resolve merge conflicts

Approved by:	re (scottl)

10 files changed, 1556 insertions, 544 deletions

diff --git a/contrib/libpcap/gencode.c b/contrib/libpcap/gencode.c
index 9fa89f2..8830fcb 100644
--- a/contrib/libpcap/gencode.c
+++ b/contrib/libpcap/gencode.c
@@ -23,7 +23,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221 2005/03/27 22:10:23 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.24 2005/06/20 21:52:53 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -104,7 +104,7 @@ static jmp_buf top_ctx;
 static pcap_t *bpf_pcap;
 
 /* Hack for updating VLAN, MPLS offsets. */
-static u_int	orig_linktype = -1U, orig_nl = -1U, orig_nl_nosnap = -1U;
+static u_int	orig_linktype = -1U, orig_nl = -1U;
 
 /* XXX */
 #ifdef PCAP_FDDIPAD
@@ -114,7 +114,6 @@ static int	pcap_fddipad;
 /* VARARGS */
 void
 bpf_error(const char *fmt, ...)
-
 {
 	va_list ap;
 
@@ -135,6 +134,19 @@ static void free_reg(int);
 static struct block *root;
 
 /*
+ * Value passed to gen_load_a() to indicate what the offset argument
+ * is relative to.
+ */
+enum e_offrel {
+	OR_PACKET,	/* relative to the beginning of the packet */
+	OR_LINK,	/* relative to the link-layer header */
+	OR_NET,		/* relative to the network-layer header */
+	OR_NET_NOSNAP,	/* relative to the network-layer header, with no SNAP header at the link layer */
+	OR_TRAN_IPV4,	/* relative to the transport-layer header, with IPv4 network layer */
+	OR_TRAN_IPV6	/* relative to the transport-layer header, with IPv6 network layer */
+};
+
+/*
  * We divy out chunks of memory rather than call malloc each time so
  * we don't have to worry about leaking memory.  It's probably
  * not a big deal if all this memory was wasted but if this ever
@@ -161,20 +173,30 @@ static inline void syntax(void);
 
 static void backpatch(struct block *, struct block *);
 static void merge(struct block *, struct block *);
-static struct block *gen_cmp(u_int, u_int, bpf_int32);
-static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
-static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
-static struct block *gen_bcmp(u_int, u_int, const u_char *);
-static struct block *gen_ncmp(bpf_u_int32, bpf_u_int32, bpf_u_int32,
-    bpf_u_int32, bpf_u_int32, int);
+static struct block *gen_cmp(enum e_offrel, u_int, u_int, bpf_int32);
+static struct block *gen_cmp_gt(enum e_offrel, u_int, u_int, bpf_int32);
+static struct block *gen_cmp_ge(enum e_offrel, u_int, u_int, bpf_int32);
+static struct block *gen_cmp_lt(enum e_offrel, u_int, u_int, bpf_int32);
+static struct block *gen_cmp_le(enum e_offrel, u_int, u_int, bpf_int32);
+static struct block *gen_mcmp(enum e_offrel, u_int, u_int, bpf_int32,
+    bpf_u_int32);
+static struct block *gen_bcmp(enum e_offrel, u_int, u_int, const u_char *);
+static struct block *gen_ncmp(enum e_offrel, bpf_u_int32, bpf_u_int32,
+    bpf_u_int32, bpf_u_int32, int, bpf_int32);
+static struct slist *gen_load_llrel(u_int, u_int);
+static struct slist *gen_load_a(enum e_offrel, u_int, u_int);
+static struct slist *gen_loadx_iphdrlen(void);
 static struct block *gen_uncond(int);
 static inline struct block *gen_true(void);
 static inline struct block *gen_false(void);
 static struct block *gen_ether_linktype(int);
 static struct block *gen_linux_sll_linktype(int);
+static void insert_radiotap_load_llprefixlen(struct block *);
+static void insert_load_llprefixlen(struct block *);
+static struct slist *gen_llprefixlen(void);
 static struct block *gen_linktype(int);
 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
-static struct block *gen_llc(int);
+static struct block *gen_llc_linktype(int);
 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
 #ifdef INET6
 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
@@ -185,7 +207,7 @@ static struct block *gen_fhostop(const u_char *, int);
 static struct block *gen_thostop(const u_char *, int);
 static struct block *gen_wlanhostop(const u_char *, int);
 static struct block *gen_ipfchostop(const u_char *, int);
-static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
+static struct block *gen_dnhostop(bpf_u_int32, int);
 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
 #ifdef INET6
 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
@@ -195,14 +217,20 @@ static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
 #endif
 static struct block *gen_ipfrag(void);
 static struct block *gen_portatom(int, bpf_int32);
+static struct block *gen_portrangeatom(int, bpf_int32, bpf_int32);
 #ifdef INET6
 static struct block *gen_portatom6(int, bpf_int32);
+static struct block *gen_portrangeatom6(int, bpf_int32, bpf_int32);
 #endif
 struct block *gen_portop(int, int, int);
 static struct block *gen_port(int, int, int);
+struct block *gen_portrangeop(int, int, int, int);
+static struct block *gen_portrange(int, int, int, int);
 #ifdef INET6
 struct block *gen_portop6(int, int, int);
 static struct block *gen_port6(int, int, int);
+struct block *gen_portrangeop6(int, int, int, int);
+static struct block *gen_portrange6(int, int, int, int);
 #endif
 static int lookup_proto(const char *, int);
 static struct block *gen_protochain(int, int, int);
@@ -454,6 +482,23 @@ finish_parse(p)
 	p->sense = !p->sense;
 	backpatch(p, gen_retblk(0));
 	root = p->head;
+
+	/*
+	 * Insert before the statements of the first (root) block any
+	 * statements needed to load the lengths of any variable-length
+	 * headers into registers.
+	 *
+	 * XXX - a fancier strategy would be to insert those before the
+	 * statements of all blocks that use those lengths and that
+	 * have no predecessors that use them, so that we only compute
+	 * the lengths if we need them.  There might be even better
+	 * approaches than that.  However, as we're currently only
+	 * handling variable-length radiotap headers, and as all
+	 * filtering expressions other than raw link[M:N] tests
+	 * require the length of that header, doing more for that
+	 * header length isn't really worth the effort.
+	 */
+	insert_load_llprefixlen(root);
 }
 
 void
@@ -487,60 +532,63 @@ gen_not(b)
 }
 
 static struct block *
-gen_cmp(offset, size, v)
+gen_cmp(offrel, offset, size, v)
+	enum e_offrel offrel;
 	u_int offset, size;
 	bpf_int32 v;
 {
-	struct slist *s;
-	struct block *b;
-
-	s = new_stmt(BPF_LD|BPF_ABS|size);
-	s->s.k = offset;
-
-	b = new_block(JMP(BPF_JEQ));
-	b->stmts = s;
-	b->s.k = v;
-
-	return b;
+	return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v);
 }
 
 static struct block *
-gen_cmp_gt(offset, size, v)
+gen_cmp_gt(offrel, offset, size, v)
+	enum e_offrel offrel;
 	u_int offset, size;
 	bpf_int32 v;
 {
-	struct slist *s;
-	struct block *b;
+	return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGT, 0, v);
+}
 
-	s = new_stmt(BPF_LD|BPF_ABS|size);
-	s->s.k = offset;
+static struct block *
+gen_cmp_ge(offrel, offset, size, v)
+	enum e_offrel offrel;
+	u_int offset, size;
+	bpf_int32 v;
+{
+	return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGE, 0, v);
+}
 
-	b = new_block(JMP(BPF_JGT));
-	b->stmts = s;
-	b->s.k = v;
+static struct block *
+gen_cmp_lt(offrel, offset, size, v)
+	enum e_offrel offrel;
+	u_int offset, size;
+	bpf_int32 v;
+{
+	return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGE, 1, v);
+}
 
-	return b;
+static struct block *
+gen_cmp_le(offrel, offset, size, v)
+	enum e_offrel offrel;
+	u_int offset, size;
+	bpf_int32 v;
+{
+	return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGT, 1, v);
 }
 
 static struct block *
-gen_mcmp(offset, size, v, mask)
+gen_mcmp(offrel, offset, size, v, mask)
+	enum e_offrel offrel;
 	u_int offset, size;
 	bpf_int32 v;
 	bpf_u_int32 mask;
 {
-	struct block *b = gen_cmp(offset, size, v);
-	struct slist *s;
-
-	if (mask != 0xffffffff) {
-		s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
-		s->s.k = mask;
-		b->stmts->next = s;
-	}
-	return b;
+	return gen_ncmp(offrel, offset, size, mask, BPF_JEQ, 0, v);
 }
 
 static struct block *
-gen_bcmp(offset, size, v)
+gen_bcmp(offrel, offset, size, v)
+	enum e_offrel offrel;
 	register u_int offset, size;
 	register const u_char *v;
 {
@@ -552,7 +600,7 @@ gen_bcmp(offset, size, v)
 		bpf_int32 w = ((bpf_int32)p[0] << 24) |
 		    ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
 
-		tmp = gen_cmp(offset + size - 4, BPF_W, w);
+		tmp = gen_cmp(offrel, offset + size - 4, BPF_W, w);
 		if (b != NULL)
 			gen_and(b, tmp);
 		b = tmp;
@@ -562,14 +610,14 @@ gen_bcmp(offset, size, v)
 		register const u_char *p = &v[size - 2];
 		bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
 
-		tmp = gen_cmp(offset + size - 2, BPF_H, w);
+		tmp = gen_cmp(offrel, offset + size - 2, BPF_H, w);
 		if (b != NULL)
 			gen_and(b, tmp);
 		b = tmp;
 		size -= 2;
 	}
 	if (size > 0) {
-		tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
+		tmp = gen_cmp(offrel, offset, BPF_B, (bpf_int32)v[0]);
 		if (b != NULL)
 			gen_and(b, tmp);
 		b = tmp;
@@ -577,25 +625,33 @@ gen_bcmp(offset, size, v)
 	return b;
 }
 
+/*
+ * AND the field of size "size" at offset "offset" relative to the header
+ * specified by "offrel" with "mask", and compare it with the value "v"
+ * with the test specified by "jtype"; if "reverse" is true, the test
+ * should test the opposite of "jtype".
+ */
 static struct block *
-gen_ncmp(datasize, offset, mask, jtype, jvalue, reverse)
-	bpf_u_int32 datasize, offset, mask, jtype, jvalue;
+gen_ncmp(offrel, offset, size, mask, jtype, reverse, v)
+	enum e_offrel offrel;
+	bpf_int32 v;
+	bpf_u_int32 offset, size, mask, jtype;
 	int reverse;
 {
-	struct slist *s;
+	struct slist *s, *s2;
 	struct block *b;
 
-	s = new_stmt(BPF_LD|datasize|BPF_ABS);
-	s->s.k = offset;
+	s = gen_load_a(offrel, offset, size);
 
 	if (mask != 0xffffffff) {
-		s->next = new_stmt(BPF_ALU|BPF_AND|BPF_K);
-		s->next->s.k = mask;
+		s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K);
+		s2->s.k = mask;
+		sappend(s, s2);
 	}
 
 	b = new_block(JMP(jtype));
 	b->stmts = s;
-	b->s.k = jvalue;
+	b->s.k = v;
 	if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE))
 		gen_not(b);
 	return b;
@@ -603,8 +659,21 @@ gen_ncmp(datasize, offset, mask, jtype, jvalue, reverse)
 
 /*
  * Various code constructs need to know the layout of the data link
- * layer.  These variables give the necessary offsets.
+ * layer.  These variables give the necessary offsets from the beginning
+ * of the packet data.
+ *
+ * If the link layer has variable_length headers, the offsets are offsets
+ * from the end of the link-link-layer header, and "reg_ll_size" is
+ * the register number for a register containing the length of the
+ * link-layer header.  Otherwise, "reg_ll_size" is -1.
  */
+static int reg_ll_size;
+
+/*
+ * This is the offset of the beginning of the link-layer header.
+ * It's usually 0, except for 802.11 with a fixed-length radio header.
+ */
+static u_int off_ll;
 
 /*
  * This is the offset of the beginning of the MAC-layer header.
@@ -652,6 +721,14 @@ static u_int off_vci;
 static u_int off_proto;
 
 /*
+ * These are offsets for the MTP3 fields.
+ */
+static u_int off_sio;
+static u_int off_opc;
+static u_int off_dpc;
+static u_int off_sls;
+
+/*
  * This is the offset of the first byte after the ATM pseudo_header,
  * or -1 if there is no ATM pseudo-header.
  */
@@ -704,9 +781,20 @@ init_linktype(p)
 	off_proto = -1;
 	off_payload = -1;
 
+	off_sio = -1;
+	off_opc = -1;
+	off_dpc = -1;
+	off_sls = -1;
+
+	/*
+	 * Also assume it's not 802.11 with a fixed-length radio header.
+	 */
+	off_ll = 0;
+
 	orig_linktype = -1;
 	orig_nl = -1;
-	orig_nl_nosnap = -1;
+
+	reg_ll_size = -1;
 
 	switch (linktype) {
 
@@ -865,6 +953,7 @@ init_linktype(p)
 		 * XXX - same variable-length header problem; at least
 		 * the Prism header is fixed-length.
 		 */
+		off_ll = 144;
 		off_linktype = 144+24;
 		off_nl = 144+32;	/* Prism+802.11+802.2+SNAP */
 		off_nl_nosnap = 144+27;	/* Prism+802.11+802.2 */
@@ -885,6 +974,7 @@ init_linktype(p)
 		 * number at an offset of 4 from the beginning
 		 * of the radio header.
 		 */
+		off_ll = 64;
 		off_linktype = 64+24;
 		off_nl = 64+32;		/* Radio+802.11+802.2+SNAP */
 		off_nl_nosnap = 64+27;	/* Radio+802.11+802.2 */
@@ -896,21 +986,14 @@ init_linktype(p)
 		 * the 802.11 header, containing a bunch of additional
 		 * information including radio-level information.
 		 *
-		 * XXX - same variable-length header problem, only
-		 * even *more* so; this header is also variable-length,
-		 * with the length being the 16-bit number at an offset
-		 * of 2 from the beginning of the radio header, and it's
-		 * device-dependent (different devices might supply
-		 * different amounts of information), so we can't even
-		 * assume a fixed length for the current version of the
-		 * header.
-		 *
-		 * Therefore, currently, only raw "link[N:M]" filtering is
-		 * supported.
+		 * The radiotap header is variable length, and we
+		 * generate code to compute its length and store it
+		 * in a register.  These offsets are relative to the
+		 * beginning of the 802.11 header.
 		 */
-		off_linktype = -1;
-		off_nl = -1;
-		off_nl_nosnap = -1;
+		off_linktype = 24;
+		off_nl = 32;		/* 802.11+802.2+SNAP */
+		off_nl_nosnap = 27;	/* 802.11+802.2 */
 		return;
 
 	case DLT_ATM_RFC1483:
@@ -918,6 +1001,13 @@ init_linktype(p)
 		/*
 		 * assume routed, non-ISO PDUs
 		 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
+		 *
+		 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS,
+		 * or PPP with the PPP NLPID (e.g., PPPoA)?  The
+		 * latter would presumably be treated the way PPPoE
+		 * should be, so you can do "pppoe and udp port 2049"
+		 * or "pppoa and tcp port 80" and have it check for
+		 * PPPo{A,E} and a PPP protocol of IP and....
 		 */
 		off_linktype = 0;
 		off_nl = 8;		/* 802.2+SNAP */
@@ -992,7 +1082,7 @@ init_linktype(p)
 	case DLT_APPLE_IP_OVER_IEEE1394:
 		off_linktype = 16;
 		off_nl = 18;
-		off_nl_nosnap = 0;	/* no 802.2 LLC */
+		off_nl_nosnap = 18;	/* no 802.2 LLC */
 		return;
 
 	case DLT_LINUX_IRDA:
@@ -1021,16 +1111,16 @@ init_linktype(p)
 
 	case DLT_PFLOG:
 		off_linktype = 0;
-		/* XXX read from header? */
+		/* XXX read this from pf.h? */
 		off_nl = PFLOG_HDRLEN;
-		off_nl_nosnap = PFLOG_HDRLEN;
+		off_nl_nosnap = PFLOG_HDRLEN;	/* no 802.2 LLC */
 		return;
 
         case DLT_JUNIPER_MLFR:
         case DLT_JUNIPER_MLPPP:
                 off_linktype = 4;
 		off_nl = 4;
-		off_nl_nosnap = -1;
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
                 return;
 
 	case DLT_JUNIPER_ATM1:
@@ -1045,6 +1135,54 @@ init_linktype(p)
 		off_nl_nosnap = 18;
 		return;
 
