D55578.id.diff
No OneTemporary
Actions

Size

179 KB

Referenced Files

None

Subscribers

None

D55578.id.diff
View Options

	diff --git a/contrib/tcpdump/CHANGES b/contrib/tcpdump/CHANGES
	--- a/contrib/tcpdump/CHANGES
	+++ b/contrib/tcpdump/CHANGES
	@@ -1,3 +1,76 @@
	+Tuesday, December 30, 2025 / The Tcpdump Group
	+ Summary for 4.99.6 tcpdump release
	+ Remove protocol decoding for:
	+ OTV (draft-hasmit-otv-04, this Internet-Draft is no longer active).
	+ Refine protocol decoding for:
	+ DNS: Use ND_TCHECK_LEN() instead of a custom bounds check.
	+ IPv6: Add a missing comma and remove a colon in the output.
	+ TCP: Note if the Urgent Pointer is non-zero while URG flag not set,
	+ if the verbose level is > 1 (option -vv and more).
	+ TCP: Note if the Acknowledgment Number is non-zero while ACK flag not set,
	+ if the verbose level is > 1 (option -vv and more).
	+ TCP: Fix Reset segment processing.
	+ IP, IPv6: Fix setting the snapshot length for the payload.
	+ IP: Use ND_TTEST_LEN() instead of a custom bounds check.
	+ frag6: Add a bounds check in non-verbose mode.
	+ PTP: Remove spaces before colons in output.
	+ PTP: Fix management packet fields.
	+ ISO: Avoid undefined behavior and integer overflow in the Fletcher
	+ checksum calculation.
	+ NFS: Delete dead code.
	+ BOOTP: Use an uint16_t variable to get the result of a GET_BE_U_2().
	+ ZEP: use the existing NTP time formatting code.
	+ NTP: Fix p_ntp_time_fmt() using epoch 1/epoch 2 convention (RFC 4330).
	+ NTP: Update a field name with the RFC 5905 name (Origin Timestamp).
	+ IPv6 mobility: Modernize packet parsing and make fixes.
	+ IP6OPTS: Modernize packet parsing and make fixes.
	+ VXLAN: Add UDP port 8472 used by Linux as the default port.
	+ EGP: Replace custom code with tok2str(); Modernize packet parsing and
	+ fix printing with -v option.
	+ User interface:
	+ Add optional unit suffix on -C file size.
	+ Improve the handling of size suffixes for -C.
	+ Print errors for options -A, -x[x] and -X[X] (mutually exclusive).
	+ Print errors about -C, -G and -z options usage.
	+ For PCAP_ERROR_CAPTURE_NOTSUP, show the error message provided
	+ by libpcap for that error if it's non-empty.
	+ Update the -z option processing. Print "invalid option -- z" when it is.
	+ Add the -g option, causing IPv4 output in verbose mode to be on one line.
	+ Other:
	+ Avoid race condition when receiving signal during shutdown.
	+ Always show the interface name in error messages when the
	+ interface can't be opened.
	+ Clean up the message shown if a -i flag is specified with an
	+ interface index that's too large.
	+ Source code:
	+ Fix '-tt' option printing when time > 2106-02-07T06:28:15Z.
	+ Add sub-second packet timestamp checks for invalid micro/nano.
	+ Remove unused missing/snprintf.c.
	+ Fix incompatible pointer types with time functions calls on Windows.
	+ Use C99 macros to define 64-bit constants and maximum 64-bit values.
	+ Windows:
	+ Fixed to find wpcap.dll if WinPcap isn't installed and Npcap was
	+ installed without the WinPcap API compatibility option. (GitHub
	+ issue #1226).
	+ Building and testing:
	+ Makefile.in: Use a local libpcap in the releasecheck target.
	+ CMake: Fix build with CMake 3.31.
	+ autotools, CMake: don't separately test whether snprintf(3) is
	+ available and whether it's suitable - the test for whether it's
	+ suitable also fails if it's unavailable.
	+ CMake: Skip snprintf(3) tests when cross-compiling.
	+ autotools, CMake: fix issues with snprintf test and sanitizers.
	+ CMake: check whether check_c_source_runs() works, treat the build
	+ as a cross-compile if it doesn't work.
	+ Autoconf: Use AC_SYS_YEAR2038_RECOMMENDED when possible if the
	+ environment variable BUILD_YEAR2038 = yes (via autogen.sh).
	+ Autoconf: Avoid incorrectly include the libpcap's config.h.
	+ Autoconf: Refine reporting of os-proto.h.
	+ Require config.h to be from the tcpdump build.
	+ AppVeyor: Update Npcap SDK to 1.15.
	+ autogen.sh: Allow to configure Autoconf warnings.
	+ autogen.sh: Delete all trailing blank lines at end of configure.
	+
	Friday, August 30, 2024 / The Tcpdump Group
	Summary for 4.99.5 tcpdump release
	Refine protocol decoding for:
	@@ -38,7 +111,7 @@
	OSPF: Pad TLVs in LS_OPAQUE_TYPE_RI to multiples of 4 bytes.
	OSPF: Update LS-Ack printing not to run off the end of the packet.
	OSPF6: Fix an undefined behavior.
	- pflog: use nd_ types in struct pfloghdr.
	+ pflog: Use nd_ types in struct pfloghdr.
	PPP: Check if there is some data to hexdump.
	PPP: Remove an extra colon before LCP Callback Operation.
	Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397;
	@@ -122,6 +195,7 @@
	Make various improvements to the man page.
	Add initial README file for Haiku.
	Make various improvements to CONTRIBUTING.md.
	+ man: Clarify the "any" pseudo-interface further.

	Friday, April 7, 2023 / The Tcpdump Group
	Summary for 4.99.4 tcpdump release
	@@ -179,7 +253,7 @@
	802.11: Fetch the CF and TIM IEs a field at a time.
	802.15.4, BGP, LISP: fix some length checks, compiler warnings,
	and undefined behavior warnings.
	- PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
	+ PFLOG: Handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
	OSes.
	RRCP: support more Realtek protocols than just RRCP.
	MPLS: show the EXP field as TC, as per RFC 5462.
	diff --git a/contrib/tcpdump/CMakeLists.txt b/contrib/tcpdump/CMakeLists.txt
	--- a/contrib/tcpdump/CMakeLists.txt
	+++ b/contrib/tcpdump/CMakeLists.txt
	@@ -13,14 +13,21 @@
	# on a "long-term support" version # of some OS and that
	# version supplies an older version of CMake;
	#
	- # otherwise, require 3.5, so we don't get messages warning
	- # that support for versions of CMake lower than 3.5 is
	+ # otherwise, if it's a version less than 3.10, require only
	+ # 3.5, just in case somebody is configuring with CMake
	+ # on a "long-term support" version # of some OS and that
	+ # version supplies an older version of CMake;
	+ #
	+ # otherwise, require 3.10, so we don't get messages warning
	+ # that support for versions of CMake lower than 3.10 is
	# deprecated.
	#
	if(CMAKE_VERSION VERSION_LESS "3.5")
	cmake_minimum_required(VERSION 2.8.12)
	- else()
	+ elseif(CMAKE_VERSION VERSION_LESS "3.10")
	cmake_minimum_required(VERSION 3.5)
	+ else()
	+ cmake_minimum_required(VERSION 3.10)
	endif()
	endif(WIN32)

	@@ -392,6 +399,35 @@
	endif (USE_STATIC_RT)
	endif(MSVC)

	+#
	+# CMake's definition of "cross-compiling" appears to be "compiling
	+# for an operating system other than the one on which the build
	+# is being done*.
	+#
	+# This is an inadequate definition, as people build for the same
	+# operating system but a different instruction set, e.g. building
	+# on an IA-32 or x86-64 Linux box for an Arm embedded Linux box,
	+# or building Arm code on an IA-32 or x86-64 Windows box.
	+#
	+# So just test whether check_c_source_runs() on a trivial program
	+# works; if not, it's probably because the generated code won't
	+# run on the platform on which we're running.
	+#
	+include(CheckCSourceRuns)
	+if (NOT CMAKE_CROSSCOMPILING)
	+ check_c_source_runs("
	+ int main()
	+ {
	+ return 0;
	+ }
	+ "
	+ CHECK_C_SOURCE_RUNS_WORKS
	+ )
	+ if (NOT CHECK_C_SOURCE_RUNS_WORKS)
	+ set(CMAKE_CROSSCOMPILING TRUE)
	+ endif()
	+endif()
	+
	###################################################################
	# Detect available platform features
	###################################################################
	@@ -407,11 +443,16 @@
	include(CheckTypeSize)

	#
	-# Get the size of a time_t, to know whether it's 32-bit or 64-bit.
	+# Get the size of a time_t, to know whether it's 32-bit or 64-bit. Print it.
	#
	cmake_push_check_state()
	set(CMAKE_EXTRA_INCLUDE_FILES time.h)
	check_type_size("time_t" SIZEOF_TIME_T)
	+if(SIZEOF_TIME_T EQUAL 4)
	+ message(STATUS "32-bit time_t")
	+elseif(SIZEOF_TIME_T EQUAL 8)
	+ message(STATUS "64-bit time_t")
	+endif()
	cmake_pop_check_state()

	#
	@@ -493,67 +534,77 @@
	endif(STDLIBS_HAVE_GETSERVENT)
	cmake_pop_check_state()

	-#
	-# Make sure we have snprintf(); we require it.
	-# We use check_symbol_exists(), as it isn't necessarily an external
	-# function - in Visual Studio, for example, it is an inline function
	-# calling an external function.
	-#
	-check_symbol_exists(snprintf "stdio.h" HAVE_SNPRINTF)
	-if(NOT HAVE_SNPRINTF)
	- message(FATAL_ERROR "snprintf() is required but wasn't found")
	-endif()
	-
	-#
	-# Require a proof of suitable snprintf(3), same as in Autoconf.
	-#
	-include(CheckCSourceRuns)
	-check_c_source_runs("
	-#include <stdio.h>
	-#include <string.h>
	-#include <inttypes.h>
	-#include <sys/types.h>
	-
	-int main()
	-{
	- char buf[100];
	- uint64_t t = (uint64_t)1 << 32;
	-
	- snprintf(buf, sizeof(buf), \"%zu\", sizeof(buf));
	- if (strncmp(buf, \"100\", sizeof(buf)))
	- return 1;
	-
	- snprintf(buf, sizeof(buf), \"%zd\", -sizeof(buf));
	- if (strncmp(buf, \"-100\", sizeof(buf)))
	- return 2;
	-
	- snprintf(buf, sizeof(buf), \"%\" PRId64, -t);
	- if (strncmp(buf, \"-4294967296\", sizeof(buf)))
	- return 3;
	-
	- snprintf(buf, sizeof(buf), \"0o%\" PRIo64, t);
	- if (strncmp(buf, \"0o40000000000\", sizeof(buf)))
	- return 4;
	-
	- snprintf(buf, sizeof(buf), \"0x%\" PRIx64, t);
	- if (strncmp(buf, \"0x100000000\", sizeof(buf)))
	- return 5;
	-
	- snprintf(buf, sizeof(buf), \"%\" PRIu64, t);
	- if (strncmp(buf, \"4294967296\", sizeof(buf)))
	- return 6;
	-
	- return 0;
	-}
	-
	-"
	- SUITABLE_SNPRINTF
	-)
	-if(NOT SUITABLE_SNPRINTF)
	- message(FATAL_ERROR
	+if (NOT CMAKE_CROSSCOMPILING)
	+ #
	+ # Require a proof of suitable snprintf(3), same as in Autoconf.
	+ #
	+ check_c_source_runs("
	+ #include <stdio.h>
	+ #include <string.h>
	+ #include <inttypes.h>
	+ #include <sys/types.h>
	+
	+ #if defined(_WIN32) && !defined(_SSIZE_T_DEFINED)
	+ /*
	+ * On UN*Xes, this is a signed integer type of the same size as size_t.
	+ *
	+ * It's not defined by Visual Studio; we assume that ptrdiff_t will
	+ * be a type that is a signed integer type of the same size as size_t.
	+ */
	+ typedef ptrdiff_t ssize_t;
	+ #endif
	+
	+ /*
	+ * Avoid trying to cast negative values to unsigned types, or doing
	+ * shifts of signed types, in order not to have the test program fail
	+ * if we're building with undefined-behavior sanitizers enabled.
	+ */
	+ int main()
	+ {
	+ char buf[100];
	+ unsigned int ui = sizeof(buf);
	+ int i = sizeof(buf);
	+ int64_t i64 = INT64_C(0x100000000);
	+ uint64_t ui64 = UINT64_C(0x100000000);
	+
	+ snprintf(buf, sizeof(buf), \"%zu\", (size_t)ui);
	+ if (strncmp(buf, \"100\", sizeof(buf)))
	+ return 1;
	+
	+ snprintf(buf, sizeof(buf), \"%zd\", (ssize_t)(-i));
	+ if (strncmp(buf, \"-100\", sizeof(buf)))
	+ return 2;
	+
	+ snprintf(buf, sizeof(buf), \"%\" PRId64, -i64);
	+ if (strncmp(buf, \"-4294967296\", sizeof(buf)))
	+ return 3;
	+
	+ snprintf(buf, sizeof(buf), \"0o%\" PRIo64, ui64);
	+ if (strncmp(buf, \"0o40000000000\", sizeof(buf)))
	+ return 4;
	+
	+ snprintf(buf, sizeof(buf), \"0x%\" PRIx64, ui64);
	+ if (strncmp(buf, \"0x100000000\", sizeof(buf)))
	+ return 5;
	+
	+ snprintf(buf, sizeof(buf), \"%\" PRIu64, ui64);
	+ if (strncmp(buf, \"4294967296\", sizeof(buf)))
	+ return 6;
	+
	+ return 0;
	+ }
	+
	+ "
	+ SUITABLE_SNPRINTF
	+ )
	+ if(NOT SUITABLE_SNPRINTF)
	+ message(FATAL_ERROR
	"The snprintf(3) implementation in this libc is not suitable,
	tcpdump would not work correctly even if it managed to compile."
	- )
	+ )
	+ endif()
	+else()
	+ message(STATUS "Skipped SUITABLE_SNPRINTF because cross-compiling.")
	endif()

	check_function_exists(getopt_long HAVE_GETOPT_LONG)
	@@ -908,7 +959,7 @@
	# we should check for it, so that we can use it if it's present.
	#
	# So we check for pcap_open() and pcap_findalldevs_ex() if 1) this isn't
	-# macOS or 2) the the libpcap we found is not a system library, meaning
	+# macOS or 2) the libpcap we found is not a system library, meaning
	# that its path begins neither with /usr/lib (meaning it's a system
	# dylib) nor /Application/Xcode.app (meaning it's a file in
	# the Xcode SDK).
	@@ -1160,6 +1211,7 @@
	check_and_add_compiler_option(-Wall)
	check_and_add_compiler_option(-Wassign-enum)
	check_and_add_compiler_option(-Wcast-qual)
	+ check_and_add_compiler_option(-Wcomma)
	check_and_add_compiler_option(-Wmissing-prototypes)
	check_and_add_compiler_option(-Wmissing-variable-declarations)
	check_and_add_compiler_option(-Wold-style-definition)
	@@ -1331,7 +1383,6 @@
	print-openflow.c
	print-ospf.c
	print-ospf6.c
	- print-otv.c
	print-pflog.c
	print-pgm.c
	print-pim.c
	@@ -1496,6 +1547,9 @@
	if(NOT C_ADDITIONAL_FLAGS STREQUAL "")
	set_target_properties(tcpdump PROPERTIES COMPILE_FLAGS ${C_ADDITIONAL_FLAGS})
	endif()
	+if(NOT "${PCAP_LINK_FLAGS}" STREQUAL "")
	+ set_target_properties(tcpdump PROPERTIES LINK_FLAGS ${PCAP_LINK_FLAGS})
	+endif()
	target_link_libraries(tcpdump netdissect ${TCPDUMP_LINK_LIBRARIES})

	######################################
	@@ -1551,7 +1605,7 @@
	COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake)

	#
	-# Tcpdump tests
	+# tcpdump tests
	# We try to find the Perl interpreter and, if we do, we have the check
	# rule run tests/TESTrun with it, because just trying to run the TESTrun
	# script as a command won't work on Windows.
	diff --git a/contrib/tcpdump/CONTRIBUTING.md b/contrib/tcpdump/CONTRIBUTING.md
	--- a/contrib/tcpdump/CONTRIBUTING.md
	+++ b/contrib/tcpdump/CONTRIBUTING.md
	@@ -39,7 +39,7 @@
	1) Check that there isn't a pull request already opened for the changes you
	intend to make.

	-2) [Fork](https://help.github.com/articles/fork-a-repo/) the Tcpdump
	+2) [Fork](https://help.github.com/articles/fork-a-repo/) the tcpdump
	[repository](https://github.com/the-tcpdump-group/tcpdump).

	3) The easiest way to test your changes on multiple operating systems and
	diff --git a/contrib/tcpdump/INSTALL.md b/contrib/tcpdump/INSTALL.md
	--- a/contrib/tcpdump/INSTALL.md
	+++ b/contrib/tcpdump/INSTALL.md
	@@ -18,6 +18,10 @@
	run `./autogen.sh` (a shell script). The autogen.sh script will
	build the `configure` and `config.h.in` files.

	+* If you build on a Linux 32-bit system, with Autoconf version >= 2.72
	+and GNU C Library version >= 2.34, run `export BUILD_YEAR2038=yes`
	+before running `./autogen.sh` to build with 64-bit time_t (Y2038-safe).
	+
	On some system, you may need to set the `AUTORECONF` variable, like:
	`AUTORECONF=autoreconf-2.69 ./autogen.sh`
	to select the `autoreconf` version you want to use.
	diff --git a/contrib/tcpdump/Makefile.in b/contrib/tcpdump/Makefile.in
	--- a/contrib/tcpdump/Makefile.in
	+++ b/contrib/tcpdump/Makefile.in
	@@ -49,7 +49,7 @@

	# Standard CFLAGS
	CFLAGS = @CFLAGS@
	-FULL_CFLAGS = $(CCOPT) $(DEFS) $(INCLS) $(CFLAGS)
	+FULL_CFLAGS = $(INCLS) $(CCOPT) $(DEFS) $(CFLAGS)

	# Standard LDFLAGS
	LDFLAGS = @LDFLAGS@
	@@ -192,7 +192,6 @@
	print-openflow.c \
	print-ospf.c \
	print-ospf6.c \
	- print-otv.c \
	print-pflog.c \
	print-pgm.c \
	print-pim.c \
	@@ -373,7 +372,6 @@
	missing/getopt_long.h \
	missing/getservent.c \
	missing/pcap_dump_ftell.c \
	- missing/snprintf.c \
	missing/strdup.c \
	missing/strlcat.c \
	missing/strlcpy.c \
	@@ -409,8 +407,6 @@
	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/getservent.c
	getopt_long.o: $(srcdir)/missing/getopt_long.c
	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/getopt_long.c
	-snprintf.o: $(srcdir)/missing/snprintf.c
	- $(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/snprintf.c
	strdup.o: $(srcdir)/missing/strdup.c
	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/strdup.c
	strlcat.o: $(srcdir)/missing/strlcat.c
	@@ -504,7 +500,7 @@
	tar xf -) && \
	echo "No $$TAG tag. Archive build from HEAD."; \
	fi && \
	- (cd "$$TAG" && "$${AUTORECONF:-autoreconf}" && rm -rf autom4te.cache) && \
	+ (cd "$$TAG" && ./autogen.sh && rm -rf autom4te.cache) && \
	tar cf "$$DIR/$$TAG".tar "$$TAG" && \
	rm -f "$$DIR/$$TAG".tar.gz && \
	gzip --best "$$DIR/$$TAG".tar && \
	@@ -516,6 +512,22 @@
	INSTALL_DIR=/tmp/install_"$$TAG"_$$$$ && \
	DIR=`pwd` && \
	cd /tmp && \
	+ rm -rf libpcap && \
	+ rm -rf install_libpcap && \
	+ echo "[$@] $$ git clone [...] libpcap.git" && \
	+ git clone --depth 3 --quiet https://github.com/the-tcpdump-group/libpcap.git && \
	+ echo "[$@] $$ cd libpcap" && \
	+ cd libpcap && \
	+ echo "[$@] $$ ./autogen.sh" && \
	+ ./autogen.sh && \
	+ echo "[$@] $$ ./configure --quiet --prefix=/tmp/install_libpcap" && \
	+ ./configure --quiet --prefix=/tmp/install_libpcap && \
	+ echo "[$@] $$ make -s " && \
	+ make -s && \
	+ echo "[$@] $$ make -s install" && \
	+ make -s install && \
	+ echo "[$@] $$ cd .." && \
	+ cd .. && \
	rm -rf "$$TAG" && \
	rm -rf "$$INSTALL_DIR" && \
	tar xf "$$DIR"/"$$TAG".tar.gz && \
	@@ -537,6 +549,8 @@
	touch .devel && \
	mkdir build && \
	cd build && \
	+ echo "[$@] $$ export PKG_CONFIG_PATH=/tmp/install_libpcap/lib/pkgconfig" && \
	+ export PKG_CONFIG_PATH=/tmp/install_libpcap/lib/pkgconfig && \
	echo '[$@] $$ cmake -DENABLE_SMB=yes [...] ..' && \
	cmake -DENABLE_SMB=yes \
	-DCMAKE_INSTALL_PREFIX="$$INSTALL_DIR" \
	@@ -551,6 +565,8 @@
	cd ../.. && \
	rm -rf "$$TAG" && \
	rm -rf "$$INSTALL_DIR" && \
	+ rm -rf install_libpcap && \
	+ rm -rf libpcap && \
	echo '[$@] Done.'

	whitespacecheck:
	diff --git a/contrib/tcpdump/README.md b/contrib/tcpdump/README.md
	--- a/contrib/tcpdump/README.md
	+++ b/contrib/tcpdump/README.md
	@@ -40,7 +40,7 @@
	* Windows (requires WinPcap or Npcap, and Visual Studio with CMake)

	### Dependency on libpcap
	-Tcpdump uses libpcap, a system-independent interface for user-level
	+tcpdump uses libpcap, a system-independent interface for user-level
	packet capture. Before building tcpdump, you must first retrieve and
	build libpcap.

	diff --git a/contrib/tcpdump/VERSION b/contrib/tcpdump/VERSION
	--- a/contrib/tcpdump/VERSION
	+++ b/contrib/tcpdump/VERSION
	@@ -1 +1 @@
	-4.99.5
	+4.99.6
	diff --git a/contrib/tcpdump/addrtostr.c b/contrib/tcpdump/addrtostr.c
	--- a/contrib/tcpdump/addrtostr.c
	+++ b/contrib/tcpdump/addrtostr.c
	@@ -127,9 +127,11 @@
	cur.base = -1;
	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
	if (words[i] == 0) {
	- if (cur.base == -1)
	- cur.base = i, cur.len = 1;
	- else cur.len++;
	+ if (cur.base == -1) {
	+ cur.base = i;
	+ cur.len = 1;
	+ } else
	+ cur.len++;
	} else if (cur.base != -1) {
	if (best.base == -1 \|\| cur.len > best.len)
	best = cur;
	diff --git a/contrib/tcpdump/autogen.sh b/contrib/tcpdump/autogen.sh
	--- a/contrib/tcpdump/autogen.sh
	+++ b/contrib/tcpdump/autogen.sh
	@@ -1,6 +1,7 @@
	#!/bin/sh -e

