X-Git-Url: https://git.tcpdump.org/libpcap/blobdiff_plain/0f740c78ff4523165a177d3258da8e8872096301..fda83a89fd2600d23f669f8c48bea820a988008c:/gencode.c

diff --git a/gencode.c b/gencode.c
index 6f03326c..090a8ed3 100644
--- a/gencode.c
+++ b/gencode.c
@@ -103,6 +103,10 @@
 
 #define ETHERMTU	1500
 
+#ifndef ETHERTYPE_TEB
+#define ETHERTYPE_TEB 0x6558
+#endif
+
 #ifndef IPPROTO_HOPOPTS
 #define IPPROTO_HOPOPTS 0
 #endif
@@ -119,6 +123,8 @@
 #define IPPROTO_SCTP 132
 #endif
 
+#define GENEVE_PORT 6081
+
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
 #endif
@@ -195,6 +201,7 @@ enum e_offrel {
 	OR_PREVLINKHDR,		/* previous link-layer header */
 	OR_LLC,			/* 802.2 LLC header */
 	OR_PREVMPLSHDR,		/* previous MPLS header */
+	OR_LINKTYPE,		/* link-layer type */
 	OR_LINKPL,		/* link-layer payload */
 	OR_LINKPL_NOSNAP,	/* link-layer payload, with no SNAP header at the link layer */
 	OR_TRAN_IPV4,		/* transport-layer header, with IPv4 network layer */
@@ -308,6 +315,7 @@ static struct slist *xfer_to_a(struct arth *);
 static struct block *gen_mac_multicast(int);
 static struct block *gen_len(int, int);
 static struct block *gen_check_802_11_data_frame(void);
+static struct block *gen_geneve_ll_check(void);
 
 static struct block *gen_ppi_dlt_check(void);
 static struct block *gen_msg_abbrev(int type);
@@ -825,6 +833,7 @@ static bpf_abs_offset off_outermostlinkhdr;
 	off_linkhdr.is_variable = new_is_variable; \
 	off_linkhdr.constant_part = new_constant_part; \
 	off_linkhdr.reg = new_reg; \
+	is_geneve = 0; \
 }
 
 /*
@@ -834,10 +843,8 @@ static bpf_abs_offset off_linkpl;
 
 /*
  * "off_linktype" is the offset to information in the link-layer header
- * giving the packet type.  This offset is relative to the beginning
- * of the link-layer header - i.e., it doesn't include off_linkhdr.constant_part - so
- * loads with an offset that includes "off_linktype" should use
- * OR_LINKHDR.
+ * giving the packet type. This is an absolute offset from the beginning
+ * of the packet.
  *
  * For Ethernet, it's the offset of the Ethernet type field; this
  * means that it must have a value that skips VLAN tags.
@@ -854,15 +861,23 @@ static bpf_abs_offset off_linkpl;
  *
  * For Linux cooked sockets, it's the offset of the type field.
  *
- * It's set to -1 for no encapsulation, in which case, IP is assumed.
+ * off_linktype.constant_part is set to -1 for no encapsulation,
+ * in which case, IP is assumed.
  */
-static u_int off_linktype;
+static bpf_abs_offset off_linktype;
 
 /*
  * TRUE if the link layer includes an ATM pseudo-header.
  */
 static int is_atm = 0;
 
+/*
+ * TRUE if "geneve" appeared in the filter; it causes us to generate
+ * code that checks for a Geneve header and assume that later filters
+ * apply to the encapsulated payload.
+ */
+static int is_geneve = 0;
+
 /*
  * These are offsets for the ATM pseudo-header.
  */
@@ -952,6 +967,10 @@ init_linktype(p)
 	off_linkpl.is_variable = 0;
 	off_linkpl.reg = -1;
 
+	off_linktype.constant_part = 0;
+	off_linktype.is_variable = 0;
+	off_linktype.reg = -1;
+
 	/*
 	 * Assume it's not raw ATM with a pseudo-header, for now.
 	 */
@@ -961,6 +980,11 @@ init_linktype(p)
 	off_proto = -1;
 	off_payload = -1;
 
+	/*
+	 * And not Geneve.
+	 */
+	is_geneve = 0;
+
 	/*
 	 * And assume we're not doing SS7.
 	 */
@@ -977,21 +1001,21 @@ init_linktype(p)
 	switch (linktype) {
 
 	case DLT_ARCNET:
-		off_linktype = 2;
+		off_linktype.constant_part = 2;
 		off_linkpl.constant_part = 6;
 		off_nl = 0;		/* XXX in reality, variable! */
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		break;
 
 	case DLT_ARCNET_LINUX:
-		off_linktype = 4;
+		off_linktype.constant_part = 4;
 		off_linkpl.constant_part = 8;
 		off_nl = 0;		/* XXX in reality, variable! */
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		break;
 
 	case DLT_EN10MB:
-		off_linktype = 12;
+		off_linktype.constant_part = 12;
 		off_linkpl.constant_part = 14;	/* Ethernet header length */
 		off_nl = 0;		/* Ethernet II */
 		off_nl_nosnap = 3;	/* 802.3+802.2 */
@@ -1002,7 +1026,7 @@ init_linktype(p)
 		 * SLIP doesn't have a link level type.  The 16 byte
 		 * header is hacked into our SLIP driver.
 		 */
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = 16;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1010,7 +1034,7 @@ init_linktype(p)
 
 	case DLT_SLIP_BSDOS:
 		/* XXX this may be the same as the DLT_PPP_BSDOS case */
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		/* XXX end */
 		off_linkpl.constant_part = 24;
 		off_nl = 0;
@@ -1019,14 +1043,14 @@ init_linktype(p)
 
 	case DLT_NULL:
 	case DLT_LOOP:
-		off_linktype = 0;
+		off_linktype.constant_part = 0;
 		off_linkpl.constant_part = 4;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		break;
 
