@@ -2134,8 +2134,7 @@ gen_ether_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto)
21342134 * DSAP, as we do for other types <= ETHERMTU
21352135 * (i.e., other SAP values)?
21362136 */
2137- b0 = gen_cmp_gt (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
2138- gen_not (b0 );
2137+ b0 = gen_cmp_le (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
21392138 b1 = gen_cmp (cstate , OR_LLC , 0 , BPF_H , (ll_proto << 8 ) | ll_proto );
21402139 gen_and (b0 , b1 );
21412140 return b1 ;
@@ -2188,8 +2187,7 @@ gen_ether_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto)
21882187 * Now we generate code to check for 802.3
21892188 * frames in general.
21902189 */
2191- b0 = gen_cmp_gt (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
2192- gen_not (b0 );
2190+ b0 = gen_cmp_le (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
21932191
21942192 /*
21952193 * Now add the check for 802.3 frames before the
@@ -2217,11 +2215,10 @@ gen_ether_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto)
22172215
22182216 /*
22192217 * Check for 802.2 encapsulation (EtherTalk phase 2?);
2220- * we check for an Ethernet type field less than
2218+ * we check for an Ethernet type field less or equal than
22212219 * 1500, which means it's an 802.3 length field.
22222220 */
2223- b0 = gen_cmp_gt (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
2224- gen_not (b0 );
2221+ b0 = gen_cmp_le (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
22252222
22262223 /*
22272224 * 802.2-encapsulated ETHERTYPE_ATALK packets are
@@ -2260,8 +2257,7 @@ gen_ether_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto)
22602257 * a length field, <= ETHERMTU) and
22612258 * then check the DSAP.
22622259 */
2263- b0 = gen_cmp_gt (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
2264- gen_not (b0 );
2260+ b0 = gen_cmp_le (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
22652261 b1 = gen_cmp (cstate , OR_LINKTYPE , 2 , BPF_B , ll_proto );
22662262 gen_and (b0 , b1 );
22672263 return b1 ;
@@ -3877,11 +3873,10 @@ gen_llc_internal(compiler_state_t *cstate)
38773873
38783874 case DLT_EN10MB :
38793875 /*
3880- * We check for an Ethernet type field less than
3876+ * We check for an Ethernet type field less or equal than
38813877 * 1500, which means it's an 802.3 length field.
38823878 */
3883- b0 = gen_cmp_gt (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
3884- gen_not (b0 );
3879+ b0 = gen_cmp_le (cstate , OR_LINKTYPE , 0 , BPF_H , ETHERMTU );
38853880
38863881 /*
38873882 * Now check for the purported DSAP and SSAP not being
0 commit comments