diff --git a/0003-pcap-linux-apparently-ctc-interfaces-on-s390-has-eth.patch b/0003-pcap-linux-apparently-ctc-interfaces-on-s390-has-eth.patch index 6d7532c345fe6508f876cd34ec3c887a4cdbf4b7..7f7d372b6c1d6129155c12c27bc38eb3cf07235a 100644 --- a/0003-pcap-linux-apparently-ctc-interfaces-on-s390-has-eth.patch +++ b/0003-pcap-linux-apparently-ctc-interfaces-on-s390-has-eth.patch @@ -13,7 +13,7 @@ index 900ebbc..58292c3 100644 --- a/pcap-linux.c +++ b/pcap-linux.c @@ -3197,6 +3197,10 @@ activate_new(pcap_t *handle) - handle->linktype = DLT_LINUX_SLL; + } } + /* Hack to make things work on s390 ctc interfaces */ @@ -26,4 +26,3 @@ index 900ebbc..58292c3 100644 -- 1.8.3.1 - diff --git a/0611-With-MSVC-abort-if-_BitScanForward-returns-0.patch b/0611-With-MSVC-abort-if-_BitScanForward-returns-0.patch deleted file mode 100644 index c76637ff2c8fc52de6e9ed936d30c146c874cc74..0000000000000000000000000000000000000000 --- a/0611-With-MSVC-abort-if-_BitScanForward-returns-0.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 3b9b6100912f7bb1ee43f9cfb51e804765a37bd4 Mon Sep 17 00:00:00 2001 -From: Guy Harris -Date: Thu, 3 Oct 2019 09:27:36 -0700 -Subject: [PATCH 611/977] With MSVC, abort if _BitScanForward() returns 0. - -It should never return zero, as never pass a value of 0 to -lowest_set_bit(), but this should keep Coverity from getting upset (as a -result of not understanding _BitScanForward() well enough to realize -that if it's passed a non-zero value it will never return 0). - -Reported by Charles Smith at Tangible Security. ---- - optimize.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/optimize.c b/optimize.c -index 283a6de..e38d2d7 100644 ---- a/optimize.c -+++ b/optimize.c -@@ -137,7 +137,7 @@ lowest_set_bit(int mask) - * (It's currently not, in MSVC, even on 64-bit platforms, but....) - */ - if (_BitScanForward(&bit, (unsigned int)mask) == 0) -- return -1; /* mask is zero */ -+ abort(); /* mask is zero */ - return (int)bit; - } - #elif defined(MSDOS) && defined(__DJGPP__) --- -1.8.3.1 - diff --git a/0875-optimize-make-some-variables-unsigned.patch b/0875-optimize-make-some-variables-unsigned.patch deleted file mode 100644 index b406aaa293e77541a0a3ddaf12218bd0620f73bb..0000000000000000000000000000000000000000 --- a/0875-optimize-make-some-variables-unsigned.patch +++ /dev/null @@ -1,279 +0,0 @@ -From d71913d38475f5b4f0dc753074337ba29d5c0789 Mon Sep 17 00:00:00 2001 -From: Guy Harris -Date: Thu, 21 May 2020 22:37:19 -0700 -Subject: [PATCH 875/977] optimize: make some variables unsigned. - -That should avoid some overflow failure modes, and allow saner overflow -checking. ---- - optimize.c | 92 ++++++++++++++++++++++++++++++++++++++------------------------ - 1 file changed, 57 insertions(+), 35 deletions(-) - -diff --git a/optimize.c b/optimize.c -index 325d4ff..bea8cdc 100644 ---- a/optimize.c -+++ b/optimize.c -@@ -115,7 +115,7 @@ pcap_set_print_dot_graph(int value) - /* - * GCC 3.4 and later; we have __builtin_ctz(). - */ -- #define lowest_set_bit(mask) __builtin_ctz(mask) -+ #define lowest_set_bit(mask) ((u_int)__builtin_ctz(mask)) - #elif defined(_MSC_VER) - /* - * Visual Studio; we support only 2005 and later, so use -@@ -127,7 +127,7 @@ pcap_set_print_dot_graph(int value) - #pragma intrinsic(_BitScanForward) - #endif - --static __forceinline int -+static __forceinline u_int - lowest_set_bit(int mask) - { - unsigned long bit; -@@ -138,14 +138,14 @@ lowest_set_bit(int mask) - */ - if (_BitScanForward(&bit, (unsigned int)mask) == 0) - abort(); /* mask is zero */ -- return (int)bit; -+ return (u_int)bit; - } - #elif defined(MSDOS) && defined(__DJGPP__) - /* - * MS-DOS with DJGPP, which declares ffs() in , which - * we've already included. - */ -- #define lowest_set_bit(mask) (ffs((mask)) - 1) -+ #define lowest_set_bit(mask) ((u_int)(ffs((mask)) - 1)) - #elif (defined(MSDOS) && defined(__WATCOMC__)) || defined(STRINGS_H_DECLARES_FFS) - /* - * MS-DOS with Watcom C, which has and declares ffs() there, -@@ -153,18 +153,18 @@ lowest_set_bit(int mask) - * of the Single UNIX Specification). - */ - #include -- #define lowest_set_bit(mask) (ffs((mask)) - 1) -+ #define lowest_set_bit(mask) (u_int)((ffs((mask)) - 1)) - #else - /* - * None of the above. - * Use a perfect-hash-function-based function. - */ --static int -+static u_int - lowest_set_bit(int mask) - { - unsigned int v = (unsigned int)mask; - -- static const int MultiplyDeBruijnBitPosition[32] = { -+ static const u_int MultiplyDeBruijnBitPosition[32] = { - 0, 1, 28, 2, 29, 14, 24, 3, 30, 22, 20, 15, 25, 17, 4, 8, - 31, 27, 13, 23, 21, 19, 16, 7, 26, 12, 18, 6, 11, 5, 10, 9 - }; -@@ -257,17 +257,17 @@ typedef struct { - */ - int done; - -- int n_blocks; -+ u_int n_blocks; /* number of blocks in the CFG; guaranteed to be > 0, as it's a RET instruction at a minimum */ - struct block **blocks; -- int n_edges; -+ u_int n_edges; /* twice n_blocks, so guaranteed to be > 0 */ - struct edge **edges; - - /* - * A bit vector set representation of the dominators. - * We round up the set size to the next power of two. - */ -- int nodewords; -- int edgewords; -+ u_int nodewords; /* number of 32-bit words for a bit vector of "number of nodes" bits; guaranteed to be > 0 */ -+ u_int edgewords; /* number of 32-bit words for a bit vector of "number of edges" bits; guaranteed to be > 0 */ - struct block **levels; - bpf_u_int32 *space; - -@@ -292,32 +292,35 @@ typedef struct { - - /* - * a := a intersect b -+ * n must be guaranteed to be > 0 - */ - #define SET_INTERSECT(a, b, n)\ - {\ - register bpf_u_int32 *_x = a, *_y = b;\ -- register int _n = n;\ -- while (--_n >= 0) *_x++ &= *_y++;\ -+ register u_int _n = n;\ -+ do *_x++ &= *_y++; while (--_n != 0);\ - } - - /* - * a := a - b -+ * n must be guaranteed to be > 0 - */ - #define SET_SUBTRACT(a, b, n)\ - {\ - register bpf_u_int32 *_x = a, *_y = b;\ -- register int _n = n;\ -- while (--_n >= 0) *_x++ &=~ *_y++;\ -+ register u_int _n = n;\ -+ do *_x++ &=~ *_y++; while (--_n != 0);\ - } - - /* - * a := a union b -+ * n must be guaranteed to be > 0 - */ - #define SET_UNION(a, b, n)\ - {\ - register bpf_u_int32 *_x = a, *_y = b;\ -- register int _n = n;\ -- while (--_n >= 0) *_x++ |= *_y++;\ -+ register u_int _n = n;\ -+ do *_x++ |= *_y++; while (--_n != 0);\ - } - - uset all_dom_sets; -@@ -414,7 +417,8 @@ find_levels(opt_state_t *opt_state, struct icode *ic) - static void - find_dom(opt_state_t *opt_state, struct block *root) - { -- int i; -+ u_int i; -+ int level; - struct block *b; - bpf_u_int32 *x; - -@@ -422,16 +426,25 @@ find_dom(opt_state_t *opt_state, struct block *root) - * Initialize sets to contain all nodes. - */ - x = opt_state->all_dom_sets; -+ /* -+ * These are both guaranteed to be > 0, so the product is -+ * guaranteed to be > 0. -+ * -+ * XXX - but what if it overflows? -+ */ - i = opt_state->n_blocks * opt_state->nodewords; -- while (--i >= 0) -+ do - *x++ = 0xFFFFFFFFU; -+ while (--i != 0); - /* Root starts off empty. */ -- for (i = opt_state->nodewords; --i >= 0;) -+ i = opt_state->nodewords; -+ do - root->dom[i] = 0; -+ while (--i != 0); - - /* root->level is the highest level no found. */ -- for (i = root->level; i >= 0; --i) { -- for (b = opt_state->levels[i]; b; b = b->link) { -+ for (level = root->level; level >= 0; --level) { -+ for (b = opt_state->levels[level]; b; b = b->link) { - SET_INSERT(b->dom, b->id); - if (JT(b) == 0) - continue; -@@ -458,19 +471,28 @@ propedom(opt_state_t *opt_state, struct edge *ep) - static void - find_edom(opt_state_t *opt_state, struct block *root) - { -- int i; -+ u_int i; - uset x; -+ int level; - struct block *b; - - x = opt_state->all_edge_sets; -- for (i = opt_state->n_edges * opt_state->edgewords; --i >= 0; ) -+ /* -+ * These are both guaranteed to be > 0, so the product is -+ * guaranteed to be > 0. -+ * -+ * XXX - but what if it overflows? -+ */ -+ i = opt_state->n_edges * opt_state->edgewords; -+ do - x[i] = 0xFFFFFFFFU; -+ while (--i != 0); - - /* root->level is the highest level no found. */ - memset(root->et.edom, 0, opt_state->edgewords * sizeof(*(uset)0)); - memset(root->ef.edom, 0, opt_state->edgewords * sizeof(*(uset)0)); -- for (i = root->level; i >= 0; --i) { -- for (b = opt_state->levels[i]; b != 0; b = b->link) { -+ for (level = root->level; level >= 0; --level) { -+ for (b = opt_state->levels[level]; b != 0; b = b->link) { - propedom(opt_state, &b->et); - propedom(opt_state, &b->ef); - } -@@ -487,7 +509,7 @@ find_edom(opt_state_t *opt_state, struct block *root) - static void - find_closure(opt_state_t *opt_state, struct block *root) - { -- int i; -+ int level; - struct block *b; - - /* -@@ -497,8 +519,8 @@ find_closure(opt_state_t *opt_state, struct block *root) - opt_state->n_blocks * opt_state->nodewords * sizeof(*opt_state->all_closure_sets)); - - /* root->level is the highest level no found. */ -- for (i = root->level; i >= 0; --i) { -- for (b = opt_state->levels[i]; b; b = b->link) { -+ for (level = root->level; level >= 0; --level) { -+ for (b = opt_state->levels[level]; b; b = b->link) { - SET_INSERT(b->closure, b->id); - if (JT(b) == 0) - continue; -@@ -1674,6 +1696,6 @@ fold_edge(struct block *child, struct edge *ep) - static void - opt_j(opt_state_t *opt_state, struct edge *ep) - { -- register int i, k; -+ register u_int i, k; - register struct block *target; - -@@ -2116,17 +2138,16 @@ link_inedge(struct edge *parent, struct block *child) - static void - find_inedges(opt_state_t *opt_state, struct block *root) - { -- int i; - struct block *b; - -- for (i = 0; i < opt_state->n_blocks; ++i) -+ for (u_int i = 0; i < opt_state->n_blocks; ++i) - opt_state->blocks[i]->in_edges = 0; - - /* - * Traverse the graph, adding each edge to the predecessor - * list of its successors. Skip the leaves (i.e. level 0). - */ -- for (i = root->level; i > 0; --i) { -+ for (int i = root->level; i > 0; --i) { - for (b = opt_state->levels[i]; b != 0; b = b->link) { - link_inedge(&b->et, JT(b)); - link_inedge(&b->ef, JF(b)); -@@ -2336,7 +2357,7 @@ static void - intern_blocks(opt_state_t *opt_state, struct icode *ic) - { - struct block *p; -- int i, j; -+ u_int i, j; - int done1; /* don't shadow global */ - top: - done1 = 1; -@@ -2345,7 +2366,8 @@ intern_blocks(opt_state_t *opt_state, struct icode *ic) - - mark_code(ic); - -- for (i = opt_state->n_blocks - 1; --i >= 0; ) { -+ for (i = opt_state->n_blocks - 1; i != 0; ) { -+ --i; - if (!isMarked(ic, opt_state->blocks[i])) - continue; - for (j = i + 1; j < opt_state->n_blocks; ++j) { --- -1.8.3.1 - diff --git a/0876-optimize-fix-some-of-those-changes.patch b/0876-optimize-fix-some-of-those-changes.patch deleted file mode 100644 index ad63e983e762a6b76c8df6278897bffbf8608004..0000000000000000000000000000000000000000 --- a/0876-optimize-fix-some-of-those-changes.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 2aa7d268e2ce37025d68a3f428001f6f779f56e8 Mon Sep 17 00:00:00 2001 -From: Guy Harris -Date: Thu, 21 May 2020 23:36:09 -0700 -Subject: [PATCH 876/977] optimize: fix some of those changes. - -For loops with predecrements that we eliminated because we don't want to -rely on the loop index going negative if it's zero before the -predecrement - the index is now unsigned, so it'll *never go negative - -we revert to a similar loop, but with the test checking whether the -index is 0 and decrementing it as the first action in the loop body. - -(Yeah, it means that, on machines with condition codes, you don't get to -use the condition code setting of the decrement "for free"; we'll let -the compiler and the processor figure out how to do that efficiently.) ---- - optimize.c | 35 ++++++++++++++++------------------- - 1 file changed, 16 insertions(+), 19 deletions(-) - -diff --git a/optimize.c b/optimize.c -index bea8cdc..07fc0f3 100644 ---- a/optimize.c -+++ b/optimize.c -@@ -427,20 +427,18 @@ find_dom(opt_state_t *opt_state, struct block *root) - */ - x = opt_state->all_dom_sets; - /* -- * These are both guaranteed to be > 0, so the product is -- * guaranteed to be > 0. -- * -- * XXX - but what if it overflows? -+ * XXX - what if the multiplication overflows? - */ - i = opt_state->n_blocks * opt_state->nodewords; -- do -+ while (i != 0) { -+ --i; - *x++ = 0xFFFFFFFFU; -- while (--i != 0); -+ } - /* Root starts off empty. */ -- i = opt_state->nodewords; -- do -+ for (i = opt_state->nodewords; i != 0;) { -+ --i; - root->dom[i] = 0; -- while (--i != 0); -+ } - - /* root->level is the highest level no found. */ - for (level = root->level; level >= 0; --level) { -@@ -478,15 +476,12 @@ find_edom(opt_state_t *opt_state, struct block *root) - - x = opt_state->all_edge_sets; - /* -- * These are both guaranteed to be > 0, so the product is -- * guaranteed to be > 0. -- * -- * XXX - but what if it overflows? -+ * XXX - what if the multiplication overflows? - */ -- i = opt_state->n_edges * opt_state->edgewords; -- do -+ for (i = opt_state->n_edges * opt_state->edgewords; i != 0; ) { -+ --i; - x[i] = 0xFFFFFFFFU; -- while (--i != 0); -+ } - - /* root->level is the highest level no found. */ - memset(root->et.edom, 0, opt_state->edgewords * sizeof(*(uset)0)); -@@ -2138,17 +2133,19 @@ link_inedge(struct edge *parent, struct block *child) - static void - find_inedges(opt_state_t *opt_state, struct block *root) - { -+ u_int i; -+ int level; - struct block *b; - -- for (u_int i = 0; i < opt_state->n_blocks; ++i) -+ for (i = 0; i < opt_state->n_blocks; ++i) - opt_state->blocks[i]->in_edges = 0; - - /* - * Traverse the graph, adding each edge to the predecessor - * list of its successors. Skip the leaves (i.e. level 0). - */ -- for (int i = root->level; i > 0; --i) { -- for (b = opt_state->levels[i]; b != 0; b = b->link) { -+ for (level = root->level; level > 0; --level) { -+ for (b = opt_state->levels[level]; b != 0; b = b->link) { - link_inedge(&b->et, JT(b)); - link_inedge(&b->ef, JF(b)); - } --- -1.8.3.1 - diff --git a/clean-up-signed-vs-unsigned-do-more-error-checking-in-the-parser.patch b/clean-up-signed-vs-unsigned-do-more-error-checking-in-the-parser.patch deleted file mode 100644 index 1586e9ae13df835d0094096d2282f4486a9f23bc..0000000000000000000000000000000000000000 --- a/clean-up-signed-vs-unsigned-do-more-error-checking-in-the-parser.patch +++ /dev/null @@ -1,2975 +0,0 @@ -From 72902568e6df7d410b0a9f09133601cdcf65d6a3 Mon Sep 17 00:00:00 2001 -From: Guy Harris -Date: Tue, 17 Dec 2019 22:12:55 +0800 - -From：https://github.com/the-tcpdump-group/libpcap/commit/81d760fecaec22d89d8cdad54d605ec8f25be143#diff-021c0dd9e9ed7100b9e31d8d95c930f2L2379 ---- - gencode.c | 697 ++++++++++++++++++++++++++--------------------------- - gencode.h | 32 +-- - grammar.y | 139 ++++++----- - optimize.c | 92 ++++--- - scanner.l | 237 +++++++++++------- - 5 files changed, 652 insertions(+), 545 deletions(-) - -diff --git a/gencode.c b/gencode.c -index e3425cd..07bec50 100644 ---- a/gencode.c -+++ b/gencode.c -@@ -248,6 +248,7 @@ struct chunk { - struct _compiler_state { - jmp_buf top_ctx; - pcap_t *bpf_pcap; -+ int error_set; - - struct icode ic; - -@@ -435,10 +436,22 @@ bpf_set_error(compiler_state_t *cstate, const char *fmt, ...) - { - va_list ap; - -- va_start(ap, fmt); -- (void)pcap_vsnprintf(cstate->bpf_pcap->errbuf, PCAP_ERRBUF_SIZE, -- fmt, ap); -- va_end(ap); -+ /* -+ * If we've already set an error, don't override it. -+ * The lexical analyzer reports some errors by setting -+ * the error and then returning a LEX_ERROR token, which -+ * is not recognized by any grammar rule, and thus forces -+ * the parse to stop. We don't want the error reported -+ * by the lexical analyzer to be overwritten by the syntax -+ * error. -+ */ -+ if (!cstate->error_set) { -+ va_start(ap, fmt); -+ (void)pcap_vsnprintf(cstate->bpf_pcap->errbuf, PCAP_ERRBUF_SIZE, -+ fmt, ap); -+ va_end(ap); -+ cstate->error_set = 1; -+ } - } - - /* -@@ -479,21 +492,21 @@ static inline void syntax(compiler_state_t *cstate); - static void backpatch(struct block *, struct block *); - static void merge(struct block *, struct block *); - static struct block *gen_cmp(compiler_state_t *, enum e_offrel, u_int, -- u_int, bpf_int32); -+ u_int, bpf_u_int32); - static struct block *gen_cmp_gt(compiler_state_t *, enum e_offrel, u_int, -- u_int, bpf_int32); -+ u_int, bpf_u_int32); - static struct block *gen_cmp_ge(compiler_state_t *, enum e_offrel, u_int, -- u_int, bpf_int32); -+ u_int, bpf_u_int32); - static struct block *gen_cmp_lt(compiler_state_t *, enum e_offrel, u_int, -- u_int, bpf_int32); -+ u_int, bpf_u_int32); - static struct block *gen_cmp_le(compiler_state_t *, enum e_offrel, u_int, -- u_int, bpf_int32); -+ u_int, bpf_u_int32); - static struct block *gen_mcmp(compiler_state_t *, enum e_offrel, u_int, -- u_int, bpf_int32, bpf_u_int32); -+ u_int, bpf_u_int32, bpf_u_int32); - static struct block *gen_bcmp(compiler_state_t *, enum e_offrel, u_int, - u_int, const u_char *); --static struct block *gen_ncmp(compiler_state_t *, enum e_offrel, bpf_u_int32, -- bpf_u_int32, bpf_u_int32, bpf_u_int32, int, bpf_int32); -+static struct block *gen_ncmp(compiler_state_t *, enum e_offrel, u_int, -+ u_int, bpf_u_int32, int, int, bpf_u_int32); - static struct slist *gen_load_absoffsetrel(compiler_state_t *, bpf_abs_offset *, - u_int, u_int); - static struct slist *gen_load_a(compiler_state_t *, enum e_offrel, u_int, -@@ -502,9 +515,9 @@ static struct slist *gen_loadx_iphdrlen(compiler_state_t *); - static struct block *gen_uncond(compiler_state_t *, int); - static inline struct block *gen_true(compiler_state_t *); - static inline struct block *gen_false(compiler_state_t *); --static struct block *gen_ether_linktype(compiler_state_t *, int); --static struct block *gen_ipnet_linktype(compiler_state_t *, int); --static struct block *gen_linux_sll_linktype(compiler_state_t *, int); -+static struct block *gen_ether_linktype(compiler_state_t *, bpf_u_int32); -+static struct block *gen_ipnet_linktype(compiler_state_t *, bpf_u_int32); -+static struct block *gen_linux_sll_linktype(compiler_state_t *, bpf_u_int32); - static struct slist *gen_load_prism_llprefixlen(compiler_state_t *); - static struct slist *gen_load_avs_llprefixlen(compiler_state_t *); - static struct slist *gen_load_radiotap_llprefixlen(compiler_state_t *); -@@ -512,15 +525,15 @@ static struct slist *gen_load_ppi_llprefixlen(compiler_state_t *); - static void insert_compute_vloffsets(compiler_state_t *, struct block *); - static struct slist *gen_abs_offset_varpart(compiler_state_t *, - bpf_abs_offset *); --static int ethertype_to_ppptype(int); --static struct block *gen_linktype(compiler_state_t *, int); -+static bpf_u_int32 ethertype_to_ppptype(bpf_u_int32); -+static struct block *gen_linktype(compiler_state_t *, bpf_u_int32); - static struct block *gen_snap(compiler_state_t *, bpf_u_int32, bpf_u_int32); --static struct block *gen_llc_linktype(compiler_state_t *, int); -+static struct block *gen_llc_linktype(compiler_state_t *, bpf_u_int32); - static struct block *gen_hostop(compiler_state_t *, bpf_u_int32, bpf_u_int32, -- int, int, u_int, u_int); -+ int, bpf_u_int32, u_int, u_int); - #ifdef INET6 - static struct block *gen_hostop6(compiler_state_t *, struct in6_addr *, -- struct in6_addr *, int, int, u_int, u_int); -+ struct in6_addr *, int, bpf_u_int32, u_int, u_int); - #endif - static struct block *gen_ahostop(compiler_state_t *, const u_char *, int); - static struct block *gen_ehostop(compiler_state_t *, const u_char *, int); -@@ -529,7 +542,7 @@ static struct block *gen_thostop(compiler_state_t *, const u_char *, int); - static struct block *gen_wlanhostop(compiler_state_t *, const u_char *, int); - static struct block *gen_ipfchostop(compiler_state_t *, const u_char *, int); - static struct block *gen_dnhostop(compiler_state_t *, bpf_u_int32, int); --static struct block *gen_mpls_linktype(compiler_state_t *, int); -+static struct block *gen_mpls_linktype(compiler_state_t *, bpf_u_int32); - static struct block *gen_host(compiler_state_t *, bpf_u_int32, bpf_u_int32, - int, int, int); - #ifdef INET6 -@@ -541,23 +554,25 @@ static struct block *gen_gateway(compiler_state_t *, const u_char *, - struct addrinfo *, int, int); - #endif - static struct block *gen_ipfrag(compiler_state_t *); --static struct block *gen_portatom(compiler_state_t *, int, bpf_int32); --static struct block *gen_portrangeatom(compiler_state_t *, int, bpf_int32, -- bpf_int32); --static struct block *gen_portatom6(compiler_state_t *, int, bpf_int32); --static struct block *gen_portrangeatom6(compiler_state_t *, int, bpf_int32, -- bpf_int32); --struct block *gen_portop(compiler_state_t *, int, int, int); --static struct block *gen_port(compiler_state_t *, int, int, int); --struct block *gen_portrangeop(compiler_state_t *, int, int, int, int); --static struct block *gen_portrange(compiler_state_t *, int, int, int, int); --struct block *gen_portop6(compiler_state_t *, int, int, int); --static struct block *gen_port6(compiler_state_t *, int, int, int); --struct block *gen_portrangeop6(compiler_state_t *, int, int, int, int); --static struct block *gen_portrange6(compiler_state_t *, int, int, int, int); -+static struct block *gen_portatom(compiler_state_t *, int, bpf_u_int32); -+static struct block *gen_portrangeatom(compiler_state_t *, u_int, bpf_u_int32, -+ bpf_u_int32); -+static struct block *gen_portatom6(compiler_state_t *, int, bpf_u_int32); -+static struct block *gen_portrangeatom6(compiler_state_t *, u_int, bpf_u_int32, -+ bpf_u_int32); -+static struct block *gen_portop(compiler_state_t *, u_int, u_int, int); -+static struct block *gen_port(compiler_state_t *, u_int, int, int); -+static struct block *gen_portrangeop(compiler_state_t *, u_int, u_int, -+ bpf_u_int32, int); -+static struct block *gen_portrange(compiler_state_t *, u_int, u_int, int, int); -+struct block *gen_portop6(compiler_state_t *, u_int, u_int, int); -+static struct block *gen_port6(compiler_state_t *, u_int, int, int); -+static struct block *gen_portrangeop6(compiler_state_t *, u_int, u_int, -+ bpf_u_int32, int); -+static struct block *gen_portrange6(compiler_state_t *, u_int, u_int, int, int); - static int lookup_proto(compiler_state_t *, const char *, int); --static struct block *gen_protochain(compiler_state_t *, int, int, int); --static struct block *gen_proto(compiler_state_t *, int, int, int); -+static struct block *gen_protochain(compiler_state_t *, bpf_u_int32, int); -+static struct block *gen_proto(compiler_state_t *, bpf_u_int32, int, int); - static struct slist *xfer_to_x(compiler_state_t *, struct arth *); - static struct slist *xfer_to_a(compiler_state_t *, struct arth *); - static struct block *gen_mac_multicast(compiler_state_t *, int); -@@ -567,7 +582,7 @@ static struct block *gen_geneve_ll_check(compiler_state_t *cstate); - - static struct block *gen_ppi_dlt_check(compiler_state_t *); - static struct block *gen_atmfield_code_internal(compiler_state_t *, int, -- bpf_int32, bpf_u_int32, int); -+ bpf_u_int32, int, int); - static struct block *gen_atmtype_llc(compiler_state_t *); - static struct block *gen_msg_abbrev(compiler_state_t *, int type); - -@@ -762,6 +777,7 @@ pcap_compile(pcap_t *p, struct bpf_program *program, - cstate.ic.root = NULL; - cstate.ic.cur_mark = 0; - cstate.bpf_pcap = p; -+ cstate.error_set = 0; - init_regs(&cstate); - - cstate.netmask = mask; -@@ -1013,42 +1029,42 @@ gen_not(struct block *b) - - static struct block * - gen_cmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -- u_int size, bpf_int32 v) -+ u_int size, bpf_u_int32 v) - { - return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v); - } - - static struct block * - gen_cmp_gt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -- u_int size, bpf_int32 v) -+ u_int size, bpf_u_int32 v) - { - return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 0, v); - } - - static struct block * - gen_cmp_ge(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -- u_int size, bpf_int32 v) -+ u_int size, bpf_u_int32 v) - { - return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 0, v); - } - - static struct block * - gen_cmp_lt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -- u_int size, bpf_int32 v) -+ u_int size, bpf_u_int32 v) - { - return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 1, v); - } - - static struct block * - gen_cmp_le(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -- u_int size, bpf_int32 v) -+ u_int size, bpf_u_int32 v) - { - return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 1, v); - } - - static struct block * - gen_mcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -- u_int size, bpf_int32 v, bpf_u_int32 mask) -+ u_int size, bpf_u_int32 v, bpf_u_int32 mask) - { - return gen_ncmp(cstate, offrel, offset, size, mask, BPF_JEQ, 0, v); - } -@@ -1059,16 +1075,6 @@ gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, - { - register struct block *b, *tmp; - -- /* -- * XXX - the actual *instructions* do unsigned comparisons on -- * most platforms, and the load instructions don't do sign -- * extension, so gen_cmp() should really take an unsigned -- * value argument. -- * -- * As the load instructons also don't do sign-extension, we -- * fetch the values from the byte array as unsigned. We don't -- * want to use the signed versions of the extract calls. -- */ - b = NULL; - while (size >= 4) { - register const u_char *p = &v[size - 4]; -@@ -1091,7 +1097,7 @@ gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, - size -= 2; - } - if (size > 0) { -- tmp = gen_cmp(cstate, offrel, offset, BPF_B, (bpf_int32)v[0]); -+ tmp = gen_cmp(cstate, offrel, offset, BPF_B, v[0]); - if (b != NULL) - gen_and(b, tmp); - b = tmp; -@@ -1106,9 +1112,9 @@ gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, - * should test the opposite of "jtype". - */ - static struct block * --gen_ncmp(compiler_state_t *cstate, enum e_offrel offrel, bpf_u_int32 offset, -- bpf_u_int32 size, bpf_u_int32 mask, bpf_u_int32 jtype, int reverse, -- bpf_int32 v) -+gen_ncmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, -+ u_int size, bpf_u_int32 mask, int jtype, int reverse, -+ bpf_u_int32 v) - { - struct slist *s, *s2; - struct block *b; -@@ -1956,11 +1962,11 @@ gen_false(compiler_state_t *cstate) - * the appropriate test. - */ - static struct block * --gen_ether_linktype(compiler_state_t *cstate, int proto) -+gen_ether_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { - struct block *b0, *b1; - -- switch (proto) { -+ switch (ll_proto) { - - case LLCSAP_ISONS: - case LLCSAP_IP: -@@ -1979,8 +1985,7 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - */ - b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); - gen_not(b0); -- b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32) -- ((proto << 8) | proto)); -+ b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (ll_proto << 8) | ll_proto); - gen_and(b0, b1); - return b1; - -@@ -2017,8 +2022,8 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - * This generates code to check both for the - * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. - */ -- b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX); -- b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)0xFFFF); -+ b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, LLCSAP_IPX); -+ b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, 0xFFFF); - gen_or(b0, b1); - - /* -@@ -2048,7 +2053,7 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - * do that before checking for the other frame - * types. - */ -- b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX); -+ b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ETHERTYPE_IPX); - gen_or(b0, b1); - return b1; - -@@ -2078,9 +2083,9 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - * 0x000000 (encapsulated Ethernet) and a protocol - * type of ETHERTYPE_AARP (Appletalk ARP). - */ -- if (proto == ETHERTYPE_ATALK) -+ if (ll_proto == ETHERTYPE_ATALK) - b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); -- else /* proto == ETHERTYPE_AARP */ -+ else /* ll_proto == ETHERTYPE_AARP */ - b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP); - gen_and(b0, b1); - -@@ -2089,13 +2094,13 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - * phase 1?); we just check for the Ethernet - * protocol type. - */ -- b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); -+ b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); - - gen_or(b0, b1); - return b1; - - default: -- if (proto <= ETHERMTU) { -+ if (ll_proto <= ETHERMTU) { - /* - * This is an LLC SAP value, so the frames - * that match would be 802.2 frames. -@@ -2106,7 +2111,7 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - */ - b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); - gen_not(b0); -- b1 = gen_cmp(cstate, OR_LINKTYPE, 2, BPF_B, (bpf_int32)proto); -+ b1 = gen_cmp(cstate, OR_LINKTYPE, 2, BPF_B, ll_proto); - gen_and(b0, b1); - return b1; - } else { -@@ -2115,18 +2120,17 @@ gen_ether_linktype(compiler_state_t *cstate, int proto) - * the length/type field with it (if - * the frame is an 802.2 frame, the length - * field will be <= ETHERMTU, and, as -- * "proto" is > ETHERMTU, this test -+ * "ll_proto" is > ETHERMTU, this test - * will fail and the frame won't match, - * which is what we want). - */ -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, -- (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); - } - } - } - - static struct block * --gen_loopback_linktype(compiler_state_t *cstate, int proto) -+gen_loopback_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { - /* - * For DLT_NULL, the link-layer header is a 32-bit word -@@ -2154,10 +2158,10 @@ gen_loopback_linktype(compiler_state_t *cstate, int proto) - * code to compare against the result. - */ - if (cstate->bpf_pcap->rfile != NULL && cstate->bpf_pcap->swapped) -- proto = SWAPLONG(proto); -- proto = htonl(proto); -+ ll_proto = SWAPLONG(ll_proto); -+ ll_proto = htonl(ll_proto); - } -- return (gen_cmp(cstate, OR_LINKHDR, 0, BPF_W, (bpf_int32)proto)); -+ return (gen_cmp(cstate, OR_LINKHDR, 0, BPF_W, ll_proto)); - } - - /* -@@ -2165,17 +2169,16 @@ gen_loopback_linktype(compiler_state_t *cstate, int proto) - * or IPv6 then we have an error. - */ - static struct block * --gen_ipnet_linktype(compiler_state_t *cstate, int proto) -+gen_ipnet_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { -- switch (proto) { -+ switch (ll_proto) { - - case ETHERTYPE_IP: -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, (bpf_int32)IPH_AF_INET); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, IPH_AF_INET); - /*NOTREACHED*/ - - case ETHERTYPE_IPV6: -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)IPH_AF_INET6); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, IPH_AF_INET6); - /*NOTREACHED*/ - - default: -@@ -2188,17 +2191,17 @@ gen_ipnet_linktype(compiler_state_t *cstate, int proto) - /* - * Generate code to match a particular packet type. - * -- * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP -+ * "ll_proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP - * value, if <= ETHERMTU. We use that to determine whether to - * match the type field or to check the type field for the special - * LINUX_SLL_P_802_2 value and then do the appropriate test. - */ - static struct block * --gen_linux_sll_linktype(compiler_state_t *cstate, int proto) -+gen_linux_sll_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { - struct block *b0, *b1; - -- switch (proto) { -+ switch (ll_proto) { - - case LLCSAP_ISONS: - case LLCSAP_IP: -@@ -2216,8 +2219,7 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - * (i.e., other SAP values)? - */ - b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); -- b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32) -- ((proto << 8) | proto)); -+ b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (ll_proto << 8) | ll_proto); - gen_and(b0, b1); - return b1; - -@@ -2247,7 +2249,7 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - * then put a check for LINUX_SLL_P_802_2 frames - * before it. - */ -- b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX); -+ b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, LLCSAP_IPX); - b1 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX); - gen_or(b0, b1); - b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); -@@ -2265,7 +2267,7 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - * do that before checking for the other frame - * types. - */ -- b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX); -+ b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ETHERTYPE_IPX); - gen_or(b0, b1); - return b1; - -@@ -2294,9 +2296,9 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - * 0x000000 (encapsulated Ethernet) and a protocol - * type of ETHERTYPE_AARP (Appletalk ARP). - */ -- if (proto == ETHERTYPE_ATALK) -+ if (ll_proto == ETHERTYPE_ATALK) - b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); -- else /* proto == ETHERTYPE_AARP */ -+ else /* ll_proto == ETHERTYPE_AARP */ - b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP); - gen_and(b0, b1); - -@@ -2305,13 +2307,13 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - * phase 1?); we just check for the Ethernet - * protocol type. - */ -- b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); -+ b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); - - gen_or(b0, b1); - return b1; - - default: -- if (proto <= ETHERMTU) { -+ if (ll_proto <= ETHERMTU) { - /* - * This is an LLC SAP value, so the frames - * that match would be 802.2 frames. -@@ -2321,7 +2323,7 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - */ - b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); - b1 = gen_cmp(cstate, OR_LINKHDR, cstate->off_linkpl.constant_part, BPF_B, -- (bpf_int32)proto); -+ ll_proto); - gen_and(b0, b1); - return b1; - } else { -@@ -2330,11 +2332,11 @@ gen_linux_sll_linktype(compiler_state_t *cstate, int proto) - * the length/type field with it (if - * the frame is an 802.2 frame, the length - * field will be <= ETHERMTU, and, as -- * "proto" is > ETHERMTU, this test -+ * "ll_proto" is > ETHERMTU, this test - * will fail and the frame won't match, - * which is what we want). - */ -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); - } - } - } -@@ -3035,33 +3037,33 @@ gen_abs_offset_varpart(compiler_state_t *cstate, bpf_abs_offset *off) - /* - * Map an Ethernet type to the equivalent PPP type. - */ --static int --ethertype_to_ppptype(int proto) -+static bpf_u_int32 -+ethertype_to_ppptype(bpf_u_int32 ll_proto) - { -- switch (proto) { -+ switch (ll_proto) { - - case ETHERTYPE_IP: -- proto = PPP_IP; -+ ll_proto = PPP_IP; - break; - - case ETHERTYPE_IPV6: -- proto = PPP_IPV6; -+ ll_proto = PPP_IPV6; - break; - - case ETHERTYPE_DN: -- proto = PPP_DECNET; -+ ll_proto = PPP_DECNET; - break; - - case ETHERTYPE_ATALK: -- proto = PPP_APPLE; -+ ll_proto = PPP_APPLE; - break; - - case ETHERTYPE_NS: -- proto = PPP_NS; -+ ll_proto = PPP_NS; - break; - - case LLCSAP_ISONS: -- proto = PPP_OSI; -+ ll_proto = PPP_OSI; - break; - - case LLCSAP_8021D: -@@ -3070,14 +3072,14 @@ ethertype_to_ppptype(int proto) - * over PPP are Spanning Tree Protocol - * Bridging PDUs. - */ -- proto = PPP_BRPDU; -+ ll_proto = PPP_BRPDU; - break; - - case LLCSAP_IPX: -- proto = PPP_IPX; -+ ll_proto = PPP_IPX; - break; - } -- return (proto); -+ return (ll_proto); - } - - /* -@@ -3133,29 +3135,14 @@ gen_prevlinkhdr_check(compiler_state_t *cstate) - * value, if <= ETHERMTU. - */ - static struct block * --gen_linktype(compiler_state_t *cstate, int proto) -+gen_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { - struct block *b0, *b1, *b2; - const char *description; - - /* are we checking MPLS-encapsulated packets? */ -- if (cstate->label_stack_depth > 0) { -- switch (proto) { -- case ETHERTYPE_IP: -- case PPP_IP: -- /* FIXME add other L3 proto IDs */ -- return gen_mpls_linktype(cstate, Q_IP); -- -- case ETHERTYPE_IPV6: -- case PPP_IPV6: -- /* FIXME add other L3 proto IDs */ -- return gen_mpls_linktype(cstate, Q_IPV6); -- -- default: -- bpf_error(cstate, "unsupported protocol over mpls"); -- /*NOTREACHED*/ -- } -- } -+ if (cstate->label_stack_depth > 0) -+ return gen_mpls_linktype(cstate, ll_proto); - - switch (cstate->linktype) { - -@@ -3169,21 +3156,21 @@ gen_linktype(compiler_state_t *cstate, int proto) - else - b0 = NULL; - -- b1 = gen_ether_linktype(cstate, proto); -+ b1 = gen_ether_linktype(cstate, ll_proto); - if (b0 != NULL) - gen_and(b0, b1); - return b1; - /*NOTREACHED*/ - - case DLT_C_HDLC: -- switch (proto) { -+ switch (ll_proto) { - - case LLCSAP_ISONS: -- proto = (proto << 8 | LLCSAP_ISONS); -+ ll_proto = (ll_proto << 8 | LLCSAP_ISONS); - /* fall through */ - - default: -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); - /*NOTREACHED*/ - } - -@@ -3200,7 +3187,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - /* - * Now check for the specified link-layer type. - */ -- b1 = gen_llc_linktype(cstate, proto); -+ b1 = gen_llc_linktype(cstate, ll_proto); - gen_and(b0, b1); - return b1; - /*NOTREACHED*/ -@@ -3209,20 +3196,20 @@ gen_linktype(compiler_state_t *cstate, int proto) - /* - * XXX - check for LLC frames. - */ -- return gen_llc_linktype(cstate, proto); -+ return gen_llc_linktype(cstate, ll_proto); - /*NOTREACHED*/ - - case DLT_IEEE802: - /* - * XXX - check for LLC PDUs, as per IEEE 802.5. - */ -- return gen_llc_linktype(cstate, proto); -+ return gen_llc_linktype(cstate, ll_proto); - /*NOTREACHED*/ - - case DLT_ATM_RFC1483: - case DLT_ATM_CLIP: - case DLT_IP_OVER_FC: -- return gen_llc_linktype(cstate, proto); -+ return gen_llc_linktype(cstate, ll_proto); - /*NOTREACHED*/ - - case DLT_SUNATM: -@@ -3234,13 +3221,13 @@ gen_linktype(compiler_state_t *cstate, int proto) - * Check for LLC encapsulation and then check the protocol. - */ - b0 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); -- b1 = gen_llc_linktype(cstate, proto); -+ b1 = gen_llc_linktype(cstate, ll_proto); - gen_and(b0, b1); - return b1; - /*NOTREACHED*/ - - case DLT_LINUX_SLL: -- return gen_linux_sll_linktype(cstate, proto); -+ return gen_linux_sll_linktype(cstate, ll_proto); - /*NOTREACHED*/ - - case DLT_SLIP: -@@ -3253,7 +3240,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - * XXX - for IPv4, check for a version number of 4, and, - * for IPv6, check for a version number of 6? - */ -- switch (proto) { -+ switch (ll_proto) { - - case ETHERTYPE_IP: - /* Check for a version number of 4. */ -@@ -3272,7 +3259,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - /* - * Raw IPv4, so no type field. - */ -- if (proto == ETHERTYPE_IP) -+ if (ll_proto == ETHERTYPE_IP) - return gen_true(cstate); /* always true */ - - /* Checking for something other than IPv4; always false */ -@@ -3283,7 +3270,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - /* - * Raw IPv6, so no type field. - */ -- if (proto == ETHERTYPE_IPV6) -+ if (ll_proto == ETHERTYPE_IPV6) - return gen_true(cstate); /* always true */ - - /* Checking for something other than IPv6; always false */ -@@ -3298,8 +3285,8 @@ gen_linktype(compiler_state_t *cstate, int proto) - * We use Ethernet protocol types inside libpcap; - * map them to the corresponding PPP protocol types. - */ -- proto = ethertype_to_ppptype(proto); -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, -+ ethertype_to_ppptype(ll_proto)); - /*NOTREACHED*/ - - case DLT_PPP_BSDOS: -@@ -3307,7 +3294,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - * We use Ethernet protocol types inside libpcap; - * map them to the corresponding PPP protocol types. - */ -- switch (proto) { -+ switch (ll_proto) { - - case ETHERTYPE_IP: - /* -@@ -3322,16 +3309,15 @@ gen_linktype(compiler_state_t *cstate, int proto) - return b0; - - default: -- proto = ethertype_to_ppptype(proto); - return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, -- (bpf_int32)proto); -+ ethertype_to_ppptype(ll_proto)); - } - /*NOTREACHED*/ - - case DLT_NULL: - case DLT_LOOP: - case DLT_ENC: -- switch (proto) { -+ switch (ll_proto) { - - case ETHERTYPE_IP: - return (gen_loopback_linktype(cstate, AF_INET)); -@@ -3412,12 +3398,12 @@ gen_linktype(compiler_state_t *cstate, int proto) - * af field is host byte order in contrast to the rest of - * the packet. - */ -- if (proto == ETHERTYPE_IP) -+ if (ll_proto == ETHERTYPE_IP) - return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af), -- BPF_B, (bpf_int32)AF_INET)); -- else if (proto == ETHERTYPE_IPV6) -+ BPF_B, AF_INET)); -+ else if (ll_proto == ETHERTYPE_IPV6) - return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af), -- BPF_B, (bpf_int32)AF_INET6)); -+ BPF_B, AF_INET6)); - else - return gen_false(cstate); - /*NOTREACHED*/ -@@ -3429,43 +3415,43 @@ gen_linktype(compiler_state_t *cstate, int proto) - * XXX should we check for first fragment if the protocol - * uses PHDS? - */ -- switch (proto) { -+ switch (ll_proto) { - - default: - return gen_false(cstate); - - case ETHERTYPE_IPV6: - return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_INET6)); -+ ARCTYPE_INET6)); - - case ETHERTYPE_IP: - b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_IP); -+ ARCTYPE_IP); - b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_IP_OLD); -+ ARCTYPE_IP_OLD); - gen_or(b0, b1); - return (b1); - - case ETHERTYPE_ARP: - b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_ARP); -+ ARCTYPE_ARP); - b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_ARP_OLD); -+ ARCTYPE_ARP_OLD); - gen_or(b0, b1); - return (b1); - - case ETHERTYPE_REVARP: - return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_REVARP)); -+ ARCTYPE_REVARP)); - - case ETHERTYPE_ATALK: - return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, -- (bpf_int32)ARCTYPE_ATALK)); -+ ARCTYPE_ATALK)); - } - /*NOTREACHED*/ - - case DLT_LTALK: -- switch (proto) { -+ switch (ll_proto) { - case ETHERTYPE_ATALK: - return gen_true(cstate); - default: -@@ -3478,7 +3464,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - * XXX - assumes a 2-byte Frame Relay header with - * DLCI and flags. What if the address is longer? - */ -- switch (proto) { -+ switch (ll_proto) { - - case ETHERTYPE_IP: - /* -@@ -3555,7 +3541,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x55FF0000, 0xffff0000); - - case DLT_IPNET: -- return gen_ipnet_linktype(cstate, proto); -+ return gen_ipnet_linktype(cstate, ll_proto); - - case DLT_LINUX_IRDA: - bpf_error(cstate, "IrDA link-layer type filtering not implemented"); -@@ -3632,7 +3618,7 @@ gen_linktype(compiler_state_t *cstate, int proto) - * it's not, it needs to be handled specially - * above.) - */ -- return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); - /*NOTREACHED */ - } else { - /* -@@ -3691,7 +3677,7 @@ gen_llc_internal(compiler_state_t *cstate) - * Now check for the purported DSAP and SSAP not being - * 0xFF, to rule out NetWare-over-802.3. - */ -- b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)0xFFFF); -+ b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, 0xFFFF); - gen_not(b1); - gen_and(b0, b1); - return b1; -@@ -3903,12 +3889,12 @@ gen_llc_u_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) - * protocol ID in a SNAP header. - */ - static struct block * --gen_llc_linktype(compiler_state_t *cstate, int proto) -+gen_llc_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { - /* - * XXX - handle token-ring variable-length header. - */ -- switch (proto) { -+ switch (ll_proto) { - - case LLCSAP_IP: - case LLCSAP_ISONS: -@@ -3919,15 +3905,14 @@ gen_llc_linktype(compiler_state_t *cstate, int proto) - * DSAP, as we do for other SAP values? - */ - return gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_u_int32) -- ((proto << 8) | proto)); -+ ((ll_proto << 8) | ll_proto)); - - case LLCSAP_IPX: - /* - * XXX - are there ever SNAP frames for IPX on - * non-Ethernet 802.x networks? - */ -- return gen_cmp(cstate, OR_LLC, 0, BPF_B, -- (bpf_int32)LLCSAP_IPX); -+ return gen_cmp(cstate, OR_LLC, 0, BPF_B, LLCSAP_IPX); - - case ETHERTYPE_ATALK: - /* -@@ -3946,12 +3931,12 @@ gen_llc_linktype(compiler_state_t *cstate, int proto) - * XXX - we don't have to check for IPX 802.3 - * here, but should we check for the IPX Ethertype? - */ -- if (proto <= ETHERMTU) { -+ if (ll_proto <= ETHERMTU) { - /* - * This is an LLC SAP value, so check - * the DSAP. - */ -- return gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LLC, 0, BPF_B, ll_proto); - } else { - /* - * This is an Ethernet type; we assume that it's -@@ -3966,20 +3951,20 @@ gen_llc_linktype(compiler_state_t *cstate, int proto) - * organization code of 0x000000 (encapsulated - * Ethernet), we'd do - * -- * return gen_snap(cstate, 0x000000, proto); -+ * return gen_snap(cstate, 0x000000, ll_proto); - * - * here; for now, we don't, as per the above. - * I don't know whether it's worth the extra CPU - * time to do the right check or not. - */ -- return gen_cmp(cstate, OR_LLC, 6, BPF_H, (bpf_int32)proto); -+ return gen_cmp(cstate, OR_LLC, 6, BPF_H, ll_proto); - } - } - } - - static struct block * - gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, -- int dir, int proto, u_int src_off, u_int dst_off) -+ int dir, bpf_u_int32 ll_proto, u_int src_off, u_int dst_off) - { - struct block *b0, *b1; - u_int offset; -@@ -3995,15 +3980,15 @@ gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, - break; - - case Q_AND: -- b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); -- b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off); -+ b0 = gen_hostop(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); -+ b1 = gen_hostop(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); - gen_and(b0, b1); - return b1; - - case Q_DEFAULT: - case Q_OR: -- b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); -- b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off); -+ b0 = gen_hostop(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); -+ b1 = gen_hostop(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); - gen_or(b0, b1); - return b1; - -@@ -4035,8 +4020,8 @@ gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, - abort(); - /*NOTREACHED*/ - } -- b0 = gen_linktype(cstate, proto); -- b1 = gen_mcmp(cstate, OR_LINKPL, offset, BPF_W, (bpf_int32)addr, mask); -+ b0 = gen_linktype(cstate, ll_proto); -+ b1 = gen_mcmp(cstate, OR_LINKPL, offset, BPF_W, addr, mask); - gen_and(b0, b1); - return b1; - } -@@ -4044,7 +4029,8 @@ gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, - #ifdef INET6 - static struct block * - gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, -- struct in6_addr *mask, int dir, int proto, u_int src_off, u_int dst_off) -+ struct in6_addr *mask, int dir, bpf_u_int32 ll_proto, u_int src_off, -+ u_int dst_off) - { - struct block *b0, *b1; - u_int offset; -@@ -4061,15 +4047,15 @@ gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, - break; - - case Q_AND: -- b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); -- b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off); -+ b0 = gen_hostop6(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); -+ b1 = gen_hostop6(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); - gen_and(b0, b1); - return b1; - - case Q_DEFAULT: - case Q_OR: -- b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); -- b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off); -+ b0 = gen_hostop6(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); -+ b1 = gen_hostop6(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); - gen_or(b0, b1); - return b1; - -@@ -4111,7 +4097,7 @@ gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, - gen_and(b0, b1); - b0 = gen_mcmp(cstate, OR_LINKPL, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); - gen_and(b0, b1); -- b0 = gen_linktype(cstate, proto); -+ b0 = gen_linktype(cstate, ll_proto); - gen_and(b0, b1); - return b1; - } -@@ -4846,24 +4832,29 @@ gen_dnhostop(compiler_state_t *cstate, bpf_u_int32 addr, int dir) - b0 = gen_linktype(cstate, ETHERTYPE_DN); - /* Check for pad = 1, long header case */ - tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H, -- (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); -+ (bpf_u_int32)ntohs(0x0681), (bpf_u_int32)ntohs(0x07FF)); - b1 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_lh, -- BPF_H, (bpf_int32)ntohs((u_short)addr)); -+ BPF_H, (bpf_u_int32)ntohs((u_short)addr)); - gen_and(tmp, b1); - /* Check for pad = 0, long header case */ -- tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); -- b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_lh, BPF_H, (bpf_int32)ntohs((u_short)addr)); -+ tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_u_int32)0x06, -+ (bpf_u_int32)0x7); -+ b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_lh, BPF_H, -+ (bpf_u_int32)ntohs((u_short)addr)); - gen_and(tmp, b2); - gen_or(b2, b1); - /* Check for pad = 1, short header case */ - tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H, -- (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); -- b2 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs((u_short)addr)); -+ (bpf_u_int32)ntohs(0x0281), (bpf_u_int32)ntohs(0x07FF)); -+ b2 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_sh, BPF_H, -+ (bpf_u_int32)ntohs((u_short)addr)); - gen_and(tmp, b2); - gen_or(b2, b1); - /* Check for pad = 0, short header case */ -- tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); -- b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_sh, BPF_H, (bpf_int32)ntohs((u_short)addr)); -+ tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_u_int32)0x02, -+ (bpf_u_int32)0x7); -+ b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_sh, BPF_H, -+ (bpf_u_int32)ntohs((u_short)addr)); - gen_and(tmp, b2); - gen_or(b2, b1); - -@@ -4878,13 +4869,13 @@ gen_dnhostop(compiler_state_t *cstate, bpf_u_int32 addr, int dir) - * field in the IP header. - */ - static struct block * --gen_mpls_linktype(compiler_state_t *cstate, int proto) -+gen_mpls_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) - { - struct block *b0, *b1; - -- switch (proto) { -+ switch (ll_proto) { - -- case Q_IP: -+ case ETHERTYPE_IP: - /* match the bottom-of-stack bit */ - b0 = gen_mcmp(cstate, OR_LINKPL, (u_int)-2, BPF_B, 0x01, 0x01); - /* match the IPv4 version number */ -@@ -4892,7 +4883,7 @@ gen_mpls_linktype(compiler_state_t *cstate, int proto) - gen_and(b0, b1); - return b1; - -- case Q_IPV6: -+ case ETHERTYPE_IPV6: - /* match the bottom-of-stack bit */ - b0 = gen_mcmp(cstate, OR_LINKPL, (u_int)-2, BPF_B, 0x01, 0x01); - /* match the IPv4 version number */ -@@ -4900,8 +4891,10 @@ gen_mpls_linktype(compiler_state_t *cstate, int proto) - gen_and(b0, b1); - return b1; - -- default: -- abort(); -+ default: -+ /* FIXME add other L3 proto IDs */ -+ bpf_error(cstate, "unsupported protocol over mpls"); -+ /*NOTREACHED*/ - } - } - -@@ -5583,46 +5576,46 @@ gen_ipfrag(compiler_state_t *cstate) - * headers). - */ - static struct block * --gen_portatom(compiler_state_t *cstate, int off, bpf_int32 v) -+gen_portatom(compiler_state_t *cstate, int off, bpf_u_int32 v) - { - return gen_cmp(cstate, OR_TRAN_IPV4, off, BPF_H, v); - } - - static struct block * --gen_portatom6(compiler_state_t *cstate, int off, bpf_int32 v) -+gen_portatom6(compiler_state_t *cstate, int off, bpf_u_int32 v) - { - return gen_cmp(cstate, OR_TRAN_IPV6, off, BPF_H, v); - } - --struct block * --gen_portop(compiler_state_t *cstate, int port, int proto, int dir) -+static struct block * -+gen_portop(compiler_state_t *cstate, u_int port, u_int proto, int dir) - { - struct block *b0, *b1, *tmp; - - /* ip proto 'proto' and not a fragment other than the first fragment */ -- tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)proto); -+ tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, proto); - b0 = gen_ipfrag(cstate); - gen_and(tmp, b0); - - switch (dir) { - case Q_SRC: -- b1 = gen_portatom(cstate, 0, (bpf_int32)port); -+ b1 = gen_portatom(cstate, 0, port); - break; - - case Q_DST: -- b1 = gen_portatom(cstate, 2, (bpf_int32)port); -+ b1 = gen_portatom(cstate, 2, port); - break; - - case Q_AND: -- tmp = gen_portatom(cstate, 0, (bpf_int32)port); -- b1 = gen_portatom(cstate, 2, (bpf_int32)port); -+ tmp = gen_portatom(cstate, 0, port); -+ b1 = gen_portatom(cstate, 2, port); - gen_and(tmp, b1); - break; - - case Q_DEFAULT: - case Q_OR: -- tmp = gen_portatom(cstate, 0, (bpf_int32)port); -- b1 = gen_portatom(cstate, 2, (bpf_int32)port); -+ tmp = gen_portatom(cstate, 0, port); -+ b1 = gen_portatom(cstate, 2, port); - gen_or(tmp, b1); - break; - -@@ -5660,7 +5653,7 @@ gen_portop(compiler_state_t *cstate, int port, int proto, int dir) - } - - static struct block * --gen_port(compiler_state_t *cstate, int port, int ip_proto, int dir) -+gen_port(compiler_state_t *cstate, u_int port, int ip_proto, int dir) - { - struct block *b0, *b1, *tmp; - -@@ -5687,7 +5680,7 @@ gen_port(compiler_state_t *cstate, int port, int ip_proto, int dir) - case IPPROTO_UDP: - case IPPROTO_TCP: - case IPPROTO_SCTP: -- b1 = gen_portop(cstate, port, ip_proto, dir); -+ b1 = gen_portop(cstate, port, (u_int)ip_proto, dir); - break; - - case PROTO_UNDEF: -@@ -5706,33 +5699,33 @@ gen_port(compiler_state_t *cstate, int port, int ip_proto, int dir) - } - - struct block * --gen_portop6(compiler_state_t *cstate, int port, int proto, int dir) -+gen_portop6(compiler_state_t *cstate, u_int port, u_int proto, int dir) - { - struct block *b0, *b1, *tmp; - - /* ip6 proto 'proto' */ - /* XXX - catch the first fragment of a fragmented packet? */ -- b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)proto); -+ b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, proto); - - switch (dir) { - case Q_SRC: -- b1 = gen_portatom6(cstate, 0, (bpf_int32)port); -+ b1 = gen_portatom6(cstate, 0, port); - break; - - case Q_DST: -- b1 = gen_portatom6(cstate, 2, (bpf_int32)port); -+ b1 = gen_portatom6(cstate, 2, port); - break; - - case Q_AND: -- tmp = gen_portatom6(cstate, 0, (bpf_int32)port); -- b1 = gen_portatom6(cstate, 2, (bpf_int32)port); -+ tmp = gen_portatom6(cstate, 0, port); -+ b1 = gen_portatom6(cstate, 2, port); - gen_and(tmp, b1); - break; - - case Q_DEFAULT: - case Q_OR: -- tmp = gen_portatom6(cstate, 0, (bpf_int32)port); -- b1 = gen_portatom6(cstate, 2, (bpf_int32)port); -+ tmp = gen_portatom6(cstate, 0, port); -+ b1 = gen_portatom6(cstate, 2, port); - gen_or(tmp, b1); - break; - -@@ -5745,7 +5738,7 @@ gen_portop6(compiler_state_t *cstate, int port, int proto, int dir) - } - - static struct block * --gen_port6(compiler_state_t *cstate, int port, int ip_proto, int dir) -+gen_port6(compiler_state_t *cstate, u_int port, int ip_proto, int dir) - { - struct block *b0, *b1, *tmp; - -@@ -5756,7 +5749,7 @@ gen_port6(compiler_state_t *cstate, int port, int ip_proto, int dir) - case IPPROTO_UDP: - case IPPROTO_TCP: - case IPPROTO_SCTP: -- b1 = gen_portop6(cstate, port, ip_proto, dir); -+ b1 = gen_portop6(cstate, port, (u_int)ip_proto, dir); - break; - - case PROTO_UNDEF: -@@ -5776,8 +5769,8 @@ gen_port6(compiler_state_t *cstate, int port, int ip_proto, int dir) - - /* gen_portrange code */ - static struct block * --gen_portrangeatom(compiler_state_t *cstate, int off, bpf_int32 v1, -- bpf_int32 v2) -+gen_portrangeatom(compiler_state_t *cstate, u_int off, bpf_u_int32 v1, -+ bpf_u_int32 v2) - { - struct block *b1, *b2; - -@@ -5785,7 +5778,7 @@ gen_portrangeatom(compiler_state_t *cstate, int off, bpf_int32 v1, - /* - * Reverse the order of the ports, so v1 is the lower one. - */ -- bpf_int32 vtemp; -+ bpf_u_int32 vtemp; - - vtemp = v1; - v1 = v2; -@@ -5800,36 +5793,36 @@ gen_portrangeatom(compiler_state_t *cstate, int off, bpf_int32 v1, - return b2; - } - --struct block * --gen_portrangeop(compiler_state_t *cstate, int port1, int port2, int proto, -- int dir) -+static struct block * -+gen_portrangeop(compiler_state_t *cstate, u_int port1, u_int port2, -+ bpf_u_int32 proto, int dir) - { - struct block *b0, *b1, *tmp; - - /* ip proto 'proto' and not a fragment other than the first fragment */ -- tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)proto); -+ tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, proto); - b0 = gen_ipfrag(cstate); - gen_and(tmp, b0); - - switch (dir) { - case Q_SRC: -- b1 = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); -+ b1 = gen_portrangeatom(cstate, 0, port1, port2); - break; - - case Q_DST: -- b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); -+ b1 = gen_portrangeatom(cstate, 2, port1, port2); - break; - - case Q_AND: -- tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); -- b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); -+ tmp = gen_portrangeatom(cstate, 0, port1, port2); -+ b1 = gen_portrangeatom(cstate, 2, port1, port2); - gen_and(tmp, b1); - break; - - case Q_DEFAULT: - case Q_OR: -- tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); -- b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); -+ tmp = gen_portrangeatom(cstate, 0, port1, port2); -+ b1 = gen_portrangeatom(cstate, 2, port1, port2); - gen_or(tmp, b1); - break; - -@@ -5867,7 +5860,7 @@ gen_portrangeop(compiler_state_t *cstate, int port1, int port2, int proto, - } - - static struct block * --gen_portrange(compiler_state_t *cstate, int port1, int port2, int ip_proto, -+gen_portrange(compiler_state_t *cstate, u_int port1, u_int port2, int ip_proto, - int dir) - { - struct block *b0, *b1, *tmp; -@@ -5879,7 +5872,8 @@ gen_portrange(compiler_state_t *cstate, int port1, int port2, int ip_proto, - case IPPROTO_UDP: - case IPPROTO_TCP: - case IPPROTO_SCTP: -- b1 = gen_portrangeop(cstate, port1, port2, ip_proto, dir); -+ b1 = gen_portrangeop(cstate, port1, port2, (bpf_u_int32)ip_proto, -+ dir); - break; - - case PROTO_UNDEF: -@@ -5898,8 +5892,8 @@ gen_portrange(compiler_state_t *cstate, int port1, int port2, int ip_proto, - } - - static struct block * --gen_portrangeatom6(compiler_state_t *cstate, int off, bpf_int32 v1, -- bpf_int32 v2) -+gen_portrangeatom6(compiler_state_t *cstate, u_int off, bpf_u_int32 v1, -+ bpf_u_int32 v2) - { - struct block *b1, *b2; - -@@ -5907,7 +5901,7 @@ gen_portrangeatom6(compiler_state_t *cstate, int off, bpf_int32 v1, - /* - * Reverse the order of the ports, so v1 is the lower one. - */ -- bpf_int32 vtemp; -+ bpf_u_int32 vtemp; - - vtemp = v1; - v1 = v2; -@@ -5922,35 +5916,35 @@ gen_portrangeatom6(compiler_state_t *cstate, int off, bpf_int32 v1, - return b2; - } - --struct block * --gen_portrangeop6(compiler_state_t *cstate, int port1, int port2, int proto, -- int dir) -+static struct block * -+gen_portrangeop6(compiler_state_t *cstate, u_int port1, u_int port2, -+ bpf_u_int32 proto, int dir) - { - struct block *b0, *b1, *tmp; - - /* ip6 proto 'proto' */ - /* XXX - catch the first fragment of a fragmented packet? */ -- b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)proto); -+ b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, proto); - - switch (dir) { - case Q_SRC: -- b1 = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); -+ b1 = gen_portrangeatom6(cstate, 0, port1, port2); - break; - - case Q_DST: -- b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); -+ b1 = gen_portrangeatom6(cstate, 2, port1, port2); - break; - - case Q_AND: -- tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); -- b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); -+ tmp = gen_portrangeatom6(cstate, 0, port1, port2); -+ b1 = gen_portrangeatom6(cstate, 2, port1, port2); - gen_and(tmp, b1); - break; - - case Q_DEFAULT: - case Q_OR: -- tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); -- b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); -+ tmp = gen_portrangeatom6(cstate, 0, port1, port2); -+ b1 = gen_portrangeatom6(cstate, 2, port1, port2); - gen_or(tmp, b1); - break; - -@@ -5963,7 +5957,7 @@ gen_portrangeop6(compiler_state_t *cstate, int port1, int port2, int proto, - } - - static struct block * --gen_portrange6(compiler_state_t *cstate, int port1, int port2, int ip_proto, -+gen_portrange6(compiler_state_t *cstate, u_int port1, u_int port2, int ip_proto, - int dir) - { - struct block *b0, *b1, *tmp; -@@ -5975,7 +5969,8 @@ gen_portrange6(compiler_state_t *cstate, int port1, int port2, int ip_proto, - case IPPROTO_UDP: - case IPPROTO_TCP: - case IPPROTO_SCTP: -- b1 = gen_portrangeop6(cstate, port1, port2, ip_proto, dir); -+ b1 = gen_portrangeop6(cstate, port1, port2, (bpf_u_int32)ip_proto, -+ dir); - break; - - case PROTO_UNDEF: -@@ -6045,10 +6040,10 @@ gen_joinsp(struct stmt **s, int n) - #endif - - static struct block * --gen_protochain(compiler_state_t *cstate, int v, int proto, int dir) -+gen_protochain(compiler_state_t *cstate, bpf_u_int32 v, int proto) - { - #ifdef NO_PROTOCHAIN -- return gen_proto(cstate, v, proto, dir); -+ return gen_proto(cstate, v, proto); - #else - struct block *b0, *b; - struct slist *s[100]; -@@ -6065,8 +6060,8 @@ gen_protochain(compiler_state_t *cstate, int v, int proto, int dir) - case Q_IPV6: - break; - case Q_DEFAULT: -- b0 = gen_protochain(cstate, v, Q_IP, dir); -- b = gen_protochain(cstate, v, Q_IPV6, dir); -+ b0 = gen_protochain(cstate, v, Q_IP); -+ b = gen_protochain(cstate, v, Q_IPV6); - gen_or(b0, b); - return b; - default: -@@ -6371,7 +6366,7 @@ gen_check_802_11_data_frame(compiler_state_t *cstate) - * against Q_IP and Q_IPV6. - */ - static struct block * --gen_proto(compiler_state_t *cstate, int v, int proto, int dir) -+gen_proto(compiler_state_t *cstate, bpf_u_int32 v, int proto, int dir) - { - struct block *b0, *b1; - #ifndef CHASE_CHAIN -@@ -6409,7 +6404,7 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) - */ - b0 = gen_linktype(cstate, ETHERTYPE_IP); - #ifndef CHASE_CHAIN -- b1 = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)v); -+ b1 = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, v); - #else - b1 = gen_protochain(cstate, v, Q_IP); - #endif -@@ -6480,9 +6475,9 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) - * header. - */ - b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, IPPROTO_FRAGMENT); -- b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, (bpf_int32)v); -+ b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, v); - gen_and(b2, b1); -- b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)v); -+ b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, v); - gen_or(b2, b1); - #else - b1 = gen_protochain(cstate, v, Q_IPV6); -@@ -6546,13 +6541,13 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) - */ - b0 = gen_linktype(cstate, LLCSAP_ISONS<<8 | LLCSAP_ISONS); - /* OSI in C-HDLC is stuffed with a fudge byte */ -- b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 1, BPF_B, (long)v); -+ b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 1, BPF_B, v); - gen_and(b0, b1); - return b1; - - default: - b0 = gen_linktype(cstate, LLCSAP_ISONS); -- b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 0, BPF_B, (long)v); -+ b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 0, BPF_B, v); - gen_and(b0, b1); - return b1; - } -@@ -6567,7 +6562,7 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) - * 4 is the offset of the PDU type relative to the IS-IS - * header. - */ -- b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 4, BPF_B, (long)v); -+ b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 4, BPF_B, v); - gen_and(b0, b1); - return b1; - -@@ -6928,7 +6923,7 @@ gen_scode(compiler_state_t *cstate, const char *name, struct qual q) - case Q_PROTOCHAIN: - real_proto = lookup_proto(cstate, name, proto); - if (real_proto >= 0) -- return gen_protochain(cstate, real_proto, proto, dir); -+ return gen_protochain(cstate, real_proto, proto); - else - bpf_error(cstate, "unknown protocol: %s", name); - -@@ -6942,7 +6937,7 @@ gen_scode(compiler_state_t *cstate, const char *name, struct qual q) - - struct block * - gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2, -- unsigned int masklen, struct qual q) -+ bpf_u_int32 masklen, struct qual q) - { - register int nlen, mlen; - bpf_u_int32 n, m; -@@ -7062,8 +7057,8 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) - - { - struct block *b; -- b = gen_port(cstate, (int)v, proto, dir); -- gen_or(gen_port6(cstate, (int)v, proto, dir), b); -+ b = gen_port(cstate, v, proto, dir); -+ gen_or(gen_port6(cstate, v, proto, dir), b); - return b; - } - -@@ -7084,8 +7079,8 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) - - { - struct block *b; -- b = gen_portrange(cstate, (int)v, (int)v, proto, dir); -- gen_or(gen_portrange6(cstate, (int)v, (int)v, proto, dir), b); -+ b = gen_portrange(cstate, v, v, proto, dir); -+ gen_or(gen_portrange6(cstate, v, v, proto, dir), b); - return b; - } - -@@ -7094,10 +7089,10 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) - /*NOTREACHED*/ - - case Q_PROTO: -- return gen_proto(cstate, (int)v, proto, dir); -+ return gen_proto(cstate, v, proto, dir); - - case Q_PROTOCHAIN: -- return gen_protochain(cstate, (int)v, proto, dir); -+ return gen_protochain(cstate, v, proto); - - case Q_UNDEF: - syntax(cstate); -@@ -7113,7 +7108,7 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) - #ifdef INET6 - struct block * - gen_mcode6(compiler_state_t *cstate, const char *s1, const char *s2, -- unsigned int masklen, struct qual q) -+ bpf_u_int32 masklen, struct qual q) - { - struct addrinfo *res; - struct in6_addr *addr; -@@ -7271,8 +7266,10 @@ xfer_to_a(compiler_state_t *cstate, struct arth *a) - * for "index". - */ - static struct arth * --gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int size) -+gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, -+ bpf_u_int32 size) - { -+ int size_code; - struct slist *s, *tmp; - struct block *b; - int regno = alloc_reg(cstate); -@@ -7282,17 +7279,18 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - - default: - bpf_error(cstate, "data size must be 1, 2, or 4"); -+ /*NOTREACHED*/ - - case 1: -- size = BPF_B; -+ size_code = BPF_B; - break; - - case 2: -- size = BPF_H; -+ size_code = BPF_H; - break; - - case 4: -- size = BPF_W; -+ size_code = BPF_W; - break; - } - switch (proto) { -@@ -7319,7 +7317,7 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - /* - * Load the item at that offset. - */ -- tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); -+ tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); - sappend(s, tmp); - sappend(inst->s, s); - break; -@@ -7361,7 +7359,7 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - * variable-length; that header length is what we put - * into the X register and then added to the index). - */ -- tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); -+ tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); - tmp->s.k = cstate->off_linkhdr.constant_part; - sappend(s, tmp); - sappend(inst->s, s); -@@ -7408,7 +7406,7 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - * payload, and the constant part of the offset of the - * start of the link-layer payload. - */ -- tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); -+ tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); - tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; - sappend(s, tmp); - sappend(inst->s, s); -@@ -7465,7 +7463,7 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - sappend(s, xfer_to_a(cstate, inst)); - sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); - sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); -- sappend(s, tmp = new_stmt(cstate, BPF_LD|BPF_IND|size)); -+ sappend(s, tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code)); - tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; - sappend(inst->s, s); - -@@ -7527,7 +7525,7 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - * payload, and the constant part of the offset of the - * start of the link-layer payload. - */ -- tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); -+ tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); - tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 40; - - sappend(s, tmp); -@@ -7544,7 +7542,8 @@ gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int si - } - - struct arth * --gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) -+gen_load(compiler_state_t *cstate, int proto, struct arth *inst, -+ bpf_u_int32 size) - { - /* - * Catch errors reported by us and routines below us, and return NULL -@@ -7640,7 +7639,7 @@ gen_loadlen(compiler_state_t *cstate) - } - - static struct arth * --gen_loadi_internal(compiler_state_t *cstate, int val) -+gen_loadi_internal(compiler_state_t *cstate, bpf_u_int32 val) - { - struct arth *a; - struct slist *s; -@@ -7661,7 +7660,7 @@ gen_loadi_internal(compiler_state_t *cstate, int val) - } - - struct arth * --gen_loadi(compiler_state_t *cstate, int val) -+gen_loadi(compiler_state_t *cstate, bpf_u_int32 val) - { - /* - * Catch errors reported by us and routines below us, and return NULL -@@ -7736,13 +7735,7 @@ gen_arth(compiler_state_t *cstate, int code, struct arth *a0_arg, - if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) - bpf_error(cstate, "modulus by zero"); - } else if (code == BPF_LSH || code == BPF_RSH) { -- /* -- * XXX - we need to make up our minds as to what integers -- * are signed and what integers are unsigned in BPF programs -- * and in our IR. -- */ -- if (a1->s->s.code == (BPF_LD|BPF_IMM) && -- (a1->s->s.k < 0 || a1->s->s.k > 31)) -+ if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k > 31) - bpf_error(cstate, "shift by more than 31 bits"); - } - s0 = xfer_to_x(cstate, a1); -@@ -7863,7 +7856,7 @@ gen_less(compiler_state_t *cstate, int n) - * would generate code appropriate to the radio header in question. - */ - struct block * --gen_byteop(compiler_state_t *cstate, int op, int idx, int val) -+gen_byteop(compiler_state_t *cstate, int op, int idx, bpf_u_int32 val) - { - struct block *b; - struct slist *s; -@@ -7880,14 +7873,14 @@ gen_byteop(compiler_state_t *cstate, int op, int idx, int val) - abort(); - - case '=': -- return gen_cmp(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val); -+ return gen_cmp(cstate, OR_LINKHDR, (u_int)idx, BPF_B, val); - - case '<': -- b = gen_cmp_lt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val); -+ b = gen_cmp_lt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, val); - return b; - - case '>': -- b = gen_cmp_gt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val); -+ b = gen_cmp_gt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, val); - return b; - - case '|': -@@ -7965,9 +7958,9 @@ gen_broadcast(compiler_state_t *cstate, int proto) - bpf_error(cstate, "netmask not known, so 'ip broadcast' not supported"); - b0 = gen_linktype(cstate, ETHERTYPE_IP); - hostmask = ~cstate->netmask; -- b1 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, (bpf_int32)0, hostmask); -+ b1 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, 0, hostmask); - b2 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, -- (bpf_int32)(~0 & hostmask), hostmask); -+ ~0 & hostmask, hostmask); - gen_or(b1, b2); - gen_and(b0, b2); - return b2; -@@ -8164,13 +8157,13 @@ gen_multicast(compiler_state_t *cstate, int proto) - - case Q_IP: - b0 = gen_linktype(cstate, ETHERTYPE_IP); -- b1 = gen_cmp_ge(cstate, OR_LINKPL, 16, BPF_B, (bpf_int32)224); -+ b1 = gen_cmp_ge(cstate, OR_LINKPL, 16, BPF_B, 224); - gen_and(b0, b1); - return b1; - - case Q_IPV6: - b0 = gen_linktype(cstate, ETHERTYPE_IPV6); -- b1 = gen_cmp(cstate, OR_LINKPL, 24, BPF_B, (bpf_int32)255); -+ b1 = gen_cmp(cstate, OR_LINKPL, 24, BPF_B, 255); - gen_and(b0, b1); - return b1; - } -@@ -8241,7 +8234,7 @@ gen_inbound(compiler_state_t *cstate, int dir) - #ifdef HAVE_NET_PFVAR_H - case DLT_PFLOG: - b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, dir), BPF_B, -- (bpf_int32)((dir == 0) ? PF_IN : PF_OUT)); -+ ((dir == 0) ? PF_IN : PF_OUT)); - break; - #endif - -@@ -8414,7 +8407,7 @@ gen_pf_rnr(compiler_state_t *cstate, int rnr) - } - - b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, rulenr), BPF_W, -- (bpf_int32)rnr); -+ (bpf_u_int32)rnr); - return (b0); - } - -@@ -8437,7 +8430,7 @@ gen_pf_srnr(compiler_state_t *cstate, int srnr) - } - - b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, subrulenr), BPF_W, -- (bpf_int32)srnr); -+ (bpf_u_int32)srnr); - return (b0); - } - -@@ -8460,7 +8453,7 @@ gen_pf_reason(compiler_state_t *cstate, int reason) - } - - b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, reason), BPF_B, -- (bpf_int32)reason); -+ (bpf_u_int32)reason); - return (b0); - } - -@@ -8483,7 +8476,7 @@ gen_pf_action(compiler_state_t *cstate, int action) - } - - b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, action), BPF_B, -- (bpf_int32)action); -+ (bpf_u_int32)action); - return (b0); - } - #else /* !HAVE_NET_PFVAR_H */ -@@ -8574,7 +8567,7 @@ gen_pf_action(compiler_state_t *cstate, int action _U_) - - /* IEEE 802.11 wireless header */ - struct block * --gen_p80211_type(compiler_state_t *cstate, int type, int mask) -+gen_p80211_type(compiler_state_t *cstate, bpf_u_int32 type, bpf_u_int32 mask) - { - struct block *b0; - -@@ -8591,8 +8584,7 @@ gen_p80211_type(compiler_state_t *cstate, int type, int mask) - case DLT_PRISM_HEADER: - case DLT_IEEE802_11_RADIO_AVS: - case DLT_IEEE802_11_RADIO: -- b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, (bpf_int32)type, -- (bpf_int32)mask); -+ b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, type, mask); - break; - - default: -@@ -8604,7 +8596,7 @@ gen_p80211_type(compiler_state_t *cstate, int type, int mask) - } - - struct block * --gen_p80211_fcdir(compiler_state_t *cstate, int fcdir) -+gen_p80211_fcdir(compiler_state_t *cstate, bpf_u_int32 fcdir) - { - struct block *b0; - -@@ -8628,8 +8620,8 @@ gen_p80211_fcdir(compiler_state_t *cstate, int fcdir) - /*NOTREACHED*/ - } - -- b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, (bpf_int32)fcdir, -- (bpf_u_int32)IEEE80211_FC1_DIR_MASK); -+ b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, fcdir, -+ IEEE80211_FC1_DIR_MASK); - - return (b0); - } -@@ -8746,7 +8738,7 @@ gen_vlan_vid_test(compiler_state_t *cstate, bpf_u_int32 vlan_num) - bpf_error(cstate, "VLAN tag %u greater than maximum %u", - vlan_num, 0x0fff); - } -- return gen_mcmp(cstate, OR_LINKPL, 0, BPF_H, (bpf_int32)vlan_num, 0x0fff); -+ return gen_mcmp(cstate, OR_LINKPL, 0, BPF_H, vlan_num, 0x0fff); - } - - static struct block * -@@ -8776,7 +8768,8 @@ gen_vlan_no_bpf_extensions(compiler_state_t *cstate, bpf_u_int32 vlan_num, - #if defined(SKF_AD_VLAN_TAG_PRESENT) - /* add v to variable part of off */ - static void --gen_vlan_vloffset_add(compiler_state_t *cstate, bpf_abs_offset *off, int v, struct slist *s) -+gen_vlan_vloffset_add(compiler_state_t *cstate, bpf_abs_offset *off, -+ bpf_u_int32 v, struct slist *s) - { - struct slist *s2; - -@@ -9062,7 +9055,7 @@ gen_mpls(compiler_state_t *cstate, bpf_u_int32 label_num_arg, - label_num, 0xFFFFF); - } - label_num = label_num << 12; /* label is shifted 12 bits on the wire */ -- b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, (bpf_int32)label_num, -+ b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, label_num, - 0xfffff000); /* only compare the first 20 bits */ - gen_and(b0, b1); - b0 = b1; -@@ -9102,7 +9095,7 @@ gen_pppoed(compiler_state_t *cstate) - return (NULL); - - /* check for PPPoE discovery */ -- return gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOED); -+ return gen_linktype(cstate, ETHERTYPE_PPPOED); - } - - struct block * -@@ -9120,7 +9113,7 @@ gen_pppoes(compiler_state_t *cstate, bpf_u_int32 sess_num, int has_sess_num) - /* - * Test against the PPPoE session link-layer type. - */ -- b0 = gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOES); -+ b0 = gen_linktype(cstate, ETHERTYPE_PPPOES); - - /* If a specific session is requested, check PPPoE session id */ - if (has_sess_num) { -@@ -9128,8 +9121,7 @@ gen_pppoes(compiler_state_t *cstate, bpf_u_int32 sess_num, int has_sess_num) - bpf_error(cstate, "PPPoE session number %u greater than maximum %u", - sess_num, 0x0000ffff); - } -- b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, -- (bpf_int32)sess_num, 0x0000ffff); -+ b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, sess_num, 0x0000ffff); - gen_and(b0, b1); - b0 = b1; - } -@@ -9169,7 +9161,7 @@ gen_pppoes(compiler_state_t *cstate, bpf_u_int32 sess_num, int has_sess_num) - * specified. Parameterized to handle both IPv4 and IPv6. */ - static struct block * - gen_geneve_check(compiler_state_t *cstate, -- struct block *(*gen_portfn)(compiler_state_t *, int, int, int), -+ struct block *(*gen_portfn)(compiler_state_t *, u_int, int, int), - enum e_offrel offrel, bpf_u_int32 vni, int has_vni) - { - struct block *b0, *b1; -@@ -9179,7 +9171,7 @@ gen_geneve_check(compiler_state_t *cstate, - /* Check that we are operating on version 0. Otherwise, we - * can't decode the rest of the fields. The version is 2 bits - * in the first byte of the Geneve header. */ -- b1 = gen_mcmp(cstate, offrel, 8, BPF_B, (bpf_int32)0, 0xc0); -+ b1 = gen_mcmp(cstate, offrel, 8, BPF_B, 0, 0xc0); - gen_and(b0, b1); - b0 = b1; - -@@ -9189,8 +9181,7 @@ gen_geneve_check(compiler_state_t *cstate, - vni, 0xffffff); - } - vni <<= 8; /* VNI is in the upper 3 bytes */ -- b1 = gen_mcmp(cstate, offrel, 12, BPF_W, (bpf_int32)vni, -- 0xffffff00); -+ b1 = gen_mcmp(cstate, offrel, 12, BPF_W, vni, 0xffffff00); - gen_and(b0, b1); - b0 = b1; - } -@@ -9473,7 +9464,7 @@ gen_geneve_ll_check(compiler_state_t *cstate) - - static struct block * - gen_atmfield_code_internal(compiler_state_t *cstate, int atmfield, -- bpf_int32 jvalue, bpf_u_int32 jtype, int reverse) -+ bpf_u_int32 jvalue, int jtype, int reverse) - { - struct block *b0; - -@@ -9484,8 +9475,8 @@ gen_atmfield_code_internal(compiler_state_t *cstate, int atmfield, - bpf_error(cstate, "'vpi' supported only on raw ATM"); - if (cstate->off_vpi == OFFSET_NOT_SET) - abort(); -- b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vpi, BPF_B, 0xffffffff, jtype, -- reverse, jvalue); -+ b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vpi, BPF_B, -+ 0xffffffffU, jtype, reverse, jvalue); - break; - - case A_VCI: -@@ -9493,22 +9484,22 @@ gen_atmfield_code_internal(compiler_state_t *cstate, int atmfield, - bpf_error(cstate, "'vci' supported only on raw ATM"); - if (cstate->off_vci == OFFSET_NOT_SET) - abort(); -- b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vci, BPF_H, 0xffffffff, jtype, -- reverse, jvalue); -+ b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vci, BPF_H, -+ 0xffffffffU, jtype, reverse, jvalue); - break; - - case