	: "${AUTORECONF:=autoreconf}"
	+: "${BUILD_YEAR2038:=no}"

	AUTORECONFVERSION=`$AUTORECONF --version 2>&1 \| grep "^autoreconf" \| sed 's/.) //'`

	@@ -21,5 +22,43 @@
	exit 1
	fi

	+# On Linux, if Autoconf version >= 2.72 and GNU C Library version >= 2.34,
	+# s/AC_SYS_LARGEFILE/AC_SYS_YEAR2038_RECOMMENDED/ to ensure time_t
	+# is Y2038-safe.
	+if [ "$BUILD_YEAR2038" = yes ] && [ "`uname -s`" = Linux ]; then
	+ if [ "$maj" -gt 2 ] \|\| { [ "$maj" -eq 2 ] && [ "$min" -ge 72 ]; }; then
	+ GLIBC_VERSION=`ldd --version\|head -1\|grep GLIBC\|sed 's/.* //'`
	+ maj_glibc=`echo "$GLIBC_VERSION" \| cut -d. -f1`
	+ min_glibc=`echo "$GLIBC_VERSION" \| cut -d. -f2`
	+ echo "GNU C Library identification: $GLIBC_VERSION"
	+ if [ "$maj_glibc" -gt 2 ] \|\| { [ "$maj_glibc" -eq 2 ] && \
	+ [ "$min_glibc" -ge 34 ]; }; then
	+ CONFIGURE_AC_NEW="configure.ac.new$$"
	+ sed 's/^# $AC_SYS_YEAR2038_RECOMMENDED$/\1/' \
	+ <configure.ac >"$CONFIGURE_AC_NEW"
	+ cmp -s configure.ac "$CONFIGURE_AC_NEW" \|\| \
	+ cat "$CONFIGURE_AC_NEW" >configure.ac
	+ rm -f "$CONFIGURE_AC_NEW"
	+ echo 'Setup to ensure time_t is Y2038-safe.'
	+ fi
	+ fi
	+fi
	+
	echo "$AUTORECONF identification: $AUTORECONFVERSION"
	-"$AUTORECONF" -f
	+
	+# configure.ac is an Autoconf 2.69 file, but it works as expected even with
	+# Autoconf 2.72. However, in Autoconf versions 2.70 and later obsolete
	+# construct warnings are enabled by default, which adds varying (depending on
	+# the branch) amount of noise to the build matrix output, so provide a means
	+# to silence that.
	+env ${AUTOCONF_WARNINGS:+WARNINGS="$AUTOCONF_WARNINGS"} "$AUTORECONF" -f
	+
	+# Autoconf 2.71 adds a blank line after the final "exit 0" on Linux, but not
	+# on OpenBSD. Remove this difference to make it easier to compare the result
	+# of "make releasetar" across different platforms. From sed one-liners:
	+# "delete all trailing blank lines at end of file (works on all seds)". Don't
	+# use mktemp(1) because AIX does not have it.
	+CONFIGURE_NEW="configure.new$$"
	+sed -e :a -e '/^\n*$/{$d;N;ba' -e '}' <configure >"$CONFIGURE_NEW"
	+cmp -s configure "$CONFIGURE_NEW" \|\| cat "$CONFIGURE_NEW" >configure
	+rm -f "$CONFIGURE_NEW"
	diff --git a/contrib/tcpdump/checksum.c b/contrib/tcpdump/checksum.c
	--- a/contrib/tcpdump/checksum.c
	+++ b/contrib/tcpdump/checksum.c
	@@ -106,9 +106,9 @@

	int x;
	int y;
	- uint32_t mul;
	+ int32_t mul;
	uint32_t c0;
	- uint32_t c1;
	+ uint64_t c1;
	uint16_t checksum;
	int idx;

	@@ -134,21 +134,23 @@

	mul = (length - checksum_offset)*(c0);

	- x = mul - c0 - c1;
	- y = c1 - mul - 1;
	-
	- if ( y >= 0 ) y++;
	- if ( x < 0 ) x--;
	+ /*
	+ * Casting c0 and c1 here is guaranteed to be safe, because we know
	+ * they have values between 0 and 254 inclusive. These casts are
	+ * done to ensure that all of the arithmetic operations are
	+ * well-defined (i.e., not mixing signed and unsigned integers).
	+ */
	+ x = mul - (int)c0 - (int)c1;
	+ y = (int)c1 - mul;

	x %= 255;
	y %= 255;

	-
	- if (x == 0) x = 255;
	- if (y == 0) y = 255;
	+ if (x <= 0) x += 255;
	+ if (y <= 0) y += 255;

	y &= 0x00FF;
	- checksum = ((x << 8) \| y);
	+ checksum = (uint16_t)((x << 8) \| y);

	return checksum;
	}
	diff --git a/contrib/tcpdump/cmake/Modules/FindPCAP.cmake b/contrib/tcpdump/cmake/Modules/FindPCAP.cmake
	--- a/contrib/tcpdump/cmake/Modules/FindPCAP.cmake
	+++ b/contrib/tcpdump/cmake/Modules/FindPCAP.cmake
	@@ -61,6 +61,42 @@
	if(PCAP_FOUND)
	set(PCAP_LIBRARIES ${PCAP_LIBRARY})
	set(PCAP_INCLUDE_DIRS ${PCAP_INCLUDE_DIR})
	+
	+ #
	+ # We need to look for wpcap.dll in \Windows\System32\Npcap first,
	+ # as either:
	+ #
	+ # 1) WinPcap isn't installed and Npcap isn't installed in "WinPcap
	+ # API-compatible Mode", so there's no wpcap.dll in
	+ # \Windows\System32, only in \Windows\System32\Npcap;
	+ #
	+ # 2) WinPcap is installed and Npcap isn't installed in "WinPcap
	+ # API-compatible Mode", so the wpcap.dll in \Windows\System32
	+ # is a WinPcap DLL, but we'd prefer an Npcap DLL (we should
	+ # work with either one if we're configured against WinPcap,
	+ # and we'll probably require Npcap if we're configured against
	+ # it), and that's in \Windows\System32\Npcap;
	+ #
	+ # 3) Npcap is installed in "WinPcap API-compatible Mode", so both
	+ # \Windows\System32 and \Windows\System32\Npcap have an Npcap
	+ # wpcap.dll.
	+ #
	+ # Unfortunately, Windows has no notion of an rpath, so we can't
	+ # set the rpath to include \Windows\System32\Npcap at link time;
	+ # what we need to do is to link wpcap as a delay-load DLL and
	+ # add \Windows\System32\Npcap to the DLL search path early in
	+ # main() with a call to SetDllDirectory().
	+ #
	+ # We add /delayload:wpcap.dll to the linker options here.
	+ #
	+ # See https://npcap.com/guide/npcap-devguide.html#npcap-feature-native-dll-implicitly
	+ #
	+ set(PCAP_LINK_FLAGS /delayload:wpcap.dll)
	+
	+ #
	+ # Delay-loading libraries means we need to link with delayimp.lib.
	+ #
	+ set(PCAP_LIBRARIES ${PCAP_LIBRARIES} delayimp.lib)
	endif()
	else(WIN32)
	#
	diff --git a/contrib/tcpdump/cmakeconfig.h.in b/contrib/tcpdump/cmakeconfig.h.in
	--- a/contrib/tcpdump/cmakeconfig.h.in
	+++ b/contrib/tcpdump/cmakeconfig.h.in
	@@ -1,5 +1,8 @@
	/* cmakeconfig.h.in */

	+#ifndef TCPDUMP_CONFIG_H_
	+#define TCPDUMP_CONFIG_H_
	+
	/* Define to 1 if arpa/inet.h declares `ether_ntohost' */
	#cmakedefine ARPA_INET_H_DECLARES_ETHER_NTOHOST 1

	@@ -288,3 +291,5 @@
	/* Define to the type of an unsigned integer type wide enough to hold a
	pointer, if such a type exists, and if the system does not define it. */
	#cmakedefine uintptr_t 1
	+
	+#endif // TCPDUMP_CONFIG_H_
	diff --git a/contrib/tcpdump/config.h.in b/contrib/tcpdump/config.h.in
	--- a/contrib/tcpdump/config.h.in
	+++ b/contrib/tcpdump/config.h.in
	@@ -1,5 +1,10 @@
	/* config.h.in. Generated from configure.ac by autoheader. */

	+
	+#ifndef TCPDUMP_CONFIG_H_
	+#define TCPDUMP_CONFIG_H_
	+
	+
	/* Define to 1 if arpa/inet.h declares `ether_ntohost' */
	#undef ARPA_INET_H_DECLARES_ETHER_NTOHOST

	@@ -75,7 +80,7 @@
	/* define if the OS provides AF_INET6 and struct in6_addr */
	#undef HAVE_OS_IPV6_SUPPORT

	-/* if there's an os_proto.h for this platform, to use additional prototypes */
	+/* if there's an os-proto.h for this platform, to use additional prototypes */
	#undef HAVE_OS_PROTO_H

	/* Define to 1 if you have the `pcap_breakloop' function. */
	@@ -287,3 +292,7 @@
	/* Define to the type of an unsigned integer type wide enough to hold a
	pointer, if such a type exists, and if the system does not define it. */
	#undef uintptr_t
	+
	+
	+#endif // TCPDUMP_CONFIG_H_
	+
	diff --git a/contrib/tcpdump/configure b/contrib/tcpdump/configure
	--- a/contrib/tcpdump/configure
	+++ b/contrib/tcpdump/configure
	@@ -1,6 +1,6 @@
	#! /bin/sh
	# Guess values for system-dependent variables and create Makefiles.
	-# Generated by GNU Autoconf 2.71 for tcpdump 4.99.5.
	+# Generated by GNU Autoconf 2.71 for tcpdump 4.99.6.
	#
	#
	# Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation,
	@@ -608,8 +608,8 @@
	# Identity of this package.
	PACKAGE_NAME='tcpdump'
	PACKAGE_TARNAME='tcpdump'
	-PACKAGE_VERSION='4.99.5'
	-PACKAGE_STRING='tcpdump 4.99.5'
	+PACKAGE_VERSION='4.99.6'
	+PACKAGE_STRING='tcpdump 4.99.6'
	PACKAGE_BUGREPORT=''
	PACKAGE_URL=''

	@@ -1306,7 +1306,7 @@
	# Omit some internal or obsolete options to make the list less imposing.
	# This message is too long to be a string in the A/UX 3.1 sh.
	cat <<_ACEOF
	-\`configure' configures tcpdump 4.99.5 to adapt to many kinds of systems.
	+\`configure' configures tcpdump 4.99.6 to adapt to many kinds of systems.

	Usage: $0 [OPTION]... [VAR=VALUE]...

	@@ -1372,7 +1372,7 @@

	if test -n "$ac_init_help"; then
	case $ac_init_help in
	- short \| recursive ) echo "Configuration of tcpdump 4.99.5:";;
	+ short \| recursive ) echo "Configuration of tcpdump 4.99.6:";;
	esac
	cat <<\_ACEOF

	@@ -1489,7 +1489,7 @@
	test -n "$ac_init_help" && exit $ac_status
	if $ac_init_version; then
	cat <<\_ACEOF
	-tcpdump configure 4.99.5
	+tcpdump configure 4.99.6
	generated by GNU Autoconf 2.71

	Copyright (C) 2021 Free Software Foundation, Inc.
	@@ -2086,7 +2086,7 @@
	This file contains any messages produced by compilers while
	running configure, to aid debugging if configure makes a mistake.

	-It was created by tcpdump $as_me 4.99.5, which was
	+It was created by tcpdump $as_me 4.99.6, which was
	generated by GNU Autoconf 2.71. Invocation command line was

	$ $0$ac_configure_args_raw
	@@ -4248,6 +4248,11 @@

	fi

	+
	+# On Linux, if Autoconf version >= 2.72 and GNU C Library version >= 2.34,
	+# uncomment AC_SYS_YEAR2038_RECOMMENDED to ensure time_t is Y2038-safe.
	+# (Can be done by autogen.sh)
	+# AC_SYS_YEAR2038_RECOMMENDED
	#
	# Get the size of a void *, to know whether this is a 32-bit or 64-bit build.
	#
	@@ -5838,18 +5843,6 @@
	fi


	-#
	-# Make sure we have snprintf(); we require it.
	-#
	-ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf"
	-if test "x$ac_cv_func_snprintf" = xyes
	-then :
	-
	-else $as_nop
	- as_fn_error $? "snprintf() is required but wasn't found" "$LINENO" 5
	-fi
	-
	-
	#
	# It became apparent at some point that using a suitable C99 compiler does not
	# automatically mean snprintf(3) implementation in the libc supports all the
	@@ -5883,32 +5876,50 @@
	#include <inttypes.h>
	#include <sys/types.h>

	+#if defined(_WIN32) && !defined(_SSIZE_T_DEFINED)
	+/*
	+ * On UN*Xes, this is a signed integer type of the same size as size_t.
	+ *
	+ * It's not defined by Visual Studio; we assume that ptrdiff_t will
	+ * be a type that is a signed integer type of the same size as size_t.
	+ */
	+typedef ptrdiff_t ssize_t;
	+#endif
	+
	+/*
	+ * Avoid trying to cast negative values to unsigned types, or doing
	+ * shifts of signed types, in order not to have the test program fail
	+ * if we're building with undefined-behavior sanitizers enabled.
	+ */
	int main()
	{
	char buf[100];
	- uint64_t t = (uint64_t)1 << 32;
	+ unsigned int ui = sizeof(buf);
	+ int i = sizeof(buf);
	+ int64_t i64 = INT64_C(0x100000000);
	+ uint64_t ui64 = UINT64_C(0x100000000);

	- snprintf(buf, sizeof(buf), "%zu", sizeof(buf));
	+ snprintf(buf, sizeof(buf), "%zu", (size_t)ui);
	if (strncmp(buf, "100", sizeof(buf)))
	return 1;

	- snprintf(buf, sizeof(buf), "%zd", -sizeof(buf));
	+ snprintf(buf, sizeof(buf), "%zd", (ssize_t)(-i));
	if (strncmp(buf, "-100", sizeof(buf)))
	return 2;

	- snprintf(buf, sizeof(buf), "%" PRId64, -t);
	+ snprintf(buf, sizeof(buf), "%" PRId64, -i64);
	if (strncmp(buf, "-4294967296", sizeof(buf)))
	return 3;

	- snprintf(buf, sizeof(buf), "0o%" PRIo64, t);
	+ snprintf(buf, sizeof(buf), "0o%" PRIo64, ui64);
	if (strncmp(buf, "0o40000000000", sizeof(buf)))
	return 4;

	- snprintf(buf, sizeof(buf), "0x%" PRIx64, t);
	+ snprintf(buf, sizeof(buf), "0x%" PRIx64, ui64);
	if (strncmp(buf, "0x100000000", sizeof(buf)))
	return 5;

	- snprintf(buf, sizeof(buf), "%" PRIu64, t);
	+ snprintf(buf, sizeof(buf), "%" PRIu64, ui64);
	if (strncmp(buf, "4294967296", sizeof(buf)))
	return 6;

	@@ -7845,6 +7856,11 @@


	rm -f os-proto.h
	+ #
	+ # MKDEP defaults to no-op (":") if we don't test whether the compiler
	+ # supports generating dependencies
	+ #
	+ MKDEP=:
	if test "${LBL_CFLAGS+set}" = set; then
	V_CCOPT="$V_CCOPT ${LBL_CFLAGS}"
	fi
	@@ -8066,6 +8082,59 @@
	ac_c_werror_flag="$save_ac_c_werror_flag"


	+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports the -Wcomma option" >&5
	+printf %s "checking whether the compiler supports the -Wcomma option... " >&6; }
	+ save_CFLAGS="$CFLAGS"
	+ CFLAGS="$CFLAGS -Wcomma"
	+ #
	+ # XXX - yes, this depends on the way AC_LANG_WERROR works,
	+ # but no mechanism is provided to turn AC_LANG_WERROR on
	+ # and then turn it back off, so that we only do it when
	+ # testing compiler options - 15 years after somebody asked
	+ # for it:
	+ #
	+ # https://autoconf.gnu.narkive.com/gTAVmfKD/how-to-cancel-flags-set-by-ac-lang-werror
	+ #
	+ save_ac_c_werror_flag="$ac_c_werror_flag"
	+ ac_c_werror_flag=yes
	+ #
	+ # We use AC_LANG_SOURCE() so that we can control the complete
	+ # content of the program being compiled. We do not, for example,
	+ # want the default "int main()" that AC_LANG_PROGRAM() generates,
	+ # as it will generate a warning with -Wold-style-definition, meaning
	+ # that we would treat it as not working, as the test will fail if
	+ # any error output, including a warning due to the flag we're
	+ # testing, is generated; see
	+ #
	+ # https://www.postgresql.org/message-id/2192993.1591682589%40sss.pgh.pa.us
	+ # https://www.postgresql.org/message-id/2192993.1591682589%40sss.pgh.pa.us
	+ #
	+ # This may, as per those two messages, be fixed in autoconf 2.70,
	+ # but we only require 2.69 or newer for now.
	+ #
	+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	+/* end confdefs.h. */
	+int main(void) { return 0; }
	+_ACEOF
	+if ac_fn_c_try_compile "$LINENO"
	+then :
	+
	+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	+printf "%s\n" "yes" >&6; }
	+ CFLAGS="$save_CFLAGS"
	+ V_CCOPT="$V_CCOPT -Wcomma"
	+
	+else $as_nop
	+
	+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
	+printf "%s\n" "no" >&6; }
	+ CFLAGS="$save_CFLAGS"
	+
	+fi
	+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
	+ ac_c_werror_flag="$save_ac_c_werror_flag"
	+
	+
	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports the -Wmissing-prototypes option" >&5
	printf %s "checking whether the compiler supports the -Wmissing-prototypes option... " >&6; }
	save_CFLAGS="$CFLAGS"
	@@ -9024,16 +9093,20 @@
	# .devel file; why should the ABI for which we produce code
	# depend on .devel?
	#
	+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to use an os-proto.h header" >&5
	+printf %s "checking whether to use an os-proto.h header... " >&6; }
	os=`echo $host_os \| sed -e 's/$[0-9][0-9]$[^0-9].$/\1/'`
	name="lbl/os-$os.h"
	if test -f $name ; then
	+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes, at \"$name\"" >&5
	+printf "%s\n" "yes, at \"$name\"" >&6; }
	ln -s $name os-proto.h

	printf "%s\n" "#define HAVE_OS_PROTO_H 1" >>confdefs.h

	else
	- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: can't find $name" >&5
	-printf "%s\n" "$as_me: WARNING: can't find $name" >&2;}
	+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
	+printf "%s\n" "no" >&6; }
	fi
	fi

	@@ -9689,6 +9762,8 @@
	ac_config_headers="$ac_config_headers config.h"


	+
	+
	ac_config_commands="$ac_config_commands .devel"

	ac_config_files="$ac_config_files Makefile tcpdump.1"
	@@ -10192,7 +10267,7 @@
	# report actual input values of CONFIG_FILES etc. instead of their
	# values after options handling.
	ac_log="
	-This file was extended by tcpdump $as_me 4.99.5, which was
	+This file was extended by tcpdump $as_me 4.99.6, which was
	generated by GNU Autoconf 2.71. Invocation command line was

	CONFIG_FILES = $CONFIG_FILES
	@@ -10260,7 +10335,7 @@
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	ac_cs_config='$ac_cs_config_escaped'
	ac_cs_version="\\
	-tcpdump config.status 4.99.5
	+tcpdump config.status 4.99.6
	configured by $0, generated by GNU Autoconf 2.71,
	with options \\"\$ac_cs_config\\"

	@@ -10990,4 +11065,3 @@
	fi

	exit 0
	-
	diff --git a/contrib/tcpdump/configure.ac b/contrib/tcpdump/configure.ac
	--- a/contrib/tcpdump/configure.ac
	+++ b/contrib/tcpdump/configure.ac
	@@ -32,6 +32,11 @@
	AC_LBL_C_INLINE

	AC_CHECK_HEADERS(rpc/rpc.h rpc/rpcent.h net/if.h)
	+
	+# On Linux, if Autoconf version >= 2.72 and GNU C Library version >= 2.34,
	+# uncomment AC_SYS_YEAR2038_RECOMMENDED to ensure time_t is Y2038-safe.
	+# (Can be done by autogen.sh)
	+# AC_SYS_YEAR2038_RECOMMENDED
	#
	# Get the size of a void *, to know whether this is a 32-bit or 64-bit build.
	#
	@@ -445,12 +450,6 @@
	AC_CHECK_FUNCS(fork vfork)
	AC_CHECK_FUNCS(setlinebuf)

	-#
	-# Make sure we have snprintf(); we require it.
	-#
	-AC_CHECK_FUNC(snprintf,,
	- AC_MSG_ERROR([snprintf() is required but wasn't found]))
	-
	#
	# It became apparent at some point that using a suitable C99 compiler does not
	# automatically mean snprintf(3) implementation in the libc supports all the
	@@ -474,32 +473,50 @@
	#include <inttypes.h>
	#include <sys/types.h>

	+#if defined(_WIN32) && !defined(_SSIZE_T_DEFINED)
	+/*
	+ * On UN*Xes, this is a signed integer type of the same size as size_t.
	+ *
	+ * It's not defined by Visual Studio; we assume that ptrdiff_t will
	+ * be a type that is a signed integer type of the same size as size_t.
	+ */
	+typedef ptrdiff_t ssize_t;
	+#endif
	+
	+/*
	+ * Avoid trying to cast negative values to unsigned types, or doing
	+ * shifts of signed types, in order not to have the test program fail
	+ * if we're building with undefined-behavior sanitizers enabled.
	+ */
	int main()
	{
	char buf[100];
	- uint64_t t = (uint64_t)1 << 32;
	+ unsigned int ui = sizeof(buf);
	+ int i = sizeof(buf);
	+ int64_t i64 = INT64_C(0x100000000);
	+ uint64_t ui64 = UINT64_C(0x100000000);

	- snprintf(buf, sizeof(buf), "%zu", sizeof(buf));
	+ snprintf(buf, sizeof(buf), "%zu", (size_t)ui);
	if (strncmp(buf, "100", sizeof(buf)))
	return 1;

	- snprintf(buf, sizeof(buf), "%zd", -sizeof(buf));
	+ snprintf(buf, sizeof(buf), "%zd", (ssize_t)(-i));
	if (strncmp(buf, "-100", sizeof(buf)))
	return 2;

	- snprintf(buf, sizeof(buf), "%" PRId64, -t);
	+ snprintf(buf, sizeof(buf), "%" PRId64, -i64);
	if (strncmp(buf, "-4294967296", sizeof(buf)))
	return 3;