 	case DLT_ENC:
-		off_linktype = 0;
+		off_linktype.constant_part = 0;
 		off_linkpl.constant_part = 12;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1036,7 +1060,7 @@ init_linktype(p)
 	case DLT_PPP_PPPD:
 	case DLT_C_HDLC:		/* BSD/OS Cisco HDLC */
 	case DLT_PPP_SERIAL:		/* NetBSD sync/async serial PPP */
-		off_linktype = 2;	/* skip HDLC-like framing */
+		off_linktype.constant_part = 2;	/* skip HDLC-like framing */
 		off_linkpl.constant_part = 4;	/* skip HDLC-like framing and protocol field */
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1047,14 +1071,14 @@ init_linktype(p)
 		 * This does no include the Ethernet header, and
 		 * only covers session state.
 		 */
-		off_linktype = 6;
+		off_linktype.constant_part = 6;
 		off_linkpl.constant_part = 8;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		break;
 
 	case DLT_PPP_BSDOS:
-		off_linktype = 5;
+		off_linktype.constant_part = 5;
 		off_linkpl.constant_part = 24;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1069,8 +1093,8 @@ init_linktype(p)
 		 * is being used and pick out the encapsulated Ethernet type.
 		 * XXX - should we generate code to check for SNAP?
 		 */
-		off_linktype = 13;
-		off_linktype += pcap_fddipad;
+		off_linktype.constant_part = 13;
+		off_linktype.constant_part += pcap_fddipad;
 		off_linkpl.constant_part = 13;	/* FDDI MAC header length */
 		off_linkpl.constant_part += pcap_fddipad;
 		off_nl = 8;		/* 802.2+SNAP */
@@ -1101,7 +1125,7 @@ init_linktype(p)
 		 * the 16-bit value at an offset of 14 (shifted right
 		 * 8 - figure out which byte that is).
 		 */
-		off_linktype = 14;
+		off_linktype.constant_part = 14;
 		off_linkpl.constant_part = 14;	/* Token Ring MAC header length */
 		off_nl = 8;		/* 802.2+SNAP */
 		off_nl_nosnap = 3;	/* 802.2 */
@@ -1117,7 +1141,8 @@ init_linktype(p)
 	case DLT_IEEE802_11:
 		/*
 		 * 802.11 doesn't really have a link-level type field.
-		 * We set "off_linktype" to the offset of the LLC header.
+		 * We set "off_linktype.constant_part" to the offset of
+		 * the LLC header.
 		 *
 		 * To check for Ethernet types, we assume that SSAP = SNAP
 		 * is being used and pick out the encapsulated Ethernet type.
@@ -1132,7 +1157,7 @@ init_linktype(p)
 		 * header or an AVS header, so, in practice, it's
 		 * variable-length.
 		 */
-		off_linktype = 24;
+		off_linktype.constant_part = 24;
 		off_linkpl.constant_part = 0;	/* link-layer header is variable-length */
 		off_linkpl.is_variable = 1;
 		off_nl = 8;		/* 802.2+SNAP */
@@ -1149,7 +1174,7 @@ init_linktype(p)
 		 * the encapsulated DLT should be DLT_IEEE802_11) we
 		 * generate code to check for this too.
 		 */
-		off_linktype = 24;
+		off_linktype.constant_part = 24;
 		off_linkpl.constant_part = 0;	/* link-layer header is variable-length */
 		off_linkpl.is_variable = 1;
 		off_linkhdr.is_variable = 1;
@@ -1170,7 +1195,7 @@ init_linktype(p)
 		 * or "pppoa and tcp port 80" and have it check for
 		 * PPPo{A,E} and a PPP protocol of IP and....
 		 */
-		off_linktype = 0;
+		off_linktype.constant_part = 0;
 		off_linkpl.constant_part = 0;	/* packet begins with LLC header */
 		off_nl = 8;		/* 802.2+SNAP */
 		off_nl_nosnap = 3;	/* 802.2 */
@@ -1186,7 +1211,7 @@ init_linktype(p)
 		off_vci = SUNATM_VCI_POS;
 		off_proto = PROTO_POS;
 		off_payload = SUNATM_PKT_BEGIN_POS;
-		off_linktype = off_payload;
+		off_linktype.constant_part = off_payload;
 		off_linkpl.constant_part = off_payload;	/* if LLC-encapsulated */
 		off_nl = 8;		/* 802.2+SNAP */
 		off_nl_nosnap = 3;	/* 802.2 */
@@ -1195,14 +1220,14 @@ init_linktype(p)
 	case DLT_RAW:
 	case DLT_IPV4:
 	case DLT_IPV6:
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = 0;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		break;
 
 	case DLT_LINUX_SLL:	/* fake header for Linux cooked socket */
-		off_linktype = 14;
+		off_linktype.constant_part = 14;
 		off_linkpl.constant_part = 16;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1214,7 +1239,7 @@ init_linktype(p)
 		 * but really it just indicates whether there is a "short" or
 		 * "long" DDP packet following.
 		 */
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = 0;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1231,7 +1256,7 @@ init_linktype(p)
 		 * XXX - should we generate code to check for SNAP? RFC
 		 * 2625 says SNAP should be used.
 		 */
-		off_linktype = 16;
+		off_linktype.constant_part = 16;
 		off_linkpl.constant_part = 16;
 		off_nl = 8;		/* 802.2+SNAP */
 		off_nl_nosnap = 3;	/* 802.2 */
@@ -1242,7 +1267,7 @@ init_linktype(p)
 		 * XXX - we should set this to handle SNAP-encapsulated
 		 * frames (NLPID of 0x80).
 		 */
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = 0;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1254,21 +1279,21 @@ init_linktype(p)
                  * so lets start with offset 4 for now and increments later on (FIXME);
                  */
 	case DLT_MFR:
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = 0;
 		off_nl = 4;
 		off_nl_nosnap = 0;	/* XXX - for now -> no 802.2 LLC */
 		break;
 
 	case DLT_APPLE_IP_OVER_IEEE1394:
-		off_linktype = 16;
+		off_linktype.constant_part = 16;
 		off_linkpl.constant_part = 18;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		break;
 
 	case DLT_SYMANTEC_FIREWALL:
-		off_linktype = 6;
+		off_linktype.constant_part = 6;
 		off_linkpl.constant_part = 44;
 		off_nl = 0;		/* Ethernet II */
 		off_nl_nosnap = 0;	/* XXX - what does it do with 802.3 packets? */
@@ -1276,7 +1301,7 @@ init_linktype(p)
 