+		/* frames captured on a Juniper PPPoE service PIC
+		 * contain raw ethernet frames */
+	case DLT_JUNIPER_PPPOE:
+		off_linktype = 16;
+		off_nl = 18;		/* Ethernet II */
+		off_nl_nosnap = 21;	/* 802.3+802.2 */
+		return;
+
+	case DLT_JUNIPER_PPPOE_ATM:
+		off_linktype = 4;
+		off_nl = 6;
+		off_nl_nosnap = -1;	 /* no 802.2 LLC */
+		return;
+
+	case DLT_JUNIPER_GGSN:
+		off_linktype = 6;
+		off_nl = 12;
+		off_nl_nosnap = -1;	 /* no 802.2 LLC */
+		return;
+
+	case DLT_JUNIPER_ES:
+		off_linktype = 6;
+		off_nl = -1;		/* not really a network layer but raw IP adresses */
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
+		return;
+
+	case DLT_JUNIPER_MONITOR:
+		off_linktype = 12;
+		off_nl = 12;		/* raw IP/IP6 header */
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
+		return;
+
+	case DLT_JUNIPER_SERVICES:
+		off_linktype = 12;
+		off_nl = -1;		/* L3 proto location dep. on cookie type */
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
+		return;
+
+	case DLT_MTP2:
+		off_sio = 3;
+		off_opc = 4;
+		off_dpc = 4;
+		off_sls = 7;
+		off_linktype = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
 #ifdef DLT_PFSYNC
 	case DLT_PFSYNC:
 		off_linktype = -1;
@@ -1052,11 +1190,158 @@ init_linktype(p)
 		off_nl_nosnap = 4;
 		return;
 #endif
+
+	case DLT_LINUX_LAPD:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
 	}
 	bpf_error("unknown data link type %d", linktype);
 	/* NOTREACHED */
 }
 
+/*
+ * Load a value relative to the beginning of the link-layer header.
+ * The link-layer header doesn't necessarily begin at the beginning
+ * of the packet data; there might be a variable-length prefix containing
+ * radio information.
+ */
+static struct slist *
+gen_load_llrel(offset, size)
+	u_int offset, size;
+{
+	struct slist *s, *s2;
+
+	s = gen_llprefixlen();
+
+	/*
+	 * If "s" is non-null, it has code to arrange that the X register
+	 * contains the length of the prefix preceding the link-layer
+	 * header.
+	 */
+	if (s != NULL) {
+		s2 = new_stmt(BPF_LD|BPF_IND|size);
+		s2->s.k = offset;
+		sappend(s, s2);
+	} else {
+		s = new_stmt(BPF_LD|BPF_ABS|size);
+		s->s.k = offset;
+	}
+	return s;
+}
+
+/*
+ * Load a value relative to the beginning of the specified header.
+ */
+static struct slist *
+gen_load_a(offrel, offset, size)
+	enum e_offrel offrel;
+	u_int offset, size;
+{
+	struct slist *s, *s2;
+
+	switch (offrel) {
+
+	case OR_PACKET:
+		s = gen_load_llrel(offset, size);
+		break;
+
+	case OR_LINK:
+		s = gen_load_llrel(off_ll + offset, size);
+		break;
+
+	case OR_NET:
+		s = gen_load_llrel(off_nl + offset, size);
+		break;
+
+	case OR_NET_NOSNAP:
+		s = gen_load_llrel(off_nl_nosnap + offset, size);
+		break;
+
+	case OR_TRAN_IPV4:
+		/*
+		 * Load the X register with the length of the IPv4 header,
+		 * in bytes.
+		 */
+		s = gen_loadx_iphdrlen();
+
+		/*
+		 * Load the item at {length of the link-layer header} +
+		 * {length of the IPv4 header} + {specified offset}.
+		 */
+		s2 = new_stmt(BPF_LD|BPF_IND|size);
+		s2->s.k = off_nl + offset;
+		sappend(s, s2);
+		break;
+
+	case OR_TRAN_IPV6:
+		s = gen_load_llrel(off_nl + 40 + offset, size);
+		break;
+
+	default:
+		abort();
+		return NULL;
+	}
+	return s;
+}
+
+/*
+ * Generate code to load into the X register the sum of the length of
+ * the IPv4 header and any variable-length header preceding the link-layer
+ * header.
+ */
+static struct slist *
+gen_loadx_iphdrlen()
+{
+	struct slist *s, *s2;
+
+	s = gen_llprefixlen();
+	if (s != NULL) {
+		/*
+		 * There's a variable-length prefix preceding the
+		 * link-layer header.  "s" points to a list of statements
+		 * that put the length of that prefix into the X register.
+		 * The 4*([k]&0xf) addressing mode can't be used, as we
+		 * don't have a constant offset, so we have to load the
+		 * value in question into the A register and add to it
+		 * the value from the X register.
+		 */
+		s2 = new_stmt(BPF_LD|BPF_IND|BPF_B);
+		s2->s.k = off_nl;
+		sappend(s, s2);
+		s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K);
+		s2->s.k = 0xf;
+		sappend(s, s2);
+		s2 = new_stmt(BPF_ALU|BPF_LSH|BPF_K);
+		s2->s.k = 2;
+		sappend(s, s2);
+
+		/*
+		 * The A register now contains the length of the
+		 * IP header.  We need to add to it the length
+		 * of the prefix preceding the link-layer
+		 * header, which is still in the X register, and
+		 * move the result into the X register.
+		 */
+		sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
+		sappend(s, new_stmt(BPF_MISC|BPF_TAX));
+	} else {
+		/*
+		 * There is no variable-length header preceding the
+		 * link-layer header; if there's a fixed-length
+		 * header preceding it, its length is included in
+		 * the off_ variables, so it doesn't need to be added.
+		 */
+		s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
+		s->s.k = off_nl;
+	}
+	return s;
+}
+
 static struct block *
 gen_uncond(rsense)
 	int rsense;
@@ -1092,6 +1377,15 @@ gen_false()
 #define	SWAPLONG(y) \
 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
 
+/*
+ * Generate code to match a particular packet type.
+ *
+ * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
+ * value, if <= ETHERMTU.  We use that to determine whether to
+ * match the type/length field or to check the type/length field for
+ * a value <= ETHERMTU to see whether it's a type field and then do
+ * the appropriate test.
+ */
 static struct block *
 gen_ether_linktype(proto)
 	register int proto;
@@ -1101,38 +1395,24 @@ gen_ether_linktype(proto)
 	switch (proto) {
 
 	case LLCSAP_ISONS:
-		/*
-		 * OSI protocols always use 802.2 encapsulation.
-		 * XXX - should we check both the DSAP and the
-		 * SSAP, like this, or should we check just the
-		 * DSAP?
-		 */
-		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
-		gen_not(b0);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-			     ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
-		gen_and(b0, b1);
-		return b1;
-
 	case LLCSAP_IP:
-		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
-		gen_not(b0);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-			     ((LLCSAP_IP << 8) | LLCSAP_IP));
-		gen_and(b0, b1);
-		return b1;
-
 	case LLCSAP_NETBEUI:
 		/*
-		 * NetBEUI always uses 802.2 encapsulation.
+		 * OSI protocols and NetBEUI always use 802.2 encapsulation,
+		 * so we check the DSAP and SSAP.
+		 *
+		 * LLCSAP_IP checks for IP-over-802.2, rather
+		 * than IP-over-Ethernet or IP-over-SNAP.
+		 *
 		 * XXX - should we check both the DSAP and the
 		 * SSAP, like this, or should we check just the
-		 * DSAP?
+		 * DSAP, as we do for other types <= ETHERMTU
+		 * (i.e., other SAP values)?
 		 */
-		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU);
 		gen_not(b0);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-			     ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
+		b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32)
+			     ((proto << 8) | proto));
 		gen_and(b0, b1);
 		return b1;
 
@@ -1169,8 +1449,10 @@ gen_ether_linktype(proto)
 		 * This generates code to check both for the
 		 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
 		 */
-		b0 = gen_cmp(off_linktype + 2, BPF_B, (bpf_int32)LLCSAP_IPX);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)0xFFFF);
+		b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
+		    (bpf_int32)LLCSAP_IPX);
+		b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H,
+		    (bpf_int32)0xFFFF);
 		gen_or(b0, b1);
 
 		/*
@@ -1184,7 +1466,7 @@ gen_ether_linktype(proto)
 		 * Now we generate code to check for 802.3
 		 * frames in general.
 		 */
-		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU);
 		gen_not(b0);
 
 		/*
@@ -1200,7 +1482,8 @@ gen_ether_linktype(proto)
 		 * do that before checking for the other frame
 		 * types.
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)ETHERTYPE_IPX);
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H,
+		    (bpf_int32)ETHERTYPE_IPX);
 		gen_or(b0, b1);
 		return b1;
 
@@ -1216,7 +1499,7 @@ gen_ether_linktype(proto)
 		 * we check for an Ethernet type field less than
 		 * 1500, which means it's an 802.3 length field.
 		 */
-		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+		b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU);
 		gen_not(b0);
 
 		/*
@@ -1241,7 +1524,7 @@ gen_ether_linktype(proto)
 		 * phase 1?); we just check for the Ethernet
 		 * protocol type.
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto);
 
 		gen_or(b0, b1);
 		return b1;
@@ -1256,9 +1539,10 @@ gen_ether_linktype(proto)
 			 * a length field, <= ETHERMTU) and
 			 * then check the DSAP.
 			 */
-			b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+			b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU);
 			gen_not(b0);
-			b1 = gen_cmp(off_linktype + 2, BPF_B, (bpf_int32)proto);
+			b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
+			    (bpf_int32)proto);
 			gen_and(b0, b1);
 			return b1;
 		} else {
@@ -1271,11 +1555,20 @@ gen_ether_linktype(proto)
 			 * will fail and the frame won't match,
 			 * which is what we want).
 			 */
-			return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+			return gen_cmp(OR_LINK, off_linktype, BPF_H,
+			    (bpf_int32)proto);
 		}
 	}
 }
 
+/*
+ * Generate code to match a particular packet type.
+ *
+ * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
+ * value, if <= ETHERMTU.  We use that to determine whether to
+ * match the type field or to check the type field for the special
+ * LINUX_SLL_P_802_2 value and then do the appropriate test.
+ */
 static struct block *
 gen_linux_sll_linktype(proto)
 	register int proto;
@@ -1284,36 +1577,24 @@ gen_linux_sll_linktype(proto)
 
 	switch (proto) {
 
-	case LLCSAP_IP:
-		b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-			     ((LLCSAP_IP << 8) | LLCSAP_IP));
-		gen_and(b0, b1);
-		return b1;
-
 	case LLCSAP_ISONS:
-		/*
-		 * OSI protocols always use 802.2 encapsulation.
-		 * XXX - should we check both the DSAP and the
-		 * SSAP, like this, or should we check just the
-		 * DSAP?
-		 */
-		b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-			     ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
-		gen_and(b0, b1);
-		return b1;
-
+	case LLCSAP_IP:
 	case LLCSAP_NETBEUI:
 		/*
-		 * NetBEUI always uses 802.2 encapsulation.
+		 * OSI protocols and NetBEUI always use 802.2 encapsulation,
+		 * so we check the DSAP and SSAP.
+		 *
+		 * LLCSAP_IP checks for IP-over-802.2, rather
+		 * than IP-over-Ethernet or IP-over-SNAP.
+		 *
 		 * XXX - should we check both the DSAP and the
-		 * LSAP, like this, or should we check just the
-		 * DSAP?
+		 * SSAP, like this, or should we check just the
+		 * DSAP, as we do for other types <= ETHERMTU
+		 * (i.e., other SAP values)?
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
-		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
-			     ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2);
+		b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32)
+			     ((proto << 8) | proto));
 		gen_and(b0, b1);
 		return b1;
 
@@ -1343,19 +1624,19 @@ gen_linux_sll_linktype(proto)
 		 * then put a check for LINUX_SLL_P_802_2 frames
 		 * before it.
 		 */
-		b0 = gen_cmp(off_linktype + 2, BPF_B,
+		b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
 		    (bpf_int32)LLCSAP_IPX);
 		b1 = gen_snap(0x000000, ETHERTYPE_IPX,
 		    off_linktype + 2);
 		gen_or(b0, b1);
-		b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2);
 		gen_and(b0, b1);
 
 		/*
 		 * Now check for 802.3 frames and OR that with
 		 * the previous test.
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_3);
 		gen_or(b0, b1);
 
 		/*
@@ -1363,7 +1644,7 @@ gen_linux_sll_linktype(proto)
 		 * do that before checking for the other frame
 		 * types.
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H,
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H,
 		    (bpf_int32)ETHERTYPE_IPX);
 		gen_or(b0, b1);
 		return b1;
@@ -1380,7 +1661,7 @@ gen_linux_sll_linktype(proto)
 		 * we check for the 802.2 protocol type in the
 		 * "Ethernet type" field.
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2);
 
 		/*
 		 * 802.2-encapsulated ETHERTYPE_ATALK packets are
@@ -1406,7 +1687,7 @@ gen_linux_sll_linktype(proto)
 		 * phase 1?); we just check for the Ethernet
 		 * protocol type.
 		 */
-		b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto);
 
 		gen_or(b0, b1);
 		return b1;
@@ -1420,9 +1701,9 @@ gen_linux_sll_linktype(proto)
 			 * in the "Ethernet type" field, and
 			 * then check the DSAP.
 			 */
-			b0 = gen_cmp(off_linktype, BPF_H,
+			b0 = gen_cmp(OR_LINK, off_linktype, BPF_H,
 			    LINUX_SLL_P_802_2);
-			b1 = gen_cmp(off_linktype + 2, BPF_B,
+			b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
 			     (bpf_int32)proto);
 			gen_and(b0, b1);
 			return b1;
@@ -1436,12 +1717,137 @@ gen_linux_sll_linktype(proto)
 			 * will fail and the frame won't match,
 			 * which is what we want).
 			 */
-			return gen_cmp(off_linktype, BPF_H,
+			return gen_cmp(OR_LINK, off_linktype, BPF_H,
 			    (bpf_int32)proto);
 		}
 	}
 }
 
+static void
+insert_radiotap_load_llprefixlen(b)
+	struct block *b;
+{
+	struct slist *s1, *s2;
+
+	/*
+	 * Prepend to the statements in this block code to load the
+	 * length of the radiotap header into the register assigned
+	 * to hold that length, if one has been assigned.
+	 */
+	if (reg_ll_size != -1) {
+		/*
+		 * The 2 bytes at offsets of 2 and 3 from the beginning
+		 * of the radiotap header are the length of the radiotap
+		 * header; unfortunately, it's little-endian, so we have
+		 * to load it a byte at a time and construct the value.
+		 */
+
+		/*
+		 * Load the high-order byte, at an offset of 3, shift it
+		 * left a byte, and put the result in the X register.
+		 */
+		s1 = new_stmt(BPF_LD|BPF_B|BPF_ABS);
+		s1->s.k = 3;
+		s2 = new_stmt(BPF_ALU|BPF_LSH|BPF_K);
+		sappend(s1, s2);
+		s2->s.k = 8;
+		s2 = new_stmt(BPF_MISC|BPF_TAX);
+		sappend(s1, s2);
+
+		/*
+		 * Load the next byte, at an offset of 2, and OR the
+		 * value from the X register into it.
+		 */
+		s2 = new_stmt(BPF_LD|BPF_B|BPF_ABS);
+		sappend(s1, s2);
+		s2->s.k = 2;
+		s2 = new_stmt(BPF_ALU|BPF_OR|BPF_X);
+		sappend(s1, s2);
+
+		/*
+		 * Now allocate a register to hold that value and store
+		 * it.
+		 */
+		s2 = new_stmt(BPF_ST);
+		s2->s.k = reg_ll_size;
+		sappend(s1, s2);
+
+		/*
+		 * Now move it into the X register.
+		 */
+		s2 = new_stmt(BPF_MISC|BPF_TAX);
+		sappend(s1, s2);
+
+		/*
+		 * Now append all the existing statements in this
+		 * block to these statements.
+		 */
+		sappend(s1, b->stmts);
+		b->stmts = s1;
+	}
+}
+
+
+static void
+insert_load_llprefixlen(b)
+	struct block *b;
+{
+	switch (linktype) {
+
+	case DLT_IEEE802_11_RADIO:
+		insert_radiotap_load_llprefixlen(b);
+	}
+}
+
+
+static struct slist *
+gen_radiotap_llprefixlen(void)
+{
+	struct slist *s;
+
+	if (reg_ll_size == -1) {
+		/*
+		 * We haven't yet assigned a register for the length
+		 * of the radiotap header; allocate one.
+		 */
+		reg_ll_size = alloc_reg();
+	}
+
+	/*
+	 * Load the register containing the radiotap length
+	 * into the X register.
+	 */
+	s = new_stmt(BPF_LDX|BPF_MEM);
+	s->s.k = reg_ll_size;
+	return s;
+}
+
+/*
+ * Generate code to compute the link-layer header length, if necessary,
+ * putting it into the X register, and to return either a pointer to a
+ * "struct slist" for the list of statements in that code, or NULL if
+ * no code is necessary.
+ */
+static struct slist *
+gen_llprefixlen(void)
+{
+	switch (linktype) {
+
+	case DLT_IEEE802_11_RADIO:
+		return gen_radiotap_llprefixlen();
+
+	default:
+		return NULL;
+	}
+}
+
+/*
+ * Generate code to match a particular packet type by matching the
+ * link-layer type field or fields in the 802.2 LLC header.
+ *
+ * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
+ * value, if <= ETHERMTU.
+ */
 static struct block *
 gen_linktype(proto)
 	register int proto;
@@ -1463,21 +1869,23 @@ gen_linktype(proto)
 			/* fall through */
 
 		default:
-			return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+			return gen_cmp(OR_LINK, off_linktype, BPF_H,
+			    (bpf_int32)proto);
 			/*NOTREACHED*/
 			break;
 		}
 		break;
 