A_PROTOTYPE: - if (cstate->off_proto == OFFSET_NOT_SET) - abort(); /* XXX - this isn't on FreeBSD */ -- b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 0x0f, jtype, -- reverse, jvalue); -+ b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, -+ 0x0fU, jtype, reverse, jvalue); - break; - - case A_MSGTYPE: - if (cstate->off_payload == OFFSET_NOT_SET) - abort(); - b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_payload + MSG_TYPE_POS, BPF_B, -- 0xffffffff, jtype, reverse, jvalue); -+ 0xffffffffU, jtype, reverse, jvalue); - break; - - case A_CALLREFTYPE: -@@ -9516,8 +9507,8 @@ gen_atmfield_code_internal(compiler_state_t *cstate, int atmfield, - bpf_error(cstate, "'callref' supported only on raw ATM"); - if (cstate->off_proto == OFFSET_NOT_SET) - abort(); -- b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 0xffffffff, -- jtype, reverse, jvalue); -+ b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, -+ 0xffffffffU, jtype, reverse, jvalue); - break; - - default: -@@ -9560,7 +9551,7 @@ gen_atmtype_llc(compiler_state_t *cstate) - - struct block * - gen_atmfield_code(compiler_state_t *cstate, int atmfield, -- bpf_int32 jvalue, bpf_u_int32 jtype, int reverse) -+ bpf_u_int32 jvalue, int jtype, int reverse) - { - /* - * Catch errors reported by us and routines below us, and return NULL -@@ -9700,7 +9691,8 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - (cstate->linktype != DLT_MTP2_WITH_PHDR) ) - bpf_error(cstate, "'fisu' supported only on MTP2"); - /* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */ -- b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JEQ, 0, 0); -+ b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, -+ 0x3fU, BPF_JEQ, 0, 0U); - break; - - case M_LSSU: -@@ -9708,8 +9700,10 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - (cstate->linktype != DLT_ERF) && - (cstate->linktype != DLT_MTP2_WITH_PHDR) ) - bpf_error(cstate, "'lssu' supported only on MTP2"); -- b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 1, 2); -- b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 0, 0); -+ b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, -+ 0x3fU, BPF_JGT, 1, 2U); -+ b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, -+ 0x3fU, BPF_JGT, 0, 0U); - gen_and(b1, b0); - break; - -@@ -9718,7 +9712,8 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - (cstate->linktype != DLT_ERF) && - (cstate->linktype != DLT_MTP2_WITH_PHDR) ) - bpf_error(cstate, "'msu' supported only on MTP2"); -- b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 0, 2); -+ b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, -+ 0x3fU, BPF_JGT, 0, 2U); - break; - - case MH_FISU: -@@ -9727,7 +9722,8 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - (cstate->linktype != DLT_MTP2_WITH_PHDR) ) - bpf_error(cstate, "'hfisu' supported only on MTP2_HSL"); - /* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */ -- b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JEQ, 0, 0); -+ b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, -+ 0xff80U, BPF_JEQ, 0, 0U); - break; - - case MH_LSSU: -@@ -9735,8 +9731,10 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - (cstate->linktype != DLT_ERF) && - (cstate->linktype != DLT_MTP2_WITH_PHDR) ) - bpf_error(cstate, "'hlssu' supported only on MTP2_HSL"); -- b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 1, 0x0100); -- b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 0, 0); -+ b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, -+ 0xff80U, BPF_JGT, 1, 0x0100U); -+ b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, -+ 0xff80U, BPF_JGT, 0, 0U); - gen_and(b1, b0); - break; - -@@ -9745,7 +9743,8 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - (cstate->linktype != DLT_ERF) && - (cstate->linktype != DLT_MTP2_WITH_PHDR) ) - bpf_error(cstate, "'hmsu' supported only on MTP2_HSL"); -- b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 0, 0x0100); -+ b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, -+ 0xff80U, BPF_JGT, 0, 0x0100U); - break; - - default: -@@ -9761,7 +9760,7 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) - */ - struct block * - gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, -- bpf_u_int32 jvalue_arg, bpf_u_int32 jtype, int reverse) -+ bpf_u_int32 jvalue_arg, int jtype, int reverse) - { - volatile bpf_u_int32 jvalue = jvalue_arg; - struct block *b0; -@@ -9795,15 +9794,15 @@ gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, - if(jvalue > 255) - bpf_error(cstate, "sio value %u too big; max value = 255", - jvalue); -- b0 = gen_ncmp(cstate, OR_PACKET, newoff_sio, BPF_B, 0xffffffff, -- (u_int)jtype, reverse, (u_int)jvalue); -+ b0 = gen_ncmp(cstate, OR_PACKET, newoff_sio, BPF_B, 0xffffffffU, -+ jtype, reverse, jvalue); - break; - - case MH_OPC: - newoff_opc += 3; - - /* FALLTHROUGH */ -- case M_OPC: -+ case M_OPC: - if (cstate->off_opc == OFFSET_NOT_SET) - bpf_error(cstate, "'opc' supported only on SS7"); - /* opc coded on 14 bits so max value 16383 */ -@@ -9819,8 +9818,8 @@ gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, - val3 = jvalue & 0x00000003; - val3 = val3 <<22; - jvalue = val1 + val2 + val3; -- b0 = gen_ncmp(cstate, OR_PACKET, newoff_opc, BPF_W, 0x00c0ff0f, -- (u_int)jtype, reverse, (u_int)jvalue); -+ b0 = gen_ncmp(cstate, OR_PACKET, newoff_opc, BPF_W, 0x00c0ff0fU, -+ jtype, reverse, jvalue); - break; - - case MH_DPC: -@@ -9841,8 +9840,8 @@ gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, - val2 = jvalue & 0x00003f00; - val2 = val2 << 8; - jvalue = val1 + val2; -- b0 = gen_ncmp(cstate, OR_PACKET, newoff_dpc, BPF_W, 0xff3f0000, -- (u_int)jtype, reverse, (u_int)jvalue); -+ b0 = gen_ncmp(cstate, OR_PACKET, newoff_dpc, BPF_W, 0xff3f0000U, -+ jtype, reverse, jvalue); - break; - - case MH_SLS: -@@ -9859,8 +9858,8 @@ gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, - /* the following instruction is made to convert jvalue - * to the forme used to write sls in an ss7 message*/ - jvalue = jvalue << 4; -- b0 = gen_ncmp(cstate, OR_PACKET, newoff_sls, BPF_B, 0xf0, -- (u_int)jtype,reverse, (u_int)jvalue); -+ b0 = gen_ncmp(cstate, OR_PACKET, newoff_sls, BPF_B, 0xf0U, -+ jtype, reverse, jvalue); - break; - - default: -diff --git a/gencode.h b/gencode.h -index cc21e04..ef88ea1 100644 ---- a/gencode.h -+++ b/gencode.h -@@ -204,7 +204,7 @@ struct stmt { - int code; - struct slist *jt; /*only for relative jump in block*/ - struct slist *jf; /*only for relative jump in block*/ -- bpf_int32 k; -+ bpf_u_int32 k; - }; - - struct slist { -@@ -261,7 +261,7 @@ struct block { - atomset in_use; - atomset out_use; - int oval; -- int val[N_ATOMS]; -+ bpf_u_int32 val[N_ATOMS]; - }; - - /* -@@ -286,8 +286,8 @@ struct _compiler_state; - - typedef struct _compiler_state compiler_state_t; - --struct arth *gen_loadi(compiler_state_t *, int); --struct arth *gen_load(compiler_state_t *, int, struct arth *, int); -+struct arth *gen_loadi(compiler_state_t *, bpf_u_int32); -+struct arth *gen_load(compiler_state_t *, int, struct arth *, bpf_u_int32); - struct arth *gen_loadlen(compiler_state_t *); - struct arth *gen_neg(compiler_state_t *, struct arth *); - struct arth *gen_arth(compiler_state_t *, int, struct arth *, struct arth *); -@@ -300,10 +300,10 @@ struct block *gen_scode(compiler_state_t *, const char *, struct qual); - struct block *gen_ecode(compiler_state_t *, const char *, struct qual); - struct block *gen_acode(compiler_state_t *, const char *, struct qual); - struct block *gen_mcode(compiler_state_t *, const char *, const char *, -- unsigned int, struct qual); -+ bpf_u_int32, struct qual); - #ifdef INET6 - struct block *gen_mcode6(compiler_state_t *, const char *, const char *, -- unsigned int, struct qual); -+ bpf_u_int32, struct qual); - #endif - struct block *gen_ncode(compiler_state_t *, const char *, bpf_u_int32, - struct qual); -@@ -312,7 +312,7 @@ struct block *gen_relation(compiler_state_t *, int, struct arth *, - struct arth *, int); - struct block *gen_less(compiler_state_t *, int); - struct block *gen_greater(compiler_state_t *, int); --struct block *gen_byteop(compiler_state_t *, int, int, int); -+struct block *gen_byteop(compiler_state_t *, int, int, bpf_u_int32); - struct block *gen_broadcast(compiler_state_t *, int); - struct block *gen_multicast(compiler_state_t *, int); - struct block *gen_inbound(compiler_state_t *, int); -@@ -332,14 +332,14 @@ struct block *gen_pppoes(compiler_state_t *, bpf_u_int32, int); - - struct block *gen_geneve(compiler_state_t *, bpf_u_int32, int); - --struct block *gen_atmfield_code(compiler_state_t *, int, bpf_int32, -- bpf_u_int32, int); --struct block *gen_atmtype_abbrev(compiler_state_t *, int type); --struct block *gen_atmmulti_abbrev(compiler_state_t *, int type); -+struct block *gen_atmfield_code(compiler_state_t *, int, bpf_u_int32, -+ int, int); -+struct block *gen_atmtype_abbrev(compiler_state_t *, int); -+struct block *gen_atmmulti_abbrev(compiler_state_t *, int); - --struct block *gen_mtp2type_abbrev(compiler_state_t *, int type); -+struct block *gen_mtp2type_abbrev(compiler_state_t *, int); - struct block *gen_mtp3field_code(compiler_state_t *, int, bpf_u_int32, -- bpf_u_int32, int); -+ int, int); - - struct block *gen_pf_ifname(compiler_state_t *, const char *); - struct block *gen_pf_rnr(compiler_state_t *, int); -@@ -348,8 +348,8 @@ struct block *gen_pf_ruleset(compiler_state_t *, char *); - struct block *gen_pf_reason(compiler_state_t *, int); - struct block *gen_pf_action(compiler_state_t *, int); - --struct block *gen_p80211_type(compiler_state_t *, int, int); --struct block *gen_p80211_fcdir(compiler_state_t *, int); -+struct block *gen_p80211_type(compiler_state_t *, bpf_u_int32, bpf_u_int32); -+struct block *gen_p80211_fcdir(compiler_state_t *, bpf_u_int32); - - /* - * Representation of a program as a tree of blocks, plus current mark. -@@ -385,4 +385,4 @@ int pcap_parse(void *, compiler_state_t *); - - /* XXX */ - #define JT(b) ((b)->et.succ) --#define JF(b) ((b)->ef.succ) -+#define JF(b) ((b)->ef.succ) -\ No newline at end of file -diff --git a/grammar.y b/grammar.y -index 32cb19c..eadc8c8 100644 ---- a/grammar.y -+++ b/grammar.y -@@ -210,8 +210,17 @@ str2tok(const char *str, const struct tok *toks) - int i; - - for (i = 0; toks[i].s != NULL; i++) { -- if (pcap_strcasecmp(toks[i].s, str) == 0) -+ if (pcap_strcasecmp(toks[i].s, str) == 0) { -+ /* -+ * Just in case somebody is using this to -+ * generate values of -1/0xFFFFFFFF. -+ * That won't work, as it's indistinguishable -+ * from an error. -+ */ -+ if (toks[i].v == -1) -+ abort(); - return (toks[i].v); -+ } - } - return (-1); - } -@@ -235,7 +244,7 @@ pfreason_to_num(compiler_state_t *cstate, const char *reason) - if (pcap_strcasecmp(reason, reasons[i]) == 0) - return (i); - } -- bpf_set_error(cstate, "unknown PF reason"); -+ bpf_set_error(cstate, "unknown PF reason \"%s\"", reason); - return (-1); - } - -@@ -259,7 +268,7 @@ pfaction_to_num(compiler_state_t *cstate, const char *action) - return (PF_NORDR); - #endif - else { -- bpf_set_error(cstate, "unknown PF action"); -+ bpf_set_error(cstate, "unknown PF action \"%s\"", action); - return (-1); - } - } -@@ -307,7 +316,8 @@ DIAG_OFF_BISON_BYACC - %type head - %type pqual dqual aqual ndaqual - %type arth narth --%type byteop pname pnum relop irelop -+%type byteop pname relop irelop -+%type pnum - %type and or paren not null prog - %type other pfvar p80211 pllc - %type atmtype atmmultitype -@@ -348,7 +358,8 @@ DIAG_OFF_BISON_BYACC - - %type ID EID AID - %type HID HID6 --%type NUM action reason type subtype type_subtype dir -+%type NUM -+%type action reason type subtype type_subtype dir - - %left OR AND - %nonassoc '!' -@@ -378,7 +389,7 @@ and: AND { $$ = $0; } - or: OR { $$ = $0; } - ; - id: nid -- | pnum { CHECK_PTR_VAL(($$.b = gen_ncode(cstate, NULL, (bpf_u_int32)$1, -+ | pnum { CHECK_PTR_VAL(($$.b = gen_ncode(cstate, NULL, $1, - $$.q = $0.q))); } - | paren pid ')' { $$ = $2; } - ; -@@ -392,17 +403,17 @@ nid: ID { CHECK_PTR_VAL($1); CHECK_PTR_VAL(($$.b = gen_scode(cstate, $1, $$. - /* Decide how to parse HID based on proto */ - $$.q = $0.q; - if ($$.q.addr == Q_PORT) { -- bpf_set_error(cstate, "'port' modifier applied to ip host"); -- YYABORT; -+ bpf_set_error(cstate, "'port' modifier applied to ip host"); -+ YYABORT; - } else if ($$.q.addr == Q_PORTRANGE) { -- bpf_set_error(cstate, "'portrange' modifier applied to ip host"); -- YYABORT; -+ bpf_set_error(cstate, "'portrange' modifier applied to ip host"); -+ YYABORT; - } else if ($$.q.addr == Q_PROTO) { -- bpf_set_error(cstate, "'proto' modifier applied to ip host"); -- YYABORT; -+ bpf_set_error(cstate, "'proto' modifier applied to ip host"); -+ YYABORT; - } else if ($$.q.addr == Q_PROTOCHAIN) { -- bpf_set_error(cstate, "'protochain' modifier applied to ip host"); -- YYABORT; -+ bpf_set_error(cstate, "'protochain' modifier applied to ip host"); -+ YYABORT; - } - CHECK_PTR_VAL(($$.b = gen_ncode(cstate, $1, 0, $$.q))); - } -@@ -440,7 +451,7 @@ pid: nid - | qid and id { gen_and($1.b, $3.b); $$ = $3; } - | qid or id { gen_or($1.b, $3.b); $$ = $3; } - ; --qid: pnum { CHECK_PTR_VAL(($$.b = gen_ncode(cstate, NULL, (bpf_u_int32)$1, -+qid: pnum { CHECK_PTR_VAL(($$.b = gen_ncode(cstate, NULL, $1, - $$.q = $0.q))); } - | pid - ; -@@ -514,7 +525,7 @@ pname: LINK { $$ = Q_LINK; } - | IGRP { $$ = Q_IGRP; } - | PIM { $$ = Q_PIM; } - | VRRP { $$ = Q_VRRP; } -- | CARP { $$ = Q_CARP; } -+ | CARP { $$ = Q_CARP; } - | ATALK { $$ = Q_ATALK; } - | AARP { $$ = Q_AARP; } - | DECNET { $$ = Q_DECNET; } -@@ -549,14 +560,14 @@ other: pqual TK_BROADCAST { CHECK_PTR_VAL(($$ = gen_broadcast(cstate, $1))); } - | CBYTE NUM byteop NUM { CHECK_PTR_VAL(($$ = gen_byteop(cstate, $3, $2, $4))); } - | INBOUND { CHECK_PTR_VAL(($$ = gen_inbound(cstate, 0))); } - | OUTBOUND { CHECK_PTR_VAL(($$ = gen_inbound(cstate, 1))); } -- | VLAN pnum { CHECK_PTR_VAL(($$ = gen_vlan(cstate, (bpf_u_int32)$2, 1))); } -+ | VLAN pnum { CHECK_PTR_VAL(($$ = gen_vlan(cstate, $2, 1))); } - | VLAN { CHECK_PTR_VAL(($$ = gen_vlan(cstate, 0, 0))); } -- | MPLS pnum { CHECK_PTR_VAL(($$ = gen_mpls(cstate, (bpf_u_int32)$2, 1))); } -+ | MPLS pnum { CHECK_PTR_VAL(($$ = gen_mpls(cstate, $2, 1))); } - | MPLS { CHECK_PTR_VAL(($$ = gen_mpls(cstate, 0, 0))); } - | PPPOED { CHECK_PTR_VAL(($$ = gen_pppoed(cstate))); } -- | PPPOES pnum { CHECK_PTR_VAL(($$ = gen_pppoes(cstate, (bpf_u_int32)$2, 1))); } -+ | PPPOES pnum { CHECK_PTR_VAL(($$ = gen_pppoes(cstate, $2, 1))); } - | PPPOES { CHECK_PTR_VAL(($$ = gen_pppoes(cstate, 0, 0))); } -- | GENEVE pnum { CHECK_PTR_VAL(($$ = gen_geneve(cstate, (bpf_u_int32)$2, 1))); } -+ | GENEVE pnum { CHECK_PTR_VAL(($$ = gen_geneve(cstate, $2, 1))); } - | GENEVE { CHECK_PTR_VAL(($$ = gen_geneve(cstate, 0, 0))); } - | pfvar { $$ = $1; } - | pqual p80211 { $$ = $2; } -@@ -586,45 +597,55 @@ p80211: TYPE type SUBTYPE subtype - | DIR dir { CHECK_PTR_VAL(($$ = gen_p80211_fcdir(cstate, $2))); } - ; - --type: NUM -+type: NUM { if (($1 & (~IEEE80211_FC0_TYPE_MASK)) != 0) { -+ bpf_set_error(cstate, "invalid 802.11 type value 0x%02x", $1); -+ YYABORT; -+ } -+ $$ = (int)$1; -+ } - | ID { CHECK_PTR_VAL($1); -- $$ = str2tok($1, ieee80211_types); -- if ($$ == -1) { -- bpf_set_error(cstate, "unknown 802.11 type name"); -- YYABORT; -- } -- } -+ $$ = str2tok($1, ieee80211_types); -+ if ($$ == -1) { -+ bpf_set_error(cstate, "unknown 802.11 type name \"%s\"", $1); -+ YYABORT; -+ } -+ } - ; - --subtype: NUM -+subtype: NUM { if (($1 & (~IEEE80211_FC0_SUBTYPE_MASK)) != 0) { -+ bpf_set_error(cstate, "invalid 802.11 subtype value 0x%02x", $1); -+ YYABORT; -+ } -+ $$ = (int)$1; -+ } - | ID { const struct tok *types = NULL; -- int