 #ifdef HAVE_NET_PFVAR_H
 	case DLT_PFLOG:
-		off_linktype = 0;
+		off_linktype.constant_part = 0;
 		off_linkpl.constant_part = PFLOG_HDRLEN;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
@@ -1289,21 +1314,21 @@ init_linktype(p)
         case DLT_JUNIPER_PPP:
         case DLT_JUNIPER_CHDLC:
         case DLT_JUNIPER_FRELAY:
-                off_linktype = 4;
+                off_linktype.constant_part = 4;
 		off_linkpl.constant_part = 4;
 		off_nl = 0;
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
                 break;
 
 	case DLT_JUNIPER_ATM1:
-		off_linktype = 4;		/* in reality variable between 4-8 */
+		off_linktype.constant_part = 4;		/* in reality variable between 4-8 */
 		off_linkpl.constant_part = 4;	/* in reality variable between 4-8 */
 		off_nl = 0;
 		off_nl_nosnap = 10;
 		break;
 
 	case DLT_JUNIPER_ATM2:
-		off_linktype = 8;		/* in reality variable between 8-12 */
+		off_linktype.constant_part = 8;		/* in reality variable between 8-12 */
 		off_linkpl.constant_part = 8;	/* in reality variable between 8-12 */
 		off_nl = 0;
 		off_nl_nosnap = 10;
@@ -1314,69 +1339,69 @@ init_linktype(p)
 	case DLT_JUNIPER_PPPOE:
         case DLT_JUNIPER_ETHER:
         	off_linkpl.constant_part = 14;
-		off_linktype = 16;
+		off_linktype.constant_part = 16;
 		off_nl = 18;		/* Ethernet II */
 		off_nl_nosnap = 21;	/* 802.3+802.2 */
 		break;
 
 	case DLT_JUNIPER_PPPOE_ATM:
-		off_linktype = 4;
+		off_linktype.constant_part = 4;
 		off_linkpl.constant_part = 6;
 		off_nl = 0;
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		break;
 
 	case DLT_JUNIPER_GGSN:
-		off_linktype = 6;
+		off_linktype.constant_part = 6;
 		off_linkpl.constant_part = 12;
 		off_nl = 0;
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		break;
 
 	case DLT_JUNIPER_ES:
-		off_linktype = 6;
+		off_linktype.constant_part = 6;
 		off_linkpl.constant_part = -1;	/* not really a network layer but raw IP addresses */
 		off_nl = -1;		/* not really a network layer but raw IP addresses */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		break;
 
 	case DLT_JUNIPER_MONITOR:
-		off_linktype = 12;
+		off_linktype.constant_part = 12;
 		off_linkpl.constant_part = 12;
 		off_nl = 0;		/* raw IP/IP6 header */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		break;
 
 	case DLT_BACNET_MS_TP:
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		break;
 
 	case DLT_JUNIPER_SERVICES:
-		off_linktype = 12;
+		off_linktype.constant_part = 12;
 		off_linkpl.constant_part = -1;	/* L3 proto location dep. on cookie type */
 		off_nl = -1;		/* L3 proto location dep. on cookie type */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		break;
 
 	case DLT_JUNIPER_VP:
-		off_linktype = 18;
+		off_linktype.constant_part = 18;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		break;
 
 	case DLT_JUNIPER_ST:
-		off_linktype = 18;
+		off_linktype.constant_part = 18;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		break;
 
 	case DLT_JUNIPER_ISM:
-		off_linktype = 8;
+		off_linktype.constant_part = 8;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
@@ -1386,7 +1411,7 @@ init_linktype(p)
 	case DLT_JUNIPER_SRX_E2E:
 	case DLT_JUNIPER_FIBRECHANNEL:
 	case DLT_JUNIPER_ATM_CEMIC:
-		off_linktype = 8;
+		off_linktype.constant_part = 8;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
@@ -1399,7 +1424,7 @@ init_linktype(p)
 		off_opc = 4;
 		off_dpc = 4;
 		off_sls = 7;
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
@@ -1412,7 +1437,7 @@ init_linktype(p)
 		off_opc = 8;
 		off_dpc = 8;
 		off_sls = 11;
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
@@ -1425,14 +1450,14 @@ init_linktype(p)
 		off_opc = 24;
 		off_dpc = 24;
 		off_sls = 27;
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		break;
 
 	case DLT_PFSYNC:
-		off_linktype = -1;
+		off_linktype.constant_part = -1;
 		off_linkpl.constant_part = 4;
 		off_nl = 0;
 		off_nl_nosnap = 0;
@@ -1442,14 +1467,14 @@ init_linktype(p)
 		/*
 		 * Currently, only raw "link[N:M]" filtering is supported.
 		 */
-		off_linktype = -1;	/* variable, min 15, max 71 steps of 7 */
+		off_linktype.constant_part = -1;	/* variable, min 15, max 71 steps of 7 */
 		off_linkpl.constant_part = -1;
 		off_nl = -1;		/* variable, min 16, max 71 steps of 7 */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		break;
 