-	case DLT_IEEE802_11:
-	case DLT_PRISM_HEADER:
-	case DLT_IEEE802_11_RADIO:
 	case DLT_FDDI:
 	case DLT_IEEE802:
+	case DLT_IEEE802_11:
+	case DLT_IEEE802_11_RADIO_AVS:
+	case DLT_IEEE802_11_RADIO:
+	case DLT_PRISM_HEADER:
 	case DLT_ATM_RFC1483:
 	case DLT_ATM_CLIP:
 	case DLT_IP_OVER_FC:
-		return gen_llc(proto);
+		return gen_llc_linktype(proto);
 		/*NOTREACHED*/
 		break;
 
@@ -1495,7 +1903,8 @@ gen_linktype(proto)
 			 * LE Control marker.  (We've already generated
 			 * a test for LANE.)
 			 */
-			b0 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
+			b0 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
+			    0xFF00);
 			gen_not(b0);
 
 			/*
@@ -1510,10 +1919,12 @@ gen_linktype(proto)
 			 * protocol.
 			 */
 			b0 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0);
-			b1 = gen_llc(proto);
+			b1 = gen_llc_linktype(proto);
 			gen_and(b0, b1);
 			return b1;
 		}
+		/*NOTREACHED*/
+		break;
 
 	case DLT_LINUX_SLL:
 		return gen_linux_sll_linktype(proto);
@@ -1603,10 +2014,10 @@ gen_linktype(proto)
 		switch (proto) {
 
 		case ETHERTYPE_IP:
-			b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
-			b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
+			b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_IP);
+			b1 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJC);
 			gen_or(b0, b1);
-			b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
+			b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJNC);
 			gen_or(b1, b0);
 			return b0;
 
@@ -1712,7 +2123,7 @@ gen_linktype(proto)
 				proto = SWAPLONG(proto);
 			proto = htonl(proto);
 		}
-		return (gen_cmp(0, BPF_W, (bpf_int32)proto));
+		return (gen_cmp(OR_LINK, 0, BPF_W, (bpf_int32)proto));
 
 	case DLT_PFLOG:
 		/*
@@ -1720,12 +2131,12 @@ gen_linktype(proto)
 		 * the packet.
 		 */
 		if (proto == ETHERTYPE_IP)
-			return (gen_cmp(offsetof(struct pfloghdr, af), BPF_B,
-			    (bpf_int32)AF_INET));
+			return (gen_cmp(OR_LINK, offsetof(struct pfloghdr, af),
+			    BPF_B, (bpf_int32)AF_INET));
 #ifdef INET6
 		else if (proto == ETHERTYPE_IPV6)
-			return (gen_cmp(offsetof(struct pfloghdr, af), BPF_B,
-			    (bpf_int32)AF_INET6));
+			return (gen_cmp(OR_LINK, offsetof(struct pfloghdr, af),
+			    BPF_B, (bpf_int32)AF_INET6));
 #endif /* INET6 */
 		else
 			return gen_false();
@@ -1745,32 +2156,32 @@ gen_linktype(proto)
 
 #ifdef INET6
 		case ETHERTYPE_IPV6:
-			return (gen_cmp(off_linktype, BPF_B,
+			return (gen_cmp(OR_LINK, off_linktype, BPF_B,
 				(bpf_int32)ARCTYPE_INET6));
 #endif /* INET6 */
 
 		case ETHERTYPE_IP:
-			b0 = gen_cmp(off_linktype, BPF_B,
+			b0 = gen_cmp(OR_LINK, off_linktype, BPF_B,
 				     (bpf_int32)ARCTYPE_IP);
-			b1 = gen_cmp(off_linktype, BPF_B,
+			b1 = gen_cmp(OR_LINK, off_linktype, BPF_B,
 				     (bpf_int32)ARCTYPE_IP_OLD);
 			gen_or(b0, b1);
 			return (b1);
 
 		case ETHERTYPE_ARP:
-			b0 = gen_cmp(off_linktype, BPF_B,
+			b0 = gen_cmp(OR_LINK, off_linktype, BPF_B,
 				     (bpf_int32)ARCTYPE_ARP);
-			b1 = gen_cmp(off_linktype, BPF_B,
+			b1 = gen_cmp(OR_LINK, off_linktype, BPF_B,
 				     (bpf_int32)ARCTYPE_ARP_OLD);
 			gen_or(b0, b1);
 			return (b1);
 
 		case ETHERTYPE_REVARP:
-			return (gen_cmp(off_linktype, BPF_B,
+			return (gen_cmp(OR_LINK, off_linktype, BPF_B,
 					(bpf_int32)ARCTYPE_REVARP));
 
 		case ETHERTYPE_ATALK:
-			return (gen_cmp(off_linktype, BPF_B,
+			return (gen_cmp(OR_LINK, off_linktype, BPF_B,
 					(bpf_int32)ARCTYPE_ATALK));
 		}
 		/*NOTREACHED*/
@@ -1797,14 +2208,14 @@ gen_linktype(proto)
 			/*
 			 * Check for the special NLPID for IP.
 			 */
-			return gen_cmp(2, BPF_H, (0x03<<8) | 0xcc);
+			return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | 0xcc);
 
 #ifdef INET6
 		case ETHERTYPE_IPV6:
 			/*
 			 * Check for the special NLPID for IPv6.
 			 */
-			return gen_cmp(2, BPF_H, (0x03<<8) | 0x8e);
+			return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | 0x8e);
 #endif
 
 		case LLCSAP_ISONS:
@@ -1819,9 +2230,9 @@ gen_linktype(proto)
 			 * control field of UI, i.e. 0x03 followed
 			 * by the NLPID.
 			 */
-			b0 = gen_cmp(2, BPF_H, (0x03<<8) | ISO8473_CLNP);
-			b1 = gen_cmp(2, BPF_H, (0x03<<8) | ISO9542_ESIS);
-			b2 = gen_cmp(2, BPF_H, (0x03<<8) | ISO10589_ISIS);
+			b0 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO8473_CLNP);
+			b1 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO9542_ESIS);
+			b2 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO10589_ISIS);
 			gen_or(b1, b2);
 			gen_or(b0, b2);
 			return b2;
@@ -1836,6 +2247,12 @@ gen_linktype(proto)
         case DLT_JUNIPER_MLPPP:
 	case DLT_JUNIPER_ATM1:
 	case DLT_JUNIPER_ATM2:
+	case DLT_JUNIPER_PPPOE:
+	case DLT_JUNIPER_PPPOE_ATM:
+        case DLT_JUNIPER_GGSN:
+        case DLT_JUNIPER_ES:
+        case DLT_JUNIPER_MONITOR:
+        case DLT_JUNIPER_SERVICES:
 		/* just lets verify the magic number for now -
 		 * on ATM we may have up to 6 different encapsulations on the wire
 		 * and need a lot of heuristics to figure out that the payload
@@ -1843,13 +2260,16 @@ gen_linktype(proto)
 		 *
 		 * FIXME encapsulation specific BPF_ filters
 		 */
-		return gen_mcmp(0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */
+		return gen_mcmp(OR_LINK, 0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */
 
 	case DLT_LINUX_IRDA:
 		bpf_error("IrDA link-layer type filtering not implemented");
 
 	case DLT_DOCSIS:
 		bpf_error("DOCSIS link-layer type filtering not implemented");
+
+	case DLT_LINUX_LAPD:
+		bpf_error("LAPD link-layer type filtering not implemented");
 	}
 
 	/*
@@ -1874,7 +2294,7 @@ gen_linktype(proto)
 	 * at "off_linktype", so we don't have to do the code generation
 	 * above.)
 	 */
-	return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+	return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto);
 }
 
 /*
@@ -1900,14 +2320,23 @@ gen_snap(orgcode, ptype, offset)
 	snapblock[5] = (orgcode >> 0);	/* lower 8 bits of organization code */
 	snapblock[6] = (ptype >> 8);	/* upper 8 bits of protocol type */
 	snapblock[7] = (ptype >> 0);	/* lower 8 bits of protocol type */
-	return gen_bcmp(offset, 8, snapblock);
+	return gen_bcmp(OR_LINK, offset, 8, snapblock);
 }
 
 /*
- * Check for a given protocol value assuming an 802.2 LLC header.
+ * Generate code to match a particular packet type, for link-layer types
+ * using 802.2 LLC headers.
+ *
+ * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used
+ * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues.
+ *
+ * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
+ * value, if <= ETHERMTU.  We use that to determine whether to
+ * match the DSAP or both DSAP and LSAP or to check the OUI and
+ * protocol ID in a SNAP header.
  */
 static struct block *
-gen_llc(proto)
+gen_llc_linktype(proto)
 	int proto;
 {
 	/*
@@ -1916,23 +2345,24 @@ gen_llc(proto)
 	switch (proto) {
 
 	case LLCSAP_IP:
-		return gen_cmp(off_linktype, BPF_H, (long)
-			     ((LLCSAP_IP << 8) | LLCSAP_IP));
-
 	case LLCSAP_ISONS:
-		return gen_cmp(off_linktype, BPF_H, (long)
-			     ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
-
 	case LLCSAP_NETBEUI:
-		return gen_cmp(off_linktype, BPF_H, (long)
-			     ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
+		/*
+		 * XXX - should we check both the DSAP and the
+		 * SSAP, like this, or should we check just the
+		 * DSAP, as we do for other types <= ETHERMTU
+		 * (i.e., other SAP values)?
+		 */
+		return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_u_int32)
+			     ((proto << 8) | proto));
 
 	case LLCSAP_IPX:
 		/*
 		 * XXX - are there ever SNAP frames for IPX on
 		 * non-Ethernet 802.x networks?
 		 */
-		return gen_cmp(off_linktype, BPF_B, (bpf_int32)LLCSAP_IPX);
+		return gen_cmp(OR_LINK, off_linktype, BPF_B,
+		    (bpf_int32)LLCSAP_IPX);
 
 	case ETHERTYPE_ATALK:
 		/*
@@ -1956,7 +2386,8 @@ gen_llc(proto)
 			 * This is an LLC SAP value, so check
 			 * the DSAP.
 			 */
-			return gen_cmp(off_linktype, BPF_B, (bpf_int32)proto);
+			return gen_cmp(OR_LINK, off_linktype, BPF_B,
+			    (bpf_int32)proto);
 		} else {
 			/*
 			 * This is an Ethernet type; we assume that it's
@@ -1978,7 +2409,8 @@ gen_llc(proto)
 			 * I don't know whether it's worth the extra CPU
 			 * time to do the right check or not.
 			 */
-			return gen_cmp(off_linktype+6, BPF_H, (bpf_int32)proto);
+			return gen_cmp(OR_LINK, off_linktype+6, BPF_H,
+			    (bpf_int32)proto);
 		}
 	}
 }
@@ -2020,7 +2452,7 @@ gen_hostop(addr, mask, dir, proto, src_off, dst_off)
 		abort();
 	}
 	b0 = gen_linktype(proto);
-	b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
+	b1 = gen_mcmp(OR_NET, offset, BPF_W, (bpf_int32)addr, mask);
 	gen_and(b0, b1);
 	return b1;
 }
@@ -2066,12 +2498,12 @@ gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
 	/* this order is important */
 	a = (u_int32_t *)addr;
 	m = (u_int32_t *)mask;
-	b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
-	b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
+	b1 = gen_mcmp(OR_NET, offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
+	b0 = gen_mcmp(OR_NET, offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
 	gen_and(b0, b1);
-	b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
+	b0 = gen_mcmp(OR_NET, offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
 	gen_and(b0, b1);
-	b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
+	b0 = gen_mcmp(OR_NET, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
 	gen_and(b0, b1);
 	b0 = gen_linktype(proto);
 	gen_and(b0, b1);
@@ -2088,10 +2520,10 @@ gen_ehostop(eaddr, dir)
 
 	switch (dir) {
 	case Q_SRC:
-		return gen_bcmp(off_mac + 6, 6, eaddr);
+		return gen_bcmp(OR_LINK, off_mac + 6, 6, eaddr);
 
 	case Q_DST:
-		return gen_bcmp(off_mac + 0, 6, eaddr);
+		return gen_bcmp(OR_LINK, off_mac + 0, 6, eaddr);
 
 	case Q_AND:
 		b0 = gen_ehostop(eaddr, Q_SRC);
@@ -2123,16 +2555,16 @@ gen_fhostop(eaddr, dir)
 	switch (dir) {
 	case Q_SRC:
 #ifdef PCAP_FDDIPAD
-		return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
+		return gen_bcmp(OR_LINK, 6 + 1 + pcap_fddipad, 6, eaddr);
 #else
-		return gen_bcmp(6 + 1, 6, eaddr);
+		return gen_bcmp(OR_LINK, 6 + 1, 6, eaddr);
 #endif
 
 	case Q_DST:
 #ifdef PCAP_FDDIPAD
-		return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
+		return gen_bcmp(OR_LINK, 0 + 1 + pcap_fddipad, 6, eaddr);
 #else
-		return gen_bcmp(0 + 1, 6, eaddr);
+		return gen_bcmp(OR_LINK, 0 + 1, 6, eaddr);
 #endif
 
 	case Q_AND:
@@ -2164,10 +2596,10 @@ gen_thostop(eaddr, dir)
 
 	switch (dir) {
 	case Q_SRC:
-		return gen_bcmp(8, 6, eaddr);
+		return gen_bcmp(OR_LINK, 8, 6, eaddr);
 
 	case Q_DST:
-		return gen_bcmp(2, 6, eaddr);
+		return gen_bcmp(OR_LINK, 2, 6, eaddr);
 
 	case Q_AND:
 		b0 = gen_thostop(eaddr, Q_SRC);
@@ -2224,8 +2656,7 @@ gen_wlanhostop(eaddr, dir)
 		 *
 		 * First, check for To DS set, i.e. check "link[1] & 0x01".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 1;
+		s = gen_load_a(OR_LINK, 1, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x01;	/* To DS */
 		b1->stmts = s;
@@ -2233,15 +2664,14 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * If To DS is set, the SA is at 24.
 		 */
-		b0 = gen_bcmp(24, 6, eaddr);
+		b0 = gen_bcmp(OR_LINK, 24, 6, eaddr);
 		gen_and(b1, b0);
 
 		/*
 		 * Now, check for To DS not set, i.e. check
 		 * "!(link[1] & 0x01)".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 1;
+		s = gen_load_a(OR_LINK, 1, BPF_B);
 		b2 = new_block(JMP(BPF_JSET));
 		b2->s.k = 0x01;	/* To DS */
 		b2->stmts = s;
@@ -2250,7 +2680,7 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * If To DS is not set, the SA is at 16.
 		 */
-		b1 = gen_bcmp(16, 6, eaddr);
+		b1 = gen_bcmp(OR_LINK, 16, 6, eaddr);
 		gen_and(b2, b1);
 