	- snprintf(buf, sizeof(buf), "0o%" PRIo64, t);
	+ snprintf(buf, sizeof(buf), "0o%" PRIo64, ui64);
	if (strncmp(buf, "0o40000000000", sizeof(buf)))
	return 4;

	- snprintf(buf, sizeof(buf), "0x%" PRIx64, t);
	+ snprintf(buf, sizeof(buf), "0x%" PRIx64, ui64);
	if (strncmp(buf, "0x100000000", sizeof(buf)))
	return 5;

	- snprintf(buf, sizeof(buf), "%" PRIu64, t);
	+ snprintf(buf, sizeof(buf), "%" PRIu64, ui64);
	if (strncmp(buf, "4294967296", sizeof(buf)))
	return 6;

	@@ -1276,6 +1293,13 @@
	AC_PROG_INSTALL

	AC_CONFIG_HEADER(config.h)
	+AH_TOP([
	+#ifndef TCPDUMP_CONFIG_H_
	+#define TCPDUMP_CONFIG_H_
	+])
	+AH_BOTTOM([
	+#endif // TCPDUMP_CONFIG_H_
	+])

	AC_CONFIG_COMMANDS([.devel],[[if test -f .devel; then
	echo timestamp > stamp-h
	diff --git a/contrib/tcpdump/diag-control.h b/contrib/tcpdump/diag-control.h
	--- a/contrib/tcpdump/diag-control.h
	+++ b/contrib/tcpdump/diag-control.h
	@@ -132,7 +132,7 @@
	#define DIAG_ON_STRICT_PROTOTYPES \
	DIAG_DO_PRAGMA(clang diagnostic pop)
	#endif
	-#elif ND_IS_AT_LEAST_GNUC_VERSION(4,2)
	+#elif ND_IS_AT_LEAST_GNUC_VERSION(4,6)
	/* GCC apparently doesn't complain about ORing enums together. */

	/*
	@@ -145,21 +145,19 @@
	#define DIAG_ON_CAST_QUAL \
	DIAG_DO_PRAGMA(GCC diagnostic pop)

	- #if ND_IS_AT_LEAST_GNUC_VERSION(4,5)
	- /*
	- * GCC warns about unused return values if a function is marked as
	- * "warn about ignoring this function's return value".
	- *
	- * Clang appears to let you ignore a result without a warning by
	- * casting the function result to void, so we don't appear to
	- * need this for Clang.
	- */
	- #define DIAG_OFF_WARN_UNUSED_RESULT \
	- DIAG_DO_PRAGMA(GCC diagnostic push) \
	- DIAG_DO_PRAGMA(GCC diagnostic ignored "-Wunused-result")
	- #define DIAG_ON_WARN_UNUSED_RESULT \
	- DIAG_DO_PRAGMA(GCC diagnostic pop)
	- #endif
	+ /*
	+ * GCC warns about unused return values if a function is marked as
	+ * "warn about ignoring this function's return value".
	+ *
	+ * Clang appears to let you ignore a result without a warning by
	+ * casting the function result to void, so we don't appear to
	+ * need this for Clang.
	+ */
	+ #define DIAG_OFF_WARN_UNUSED_RESULT \
	+ DIAG_DO_PRAGMA(GCC diagnostic push) \
	+ DIAG_DO_PRAGMA(GCC diagnostic ignored "-Wunused-result")
	+ #define DIAG_ON_WARN_UNUSED_RESULT \
	+ DIAG_DO_PRAGMA(GCC diagnostic pop)

	/*
	* Suppress deprecation warnings.
	diff --git a/contrib/tcpdump/doc/README.haiku.md b/contrib/tcpdump/doc/README.haiku.md
	deleted file mode 100644
	--- a/contrib/tcpdump/doc/README.haiku.md
	+++ /dev/null
	@@ -1,33 +0,0 @@
	-# Compiling tcpdump on Haiku
	-
	-## 64-bit x86 R1/beta4
	-
	-* Both system and local libpcap are suitable.
	-* Autoconf 2.71 works.
	-* CMake 3.24.2 works.
	-* GCC 11.2.0 works.
	-* Clang 12.0.1 works with the latest llvm12_clang-12.0.1-5 version.
	-
	-The following command will install respective non-default packages:
	-```
	-pkgman install libpcap_devel cmake llvm12_clang
	-```
	-
	-For reference, the tests were done using a system installed from
	-`haiku-r1beta4-x86_64-anyboot.iso`.
	-
	-## 32-bit x86 R1/beta4
	-
	-* Both system and local libpcap are suitable.
	-* Autoconf 2.71 works.
	-* CMake 3.24.2 works.
	-* GCC 11.2.0 works.
	-* Clang does not work.
	-
	-The following command will install respective non-default packages:
	-```
	-pkgman install libpcap_x86_devel cmake_x86
	-```
	-
	-For reference, the tests were done using a system installed from
	-`haiku-r1beta4-x86_gcc2h-anyboot.iso`.
	diff --git a/contrib/tcpdump/doc/README.NetBSD.md b/contrib/tcpdump/doc/README.NetBSD.md
	deleted file mode 100644
	--- a/contrib/tcpdump/doc/README.NetBSD.md
	+++ /dev/null
	@@ -1,22 +0,0 @@
	-# Compiling tcpdump on NetBSD
	-
	-NetBSD has two libpcap libraries: one that is always installed as a part of the
	-OS and another that can be installed as a package from pkgsrc. Also the usual
	-method of compiling with the upstream libpcap in `../libpcap` is available.
	-
	-GCC, Clang, Autoconf and CMake are presumed to work, if this is not the case,
	-please report a bug as explained in the
	-[guidelines for contributing](../CONTRIBUTING.md).
	-
	-## NetBSD 9.3
	-
	-* Upstream libpcap works.
	-* OS libpcap works.
	-* pkgsrc libpcap works.
	-
	-## NetBSD 9.2, 9.1 and 9.0
	-
	-* Upstream libpcap works.
	-* OS libpcap cannot be used due to
	- [this bug](https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=55901).
	-
	diff --git a/contrib/tcpdump/doc/README.aix.md b/contrib/tcpdump/doc/README.aix.md
	deleted file mode 100644
	--- a/contrib/tcpdump/doc/README.aix.md
	+++ /dev/null
	@@ -1,17 +0,0 @@
	-# Compiling tcpdump on AIX
	-
	-* Autoconf works everywhere.
	-
	-## AIX 7.1/POWER7
	-
	-* Only local libpcap is suitable.
	-* CMake 3.16.0 does not work.
	-* GCC 8.3.0 and XL C 12.1.0.0 work.
	-* System m4 does not work, GNU m4 1.4.17 works.
	-
	-## AIX 7.2/POWER8
	-
	-* Only local libpcap is suitable.
	-* GCC 7.2.0 and XL C 13.1.3.6 work.
	-* System m4 does not work, GNU m4 1.4.17 works.
	-
	diff --git a/contrib/tcpdump/doc/README.solaris.md b/contrib/tcpdump/doc/README.solaris.md
	deleted file mode 100644
	--- a/contrib/tcpdump/doc/README.solaris.md
	+++ /dev/null
	@@ -1,46 +0,0 @@
	-# Compiling tcpdump on Solaris and related OSes
	-
	-* Autoconf works everywhere.
	-
	-## OmniOS r151042/AMD64
	-
	-* Both system and local libpcap are suitable.
	-* CMake 3.23.1 works.
	-* GCC 11.2.0 and Clang 14.0.3 work.
	-
	-## OpenIndiana 2021.04/AMD64
	-
	-* Both system and local libpcap are suitable.
	-* CMake 3.21.1 works.
	-* GCC 7.5.0 and GCC 10.3.0 work, Clang 9.0.1 works.
	-
	-For reference, the tests were done using a system installed from
	-`OI-hipster-text-20210430.iso` plus the following packages:
	-```shell
	-xargs -L1 pkg install <<ENDOFTEXT
	-developer/build/autoconf
	-developer/build/cmake
	-developer/gcc-10
	-developer/clang-90
	-ENDOFTEXT
	-```
	-
	-## Oracle Solaris 11.4.42/AMD64
	-
	-* Both system and local libpcap are suitable.
	-* GCC 11.2 and Clang 11.0 work.
	-
	-For reference, the tests were done on a VM booted from `sol-11_4-vbox.ova`
	-and updated to 11.4.42.111.0 plus the following packages:
	-```shell
	-xargs -L1 pkg install <<ENDOFTEXT
	-developer/build/autoconf
	-developer/gcc
	-developer/llvm/clang
	-ENDOFTEXT
	-```
	-
	-## Solaris 9
	-
	-This version of this OS is not supported because the snprintf(3) implementation
	-in its libc is not suitable.
	diff --git a/contrib/tcpdump/extract.h b/contrib/tcpdump/extract.h
	--- a/contrib/tcpdump/extract.h
	+++ b/contrib/tcpdump/extract.h
	@@ -415,7 +415,7 @@
	((uint64_t)(((const uint8_t )(p) + 2)) << 16) \| \
	((uint64_t)(((const uint8_t )(p) + 3)) << 8) \| \
	((uint64_t)(((const uint8_t )(p) + 4)) << 0))) : \
	- ((int64_t)(INT64_T_CONSTANT(0xFFFFFF0000000000U) \| \
	+ ((int64_t)(UINT64_C(0xFFFFFF0000000000) \| \
	((uint64_t)(((const uint8_t )(p) + 0)) << 32) \| \
	((uint64_t)(((const uint8_t )(p) + 1)) << 24) \| \
	((uint64_t)(((const uint8_t )(p) + 2)) << 16) \| \
	@@ -438,7 +438,7 @@
	((uint64_t)(((const uint8_t )(p) + 3)) << 16) \| \
	((uint64_t)(((const uint8_t )(p) + 4)) << 8) \| \
	((uint64_t)(((const uint8_t )(p) + 5)) << 0))) : \
	- ((int64_t)(INT64_T_CONSTANT(0xFFFFFFFF00000000U) \| \
	+ ((int64_t)(UINT64_C(0xFFFFFFFF00000000) \| \
	((uint64_t)(((const uint8_t )(p) + 0)) << 40) \| \
	((uint64_t)(((const uint8_t )(p) + 1)) << 32) \| \
	((uint64_t)(((const uint8_t )(p) + 2)) << 24) \| \
	@@ -464,7 +464,7 @@
	((uint64_t)(((const uint8_t )(p) + 4)) << 16) \| \
	((uint64_t)(((const uint8_t )(p) + 5)) << 8) \| \
	((uint64_t)(((const uint8_t )(p) + 6)) << 0))) : \
	- ((int64_t)(INT64_T_CONSTANT(0xFFFFFFFFFF000000U) \| \
	+ ((int64_t)(UINT64_C(0xFFFFFFFFFF000000) \| \
	((uint64_t)(((const uint8_t )(p) + 0)) << 48) \| \
	((uint64_t)(((const uint8_t )(p) + 1)) << 40) \| \
	((uint64_t)(((const uint8_t )(p) + 2)) << 32) \| \
	diff --git a/contrib/tcpdump/ipproto.c b/contrib/tcpdump/ipproto.c
	--- a/contrib/tcpdump/ipproto.c
	+++ b/contrib/tcpdump/ipproto.c
	@@ -21,7 +21,7 @@
	#include "ipproto.h"

	const struct tok ipproto_values[] = {
	- { IPPROTO_HOPOPTS, "Options" },
	+ { IPPROTO_HOPOPTS, "HBH" },
	{ IPPROTO_ICMP, "ICMP" },
	{ IPPROTO_IGMP, "IGMP" },
	{ IPPROTO_IPV4, "IPIP" },
	@@ -39,6 +39,7 @@
	{ IPPROTO_AH, "AH" },
	{ IPPROTO_MOBILE, "Mobile IP" },
	{ IPPROTO_ICMPV6, "ICMPv6" },
	+ { IPPROTO_DSTOPTS, "DSTOPT" },
	{ IPPROTO_MOBILITY_OLD, "Mobile IP (old)" },
	{ IPPROTO_EIGRP, "EIGRP" },
	{ IPPROTO_OSPF, "OSPF" },
	diff --git a/contrib/tcpdump/missing/snprintf.c b/contrib/tcpdump/missing/snprintf.c
	deleted file mode 100644
	index 52eb9a61ca6678d89b239ddd0b26cf0a4fd6e3e2..0000000000000000000000000000000000000000
	GIT binary patch
	literal 0
	Hc$@<O00001

	literal 10976
	zc%0Q>vPS68\|jy729MIi?$?7>En{R&I~QnG3R8-CrWut+w;*BC2=B=8j`Z(w7x(4
	zKHn}DAVG?Lv`ssA{$PW^K7Uv&7J&D6>#z&GXnhk0^F;~`&w%c$SKqeq*DLt@CY&#W
	zxeH_eV;CeKT{!EJoy+c-H_NCqvz6f*mGlkZw{Rq8U<pi!fS7^P46(Y2<xeM9UR6
	zul=bX8f{`TmrD@Z5{Ui8kFWeG_0!PEp9V=92bY^Ph(d6~DQprSf)J8u6MMesxeP)#
	zzJXa3uaYKQ2k8Q$Sp1DPDM?vH(_j{OF3D(u8~d>K<5iHR{uI`6bQMgokuKa6fB7h9
	zxs0xZa1LG+P6J{}NDA?-{PcTiTDM)YE+KcNSza_n;!TpGN2!bEl3@2Tx}qV8EeXM&
	zFiHc@Zz4sIz!K$=m\|U~)uxJ)4^_Fh1@?!<li)~v_r-qBN1-+ea(7r#%9AHPKq-o@B
	zR(_beYU=iJRw5jaVdbWN9JtFQhhIz^3D(_E{(aqsfgcD~A_?7<h%IX8!4^jOsF;fY
	z0}3r?X;GX=yH@TET>2D8=t%^AIK?raLI#alMJS0;LhdPAiO~o%9AHF}XqH}MBuH5@
	z$RJt!9)%dP1{8ZS1y{&nmL!@d<5SxKXLvGxXO1ku_W5Y\|);_k5;phVnV%NYK+vCaD
	z0&{Q-z2RUyvX3U?;mCo1{mXQaWoL(m#KIYT0PFqv$Z{MQj=(-U@7pK\|MUTwE*tVP\|
	zitF_!$M)b&6Hp2ahGXd4XZ9G$#=\|CQBthGpFg$@XYt%c%PxHv`+v5+ypc8vMAay6G
	z&xCVxG`4$_zBzP$>@CO2x;WmvF-HwrhR4\|wien#bCX)24iqe&3?b+DatB1dSs!I
	z=22fr6PnP`V\|!%v#^h1n>LGGyUmx?yxz)3&VZFD\|8FTcZDaAV0KPE_ogCy<PJTu>*
	zdyNNx!D;DDM%Edbj8Hg}BW3KH;qcfYQ7GQAMsMw&<s3kN=m^Xvj@3jZV^gR{DF_%2
	zWBX\|0*aA9xFt$dc$@$nG4h#}>I(&!Nps^-$9}Ad=1K~5mG#q^(xrB$9g(kc^wXlCg
	zs0!3f!oorHdSjBNQKDAFbF4WF1M5xSeq#-K0`(yYdS^S9fs<xCL}0V#cjgD-<3zYm
	z(}lKiQw!jxm{hP&z&w6ylkt)mL&33SbGldk~8U@O7v+h?APm0gV0-UFi-w~iy#u
	z+l$wFXOd2Xi24d$Zam-WTLzcqz8DizvCm6y)_#fXCfTRnq^S8x=%eZ+@x8RYcv7$X
	z;btY0sGDBQmhL=(U+N-{1mPwTJ@f^K0Nth-STFT{8hF72$=db&0>?Kz;4U#AhL{w2
	z5C>lJz-K>>3ZlB-)o%~#^?kWbuU42^6HKu_V~U<;^H1<\|a&nd59^@Tevao;`l*D
	zZ$%$wQp}7rkOZIo3zYd;`&hZ3F1RBIu}Ii;K4G{AXcMMFk-h^lxZoa<kuNU?qZb
	ze;3}re-AC%c^A<%AukDlr@;(5b>hIJi{k2Tav\|kGNuKzlghFW42^VB<h=JDY1oj\|=
	z*C0RHaYIfrSsKk\|h<rxf%9;%3Hgu~sS}3@4EsPjEf1YuFhS!-?9yRJb%~&&R;t;x0
	zO3rXdz&G-5-1(c@F#2H}R4Z1Z3$lVRm(?tp!gA0RB#eC*H+wHfER8j_no2=_2!lz#
	zzwL{zK8;bVz)A1bP)3410=_`NQ&XnOU23tK+j^$9b5Osnm%>Dg)jL9^IG>)1m_{+i
	z1Zme`M\|C&-W#Y^5*;U5v?V;J;flk\|DTW{-6(VSpbG?Q(_%ya3-l}6TUjBjS^GQwI6
	z88q`R-2_eKpv2lQ<DsCw4yNg%DVpop_qZj}8#hIETT9pRdx_=DA=^x!frw39opUUZ
	zLLnkZM0t&>BdnAua\|wC0Vg-6c1796NtILpaE`5Fo\|IV_ULXXoZ(H}CTs7MIBa+e#Q
	zYen&$>4ny7c=DvE3nQ^Z3y$(PwT&(Gr;%LcvqnQrRVkH;Sw`@FBq`4Xq(2+g!Hp2@
	z?QxTc_YVcNnC0t5u=E?)D;A5eu60NZ(z&%OD_}81t\|jaXGg5D>g*mEYJkH>q&dx(d
	z-m+$QI;Flj9hzqOMns0pf=\|%EaSARf*bOR\|DGn6Mat6!W7ed}3&k6MIckt`4puS#8
	zqe#de!vp*9vJ8UezosRN5{ZF`U=2n=%wbD9GroM+H46RNHk~0QB(_>CjFFdJ8uX6^
	zzgEP(5FWQh{I^j5BLHUsl2aIuG@Qb`+xZ!D>Wi-pL+!n2Ov#tu8-1F~l%X;=Wv+Q-
	zXty2?ZBD@&fcad*Bem@P4lR15JyH!kYMp92@~V^h5YOb=UE_&%Mrjw<(3B44VjT&4
	z<U#@}VH<(S;Sj(NVh!%Y3;fvI%R-wsJZ*>lu@$tsKdTTf_7=#<-k^ez`}56@+$pcz
	zyO!ER==}!xzN!MSh@d;eMfU#y;C<x{qr?ZG>gq-n0p+R{PgeO@ULh2^M5R#Z5vXPb
	zQhAHdCYlBcn\|n5bCZdOp1{-0Z6?{UtcgnT{=79_c#RXT$XH>XqhRc;JRM5#L7WtNU
	z;9LznpojP{EJ~_w_1aL=@Q3BzpCi5~Tn~gE@!u17#h}Y$t{iZs*kTVVBZ6k9)#7-{
	zTzjNr<;+ok1Sd_`cFoTQ{ss0G;OA?AF<nf0Zn%@uz2?fD(git\|YA(z+p(pN9+v?6`
	ziuFb4)5V=UD$1#mR7VW{w+pt`V-u(}Mv&)hQV1P$Av;sV<G7V_HK{i8F_B<z66T
	zBWLFB1LTk!Bzm=o;`AOtV!T2U`jHE&VkClUHigdTn@?-ZhUpBChYCEp>}_?`l}Q%D
	zpKd-&(&}@e7llbG(<S}B;9H?49!oC7Rk<q<OiWlxuuM#*R}LGR#O?bSPfWgyGTL9H
	zILZZCtpN>j=-GL;qx!Uk#GmpAS6FhDBO)WJkyck9%7S8xDW7H@kwdt{vI%k{y~~kb
	z>NQ#>;qPLlnI#cF$YZ9n@>8@M6-v5@}ZKZBasrGB4P+NS~HSizWCLd8b6K9ccw6
	z4PM5+`%%GlTi0@MRRKvwe$`Q>#-0BxT3;col!GeHQMxeA;C$9NJhEA%2n&*FFb~p(
	zN8Hm0<E*B3^Fu`s-4321@Q6#e91uZaqOs>zMt~+w0aL_vSA=p+DNsv&-Q?6zuazX1
	zz@<}Vc12L\|gT=R5yu51YY\|E={`AoM4>~(fUA^uc&z3n%Z02Q9svP4<%I#aOib_Jvr
	zzSEtjNOEPr7p$PLUb}aq2_^HE%$?_f`<RvT1S@K9As&>oVwp~;JKhd_FBX2Wf)E+E
	z<akqETXAV1W<%z5N>R1K3S;Ssln#wTZQM{rNexA4S_)Zr*N_CNGO5Wak<G_jF(oVX
	zjsQCphP3Y@+ty7UMPGIkClhLIYv&f9+}SE1`!E&v2gtX>kSU1Oh{JkGK+p7AxlY
	z&AUZ!0W-db%!(6n%h>HS;Yp\|a;_Gj\|{qAosUp<kSs2So*MR}np5BT>Zbz1;vBLOO+
	zB2Bv+1VwJ#?}4EIEgp1!lkw4?Z+xd<{TH<T(_diwrxNt;rH6&-7j)u1I`J3#U>^03
	zt&=b4!}_j?$f{q}X=n-TDhj5%{~Hd3(g8\|hyKHwcp92\|MlS6mBuidBMr;bSOfafb!
	zH`m0zcVhPY<I~Y_^5!((^_k~cwjbPkwd6hEDTb@NS*A)B_S}EZ_l)a95I4\|&L@^_9
	zo8P27=GMT\|4)Lw(H!^-u#or;i2B+p>%w%-N4QK>ilq~jz)Z3*+uT+iAWuW@UY3J
	zpzKr>&lB}-bmcBZfr(>iTb$D3!@y!*Q3E1{2$W2pP^5$txxw$hWGAj=b1<\|`<jdb{
	zk>LfyrM<_}C%<N{<YOi&+Jo->&zJ5cR!Gn=WK~R}$-2xqWZ5!Ki6aGH9WoD2JBG8j
	zS~nOt<TJK)(AO;XeIeK2c~Y-~0yAtkGA(lc1f)4#VG7@x&On<)3=9M\|teVNf!+!O\|
	z>hqaD3?`}ee*yABw{UtEzXg7x)s`>ehuS\|8@Bntwk9_izeQC^nJZlX_X{ejKoJ`G}
	zdU{2-fV&FMu6g`RR+W3&@;#qFif_&BL_IXO^LJ+c)}NEHb}GCt=Tz$5n4QTVk\|i$K
	zr(Hfgm&<l5uGnGaAxBDPyNsU){MK(E%m1#hn<GNGHM>dIP-qpgs{Rjww)h7Dy12e;
	eb!A6@Y9A`RDEXlhp`^=}xFnKssJ*VsKmP?N?p?<K

	diff --git a/contrib/tcpdump/netdissect-stdinc.h b/contrib/tcpdump/netdissect-stdinc.h
	--- a/contrib/tcpdump/netdissect-stdinc.h
	+++ b/contrib/tcpdump/netdissect-stdinc.h
	@@ -139,11 +139,6 @@
	* strtoint64_t().
	*/
	#define strtoint64_t strtoll
	-
	- /*
	- * And we have LL as a suffix for constants, so use that.
	- */
	- #define INT64_T_CONSTANT(constant) (constant##LL)
	#else
	/*
	* Non-Microsoft compiler.
	@@ -151,11 +146,6 @@
	* XXX - should we use strtoll or should we use _strtoi64()?
	*/
	#define strtoint64_t strtoll
	-
	- /*
	- * Assume LL works.
	- */
	- #define INT64_T_CONSTANT(constant) (constant##LL)
	#endif