i; -- CHECK_PTR_VAL($1); -- for (i = 0;; i++) { -- if (ieee80211_type_subtypes[i].tok == NULL) { -- /* Ran out of types */ -- bpf_set_error(cstate, "unknown 802.11 type"); -+ int i; -+ CHECK_PTR_VAL($1); -+ for (i = 0;; i++) { -+ if (ieee80211_type_subtypes[i].tok == NULL) { -+ /* Ran out of types */ -+ bpf_set_error(cstate, "unknown 802.11 type"); -+ YYABORT; -+ } -+ if (-1 == ieee80211_type_subtypes[i].type) { -+ types = ieee80211_type_subtypes[i].tok; -+ break; -+ } -+ } -+ -+ $$ = str2tok($1, types); -+ if ($$ == -1) { -+ bpf_set_error(cstate, "unknown 802.11 subtype name \"%s\"", $1); - YYABORT; -+ } - } -- if ($-1 == ieee80211_type_subtypes[i].type) { -- types = ieee80211_type_subtypes[i].tok; -- break; -- } -- } -- -- $$ = str2tok($1, types); -- if ($$ == -1) { -- bpf_set_error(cstate, "unknown 802.11 subtype name"); -- YYABORT; -- } -- } - ; - - type_subtype: ID { int i; - CHECK_PTR_VAL($1); - for (i = 0;; i++) { -- if (ieee80211_type_subtypes[i].tok == NULL) { -- /* Ran out of types */ -+ if (ieee80211_type_subtypes[i].tok == NULL) { -+ /* Ran out of types */ - bpf_set_error(cstate, "unknown 802.11 type name"); - YYABORT; - } -@@ -654,9 +675,9 @@ pllc: LLC { CHECK_PTR_VAL(($$ = gen_llc(cstate))); } - } else { - subtype = str2tok($2, llc_u_subtypes); - if (subtype == -1) { -- bpf_set_error(cstate, "unknown LLC type name \"%s\"", $2); -- YYABORT; -- } -+ bpf_set_error(cstate, "unknown LLC type name \"%s\"", $2); -+ YYABORT; -+ } - CHECK_PTR_VAL(($$ = gen_llc_u_subtype(cstate, subtype))); - } - } -@@ -665,7 +686,7 @@ pllc: LLC { CHECK_PTR_VAL(($$ = gen_llc(cstate))); } - | LLC PF_RNR { CHECK_PTR_VAL(($$ = gen_llc_s_subtype(cstate, LLC_RNR))); } - ; - --dir: NUM -+dir: NUM { $$ = (int)$1; } - | ID { CHECK_PTR_VAL($1); - if (pcap_strcasecmp($1, "nods") == 0) - $$ = IEEE80211_FC1_DIR_NODS; -@@ -743,15 +764,15 @@ atmfield: VPI { $$.atmfieldtype = A_VPI; } - | VCI { $$.atmfieldtype = A_VCI; } - ; - atmvalue: atmfieldvalue -- | relop NUM { CHECK_PTR_VAL(($$.b = gen_atmfield_code(cstate, $0.atmfieldtype, (bpf_int32)$2, (bpf_u_int32)$1, 0))); } -- | irelop NUM { CHECK_PTR_VAL(($$.b = gen_atmfield_code(cstate, $0.atmfieldtype, (bpf_int32)$2, (bpf_u_int32)$1, 1))); } -+ | relop NUM { CHECK_PTR_VAL(($$.b = gen_atmfield_code(cstate, $0.atmfieldtype, $2, $1, 0))); } -+ | irelop NUM { CHECK_PTR_VAL(($$.b = gen_atmfield_code(cstate, $0.atmfieldtype, $2, $1, 1))); } - | paren atmlistvalue ')' { $$.b = $2.b; $$.q = qerr; } - ; - atmfieldvalue: NUM { - $$.atmfieldtype = $0.atmfieldtype; - if ($$.atmfieldtype == A_VPI || - $$.atmfieldtype == A_VCI) -- CHECK_PTR_VAL(($$.b = gen_atmfield_code(cstate, $$.atmfieldtype, (bpf_int32) $1, BPF_JEQ, 0))); -+ CHECK_PTR_VAL(($$.b = gen_atmfield_code(cstate, $$.atmfieldtype, $1, BPF_JEQ, 0))); - } - ; - atmlistvalue: atmfieldvalue -@@ -776,8 +797,8 @@ mtp3field: SIO { $$.mtp3fieldtype = M_SIO; } - | HSLS { $$.mtp3fieldtype = MH_SLS; } - ; - mtp3value: mtp3fieldvalue -- | relop NUM { CHECK_PTR_VAL(($$.b = gen_mtp3field_code(cstate, $0.mtp3fieldtype, (u_int)$2, (u_int)$1, 0))); } -- | irelop NUM { CHECK_PTR_VAL(($$.b = gen_mtp3field_code(cstate, $0.mtp3fieldtype, (u_int)$2, (u_int)$1, 1))); } -+ | relop NUM { CHECK_PTR_VAL(($$.b = gen_mtp3field_code(cstate, $0.mtp3fieldtype, $2, $1, 0))); } -+ | irelop NUM { CHECK_PTR_VAL(($$.b = gen_mtp3field_code(cstate, $0.mtp3fieldtype, $2, $1, 1))); } - | paren mtp3listvalue ')' { $$.b = $2.b; $$.q = qerr; } - ; - mtp3fieldvalue: NUM { -@@ -790,10 +811,10 @@ mtp3fieldvalue: NUM { - $$.mtp3fieldtype == MH_OPC || - $$.mtp3fieldtype == MH_DPC || - $$.mtp3fieldtype == MH_SLS) -- CHECK_PTR_VAL(($$.b = gen_mtp3field_code(cstate, $$.mtp3fieldtype, (u_int) $1, BPF_JEQ, 0))); -+ CHECK_PTR_VAL(($$.b = gen_mtp3field_code(cstate, $$.mtp3fieldtype, $1, BPF_JEQ, 0))); - } - ; - mtp3listvalue: mtp3fieldvalue - | mtp3listvalue or mtp3fieldvalue { gen_or($1.b, $3.b); $$ = $3; } - ; --%% -+%% -\ No newline at end of file -diff --git a/optimize.c b/optimize.c -index 448452d..c0f9ea5 100644 ---- a/optimize.c -+++ b/optimize.c -@@ -213,17 +213,17 @@ lowest_set_bit(int mask) - */ - struct valnode { - int code; -- int v0, v1; -- int val; -+ bpf_u_int32 v0, v1; -+ int val; /* the value number */ - struct valnode *next; - }; - - /* Integer constants mapped with the load immediate opcode. */ --#define K(i) F(opt_state, BPF_LD|BPF_IMM|BPF_W, i, 0L) -+#define K(i) F(opt_state, BPF_LD|BPF_IMM|BPF_W, i, 0U) - - struct vmapinfo { - int is_const; -- bpf_int32 const_val; -+ bpf_u_int32 const_val; - }; - - typedef struct { -@@ -313,8 +313,8 @@ typedef struct { - - #define MODULUS 213 - struct valnode *hashtbl[MODULUS]; -- int curval; -- int maxval; -+ bpf_u_int32 curval; -+ bpf_u_int32 maxval; - - struct vmapinfo *vmap; - struct valnode *vnode_base; -@@ -496,8 +496,11 @@ find_closure(opt_state_t *opt_state, struct block *root) - } - - /* -- * Return the register number that is used by s. If A and X are both -- * used, return AX_ATOM. If no register is used, return -1. -+ * Return the register number that is used by s. -+ * -+ * Returns ATOM_A if A is used, ATOM_X if X is used, AX_ATOM if both A and X -+ * are used, the scratch memory location's number if a scratch memory -+ * location is used (e.g., 0 for M[0]), or -1 if none of those are used. - * - * The implementation should probably change to an array access. - */ -@@ -676,21 +679,40 @@ init_val(opt_state_t *opt_state) - memset((char *)opt_state->hashtbl, 0, sizeof opt_state->hashtbl); - } - --/* Because we really don't have an IR, this stuff is a little messy. */ --static int --F(opt_state_t *opt_state, int code, int v0, int v1) -+/* -+ * Because we really don't have an IR, this stuff is a little messy. -+ * -+ * This routine looks in the table of existing value number for a value -+ * with generated from an operation with the specified opcode and -+ * the specified values. If it finds it, it returns its value number, -+ * otherwise it makes a new entry in the table and returns the -+ * value number of that entry. -+ */ -+static bpf_u_int32 -+F(opt_state_t *opt_state, int code, bpf_u_int32 v0, bpf_u_int32 v1) - { - u_int hash; -- int val; -+ bpf_u_int32 val; - struct valnode *p; - -- hash = (u_int)code ^ ((u_int)v0 << 4) ^ ((u_int)v1 << 8); -+ hash = (u_int)code ^ (v0 << 4) ^ (v1 << 8); - hash %= MODULUS; - - for (p = opt_state->hashtbl[hash]; p; p = p->next) - if (p->code == code && p->v0 == v0 && p->v1 == v1) - return p->val; - -+ /* -+ * Not found. Allocate a new value, and assign it a new -+ * value number. -+ * -+ * opt_state->curval starts out as 0, which means VAL_UNKNOWN; we -+ * increment it before using it as the new value number, which -+ * means we never assign VAL_UNKNOWN. -+ * -+ * XXX - unless we overflow, but we probably won't have 2^32-1 -+ * values; we treat 32 bits as effectively infinite. -+ */ - val = ++opt_state->curval; - if (BPF_MODE(code) == BPF_IMM && - (BPF_CLASS(code) == BPF_LD || BPF_CLASS(code) == BPF_LDX)) { -@@ -709,7 +731,7 @@ F(opt_state_t *opt_state, int code, int v0, int v1) - } - - static inline void --vstore(struct stmt *s, int *valp, int newval, int alter) -+vstore(struct stmt *s, bpf_u_int32 *valp, bpf_u_int32 newval, int alter) - { - if (alter && newval != VAL_UNKNOWN && *valp == newval) - s->code = NOP; -@@ -722,7 +744,7 @@ vstore(struct stmt *s, int *valp, int newval, int alter) - * (Unary operators are handled elsewhere.) - */ - static void --fold_op(opt_state_t *opt_state, struct stmt *s, int v0, int v1) -+fold_op(opt_state_t *opt_state, struct stmt *s, bpf_u_int32 v0, bpf_u_int32 v1) - { - bpf_u_int32 a, b; - -@@ -832,7 +854,7 @@ opt_peep(opt_state_t *opt_state, struct block *b) - { - struct slist *s; - struct slist *next, *last; -- int val; -+ bpf_u_int32 val; - - s = b->stmts; - if (s == 0) -@@ -1033,7 +1055,7 @@ opt_peep(opt_state_t *opt_state, struct block *b) - if (b->s.code == (BPF_JMP|BPF_K|BPF_JSET)) { - if (b->s.k == 0) - JT(b) = JF(b); -- if ((u_int)b->s.k == 0xffffffffU) -+ if (b->s.k == 0xffffffffU) - JF(b) = JT(b); - } - /* -@@ -1043,7 +1065,7 @@ opt_peep(opt_state_t *opt_state, struct block *b) - */ - val = b->val[X_ATOM]; - if (opt_state->vmap[val].is_const && BPF_SRC(b->s.code) == BPF_X) { -- bpf_int32 v = opt_state->vmap[val].const_val; -+ bpf_u_int32 v = opt_state->vmap[val].const_val; - b->s.code &= ~BPF_X; - b->s.k = v; - } -@@ -1053,7 +1075,7 @@ opt_peep(opt_state_t *opt_state, struct block *b) - */ - val = b->val[A_ATOM]; - if (opt_state->vmap[val].is_const && BPF_SRC(b->s.code) == BPF_K) { -- bpf_int32 v = opt_state->vmap[val].const_val; -+ bpf_u_int32 v = opt_state->vmap[val].const_val; - switch (BPF_OP(b->s.code)) { - - case BPF_JEQ: -@@ -1061,11 +1083,11 @@ opt_peep(opt_state_t *opt_state, struct block *b) - break; - - case BPF_JGT: -- v = (unsigned)v > (unsigned)b->s.k; -+ v = v > b->s.k; - break; - - case BPF_JGE: -- v = (unsigned)v >= (unsigned)b->s.k; -+ v = v >= b->s.k; - break; - - case BPF_JSET: -@@ -1091,10 +1113,10 @@ opt_peep(opt_state_t *opt_state, struct block *b) - * evaluation and code transformations weren't folded together. - */ - static void --opt_stmt(opt_state_t *opt_state, struct stmt *s, int val[], int alter) -+opt_stmt(opt_state_t *opt_state, struct stmt *s, bpf_u_int32 val[], int alter) - { - int op; -- int v; -+ bpf_u_int32 v; - - switch (s->code) { - -@@ -1159,7 +1181,7 @@ opt_stmt(opt_state_t *opt_state, struct stmt *s, int val[], int alter) - * about the result of negating 0x80000000 being - * undefined. - */ -- s->k = 0U - (bpf_u_int32)(opt_state->vmap[val[A_ATOM]].const_val); -+ s->k = 0U - opt_state->vmap[val[A_ATOM]].const_val; - val[A_ATOM] = K(s->k); - } - else -@@ -1236,14 +1258,8 @@ opt_stmt(opt_state_t *opt_state, struct stmt *s, int val[], int alter) - else { - s->code = BPF_ALU|BPF_K|op; - s->k = opt_state->vmap[val[X_ATOM]].const_val; -- /* -- * XXX - we need to make up our minds -- * as to what integers are signed and -- * what integers are unsigned in BPF -- * programs and in our IR. -- */ - if ((op == BPF_LSH || op == BPF_RSH) && -- (s->k < 0 || s->k > 31)) -+ s->k > 31) - opt_error(opt_state, - "shift by more than 31 bits"); - opt_state->done = 0; -@@ -1369,7 +1385,7 @@ opt_blk(opt_state_t *opt_state, struct block *b, int do_stmts) - struct slist *s; - struct edge *p; - int i; -- bpf_int32 aval, xval; -+ bpf_u_int32 aval, xval; - - #if 0 - for (s = b->stmts; s && s->next; s = s->next) -@@ -1488,7 +1504,7 @@ static struct block * - fold_edge(struct block *child, struct edge *ep) - { - int sense; -- int aval0, aval1, oval0, oval1; -+ bpf_u_int32 aval0, aval1, oval0, oval1; - int code = ep->code; - - if (code < 0) { -@@ -1594,7 +1610,8 @@ opt_j(opt_state_t *opt_state, struct edge *ep) - static void - or_pullup(opt_state_t *opt_state, struct block *b) - { -- int val, at_top; -+ bpf_u_int32 val; -+ int at_top; - struct block *pull; - struct block **diffp, **samep; - struct edge *ep; -@@ -1686,7 +1703,8 @@ or_pullup(opt_state_t *opt_state, struct block *b) - static void - and_pullup(opt_state_t *opt_state, struct block *b) - { -- int val, at_top; -+ bpf_u_int32 val; -+ int at_top; - struct block *pull; - struct block **diffp, **samep; - struct edge *ep; -@@ -2379,7 +2397,7 @@ filled: - if (off >= 256) { - /* offset too large for branch, must add a jump */ - if (p->longjt == 0) { -- /* mark this instruction and retry */ -+ /* mark this instruction and retry */ - p->longjt++; - return(0); - } -@@ -2399,7 +2417,7 @@ filled: - if (off >= 256) { - /* offset too large for branch, must add a jump */ - if (p->longjf == 0) { -- /* mark this instruction and retry */ -+ /* mark this instruction and retry */ - p->longjf++; - return(0); - } -diff --git a/scanner.l b/scanner.l -index effcf81..f3dabac 100644 ---- a/scanner.l -+++ b/scanner.l -@@ -147,8 +147,7 @@ void pcap_set_column(int, yyscan_t); - #include "os-proto.h" - #endif - --static int stoi(char *); --static inline int xdtoi(int); -+static int stou(char *, YYSTYPE *, compiler_state_t *); - - /* - * Disable diagnostics in the code generated by Flex. -@@ -393,7 +392,7 @@ hsls return HSLS; - ">>" return RSH; - ${B} { yylval->s = sdup(yyextra, yytext); return AID; } - {MAC} { yylval->s = sdup(yyextra, yytext); return EID; } --{N} { yylval->i = stoi((char *)yytext); return NUM; } -+{N} { return stou(yytext, yylval, yyextra); } - ({N}\.{N})|({N}\.{N}\.{N})|({N}\.{N}\.{N}\.{N}) { - yylval->s = sdup(yyextra, (char *)yytext); return HID; } - {V6} { -@@ -416,62 +415,62 @@ ${B} { yylval->s = sdup(yyextra, yytext); return AID; } - return HID6; - } - {B}:+({B}:+)+ { bpf_set_error(yyextra, "bogus ethernet address %s", yytext); yylval->s = NULL; return EID; } --icmptype { yylval->i = 0; return NUM; } --icmpcode { yylval->i = 1; return NUM; } --icmp-echoreply { yylval->i = 0; return NUM; } --icmp-unreach { yylval->i = 3; return NUM; } --icmp-sourcequench { yylval->i = 4; return NUM; } --icmp-redirect { yylval->i = 5; return NUM; } --icmp-echo { yylval->i = 8; return NUM; } --icmp-routeradvert { yylval->i = 9; return NUM; } --icmp-routersolicit { yylval->i = 10; return NUM; } --icmp-timxceed { yylval->i = 11; return NUM; } --icmp-paramprob { yylval->i = 12; return NUM; } --icmp-tstamp { yylval->i = 13; return NUM; } --icmp-tstampreply { yylval->i = 14; return NUM; } --icmp-ireq { yylval->i = 15; return NUM; } --icmp-ireqreply { yylval->i = 16; return NUM; } --icmp-maskreq { yylval->i = 17; return NUM; } --icmp-maskreply { yylval->i = 18; return NUM; } -- --icmp6type { yylval->i = 0; return NUM; } --icmp6code { yylval->i = 1; return NUM; } -- --icmp6-echo { yylval->i = 128; return NUM; } --icmp6-echoreply { yylval->i = 129; return NUM; } --icmp6-multicastlistenerquery { yylval->i = 130; return NUM; } --icmp6-multicastlistenerreportv1 { yylval->i = 131; return NUM; } --icmp6-multicastlistenerdone { yylval->i = 132; return NUM; } --icmp6-routersolicit { yylval->i = 133; return NUM; } --icmp6-routeradvert { yylval->i = 134; return NUM; } --icmp6-neighborsolicit { yylval->i = 135; return NUM; } --icmp6-neighboradvert { yylval->i = 136; return NUM; } --icmp6-redirect { yylval->i = 137; return NUM; } --icmp6-routerrenum { yylval->i = 138; return NUM; } --icmp6-nodeinformationquery { yylval->i = 139; return NUM; } --icmp6-nodeinformationresponse { yylval->i = 140; return NUM; } --icmp6-ineighbordiscoverysolicit { yylval->i = 141; return NUM; } --icmp6-ineighbordiscoveryadvert { yylval->i = 142; return NUM; } --icmp6-multicastlistenerreportv2 { yylval->i = 143; return NUM; } --icmp6-homeagentdiscoveryrequest { yylval->i = 144; return NUM; } --icmp6-homeagentdiscoveryreply { yylval->i = 145; return NUM; } --icmp6-mobileprefixsolicit { yylval->i = 146; return NUM; } --icmp6-mobileprefixadvert { yylval->i = 147; return NUM; } --icmp6-certpathsolicit { yylval->i = 148; return NUM; } --icmp6-certpathadvert { yylval->i = 149; return NUM; } --icmp6-multicastrouteradvert { yylval->i = 151; return NUM; } --icmp6-multicastroutersolicit { yylval->i = 152; return NUM; } --icmp6-multicastrouterterm { yylval->i = 153; return NUM; } -- --tcpflags { yylval->i = 13; return NUM; } --tcp-fin { yylval->i = 0x01; return NUM; } --tcp-syn { yylval->i = 0x02; return NUM; } --tcp-rst { yylval->i = 0x04; return NUM; } --tcp-push { yylval->i = 0x08; return NUM; } --tcp-ack { yylval->i = 0x10; return NUM; } --tcp-urg { yylval->i = 0x20; return NUM; } --tcp-ece { yylval->i = 0x40; return NUM; } --tcp-cwr { yylval->i = 0x80; return NUM; } -+icmptype { yylval->h = 0; return NUM; } -+icmpcode { yylval->h = 1; return NUM; } -+icmp-echoreply { yylval->h = 0; return NUM; } -+icmp-unreach { yylval->h = 3; return NUM; } -+icmp-sourcequench { yylval->h = 4; return NUM; } -+icmp-redirect { yylval->h = 5; return NUM; } -+icmp-echo { yylval->h = 8; return NUM; } -+icmp-routeradvert { yylval->h = 9; return NUM; } -+icmp-routersolicit { yylval->h = 10; return NUM; } -+icmp-timxceed { yylval->h = 11; return NUM; } -+icmp-paramprob { yylval->h = 12; return NUM; } -+icmp-tstamp { yylval->h = 13; return NUM; } -+icmp-tstampreply { yylval->h = 14; return NUM; } -+icmp-ireq { yylval->h = 15; return NUM; } -+icmp-ireqreply { yylval->h = 16; return NUM; } -+icmp-maskreq { yylval->h = 17; return NUM; } -+icmp-maskreply { yylval->h = 18; return NUM; } -+ -+icmp6type { yylval->h = 0; return NUM; } -+icmp6code { yylval->h = 1; return NUM; } -+ -+icmp6-echo { yylval->h = 128; return NUM; } -+icmp6-echoreply { yylval->h = 129; return NUM; } -+icmp6-multicastlistenerquery { yylval->h = 130; return NUM; } -+icmp6-multicastlistenerreportv1 { yylval->h = 131; return NUM; } -+icmp6-multicastlistenerdone { yylval->h = 132; return NUM; } -+icmp6-routersolicit { yylval->h = 133; return NUM; } -+icmp6-routeradvert { yylval->h = 134; return NUM; } -+icmp6-neighborsolicit { yylval->h = 135; return NUM; } -+icmp6-neighboradvert { yylval->h = 136; return NUM; } -+icmp6-redirect { yylval->h = 137; return NUM; } -+icmp6-routerrenum { yylval->h = 138; return NUM; } -+icmp6-nodeinformationquery { yylval->h = 139; return NUM; } -+icmp6-nodeinformationresponse { yylval->h = 140; return NUM; } -+icmp6-ineighbordiscoverysolicit { yylval->h = 141; return NUM; } -+icmp6-ineighbordiscoveryadvert { yylval->h = 142; return NUM; } -+icmp6-multicastlistenerreportv2 { yylval->h = 143; return NUM; } -+icmp6-homeagentdiscoveryrequest { yylval->h = 144; return NUM; } -+icmp6-homeagentdiscoveryreply { yylval->h = 145; return NUM; } -+icmp6-mobileprefixsolicit { yylval->h = 146; return NUM; } -+icmp6-mobileprefixadvert { yylval->h = 147; return NUM; } -+icmp6-certpathsolicit { yylval->h = 148; return NUM; } -+icmp6-certpathadvert { yylval->h = 149; return NUM; } -+icmp6-multicastrouteradvert { yylval->h = 151; return NUM; } -+icmp6-multicastroutersolicit { yylval->h = 152; return NUM; } -+icmp6-multicastrouterterm { yylval->h = 153; return NUM; } -+ -+tcpflags { yylval->h = 13; return NUM; } -+tcp-fin { yylval->h = 0x01; return NUM; } -+tcp-syn { yylval->h = 0x02; return NUM; } -+tcp-rst { yylval->h = 0x04; return NUM; } -+tcp-push { yylval->h = 0x08; return NUM; } -+tcp-ack { yylval->h = 0x10; return NUM; } -+tcp-urg { yylval->h = 0x20; return NUM; } -+tcp-ece { yylval->h = 0x40; return NUM; } -+tcp-cwr { yylval->h = 0x80; return NUM; } - [A-Za-z0-9]([-_.A-Za-z0-9]*[.A-Za-z0-9])? { - yylval->s = sdup(yyextra, (char *)yytext); return ID; } - "\\"[^ !()\n\t]+ { yylval->s = sdup(yyextra, (char *)yytext + 1); return ID; } -@@ -483,40 +482,110 @@ tcp-cwr { yylval->i = 0x80; return NUM; } - */ - DIAG_ON_FLEX - --/* Hex digit to integer. */ --static inline int --xdtoi(int c) --{ -- if (isdigit(c)) -- return c - '0'; -- else if (islower(c)) -- return c - 'a' + 10; -- else -- return c - 'A' + 10; --} -- - /* -- * Convert string to integer. Just like atoi(), but checks for -+ * Convert string to 32-bit unsigned integer. Just like atoi(), but checks for - * preceding 0x or 0 and uses hex or octal instead of decimal. -+ * -+ * On success, sets yylval->h to the value and returns NUM. -+ * On failure, sets the BPF error string and returns LEX_ERROR, to force -+ * the parse to stop. - */ - static int --stoi(char *s) -+stou(char *yytext_arg, YYSTYPE *yylval_arg, compiler_state_t *yyextra_arg) - { -- int base = 10; -- int n = 0; -- -+ bpf_u_int32 n = 0; -+ unsigned int digit; -+ char *s = yytext_arg; -+ -+ /* -+ * yytext_arg is guaranteed either to be a string of decimal digits -+ * or 0[xX] followed by a string of hex digits. -+ */ - if (*s == '0') { - if (s[1] == 'x' || s[1] == 'X') { -- s += 2; -- base = 16; -- } -- else { -- base = 8; -+ /* -+ * Begins with 0x or 0X, so hex. -+ * Guaranteed to be all hex digits following the -+ * prefix, so anything that's not 0-9 or a-f is -+ * A-F. -+ */ -+ s += 2; /* skip the prefix */ -+ while ((digit = *s++) != '\0') { -+ if (digit >= '0' && digit <= '9') -+ digit = digit - '0'; -+ else if (digit >= 'a' && digit <= 'f') -+ digit = digit - 'a' + 10; -+ else -+ digit = digit - 'A' + 10; -+ -+ /* -+ * Check for overflow. -+ */ -+ if (n > 0xFFFFFFFU) { -+ /* -+ * We have more than 28 bits of -+ * number, and are about to -+ * add 4 more; that won't fit -+ * in 32 bits. -+ */ -+ bpf_set_error(yyextra_arg, -+ "number %s overflows 32 bits", -+ yytext_arg); -+ return LEX_ERROR; -+ } -+ n = (n << 4) + digit; -+ } -+ } else { -+ /* -+ * Begins with 0, but not 0x or 0X, so octal. -+ * Guaranteed to be all *decimal* digits following -+ * the prefix, so we need to catch 8 and 9 and -+ * report an error. -+ */ - s += 1; -+ while ((digit = *s++) != '\0') { -+ if (digit >= '0' && digit <= '7') -+ digit = digit - '0'; -+ else { -+ bpf_set_error(yyextra_arg, -+ "number %s contains non-octal digit", -+ yytext_arg); -+ return LEX_ERROR; -+ } -+ if (n > 03777777777U) { -+ /* -+ * We have more than 29 bits of -+ * number, and are about to add -+ * 3 more; that won't fit in -+ * 32 bits. -+ */ -+ bpf_set_error(yyextra_arg, -+ "number %s overflows 32 bits", -+ yytext_arg); -+ return LEX_ERROR; -+ } -+ n = (n << 3) + digit; -+ } -+ } -+ } else { -+ /* -+ * Decimal. -+ */ -+ while ((digit = *s++) != '\0') { -+ digit = digit - '0'; -+#define CUTOFF_DEC (0xFFFFFFFFU / 10U) -+#define CUTLIM_DEC (0xFFFFFFFFU % 10U) -+ if (n > CUTOFF_DEC || -+ (n == CUTOFF_DEC && digit > CUTLIM_DEC)) { -+ bpf_set_error(yyextra_arg, -+ "number %s overflows 32 bits", -+ yytext_arg); -+ return LEX_ERROR; -+ } -+ n = (n * 10) + digit; - } - } -- while (*s) -- n = n * base + xdtoi(*s++); - -- return n; -+ yylval_arg->h = n; -+ return NUM; - } --- -2.19.1 diff --git a/fix-optimize-add-a-bunch-of-overflow-checks.patch b/fix-optimize-add-a-bunch-of-overflow-checks.patch deleted file mode 100644 index 9c56c81d38c16ed1f12abf4103cc4290c88f46d0..0000000000000000000000000000000000000000 --- a/fix-optimize-add-a-bunch-of-overflow-checks.patch +++ /dev/null @@ -1,169 +0,0 @@ -From 119b90af867f3073c571ee333fd47dcd0dbccd3a Mon Sep 17 00:00:00 2001 -From: Guy Harris -Date: Fri, 22 May 2020 01:20:45 -0700 -Subject: [PATCH] optimize: add a bunch of overflow checks. - -This should address GitHub issue #929; it picks up checks from GitHub -pull request #930, and adds some more. - -Also, make some more values unsigned. ---- - gencode.h | 4 +-- - optimize.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++------ - 2 files changed, 76 insertions(+), 10 deletions(-) - -diff --git a/gencode.h b/gencode.h -index dc099f5..053e85f 100644 ---- a/gencode.h -+++ b/gencode.h -@@ -240,7 +240,7 @@ typedef bpf_u_int32 *uset; - #define N_ATOMS (BPF_MEMWORDS+2) - - struct edge { -- int id; -+ u_int id; - int code; - uset edom; - struct block *succ; -@@ -254,7 +254,7 @@ struct edge { - }; - - struct block { -- int id; -+ u_int id; - struct slist *stmts; /* side effect stmts */ - struct stmt s; /* branch stmt */ - int mark; -diff --git a/optimize.c b/optimize.c -index 07fc0f3..18fbe70 100644 ---- a/optimize.c -+++ b/optimize.c -@@ -2457,13 +2459,19 @@ count_blocks(struct icode *ic, struct block *p) - static void - number_blks_r(opt_state_t *opt_state, struct icode *ic, struct block *p) - { -- int n; -+ u_int n; - - if (p == 0 || isMarked(ic, p)) - return; - - Mark(ic, p); - n = opt_state->n_blocks++; -+ if (opt_state->n_blocks == 0) { -+ /* -+ * Overflow. -+ */ -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } - p->id = n; - opt_state->blocks[n] = p; - -@@ -2511,6 +2519,8 @@ opt_init(opt_state_t *opt_state, struct icode *ic) - { - bpf_u_int32 *p; - int i, n, max_stmts; -+ u_int product; -+ size_t block_memsize, edge_memsize; - - /* - * First, count the blocks, so we can malloc an array to map -@@ -2526,6 +2536,12 @@ opt_init(opt_state_t *opt_state, struct icode *ic) - number_blks_r(opt_state, ic, ic->root); - - opt_state->n_edges = 2 * opt_state->n_blocks; -+ if ((opt_state->n_edges / 2) != opt_state->n_blocks) { -+ /* -+ * Overflow. -+ */ -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } - opt_state->edges = (struct edge **)calloc(opt_state->n_edges, sizeof(*opt_state->edges)); - if (opt_state->edges == NULL) { - opt_error(opt_state, "malloc"); -@@ -2542,9 +2558,59 @@ opt_init(opt_state_t *opt_state, struct icode *ic) - opt_state->edgewords = opt_state->n_edges / (8 * sizeof(bpf_u_int32)) + 1; - opt_state->nodewords = opt_state->n_blocks / (8 * sizeof(bpf_u_int32)) + 1; - -+ /* -+ * Make sure opt_state->n_blocks * opt_state->nodewords fits -+ * in a u_int; we use it as a u_int number-of-iterations -+ * value. -+ */ -+ product = opt_state->n_blocks * opt_state->nodewords; -+ if ((product / opt_state->n_blocks) != opt_state->nodewords) { -+ /* -+ * XXX - just punt and don't try to optimize? -+ * In practice, this is unlikely to happen with -+ * a normal filter. -+ */ -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } -+ -+ /* -+ * Make sure the total memory required for that doesn't -+ * overflow. -+ */ -+ block_memsize = (size_t)2 * product * sizeof(*opt_state->space); -+ if ((block_memsize / product) != 2 * sizeof(*opt_state->space)) { -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } -+ -+ /* -+ * Make sure opt_state->n_edges * opt_state->edgewords fits -+ * in a u_int; we use it as a u_int number-of-iterations -+ * value. -+ */ -+ product = opt_state->n_edges * opt_state->edgewords; -+ if ((product / opt_state->n_edges) != opt_state->edgewords) { -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } -+ -+ /* -+ * Make sure the total memory required for that doesn't -+ * overflow. -+ */ -+ edge_memsize = (size_t)product * sizeof(*opt_state->space); -+ if (edge_memsize / product != sizeof(*opt_state->space)) { -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } -+ -+ /* -+ * Make sure the total memory required for both of them dosn't -+ * overflow. -+ */ -+ if (block_memsize > SIZE_MAX - edge_memsize) { -+ opt_error(opt_state, "filter is too complex to optimize"); -+ } -+ - /* XXX */ -- opt_state->space = (bpf_u_int32 *)malloc(2 * opt_state->n_blocks * opt_state->nodewords * sizeof(*opt_state->space) -- + opt_state->n_edges * opt_state->edgewords * sizeof(*opt_state->space)); -+ opt_state->space = (bpf_u_int32 *)malloc(block_memsize + edge_memsize); - if (opt_state->space == NULL) { - opt_error(opt_state, "malloc"); - } -@@ -2920,7 +2986,7 @@ dot_dump_node(struct icode *ic, struct block *block, struct bpf_program *prog, - icount = slength(block->stmts) + 1 + block->longjt + block->longjf; - noffset = min(block->offset + icount, (int)prog->bf_len); - -- fprintf(out, "\tblock%d [shape=ellipse, id=\"block-%d\" label=\"BLOCK%d\\n", block->id, block->id, block->id); -+ fprintf(out, "\tblock%u [shape=ellipse, id=\"block-%u\" label=\"BLOCK%u\\n", block->id, block->id, block->id); - for (i = block->offset; i < noffset; i++) { - fprintf(out, "\\n%s", bpf_image(prog->bf_insns + i, i)); - } -@@ -2947,9 +3013,9 @@ dot_dump_edge(struct icode *ic, struct block *block, FILE *out) - Mark(ic, block); - - if (JT(block)) { -- fprintf(out, "\t\"block%d\":se -> \"block%d\":n [label=\"T\"]; \n", -+ fprintf(out, "\t\"block%u\":se -> \"block%u\":n [label=\"T\"]; \n", - block->id, JT(block)->id); -- fprintf(out, "\t\"block%d\":sw -> \"block%d\":n [label=\"F\"]; \n", -+ fprintf(out, "\t\"block%u\":sw -> \"block%u\":n [label=\"F\"]; \n", - block->id, JF(block)->id); - } - dot_dump_edge(ic, JT(block), out); --- -1.8.3.1 - diff --git a/libpcap-1.10.1.tar.gz b/libpcap-1.10.1.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..8833720642bbe78d8d86611242b8ab9c20572f3f Binary files /dev/null and b/libpcap-1.10.1.tar.gz differ diff --git a/libpcap-1.9.1.tar.gz b/libpcap-1.9.1.tar.gz deleted file mode 100644 index a052b0fb66f5218ed5114df3f5ee81969d6a2d07..0000000000000000000000000000000000000000 Binary files a/libpcap-1.9.1.tar.gz and /dev/null differ diff --git a/libpcap.spec b/libpcap.spec index 7f62b6283766987f4ac6976fdf24c42936d3f14f..c5ad807e8141a73935d5726b6ff04867bcb20797 100644 --- a/libpcap.spec +++ b/libpcap.spec @@ -1,21 +1,16 @@ Name: libpcap Epoch: 14 -Version: 1.9.1 -Release: 7 +Version: 1.10.1 +Release: 1 Summary: A system-independent interface for user-level packet capture License: BSD with advertising URL: http://www.tcpdump.org Source0: http://www.tcpdump.org/release/%{name}-%{version}.tar.gz Patch0: 0003-pcap-linux-apparently-ctc-interfaces-on-s390-has-eth.patch -Patch1: clean-up-signed-vs-unsigned-do-more-error-checking-in-the-parser.patch -Patch2: fix-optimize-add-a-bunch-of-overflow-checks.patch -Patch3: 0611-With-MSVC-abort-if-_BitScanForward-returns-0.patch -Patch4: 0875-optimize-make-some-variables-unsigned.patch -Patch5: 0876-optimize-fix-some-of-those-changes.patch -Patch6: pcap-config-mitigate-multilib-conflict.patch +Patch1: pcap-config-mitigate-multilib-conflict.patch -BuildRequires: bison bluez-libs-devel flex gcc git glibc-kernheaders >= 2.2.0 +BuildRequires: bison bluez-devel flex gcc git glibc-kernheaders >= 2.2.0 %description This is the official web site of tcpdump, a powerful command-line @@ -64,6 +59,12 @@ export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" %{_mandir}/man* %changelog +* Sat Dec 04 2021 xihaochen - 14:1.10.1-1 +- Type:requirements +- ID:NA +- SUG:NA +- DESC:update libpcap to 1.10.1 + * Sat Nov 28 2020 xiaqirong - 14:1.9.1-7 - Type:bugfix - ID:NA diff --git a/pcap-config-mitigate-multilib-conflict.patch b/pcap-config-mitigate-multilib-conflict.patch index 4ae580542061b2be04f3f622ccfa47e8c238630f..8b6b420ba3d66c58be121b4b8a95d12eb7c28d77 100644 --- a/pcap-config-mitigate-multilib-conflict.patch +++ b/pcap-config-mitigate-multilib-conflict.patch @@ -9,16 +9,15 @@ file. Hence remove libdir references from pcap-config, libdir is in dynamic linker path anyway. - --- pcap-config.in | 27 ++++++++------------------- 1 file changed, 8 insertions(+), 19 deletions(-) diff --git a/pcap-config.in b/pcap-config.in -index 54ca42f..830a6c7 100644 +index 206be3b..75f2c9f 100644 --- a/pcap-config.in +++ b/pcap-config.in -@@ -11,7 +11,6 @@ +@@ -7,7 +7,6 @@ prefix="@prefix@" exec_prefix="@exec_prefix@" includedir="@includedir@" @@ -26,7 +25,7 @@ index 54ca42f..830a6c7 100644 V_RPATH_OPT="@V_RPATH_OPT@" LIBS="@LIBS@" PACKAGE_NAME="@PACKAGE_NAME@" -@@ -41,16 +40,6 @@ do +@@ -36,16 +35,6 @@ do esac shift done @@ -43,45 +42,45 @@ index 54ca42f..830a6c7 100644 if [ "$static" = 1 ] then # -@@ -59,16 +48,16 @@ then +@@ -54,16 +43,16 @@ then # if [ "$show_cflags" = 1 -a "$show_libs" = 1 ] then - echo "-I$includedir -L$libdir -lpcap $LIBS" -+ echo "-lpcap @LIBS@" ++ echo "-lpcap @LIBS@" elif [ "$show_cflags" = 1 -a "$show_additional_libs" = 1 ] then - echo "-I$includedir -L$libdir $LIBS" -+ echo "@LIBS@" ++ echo "@LIBS@" elif [ "$show_cflags" = 1 ] then - echo "-I$includedir" -+ echo "" ++ echo "" elif [ "$show_libs" = 1 ] then - echo "-L$libdir -lpcap $LIBS" -+ echo "-lpcap @LIBS@" ++ echo "-lpcap @LIBS@" elif [ "$show_additional_libs" = 1 ] then echo "$LIBS" -@@ -80,15 +69,15 @@ else +@@ -75,15 +64,15 @@ else # if [ "$show_cflags" = 1 -a "$show_libs" = 1 ] then - echo "-I$includedir -L$libdir $RPATH -l$PACKAGE_NAME" -+ echo "-lpcap" ++ echo "-lpcap" elif [ "$show_cflags" = 1 -a "$show_additional_libs" = 1 ] then - echo "-I$includedir" -+ echo "" ++ echo "" elif [ "$show_cflags" = 1 ] then - echo "-I$includedir" -+ echo "" ++ echo "" elif [ "$show_libs" = 1 ] then - echo "-L$libdir $RPATH -l$PACKAGE_NAME" -+ echo "-lpcap" ++ echo "-lpcap" fi fi --