 		/*
@@ -2264,8 +2694,7 @@ gen_wlanhostop(eaddr, dir)
 		 * Now check for From DS being set, and AND that with
 		 * the ORed-together checks.
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 1;
+		s = gen_load_a(OR_LINK, 1, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x02;	/* From DS */
 		b1->stmts = s;
@@ -2274,8 +2703,7 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * Now check for data frames with From DS not set.
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 1;
+		s = gen_load_a(OR_LINK, 1, BPF_B);
 		b2 = new_block(JMP(BPF_JSET));
 		b2->s.k = 0x02;	/* From DS */
 		b2->stmts = s;
@@ -2284,7 +2712,7 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * If From DS isn't set, the SA is at 10.
 		 */
-		b1 = gen_bcmp(10, 6, eaddr);
+		b1 = gen_bcmp(OR_LINK, 10, 6, eaddr);
 		gen_and(b2, b1);
 
 		/*
@@ -2298,8 +2726,7 @@ gen_wlanhostop(eaddr, dir)
 		 * Now check for a data frame.
 		 * I.e, check "link[0] & 0x08".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 0;
+		gen_load_a(OR_LINK, 0, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x08;
 		b1->stmts = s;
@@ -2314,8 +2741,7 @@ gen_wlanhostop(eaddr, dir)
 		 * is a management frame.
 		 * I.e, check "!(link[0] & 0x08)".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 0;
+		s = gen_load_a(OR_LINK, 0, BPF_B);
 		b2 = new_block(JMP(BPF_JSET));
 		b2->s.k = 0x08;
 		b2->stmts = s;
@@ -2324,7 +2750,7 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * For management frames, the SA is at 10.
 		 */
-		b1 = gen_bcmp(10, 6, eaddr);
+		b1 = gen_bcmp(OR_LINK, 10, 6, eaddr);
 		gen_and(b2, b1);
 
 		/*
@@ -2342,8 +2768,7 @@ gen_wlanhostop(eaddr, dir)
 		 *
 		 * I.e., check "!(link[0] & 0x04)".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 0;
+		s = gen_load_a(OR_LINK, 0, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x04;
 		b1->stmts = s;
@@ -2378,8 +2803,7 @@ gen_wlanhostop(eaddr, dir)
 		 *
 		 * First, check for To DS set, i.e. "link[1] & 0x01".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 1;
+		s = gen_load_a(OR_LINK, 1, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x01;	/* To DS */
 		b1->stmts = s;
@@ -2387,15 +2811,14 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * If To DS is set, the DA is at 16.
 		 */
-		b0 = gen_bcmp(16, 6, eaddr);
+		b0 = gen_bcmp(OR_LINK, 16, 6, eaddr);
 		gen_and(b1, b0);
 
 		/*
 		 * Now, check for To DS not set, i.e. check
 		 * "!(link[1] & 0x01)".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 1;
+		s = gen_load_a(OR_LINK, 1, BPF_B);
 		b2 = new_block(JMP(BPF_JSET));
 		b2->s.k = 0x01;	/* To DS */
 		b2->stmts = s;
@@ -2404,7 +2827,7 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * If To DS is not set, the DA is at 4.
 		 */
-		b1 = gen_bcmp(4, 6, eaddr);
+		b1 = gen_bcmp(OR_LINK, 4, 6, eaddr);
 		gen_and(b2, b1);
 
 		/*
@@ -2417,8 +2840,7 @@ gen_wlanhostop(eaddr, dir)
 		 * Now check for a data frame.
 		 * I.e, check "link[0] & 0x08".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 0;
+		s = gen_load_a(OR_LINK, 0, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x08;
 		b1->stmts = s;
@@ -2433,8 +2855,7 @@ gen_wlanhostop(eaddr, dir)
 		 * is a management frame.
 		 * I.e, check "!(link[0] & 0x08)".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 0;
+		s = gen_load_a(OR_LINK, 0, BPF_B);
 		b2 = new_block(JMP(BPF_JSET));
 		b2->s.k = 0x08;
 		b2->stmts = s;
@@ -2443,7 +2864,7 @@ gen_wlanhostop(eaddr, dir)
 		/*
 		 * For management frames, the DA is at 4.
 		 */
-		b1 = gen_bcmp(4, 6, eaddr);
+		b1 = gen_bcmp(OR_LINK, 4, 6, eaddr);
 		gen_and(b2, b1);
 
 		/*
@@ -2461,8 +2882,7 @@ gen_wlanhostop(eaddr, dir)
 		 *
 		 * I.e., check "!(link[0] & 0x04)".
 		 */
-		s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-		s->s.k = 0;
+		s = gen_load_a(OR_LINK, 0, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x04;
 		b1->stmts = s;
@@ -2506,10 +2926,10 @@ gen_ipfchostop(eaddr, dir)
 
 	switch (dir) {
 	case Q_SRC:
-		return gen_bcmp(10, 6, eaddr);
+		return gen_bcmp(OR_LINK, 10, 6, eaddr);
 
 	case Q_DST:
-		return gen_bcmp(2, 6, eaddr);
+		return gen_bcmp(OR_LINK, 2, 6, eaddr);
 
 	case Q_AND:
 		b0 = gen_ipfchostop(eaddr, Q_SRC);
@@ -2547,10 +2967,9 @@ gen_ipfchostop(eaddr, dir)
  * and not generate masking instructions if the mask is 0xFFFF.
  */
 static struct block *
-gen_dnhostop(addr, dir, base_off)
+gen_dnhostop(addr, dir)
 	bpf_u_int32 addr;
 	int dir;
-	u_int base_off;
 {
 	struct block *b0, *b1, *b2, *tmp;
 	u_int offset_lh;	/* offset if long header is received */
@@ -2570,16 +2989,16 @@ gen_dnhostop(addr, dir, base_off)
 
 	case Q_AND:
 		/* Inefficient because we do our Calvinball dance twice */
-		b0 = gen_dnhostop(addr, Q_SRC, base_off);
-		b1 = gen_dnhostop(addr, Q_DST, base_off);
+		b0 = gen_dnhostop(addr, Q_SRC);
+		b1 = gen_dnhostop(addr, Q_DST);
 		gen_and(b0, b1);
 		return b1;
 
 	case Q_OR:
 	case Q_DEFAULT:
 		/* Inefficient because we do our Calvinball dance twice */
-		b0 = gen_dnhostop(addr, Q_SRC, base_off);
-		b1 = gen_dnhostop(addr, Q_DST, base_off);
+		b0 = gen_dnhostop(addr, Q_SRC);
+		b1 = gen_dnhostop(addr, Q_DST);
 		gen_or(b0, b1);
 		return b1;
 
@@ -2591,26 +3010,25 @@ gen_dnhostop(addr, dir, base_off)
 	}
 	b0 = gen_linktype(ETHERTYPE_DN);
 	/* Check for pad = 1, long header case */
-	tmp = gen_mcmp(base_off + 2, BPF_H,
+	tmp = gen_mcmp(OR_NET, 2, BPF_H,
 	    (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
-	b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
+	b1 = gen_cmp(OR_NET, 2 + 1 + offset_lh,
 	    BPF_H, (bpf_int32)ntohs(addr));
 	gen_and(tmp, b1);
 	/* Check for pad = 0, long header case */
-	tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
-	b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
+	tmp = gen_mcmp(OR_NET, 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
+	b2 = gen_cmp(OR_NET, 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
 	gen_and(tmp, b2);
 	gen_or(b2, b1);
 	/* Check for pad = 1, short header case */
-	tmp = gen_mcmp(base_off + 2, BPF_H,
+	tmp = gen_mcmp(OR_NET, 2, BPF_H,
 	    (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
-	b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
-	    BPF_H, (bpf_int32)ntohs(addr));
+	b2 = gen_cmp(OR_NET, 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
 	gen_and(tmp, b2);
 	gen_or(b2, b1);
 	/* Check for pad = 0, short header case */
-	tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
-	b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
+	tmp = gen_mcmp(OR_NET, 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
+	b2 = gen_cmp(OR_NET, 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
 	gen_and(tmp, b2);
 	gen_or(b2, b1);
 
@@ -2641,16 +3059,13 @@ gen_host(addr, mask, proto, dir)
 		return b0;
 
 	case Q_IP:
-		return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
-				  off_nl + 12, off_nl + 16);
+		return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 12, 16);
 
 	case Q_RARP:
-		return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
-				  off_nl + 14, off_nl + 24);
+		return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 14, 24);
 
 	case Q_ARP:
-		return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
-				  off_nl + 14, off_nl + 24);
+		return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 14, 24);
 
 	case Q_TCP:
 		bpf_error("'tcp' modifier applied to host");
@@ -2683,7 +3098,7 @@ gen_host(addr, mask, proto, dir)
 		bpf_error("AARP host filtering not implemented");
 
 	case Q_DECNET:
-		return gen_dnhostop(addr, dir, off_nl);
+		return gen_dnhostop(addr, dir);
 
 	case Q_SCA:
 		bpf_error("SCA host filtering not implemented");
@@ -2732,6 +3147,9 @@ gen_host(addr, mask, proto, dir)
 	case Q_NETBEUI:
 		bpf_error("'netbeui' modifier applied to host");
 
+	case Q_RADIO:
+		bpf_error("'radio' modifier applied to host");
+
 	default:
 		abort();
 	}
@@ -2806,8 +3224,7 @@ gen_host6(addr, mask, proto, dir)
 		bpf_error("MOPRC host filtering not implemented");
 
 	case Q_IPV6:
-		return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
-				  off_nl + 8, off_nl + 24);
+		return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 8, 24);
 
 	case Q_ICMPV6:
 		bpf_error("'icmp6' modifier applied to host");
@@ -2839,6 +3256,9 @@ gen_host6(addr, mask, proto, dir)
 	case Q_NETBEUI:
 		bpf_error("'netbeui' modifier applied to host");
 
+	case Q_RADIO:
+		bpf_error("'radio' modifier applied to host");
+
 	default:
 		abort();
 	}
@@ -2870,7 +3290,10 @@ gen_gateway(eaddr, alist, proto, dir)
 			b0 = gen_fhostop(eaddr, Q_OR);
 		else if (linktype == DLT_IEEE802)
 			b0 = gen_thostop(eaddr, Q_OR);
-		else if (linktype == DLT_IEEE802_11)
+		else if (linktype == DLT_IEEE802_11 ||
+		    linktype == DLT_IEEE802_11_RADIO_AVS ||
+		    linktype == DLT_IEEE802_11_RADIO ||
+		    linktype == DLT_PRISM_HEADER)
 			b0 = gen_wlanhostop(eaddr, Q_OR);
 		else if (linktype == DLT_SUNATM && is_lane) {
 			/*
@@ -2878,7 +3301,8 @@ gen_gateway(eaddr, alist, proto, dir)
 			 * LE Control marker.  (We've already generated
 			 * a test for LANE.)
 			 */
-			b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
+			b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
+			    0xFF00);
 			gen_not(b1);
 
 			/*
@@ -3145,6 +3569,9 @@ gen_proto_abbrev(proto)
 		b1 = gen_linktype(LLCSAP_NETBEUI);
 		break;
 
+	case Q_RADIO:
+		bpf_error("'radio' is not a valid protocol type");
+
 	default:
 		abort();
 	}
@@ -3158,8 +3585,7 @@ gen_ipfrag()
 	struct block *b;
 
 	/* not ip frag */
-	s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
-	s->s.k = off_nl + 6;
+	s = gen_load_a(OR_NET, 6, BPF_H);
 	b = new_block(JMP(BPF_JSET));
 	b->s.k = 0x1fff;
 	b->stmts = s;
@@ -3168,25 +3594,21 @@ gen_ipfrag()
 	return b;
 }
 
+/*
+ * Generate a comparison to a port value in the transport-layer header
+ * at the specified offset from the beginning of that header.
+ *
+ * XXX - this handles a variable-length prefix preceding the link-layer
+ * header, such as the radiotap or AVS radio prefix, but doesn't handle
+ * variable-length link-layer headers (such as Token Ring or 802.11
+ * headers).
+ */
 static struct block *
 gen_portatom(off, v)
 	int off;
 	bpf_int32 v;
 {
-	struct slist *s;
-	struct block *b;
-
-	s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
-	s->s.k = off_nl;
-
-	s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
-	s->next->s.k = off_nl + off;
-
-	b = new_block(JMP(BPF_JEQ));
-	b->stmts = s;
-	b->s.k = v;
-
-	return b;
+	return gen_cmp(OR_TRAN_IPV4, off, BPF_H, v);
 }
 
 #ifdef INET6
@@ -3195,7 +3617,7 @@ gen_portatom6(off, v)
 	int off;
 	bpf_int32 v;
 {
-	return gen_cmp(off_nl + 40 + off, BPF_H, v);
+	return gen_cmp(OR_TRAN_IPV6, off, BPF_H, v);
 }
 #endif/*INET6*/
 
@@ -3206,7 +3628,7 @@ gen_portop(port, proto, dir)
 	struct block *b0, *b1, *tmp;
 
 	/* ip proto 'proto' */
-	tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
+	tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto);
 	b0 = gen_ipfrag();
 	gen_and(tmp, b0);
 
@@ -3296,8 +3718,8 @@ gen_portop6(port, proto, dir)
 {
 	struct block *b0, *b1, *tmp;
 
-	/* ip proto 'proto' */
-	b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
+	/* ip6 proto 'proto' */
+	b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto);
 
 	switch (dir) {
 	case Q_SRC:
@@ -3337,7 +3759,7 @@ gen_port6(port, ip_proto, dir)
 {
 	struct block *b0, *b1, *tmp;
 
-	/* ether proto ip */
+	/* link proto ip6 */
 	b0 =  gen_linktype(ETHERTYPE_IPV6);
 
 	switch (ip_proto) {
@@ -3363,6 +3785,211 @@ gen_port6(port, ip_proto, dir)
 }
 #endif /* INET6 */
 
+/* gen_portrange code */
+static struct block *
+gen_portrangeatom(off, v1, v2)
+	int off;
+	bpf_int32 v1, v2;
+{
+	struct block *b1, *b2;
+
+	if (v1 > v2) {
+		/*
+		 * Reverse the order of the ports, so v1 is the lower one.
+		 */
+		bpf_int32 vtemp;
+
+		vtemp = v1;
+		v1 = v2;
+		v2 = vtemp;
+	}
+
+	b1 = gen_cmp_ge(OR_TRAN_IPV4, off, BPF_H, v1);
+	b2 = gen_cmp_le(OR_TRAN_IPV4, off, BPF_H, v2);
+
+	gen_and(b1, b2); 
+
+	return b2;
+}
+
+struct block *
+gen_portrangeop(port1, port2, proto, dir)
+	int port1, port2;
+	int proto;
+	int dir;
+{
+	struct block *b0, *b1, *tmp;
+
+	/* ip proto 'proto' */
+	tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto);
+	b0 = gen_ipfrag();
+	gen_and(tmp, b0);
+
+	switch (dir) {
+	case Q_SRC:
+		b1 = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2);
+		break;
+
+	case Q_DST:
+		b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2);
+		break;
+
+	case Q_OR:
+	case Q_DEFAULT:
+		tmp = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2);
+		b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2);
+		gen_or(tmp, b1);
+		break;
+
+	case Q_AND:
+		tmp = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2);
+		b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2);
+		gen_and(tmp, b1);
+		break;
+
+	default:
+		abort();
+	}
+	gen_and(b0, b1);
+
+	return b1;
+}
+
+static struct block *
+gen_portrange(port1, port2, ip_proto, dir)
+	int port1, port2;
+	int ip_proto;
+	int dir;
+{
+	struct block *b0, *b1, *tmp;
+
+	/* link proto ip */
+	b0 =  gen_linktype(ETHERTYPE_IP);
+
+	switch (ip_proto) {
+	case IPPROTO_UDP:
+	case IPPROTO_TCP:
+	case IPPROTO_SCTP:
+		b1 = gen_portrangeop(port1, port2, ip_proto, dir);
+		break;
+
+	case PROTO_UNDEF:
+		tmp = gen_portrangeop(port1, port2, IPPROTO_TCP, dir);
+		b1 = gen_portrangeop(port1, port2, IPPROTO_UDP, dir);
+		gen_or(tmp, b1);
+		tmp = gen_portrangeop(port1, port2, IPPROTO_SCTP, dir);
+		gen_or(tmp, b1);
+		break;
+
+	default:
+		abort();
+	}
+	gen_and(b0, b1);
+	return b1;
+}
+
+#ifdef INET6
+static struct block *
+gen_portrangeatom6(off, v1, v2)
+	int off;
+	bpf_int32 v1, v2;
+{
+	struct block *b1, *b2;
+
+	if (v1 > v2) {
+		/*
+		 * Reverse the order of the ports, so v1 is the lower one.
+		 */
+		bpf_int32 vtemp;
+
+		vtemp = v1;
+		v1 = v2;
+		v2 = vtemp;
+	}
+
+	b1 = gen_cmp_ge(OR_TRAN_IPV6, off, BPF_H, v1);
+	b2 = gen_cmp_le(OR_TRAN_IPV6, off, BPF_H, v2);
+
+	gen_and(b1, b2); 
+
+	return b2;
+}
+
+struct block *
+gen_portrangeop6(port1, port2, proto, dir)
+	int port1, port2;
+	int proto;
+	int dir;
+{
+	struct block *b0, *b1, *tmp;
+
+	/* ip6 proto 'proto' */
+	b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto);
+
+	switch (dir) {
+	case Q_SRC:
+		b1 = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2);
+		break;
+
+	case Q_DST:
+		b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2);
+		break;
+
+	case Q_OR:
+	case Q_DEFAULT:
+		tmp = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2);
+		b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2);
+		gen_or(tmp, b1);
+		break;
+
+	case Q_AND:
+		tmp = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2);
+		b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2);
+		gen_and(tmp, b1);
+		break;
+
+	default:
+		abort();
+	}
+	gen_and(b0, b1);
+
+	return b1;
+}
+
+static struct block *
+gen_portrange6(port1, port2, ip_proto, dir)
+	int port1, port2;
+	int ip_proto;
+	int dir;
+{
+	struct block *b0, *b1, *tmp;
+
+	/* link proto ip6 */
+	b0 =  gen_linktype(ETHERTYPE_IPV6);
+
+	switch (ip_proto) {
+	case IPPROTO_UDP:
+	case IPPROTO_TCP:
+	case IPPROTO_SCTP:
+		b1 = gen_portrangeop6(port1, port2, ip_proto, dir);
+		break;
+
+	case PROTO_UNDEF:
+		tmp = gen_portrangeop6(port1, port2, IPPROTO_TCP, dir);
+		b1 = gen_portrangeop6(port1, port2, IPPROTO_UDP, dir);
+		gen_or(tmp, b1);
+		tmp = gen_portrangeop6(port1, port2, IPPROTO_SCTP, dir);
+		gen_or(tmp, b1);
+		break;
+
+	default:
+		abort();
+	}
+	gen_and(b0, b1);
+	return b1;
+}
+#endif /* INET6 */
+
 static int
 lookup_proto(name, proto)
 	register const char *name;
@@ -3451,10 +4078,23 @@ gen_protochain(v, proto, dir)
 		/*NOTREACHED*/
 	}
 