	#ifdef _MSC_VER
	@@ -251,11 +241,6 @@
	* Assume all UN*Xes have strtoll(), and use it for strtoint64_t().
	*/
	#define strtoint64_t strtoll
	-
	-/*
	- * Assume LL works.
	- */
	-#define INT64_T_CONSTANT(constant) (constant##LL)
	#endif /* _WIN32 */

	/*
	diff --git a/contrib/tcpdump/netdissect.h b/contrib/tcpdump/netdissect.h
	--- a/contrib/tcpdump/netdissect.h
	+++ b/contrib/tcpdump/netdissect.h
	@@ -208,6 +208,7 @@
	int ndo_bflag; /* print 4 byte ASes in ASDOT notation */
	int ndo_eflag; /* print ethernet header */
	int ndo_fflag; /* don't translate "foreign" IP address */
	+ int ndo_gflag; /* don't split IP output into two lines in verbose mode */
	int ndo_Kflag; /* don't check IP, TCP or UDP checksums */
	int ndo_nflag; /* leave addresses as numbers */
	int ndo_Nflag; /* remove domains from printed host names */
	@@ -374,9 +375,15 @@

	/* Bail out if "l" bytes from "p" were not captured */
	#ifdef ND_LONGJMP_FROM_TCHECK
	-#define ND_TCHECK_LEN(p, l) if (!ND_TTEST_LEN(p, l)) nd_trunc_longjmp(ndo)
	+#define ND_TCHECK_LEN(p, l) \
	+do { \
	+if (!ND_TTEST_LEN(p, l)) nd_trunc_longjmp(ndo); \
	+} while (0)
	#else
	-#define ND_TCHECK_LEN(p, l) if (!ND_TTEST_LEN(p, l)) goto trunc
	+#define ND_TCHECK_LEN(p, l) \
	+do { \
	+if (!ND_TTEST_LEN(p, l)) goto trunc; \
	+} while (0)
	#endif

	/* Bail out if "(p)" was not captured /
	@@ -398,10 +405,12 @@
	* a custom message, format %u
	*/
	#define ND_ICHECKMSG_U(message, expression_1, operator, expression_2) \
	+do { \
	if ((expression_1) operator (expression_2)) { \
	ND_PRINT(" [%s %u %s %u]", (message), (expression_1), (#operator), (expression_2)); \
	goto invalid; \
	-}
	+} \
	+} while (0)

	/*
	* Check (expression_1 operator expression_2) for invalid packet with
	@@ -415,10 +424,12 @@
	* a custom message, format %zu
	*/
	#define ND_ICHECKMSG_ZU(message, expression_1, operator, expression_2) \
	+do { \
	if ((expression_1) operator (expression_2)) { \
	ND_PRINT(" [%s %u %s %zu]", (message), (expression_1), (#operator), (expression_2)); \
	goto invalid; \
	-}
	+} \
	+} while (0)

	/*
	* Check (expression_1 operator expression_2) for invalid packet with
	@@ -644,8 +655,8 @@
	extern void gre_print(netdissect_options , const u_char , u_int);
	extern int hbhopt_process(netdissect_options , const u_char , int , uint32_t );
	extern void hex_and_ascii_print(netdissect_options , const char , const u_char *, u_int);
	-extern void hex_print(netdissect_options , const char ident, const u_char *cp, u_int);
	-extern void hex_print_with_offset(netdissect_options , const char ident, const u_char *cp, u_int, u_int);
	+extern void hex_print(netdissect_options , const char indent, const u_char *cp, u_int);
	+extern void hex_print_with_offset(netdissect_options , const char indent, const u_char *cp, u_int, u_int);
	extern void hncp_print(netdissect_options , const u_char , u_int);
	extern void hsrp_print(netdissect_options , const u_char , u_int);
	extern void http_print(netdissect_options , const u_char , u_int);
	diff --git a/contrib/tcpdump/netdissect.c b/contrib/tcpdump/netdissect.c
	--- a/contrib/tcpdump/netdissect.c
	+++ b/contrib/tcpdump/netdissect.c
	@@ -79,7 +79,7 @@
	}

	/*
	- * Clean up anything that ndo_init() did.
	+ * Clean up anything that nd_init() did.
	*/
	void
	nd_cleanup(void)
	diff --git a/contrib/tcpdump/nfs.h b/contrib/tcpdump/nfs.h
	--- a/contrib/tcpdump/nfs.h
	+++ b/contrib/tcpdump/nfs.h
	@@ -293,7 +293,7 @@
	typedef struct nfsv3_spec nfsv3spec;

	/*
	- * File attributes and setable attributes. These structures cover both
	+ * File attributes and settable attributes. These structures cover both
	* NFS version 2 and the version 3 protocol. Note that the union is only
	* used so that one pointer can refer to both variants. These structures
	* go out on the wire and must be densely packed, so no quad data types
	diff --git a/contrib/tcpdump/ntp.h b/contrib/tcpdump/ntp.h
	--- a/contrib/tcpdump/ntp.h
	+++ b/contrib/tcpdump/ntp.h
	@@ -51,4 +51,6 @@
	nd_uint16_t fraction;
	};

	+void p_ntp_time_fmt(netdissect_options , const char fmt,
	+ const struct l_fixedpt *);
	void p_ntp_time(netdissect_options , const struct l_fixedpt );
	diff --git a/contrib/tcpdump/ntp.c b/contrib/tcpdump/ntp.c
	--- a/contrib/tcpdump/ntp.c
	+++ b/contrib/tcpdump/ntp.c
	@@ -26,10 +26,14 @@

	#include "extract.h"

	-#define JAN_1970 INT64_T_CONSTANT(2208988800) /* 1970 - 1900 in seconds */
	+/* NTP epoch 1: January 1, 1900, 00:00:00 UTC. */
	+#define DIFF_1970_1900 INT64_C(2208988800) /* 1970 - 1900 in seconds */
	+/* RFC4330 - 3. NTP Timestamp Format - 6h 28m 16s UTC on 7 February 2036 */
	+/* NTP epoch 2: February 7, 2036, 06:28:16 UTC. */
	+#define DIFF_2036_1970 INT64_C(2085978496) /* 2036 - 1970 in seconds */

	void
	-p_ntp_time(netdissect_options *ndo,
	+p_ntp_time_fmt(netdissect_options ndo, const char fmt,
	const struct l_fixedpt *lfp)
	{
	uint32_t i;
	@@ -50,23 +54,33 @@
	* print the UTC time in human-readable format.
	*/
	if (i) {
	- int64_t seconds_64bit = (int64_t)i - JAN_1970;
	+ int64_t seconds_64bit;
	time_t seconds;
	char time_buf[128];
	const char *time_string;

	+ if ((i & 0x80000000) != 0)
	+ seconds_64bit = (int64_t)i - DIFF_1970_1900;
	+ else
	+ seconds_64bit = (int64_t)i + DIFF_2036_1970;
	seconds = (time_t)seconds_64bit;
	if (seconds != seconds_64bit) {
	/*
	* It doesn't fit into a time_t, so we can't hand it
	* to gmtime.
	*/
	- time_string = "[Time is too large to fit into a time_t]";
	+ time_string = "[timestamp overflow]";
	} else {
	- /* use ISO 8601 (RFC3339) format */
	time_string = nd_format_time(time_buf, sizeof (time_buf),
	- "%Y-%m-%dT%H:%M:%SZ", gmtime(&seconds));
	+ fmt, gmtime(&seconds));
	}
	ND_PRINT(" (%s)", time_string);
	}
	}
	+
	+void
	+p_ntp_time(netdissect_options ndo, const struct l_fixedpt lfp)
	+{
	+ /* use ISO 8601 (RFC3339) format */
	+ p_ntp_time_fmt(ndo, "%Y-%m-%dT%H:%M:%SZ", lfp);
	+}
	diff --git a/contrib/tcpdump/parsenfsfh.c b/contrib/tcpdump/parsenfsfh.c
	--- a/contrib/tcpdump/parsenfsfh.c
	+++ b/contrib/tcpdump/parsenfsfh.c
	@@ -329,20 +329,9 @@

	case FHT_VMSUCX:
	/* No numeric file system ID, so hash on the device-name */
	- if (sizeof(*fsidp) >= 14) {
	- if (sizeof(*fsidp) > 14)
	- memset((char )fsidp, 0, sizeof(fsidp));
	- /* just use the whole thing */
	- memcpy((char )fsidp, (const char )fh, 14);
	- } else {
	- uint32_t tempa[4]; /* at least 16 bytes, maybe more */
	-
	- memset((char *)tempa, 0, sizeof(tempa));
	- memcpy((char )tempa, (const char )fh, 14); /* ensure alignment */
	- fsidp->Fsid_dev.Minor = tempa[0] + (tempa[1]<<1);
	- fsidp->Fsid_dev.Major = tempa[2] + (tempa[3]<<1);
	- fsidp->fsid_code = 0;
	- }
	+ memset((char )fsidp, 0, sizeof(fsidp));
	+ /* just use the whole thing */
	+ memcpy((char )fsidp, (const char )fh, 14);

	/* VMS file ID is: (RVN, FidHi, FidLo) */
	*inop = (((uint32_t) GET_U_1(fhp + 26)) << 24) \|
	diff --git a/contrib/tcpdump/print-arista.c b/contrib/tcpdump/print-arista.c
	--- a/contrib/tcpdump/print-arista.c
	+++ b/contrib/tcpdump/print-arista.c
	@@ -8,6 +8,7 @@

	#include "netdissect.h"
	#include "extract.h"
	+#include "timeval-operations.h"

	/*

	@@ -86,17 +87,17 @@
	};

	static inline void
	-arista_print_date_hms_time(netdissect_options *ndo, uint32_t seconds,
	- uint32_t nanoseconds)
	+arista_print_date_hms_time(netdissect_options *ndo, const uint32_t seconds,
	+ const uint32_t nanoseconds)
	{
	- time_t ts;
	+ const time_t ts = seconds;
	char buf[sizeof("-yyyyyyyyyy-mm-dd hh:mm:ss")];

	- ts = seconds + (nanoseconds / 1000000000);
	- nanoseconds %= 1000000000;
	ND_PRINT("%s.%09u",
	nd_format_time(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S",
	gmtime(&ts)), nanoseconds);
	+ if (nanoseconds > ND_NANO_PER_SEC - 1)
	+ ND_PRINT(" " ND_INVALID_NANO_SEC_STR);
	}

	int
	@@ -117,7 +118,7 @@

	// TapAgg Header Timestamping
	if (subTypeId == ARISTA_SUBTYPE_TIMESTAMP) {
	- uint64_t seconds;
	+ uint32_t seconds;
	uint32_t nanoseconds;
	uint8_t ts_timescale = GET_U_1(bp);
	bp += 1;
	@@ -147,9 +148,9 @@
	case FORMAT_48BIT:
	seconds = GET_BE_U_2(bp);
	nanoseconds = GET_BE_U_4(bp + 2);
	- seconds += nanoseconds / 1000000000;
	- nanoseconds %= 1000000000;
	- ND_PRINT("%" PRIu64 ".%09u", seconds, nanoseconds);
	+ ND_PRINT("%u.%09u", seconds, nanoseconds);
	+ if (nanoseconds > ND_NANO_PER_SEC - 1)
	+ ND_PRINT(" " ND_INVALID_NANO_SEC_STR);
	bytesConsumed += 6;
	break;
	default:
	diff --git a/contrib/tcpdump/print-ascii.c b/contrib/tcpdump/print-ascii.c
	--- a/contrib/tcpdump/print-ascii.c
	+++ b/contrib/tcpdump/print-ascii.c
	@@ -100,7 +100,7 @@
	}

	static void
	-hex_and_ascii_print_with_offset(netdissect_options ndo, const char ident,
	+hex_and_ascii_print_with_offset(netdissect_options ndo, const char indent,
	const u_char *cp, u_int length, u_int oset)
	{
	u_int caplength;
	@@ -133,7 +133,7 @@
	if (i >= HEXDUMP_SHORTS_PER_LINE) {
	hsp = asp = '\0';
	ND_PRINT("%s0x%04x: %-*s %s",
	- ident, oset, HEXDUMP_HEXSTUFF_PER_LINE,
	+ indent, oset, HEXDUMP_HEXSTUFF_PER_LINE,
	hexstuff, asciistuff);
	i = 0; hsp = hexstuff; asp = asciistuff;
	oset += HEXDUMP_BYTES_PER_LINE;
	@@ -152,7 +152,7 @@
	if (i > 0) {
	hsp = asp = '\0';
	ND_PRINT("%s0x%04x: %-*s %s",
	- ident, oset, HEXDUMP_HEXSTUFF_PER_LINE,
	+ indent, oset, HEXDUMP_HEXSTUFF_PER_LINE,
	hexstuff, asciistuff);
	}
	if (truncated)
	@@ -160,10 +160,10 @@
	}

	void
	-hex_and_ascii_print(netdissect_options ndo, const char ident,
	+hex_and_ascii_print(netdissect_options ndo, const char indent,
	const u_char *cp, u_int length)
	{
	- hex_and_ascii_print_with_offset(ndo, ident, cp, length, 0);
	+ hex_and_ascii_print_with_offset(ndo, indent, cp, length, 0);
	}

	/*
	@@ -171,7 +171,7 @@
	*/
	void
	hex_print_with_offset(netdissect_options *ndo,
	- const char ident, const u_char cp, u_int length,
	+ const char indent, const u_char cp, u_int length,
	u_int oset)
	{
	u_int caplength;
	@@ -188,7 +188,7 @@
	i = 0;
	while (nshorts != 0) {
	if ((i++ % 8) == 0) {
	- ND_PRINT("%s0x%04x: ", ident, oset);
	+ ND_PRINT("%s0x%04x: ", indent, oset);
	oset += HEXDUMP_BYTES_PER_LINE;
	}
	s = GET_U_1(cp);
	@@ -199,7 +199,7 @@
	}
	if (length & 1) {
	if ((i % 8) == 0)
	- ND_PRINT("%s0x%04x: ", ident, oset);
	+ ND_PRINT("%s0x%04x: ", indent, oset);
	ND_PRINT(" %02x", GET_U_1(cp));
	}
	if (truncated)
	@@ -208,9 +208,9 @@

	void
	hex_print(netdissect_options *ndo,
	- const char ident, const u_char cp, u_int length)
	+ const char indent, const u_char cp, u_int length)
	{
	- hex_print_with_offset(ndo, ident, cp, length, 0);
	+ hex_print_with_offset(ndo, indent, cp, length, 0);
	}

	#ifdef MAIN
	diff --git a/contrib/tcpdump/print-bootp.c b/contrib/tcpdump/print-bootp.c
	--- a/contrib/tcpdump/print-bootp.c
	+++ b/contrib/tcpdump/print-bootp.c
	@@ -178,7 +178,7 @@
	/* RFC 2485 */
	#define TAG_OPEN_GROUP_UAP ((uint8_t) 98)
	/* RFC 2563 */
	-#define TAG_DISABLE_AUTOCONF ((uint8_t) 116)
	+#define TAG_AUTO_CONFIGURE ((uint8_t) 116)
	/* RFC 2610 */
	#define TAG_SLP_DA ((uint8_t) 78)
	#define TAG_SLP_SCOPE ((uint8_t) 79)
	@@ -394,9 +394,9 @@
	* The first character specifies the format to print:
	* i - ip address (32 bits)
	* p - ip address pairs (32 bits + 32 bits)
	- * l - long (32 bits)
	- * L - unsigned long (32 bits)
	- * s - short (16 bits)
	+ * l - unsigned longs (32 bits)
	+ * L - longs (32 bits)
	+ * s - unsigned shorts (16 bits)
	* b - period-separated decimal bytes (variable length)
	* x - colon-separated hex bytes (variable length)
	* a - ASCII string (variable length)
	@@ -486,7 +486,7 @@
	/* RFC 2485 */
	{ TAG_OPEN_GROUP_UAP, "aUAP" },
	/* RFC 2563 */
	- { TAG_DISABLE_AUTOCONF, "BNOAUTO" },
	+ { TAG_AUTO_CONFIGURE, "BAuto-Configure" },
	/* RFC 2610 */
	{ TAG_SLP_DA, "bSLP-DA" }, /"b" is a little wrong /
	{ TAG_SLP_SCOPE, "bSLP-SCOPE" }, /"b" is a little wrong /
	@@ -511,7 +511,7 @@
	{ TAG_TZ_STRING, "aTZSTR" },
	{ TAG_FQDN_OPTION, "bFQDNS" }, /* XXX 'b' */
	{ TAG_AUTH, "bAUTH" }, /* XXX 'b' */
	- { TAG_CLIENT_LAST_TRANSACTION_TIME, "LLast-Transaction-Time" },
	+ { TAG_CLIENT_LAST_TRANSACTION_TIME, "lLast-Transaction-Time" },
	{ TAG_ASSOCIATED_IP, "iAssociated-IP" },
	{ TAG_CLIENT_ARCH, "sARCH" },
	{ TAG_CLIENT_NDI, "bNDI" }, /* XXX 'b' */
	@@ -703,6 +703,14 @@

	case 'p':
	/* IP address pairs */
	+ /* this option should be N x 8 bytes long */
	+ if (len < 8 \|\| len % 8 != 0) {
	+ ND_PRINT("%s[length != N x 8 bytes]",
	+ len == 0 ? " " : "");
	+ bp += len;
	+ len = 0;
	+ break;
	+ }
	while (len >= 2*4) {
	if (!first)
	ND_PRINT(",");
	@@ -717,7 +725,7 @@
	break;

	case 's':
	- /* shorts */
	+ /* unsigned shorts */
	while (len >= 2) {
	if (!first)
	ND_PRINT(",");
	@@ -730,27 +738,33 @@

	case 'B':
	/* boolean */
	- while (len > 0) {
	- uint8_t bool_value;
	- if (!first)
	- ND_PRINT(",");
	- bool_value = GET_U_1(bp);
	- switch (bool_value) {
	- case 0:
	- ND_PRINT("N");
	- break;
	- case 1:
	- ND_PRINT("Y");
	- break;
	- default:
	- ND_PRINT("%u?", bool_value);
	- break;
	- }
	- ++bp;
	- --len;
	- first = 0;
	+ {
	+ /* this option should be 1 byte long */
	+ if (len != 1) {
	+ ND_PRINT("[length != 1 byte]");
	+ nd_print_invalid(ndo);
	+ bp += len;
	+ len = 0;
	+ break;
	}
	+
	+ uint8_t bool_value;
	+ bool_value = GET_U_1(bp);
	+ switch (bool_value) {
	+ case 0:
	+ ND_PRINT("N");
	+ break;
	+ case 1:
	+ ND_PRINT("Y");
	+ break;
	+ default:
	+ ND_PRINT("%u?", bool_value);
	+ break;
	+ }
	+ ++bp;
	+ --len;
	break;
	+ }

	case 'b':
	case 'x':
	@@ -778,7 +792,8 @@
	case TAG_NETBIOS_NODE:
	/* this option should be at least 1 byte long */
	if (len < 1) {
	- ND_PRINT("[ERROR: length < 1 bytes]");
	+ ND_PRINT("[length < 1 byte]");
	+ nd_print_invalid(ndo);
	break;
	}
	tag = GET_U_1(bp);
	@@ -790,7 +805,8 @@
	case TAG_OPT_OVERLOAD:
	/* this option should be at least 1 byte long */
	if (len < 1) {
	- ND_PRINT("[ERROR: length < 1 bytes]");
	+ ND_PRINT("[length < 1 byte]");
	+ nd_print_invalid(ndo);
	break;
	}
	tag = GET_U_1(bp);
	@@ -802,14 +818,16 @@
	case TAG_CLIENT_FQDN:
	/* this option should be at least 3 bytes long */
	if (len < 3) {
	- ND_PRINT("[ERROR: length < 3 bytes]");
	+ ND_PRINT("[length < 3 bytes]");
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	}
	if (GET_U_1(bp) & 0xf0) {
	- ND_PRINT("[ERROR: MBZ nibble 0x%x != 0] ",
	+ ND_PRINT("[MBZ nibble 0x%x != 0] ",
	(GET_U_1(bp) & 0xf0) >> 4);
	+ nd_print_invalid(ndo);
	}
	if (GET_U_1(bp) & 0x0f)
	ND_PRINT("[%s] ",
	@@ -835,7 +853,8 @@

	/* this option should be at least 1 byte long */
	if (len < 1) {
	- ND_PRINT("[ERROR: length < 1 bytes]");
	+ ND_PRINT("[length < 1 byte]");
	+ nd_print_invalid(ndo);
	break;
	}
	type = GET_U_1(bp);
	@@ -909,7 +928,8 @@

	/* this option should be at least 5 bytes long */
	if (len < 5) {
	- ND_PRINT("[ERROR: length < 5 bytes]");
	+ ND_PRINT("[length < 5 bytes]");
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	@@ -922,7 +942,8 @@
	len--;
	/* mask_width <= 32 */
	if (mask_width > 32) {
	- ND_PRINT("[ERROR: Mask width (%u) > 32]", mask_width);
	+ ND_PRINT("[Mask width (%u) > 32]", mask_width);
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	@@ -930,7 +951,8 @@
	significant_octets = (mask_width + 7) / 8;
	/* significant octets + router(4) */
	if (len < significant_octets + 4) {
	- ND_PRINT("[ERROR: Remaining length (%u) < %u bytes]", len, significant_octets + 4);
	+ ND_PRINT("[Remaining length (%u) < %u bytes]", len, significant_octets + 4);
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	@@ -964,7 +986,8 @@

	first = 1;
	if (len < 2) {
	- ND_PRINT("[ERROR: length < 2 bytes]");
	+ ND_PRINT("[length < 2 bytes]");
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	@@ -976,13 +999,16 @@
	ND_PRINT("\n\t ");
	ND_PRINT("instance#%u: ", suboptnumber);
	if (suboptlen == 0) {
	- ND_PRINT("[ERROR: suboption length must be non-zero]");
	+ ND_PRINT("[suboption length == 0]");
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	}
	if (len < suboptlen) {
	- ND_PRINT("[ERROR: invalid option]");
	+ ND_PRINT("[length %u < suboption length %u",
	+ len, suboptlen);
	+ nd_print_invalid(ndo);
	bp += len;
	len = 0;
	break;
	@@ -1012,25 +1038,28 @@
	* URI: URI of the SZTP bootstrap server.
	*/
	while (len >= 2) {
	- suboptlen = GET_BE_U_2(bp);
	+ uint16_t suboptlen2;
	+
	+ suboptlen2 = GET_BE_U_2(bp);
	bp += 2;
	len -= 2;
	ND_PRINT("\n\t ");
	- ND_PRINT("length %u: ", suboptlen);
	- if (len < suboptlen) {
	+ ND_PRINT("length %u: ", suboptlen2);
	+ if (len < suboptlen2) {
	ND_PRINT("length goes past end of option");
	bp += len;
	len = 0;
	break;
	}
	ND_PRINT("\"");
	- nd_printjn(ndo, bp, suboptlen);
	+ nd_printjn(ndo, bp, suboptlen2);
	ND_PRINT("\"");
	- len -= suboptlen;
	- bp += suboptlen;
	+ len -= suboptlen2;
	+ bp += suboptlen2;
	}
	if (len != 0) {
	- ND_PRINT("[ERROR: length < 2 bytes]");
	+ ND_PRINT("[length < 2 bytes]");
	+ nd_print_invalid(ndo);
	}
	break;

	diff --git a/contrib/tcpdump/print-domain.c b/contrib/tcpdump/print-domain.c
	--- a/contrib/tcpdump/print-domain.c
	+++ b/contrib/tcpdump/print-domain.c
	@@ -722,11 +722,10 @@
	len = GET_BE_U_2(cp);
	cp += 2;