 	case DLT_IPNET:
-		off_linktype = 1;
+		off_linktype.constant_part = 1;
 		off_linkpl.constant_part = 24;	/* ipnet header length */
 		off_nl = 0;
 		off_nl_nosnap = -1;
@@ -1457,7 +1482,7 @@ init_linktype(p)
 
 	case DLT_NETANALYZER:
 		off_linkhdr.constant_part = 4;	/* Ethernet header is past 4-byte pseudo-header */
-		off_linktype = 12;
+		off_linktype.constant_part = off_linkhdr.constant_part + 12;
 		off_linkpl.constant_part = off_linkhdr.constant_part + 14;	/* pseudo-header+Ethernet header length */
 		off_nl = 0;		/* Ethernet II */
 		off_nl_nosnap = 3;	/* 802.3+802.2 */
@@ -1465,7 +1490,7 @@ init_linktype(p)
 
 	case DLT_NETANALYZER_TRANSPARENT:
 		off_linkhdr.constant_part = 12;	/* MAC header is past 4-byte pseudo-header, preamble, and SFD */
-		off_linktype = 12;
+		off_linktype.constant_part = off_linkhdr.constant_part + 12;
 		off_linkpl.constant_part = off_linkhdr.constant_part + 14;	/* pseudo-header+preamble+SFD+Ethernet header length */
 		off_nl = 0;		/* Ethernet II */
 		off_nl_nosnap = 3;	/* 802.3+802.2 */
@@ -1478,7 +1503,7 @@ init_linktype(p)
 		 */
 		if (linktype >= DLT_MATCHING_MIN &&
 		    linktype <= DLT_MATCHING_MAX) {
-			off_linktype = -1;
+			off_linktype.constant_part = -1;
 			off_linkpl.constant_part = -1;
 			off_nl = -1;
 			off_nl_nosnap = -1;
@@ -1571,6 +1596,10 @@ gen_load_a(offrel, offset, size)
 		s = gen_load_absoffsetrel(&off_linkpl, off_nl_nosnap + offset, size);
 		break;
 
+	case OR_LINKTYPE:
+		s = gen_load_absoffsetrel(&off_linktype, offset, size);
+		break;
+
 	case OR_TRAN_IPV4:
 		/*
 		 * Load the X register with the length of the IPv4 header
@@ -1630,7 +1659,7 @@ gen_loadx_iphdrlen()
 		 * the value from the X register.
 		 */
 		s2 = new_stmt(BPF_LD|BPF_IND|BPF_B);
-		s2->s.k = off_nl;
+		s2->s.k = off_linkpl.constant_part + off_nl;
 		sappend(s, s2);
 		s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K);
 		s2->s.k = 0xf;
@@ -1733,7 +1762,7 @@ gen_ether_linktype(proto)
 		 * DSAP, as we do for other types <= ETHERMTU
 		 * (i.e., other SAP values)?
 		 */
-		b0 = gen_cmp_gt(OR_LINKHDR, off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINKTYPE, 0, BPF_H, ETHERMTU);
 		gen_not(b0);
 		b1 = gen_cmp(OR_LLC, 0, BPF_H, (bpf_int32)
 			     ((proto << 8) | proto));
@@ -1788,7 +1817,7 @@ gen_ether_linktype(proto)
 		 * Now we generate code to check for 802.3
 		 * frames in general.
 		 */
-		b0 = gen_cmp_gt(OR_LINKHDR, off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINKTYPE, 0, BPF_H, ETHERMTU);
 		gen_not(b0);
 
 		/*
@@ -1804,8 +1833,7 @@ gen_ether_linktype(proto)
 		 * do that before checking for the other frame
 		 * types.
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
-		    (bpf_int32)ETHERTYPE_IPX);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX);
 		gen_or(b0, b1);
 		return b1;
 
@@ -1821,7 +1849,7 @@ gen_ether_linktype(proto)
 		 * we check for an Ethernet type field less than
 		 * 1500, which means it's an 802.3 length field.
 		 */
-		b0 = gen_cmp_gt(OR_LINKHDR, off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINKTYPE, 0, BPF_H, ETHERMTU);
 		gen_not(b0);
 
 		/*
@@ -1846,7 +1874,7 @@ gen_ether_linktype(proto)
 		 * phase 1?); we just check for the Ethernet
 		 * protocol type.
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, (bpf_int32)proto);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
 
 		gen_or(b0, b1);
 		return b1;
@@ -1861,10 +1889,9 @@ gen_ether_linktype(proto)
 			 * a length field, <= ETHERMTU) and
 			 * then check the DSAP.
 			 */
-			b0 = gen_cmp_gt(OR_LINKHDR, off_linktype, BPF_H, ETHERMTU);
+			b0 = gen_cmp_gt(OR_LINKTYPE, 0, BPF_H, ETHERMTU);
 			gen_not(b0);
-			b1 = gen_cmp(OR_LINKHDR, off_linktype + 2, BPF_B,
-			    (bpf_int32)proto);
+			b1 = gen_cmp(OR_LINKTYPE, 2, BPF_B, (bpf_int32)proto);
 			gen_and(b0, b1);
 			return b1;
 		} else {
@@ -1877,7 +1904,7 @@ gen_ether_linktype(proto)
 			 * will fail and the frame won't match,
 			 * which is what we want).
 			 */
-			return gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
+			return gen_cmp(OR_LINKTYPE, 0, BPF_H,
 			    (bpf_int32)proto);
 		}
 	}
@@ -1894,12 +1921,11 @@ gen_ipnet_linktype(proto)
 	switch (proto) {
 
 	case ETHERTYPE_IP:
-		return gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
-		    (bpf_int32)IPH_AF_INET);
+		return gen_cmp(OR_LINKTYPE, 0, BPF_B, (bpf_int32)IPH_AF_INET);
 		/* NOTREACHED */
 
 	case ETHERTYPE_IPV6:
-		return gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+		return gen_cmp(OR_LINKTYPE, 0, BPF_B,
 		    (bpf_int32)IPH_AF_INET6);
 		/* NOTREACHED */
 