+	/*
+	 * We don't handle variable-length radiotap here headers yet.
+	 * We might want to add BPF instructions to do the protochain
+	 * work, to simplify that and, on platforms that have a BPF
+	 * interpreter with the new instructions, let the filtering
+	 * be done in the kernel.  (We already require a modified BPF
+	 * engine to do the protochain stuff, to support backward
+	 * branches, and backward branch support is unlikely to appear
+	 * in kernel BPF engines.)
+	 */
+	if (linktype == DLT_IEEE802_11_RADIO)
+		bpf_error("'protochain' not supported with radiotap headers");
+
 	no_optimize = 1; /*this code is not compatible with optimzer yet */
 
 	/*
-	 * s[0] is a dummy entry to protect other BPF insn from damaged
+	 * s[0] is a dummy entry to protect other BPF insn from damage
 	 * by s[fix] = foo with uninitialized variable "fix".  It is somewhat
 	 * hard to find interdependency made by jump table fixup.
 	 */
@@ -3710,6 +4350,15 @@ gen_protochain(v, proto, dir)
 #endif
 }
 
+/*
+ * Generate code that checks whether the packet is a packet for protocol
+ * <proto> and whether the type field in that protocol's header has
+ * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an
+ * IP packet and checks the protocol number in the IP header against <v>.
+ *
+ * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks
+ * against Q_IP and Q_IPV6.
+ */
 static struct block *
 gen_proto(v, proto, dir)
 	int v;
@@ -3749,7 +4398,7 @@ gen_proto(v, proto, dir)
 		 */
 		b0 = gen_linktype(ETHERTYPE_IP);
 #ifndef CHASE_CHAIN
-		b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
+		b1 = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)v);
 #else
 		b1 = gen_protochain(v, Q_IP);
 #endif
@@ -3778,7 +4427,7 @@ gen_proto(v, proto, dir)
 			 *
 			 * XXX - what about SNAP-encapsulated frames?
 			 */
-			return gen_cmp(2, BPF_H, (0x03<<8) | v);
+			return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | v);
 			/*NOTREACHED*/
 			break;
 
@@ -3789,13 +4438,13 @@ gen_proto(v, proto, dir)
 			 */
 			b0 = gen_linktype(LLCSAP_ISONS<<8 | LLCSAP_ISONS);
 			/* OSI in C-HDLC is stuffed with a fudge byte */
-			b1 = gen_cmp(off_nl_nosnap+1, BPF_B, (long)v);
+			b1 = gen_cmp(OR_NET_NOSNAP, 1, BPF_B, (long)v);
 			gen_and(b0, b1);
 			return b1;
 
 		default:
 			b0 = gen_linktype(LLCSAP_ISONS);
-			b1 = gen_cmp(off_nl_nosnap, BPF_B, (long)v);
+			b1 = gen_cmp(OR_NET_NOSNAP, 0, BPF_B, (long)v);
 			gen_and(b0, b1);
 			return b1;
 		}
@@ -3806,7 +4455,7 @@ gen_proto(v, proto, dir)
 		 * 4 is the offset of the PDU type relative to the IS-IS
 		 * header.
 		 */
-		b1 = gen_cmp(off_nl_nosnap+4, BPF_B, (long)v);
+		b1 = gen_cmp(OR_NET_NOSNAP, 4, BPF_B, (long)v);
 		gen_and(b0, b1);
 		return b1;
 
@@ -3881,7 +4530,7 @@ gen_proto(v, proto, dir)
 	case Q_IPV6:
 		b0 = gen_linktype(ETHERTYPE_IPV6);
 #ifndef CHASE_CHAIN
-		b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
+		b1 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)v);
 #else
 		b1 = gen_protochain(v, Q_IPV6);
 #endif
@@ -3907,6 +4556,9 @@ gen_proto(v, proto, dir)
 	case Q_NETBEUI:
 		bpf_error("'netbeui proto' is bogus");
 
+	case Q_RADIO:
+		bpf_error("'radio proto' is bogus");
+
 	default:
 		abort();
 		/* NOTREACHED */
@@ -3935,6 +4587,7 @@ gen_scode(name, q)
 #endif /*INET6*/
 	struct block *b, *tmp;
 	int port, real_proto;
+	int port1, port2;
 
 	switch (q.addr) {
 
@@ -3983,6 +4636,9 @@ gen_scode(name, q)
 				return b;
 
 			case DLT_IEEE802_11:
+			case DLT_IEEE802_11_RADIO_AVS:
+			case DLT_IEEE802_11_RADIO:
+			case DLT_PRISM_HEADER:
 				eaddr = pcap_ether_hostton(name);
 				if (eaddr == NULL)
 					bpf_error(
@@ -4009,8 +4665,8 @@ gen_scode(name, q)
 				 * with an LE Control marker.  (We've
 				 * already generated a test for LANE.)
 				 */
-				tmp = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H,
-				    0xFF00);
+				tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS,
+				    BPF_H, 0xFF00);
 				gen_not(tmp);
 
 				eaddr = pcap_ether_hostton(name);
@@ -4142,6 +4798,50 @@ gen_scode(name, q)
 	    }
 #endif /* INET6 */
 
+	case Q_PORTRANGE:
+		if (proto != Q_DEFAULT &&
+		    proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
+			bpf_error("illegal qualifier of 'portrange'");
+		if (pcap_nametoportrange(name, &port1, &port2, &real_proto) == 0) 
+			bpf_error("unknown port in range '%s'", name);
+		if (proto == Q_UDP) {
+			if (real_proto == IPPROTO_TCP)
+				bpf_error("port in range '%s' is tcp", name);
+			else if (real_proto == IPPROTO_SCTP)
+				bpf_error("port in range '%s' is sctp", name);
+			else
+				/* override PROTO_UNDEF */
+				real_proto = IPPROTO_UDP;
+		}
+		if (proto == Q_TCP) {
+			if (real_proto == IPPROTO_UDP)
+				bpf_error("port in range '%s' is udp", name);
+			else if (real_proto == IPPROTO_SCTP)
+				bpf_error("port in range '%s' is sctp", name);
+			else
+				/* override PROTO_UNDEF */
+				real_proto = IPPROTO_TCP;
+		}
+		if (proto == Q_SCTP) {
+			if (real_proto == IPPROTO_UDP)
+				bpf_error("port in range '%s' is udp", name);
+			else if (real_proto == IPPROTO_TCP)
+				bpf_error("port in range '%s' is tcp", name);
+			else
+				/* override PROTO_UNDEF */
+				real_proto = IPPROTO_SCTP;	
+		}
+#ifndef INET6
+		return gen_portrange(port1, port2, real_proto, dir);
+#else
+	    {
+		struct block *b;
+		b = gen_portrange(port1, port2, real_proto, dir);
+		gen_or(gen_portrange6(port1, port2, real_proto, dir), b);
+		return b;
+	    }
+#endif /* INET6 */
+
 	case Q_GATEWAY:
 #ifndef INET6
 		eaddr = pcap_ether_hostton(name);
@@ -4289,6 +4989,29 @@ gen_ncode(s, v, q)
 	    }
 #endif /* INET6 */
 
+	case Q_PORTRANGE:
+		if (proto == Q_UDP)
+			proto = IPPROTO_UDP;
+		else if (proto == Q_TCP)
+			proto = IPPROTO_TCP;
+		else if (proto == Q_SCTP)
+			proto = IPPROTO_SCTP;
+		else if (proto == Q_DEFAULT)
+			proto = PROTO_UNDEF;
+		else
+			bpf_error("illegal qualifier of 'portrange'");
+
+#ifndef INET6
+		return gen_portrange((int)v, (int)v, proto, dir);
+#else
+	    {
+		struct block *b;
+		b = gen_portrange((int)v, (int)v, proto, dir);
+		gen_or(gen_portrange6((int)v, (int)v, proto, dir), b);
+		return b;
+	    }
+#endif /* INET6 */
+
 	case Q_GATEWAY:
 		bpf_error("'gateway' requires a name");
 		/* NOTREACHED */
@@ -4383,7 +5106,10 @@ gen_ecode(eaddr, q)
 			return gen_fhostop(eaddr, (int)q.dir);
 		if (linktype == DLT_IEEE802)
 			return gen_thostop(eaddr, (int)q.dir);
-		if (linktype == DLT_IEEE802_11)
+		if (linktype == DLT_IEEE802_11 ||
+		    linktype == DLT_IEEE802_11_RADIO_AVS ||
+		    linktype == DLT_IEEE802_11_RADIO ||
+		    linktype == DLT_PRISM_HEADER)
 			return gen_wlanhostop(eaddr, (int)q.dir);
 		if (linktype == DLT_SUNATM && is_lane) {
 			/*
@@ -4391,7 +5117,8 @@ gen_ecode(eaddr, q)
 			 * LE Control marker.  (We've already generated
 			 * a test for LANE.)
 			 */
-			tmp = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
+			tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
+			    0xFF00);
 			gen_not(tmp);
 
 			/*
@@ -4444,6 +5171,13 @@ xfer_to_a(a)
 	return s;
 }
 
+/*
+ * Modify "index" to use the value stored into its register as an
+ * offset relative to the beginning of the header for the protocol
+ * "proto", and allocate a register and put an item "size" bytes long
+ * (1, 2, or 4) at that offset into that register, making it the register
+ * for "index".
+ */
 struct arth *
 gen_load(proto, index, size)
 	int proto;
@@ -4476,8 +5210,36 @@ gen_load(proto, index, size)
 	default:
 		bpf_error("unsupported index operation");
 
+	case Q_RADIO:
+		/*
+		 * The offset is relative to the beginning of the packet
+		 * data, if we have a radio header.  (If we don't, this
+		 * is an error.)
+		 */
+		if (linktype != DLT_IEEE802_11_RADIO_AVS &&
+		    linktype != DLT_IEEE802_11_RADIO &&
+		    linktype != DLT_PRISM_HEADER)
+			bpf_error("radio information not present in capture");
+
+		/*
+		 * Load into the X register the offset computed into the
+		 * register specifed by "index".
+		 */
+		s = xfer_to_x(index);
+
+		/*
+		 * Load the item at that offset.
+		 */
+		tmp = new_stmt(BPF_LD|BPF_IND|size);
+		sappend(s, tmp);
+		sappend(index->s, s);
+		break;
+
 	case Q_LINK:
 		/*
+		 * The offset is relative to the beginning of
+		 * the link-layer header.
+		 *
 		 * XXX - what about ATM LANE?  Should the index be
 		 * relative to the beginning of the AAL5 frame, so
 		 * that 0 refers to the beginning of the LE Control
@@ -4485,8 +5247,33 @@ gen_load(proto, index, size)
 		 * frame, so that 0 refers, for Ethernet LANE, to
 		 * the beginning of the destination address?
 		 */
-		s = xfer_to_x(index);
+		s = gen_llprefixlen();
+
+		/*
+		 * If "s" is non-null, it has code to arrange that the
+		 * X register contains the length of the prefix preceding
+		 * the link-layer header.  Add to it the offset computed
+		 * into the register specified by "index", and move that
+		 * into the X register.  Otherwise, just load into the X
+		 * register the offset computed into the register specifed
+		 * by "index".
+		 */
+		if (s != NULL) {
+			sappend(s, xfer_to_a(index));
+			sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
+			sappend(s, new_stmt(BPF_MISC|BPF_TAX));
+		} else
+			s = xfer_to_x(index);
+
+		/*
+		 * Load the item at the sum of the offset we've put in the
+		 * X register and the offset of the start of the link
+		 * layer header (which is 0 if the radio header is
+		 * variable-length; that header length is what we put
+		 * into the X register and then added to the index).
+		 */
 		tmp = new_stmt(BPF_LD|BPF_IND|size);
+		tmp->s.k = off_ll;
 		sappend(s, tmp);
 		sappend(index->s, s);
 		break;
@@ -4503,13 +5290,44 @@ gen_load(proto, index, size)
 #ifdef INET6
 	case Q_IPV6:
 #endif
-		/* XXX Note that we assume a fixed link header here. */
-		s = xfer_to_x(index);
+		/*
+		 * The offset is relative to the beginning of
+		 * the network-layer header.
+		 * XXX - are there any cases where we want
+		 * off_nl_nosnap?
+		 */
+		s = gen_llprefixlen();
+
+		/*
+		 * If "s" is non-null, it has code to arrange that the
+		 * X register contains the length of the prefix preceding
+		 * the link-layer header.  Add to it the offset computed
+		 * into the register specified by "index", and move that
+		 * into the X register.  Otherwise, just load into the X
+		 * register the offset computed into the register specifed
+		 * by "index".
+		 */
+		if (s != NULL) {
+			sappend(s, xfer_to_a(index));
+			sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
+			sappend(s, new_stmt(BPF_MISC|BPF_TAX));
+		} else
+			s = xfer_to_x(index);
+
+		/*
+		 * Load the item at the sum of the offset we've put in the
+		 * X register and the offset of the start of the network
+		 * layer header.
+		 */
 		tmp = new_stmt(BPF_LD|BPF_IND|size);
 		tmp->s.k = off_nl;
 		sappend(s, tmp);
 		sappend(index->s, s);
 
+		/*
+		 * Do the computation only if the packet contains
+		 * the protocol in question.
+		 */
 		b = gen_proto_abbrev(proto);
 		if (index->b)
 			gen_and(index->b, b);
@@ -4524,8 +5342,29 @@ gen_load(proto, index, size)
 	case Q_IGRP:
 	case Q_PIM:
 	case Q_VRRP:
-		s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
-		s->s.k = off_nl;
+		/*
+		 * The offset is relative to the beginning of
+		 * the transport-layer header.
+		 * XXX - are there any cases where we want
+		 * off_nl_nosnap?
+		 * XXX - we should, if we're built with
+		 * IPv6 support, generate code to load either
+		 * IPv4, IPv6, or both, as appropriate.
+		 */
+		s = gen_loadx_iphdrlen();
+
+		/*
+		 * The X register now contains the sum of the offset
+		 * of the beginning of the link-layer header and
+		 * the length of the network-layer header.  Load
+		 * into the A register the offset relative to
+		 * the beginning of the transport layer header,
+		 * add the X register to that, move that to the
+		 * X register, and load with an offset from the
+		 * X register equal to the offset of the network
+		 * layer header relative to the beginning of
+		 * the link-layer header.
+		 */
 		sappend(s, xfer_to_a(index));
 		sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
 		sappend(s, new_stmt(BPF_MISC|BPF_TAX));
@@ -4533,6 +5372,12 @@ gen_load(proto, index, size)
 		tmp->s.k = off_nl;
 		sappend(index->s, s);
 