	- rp = cp + len;
	-
	ND_PRINT(" %s", tok2str(ns_type2str, "Type%u", typ));
	- if (rp > ndo->ndo_snapend)
	- return(NULL);
	+
	+ ND_TCHECK_LEN(cp, len);
	+ rp = cp + len;

	switch (typ) {
	case T_A:
	@@ -896,6 +895,9 @@
	}
	}
	return (rp); /* XXX This isn't always right */
	+
	+trunc:
	+ return(NULL);
	}

	void
	diff --git a/contrib/tcpdump/print-egp.c b/contrib/tcpdump/print-egp.c
	--- a/contrib/tcpdump/print-egp.c
	+++ b/contrib/tcpdump/print-egp.c
	@@ -26,6 +26,7 @@

	#include "netdissect-stdinc.h"

	+#define ND_LONGJMP_FROM_TCHECK
	#include "netdissect.h"
	#include "addrtoname.h"
	#include "extract.h"
	@@ -87,44 +88,58 @@
	#define egp_sourcenet egp_pands.egpu_sourcenet
	};

	-static const char *egp_acquire_codes[] = {
	- "request",
	- "confirm",
	- "refuse",
	- "cease",
	- "cease_ack"
	+static const struct tok egp_type_str[] = {
	+ { EGPT_ACQUIRE, "acquire" },
	+ { EGPT_REACH, "reach" },
	+ { EGPT_POLL, "poll" },
	+ { EGPT_UPDATE, "update" },
	+ { EGPT_ERROR, "error" },
	+ { 0, NULL }
	};

	-static const char *egp_acquire_status[] = {
	- "unspecified",
	- "active_mode",
	- "passive_mode",
	- "insufficient_resources",
	- "administratively_prohibited",
	- "going_down",
	- "parameter_violation",
	- "protocol_violation"
	+static const struct tok egp_acquire_codes_str[] = {
	+ { EGPC_REQUEST, "request" },
	+ { EGPC_CONFIRM, "confirm" },
	+ { EGPC_REFUSE, "refuse" },
	+ { EGPC_CEASE, "cease" },
	+ { EGPC_CEASEACK, "cease_ack" },
	+ { 0, NULL }
	};

	-static const char *egp_reach_codes[] = {
	- "hello",
	- "i-h-u"
	+static const struct tok egp_acquire_status_str[] = {
	+ { EGPS_UNSPEC, "unspecified" },
	+ { EGPS_ACTIVE, "active_mode" },
	+ { EGPS_PASSIVE, "passive_mode" },
	+ { EGPS_NORES, "insufficient_resources" },
	+ { EGPS_ADMIN, "administratively_prohibited" },
	+ { EGPS_GODOWN, "going_down" },
	+ { EGPS_PARAM, "parameter_violation" },
	+ { EGPS_PROTO, "protocol_violation" },
	+ { 0, NULL }
	};

	-static const char *egp_status_updown[] = {
	- "indeterminate",
	- "up",
	- "down"
	+static const struct tok egp_reach_codes_str[] = {
	+ { EGPC_HELLO, "hello" },
	+ { EGPC_HEARDU, "i-h-u" },
	+ { 0, NULL }
	};

	-static const char *egp_reasons[] = {
	- "unspecified",
	- "bad_EGP_header_format",
	- "bad_EGP_data_field_format",
	- "reachability_info_unavailable",
	- "excessive_polling_rate",
	- "no_response",
	- "unsupported_version"
	+static const struct tok egp_status_updown_str[] = {
	+ { EGPS_INDET, "indeterminate" },
	+ { EGPS_UP, "up" },
	+ { EGPS_DOWN, "down" },
	+ { 0, NULL }
	+};
	+
	+static const struct tok egp_reasons_str[] = {
	+ { EGPR_UNSPEC, "unspecified" },
	+ { EGPR_BADHEAD, "bad_EGP_header_format" },
	+ { EGPR_BADDATA, "bad_EGP_data_field_format" },
	+ { EGPR_NOREACH, "reachability_info_unavailable" },
	+ { EGPR_XSPOLL, "excessive_polling_rate" },
	+ { EGPR_NORESP, "no_response" },
	+ { EGPR_UVERSION, "unsupported_version" },
	+ { 0, NULL }
	};

	static void
	@@ -162,8 +177,7 @@
	for (gateways = 0; gateways < t_gateways; ++gateways) {
	/* Pickup host part of gateway address */
	addr = 0;
	- if (length < 4 - netlen)
	- goto trunc;
	+ ND_ICHECK_U(length, <, 4 - netlen);
	ND_TCHECK_LEN(cp, 4 - netlen);
	switch (netlen) {

	@@ -182,8 +196,7 @@
	}
	addr \|= net;
	length -= 4 - netlen;
	- if (length < 1)
	- goto trunc;
	+ ND_ICHECK_U(length, <, 1);
	distances = GET_U_1(cp);
	cp++;
	length--;
	@@ -194,8 +207,7 @@
	comma = "";
	ND_PRINT("(");
	while (distances != 0) {
	- if (length < 2)
	- goto trunc;
	+ ND_ICHECK_U(length, <, 2);
	ND_PRINT("%sd%u:", comma, GET_U_1(cp));
	cp++;
	comma = ", ";
	@@ -204,20 +216,17 @@
	length -= 2;
	while (networks != 0) {
	/* Pickup network number */
	- if (length < 1)
	- goto trunc;
	+ ND_ICHECK_U(length, <, 1);
	addr = ((uint32_t) GET_U_1(cp)) << 24;
	cp++;
	length--;
	if (IN_CLASSB(addr)) {
	- if (length < 1)
	- goto trunc;
	+ ND_ICHECK_U(length, <, 1);
	addr \|= ((uint32_t) GET_U_1(cp)) << 16;
	cp++;
	length--;
	} else if (!IN_CLASSA(addr)) {
	- if (length < 2)
	- goto trunc;
	+ ND_ICHECK_U(length, <, 2);
	addr \|= ((uint32_t) GET_U_1(cp)) << 16;
	cp++;
	addr \|= ((uint32_t) GET_U_1(cp)) << 8;
	@@ -232,8 +241,8 @@
	ND_PRINT(")");
	}
	return;
	-trunc:
	- nd_print_trunc(ndo);
	+invalid:
	+ nd_print_invalid(ndo);
	}

	void
	@@ -247,46 +256,42 @@
	u_int status;

	ndo->ndo_protocol = "egp";
	+ nd_print_protocol_caps(ndo);
	+
	egp = (const struct egp_packet *)bp;
	- if (length < sizeof(*egp) \|\| !ND_TTEST_SIZE(egp)) {
	- nd_print_trunc(ndo);
	- return;
	- }
	+ ND_ICHECK_ZU(length, <, sizeof(*egp));

	version = GET_U_1(egp->egp_version);
	- if (!ndo->ndo_vflag) {
	- ND_PRINT("EGPv%u, AS %u, seq %u, length %u",
	- version,
	- GET_BE_U_2(egp->egp_as),
	- GET_BE_U_2(egp->egp_sequence),
	- length);
	- return;
	- } else
	- ND_PRINT("EGPv%u, length %u",
	- version,
	- length);
	-
	- if (version != EGP_VERSION) {
	- ND_PRINT("[version %u]", version);
	+ ND_ICHECK_U(version, !=, EGP_VERSION);
	+ ND_TCHECK_SIZE(egp);
	+
	+ ND_PRINT("v%u", version);
	+ if (ndo->ndo_vflag) {
	+ ND_PRINT(", AS %u, seq %u, length %u",
	+ GET_BE_U_2(egp->egp_as),
	+ GET_BE_U_2(egp->egp_sequence),
	+ length);
	+ } else {
	+ ND_PRINT(", length %u", length);
	return;
	}

	type = GET_U_1(egp->egp_type);
	+ ND_PRINT(", %s", tok2str(egp_type_str, "[type %u]", type));
	code = GET_U_1(egp->egp_code);
	status = GET_U_1(egp->egp_status);

	switch (type) {
	case EGPT_ACQUIRE:
	- ND_PRINT(" acquire");
	+ ND_PRINT(" %s", tok2str(egp_acquire_codes_str, "[code %u]", code));
	switch (code) {
	case EGPC_REQUEST:
	case EGPC_CONFIRM:
	- ND_PRINT(" %s", egp_acquire_codes[code]);
	switch (status) {
	case EGPS_UNSPEC:
	case EGPS_ACTIVE:
	case EGPS_PASSIVE:
	- ND_PRINT(" %s", egp_acquire_status[status]);
	+ ND_PRINT(" %s", tok2str(egp_acquire_status_str, "%u", status));
	break;

	default:
	@@ -301,7 +306,6 @@
	case EGPC_REFUSE:
	case EGPC_CEASE:
	case EGPC_CEASEACK:
	- ND_PRINT(" %s", egp_acquire_codes[code]);
	switch (status ) {
	case EGPS_UNSPEC:
	case EGPS_NORES:
	@@ -309,7 +313,7 @@
	case EGPS_GODOWN:
	case EGPS_PARAM:
	case EGPS_PROTO:
	- ND_PRINT(" %s", egp_acquire_status[status]);
	+ ND_PRINT(" %s", tok2str(egp_acquire_status_str, "%u", status));
	break;

	default:
	@@ -317,50 +321,30 @@
	break;
	}
	break;
	-
	- default:
	- ND_PRINT("[code %u]", code);
	- break;
	}
	break;

	case EGPT_REACH:
	+ ND_PRINT(" %s", tok2str(egp_reach_codes_str, "[reach code %u]", code));
	switch (code) {
	-
	case EGPC_HELLO:
	case EGPC_HEARDU:
	- ND_PRINT(" %s", egp_reach_codes[code]);
	- if (status <= EGPS_DOWN)
	- ND_PRINT(" state:%s", egp_status_updown[status]);
	- else
	- ND_PRINT(" [status %u]", status);
	- break;
	-
	- default:
	- ND_PRINT("[reach code %u]", code);
	+ ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
	break;
	}
	break;

	case EGPT_POLL:
	- ND_PRINT(" poll");
	- if (status <= EGPS_DOWN)
	- ND_PRINT(" state:%s", egp_status_updown[status]);
	- else
	- ND_PRINT(" [status %u]", status);
	+ ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
	ND_PRINT(" net:%s", GET_IPADDR_STRING(egp->egp_sourcenet));
	break;

	case EGPT_UPDATE:
	- ND_PRINT(" update");
	if (status & EGPS_UNSOL) {
	status &= ~EGPS_UNSOL;
	ND_PRINT(" unsolicited");
	}
	- if (status <= EGPS_DOWN)
	- ND_PRINT(" state:%s", egp_status_updown[status]);
	- else
	- ND_PRINT(" [status %u]", status);
	+ ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
	ND_PRINT(" %s int %u ext %u",
	GET_IPADDR_STRING(egp->egp_sourcenet),
	GET_U_1(egp->egp_intgw),
	@@ -370,21 +354,11 @@
	break;

	case EGPT_ERROR:
	- ND_PRINT(" error");
	- if (status <= EGPS_DOWN)
	- ND_PRINT(" state:%s", egp_status_updown[status]);
	- else
	- ND_PRINT(" [status %u]", status);
	-
	- if (GET_BE_U_2(egp->egp_reason) <= EGPR_UVERSION)
	- ND_PRINT(" %s",
	- egp_reasons[GET_BE_U_2(egp->egp_reason)]);
	- else
	- ND_PRINT(" [reason %u]", GET_BE_U_2(egp->egp_reason));
	- break;
	-
	- default:
	- ND_PRINT("[type %u]", type);
	+ ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
	+ ND_PRINT(" %s", tok2str(egp_reasons_str, "[reason %u]", GET_BE_U_2(egp->egp_reason)));
	break;
	}
	+ return;
	+invalid:
	+ nd_print_invalid(ndo);
	}
	diff --git a/contrib/tcpdump/print-frag6.c b/contrib/tcpdump/print-frag6.c
	--- a/contrib/tcpdump/print-frag6.c
	+++ b/contrib/tcpdump/print-frag6.c
	@@ -25,6 +25,7 @@

	#include "netdissect-stdinc.h"

	+#define ND_LONGJMP_FROM_TCHECK
	#include "netdissect.h"
	#include "extract.h"

	@@ -43,6 +44,8 @@
	ND_PRINT("frag (");
	if (ndo->ndo_vflag)
	ND_PRINT("0x%08x:", GET_BE_U_4(dp->ip6f_ident));
	+ else
	+ ND_TCHECK_4(dp->ip6f_ident);
	ND_PRINT("%u\|", GET_BE_U_2(dp->ip6f_offlg) & IP6F_OFF_MASK);
	if ((bp - bp2) + sizeof(struct ip6_frag) >
	sizeof(struct ip6_hdr) + GET_BE_U_2(ip6->ip6_plen))
	diff --git a/contrib/tcpdump/print-icmp6.c b/contrib/tcpdump/print-icmp6.c
	--- a/contrib/tcpdump/print-icmp6.c
	+++ b/contrib/tcpdump/print-icmp6.c
	@@ -100,11 +100,8 @@

	#define ICMP6_ECHO_REQUEST 128 /* echo service */
	#define ICMP6_ECHO_REPLY 129 /* echo reply */
	-#define ICMP6_MEMBERSHIP_QUERY 130 /* group membership query */
	#define MLD6_LISTENER_QUERY 130 /* multicast listener query */
	-#define ICMP6_MEMBERSHIP_REPORT 131 /* group membership report */
	#define MLD6_LISTENER_REPORT 131 /* multicast listener report */
	-#define ICMP6_MEMBERSHIP_REDUCTION 132 /* group membership termination */
	#define MLD6_LISTENER_DONE 132 /* multicast listener done */

	#define ND_ROUTER_SOLICIT 133 /* router solicitation */
	@@ -115,11 +112,7 @@

	#define ICMP6_ROUTER_RENUMBERING 138 /* router renumbering */

	-#define ICMP6_WRUREQUEST 139 /* who are you request */
	-#define ICMP6_WRUREPLY 140 /* who are you reply */
	-#define ICMP6_FQDN_QUERY 139 /* FQDN query */
	-#define ICMP6_FQDN_REPLY 140 /* FQDN reply */
	-#define ICMP6_NI_QUERY 139 /* node information request - RFC 4620 */
	+#define ICMP6_NI_QUERY 139 /* node information query - RFC 4620 */
	#define ICMP6_NI_REPLY 140 /* node information reply - RFC 4620 */
	#define IND_SOLICIT 141 /* inverse neighbor solicitation */
	#define IND_ADVERT 142 /* inverse neighbor advertisement */
	@@ -385,10 +378,9 @@
	#define ni_qtype icmp6_ni_hdr.icmp6_data16[0]
	#define ni_flags icmp6_ni_hdr.icmp6_data16[1]

	-#define NI_QTYPE_NOOP 0 /* NOOP */
	-#define NI_QTYPE_SUPTYPES 1 /* Supported Qtypes (drafts up to 09) */
	-#define NI_QTYPE_FQDN 2 /* FQDN (draft 04) */
	-#define NI_QTYPE_DNSNAME 2 /* DNS Name */
	+#define NI_QTYPE_NOOP 0 /* NOOP */
	+#define NI_QTYPE_SUPTYPES 1 /* Supported Qtypes (Obsolete) */
	+#define NI_QTYPE_NODENAME 2 /* Node Name */
	#define NI_QTYPE_NODEADDR 3 /* Node Addresses */
	#define NI_QTYPE_IPV4ADDR 4 /* IPv4 Addresses */

	@@ -398,7 +390,22 @@
	#define NI_NODEADDR_FLAG_LINKLOCAL 0x0008
	#define NI_NODEADDR_FLAG_SITELOCAL 0x0010
	#define NI_NODEADDR_FLAG_GLOBAL 0x0020
	-#define NI_NODEADDR_FLAG_ANYCAST 0x0040 /* just experimental. not in spec */
	+
	+static const struct tok ni_nodeaddr_flag_values[] = {
	+ { NI_NODEADDR_FLAG_TRUNCATE, "T" },
	+ { NI_NODEADDR_FLAG_ALL, "A" },
	+ { NI_NODEADDR_FLAG_COMPAT, "C" },
	+ { NI_NODEADDR_FLAG_LINKLOCAL, "L" },
	+ { NI_NODEADDR_FLAG_SITELOCAL, "S" },
	+ { NI_NODEADDR_FLAG_GLOBAL, "G" },
	+ { 0, NULL }
	+};
	+
	+static const struct tok ni_ipv4addr_flag_values[] = {
	+ { NI_NODEADDR_FLAG_TRUNCATE, "T" },
	+ { NI_NODEADDR_FLAG_ALL, "A" },
	+ { 0, NULL }
	+};

	struct ni_reply_fqdn {
	nd_uint32_t ni_fqdn_ttl; /* TTL */
	@@ -422,6 +429,15 @@
	#define ICMP6_RR_FLAGS_SPECSITE 0x10
	#define ICMP6_RR_FLAGS_PREVDONE 0x08

	+static const struct tok router_renum_flag_values[] = {
	+ { ICMP6_RR_FLAGS_TEST, "T" },
	+ { ICMP6_RR_FLAGS_REQRESULT, "R" },
	+ { ICMP6_RR_FLAGS_FORCEAPPLY, "A" },
	+ { ICMP6_RR_FLAGS_SPECSITE, "S" },
	+ { ICMP6_RR_FLAGS_PREVDONE, "P" },
	+ { 0, NULL },
	+};
	+
	#define rr_type rr_hdr.icmp6_type
	#define rr_code rr_hdr.icmp6_code
	#define rr_cksum rr_hdr.icmp6_cksum
	@@ -659,8 +675,6 @@
	{ ICMP6_HADISCOV_REPLY, "ha discovery reply"},
	{ ICMP6_MOBILEPREFIX_SOLICIT, "mobile router solicitation"},
	{ ICMP6_MOBILEPREFIX_ADVERT, "mobile router advertisement"},
	- { ICMP6_WRUREQUEST, "who-are-you request"},
	- { ICMP6_WRUREPLY, "who-are-you reply"},
	{ ICMP6_NI_QUERY, "node information query"},
	{ ICMP6_NI_REPLY, "node information reply"},
	{ MLD6_MTRACE, "mtrace message"},
	@@ -1152,7 +1166,7 @@
	ND_PRINT(", id %u, seq %u", GET_BE_U_2(dp->icmp6_id),
	GET_BE_U_2(dp->icmp6_seq));
	break;
	- case ICMP6_MEMBERSHIP_QUERY:
	+ case MLD6_LISTENER_QUERY:
	if (length == MLD_MINLEN) {
	mld6_print(ndo, (const u_char *)dp);
	} else if (length >= MLDV2_MINLEN) {
	@@ -1162,10 +1176,10 @@
	ND_PRINT(" unknown-version (len %u) ", length);
	}
	break;
	- case ICMP6_MEMBERSHIP_REPORT:
	+ case MLD6_LISTENER_REPORT:
	mld6_print(ndo, (const u_char *)dp);
	break;
	- case ICMP6_MEMBERSHIP_REDUCTION:
	+ case MLD6_LISTENER_DONE:
	mld6_print(ndo, (const u_char *)dp);
	break;
	case ND_ROUTER_SOLICIT:
	@@ -1700,6 +1714,7 @@
	const struct icmp6_hdr *dp;
	const u_char *cp;
	size_t siz, i;
	+ uint16_t flags;
	int needcomma;

	if (ep < bp)
	@@ -1715,7 +1730,6 @@
	ND_PRINT(" who-are-you request");
	break;
	}
	- ND_PRINT(" node information query");

	ND_TCHECK_LEN(dp, sizeof(*ni6));
	ni6 = (const struct icmp6_nodeinfo *)dp;
	@@ -1724,36 +1738,35 @@
	case NI_QTYPE_NOOP:
	ND_PRINT("noop");
	break;
	- case NI_QTYPE_SUPTYPES:
	- ND_PRINT("supported qtypes");
	- i = GET_BE_U_2(ni6->ni_flags);
	- if (i)
	- ND_PRINT(" [%s]", (i & 0x01) ? "C" : "");
	- break;
	- case NI_QTYPE_FQDN:
	- ND_PRINT("DNS name");
	+ case NI_QTYPE_NODENAME:
	+ ND_PRINT("node name");
	break;
	case NI_QTYPE_NODEADDR:
	ND_PRINT("node addresses");
	- i = GET_BE_U_2(ni6->ni_flags);
	- if (!i)
	- break;
	- /* NI_NODEADDR_FLAG_TRUNCATE undefined for query */
	- ND_PRINT(" [%s%s%s%s%s%s]",
	- (i & NI_NODEADDR_FLAG_ANYCAST) ? "a" : "",
	- (i & NI_NODEADDR_FLAG_GLOBAL) ? "G" : "",
	- (i & NI_NODEADDR_FLAG_SITELOCAL) ? "S" : "",
	- (i & NI_NODEADDR_FLAG_LINKLOCAL) ? "L" : "",
	- (i & NI_NODEADDR_FLAG_COMPAT) ? "C" : "",
	- (i & NI_NODEADDR_FLAG_ALL) ? "A" : "");
	+ flags = GET_BE_U_2(ni6->ni_flags);
	+ if (flags)
	+ ND_PRINT(" [%s]",
	+ bittok2str_nosep(ni_nodeaddr_flag_values,
	+ "none", flags));
	+ if (flags & NI_NODEADDR_FLAG_TRUNCATE)
	+ ND_PRINT(" [invalid flag Truncate present]");
	+ break;
	+ case NI_QTYPE_IPV4ADDR:
	+ ND_PRINT("ipv4 addresses");
	+ flags = GET_BE_U_2(ni6->ni_flags);
	+ if (flags)
	+ ND_PRINT(" [%s]",
	+ bittok2str_nosep(ni_ipv4addr_flag_values,
	+ "none", flags));
	+ if (flags & NI_NODEADDR_FLAG_TRUNCATE)
	+ ND_PRINT(" [invalid flag Truncate present]");
	break;
	default:
	ND_PRINT("unknown");
	break;
	}