@@ -1941,7 +1967,7 @@ gen_linux_sll_linktype(proto)
 		 * DSAP, as we do for other types <= ETHERMTU
 		 * (i.e., other SAP values)?
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, LINUX_SLL_P_802_2);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
 		b1 = gen_cmp(OR_LLC, 0, BPF_H, (bpf_int32)
 			     ((proto << 8) | proto));
 		gen_and(b0, b1);
@@ -1976,14 +2002,14 @@ gen_linux_sll_linktype(proto)
 		b0 = gen_cmp(OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX);
 		b1 = gen_snap(0x000000, ETHERTYPE_IPX);
 		gen_or(b0, b1);
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, LINUX_SLL_P_802_2);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
 		gen_and(b0, b1);
 
 		/*
 		 * Now check for 802.3 frames and OR that with
 		 * the previous test.
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, LINUX_SLL_P_802_3);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_3);
 		gen_or(b0, b1);
 
 		/*
@@ -1991,8 +2017,7 @@ gen_linux_sll_linktype(proto)
 		 * do that before checking for the other frame
 		 * types.
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
-		    (bpf_int32)ETHERTYPE_IPX);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX);
 		gen_or(b0, b1);
 		return b1;
 
@@ -2008,7 +2033,7 @@ gen_linux_sll_linktype(proto)
 		 * we check for the 802.2 protocol type in the
 		 * "Ethernet type" field.
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, LINUX_SLL_P_802_2);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
 
 		/*
 		 * 802.2-encapsulated ETHERTYPE_ATALK packets are
@@ -2032,7 +2057,7 @@ gen_linux_sll_linktype(proto)
 		 * phase 1?); we just check for the Ethernet
 		 * protocol type.
 		 */
-		b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, (bpf_int32)proto);
+		b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
 
 		gen_or(b0, b1);
 		return b1;
@@ -2046,8 +2071,7 @@ gen_linux_sll_linktype(proto)
 			 * in the "Ethernet type" field, and
 			 * then check the DSAP.
 			 */
-			b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
-			    LINUX_SLL_P_802_2);
+			b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
 			b1 = gen_cmp(OR_LINKHDR, off_linkpl.constant_part, BPF_B,
 			     (bpf_int32)proto);
 			gen_and(b0, b1);
@@ -2062,8 +2086,7 @@ gen_linux_sll_linktype(proto)
 			 * will fail and the frame won't match,
 			 * which is what we want).
 			 */
-			return gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
-			    (bpf_int32)proto);
+			return gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
 		}
 	}
 }
@@ -2574,6 +2597,15 @@ insert_compute_vloffsets(b)
 {
 	struct slist *s;
 
+	/* There is an implicit dependency between the link
+	 * payload and link header since the payload computation
+	 * includes the variable part of the header. Therefore,
+	 * if nobody else has allocated a register for the link
+	 * header and we need it, do it now. */
+	if (off_linkpl.reg != -1 && off_linkhdr.is_variable &&
+	    off_linkhdr.reg == -1)
+		off_linkhdr.reg = alloc_reg();
+
 	/*
 	 * For link-layer types that have a variable-length header
 	 * preceding the link-layer header, generate code to load
@@ -2766,6 +2798,9 @@ gen_prevlinkhdr_check(void)
 {
 	struct block *b0;
 
+	if (is_geneve)
+		return gen_geneve_ll_check();
+
 	switch (prevlinktype) {
 
 	case DLT_SUNATM:
@@ -2827,7 +2862,13 @@ gen_linktype(proto)
 	case DLT_EN10MB:
 	case DLT_NETANALYZER:
 	case DLT_NETANALYZER_TRANSPARENT:
-		b0 = gen_prevlinkhdr_check();
+		/* Geneve has an EtherType regardless of whether there is an
+		 * L2 header. */
+		if (!is_geneve)
+			b0 = gen_prevlinkhdr_check();
+		else
+			b0 = NULL;
+
 		b1 = gen_ether_linktype(proto);
 		if (b0 != NULL)
 			gen_and(b0, b1);
@@ -2843,8 +2884,7 @@ gen_linktype(proto)
 			/* fall through */
 
 		default:
-			return gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
-			    (bpf_int32)proto);
+			return gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
 			/*NOTREACHED*/
 			break;
 		}
@@ -2971,7 +3011,7 @@ gen_linktype(proto)
 		 * map them to the corresponding PPP protocol types.
 		 */
 		proto = ethertype_to_ppptype(proto);
-		return gen_cmp(OR_LINKHDR, off_linktype, BPF_H, (bpf_int32)proto);
+		return gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
 		/*NOTREACHED*/
 		break;
 
@@ -2987,16 +3027,16 @@ gen_linktype(proto)
 			 * Also check for Van Jacobson-compressed IP.
 			 * XXX - do this for other forms of PPP?
 			 */
-			b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, PPP_IP);
-			b1 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, PPP_VJC);
+			b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, PPP_IP);
+			b1 = gen_cmp(OR_LINKTYPE, 0, BPF_H, PPP_VJC);
 			gen_or(b0, b1);
-			b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_H, PPP_VJNC);
+			b0 = gen_cmp(OR_LINKTYPE, 0, BPF_H, PPP_VJNC);
 			gen_or(b1, b0);
 			return b0;
 
 		default:
 			proto = ethertype_to_ppptype(proto);
-			return gen_cmp(OR_LINKHDR, off_linktype, BPF_H,
+			return gen_cmp(OR_LINKTYPE, 0, BPF_H,
 				(bpf_int32)proto);
 		}
 		/*NOTREACHED*/
@@ -3097,31 +3137,31 @@ gen_linktype(proto)
 			return gen_false();
 