+		/*
+		 * Do the computation only if the packet contains
+		 * the protocol in question - which is true only
+		 * if this is an IP datagram and is the first or
+		 * only fragment of that datagram.
+		 */
 		gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
 		if (index->b)
 			gen_and(index->b, b);
@@ -4758,6 +5603,16 @@ gen_less(n)
 	return b;
 }
 
+/*
+ * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to
+ * the beginning of the link-layer header.
+ * XXX - that means you can't test values in the radiotap header, but
+ * as that header is difficult if not impossible to parse generally
+ * without a loop, that might not be a severe problem.  A new keyword
+ * "radio" could be added for that, although what you'd really want
+ * would be a way of testing particular radio header values, which
+ * would generate code appropriate to the radio header in question.
+ */
 struct block *
 gen_byteop(op, idx, val)
 	int op, idx, val;
@@ -4770,17 +5625,14 @@ gen_byteop(op, idx, val)
 		abort();
 
 	case '=':
-		return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
+		return gen_cmp(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val);
 
 	case '<':
-		b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
-		b->s.code = JMP(BPF_JGE);
-		gen_not(b);
+		b = gen_cmp_lt(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val);
 		return b;
 
 	case '>':
-		b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
-		b->s.code = JMP(BPF_JGT);
+		b = gen_cmp_gt(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val);
 		return b;
 
 	case '|':
@@ -4821,7 +5673,10 @@ gen_broadcast(proto)
 			return gen_fhostop(ebroadcast, Q_DST);
 		if (linktype == DLT_IEEE802)
 			return gen_thostop(ebroadcast, Q_DST);
-		if (linktype == DLT_IEEE802_11)
+		if (linktype == DLT_IEEE802_11 ||
+		    linktype == DLT_IEEE802_11_RADIO_AVS ||
+		    linktype == DLT_IEEE802_11_RADIO ||
+		    linktype == DLT_PRISM_HEADER)
 			return gen_wlanhostop(ebroadcast, Q_DST);
 		if (linktype == DLT_IP_OVER_FC)
 			return gen_ipfchostop(ebroadcast, Q_DST);
@@ -4831,7 +5686,8 @@ gen_broadcast(proto)
 			 * LE Control marker.  (We've already generated
 			 * a test for LANE.)
 			 */
-			b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
+			b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
+			    0xFF00);
 			gen_not(b1);
 
 			/*
@@ -4847,8 +5703,8 @@ gen_broadcast(proto)
 	case Q_IP:
 		b0 = gen_linktype(ETHERTYPE_IP);
 		hostmask = ~netmask;
-		b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
-		b2 = gen_mcmp(off_nl + 16, BPF_W,
+		b1 = gen_mcmp(OR_NET, 16, BPF_W, (bpf_int32)0, hostmask);
+		b2 = gen_mcmp(OR_NET, 16, BPF_W,
 			      (bpf_int32)(~0 & hostmask), hostmask);
 		gen_or(b1, b2);
 		gen_and(b0, b2);
@@ -4870,8 +5726,7 @@ gen_mac_multicast(offset)
 	register struct slist *s;
 
 	/* link[offset] & 1 != 0 */
-	s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-	s->s.k = offset;
+	s = gen_load_a(OR_LINK, offset, BPF_B);
 	b0 = new_block(JMP(BPF_JSET));
 	b0->s.k = 1;
 	b0->stmts = s;
@@ -4913,7 +5768,10 @@ gen_multicast(proto)
 			return gen_mac_multicast(2);
 		}
 
-		if (linktype == DLT_IEEE802_11) {
+		if (linktype == DLT_IEEE802_11 ||
+		    linktype == DLT_IEEE802_11_RADIO_AVS ||
+		    linktype == DLT_IEEE802_11_RADIO ||
+		    linktype == DLT_PRISM_HEADER) {
 			/*
 			 * Oh, yuk.
 			 *
@@ -4935,8 +5793,7 @@ gen_multicast(proto)
 			 *
 			 * First, check for To DS set, i.e. "link[1] & 0x01".
 			 */
-			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-			s->s.k = 1;
+			s = gen_load_a(OR_LINK, 1, BPF_B);
 			b1 = new_block(JMP(BPF_JSET));
 			b1->s.k = 0x01;	/* To DS */
 			b1->stmts = s;
@@ -4951,8 +5808,7 @@ gen_multicast(proto)
 			 * Now, check for To DS not set, i.e. check
 			 * "!(link[1] & 0x01)".
 			 */
-			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-			s->s.k = 1;
+			s = gen_load_a(OR_LINK, 1, BPF_B);
 			b2 = new_block(JMP(BPF_JSET));
 			b2->s.k = 0x01;	/* To DS */
 			b2->stmts = s;
@@ -4974,8 +5830,7 @@ gen_multicast(proto)
 			 * Now check for a data frame.
 			 * I.e, check "link[0] & 0x08".
 			 */
-			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-			s->s.k = 0;
+			s = gen_load_a(OR_LINK, 0, BPF_B);
 			b1 = new_block(JMP(BPF_JSET));
 			b1->s.k = 0x08;
 			b1->stmts = s;
@@ -4990,8 +5845,7 @@ gen_multicast(proto)
 			 * is a management frame.
 			 * I.e, check "!(link[0] & 0x08)".
 			 */
-			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-			s->s.k = 0;
+			s = gen_load_a(OR_LINK, 0, BPF_B);
 			b2 = new_block(JMP(BPF_JSET));
 			b2->s.k = 0x08;
 			b2->stmts = s;
@@ -5018,8 +5872,7 @@ gen_multicast(proto)
 			 *
 			 * I.e., check "!(link[0] & 0x04)".
 			 */
-			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
-			s->s.k = 0;
+			s = gen_load_a(OR_LINK, 0, BPF_B);
 			b1 = new_block(JMP(BPF_JSET));
 			b1->s.k = 0x04;
 			b1->stmts = s;
@@ -5044,7 +5897,8 @@ gen_multicast(proto)
 			 * LE Control marker.  (We've already generated
 			 * a test for LANE.)
 			 */
-			b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
+			b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
+			    0xFF00);
 			gen_not(b1);
 
 			/* ether[off_mac] & 1 != 0 */
@@ -5058,15 +5912,14 @@ gen_multicast(proto)
 
 	case Q_IP:
 		b0 = gen_linktype(ETHERTYPE_IP);
-		b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
-		b1->s.code = JMP(BPF_JGE);
+		b1 = gen_cmp_ge(OR_NET, 16, BPF_B, (bpf_int32)224);
 		gen_and(b0, b1);
 		return b1;
 
 #ifdef INET6
 	case Q_IPV6:
 		b0 = gen_linktype(ETHERTYPE_IPV6);
-		b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
+		b1 = gen_cmp(OR_NET, 24, BPF_B, (bpf_int32)255);
 		gen_and(b0, b1);
 		return b1;
 #endif /* INET6 */
@@ -5102,7 +5955,7 @@ gen_inbound(dir)
 			/*
 			 * Match packets sent by this machine.
 			 */
-			b0 = gen_cmp(0, BPF_H, LINUX_SLL_OUTGOING);
+			b0 = gen_cmp(OR_LINK, 0, BPF_H, LINUX_SLL_OUTGOING);
 		} else {
 			/*
 			 * Match packets sent to this machine.
@@ -5114,22 +5967,22 @@ gen_inbound(dir)
 			 * shouldn't be matched, but what about broadcast
 			 * or multicast packets we received?
 			 */
-			b0 = gen_cmp(0, BPF_H, LINUX_SLL_HOST);
+			b0 = gen_cmp(OR_LINK, 0, BPF_H, LINUX_SLL_HOST);
 		}
 		break;
 
 	case DLT_PFLOG:
-		b0 = gen_cmp(offsetof(struct pfloghdr, dir), BPF_B,
+		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, dir), BPF_B,
 		    (bpf_int32)((dir == 0) ? PF_IN : PF_OUT));
 		break;
 
 	case DLT_PPP_PPPD:
 		if (dir) {
 			/* match outgoing packets */
-			b0 = gen_cmp(0, BPF_B, PPP_PPPD_OUT);
+			b0 = gen_cmp(OR_LINK, 0, BPF_B, PPP_PPPD_OUT);
 		} else {
 			/* match incoming packets */
-			b0 = gen_cmp(0, BPF_B, PPP_PPPD_IN);
+			b0 = gen_cmp(OR_LINK, 0, BPF_B, PPP_PPPD_IN);
 		}
 		break;
 
@@ -5137,14 +5990,20 @@ gen_inbound(dir)
         case DLT_JUNIPER_MLPPP:
 	case DLT_JUNIPER_ATM1:
 	case DLT_JUNIPER_ATM2:
+	case DLT_JUNIPER_PPPOE:
+	case DLT_JUNIPER_PPPOE_ATM:
+        case DLT_JUNIPER_GGSN:
+        case DLT_JUNIPER_ES:
+        case DLT_JUNIPER_MONITOR:
+        case DLT_JUNIPER_SERVICES:
 		/* juniper flags (including direction) are stored
 		 * the byte after the 3-byte magic number */
 		if (dir) {
 			/* match outgoing packets */
-			b0 = gen_mcmp(3, BPF_B, 0, 0x01);
+			b0 = gen_mcmp(OR_LINK, 3, BPF_B, 0, 0x01);
 		} else {
 			/* match incoming packets */
-			b0 = gen_mcmp(3, BPF_B, 1, 0x01);
+			b0 = gen_mcmp(OR_LINK, 3, BPF_B, 1, 0x01);
 		}
 	    break;
 
@@ -5176,7 +6035,7 @@ gen_pf_ifname(const char *ifname)
 		    len-1);
 		/* NOTREACHED */
 	}
-	b0 = gen_bcmp(off, strlen(ifname), (const u_char *)ifname);
+	b0 = gen_bcmp(OR_LINK, off, strlen(ifname), (const u_char *)ifname);
 	return (b0);
 }
 
@@ -5195,7 +6054,7 @@ gen_pf_ruleset(char *ruleset)
 		    (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1));
 		/* NOTREACHED */
 	}
-	b0 = gen_bcmp(offsetof(struct pfloghdr, ruleset),
+	b0 = gen_bcmp(OR_LINK, offsetof(struct pfloghdr, ruleset),
 	    strlen(ruleset), (const u_char *)ruleset);
 	return (b0);
 }
@@ -5207,7 +6066,7 @@ gen_pf_rnr(int rnr)
 	struct block *b0;
 
 	if (linktype == DLT_PFLOG) {
-		b0 = gen_cmp(offsetof(struct pfloghdr, rulenr), BPF_W,
+		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, rulenr), BPF_W,
 			 (bpf_int32)rnr);
 	} else {
 		bpf_error("rnr not supported on linktype 0x%x", linktype);
@@ -5228,7 +6087,7 @@ gen_pf_srnr(int srnr)
 		/* NOTREACHED */
 	}
 
-	b0 = gen_cmp(offsetof(struct pfloghdr, subrulenr), BPF_W,
+	b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, subrulenr), BPF_W,
 	    (bpf_int32)srnr);
 	return (b0);
 }
@@ -5240,7 +6099,7 @@ gen_pf_reason(int reason)
 	struct block *b0;
 
 	if (linktype == DLT_PFLOG) {
-		b0 = gen_cmp(offsetof(struct pfloghdr, reason), BPF_B,
+		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, reason), BPF_B,
 		    (bpf_int32)reason);
 	} else {
 		bpf_error("reason not supported on linktype 0x%x", linktype);
@@ -5257,7 +6116,7 @@ gen_pf_action(int action)
 	struct block *b0;
 
 	if (linktype == DLT_PFLOG) {
-		b0 = gen_cmp(offsetof(struct pfloghdr, action), BPF_B,
+		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, action), BPF_B,
 		    (bpf_int32)action);
 	} else {
 		bpf_error("action not supported on linktype 0x%x", linktype);
@@ -5290,10 +6149,10 @@ gen_ahostop(eaddr, dir)
 	switch (dir) {
 	/* src comes first, different from Ethernet */
 	case Q_SRC:
-		return gen_bcmp(0, 1, eaddr);
+		return gen_bcmp(OR_LINK, 0, 1, eaddr);
 
 	case Q_DST:
-		return gen_bcmp(1, 1, eaddr);
+		return gen_bcmp(OR_LINK, 1, 1, eaddr);
 
 	case Q_AND:
 		b0 = gen_ahostop(eaddr, Q_SRC);
@@ -5323,36 +6182,60 @@ gen_vlan(vlan_num)
 
 	/*
 	 * Change the offsets to point to the type and data fields within
-	 * the VLAN packet.  This is somewhat of a kludge.
+	 * the VLAN packet.  Just increment the offsets, so that we
+	 * can support a hierarchy, e.g. "vlan 300 && vlan 200" to
+	 * capture VLAN 200 encapsulated within VLAN 100.
+	 *
+	 * XXX - this is a bit of a kludge.  If we were to split the
+	 * compiler into a parser that parses an expression and
+	 * generates an expression tree, and a code generator that
+	 * takes an expression tree (which could come from our
+	 * parser or from some other parser) and generates BPF code,
+	 * we could perhaps make the offsets parameters of routines
+	 * and, in the handler for an "AND" node, pass to subnodes
+	 * other than the VLAN node the adjusted offsets.
+	 *
+	 * This would mean that "vlan" would, instead of changing the
+	 * behavior of *all* tests after it, change only the behavior
+	 * of tests ANDed with it.  That would change the documented
+	 * semantics of "vlan", which might break some expressions.
+	 * However, it would mean that "(vlan and ip) or ip" would check
+	 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
+	 * checking only for VLAN-encapsulated IP, so that could still
+	 * be considered worth doing; it wouldn't break expressions
+	 * that are of the form "vlan and ..." or "vlan N and ...",
+	 * which I suspect are the most common expressions involving
+	 * "vlan".  "vlan or ..." doesn't necessarily do what the user
+	 * would really want, now, as all the "or ..." tests would
+	 * be done assuming a VLAN, even though the "or" could be viewed
+	 * as meaning "or, if this isn't a VLAN packet...".
 	 */
-	if (orig_nl == (u_int)-1) {
-		orig_linktype = off_linktype;	/* save original values */
-		orig_nl = off_nl;
-		orig_nl_nosnap = off_nl_nosnap;
+        orig_linktype = off_linktype;	/* save original values */
+        orig_nl = off_nl;
 
-		switch (linktype) {
+        switch (linktype) {
 
-		case DLT_EN10MB:
-			off_linktype = 16;
-			off_nl_nosnap = 18;
-			off_nl = 18;
-			break;
+        case DLT_EN10MB:
+                off_linktype += 4;
+                off_nl_nosnap += 4;
+                off_nl += 4;
+                break;
 
-		default:
-			bpf_error("no VLAN support for data link type %d",
-				  linktype);
-			/*NOTREACHED*/
-		}
-	}
+        default:
+                bpf_error("no VLAN support for data link type %d",
+                      linktype);
+            /*NOTREACHED*/
+        }
 
 	/* check for VLAN */
-	b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
+	b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
 
 	/* If a specific VLAN is requested, check VLAN id */
 	if (vlan_num >= 0) {
 		struct block *b1;
 
-		b1 = gen_mcmp(orig_nl, BPF_H, (bpf_int32)vlan_num, 0x0fff);
+		b1 = gen_mcmp(OR_LINK, orig_nl, BPF_H, (bpf_int32)vlan_num,
+		    0x0fff);
 		gen_and(b0, b1);
 		b0 = b1;
 	}
@@ -5371,61 +6254,54 @@ gen_mpls(label_num)
 