	- if (GET_BE_U_2(ni6->ni_qtype) == NI_QTYPE_NOOP \|\|
	- GET_BE_U_2(ni6->ni_qtype) == NI_QTYPE_SUPTYPES) {
	+ if (GET_BE_U_2(ni6->ni_qtype) == NI_QTYPE_NOOP) {
	if (siz != sizeof(*ni6))
	if (ndo->ndo_vflag)
	ND_PRINT(", invalid len");
	@@ -1762,14 +1775,6 @@
	break;
	}

	- /* XXX backward compat, icmp-name-lookup-03 */
	- if (siz == sizeof(*ni6)) {
	- ND_PRINT(", 03 draft");
	- /(/
	- ND_PRINT(")");
	- break;
	- }
	-
	cp = (const u_char *)(ni6 + 1);
	switch (GET_U_1(ni6->ni_code)) {
	case ICMP6_NI_SUBJ_IPV6:
	@@ -1785,19 +1790,7 @@
	break;
	case ICMP6_NI_SUBJ_FQDN:
	ND_PRINT(", subject=DNS name");
	- if (GET_U_1(cp) == ep - cp - 1) {
	- /* icmp-name-lookup-03, pascal string */
	- if (ndo->ndo_vflag)
	- ND_PRINT(", 03 draft");
	- cp++;
	- ND_PRINT(", \"");
	- while (cp < ep) {
	- fn_print_char(ndo, GET_U_1(cp));
	- cp++;
	- }
	- ND_PRINT("\"");
	- } else
	- dnsname_print(ndo, cp, ep);
	+ dnsname_print(ndo, cp, ep);
	break;
	case ICMP6_NI_SUBJ_IPV4:
	if (!ND_TTEST_LEN(dp, sizeof(*ni6) + sizeof(nd_ipv4)))
	@@ -1827,7 +1820,6 @@

	ND_TCHECK_LEN(dp, sizeof(*ni6));
	ni6 = (const struct icmp6_nodeinfo *)dp;
	- ND_PRINT(" node information reply");
	ND_PRINT(" ("); /)/
	switch (GET_U_1(ni6->ni_code)) {
	case ICMP6_NI_SUCCESS:
	@@ -1867,32 +1859,12 @@
	if (ndo->ndo_vflag)
	ND_PRINT(", invalid length");
	break;
	- case NI_QTYPE_SUPTYPES:
	+ case NI_QTYPE_NODENAME:
	if (needcomma)
	ND_PRINT(", ");
	- ND_PRINT("supported qtypes");
	- i = GET_BE_U_2(ni6->ni_flags);
	- if (i)
	- ND_PRINT(" [%s]", (i & 0x01) ? "C" : "");
	- break;
	- case NI_QTYPE_FQDN:
	- if (needcomma)
	- ND_PRINT(", ");
	- ND_PRINT("DNS name");
	+ ND_PRINT("node name");
	cp = (const u_char *)(ni6 + 1) + 4;
	- if (GET_U_1(cp) == ep - cp - 1) {
	- /* icmp-name-lookup-03, pascal string */
	- if (ndo->ndo_vflag)
	- ND_PRINT(", 03 draft");
	- cp++;
	- ND_PRINT(", \"");
	- while (cp < ep) {
	- fn_print_char(ndo, GET_U_1(cp));
	- cp++;
	- }
	- ND_PRINT("\"");
	- } else
	- dnsname_print(ndo, cp, ep);
	+ dnsname_print(ndo, cp, ep);
	if ((GET_BE_U_2(ni6->ni_flags) & 0x01) != 0)
	ND_PRINT(" [TTL=%u]", GET_BE_U_4(ni6 + 1));
	break;
	@@ -1900,6 +1872,11 @@
	if (needcomma)
	ND_PRINT(", ");
	ND_PRINT("node addresses");
	+ flags = GET_BE_U_2(ni6->ni_flags);
	+ if (flags)
	+ ND_PRINT(" [%s]",
	+ bittok2str_nosep(ni_nodeaddr_flag_values,
	+ "none", flags));
	i = sizeof(*ni6);
	while (i < siz) {
	if (i + sizeof(uint32_t) + sizeof(nd_ipv6) > siz)
	@@ -1909,17 +1886,25 @@
	GET_BE_U_4(bp + i));
	i += sizeof(uint32_t) + sizeof(nd_ipv6);
	}
	- i = GET_BE_U_2(ni6->ni_flags);
	- if (!i)
	- break;
	- ND_PRINT(" [%s%s%s%s%s%s%s]",
	- (i & NI_NODEADDR_FLAG_ANYCAST) ? "a" : "",
	- (i & NI_NODEADDR_FLAG_GLOBAL) ? "G" : "",
	- (i & NI_NODEADDR_FLAG_SITELOCAL) ? "S" : "",
	- (i & NI_NODEADDR_FLAG_LINKLOCAL) ? "L" : "",
	- (i & NI_NODEADDR_FLAG_COMPAT) ? "C" : "",
	- (i & NI_NODEADDR_FLAG_ALL) ? "A" : "",
	- (i & NI_NODEADDR_FLAG_TRUNCATE) ? "T" : "");
	+ break;
	+ case NI_QTYPE_IPV4ADDR:
	+ if (needcomma)
	+ ND_PRINT(", ");
	+ ND_PRINT("ipv4 addresses");
	+ flags = GET_BE_U_2(ni6->ni_flags);
	+ if (flags)
	+ ND_PRINT(" [%s]",
	+ bittok2str_nosep(ni_nodeaddr_flag_values,
	+ "none", flags));
	+ cp = (const u_char *)(ni6 + 1);
	+ while (cp < ep) {
	+ uint32_t ttl;
	+
	+ ttl = GET_BE_U_4(cp);
	+ cp += 4;
	+ ND_PRINT(" %s(%u)", GET_IPADDR_STRING(cp), ttl);
	+ cp += 4;
	+ }
	break;
	default:
	if (needcomma)
	@@ -1973,14 +1958,11 @@

	if (ndo->ndo_vflag) {
	uint8_t rr_flags = GET_U_1(rr6->rr_flags);
	-#define F(x, y) (rr_flags & (x) ? (y) : "")
	ND_PRINT("["); /]/
	if (rr_flags) {
	- ND_PRINT("%s%s%s%s%s,", F(ICMP6_RR_FLAGS_TEST, "T"),
	- F(ICMP6_RR_FLAGS_REQRESULT, "R"),
	- F(ICMP6_RR_FLAGS_FORCEAPPLY, "A"),
	- F(ICMP6_RR_FLAGS_SPECSITE, "S"),
	- F(ICMP6_RR_FLAGS_PREVDONE, "P"));
	+ ND_PRINT("%s,",
	+ bittok2str_nosep(router_renum_flag_values,
	+ "none", rr_flags));
	}
	ND_PRINT("seg=%u,", GET_U_1(rr6->rr_segnum));
	ND_PRINT("maxdelay=%u", GET_BE_U_2(rr6->rr_maxdelay));
	@@ -1988,7 +1970,6 @@
	ND_PRINT("rsvd=0x%x", GET_BE_U_4(rr6->rr_reserved));
	/[/
	ND_PRINT("]");
	-#undef F
	}

	if (GET_U_1(rr6->rr_code) == ICMP6_ROUTER_RENUMBERING_COMMAND) {
	diff --git a/contrib/tcpdump/print-ip.c b/contrib/tcpdump/print-ip.c
	--- a/contrib/tcpdump/print-ip.c
	+++ b/contrib/tcpdump/print-ip.c
	@@ -353,14 +353,19 @@
	/* we guess that it is a TSO send */
	len = length;
	presumed_tso = 1;
	- } else
	- ND_ICHECKMSG_U("total length", len, <, hlen);
	+ }
	+ if (len < hlen) {
	+ ND_PRINT("[total length %u < header length %u]", len, hlen);
	+ goto invalid;
	+ }

	ND_TCHECK_SIZE(ip);
	/*
	- * Cut off the snapshot length to the end of the IP payload.
	+ * Cut off the snapshot length to the end of the IP payload
	+ * or the end of the data in which it's contained, whichever
	+ * comes first.
	*/
	- if (!nd_push_snaplen(ndo, bp, len)) {
	+ if (!nd_push_snaplen(ndo, bp, ND_MIN(length, len))) {
	(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
	"%s: can't push snaplen on buffer stack", __func__);
	}
	@@ -414,7 +419,7 @@
	else
	ND_PRINT(", length %u", GET_BE_U_2(ip->ip_len));

	- if ((hlen - sizeof(struct ip)) > 0) {
	+ if ((hlen > sizeof(struct ip))) {
	ND_PRINT(", options (");
	if (ip_optprint(ndo, (const u_char *)(ip + 1),
	hlen - sizeof(struct ip)) == -1) {
	@@ -424,7 +429,7 @@
	ND_PRINT(")");
	}

	- if (!ndo->ndo_Kflag && (const u_char *)ip + hlen <= ndo->ndo_snapend) {
	+ if (!ndo->ndo_Kflag && ND_TTEST_LEN((const u_char *)ip, hlen)) {
	vec[0].ptr = (const uint8_t )(const void )ip;
	vec[0].len = hlen;
	sum = in_cksum(vec, 1);
	@@ -435,7 +440,10 @@
	}
	}

	- ND_PRINT(")\n ");
	+ if (ndo->ndo_gflag)
	+ ND_PRINT(") ");
	+ else
	+ ND_PRINT(")\n ");
	if (truncated) {
	ND_PRINT("%s > %s: ",
	GET_IPADDR_STRING(ip->ip_src),
	diff --git a/contrib/tcpdump/print-ip6.c b/contrib/tcpdump/print-ip6.c
	--- a/contrib/tcpdump/print-ip6.c
	+++ b/contrib/tcpdump/print-ip6.c
	@@ -292,7 +292,7 @@
	if (flow & 0x000fffff)
	ND_PRINT("flowlabel 0x%05x, ", flow & 0x000fffff);

	- ND_PRINT("hlim %u, next-header %s (%u) payload length: %u) ",
	+ ND_PRINT("hlim %u, next-header %s (%u), payload length %u) ",
	GET_U_1(ip6->ip6_hlim),
	tok2str(ipproto_values,"unknown",nh),
	nh,
	@@ -301,9 +301,11 @@
	ND_TCHECK_SIZE(ip6);

	/*
	- * Cut off the snapshot length to the end of the IP payload.
	+ * Cut off the snapshot length to the end of the IP payload
	+ * or the end of the data in which it's contained, whichever
	+ * comes first.
	*/
	- if (!nd_push_snaplen(ndo, bp, len)) {
	+ if (!nd_push_snaplen(ndo, bp, ND_MIN(length, len))) {
	(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
	"%s: can't push snaplen on buffer stack", __func__);
	}
	diff --git a/contrib/tcpdump/print-ip6opts.c b/contrib/tcpdump/print-ip6opts.c
	--- a/contrib/tcpdump/print-ip6opts.c
	+++ b/contrib/tcpdump/print-ip6opts.c
	@@ -33,6 +33,7 @@

	#include "netdissect-stdinc.h"

	+#define ND_LONGJMP_FROM_TCHECK
	#include "netdissect.h"
	#include "addrtoname.h"
	#include "extract.h"
	@@ -40,107 +41,84 @@
	#include "ip6.h"

	static int
	-ip6_sopt_print(netdissect_options ndo, const u_char bp, int len)
	+ip6_sopt_print(netdissect_options ndo, const u_char bp, const u_int len)
	{
	- int i;
	- int optlen;
	+ unsigned int i, opttype, optlen;

	for (i = 0; i < len; i += optlen) {
	- if (GET_U_1(bp + i) == IP6OPT_PAD1)
	+ opttype = GET_U_1(bp + i);
	+ if (opttype == IP6OPT_PAD1)
	optlen = 1;
	else {
	- if (i + 1 < len)
	- optlen = GET_U_1(bp + i + 1) + 2;
	- else
	- goto trunc;
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6OPT_MINLEN);
	+ optlen = GET_U_1(bp + i + 1) + 2;
	}
	- if (i + optlen > len)
	- goto trunc;
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
	+ ND_TCHECK_LEN(bp + i, optlen);

	- switch (GET_U_1(bp + i)) {
	+ switch (opttype) {
	case IP6OPT_PAD1:
	ND_PRINT(", pad1");
	break;
	case IP6OPT_PADN:
	- if (len - i < IP6OPT_MINLEN) {
	- ND_PRINT(", padn: trunc");
	- goto trunc;
	- }
	ND_PRINT(", padn");
	break;
	default:
	- if (len - i < IP6OPT_MINLEN) {
	- ND_PRINT(", sopt_type %u: trunc)", GET_U_1(bp + i));
	- goto trunc;
	- }
	- ND_PRINT(", sopt_type 0x%02x: len=%u", GET_U_1(bp + i),
	- GET_U_1(bp + i + 1));
	+ ND_PRINT(", unknown subopt-type 0x%02x len=%u", opttype, optlen - 2);
	break;
	}
	}
	return 0;

	-trunc:
	+invalid:
	return -1;
	}

	static int
	-ip6_opt_process(netdissect_options ndo, const u_char bp, int len,
	+ip6_opt_process(netdissect_options ndo, const u_char bp, const u_int len,
	int found_jumbop, uint32_t payload_len)
	{
	- int i;
	- int optlen = 0;
	+ unsigned int i, opttype, optlen;
	int found_jumbo = 0;
	uint32_t jumbolen = 0;

	if (len == 0)
	return 0;
	for (i = 0; i < len; i += optlen) {
	- if (GET_U_1(bp + i) == IP6OPT_PAD1)
	+ opttype = GET_U_1(bp + i);
	+ if (opttype == IP6OPT_PAD1)
	optlen = 1;
	else {
	- if (i + 1 < len)
	- optlen = GET_U_1(bp + i + 1) + 2;
	- else
	- goto trunc;
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6OPT_MINLEN);
	+ optlen = GET_U_1(bp + i + 1) + 2;
	}
	- if (i + optlen > len)
	- goto trunc;
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
	+ ND_TCHECK_LEN(bp + i, optlen);

	- switch (GET_U_1(bp + i)) {
	+ switch (opttype) {
	case IP6OPT_PAD1:
	if (ndo->ndo_vflag)
	ND_PRINT("(pad1)");
	break;
	case IP6OPT_PADN:
	- if (len - i < IP6OPT_MINLEN) {
	- ND_PRINT("(padn: trunc)");
	- goto trunc;
	- }
	if (ndo->ndo_vflag)
	ND_PRINT("(padn)");
	break;
	case IP6OPT_ROUTER_ALERT:
	- if (len - i < IP6OPT_RTALERT_LEN) {
	- ND_PRINT("(rtalert: trunc)");
	- goto trunc;
	- }
	- if (GET_U_1(bp + i + 1) != IP6OPT_RTALERT_LEN - 2) {
	- ND_PRINT("(rtalert: invalid len %u)", GET_U_1(bp + i + 1));
	- goto trunc;
	- }
	+ ND_ICHECKMSG_U("(rtalert) remaining length", (u_int)(len - i), <,
	+ IP6OPT_RTALERT_LEN);
	+ ND_ICHECKMSG_U("(rtalert) length", optlen - 2, !=,
	+ IP6OPT_RTALERT_LEN - 2);
	if (ndo->ndo_vflag)
	ND_PRINT("(rtalert: 0x%04x) ", GET_BE_U_2(bp + i + 2));
	break;
	case IP6OPT_JUMBO:
	- if (len - i < IP6OPT_JUMBO_LEN) {
	- ND_PRINT("(jumbo: trunc)");
	- goto trunc;
	- }
	- if (GET_U_1(bp + i + 1) != IP6OPT_JUMBO_LEN - 2) {
	- ND_PRINT("(jumbo: invalid len %u)", GET_U_1(bp + i + 1));
	- goto trunc;
	- }
	+ ND_ICHECKMSG_U("(jumbo) remaining length", (u_int)(len - i), <,
	+ IP6OPT_JUMBO_LEN);
	+ ND_ICHECKMSG_U("(jumbo) length", optlen - 2, !=,
	+ IP6OPT_JUMBO_LEN - 2);
	jumbolen = GET_BE_U_4(bp + i + 2);
	if (found_jumbo) {
	/* More than one Jumbo Payload option */
	@@ -176,32 +154,23 @@
	}
	break;
	case IP6OPT_HOME_ADDRESS:
	- if (len - i < IP6OPT_HOMEADDR_MINLEN) {
	- ND_PRINT("(homeaddr: trunc)");
	- goto trunc;
	- }
	- if (GET_U_1(bp + i + 1) < IP6OPT_HOMEADDR_MINLEN - 2) {
	- ND_PRINT("(homeaddr: invalid len %u)", GET_U_1(bp + i + 1));
	- goto trunc;
	- }
	+ ND_ICHECKMSG_U("(homeaddr) remaining length", (u_int)(len - i), <,
	+ IP6OPT_HOMEADDR_MINLEN);
	+ ND_ICHECKMSG_U("(homeaddr) length", optlen - 2, <,
	+ IP6OPT_HOMEADDR_MINLEN - 2);
	if (ndo->ndo_vflag) {
	ND_PRINT("(homeaddr: %s", GET_IP6ADDR_STRING(bp + i + 2));
	- if (GET_U_1(bp + i + 1) > IP6OPT_HOMEADDR_MINLEN - 2) {
	+ if (optlen > IP6OPT_HOMEADDR_MINLEN) {
	if (ip6_sopt_print(ndo, bp + i + IP6OPT_HOMEADDR_MINLEN,
	(optlen - IP6OPT_HOMEADDR_MINLEN)) == -1)
	- goto trunc;
	+ goto invalid;
	}
	ND_PRINT(")");
	}
	break;
	default:
	- if (len - i < IP6OPT_MINLEN) {
	- ND_PRINT("(type %u: trunc)", GET_U_1(bp + i));
	- goto trunc;
	- }
	if (ndo->ndo_vflag)
	- ND_PRINT("(opt_type 0x%02x: len=%u)", GET_U_1(bp + i),
	- GET_U_1(bp + i + 1));
	+ ND_PRINT("(unknown opt-type 0x%02x len=%u)", opttype, optlen - 2);
	break;
	}
	}
	@@ -209,7 +178,7 @@
	ND_PRINT(" ");
	return 0;

	-trunc:
	+invalid:
	return -1;
	}

	@@ -220,17 +189,18 @@
	const struct ip6_hbh dp = (const struct ip6_hbh )bp;
	u_int hbhlen = 0;

	- ndo->ndo_protocol = "hbhopt";
	+ ndo->ndo_protocol = "hbh";
	hbhlen = (GET_U_1(dp->ip6h_len) + 1) << 3;
	ND_TCHECK_LEN(dp, hbhlen);
	- ND_PRINT("HBH ");
	+ nd_print_protocol_caps(ndo);
	+ ND_PRINT(" ");
	if (ip6_opt_process(ndo, (const u_char )dp + sizeof(dp),
	hbhlen - sizeof(*dp), found_jumbo, jumbolen) == -1)
	- goto trunc;
	+ goto invalid;
	return hbhlen;

	-trunc:
	- nd_print_trunc(ndo);
	+invalid:
	+ nd_print_invalid(ndo);
	return -1;
	}

	@@ -243,7 +213,8 @@
	ndo->ndo_protocol = "dstopt";
	dstoptlen = (GET_U_1(dp->ip6d_len) + 1) << 3;
	ND_TCHECK_LEN(dp, dstoptlen);
	- ND_PRINT("DSTOPT ");
	+ nd_print_protocol_caps(ndo);
	+ ND_PRINT(" ");
	if (ndo->ndo_vflag) {
	/*
	* The Jumbo Payload option is a hop-by-hop option; we don't
	@@ -252,12 +223,12 @@
	*/
	if (ip6_opt_process(ndo, (const u_char )dp + sizeof(dp),
	dstoptlen - sizeof(*dp), NULL, NULL) == -1)
	- goto trunc;
	+ goto invalid;
	}

	return dstoptlen;

	-trunc:
	- nd_print_trunc(ndo);
	+invalid:
	+ nd_print_invalid(ndo);
	return -1;
	}
	diff --git a/contrib/tcpdump/print-isakmp.c b/contrib/tcpdump/print-isakmp.c
	--- a/contrib/tcpdump/print-isakmp.c
	+++ b/contrib/tcpdump/print-isakmp.c
	@@ -113,9 +113,9 @@
	#define ISAKMP_FLAG_extra 0x04

	/* IKEv2 */
	-#define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */
	-#define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */
	-#define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */
	+#define ISAKMP_FLAG_I (1 << 3) /* Initiator */
	+#define ISAKMP_FLAG_V (1 << 4) /* Version */
	+#define ISAKMP_FLAG_R (1 << 5) /* Response */


	/* 3.2 Payload Generic Header
	@@ -234,7 +234,7 @@
	Certificate Types (variable length)
	-- Contains a list of the types of certificates requested,
	sorted in order of preference. Each individual certificate
	- type is 1 octet. This field is NOT requiredo
	+ type is 1 octet. This field is NOT required.
	*/
	/* # Certificate Authorities (1 octet) */
	/* Certificate Authorities (variable length) */
	diff --git a/contrib/tcpdump/print-isoclns.c b/contrib/tcpdump/print-isoclns.c
	--- a/contrib/tcpdump/print-isoclns.c
	+++ b/contrib/tcpdump/print-isoclns.c
	@@ -1794,7 +1794,7 @@

	static int
	isis_print_tlv_ip_reach(netdissect_options *ndo,
	- const uint8_t cp, const char ident, u_int length)
	+ const uint8_t cp, const char indent, u_int length)
	{
	int prefix_len;
	const struct isis_tlv_ip_reach *tlv_ip_reach;
	@@ -1815,12 +1815,12 @@

	if (prefix_len == -1)
	ND_PRINT("%sIPv4 prefix: %s mask %s",
	- ident,
	+ indent,
	GET_IPADDR_STRING(tlv_ip_reach->prefix),
	GET_IPADDR_STRING(tlv_ip_reach->mask));
	else
	ND_PRINT("%sIPv4 prefix: %15s/%u",
	- ident,
	+ indent,
	GET_IPADDR_STRING(tlv_ip_reach->prefix),
	prefix_len);

	@@ -1831,19 +1831,19 @@

	if (!ISIS_LSP_TLV_METRIC_SUPPORTED(tlv_ip_reach->isis_metric_block.metric_delay))
	ND_PRINT("%s Delay Metric: %u, %s",
	- ident,
	+ indent,
	ISIS_LSP_TLV_METRIC_VALUE(tlv_ip_reach->isis_metric_block.metric_delay),
	ISIS_LSP_TLV_METRIC_IE(tlv_ip_reach->isis_metric_block.metric_delay) ? "External" : "Internal");

	if (!ISIS_LSP_TLV_METRIC_SUPPORTED(tlv_ip_reach->isis_metric_block.metric_expense))
	ND_PRINT("%s Expense Metric: %u, %s",
	- ident,
	+ indent,
	ISIS_LSP_TLV_METRIC_VALUE(tlv_ip_reach->isis_metric_block.metric_expense),
	ISIS_LSP_TLV_METRIC_IE(tlv_ip_reach->isis_metric_block.metric_expense) ? "External" : "Internal");

	if (!ISIS_LSP_TLV_METRIC_SUPPORTED(tlv_ip_reach->isis_metric_block.metric_error))
	ND_PRINT("%s Error Metric: %u, %s",
	- ident,
	+ indent,
	ISIS_LSP_TLV_METRIC_VALUE(tlv_ip_reach->isis_metric_block.metric_error),
	ISIS_LSP_TLV_METRIC_IE(tlv_ip_reach->isis_metric_block.metric_error) ? "External" : "Internal");

