
        case Q_DEFAULT:
        case Q_LINK:
 
        case Q_DEFAULT:
        case Q_LINK:
+               if (linktype == DLT_ARCNET)
+                       return gen_ahostop(abroadcast, Q_DST);
                if (linktype == DLT_EN10MB)
                        return gen_ehostop(ebroadcast, Q_DST);
                if (linktype == DLT_FDDI)
                if (linktype == DLT_EN10MB)
                        return gen_ehostop(ebroadcast, Q_DST);
                if (linktype == DLT_FDDI)
@@ -3462,6 +3820,10 @@ gen_multicast(proto)
 
        case Q_DEFAULT:
        case Q_LINK:
 
        case Q_DEFAULT:
        case Q_LINK:
+               if (linktype == DLT_ARCNET)
+                       /* all ARCnet multicasts use the same address */
+                       return gen_ahostop(abroadcast, Q_DST);
+
                if (linktype == DLT_EN10MB) {
                        /* ether[0] & 1 != 0 */
                        s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
                if (linktype == DLT_EN10MB) {
                        /* ether[0] & 1 != 0 */
                        s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
@@ -3539,6 +3901,51 @@ gen_inbound(dir)
        return (b0);
 }
 
        return (b0);
 }
 
+struct block *
+gen_acode(eaddr, q)
+       register const u_char *eaddr;
+       struct qual q;
+{
+       if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
+               if (linktype == DLT_ARCNET)
+                       return gen_ahostop(eaddr, (int)q.dir);
+       }
+       bpf_error("ARCnet address used in non-arc expression");
+       /* NOTREACHED */
+}
+
+static struct block *
+gen_ahostop(eaddr, dir)
+       register const u_char *eaddr;
+       register int dir;
+{
+       register struct block *b0, *b1;
+
+       switch (dir) {
+       /* src comes first, different from Ethernet */
+       case Q_SRC:
+               return gen_bcmp(0, 1, eaddr);
+
+       case Q_DST:
+               return gen_bcmp(1, 1, eaddr);
+
+       case Q_AND:
+               b0 = gen_ahostop(eaddr, Q_SRC);
+               b1 = gen_ahostop(eaddr, Q_DST);
+               gen_and(b0, b1);
+               return b1;
+
+       case Q_DEFAULT:
+       case Q_OR:
+               b0 = gen_ahostop(eaddr, Q_SRC);
+               b1 = gen_ahostop(eaddr, Q_DST);
+               gen_or(b0, b1);
+               return b1;
+       }
+       abort();
+       /* NOTREACHED */
+}
+
 /*
  * support IEEE 802.1Q VLAN trunk over ethernet
  */
 /*
  * support IEEE 802.1Q VLAN trunk over ethernet
  */
@@ -3546,7 +3953,6 @@ struct block *
 gen_vlan(vlan_num)
        int vlan_num;
 {
 gen_vlan(vlan_num)
        int vlan_num;
 {
-       static u_int    orig_linktype = -1, orig_nl = -1;
        struct  block   *b0;
 
        /*
        struct  block   *b0;
 
        /*
@@ -3556,11 +3962,13 @@ gen_vlan(vlan_num)
        if (orig_nl == (u_int)-1) {
                orig_linktype = off_linktype;   /* save original values */
                orig_nl = off_nl;
        if (orig_nl == (u_int)-1) {
                orig_linktype = off_linktype;   /* save original values */
                orig_nl = off_nl;
+               orig_nl_nosnap = off_nl_nosnap;
 
                switch (linktype) {
 
                case DLT_EN10MB:
                        off_linktype = 16;
 
                switch (linktype) {
 
                case DLT_EN10MB:
                        off_linktype = 16;
+                       off_nl_nosnap = 18;
                        off_nl = 18;
                        break;
 
                        off_nl = 18;
                        break;
 
[mirror] the LIBpcap interface to various kernel packet capture mechanism