 	/*
 	 * Change the offsets to point to the type and data fields within
-	 * the MPLS packet.  This is somewhat of a kludge.
+	 * the MPLS packet.  Just increment the offsets, so that we
+	 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to
+	 * capture packets with an outer label of 100000 and an inner
+	 * label of 1024.
+	 *
+	 * XXX - this is a bit of a kludge.  See comments in gen_vlan().
 	 */
-	if (orig_nl == (u_int)-1) {
-		orig_linktype = off_linktype;	/* save original values */
-		orig_nl = off_nl;
-		orig_nl_nosnap = off_nl_nosnap;
-
-		switch (linktype) {
-
-		case DLT_EN10MB:
-			off_linktype = 16;
-			off_nl_nosnap = 18;
-			off_nl = 18;
-
-			b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_MPLS);
-			break;
-
-		case DLT_PPP:
-			off_linktype = 6;
-			off_nl_nosnap = 8;
-			off_nl = 8;
-
-			b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)PPP_MPLS_UCAST);
-			break;
-
-		case DLT_C_HDLC:
-			off_linktype = 6;
-			off_nl_nosnap = 8;
-			off_nl = 8;
-
-			b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_MPLS);
-			break;
-
-			/* FIXME add other DLT_s ...
-			 * for Frame-Relay/and ATM this may get messy due to SNAP headers
-			 * leave it for now */
-
-		default:
-			bpf_error("no MPLS support for data link type %d",
-				  linktype);
-			b0 = NULL;
-			/*NOTREACHED*/
-		}
-	} else {
-		bpf_error("'mpls' can't be combined with 'vlan' or another 'mpls'");
-		b0 = NULL;
-		/*NOTREACHED*/
-	}
+        orig_linktype = off_linktype;	/* save original values */
+        orig_nl = off_nl;
+
+        switch (linktype) {
+            
+        case DLT_C_HDLC: /* fall through */
+        case DLT_EN10MB:
+                off_nl_nosnap += 4;
+                off_nl += 4;
+                        
+                b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H,
+                    (bpf_int32)ETHERTYPE_MPLS);
+                break;
+
+        case DLT_PPP:
+                off_nl_nosnap += 4;
+                off_nl += 4;
+
+                b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H,
+                    (bpf_int32)PPP_MPLS_UCAST);
+                break;
+
+                /* FIXME add other DLT_s ...
+                 * for Frame-Relay/and ATM this may get messy due to SNAP headers
+                 * leave it for now */
+
+        default:
+                bpf_error("no MPLS support for data link type %d",
+                          linktype);
+                b0 = NULL;
+                /*NOTREACHED*/
+                break;
+        }
 
 	/* If a specific MPLS label is requested, check it */
 	if (label_num >= 0) {
 		struct block *b1;
 
 		label_num = label_num << 12; /* label is shifted 12 bits on the wire */
-		b1 = gen_mcmp(orig_nl, BPF_W, (bpf_int32)label_num, 0xfffff000); /* only compare the first 20 bits */
+		b1 = gen_mcmp(OR_LINK, orig_nl, BPF_W, (bpf_int32)label_num,
+		    0xfffff000); /* only compare the first 20 bits */
 		gen_and(b0, b1);
 		b0 = b1;
 	}
@@ -5436,7 +6312,7 @@ gen_mpls(label_num)
 struct block *
 gen_atmfield_code(atmfield, jvalue, jtype, reverse)
 	int atmfield;
-	bpf_u_int32 jvalue;
+	bpf_int32 jvalue;
 	bpf_u_int32 jtype;
 	int reverse;
 {
@@ -5449,8 +6325,8 @@ gen_atmfield_code(atmfield, jvalue, jtype, reverse)
 			bpf_error("'vpi' supported only on raw ATM");
 		if (off_vpi == (u_int)-1)
 			abort();
-		b0 = gen_ncmp(BPF_B, off_vpi, 0xffffffff, (u_int)jtype,
-		    (u_int)jvalue, reverse);
+		b0 = gen_ncmp(OR_LINK, off_vpi, BPF_B, 0xffffffff, jtype,
+		    reverse, jvalue);
 		break;
 
 	case A_VCI:
@@ -5458,22 +6334,22 @@ gen_atmfield_code(atmfield, jvalue, jtype, reverse)
 			bpf_error("'vci' supported only on raw ATM");
 		if (off_vci == (u_int)-1)
 			abort();
-		b0 = gen_ncmp(BPF_H, off_vci, 0xffffffff, (u_int)jtype,
-		    (u_int)jvalue, reverse);
+		b0 = gen_ncmp(OR_LINK, off_vci, BPF_H, 0xffffffff, jtype,
+		    reverse, jvalue);
 		break;
 
 	case A_PROTOTYPE:
 		if (off_proto == (u_int)-1)
 			abort();	/* XXX - this isn't on FreeBSD */
-		b0 = gen_ncmp(BPF_B, off_proto, 0x0f, (u_int)jtype,
-		    (u_int)jvalue, reverse);
+		b0 = gen_ncmp(OR_LINK, off_proto, BPF_B, 0x0f, jtype,
+		    reverse, jvalue);
 		break;
 
 	case A_MSGTYPE:
 		if (off_payload == (u_int)-1)
 			abort();
-		b0 = gen_ncmp(BPF_B, off_payload + MSG_TYPE_POS, 0xffffffff,
-		    (u_int)jtype, (u_int)jvalue, reverse);
+		b0 = gen_ncmp(OR_LINK, off_payload + MSG_TYPE_POS, BPF_B,
+		    0xffffffff, jtype, reverse, jvalue);
 		break;
 
 	case A_CALLREFTYPE:
@@ -5481,8 +6357,8 @@ gen_atmfield_code(atmfield, jvalue, jtype, reverse)
 			bpf_error("'callref' supported only on raw ATM");
 		if (off_proto == (u_int)-1)
 			abort();
-		b0 = gen_ncmp(BPF_B, off_proto, 0xffffffff, (u_int)jtype,
-		    (u_int)jvalue, reverse);
+		b0 = gen_ncmp(OR_LINK, off_proto, BPF_B, 0xffffffff,
+		    jtype, reverse, jvalue);
 		break;
 
 	default:
@@ -5592,6 +6468,86 @@ gen_atmtype_abbrev(type)
 	return b1;
 }
 
+struct block *
+gen_mtp3field_code(mtp3field, jvalue, jtype, reverse)
+	int mtp3field;
+	bpf_u_int32 jvalue;
+	bpf_u_int32 jtype;
+	int reverse;
+{
+	struct block *b0;
+	bpf_u_int32 val1 , val2 , val3;
+
+	switch (mtp3field) {
+
+	case M_SIO:
+		if (off_sio == (u_int)-1)
+			bpf_error("'sio' supported only on SS7");
+		/* sio coded on 1 byte so max value 255 */
+		if(jvalue > 255)
+		        bpf_error("sio value %u too big; max value = 255",
+		            jvalue);
+		b0 = gen_ncmp(OR_PACKET, off_sio, BPF_B, 0xffffffff,
+		    (u_int)jtype, reverse, (u_int)jvalue);
+		break;
+
+        case M_OPC:
+	        if (off_opc == (u_int)-1)
+			bpf_error("'opc' supported only on SS7");
+		/* opc coded on 14 bits so max value 16383 */
+		if (jvalue > 16383)
+		        bpf_error("opc value %u too big; max value = 16383",
+		            jvalue);
+		/* the following instructions are made to convert jvalue
+		 * to the form used to write opc in an ss7 message*/
+		val1 = jvalue & 0x00003c00;
+		val1 = val1 >>10;
+		val2 = jvalue & 0x000003fc;
+		val2 = val2 <<6;
+		val3 = jvalue & 0x00000003;
+		val3 = val3 <<22;
+		jvalue = val1 + val2 + val3;
+		b0 = gen_ncmp(OR_PACKET, off_opc, BPF_W, 0x00c0ff0f,
+		    (u_int)jtype, reverse, (u_int)jvalue);
+		break;
+
+	case M_DPC:
+	        if (off_dpc == (u_int)-1)
+			bpf_error("'dpc' supported only on SS7");
+		/* dpc coded on 14 bits so max value 16383 */
+		if (jvalue > 16383)
+		        bpf_error("dpc value %u too big; max value = 16383",
+		            jvalue);
+		/* the following instructions are made to convert jvalue
+		 * to the forme used to write dpc in an ss7 message*/
+		val1 = jvalue & 0x000000ff;
+		val1 = val1 << 24;
+		val2 = jvalue & 0x00003f00;
+		val2 = val2 << 8;
+		jvalue = val1 + val2;
+		b0 = gen_ncmp(OR_PACKET, off_dpc, BPF_W, 0xff3f0000,
+		    (u_int)jtype, reverse, (u_int)jvalue);
+		break;
+
+	case M_SLS:
+	        if (off_sls == (u_int)-1)
+			bpf_error("'sls' supported only on SS7");
+		/* sls coded on 4 bits so max value 15 */
+		if (jvalue > 15)
+		         bpf_error("sls value %u too big; max value = 15",
+		             jvalue);
+		/* the following instruction is made to convert jvalue
+		 * to the forme used to write sls in an ss7 message*/
+		jvalue = jvalue << 4;
+		b0 = gen_ncmp(OR_PACKET, off_sls, BPF_B, 0xf0,
+		    (u_int)jtype,reverse, (u_int)jvalue);
+		break;
+
+	default:
+		abort();
+	}
+	return b0;
+}
 
 static struct block *
 gen_msg_abbrev(type)
diff --git a/contrib/libpcap/gencode.h b/contrib/libpcap/gencode.h
index a7cf999..d6dbd00 100644
--- a/contrib/libpcap/gencode.h
+++ b/contrib/libpcap/gencode.h
@@ -19,7 +19,7 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
  * $FreeBSD$
- * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.60 2004/06/16 08:20:30 hannes Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.60.2.5 2005/06/20 21:30:17 guy Exp $ (LBL)
  */
 
 /*
@@ -56,6 +56,10 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#ifndef HAVE___ATTRIBUTE__
+#define __attribute__(x)
+#endif /* HAVE___ATTRIBUTE__ */
+
 /* Address qualifiers. */
 
 #define Q_HOST		1
@@ -64,6 +68,7 @@
 #define Q_GATEWAY	4
 #define Q_PROTO		5
 #define Q_PROTOCHAIN	6
+#define Q_PORTRANGE	7
 
 /* Protocol qualifiers. */
 
@@ -120,6 +125,8 @@
 #define Q_ISIS_PSNP     38
 #define Q_ISIS_LSP      39
 
+#define Q_RADIO		40
+
 /* Directional qualifiers. */
 
 #define Q_SRC		1
@@ -167,6 +174,13 @@
 				   end-to-end circuits, ILMI circuits or
 				   connection signalling circuit. */
 
+/*MTP3 field types */
+#define M_SIO 1
+#define M_OPC 2
+#define M_DPC 3
+#define M_SLS 4
+
+
 struct slist;
 
 struct stmt {
@@ -276,10 +290,12 @@ struct block *gen_inbound(int);
 struct block *gen_vlan(int);
 struct block *gen_mpls(int);
 
-struct block *gen_atmfield_code(int atmfield, bpf_u_int32 jvalue, bpf_u_int32 jtype, int reverse);
+struct block *gen_atmfield_code(int atmfield, bpf_int32 jvalue, bpf_u_int32 jtype, int reverse);
 struct block *gen_atmtype_abbrev(int type);
 struct block *gen_atmmulti_abbrev(int type);
 
+struct block *gen_mtp3field_code(int mtp3field, bpf_u_int32 jvalue, bpf_u_int32 jtype, int reverse);
+
 struct block *gen_pf_ifname(const char *);
 struct block *gen_pf_rnr(int);
 struct block *gen_pf_srnr(int);
@@ -290,10 +306,7 @@ struct block *gen_pf_dir(int);
 
 void bpf_optimize(struct block **);
 void bpf_error(const char *, ...)
-#if HAVE___ATTRIBUTE__
-    __attribute__((noreturn, format (printf, 1, 2)))
-#endif
-;
+    __attribute__((noreturn, format (printf, 1, 2)));
 
 void finish_parse(struct block *);
 char *sdup(const char *);
diff --git a/contrib/libpcap/grammar.y b/contrib/libpcap/grammar.y
index 0d41499..3e40006 100644
--- a/contrib/libpcap/grammar.y
+++ b/contrib/libpcap/grammar.y
@@ -23,7 +23,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.86 2004/12/18 08:49:23 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.86.2.4 2005/06/20 21:30:17 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -98,6 +98,7 @@ pcap_parse()
 	struct {
 		struct qual q;
 		int atmfieldtype;
+		int mtp3fieldtype;
 		struct block *b;
 	} blk;
 	struct block *rblk;
@@ -113,9 +114,12 @@ pcap_parse()
 %type	<i>	atmtype atmmultitype
 %type	<blk>	atmfield
 %type	<blk>	atmfieldvalue atmvalue atmlistvalue
+%type   <blk>   mtp3field
+%type   <blk>   mtp3fieldvalue mtp3value mtp3listvalue
+
 
 %token  DST SRC HOST GATEWAY
-%token  NET NETMASK PORT LESS GREATER PROTO PROTOCHAIN CBYTE
+%token  NET NETMASK PORT PORTRANGE LESS GREATER PROTO PROTOCHAIN CBYTE
 %token  ARP RARP IP SCTP TCP UDP ICMP IGMP IGRP PIM VRRP
 %token  ATALK AARP DECNET LAT SCA MOPRC MOPDL
 %token  TK_BROADCAST TK_MULTICAST
@@ -135,6 +139,8 @@ pcap_parse()
 %token	LANE LLC METAC BCC SC ILMIC OAMF4EC OAMF4SC
 %token	OAM OAMF4 CONNECTMSG METACONNECT
 %token	VPI VCI
+%token	RADIO
+%token  SIO OPC DPC SLS
 
 %type	<s> ID
 %type	<e> EID
@@ -255,6 +261,7 @@ rterm:	  head id		{ $$ = $2; }
 	| atmtype		{ $$.b = gen_atmtype_abbrev($1); $$.q = qerr; }
 	| atmmultitype		{ $$.b = gen_atmmulti_abbrev($1); $$.q = qerr; }
 	| atmfield atmvalue	{ $$.b = $2.b; $$.q = qerr; }
+	| mtp3field mtp3value	{ $$.b = $2.b; $$.q = qerr; }
 	;
 /* protocol level qualifiers */
 pqual:	  pname
@@ -272,6 +279,7 @@ dqual:	  SRC			{ $$ = Q_SRC; }
 aqual:	  HOST			{ $$ = Q_HOST; }
 	| NET			{ $$ = Q_NET; }
 	| PORT			{ $$ = Q_PORT; }
+	| PORTRANGE		{ $$ = Q_PORTRANGE; }
 	;
 /* non-directional address type qualifiers */
 ndaqual:  GATEWAY		{ $$ = Q_GATEWAY; }
@@ -313,6 +321,7 @@ pname:	  LINK			{ $$ = Q_LINK; }
 	| STP			{ $$ = Q_STP; }
 	| IPX			{ $$ = Q_IPX; }
 	| NETBEUI		{ $$ = Q_NETBEUI; }
+	| RADIO			{ $$ = Q_RADIO; }
 	;
 other:	  pqual TK_BROADCAST	{ $$ = gen_broadcast($1); }
 	| pqual TK_MULTICAST	{ $$ = gen_multicast($1); }
@@ -414,18 +423,41 @@ atmfield: VPI			{ $$.atmfieldtype = A_VPI; }
 	| VCI			{ $$.atmfieldtype = A_VCI; }
 	;
 atmvalue: atmfieldvalue
-	| relop NUM		{ $$.b = gen_atmfield_code($<blk>0.atmfieldtype, (u_int)$2, (u_int)$1, 0); }
-	| irelop NUM		{ $$.b = gen_atmfield_code($<blk>0.atmfieldtype, (u_int)$2, (u_int)$1, 1); }
+	| relop NUM		{ $$.b = gen_atmfield_code($<blk>0.atmfieldtype, (bpf_int32)$2, (bpf_u_int32)$1, 0); }
+	| irelop NUM		{ $$.b = gen_atmfield_code($<blk>0.atmfieldtype, (bpf_int32)$2, (bpf_u_int32)$1, 1); }
 	| paren atmlistvalue ')' { $$.b = $2.b; $$.q = qerr; }
 	;
 atmfieldvalue: NUM {
 	$$.atmfieldtype = $<blk>0.atmfieldtype;
 	if ($$.atmfieldtype == A_VPI ||
 	    $$.atmfieldtype == A_VCI)
-		$$.b = gen_atmfield_code($$.atmfieldtype, (u_int) $1, BPF_JEQ, 0);
+		$$.b = gen_atmfield_code($$.atmfieldtype, (bpf_int32) $1, BPF_JEQ, 0);
 	}
 	;
 atmlistvalue: atmfieldvalue
 	| atmlistvalue or atmfieldvalue { gen_or($1.b, $3.b); $$ = $3; }
 	;
+	/* MTP3 field types quantifier */
+mtp3field: SIO			{ $$.mtp3fieldtype = M_SIO; }
+	| OPC			{ $$.mtp3fieldtype = M_OPC; }
+	| DPC			{ $$.mtp3fieldtype = M_DPC; }
+	| SLS                   { $$.mtp3fieldtype = M_SLS; }
+	;
+mtp3value: mtp3fieldvalue
+	| relop NUM		{ $$.b = gen_mtp3field_code($<blk>0.mtp3fieldtype, (u_int)$2, (u_int)$1, 0); }
+	| irelop NUM		{ $$.b = gen_mtp3field_code($<blk>0.mtp3fieldtype, (u_int)$2, (u_int)$1, 1); }
+	| paren mtp3listvalue ')' { $$.b = $2.b; $$.q = qerr; }
+	;
+mtp3fieldvalue: NUM {
+	$$.mtp3fieldtype = $<blk>0.mtp3fieldtype;
+	if ($$.mtp3fieldtype == M_SIO ||
+	    $$.mtp3fieldtype == M_OPC ||
+	    $$.mtp3fieldtype == M_DPC ||
+	    $$.mtp3fieldtype == M_SLS )
+		$$.b = gen_mtp3field_code($$.mtp3fieldtype, (u_int) $1, BPF_JEQ, 0);
+	}
+	;
+mtp3listvalue: mtp3fieldvalue
+	| mtp3listvalue or mtp3fieldvalue { gen_or($1.b, $3.b); $$ = $3; }
+	;
 %%
diff --git a/contrib/libpcap/nametoaddr.c b/contrib/libpcap/nametoaddr.c
index d58e794..fe4c582 100644
--- a/contrib/libpcap/nametoaddr.c
+++ b/contrib/libpcap/nametoaddr.c
@@ -26,7 +26,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.77 2005/03/27 22:26:25 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.77.2.3 2005/04/20 11:13:51 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -76,7 +76,7 @@ struct rtentry;		/* declarations in <net/if.h> */
 #include <ctype.h>
 #include <errno.h>
 #include <stdlib.h>
-#include <memory.h>
+#include <string.h>
 #include <stdio.h>
 