	@@ -1863,11 +1863,11 @@
	static int
	isis_print_ip_reach_subtlv(netdissect_options *ndo,
	const uint8_t *tptr, u_int subt, u_int subl,
	- const char *ident)
	+ const char *indent)
	{
	/* first lets see if we know the subTLVs name*/
	ND_PRINT("%s%s subTLV #%u, length: %u",
	- ident, tok2str(isis_ext_ip_reach_subtlv_values, "unknown", subt),
	+ indent, tok2str(isis_ext_ip_reach_subtlv_values, "unknown", subt),
	subt, subl);

	ND_TCHECK_LEN(tptr, subl);
	@@ -1940,10 +1940,10 @@

	static int
	isis_print_ext_is_reach(netdissect_options *ndo,
	- const uint8_t tptr, const char ident, u_int tlv_type,
	+ const uint8_t tptr, const char indent, u_int tlv_type,
	u_int tlv_remaining)
	{
	- char ident_buffer[20];
	+ char indent_buffer[20];
	u_int subtlv_type,subtlv_len,subtlv_sum_len;
	int proc_bytes = 0; /* how many bytes did we process ? */
	u_int te_class,priority_level,gmpls_switch_cap;
	@@ -1956,7 +1956,7 @@
	if (tlv_remaining < NODE_ID_LEN)
	return(0);

	- ND_PRINT("%sIS Neighbor: %s", ident, isis_print_id(ndo, tptr, NODE_ID_LEN));
	+ ND_PRINT("%sIS Neighbor: %s", indent, isis_print_id(ndo, tptr, NODE_ID_LEN));
	tptr+=NODE_ID_LEN;
	tlv_remaining-=NODE_ID_LEN;
	proc_bytes+=NODE_ID_LEN;
	@@ -1982,17 +1982,17 @@
	if (subtlv_sum_len) {
	ND_PRINT(" (%u)", subtlv_sum_len);
	/* prepend the indent string */
	- snprintf(ident_buffer, sizeof(ident_buffer), "%s ",ident);
	- ident = ident_buffer;
	+ snprintf(indent_buffer, sizeof(indent_buffer), "%s ", indent);
	+ indent = indent_buffer;
	while (subtlv_sum_len != 0) {
	ND_TCHECK_2(tptr);
	if (tlv_remaining < 2) {
	- ND_PRINT("%sRemaining data in TLV shorter than a subTLV header",ident);
	+ ND_PRINT("%sRemaining data in TLV shorter than a subTLV header", indent);
	proc_bytes += tlv_remaining;
	break;
	}
	if (subtlv_sum_len < 2) {
	- ND_PRINT("%sRemaining data in subTLVs shorter than a subTLV header",ident);
	+ ND_PRINT("%sRemaining data in subTLVs shorter than a subTLV header", indent);
	proc_bytes += subtlv_sum_len;
	break;
	}
	@@ -2003,7 +2003,7 @@
	subtlv_sum_len -= 2;
	proc_bytes += 2;
	ND_PRINT("%s%s subTLV #%u, length: %u",
	- ident, tok2str(isis_ext_is_reach_subtlv_values, "unknown", subtlv_type),
	+ indent, tok2str(isis_ext_is_reach_subtlv_values, "unknown", subtlv_type),
	subtlv_type, subtlv_len);

	if (subtlv_sum_len < subtlv_len) {
	@@ -2047,7 +2047,7 @@
	for (te_class = 0; te_class < 8; te_class++) {
	bw.i = GET_BE_U_4(tptr);
	ND_PRINT("%s TE-Class %u: %.3f Mbps",
	- ident,
	+ indent,
	te_class,
	bw.f * 8 / 1000000);
	tptr += 4;
	@@ -2062,7 +2062,7 @@
	if (subtlv_len == 0)
	break;
	ND_PRINT("%sBandwidth Constraints Model ID: %s (%u)",
	- ident,
	+ indent,
	tok2str(diffserv_te_bc_values, "unknown", GET_U_1(tptr)),
	GET_U_1(tptr));
	tptr++;
	@@ -2075,7 +2075,7 @@
	break;
	bw.i = GET_BE_U_4(tptr);
	ND_PRINT("%s Bandwidth constraint CT%u: %.3f Mbps",
	- ident,
	+ indent,
	te_class,
	bw.f * 8 / 1000000);
	tptr += 4;
	@@ -2123,7 +2123,7 @@
	if (subtlv_len >= 36) {
	gmpls_switch_cap = GET_U_1(tptr);
	ND_PRINT("%s Interface Switching Capability:%s",
	- ident,
	+ indent,
	tok2str(gmpls_switch_cap_values, "Unknown", gmpls_switch_cap));
	ND_PRINT(", LSP Encoding: %s",
	tok2str(gmpls_encoding_values, "Unknown", GET_U_1((tptr + 1))));
	@@ -2131,11 +2131,11 @@
	subtlv_len -= 4;
	subtlv_sum_len -= 4;
	proc_bytes += 4;
	- ND_PRINT("%s Max LSP Bandwidth:", ident);
	+ ND_PRINT("%s Max LSP Bandwidth:", indent);
	for (priority_level = 0; priority_level < 8; priority_level++) {
	bw.i = GET_BE_U_4(tptr);
	ND_PRINT("%s priority level %u: %.3f Mbps",
	- ident,
	+ indent,
	priority_level,
	bw.f * 8 / 1000000);
	tptr += 4;
	@@ -2151,16 +2151,16 @@
	if (subtlv_len < 6)
	break;
	bw.i = GET_BE_U_4(tptr);
	- ND_PRINT("%s Min LSP Bandwidth: %.3f Mbps", ident, bw.f * 8 / 1000000);
	- ND_PRINT("%s Interface MTU: %u", ident,
	+ ND_PRINT("%s Min LSP Bandwidth: %.3f Mbps", indent, bw.f * 8 / 1000000);
	+ ND_PRINT("%s Interface MTU: %u", indent,
	GET_BE_U_2(tptr + 4));
	break;
	case GMPLS_TSC:
	if (subtlv_len < 8)
	break;
	bw.i = GET_BE_U_4(tptr);
	- ND_PRINT("%s Min LSP Bandwidth: %.3f Mbps", ident, bw.f * 8 / 1000000);
	- ND_PRINT("%s Indication %s", ident,
	+ ND_PRINT("%s Min LSP Bandwidth: %.3f Mbps", indent, bw.f * 8 / 1000000);
	+ ND_PRINT("%s Indication %s", indent,
	tok2str(gmpls_switch_cap_tsc_indication_values, "Unknown (%u)", GET_U_1((tptr + 4))));
	break;
	default:
	@@ -2175,7 +2175,7 @@
	break;
	case ISIS_SUBTLV_EXT_IS_REACH_LAN_ADJ_SEGMENT_ID:
	if (subtlv_len >= 8) {
	- ND_PRINT("%s Flags: [%s]", ident,
	+ ND_PRINT("%s Flags: [%s]", indent,
	bittok2str(isis_lan_adj_sid_flag_values,
	"none",
	GET_U_1(tptr)));
	@@ -2185,14 +2185,14 @@
	subtlv_len--;
	subtlv_sum_len--;
	proc_bytes++;
	- ND_PRINT("%s Weight: %u", ident, GET_U_1(tptr));
	+ ND_PRINT("%s Weight: %u", indent, GET_U_1(tptr));
	tptr++;
	subtlv_len--;
	subtlv_sum_len--;
	proc_bytes++;
	if(subtlv_len>=SYSTEM_ID_LEN) {
	ND_TCHECK_LEN(tptr, SYSTEM_ID_LEN);
	- ND_PRINT("%s Neighbor System-ID: %s", ident,
	+ ND_PRINT("%s Neighbor System-ID: %s", indent,
	isis_print_id(ndo, tptr, SYSTEM_ID_LEN));
	}
	/* RFC 8667 section 2.2.2 */
	@@ -2200,10 +2200,10 @@
	/* if V-flag is set to 0 and L-flag is set to 0 ==> 4 octet index */
	if (vflag && lflag) {
	ND_PRINT("%s Label: %u",
	- ident, GET_BE_U_3(tptr+SYSTEM_ID_LEN));
	+ indent, GET_BE_U_3(tptr+SYSTEM_ID_LEN));
	} else if ((!vflag) && (!lflag)) {
	ND_PRINT("%s Index: %u",
	- ident, GET_BE_U_4(tptr+SYSTEM_ID_LEN));
	+ indent, GET_BE_U_4(tptr+SYSTEM_ID_LEN));
	} else
	nd_print_invalid(ndo);
	}
	@@ -2233,13 +2233,13 @@

	static uint8_t
	isis_print_mtid(netdissect_options *ndo,
	- const uint8_t tptr, const char ident, u_int tlv_remaining)
	+ const uint8_t tptr, const char indent, u_int tlv_remaining)
	{
	if (tlv_remaining < 2)
	goto trunc;

	ND_PRINT("%s%s",
	- ident,
	+ indent,
	tok2str(isis_mt_values,
	"Reserved for IETF Consensus",
	ISIS_MASK_MTID(GET_BE_U_2(tptr))));
	@@ -2262,9 +2262,9 @@

	static u_int
	isis_print_extd_ip_reach(netdissect_options *ndo,
	- const uint8_t tptr, const char ident, uint16_t afi)
	+ const uint8_t tptr, const char indent, uint16_t afi)
	{
	- char ident_buffer[20];
	+ char indent_buffer[20];
	uint8_t prefix[sizeof(nd_ipv6)]; /* shared copy buffer for IPv4 and IPv6 prefixes */
	u_int metric, status_byte, bit_length, byte_length, sublen, processed, subtlvtype, subtlvlen;

	@@ -2278,7 +2278,7 @@
	bit_length = status_byte&0x3f;
	if (bit_length > 32) {
	ND_PRINT("%sIPv4 prefix: bad bit length %u",
	- ident,
	+ indent,
	bit_length);
	return (0);
	}
	@@ -2288,7 +2288,7 @@
	bit_length=GET_U_1(tptr + 1);
	if (bit_length > 128) {
	ND_PRINT("%sIPv6 prefix: bad bit length %u",
	- ident,
	+ indent,
	bit_length);
	return (0);
	}
	@@ -2306,12 +2306,12 @@

	if (afi == AF_INET)
	ND_PRINT("%sIPv4 prefix: %15s/%u",
	- ident,
	+ indent,
	ipaddr_string(ndo, prefix), /* local buffer, not packet data; don't use GET_IPADDR_STRING() */
	bit_length);
	else if (afi == AF_INET6)
	ND_PRINT("%sIPv6 prefix: %s/%u",
	- ident,
	+ indent,
	ip6addr_string(ndo, prefix), /* local buffer, not packet data; don't use GET_IP6ADDR_STRING() */
	bit_length);

	@@ -2343,8 +2343,8 @@
	subtlvlen=GET_U_1(tptr + 1);
	tptr+=2;
	/* prepend the indent string */
	- snprintf(ident_buffer, sizeof(ident_buffer), "%s ",ident);
	- if (!isis_print_ip_reach_subtlv(ndo, tptr, subtlvtype, subtlvlen, ident_buffer))
	+ snprintf(indent_buffer, sizeof(indent_buffer), "%s ", indent);
	+ if (!isis_print_ip_reach_subtlv(ndo, tptr, subtlvtype, subtlvlen, indent_buffer))
	return(0);
	tptr+=subtlvlen;
	sublen-=(subtlvlen+2);
	diff --git a/contrib/tcpdump/print-juniper.c b/contrib/tcpdump/print-juniper.c
	--- a/contrib/tcpdump/print-juniper.c
	+++ b/contrib/tcpdump/print-juniper.c
	@@ -1009,7 +1009,7 @@
	* ATM1 PIC cookie format
	*
	* +-----+-------------------------+-------------------------------+
	- * \|fmtid\| vc index \| channel ID \|
	+ * \|fmtid\| vc index \| channel ID \|
	* +-----+-------------------------+-------------------------------+
	*/

	@@ -1070,7 +1070,7 @@
	* ATM2 PIC cookie format
	*
	* +-------------------------------+---------+---+-----+-----------+
	- * \| channel ID \| reserv \|AAL\| CCRQ\| gap cnt \|
	+ * \| channel ID \|reserved \|AAL\| CCRQ\| gap count \|
	* +-------------------------------+---------+---+-----+-----------+
	*/

	diff --git a/contrib/tcpdump/print-lspping.c b/contrib/tcpdump/print-lspping.c
	--- a/contrib/tcpdump/print-lspping.c
	+++ b/contrib/tcpdump/print-lspping.c
	@@ -587,13 +587,12 @@
	GET_BE_U_4(lspping_com_header->sender_handle),
	GET_BE_U_4(lspping_com_header->seq_number));

	- ND_PRINT("\n\t Sender Timestamp: ");
	+ ND_PRINT("\n\t TimeStamp Sent: ");
	p_ntp_time(ndo, &lspping_com_header->ts_sent);
	- ND_PRINT(" ");

	int_part=GET_BE_U_4(lspping_com_header->ts_rcvd.int_part);
	fraction=GET_BE_U_4(lspping_com_header->ts_rcvd.fraction);
	- ND_PRINT("Receiver Timestamp: ");
	+ ND_PRINT("\n\t TimeStamp Received: ");
	if (! (int_part == 0 && fraction == 0))
	p_ntp_time(ndo, &lspping_com_header->ts_rcvd);
	else
	diff --git a/contrib/tcpdump/print-lwapp.c b/contrib/tcpdump/print-lwapp.c
	--- a/contrib/tcpdump/print-lwapp.c
	+++ b/contrib/tcpdump/print-lwapp.c
	@@ -73,9 +73,9 @@
	#define LWAPP_EXTRACT_CONTROL_BIT(x) (((x)&0x04)>>2)

	static const struct tok lwapp_header_bits_values[] = {
	- { 0x01, "Last Fragment Bit"},
	- { 0x02, "Fragment Bit"},
	- { 0x04, "Control Bit"},
	+ { 0x01, "Not Last"}, /* L Bit */
	+ { 0x02, "Fragment"}, /* F Bit */
	+ { 0x04, "Control"}, /* C Bit */
	{ 0, NULL}
	};

	@@ -188,18 +188,18 @@
	* Sanity checking of the header.
	*/
	if (LWAPP_EXTRACT_VERSION(version) != LWAPP_VERSION) {
	- ND_PRINT("LWAPP version %u packet not supported",
	- LWAPP_EXTRACT_VERSION(version));
	- return;
	+ ND_PRINT("LWAPP version %u packet not supported",
	+ LWAPP_EXTRACT_VERSION(version));
	+ return;
	}

	/* non-verbose */
	if (ndo->ndo_vflag < 1) {
	ND_PRINT("LWAPPv%u, %s frame, Flags [%s], length %u",
	- LWAPP_EXTRACT_VERSION(version),
	- LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	- bittok2str(lwapp_header_bits_values,"none",version&0x07),
	- len);
	+ LWAPP_EXTRACT_VERSION(version),
	+ LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	+ bittok2str(lwapp_header_bits_values,"none",version&0x07),
	+ len);
	return;
	}

	@@ -207,12 +207,12 @@
	tlen=GET_BE_U_2(lwapp_trans_header->length);

	ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
	- LWAPP_EXTRACT_VERSION(version),
	- LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	- LWAPP_EXTRACT_RID(version),
	- bittok2str(lwapp_header_bits_values,"none",version&0x07),
	- GET_U_1(lwapp_trans_header->frag_id),
	- tlen);
	+ LWAPP_EXTRACT_VERSION(version),
	+ LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	+ LWAPP_EXTRACT_RID(version),
	+ bittok2str(lwapp_header_bits_values,"none",version&0x07),
	+ GET_U_1(lwapp_trans_header->frag_id),
	+ tlen);

	if (has_ap_ident) {
	ND_PRINT("\n\tAP identity: %s", GET_ETHERADDR_STRING(tptr));
	@@ -231,25 +231,25 @@
	}

	lwapp_control_header = (const struct lwapp_control_header *)tptr;
	- msg_tlen = GET_BE_U_2(lwapp_control_header->len);
	+ msg_tlen = GET_BE_U_2(lwapp_control_header->len);
	if (tlen < sizeof(struct lwapp_control_header) + msg_tlen) {
	ND_PRINT("\n\t Msg goes past end of PDU");
	break;
	}

	- /* print message header */
	- msg_type = GET_U_1(lwapp_control_header->msg_type);
	+ /* print message header */
	+ msg_type = GET_U_1(lwapp_control_header->msg_type);
	ND_PRINT("\n\t Msg type: %s (%u), Seqnum: %u, Msg len: %u, Session: 0x%08x",
	- tok2str(lwapp_msg_type_values,"Unknown",msg_type),
	- msg_type,
	- GET_U_1(lwapp_control_header->seq_num),
	- msg_tlen,
	- GET_BE_U_4(lwapp_control_header->session_id));
	+ tok2str(lwapp_msg_type_values,"Unknown",msg_type),
	+ msg_type,
	+ GET_U_1(lwapp_control_header->seq_num),
	+ msg_tlen,
	+ GET_BE_U_4(lwapp_control_header->session_id));

	/* did we capture enough for fully decoding the message */
	ND_TCHECK_LEN(tptr, msg_tlen);

	- /* XXX - Decode sub messages for each message */
	+ /* XXX - Decode sub messages for each message */
	switch(msg_type) {
	case LWAPP_MSGTYPE_DISCOVERY_REQUEST:
	case LWAPP_MSGTYPE_DISCOVERY_RESPONSE:
	@@ -318,39 +318,39 @@
	*/
	if (LWAPP_EXTRACT_VERSION(version) != LWAPP_VERSION) {
	ND_PRINT("LWAPP version %u packet not supported",
	- LWAPP_EXTRACT_VERSION(version));
	+ LWAPP_EXTRACT_VERSION(version));
	return;
	}

	/* non-verbose */
	if (ndo->ndo_vflag < 1) {
	ND_PRINT("LWAPPv%u, %s frame, Flags [%s], length %u",
	- LWAPP_EXTRACT_VERSION(version),
	- LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	- bittok2str(lwapp_header_bits_values,"none",version&0x07),
	- len);
	+ LWAPP_EXTRACT_VERSION(version),
	+ LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	+ bittok2str(lwapp_header_bits_values,"none",version&0x07),
	+ len);
	return;
	}

	/* ok they seem to want to know everything - lets fully decode it */
	tlen=GET_BE_U_2(lwapp_trans_header->length);
	if (tlen < sizeof(struct lwapp_transport_header)) {
	- ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], length %u < transport header length",
	- LWAPP_EXTRACT_VERSION(version),
	- LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	- LWAPP_EXTRACT_RID(version),
	- bittok2str(lwapp_header_bits_values,"none",version&0x07),
	- tlen);
	+ ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], length %u < transport header length",
	+ LWAPP_EXTRACT_VERSION(version),
	+ LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	+ LWAPP_EXTRACT_RID(version),
	+ bittok2str(lwapp_header_bits_values,"none",version&0x07),
	+ tlen);
	return;
	}

	- ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
	- LWAPP_EXTRACT_VERSION(version),
	- LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	- LWAPP_EXTRACT_RID(version),
	- bittok2str(lwapp_header_bits_values,"none",version&0x07),
	- GET_U_1(lwapp_trans_header->frag_id),
	- tlen);
	+ ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
	+ LWAPP_EXTRACT_VERSION(version),
	+ LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
	+ LWAPP_EXTRACT_RID(version),
	+ bittok2str(lwapp_header_bits_values,"none",version&0x07),
	+ GET_U_1(lwapp_trans_header->frag_id),
	+ tlen);

	tptr+=sizeof(struct lwapp_transport_header);
	tlen-=sizeof(struct lwapp_transport_header);
	diff --git a/contrib/tcpdump/print-mobility.c b/contrib/tcpdump/print-mobility.c
	--- a/contrib/tcpdump/print-mobility.c
	+++ b/contrib/tcpdump/print-mobility.c
	@@ -28,19 +28,19 @@
	*/

	/* \summary: IPv6 mobility printer */
	-/* RFC 3775 */
	+/* RFC 6275 */

	#include <config.h>

	#include "netdissect-stdinc.h"

	+#define ND_LONGJMP_FROM_TCHECK
	#include "netdissect.h"
	#include "addrtoname.h"
	#include "extract.h"

	#include "ip6.h"

	-
	/* Mobility header */
	struct ip6_mobility {
	nd_uint8_t ip6m_pproto; /* following payload protocol (for PG) */
	@@ -90,8 +90,8 @@
	IP6M_MINLEN + 8, /* IP6M_CAREOF_TEST_INIT */
	IP6M_MINLEN + 16, /* IP6M_HOME_TEST */
	IP6M_MINLEN + 16, /* IP6M_CAREOF_TEST */
	- IP6M_MINLEN + 4, /* IP6M_BINDING_UPDATE */
	- IP6M_MINLEN + 4, /* IP6M_BINDING_ACK */
	+ IP6M_MINLEN + 8, /* IP6M_BINDING_UPDATE */
	+ IP6M_MINLEN + 8, /* IP6M_BINDING_ACK */
	IP6M_MINLEN + 16, /* IP6M_BINDING_ERROR */
	};

	@@ -120,78 +120,62 @@
	mobility_opt_print(netdissect_options *ndo,
	const u_char *bp, const unsigned len)
	{
	- unsigned i, optlen;
	+ unsigned i, opttype, optlen;

	for (i = 0; i < len; i += optlen) {
	- if (GET_U_1(bp + i) == IP6MOPT_PAD1)
	+ opttype = GET_U_1(bp + i);
	+ if (opttype == IP6MOPT_PAD1)
	optlen = 1;
	else {
	- if (i + 1 < len) {
	- optlen = GET_U_1(bp + i + 1) + 2;
	- } else
	- goto trunc;
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6MOPT_MINLEN);
	+ optlen = GET_U_1(bp + i + 1) + 2;
	}
	- if (i + optlen > len)
	- goto trunc;
	- ND_TCHECK_1(bp + i + optlen);
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
	+ ND_TCHECK_LEN(bp + i, optlen);