 		case ETHERTYPE_IPV6:
-			return (gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			return (gen_cmp(OR_LINKTYPE, 0, BPF_B,
 				(bpf_int32)ARCTYPE_INET6));
 
 		case ETHERTYPE_IP:
-			b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			b0 = gen_cmp(OR_LINKTYPE, 0, BPF_B,
 				     (bpf_int32)ARCTYPE_IP);
-			b1 = gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			b1 = gen_cmp(OR_LINKTYPE, 0, BPF_B,
 				     (bpf_int32)ARCTYPE_IP_OLD);
 			gen_or(b0, b1);
 			return (b1);
 
 		case ETHERTYPE_ARP:
-			b0 = gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			b0 = gen_cmp(OR_LINKTYPE, 0, BPF_B,
 				     (bpf_int32)ARCTYPE_ARP);
-			b1 = gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			b1 = gen_cmp(OR_LINKTYPE, 0, BPF_B,
 				     (bpf_int32)ARCTYPE_ARP_OLD);
 			gen_or(b0, b1);
 			return (b1);
 
 		case ETHERTYPE_REVARP:
-			return (gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			return (gen_cmp(OR_LINKTYPE, 0, BPF_B,
 					(bpf_int32)ARCTYPE_REVARP));
 
 		case ETHERTYPE_ATALK:
-			return (gen_cmp(OR_LINKHDR, off_linktype, BPF_B,
+			return (gen_cmp(OR_LINKTYPE, 0, BPF_B,
 					(bpf_int32)ARCTYPE_ATALK));
 		}
 		/*NOTREACHED*/
@@ -3286,16 +3326,16 @@ gen_linktype(proto)
 		/*
 		 * Does this link-layer header type have a field
 		 * indicating the type of the next protocol?  If
-		 * so, off_linktype will be the offset of that
+		 * so, off_linktype.constant_part will be the offset of that
 		 * field in the packet; if not, it will be -1.
 		 */
-		if (off_linktype != (u_int)-1) {
+		if (off_linktype.constant_part != (u_int)-1) {
 			/*
 			 * Yes; assume it's an Ethernet type.  (If
 			 * it's not, it needs to be handled specially
 			 * above.)
 			 */
-			return gen_cmp(OR_LINKHDR, off_linktype, BPF_H, (bpf_int32)proto);
+			return gen_cmp(OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
 		} else {
 			/*
 			 * No; report an error.
@@ -3353,7 +3393,7 @@ gen_llc(void)
 		 * We check for an Ethernet type field less than
 		 * 1500, which means it's an 802.3 length field.
 		 */
-		b0 = gen_cmp_gt(OR_LINKHDR, off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINKTYPE, 0, BPF_H, ETHERMTU);
 		gen_not(b0);
 
 		/*
@@ -5548,15 +5588,8 @@ gen_protochain(v, proto, dir)
 	 * branches, and backward branch support is unlikely to appear
 	 * in kernel BPF engines.)
 	 */
-	switch (linktype) {
-
-	case DLT_IEEE802_11:
-	case DLT_PRISM_HEADER:
-	case DLT_IEEE802_11_RADIO_AVS:
-	case DLT_IEEE802_11_RADIO:
-	case DLT_PPI:
-		bpf_error("'protochain' not supported with 802.11");
-	}
+	if (off_linkpl.is_variable)
+		bpf_error("'protochain' not supported with variable length headers");
 
 	no_optimize = 1; /*this code is not compatible with optimzer yet */
 
@@ -6168,7 +6201,8 @@ gen_scode(name, q)
 			if (alist == NULL || *alist == NULL)
 				bpf_error("unknown host '%s'", name);
 			tproto = proto;
-			if (off_linktype == (u_int)-1 && tproto == Q_DEFAULT)
+			if (off_linktype.constant_part == (u_int)-1 &&
+			    tproto == Q_DEFAULT)
 				tproto = Q_IP;
 			b = gen_host(**alist++, 0xffffffff, tproto, dir, q.addr);
 			while (*alist) {
@@ -6186,7 +6220,8 @@ gen_scode(name, q)
 			ai = res;
 			b = tmp = NULL;
 			tproto = tproto6 = proto;
-			if (off_linktype == -1 && tproto == Q_DEFAULT) {
+			if (off_linktype.constant_part == -1 &&
+			    tproto == Q_DEFAULT) {
 				tproto = Q_IP;
 				tproto6 = Q_IPV6;
 			}
@@ -6992,6 +7027,17 @@ gen_arth(code, a0, a1)
 {
 	struct slist *s0, *s1, *s2;
 
+	/*
+	 * Disallow division by, or modulus by, zero; we do this here
+	 * so that it gets done even if the optimizer is disabled.
+	 */
+	if (code == BPF_DIV) {
+		if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0)
+			bpf_error("division by zero");
+	} else if (code == BPF_MOD) {
+		if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0)
+			bpf_error("modulus by zero");
+	}
 	s0 = xfer_to_x(a1);
 	s1 = xfer_to_a(a0);
 	s2 = new_stmt(BPF_ALU|BPF_X|code);
@@ -7891,7 +7937,7 @@ gen_vlan_no_bpf_extensions(int vlan_num)
 	 * The link-layer type information follows the VLAN tags, so
 	 * skip past this VLAN tag.
 	 */
-        off_linktype += 4;
+        off_linktype.constant_part += 4;
 
         return b0;
 }
@@ -7946,7 +7992,11 @@ gen_vlan(vlan_num)
 	case DLT_NETANALYZER:
 	case DLT_NETANALYZER_TRANSPARENT:
 #if defined(SKF_AD_VLAN_TAG) && defined(SKF_AD_VLAN_TAG_PRESENT)
-		if (vlan_stack_depth == 0) {
+		/* Verify that this is the outer part of the packet and
+		 * not encapsulated somehow. */
+		if (vlan_stack_depth == 0 && !off_linkhdr.is_variable &&
+		    off_linkhdr.constant_part ==
+		    off_outermostlinkhdr.constant_part) {
 			/*
 			 * Do we need special VLAN handling?
 			 */
@@ -8121,7 +8171,7 @@ gen_pppoes(sess_num)
 	    off_linkpl.constant_part + off_nl + 6, /* 6 bytes past the PPPoE header */
 	    off_linkpl.reg);
 