 #include "pcap-int.h"
@@ -218,6 +218,51 @@ pcap_nametoport(const char *name, int *port, int *proto)
 	return 0;
 }
 
+/*
+ * Convert a string in the form PPP-PPP, where correspond to ports, to
+ * a starting and ending port in a port range.
+ * Return 0 on failure.
+ */
+int
+pcap_nametoportrange(const char *name, int *port1, int *port2, int *proto)
+{
+	u_int p1, p2;
+	char *off, *cpy;
+	int save_proto;
+
+	if (sscanf(name, "%d-%d", &p1, &p2) != 2) {
+		if ((cpy = strdup(name)) == NULL)
+			return 0;
+
+		if ((off = strchr(cpy, '-')) == NULL) {
+			free(cpy);
+			return 0;
+		}
+
+		*off = '\0';
+
+		if (pcap_nametoport(cpy, port1, proto) == 0) {
+			free(cpy);
+			return 0;
+		}
+		save_proto = *proto;
+
+		if (pcap_nametoport(off + 1, port2, proto) == 0) {
+			free(cpy);
+			return 0;
+		}
+
+		if (*proto != save_proto)
+			*proto = PROTO_UNDEF;
+	} else {
+		*port1 = p1;
+		*port2 = p2;
+		*proto = PROTO_UNDEF;
+	}
+
+	return 1;
+}
+
 int
 pcap_nametoproto(const char *str)
 {
@@ -424,6 +469,11 @@ pcap_ether_hostton(const char *name)
 #else
 
 #if !defined(HAVE_DECL_ETHER_HOSTTON) || !HAVE_DECL_ETHER_HOSTTON
+#ifndef HAVE_STRUCT_ETHER_ADDR
+struct ether_addr {
+	unsigned char ether_addr_octet[6];
+};
+#endif
 extern int ether_hostton(const char *, struct ether_addr *);
 #endif
 
diff --git a/contrib/libpcap/pcap-int.h b/contrib/libpcap/pcap-int.h
index 260062b..01fe105 100644
--- a/contrib/libpcap/pcap-int.h
+++ b/contrib/libpcap/pcap-int.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD$
- * @(#) $Header: /tcpdump/master/libpcap/pcap-int.h,v 1.68 2004/12/18 08:52:10 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-int.h,v 1.68.2.2 2005/05/03 18:54:36 guy Exp $ (LBL)
  */
 
 #ifndef pcap_int_h
@@ -100,6 +100,14 @@ struct pcap_md {
 #endif
 };
 
+/*
+ * Ultrix, DEC OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H
+ * Tru64 UNIX, and NetBSD pad to make everything line up on a nice boundary.
+ */
+#if defined(ultrix) || defined(__osf__) || (defined(__NetBSD__) && __NetBSD_Version__ > 106000000)
+#define       PCAP_FDDIPAD 3
+#endif
+
 struct pcap {
 #ifdef WIN32
 	ADAPTER *adapter;
@@ -143,12 +151,16 @@ struct pcap {
 	 */
 	u_char *pkt;
 
+	/* We're accepting only packets in this direction/these directions. */
+	direction_t direction;
+
 	/*
 	 * Methods.
 	 */
 	int	(*read_op)(pcap_t *, int cnt, pcap_handler, u_char *);
 	int	(*inject_op)(pcap_t *, const void *, size_t);
 	int	(*setfilter_op)(pcap_t *, struct bpf_program *);
+	int	(*setdirection_op)(pcap_t *, direction_t);
 	int	(*set_datalink_op)(pcap_t *, int);
 	int	(*getnonblock_op)(pcap_t *, char *);
 	int	(*setnonblock_op)(pcap_t *, int, char *);
@@ -239,13 +251,11 @@ int	yylex(void);
 int	pcap_offline_read(pcap_t *, int, pcap_handler, u_char *);
 int	pcap_read(pcap_t *, int cnt, pcap_handler, u_char *);
 
-
-/*
- * Ultrix, DEC OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H
- * Tru64 UNIX, and NetBSD pad to make everything line up on a nice boundary.
- */
-#if defined(ultrix) || defined(__osf__) || defined(__NetBSD__)
-#define       PCAP_FDDIPAD 3
+#ifndef HAVE_STRLCPY
+#define strlcpy(x, y, z) \
+	(strncpy((x), (y), (z)), \
+	 ((z) <= 0 ? 0 : ((x)[(z) - 1] = '\0')), \
+	 strlen((y)))
 #endif
 
 #include <stdarg.h>
diff --git a/contrib/libpcap/pcap-namedb.h b/contrib/libpcap/pcap-namedb.h
index f44c07b..bbd06b0 100644
--- a/contrib/libpcap/pcap-namedb.h
+++ b/contrib/libpcap/pcap-namedb.h
@@ -66,6 +66,7 @@ struct addrinfo *pcap_nametoaddrinfo(const char *);
 bpf_u_int32 pcap_nametonetaddr(const char *);
 
 int	pcap_nametoport(const char *, int *, int *);
+int	pcap_nametoportrange(const char *, int *, int *, int *);
 int	pcap_nametoproto(const char *);
 int	pcap_nametoeproto(const char *);
 int	pcap_nametollc(const char *);
diff --git a/contrib/libpcap/pcap.3 b/contrib/libpcap/pcap.3
index 2af6d80..adf5729 100644
--- a/contrib/libpcap/pcap.3
+++ b/contrib/libpcap/pcap.3
@@ -1,4 +1,4 @@
-.\" @(#) $Header: /tcpdump/master/libpcap/pcap.3,v 1.64 2004/12/17 21:27:54 guy Exp $
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap.3,v 1.64.2.4 2005/06/03 20:36:56 guy Exp $
 .\"
 .\" Copyright (c) 1994, 1996, 1997
 .\"	The Regents of the University of California.  All rights reserved.
@@ -61,6 +61,10 @@ bpf_u_int32 *maskp, char *errbuf)
 .ft
 .LP
 .ft B
+typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
+.ti +8
+			     const u_char *bytes);
+.ft B
 int pcap_dispatch(pcap_t *p, int cnt,
 .ti +8
 pcap_handler callback, u_char *user)
@@ -77,7 +81,8 @@ int pcap_compile(pcap_t *p, struct bpf_program *fp,
 .ti +8
 char *str, int optimize, bpf_u_int32 netmask)
 int pcap_setfilter(pcap_t *p, struct bpf_program *fp)
-void pcap_freecode(struct bpf_program *);
+void pcap_freecode(struct bpf_program *)
+int pcap_setdirection(pcap_t *p, direction_t d)
 .ft
 .LP
 .ft B
@@ -120,6 +125,7 @@ const char *pcap_lib_version(void)
 .ft B
 void pcap_close(pcap_t *p)
 int pcap_dump_flush(pcap_dumper_t *p)
+long pcap_dump_ftell(pcap_dumper_t *p)
 FILE *pcap_dump_file(pcap_dumper_t *p)
 void pcap_dump_close(pcap_dumper_t *p)
 .ft
@@ -775,6 +781,31 @@ when that BPF program is no longer needed, for example after it
 has been made the filter program for a pcap structure by a call to
 .BR pcap_setfilter() .
 .PP
+.B pcap_setdirection()
+is used to specify a direction that packets will be captured.
+.I direction_t 
+is one of the constants
+.BR D_IN ,
+.B D_OUT
+or 
+.BR D_INOUT .
+.B D_IN
+will only capture packets received by the device,
+.B D_OUT
+will only capture packets sent by the device and
+.B D_INOUT
+will capture packets received by or sent by the device.
+.B D_INOUT
+is the default setting if this function is not called.  This isn't
+necessarily supported on all platforms; some platforms might return an
+error, and some other platforms might not support
+.BR D_OUT .
+This operation is not supported if a ``savefile'' is being read.
+.B \-1
+is returned on failure,
+.B 0
+is returned on success.
+.PP
 .B pcap_datalink()
 returns the link layer type; link layer types it can return include:
 .PP
@@ -1250,6 +1281,15 @@ but not yet written to the ``savefile'' will be written.
 .B \-1
 is returned on error, 0 on success.
 .PP
+.B pcap_dump_ftell()
+returns the current file position for the ``savefile'', representing the
+number of bytes written by
+.B pcap_dump_open()
+and
+.BR pcap_dump() .
+.B \-1
+is returned on error.
+.PP
 .B pcap_dump_close()
 closes the ``savefile.''
 .PP
diff --git a/contrib/libpcap/pcap.h b/contrib/libpcap/pcap.h
index 6f5233b..a302ac7 100644
--- a/contrib/libpcap/pcap.h
+++ b/contrib/libpcap/pcap.h
@@ -112,6 +112,12 @@ struct pcap_file_header {
 	bpf_u_int32 linktype;	/* data link type (LINKTYPE_*) */
 };
 
+typedef enum {
+       D_INOUT = 0,
+       D_IN,
+       D_OUT
+} direction_t;
+
 /*
  * Each packet in the dump file is prepended with this generic header.
  * This gets around the problem of different headers for different
@@ -210,6 +216,7 @@ int 	pcap_next_ex(pcap_t *, struct pcap_pkthdr **, const u_char **);
 void	pcap_breakloop(pcap_t *);
 int	pcap_stats(pcap_t *, struct pcap_stat *);
 int	pcap_setfilter(pcap_t *, struct bpf_program *);
+int 	pcap_setdirection(pcap_t *, direction_t);
 int	pcap_getnonblock(pcap_t *, char *);
 int	pcap_setnonblock(pcap_t *, int, char *);
 void	pcap_perror(pcap_t *, char *);
@@ -239,10 +246,11 @@ int	pcap_fileno(pcap_t *);
 
 pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);
 pcap_dumper_t *pcap_dump_fopen(pcap_t *, FILE *fp);
+FILE	*pcap_dump_file(pcap_dumper_t *);
+long	pcap_dump_ftell(pcap_dumper_t *);
 int	pcap_dump_flush(pcap_dumper_t *);
 void	pcap_dump_close(pcap_dumper_t *);
 void	pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *);
-FILE	*pcap_dump_file(pcap_dumper_t *);
 
 int	pcap_findalldevs(pcap_if_t **, char *);
 void	pcap_freealldevs(pcap_if_t *);
diff --git a/contrib/libpcap/rawss7.h b/contrib/libpcap/rawss7.h
deleted file mode 100644
index 8f8d058..0000000
--- a/contrib/libpcap/rawss7.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/* -*- Mode: c; tab-width: 8; indent-tabs-mode: 1; c-basic-offset: 8; -*- */
-/*
- * Copyright (c) 2003  -	The tcpdump group.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor of the Laboratory may be used
- *    to endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * @(#) $Header: /tcpdump/master/libpcap/rawss7.h,v 1.1 2003/09/10 19:55:36 mcr Exp $ (LBL)
- */
-
-/*
- * This file is never used in libpcap or tcpdump. It is provided as
- * documentation linktypes 139 through 142 only.
- */
-
-/*
- * Date: Tue, 09 Sep 2003 09:41:04 -0400
- * From: Jeff Morriss <jeff.morriss[AT]ulticom.com>
- * To: tcpdump-workers@tcpdump.org
- * Subject: [tcpdump-workers] request for LINKTYPE_
- *
- * We've had some discussion over on ethereal-dev about a "fake link" or
- * "raw SS7" dissector that allows dumping an arbitrary protocol into a
- * file without any (otherwise necessary) lower level protocols.  The
- * common example has been dumping MTP3 into a file without, well, MTP2 or
- * M2PA.
- *
- * We want to store these protocols directly in PCAP file format because
- * it's well defined and there isn't another (popular) file format for
- * capturing SS7 messages that we can reverse engineer (and we want to read
- * these files into Ethereal).  Rather than creating a new file format, it's
- * a lot easier to just allocate a LINKTYPE_.
- *
- * Here is the original post thread:
- *
- * http://ethereal.com/lists/ethereal-dev/200306/threads.html#00200
- *
- * July's thread on the subject:
- * 
- * http://ethereal.com/lists/ethereal-dev/200307/threads.html#00124
- *
- * August's thread:
- *
- * http://ethereal.com/lists/ethereal-dev/200308/threads.html#00193
- *
- *
- * and one of the last messages--which is why I'm mailing you today:
- * 
- * http://ethereal.com/lists/ethereal-dev/200308/msg00193.html
- *
- *
- * Based on the message in the last URL, I'd like to request a new
- * LINKTYPE_:  LINKTYPE_RAWSS7.
- *
- * This packets in this file type will contain a header:
- */
-
-typedef struct _rawss7_hdr {
-         /* NOTE: These are in network-byte order. */
-         guint32 type;
-         guint16 length;
-	 guint16 spare;
-} rawss7_hdr;
-
-/*
- *
- * followed by protocol data for whatever protocol 'type' indicates.
- *
- * There was some discussion about these protocol 'type's being allocated by
- * tcpdump-workers as well.  In fact it would be handy to have one place to
- * allocate such numbers, so what do you think about allocating 3 more (for
- * now) LINKTYPE_'s:
- */
-
-#define LINKTYPE_RAWSS7_MTP2	140
-#define LINKTYPE_RAWSS7_MTP3	141
-#define LINKTYPE_RAWSS7_SCCP	142
-
-/*
- *
- *  There is no reason this can't be used to store non-SS7 protocols, but
- *  it's what we need to use it for now...
- *
- */
diff --git a/contrib/libpcap/scanner.l b/contrib/libpcap/scanner.l
index 8be0cae..2bed45b 100644
--- a/contrib/libpcap/scanner.l
+++ b/contrib/libpcap/scanner.l
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.99 2004/06/16 08:20:28 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.99.2.3 2005/06/20 21:30:19 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -184,6 +184,7 @@ igmp		return IGMP;
 igrp		return IGRP;
 pim		return PIM;
 vrrp		return VRRP;
+radio		return RADIO;
 
 ip6		{
 #ifdef INET6
@@ -235,6 +236,7 @@ host		return HOST;
 net		return NET;
 mask		return NETMASK;
 port		return PORT;
+portrange	return PORTRANGE;
 proto		return PROTO;
 protochain	{
 #ifdef NO_PROTOCHAIN
@@ -285,6 +287,11 @@ srnr|subrulenum	return PF_SRNR;
 reason		return PF_REASON;
 action		return PF_ACTION;
 
+sio		return SIO;
+opc		return OPC;
+dpc		return DPC;
+sls		return SLS;
+
 [ \r\n\t]		;
 [+\-*/:\[\]!<>()&|=]	return yytext[0];
 ">="			return GEQ;