-	off_linktype = 0;
+	off_linktype = off_linkhdr;
 	off_linkpl.constant_part = off_linkhdr.constant_part + 2;
 
 	off_nl = 0;
@@ -8130,6 +8180,300 @@ gen_pppoes(sess_num)
 	return b0;
 }
 
+/* Check that this is Geneve and the VNI is correct if
+ * specified. Parameterized to handle both IPv4 and IPv6. */
+static struct block *
+gen_geneve_check(struct block *(*gen_portfn)(int, int, int),
+		 enum e_offrel offrel, int vni)
+{
+	struct block *b0, *b1;
+
+	b0 = gen_portfn(GENEVE_PORT, IPPROTO_UDP, Q_DST);
+
+	/* Check that we are operating on version 0. Otherwise, we
+	 * can't decode the rest of the fields. The version is 2 bits
+	 * in the first byte of the Geneve header. */
+	b1 = gen_mcmp(offrel, 8, BPF_B, (bpf_int32)0, 0xc0);
+	gen_and(b0, b1);
+	b0 = b1;
+
+	if (vni >= 0) {
+		vni <<= 8; /* VNI is in the upper 3 bytes */
+		b1 = gen_mcmp(offrel, 12, BPF_W, (bpf_int32)vni,
+			      0xffffff00);
+		gen_and(b0, b1);
+		b0 = b1;
+	}
+
+	return b0;
+}
+
+/* The IPv4 and IPv6 Geneve checks need to do two things:
+ * - Verify that this actually is Geneve with the right VNI.
+ * - Place the IP header length (plus variable link prefix if
+ *   needed) into register A to be used later to compute
+ *   the inner packet offsets. */
+static struct block *
+gen_geneve4(int vni)
+{
+	struct block *b0, *b1;
+	struct slist *s, *s1;
+
+	b0 = gen_geneve_check(gen_port, OR_TRAN_IPV4, vni);
+
+	/* Load the IP header length into A. */
+	s = gen_loadx_iphdrlen();
+
+	s1 = new_stmt(BPF_MISC|BPF_TXA);
+	sappend(s, s1);
+
+	/* Forcibly append these statements to the true condition
+	 * of the protocol check by creating a new block that is
+	 * always true and ANDing them. */
+	b1 = new_block(BPF_JMP|BPF_JEQ|BPF_X);
+	b1->stmts = s;
+	b1->s.k = 0;
+
+	gen_and(b0, b1);
+
+	return b1;
+}
+
+static struct block *
+gen_geneve6(int vni)
+{
+	struct block *b0, *b1;
+	struct slist *s, *s1;
+
+	b0 = gen_geneve_check(gen_port6, OR_TRAN_IPV6, vni);
+
+	/* Load the IP header length. We need to account for a
+	 * variable length link prefix if there is one. */
+	s = gen_abs_offset_varpart(&off_linkpl);
+	if (s) {
+		s1 = new_stmt(BPF_LD|BPF_IMM);
+		s1->s.k = 40;
+		sappend(s, s1);
+
+		s1 = new_stmt(BPF_ALU|BPF_ADD|BPF_X);
+		s1->s.k = 0;
+		sappend(s, s1);
+	} else {
+		s = new_stmt(BPF_LD|BPF_IMM);
+		s->s.k = 40;;
+	}
+
+	/* Forcibly append these statements to the true condition
+	 * of the protocol check by creating a new block that is
+	 * always true and ANDing them. */
+	s1 = new_stmt(BPF_MISC|BPF_TAX);
+	sappend(s, s1);
+
+	b1 = new_block(BPF_JMP|BPF_JEQ|BPF_X);
+	b1->stmts = s;
+	b1->s.k = 0;
+
+	gen_and(b0, b1);
+
+	return b1;
+}
+
+/* We need to store three values based on the Geneve header::
+ * - The offset of the linktype.
+ * - The offset of the end of the Geneve header.
+ * - The offset of the end of the encapsulated MAC header. */
+static struct slist *
+gen_geneve_offsets(void)
+{
+	struct slist *s, *s1, *s_proto;
+
+	/* First we need to calculate the offset of the Geneve header
+	 * itself. This is composed of the IP header previously calculated
+	 * (include any variable link prefix) and stored in A plus the
+	 * fixed sized headers (fixed link prefix, MAC length, and UDP
+	 * header). */
+	s = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
+	s->s.k = off_linkpl.constant_part + off_nl + 8;
+
+	/* Stash this in X since we'll need it later. */
+	s1 = new_stmt(BPF_MISC|BPF_TAX);
+	sappend(s, s1);
+
+	/* The EtherType in Geneve is 2 bytes in. Calculate this and
+	 * store it. */
+	s1 = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
+	s1->s.k = 2;
+	sappend(s, s1);
+
+	off_linktype.reg = alloc_reg();
+	off_linktype.is_variable = 1;
+	off_linktype.constant_part = 0;
+
+	s1 = new_stmt(BPF_ST);
+	s1->s.k = off_linktype.reg;
+	sappend(s, s1);
+
+	/* Load the Geneve option length and mask and shift to get the
+	 * number of bytes. It is stored in the first byte of the Geneve
+	 * header. */
+	s1 = new_stmt(BPF_LD|BPF_IND|BPF_B);
+	s1->s.k = 0;
+	sappend(s, s1);
+
+	s1 = new_stmt(BPF_ALU|BPF_AND|BPF_K);
+	s1->s.k = 0x3f;
+	sappend(s, s1);
+
+	s1 = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
+	s1->s.k = 4;
+	sappend(s, s1);
+
+	/* Add in the rest of the Geneve base header. */
+	s1 = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
+	s1->s.k = 8;
+	sappend(s, s1);
+
+	/* Add the Geneve header length to its offset and store. */
+	s1 = new_stmt(BPF_ALU|BPF_ADD|BPF_X);
+	s1->s.k = 0;
+	sappend(s, s1);
+
+	/* Set the encapsulated type as Ethernet. Even though we may
+	 * not actually have Ethernet inside there are two reasons this
+	 * is useful:
+	 * - The linktype field is always in EtherType format regardless
+	 *   of whether it is in Geneve or an inner Ethernet frame.
+	 * - The only link layer that we have specific support for is
+	 *   Ethernet. We will confirm that the packet actually is
+	 *   Ethernet at runtime before executing these checks. */
+	PUSH_LINKHDR(DLT_EN10MB, 1, 0, alloc_reg());
+
+	s1 = new_stmt(BPF_ST);
+	s1->s.k = off_linkhdr.reg;
+	sappend(s, s1);
+
+	/* Calculate whether we have an Ethernet header or just raw IP/
+	 * MPLS/etc. If we have Ethernet, advance the end of the MAC offset
+	 * and linktype by 14 bytes so that the network header can be found
+	 * seamlessly. Otherwise, keep what we've calculated already. */
+
+	/* We have a bare jmp so we can't use the optimizer. */
+	no_optimize = 1;
+
+	/* Load the EtherType in the Geneve header, 2 bytes in. */
+	s1 = new_stmt(BPF_LD|BPF_IND|BPF_H);
+	s1->s.k = 2;
+	sappend(s, s1);
+
+	/* Load X with the end of the Geneve header. */
+	s1 = new_stmt(BPF_LDX|BPF_MEM);
+	s1->s.k = off_linkhdr.reg;
+	sappend(s, s1);
+
+	/* Check if the EtherType is Transparent Ethernet Bridging. At the
+	 * end of this check, we should have the total length in X. In
+	 * the non-Ethernet case, it's already there. */
+	s_proto = new_stmt(JMP(BPF_JEQ));
+	s_proto->s.k = ETHERTYPE_TEB;
+	sappend(s, s_proto);
+
+	s1 = new_stmt(BPF_MISC|BPF_TXA);
+	sappend(s, s1);
+	s_proto->s.jt = s1;
+
+	/* Since this is Ethernet, use the EtherType of the payload
+	 * directly as the linktype. Overwrite what we already have. */
+	s1 = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
+	s1->s.k = 12;
+	sappend(s, s1);
+
+	s1 = new_stmt(BPF_ST);
+	s1->s.k = off_linktype.reg;
+	sappend(s, s1);
+
+	/* Advance two bytes further to get the end of the Ethernet
+	 * header. */
+	s1 = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
+	s1->s.k = 2;
+	sappend(s, s1);
+
+	/* Move the result to X. */
+	s1 = new_stmt(BPF_MISC|BPF_TAX);
+	sappend(s, s1);
+
+	/* Store the final result of our linkpl calculation. */
+	off_linkpl.reg = alloc_reg();
+	off_linkpl.is_variable = 1;
+	off_linkpl.constant_part = 0;
+
+	s1 = new_stmt(BPF_STX);
+	s1->s.k = off_linkpl.reg;
+	sappend(s, s1);
+	s_proto->s.jf = s1;
+
+	off_nl = 0;
+
+	return s;
+}
+
+/* Check to see if this is a Geneve packet. */
+struct block *
+gen_geneve(int vni)
+{
+	struct block *b0, *b1;
+	struct slist *s;
+
+	b0 = gen_geneve4(vni);
+	b1 = gen_geneve6(vni);
+
+	gen_or(b0, b1);
+	b0 = b1;
+
+	/* Later filters should act on the payload of the Geneve frame,
+	 * update all of the header pointers. Attach this code so that
+	 * it gets executed in the event that the Geneve filter matches. */
+	s = gen_geneve_offsets();
+
+	b1 = gen_true();
+	sappend(s, b1->stmts);
+	b1->stmts = s;
+
+	gen_and(b0, b1);
+
+	is_geneve = 1;
+
+	return b1;
+}
+
+/* Check that the encapsulated frame has a link layer header
+ * for Ethernet filters. */
+static struct block *
+gen_geneve_ll_check()
+{
+	struct block *b0;
+	struct slist *s, *s1;
+
+	/* The easiest way to see if there is a link layer present
+	 * is to check if the link layer header and payload are not
+	 * the same. */
+
+	/* Geneve always generates pure variable offsets so we can
+	 * compare only the registers. */
+	s = new_stmt(BPF_LD|BPF_MEM);
+	s->s.k = off_linkhdr.reg;
+
+	s1 = new_stmt(BPF_LDX|BPF_MEM);
+	s1->s.k = off_linkpl.reg;
+	sappend(s, s1);
+
+	b0 = new_block(BPF_JMP|BPF_JEQ|BPF_X);
+	b0->stmts = s;
+	b0->s.k = 0;
+	gen_not(b0);
+
+	return b0;
+}
+
 struct block *
 gen_atmfield_code(atmfield, jvalue, jtype, reverse)
 	int atmfield;
@@ -8267,7 +8611,7 @@ gen_atmtype_abbrev(type)
 		PUSH_LINKHDR(DLT_EN10MB, 0,
 		    off_payload + 2,	/* Ethernet header */
 		    -1);
-		off_linktype = 12;
+		off_linktype.constant_part = off_linkhdr.constant_part + 12;
 		off_linkpl.constant_part = off_linkhdr.constant_part + 14;	/* Ethernet */
 		off_nl = 0;			/* Ethernet II */
 		off_nl_nosnap = 3;		/* 802.3+802.2 */