	- switch (GET_U_1(bp + i)) {
	+ switch (opttype) {
	case IP6MOPT_PAD1:
	ND_PRINT("(pad1)");
	break;
	case IP6MOPT_PADN:
	- if (len - i < IP6MOPT_MINLEN) {
	- ND_PRINT("(padn: trunc)");
	- goto trunc;
	- }
	ND_PRINT("(padn)");
	break;
	case IP6MOPT_REFRESH:
	- if (len - i < IP6MOPT_REFRESH_MINLEN) {
	- ND_PRINT("(refresh: trunc)");
	- goto trunc;
	- }
	+ ND_PRINT("(refresh: ");
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6MOPT_REFRESH_MINLEN);
	/* units of 4 secs */
	- ND_PRINT("(refresh: %u)",
	- GET_BE_U_2(bp + i + 2) << 2);
	+ ND_PRINT("%u)", GET_BE_U_2(bp + i + 2) << 2);
	break;
	case IP6MOPT_ALTCOA:
	- if (len - i < IP6MOPT_ALTCOA_MINLEN) {
	- ND_PRINT("(altcoa: trunc)");
	- goto trunc;
	- }
	- ND_PRINT("(alt-CoA: %s)", GET_IP6ADDR_STRING(bp + i + 2));
	+ ND_PRINT("(alt-CoA: ");
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6MOPT_ALTCOA_MINLEN);
	+ ND_PRINT("%s)", GET_IP6ADDR_STRING(bp + i + 2));
	break;
	case IP6MOPT_NONCEID:
	- if (len - i < IP6MOPT_NONCEID_MINLEN) {
	- ND_PRINT("(ni: trunc)");
	- goto trunc;
	- }
	- ND_PRINT("(ni: ho=0x%04x co=0x%04x)",
	- GET_BE_U_2(bp + i + 2),
	- GET_BE_U_2(bp + i + 4));
	+ ND_PRINT("(ni: ");
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6MOPT_NONCEID_MINLEN);
	+ ND_PRINT("ho=0x%04x co=0x%04x)",
	+ GET_BE_U_2(bp + i + 2),
	+ GET_BE_U_2(bp + i + 4));
	break;
	case IP6MOPT_AUTH:
	- if (len - i < IP6MOPT_AUTH_MINLEN) {
	- ND_PRINT("(auth: trunc)");
	- goto trunc;
	- }
	ND_PRINT("(auth)");
	+ ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
	+ IP6MOPT_AUTH_MINLEN);
	break;
	default:
	- if (len - i < IP6MOPT_MINLEN) {
	- ND_PRINT("(sopt_type %u: trunc)",
	- GET_U_1(bp + i));
	- goto trunc;
	- }
	- ND_PRINT("(type-0x%02x: len=%u)", GET_U_1(bp + i),
	- GET_U_1(bp + i + 1));
	+ ND_PRINT("(unknown: ");
	+ ND_PRINT("type-#%u len=%u)", opttype, optlen - 2);
	break;
	}
	}
	return 0;

	-trunc:
	+invalid:
	return 1;
	}

	@@ -203,42 +187,29 @@
	const u_char bp, const u_char bp2 _U_)
	{
	const struct ip6_mobility *mh;
	- const u_char *ep;
	unsigned mhlen, hlen;
	- uint8_t type;
	+ uint8_t pproto, type;

	ndo->ndo_protocol = "mobility";
	+ nd_print_protocol(ndo);
	+ ND_PRINT(": ");
	mh = (const struct ip6_mobility *)bp;

	- /* 'ep' points to the end of available data. */
	- ep = ndo->ndo_snapend;
	+ pproto = GET_U_1(mh->ip6m_pproto);
	+ if (pproto != IPPROTO_NONE)
	+ ND_PRINT("(payload protocol %u should be %u) ", pproto,
	+ IPPROTO_NONE);

	- if (!ND_TTEST_1(mh->ip6m_len)) {
	- /*
	- * There's not enough captured data to include the
	- * mobility header length.
	- *
	- * Our caller expects us to return the length, however,
	- * so return a value that will run to the end of the
	- * captured data.
	- *
	- * XXX - "ip6_print()" doesn't do anything with the
	- * returned length, however, as it breaks out of the
	- * header-processing loop.
	- */
	- mhlen = (unsigned)(ep - bp);
	- goto trunc;
	- }
	mhlen = (GET_U_1(mh->ip6m_len) + 1) << 3;

	/* XXX ip6m_cksum */

	type = GET_U_1(mh->ip6m_type);
	+ ND_PRINT("%s", tok2str(ip6m_str, "type-#%u", type));
	if (type <= IP6M_MAX && mhlen < ip6m_hdrlen[type]) {
	- ND_PRINT("(header length %u is too small for type %u)", mhlen, type);
	- goto trunc;
	+ ND_PRINT(" (header length %u < %u)", mhlen, ip6m_hdrlen[type]);
	+ goto invalid;
	}
	- ND_PRINT("mobility: %s", tok2str(ip6m_str, "type-#%u", type));
	switch (type) {
	case IP6M_BINDING_REQUEST:
	hlen = IP6M_MINLEN;
	@@ -248,9 +219,9 @@
	hlen = IP6M_MINLEN;
	if (ndo->ndo_vflag) {
	ND_PRINT(" %s Init Cookie=%08x:%08x",
	- type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
	- GET_BE_U_4(bp + hlen),
	- GET_BE_U_4(bp + hlen + 4));
	+ type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
	+ GET_BE_U_4(bp + hlen),
	+ GET_BE_U_4(bp + hlen + 4));
	}
	hlen += 8;
	break;
	@@ -260,16 +231,16 @@
	hlen = IP6M_MINLEN;
	if (ndo->ndo_vflag) {
	ND_PRINT(" %s Init Cookie=%08x:%08x",
	- type == IP6M_HOME_TEST ? "Home" : "Care-of",
	- GET_BE_U_4(bp + hlen),
	- GET_BE_U_4(bp + hlen + 4));
	+ type == IP6M_HOME_TEST ? "Home" : "Care-of",
	+ GET_BE_U_4(bp + hlen),
	+ GET_BE_U_4(bp + hlen + 4));
	}
	hlen += 8;
	if (ndo->ndo_vflag) {
	ND_PRINT(" %s Keygen Token=%08x:%08x",
	- type == IP6M_HOME_TEST ? "Home" : "Care-of",
	- GET_BE_U_4(bp + hlen),
	- GET_BE_U_4(bp + hlen + 4));
	+ type == IP6M_HOME_TEST ? "Home" : "Care-of",
	+ GET_BE_U_4(bp + hlen),
	+ GET_BE_U_4(bp + hlen + 4));
	}
	hlen += 8;
	break;
	@@ -278,7 +249,6 @@
	int bits;
	ND_PRINT(" seq#=%u", GET_BE_U_2(mh->ip6m_data16[0]));
	hlen = IP6M_MINLEN;
	- ND_TCHECK_2(bp + hlen);
	bits = (GET_U_1(bp + hlen) & 0xf0) >> 4;
	if (bits) {
	ND_PRINT(" ");
	@@ -321,11 +291,11 @@
	}
	if (ndo->ndo_vflag)
	if (mobility_opt_print(ndo, bp + hlen, mhlen - hlen))
	- goto trunc;
	+ goto invalid;

	return(mhlen);

	- trunc:
	- nd_print_trunc(ndo);
	+invalid:
	+ nd_print_invalid(ndo);
	return(-1);
	}
	diff --git a/contrib/tcpdump/print-msdp.c b/contrib/tcpdump/print-msdp.c
	--- a/contrib/tcpdump/print-msdp.c
	+++ b/contrib/tcpdump/print-msdp.c
	@@ -20,6 +20,7 @@

	#include <config.h>

	+#define ND_LONGJMP_FROM_TCHECK
	#include "netdissect-stdinc.h"

	#include "netdissect.h"
	@@ -42,6 +43,10 @@
	if (len > 1500 \|\| len < 3 \|\| type == 0 \|\| type > MSDP_TYPE_MAX)
	goto trunc; /* not really truncated, but still not decodable */
	while (length != 0) {
	+ unsigned int entry_count;
	+
	+ if (length < 3)
	+ goto trunc;
	type = GET_U_1(sp);
	len = GET_BE_U_2(sp + 1);
	if (len > 1400 \|\| ndo->ndo_vflag)
	@@ -50,8 +55,6 @@
	goto trunc;
	if (length < len)
	goto trunc;
	- sp += 3;
	- length -= 3;
	switch (type) {
	case 1: /* IPv4 Source-Active */
	case 3: /* IPv4 Source-Active Response */
	@@ -59,20 +62,47 @@
	ND_PRINT(" SA");
	else
	ND_PRINT(" SA-Response");
	- ND_PRINT(" %u entries", GET_U_1(sp));
	- if ((u_int)((GET_U_1(sp) * 12) + 8) < len) {
	+
	+ /* Entry Count */
	+ if (len < 4)
	+ goto trunc;
	+ entry_count = GET_U_1(sp + 3);
	+ ND_PRINT(" %u entries", entry_count);
	+
	+ /* RP Address */
	+ if (len < 8)
	+ goto trunc;
	+ /* XXX -print this based on ndo_vflag? */
	+ ND_TCHECK_LEN(sp + 4, 4);
	+
	+ /* Entries */
	+ ND_TCHECK_LEN(sp + 8, entry_count*12);
	+
	+ if (len > (8 + entry_count*12)) {
	+ /* Encapsulated IP packet */
	ND_PRINT(" [w/data]");
	if (ndo->ndo_vflag > 1) {
	ND_PRINT(" ");
	- ip_print(ndo, sp +
	- GET_U_1(sp) * 12 + 8 - 3,
	- len - (GET_U_1(sp) * 12 + 8));
	+ ip_print(ndo, sp + (8 + entry_count*12),
	+ len - (8 + entry_count*12));
	}
	}
	break;
	case 2:
	+ /* draft-ietf-msdp-spec-13 */
	ND_PRINT(" SA-Request");
	- ND_PRINT(" for %s", GET_IPADDR_STRING(sp + 1));
	+
	+ /* Reserved */
	+ if (len < 4)
	+ goto trunc;
	+ ND_TCHECK_1(sp + 3);
	+
	+ /* Group Address */
	+ if (len < 8)
	+ goto trunc;
	+ if (len != 8)
	+ ND_PRINT("[len=%u] ", len);
	+ ND_PRINT(" for %s", GET_IPADDR_STRING(sp + 4));
	break;
	case 4:
	ND_PRINT(" Keepalive");
	@@ -86,8 +116,9 @@
	ND_PRINT(" [type=%u len=%u]", type, len);
	break;
	}
	- sp += (len - 3);
	- length -= (len - 3);
	+ ND_TCHECK_LEN(sp, len);
	+ sp += len;
	+ length -= len;
	}
	return;
	trunc:
	diff --git a/contrib/tcpdump/print-ntp.c b/contrib/tcpdump/print-ntp.c
	--- a/contrib/tcpdump/print-ntp.c
	+++ b/contrib/tcpdump/print-ntp.c
	@@ -64,7 +64,7 @@
	* \| \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| \|
	- * \| Originate Timestamp (64) \|
	+ * \| Origin Timestamp (64) \|
	* \| \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| \|
	@@ -284,7 +284,7 @@
	p_ntp_time(ndo, &(bp->ref_timestamp));

	ND_TCHECK_SIZE(&bp->org_timestamp);
	- ND_PRINT("\n\t Originator Timestamp: ");
	+ ND_PRINT("\n\t Origin Timestamp: ");
	p_ntp_time(ndo, &(bp->org_timestamp));

	ND_TCHECK_SIZE(&bp->rec_timestamp);
	diff --git a/contrib/tcpdump/print-otv.c b/contrib/tcpdump/print-otv.c
	deleted file mode 100644
	--- a/contrib/tcpdump/print-otv.c
	+++ /dev/null
	@@ -1,74 +0,0 @@
	-/*
	- * Redistribution and use in source and binary forms, with or without
	- * modification, are permitted provided that: (1) source code
	- * distributions retain the above copyright notice and this paragraph
	- * in its entirety, and (2) distributions including binary code include
	- * the above copyright notice and this paragraph in its entirety in
	- * the documentation or other materials provided with the distribution.
	- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
	- * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
	- * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
	- * FOR A PARTICULAR PURPOSE.
	- *
	- * Original code by Francesco Fondelli (francesco dot fondelli, gmail dot com)
	- */
	-
	-/* \summary: Overlay Transport Virtualization (OTV) printer */
	-
	-/* specification: draft-hasmit-otv-04 */
	-
	-#include <config.h>
	-
	-#include "netdissect-stdinc.h"
	-
	-#define ND_LONGJMP_FROM_TCHECK
	-#include "netdissect.h"
	-#include "extract.h"
	-
	-#define OTV_HDR_LEN 8
	-
	-/*
	- * OTV header, draft-hasmit-otv-04
	- *
	- * 0 1 2 3
	- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
	- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	- * \|R\|R\|R\|R\|I\|R\|R\|R\| Overlay ID \|
	- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	- * \| Instance ID \| Reserved \|
	- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	- */
	-
	-void
	-otv_print(netdissect_options ndo, const u_char bp, u_int len)
	-{
	- uint8_t flags;
	-
	- ndo->ndo_protocol = "otv";
	- ND_PRINT("OTV, ");
	- if (len < OTV_HDR_LEN) {
	- ND_PRINT("[length %u < %u]", len, OTV_HDR_LEN);
	- goto invalid;
	- }
	-
	- flags = GET_U_1(bp);
	- ND_PRINT("flags [%s] (0x%02x), ", flags & 0x08 ? "I" : ".", flags);
	- bp += 1;
	-
	- ND_PRINT("overlay %u, ", GET_BE_U_3(bp));
	- bp += 3;
	-
	- ND_PRINT("instance %u\n", GET_BE_U_3(bp));
	- bp += 3;
	-
	- /* Reserved */
	- ND_TCHECK_1(bp);
	- bp += 1;
	-
	- ether_print(ndo, bp, len - OTV_HDR_LEN, ND_BYTES_AVAILABLE_AFTER(bp), NULL, NULL);
	- return;
	-
	-invalid:
	- nd_print_invalid(ndo);
	- ND_TCHECK_LEN(bp, len);
	-}
	diff --git a/contrib/tcpdump/print-pflog.c b/contrib/tcpdump/print-pflog.c
	--- a/contrib/tcpdump/print-pflog.c
	+++ b/contrib/tcpdump/print-pflog.c
	@@ -64,7 +64,7 @@
	{ PF_PASS, "pass" },
	{ PF_DROP, "block" },
	{ PF_SCRUB, "scrub" },
	- { PF_NOSCRUB, "scrub" },
	+ { PF_NOSCRUB, "noscrub" },
	{ PF_NAT, "nat" },
	{ PF_NONAT, "nonat" },
	{ PF_BINAT, "binat" },
	diff --git a/contrib/tcpdump/print-ptp.c b/contrib/tcpdump/print-ptp.c
	--- a/contrib/tcpdump/print-ptp.c
	+++ b/contrib/tcpdump/print-ptp.c
	@@ -292,10 +292,10 @@
	static void ptp_print_timestamp(netdissect_options ndo, const u_char bp, u_int len, const char stype);
	static void ptp_print_timestamp_identity(netdissect_options ndo, const u_char bp, u_int len, const char ttype);
	static void ptp_print_announce_msg(netdissect_options ndo, const u_char bp, u_int *len);
	-static void ptp_print_port_id(netdissect_options ndo, const u_char bp, u_int *len);
	+static const u_char ptp_print_port_id(netdissect_options ndo, const u_char bp, u_int len);
	static void ptp_print_mgmt_msg(netdissect_options ndo, const u_char bp, u_int *len);

	-static void
	+static const u_char *
	print_field(netdissect_options ndo, const char st, uint32_t flen,
	const u_char bp, u_int len, uint8_t hex)
	{
	@@ -344,6 +344,8 @@
	default:
	break;
	}
	+
	+ return bp;
	}

	static void
	@@ -365,47 +367,47 @@

	foct = GET_U_1(bp);
	major_sdo_id = (foct & PTP_MAJOR_SDO_ID_MASK) >> 4;
	- ND_PRINT(", majorSdoId : 0x%x", major_sdo_id);
	+ ND_PRINT(", majorSdoId: 0x%x", major_sdo_id);
	msg_type = foct & PTP_MSG_TYPE_MASK;
	- ND_PRINT(", msg type : %s", tok2str(ptp_msg_type, "Reserved", msg_type));
	+ ND_PRINT(", msg type: %s", tok2str(ptp_msg_type, "Reserved", msg_type));

	/* msg length */
	- len -= 2; bp += 2; msg_len = GET_BE_U_2(bp); ND_PRINT(", length : %u", msg_len);
	+ len -= 2; bp += 2; msg_len = GET_BE_U_2(bp); ND_PRINT(", length: %u", msg_len);

	/* domain */
	- len -= 2; bp += 2; domain_no = (GET_BE_U_2(bp) & PTP_DOMAIN_MASK) >> 8; ND_PRINT(", domain : %u", domain_no);
	+ len -= 2; bp += 2; domain_no = (GET_BE_U_2(bp) & PTP_DOMAIN_MASK) >> 8; ND_PRINT(", domain: %u", domain_no);

	/* rsvd 1*/
	rsvd1 = GET_BE_U_2(bp) & PTP_RSVD1_MASK;
	- ND_PRINT(", reserved1 : %u", rsvd1);
	+ ND_PRINT(", reserved1: %u", rsvd1);

	/* flags */
	len -= 2; bp += 2; flags = GET_BE_U_2(bp); ND_PRINT(", Flags [%s]", bittok2str(ptp_flag_values, "none", flags));

	/* correction NS (48 bits) */
	- len -= 2; bp += 2; ns_corr = GET_BE_U_6(bp); ND_PRINT(", NS correction : %"PRIu64, ns_corr);
	+ len -= 2; bp += 2; ns_corr = GET_BE_U_6(bp); ND_PRINT(", NS correction: %"PRIu64, ns_corr);

	/* correction sub NS (16 bits) */
	- len -= 6; bp += 6; sns_corr = GET_BE_U_2(bp); ND_PRINT(", sub NS correction : %u", sns_corr);
	+ len -= 6; bp += 6; sns_corr = GET_BE_U_2(bp); ND_PRINT(", sub NS correction: %u", sns_corr);

	/* Reserved 2 */
	- len -= 2; bp += 2; rsvd2 = GET_BE_U_4(bp); ND_PRINT(", reserved2 : %u", rsvd2);
	+ len -= 2; bp += 2; rsvd2 = GET_BE_U_4(bp); ND_PRINT(", reserved2: %u", rsvd2);

	/* clock identity */
	- len -= 4; bp += 4; clk_id = GET_BE_U_8(bp); ND_PRINT(", clock identity : 0x%"PRIx64, clk_id);
	+ len -= 4; bp += 4; clk_id = GET_BE_U_8(bp); ND_PRINT(", clock identity: 0x%"PRIx64, clk_id);

	/* port identity */
	- len -= 8; bp += 8; port_id = GET_BE_U_2(bp); ND_PRINT(", port id : %u", port_id);
	+ len -= 8; bp += 8; port_id = GET_BE_U_2(bp); ND_PRINT(", port id: %u", port_id);

	/* sequence ID */
	- len -= 2; bp += 2; seq_id = GET_BE_U_2(bp); ND_PRINT(", seq id : %u", seq_id);
	+ len -= 2; bp += 2; seq_id = GET_BE_U_2(bp); ND_PRINT(", seq id: %u", seq_id);

	/* control */
	len -= 2; bp += 2; control = GET_U_1(bp) ;
	- ND_PRINT(", control : %u (%s)", control, tok2str(ptp_control_field, "Reserved", control));
	+ ND_PRINT(", control: %u (%s)", control, tok2str(ptp_control_field, "Reserved", control));

	/* log message interval */
	- lm_int = GET_BE_U_2(bp) & PTP_LOGMSG_MASK; ND_PRINT(", log message interval : %u", lm_int); len -= 2; bp += 2;
	+ lm_int = GET_BE_U_2(bp) & PTP_LOGMSG_MASK; ND_PRINT(", log message interval: %u", lm_int); len -= 2; bp += 2;

	switch(msg_type) {
	case M_SYNC:
	@@ -489,7 +491,7 @@
	uint64_t secs;
	uint32_t nsecs;

	- ND_PRINT(", %s :", stype);
	+ ND_PRINT(", %s:", stype);
	/* sec time stamp 6 bytes */
	secs = GET_BE_U_6(bp);
	ND_PRINT(" %"PRIu64" seconds,", secs);
	@@ -511,7 +513,7 @@
	uint16_t port_id;
	uint64_t port_identity;

	- ND_PRINT(", %s :", ttype);
	+ ND_PRINT(", %s:", ttype);
	/* sec time stamp 6 bytes */
	secs = GET_BE_U_6(bp);
	ND_PRINT(" %"PRIu64" seconds,", secs);
	@@ -526,13 +528,13 @@

	/* port identity*/
	port_identity = GET_BE_U_8(bp);
	- ND_PRINT(", port identity : 0x%"PRIx64, port_identity);
	+ ND_PRINT(", port identity: 0x%"PRIx64, port_identity);
	*len -= 8;
	bp += 8;

	/* port id */
	port_id = GET_BE_U_2(bp);
	- ND_PRINT(", port id : %u", port_id);
	+ ND_PRINT(", port id: %u", port_id);
	*len -= 2;
	bp += 2;
	}
	@@ -545,7 +547,7 @@
	uint64_t secs;
	uint32_t nsecs;

	- ND_PRINT(", %s :", p_origin_ts);
	+ ND_PRINT(", %s:", p_origin_ts);
	/* sec time stamp 6 bytes */
	secs = GET_BE_U_6(bp);
	ND_PRINT(" %"PRIu64" seconds", secs);
	@@ -560,61 +562,62 @@

	/* origin cur utc */
	origin_cur_utc = GET_BE_U_2(bp);
	- ND_PRINT(", origin cur utc :%u", origin_cur_utc);
	+ ND_PRINT(", origin cur utc:%u", origin_cur_utc);
	*len -= 2;
	bp += 2;

	/* rsvd */
	rsvd = GET_U_1(bp);
	- ND_PRINT(", rsvd : %u", rsvd);
	+ ND_PRINT(", rsvd: %u", rsvd);
	*len -= 1;
	bp += 1;

	/* gm prio */
	gm_prio_1 = GET_U_1(bp);
	- ND_PRINT(", gm priority_1 : %u", gm_prio_1);
	+ ND_PRINT(", gm priority_1: %u", gm_prio_1);
	*len -= 1;
	bp += 1;

	/* GM clock class */
	gm_clk_cls = GET_U_1(bp);
	- ND_PRINT(", gm clock class : %u", gm_clk_cls);
	+ ND_PRINT(", gm clock class: %u", gm_clk_cls);
	*len -= 1;
	bp += 1;
	/* GM clock accuracy */
	gm_clk_acc = GET_U_1(bp);
	- ND_PRINT(", gm clock accuracy : %u", gm_clk_acc);
	+ ND_PRINT(", gm clock accuracy: %u", gm_clk_acc);
	*len -= 1;
	bp += 1;
	/* GM clock variance */
	gm_clk_var = GET_BE_U_2(bp);
	- ND_PRINT(", gm clock variance : %u", gm_clk_var);
	+ ND_PRINT(", gm clock variance: %u", gm_clk_var);
	*len -= 2;
	bp += 2;
	/* GM Prio 2 */
	gm_prio_2 = GET_U_1(bp);
	- ND_PRINT(", gm priority_2 : %u", gm_prio_2);
	+ ND_PRINT(", gm priority_2: %u", gm_prio_2);
	*len -= 1;
	bp += 1;

	/* GM Clock Identity */
	gm_clock_id = GET_BE_U_8(bp);
	- ND_PRINT(", gm clock id : 0x%"PRIx64, gm_clock_id);
	+ ND_PRINT(", gm clock id: 0x%"PRIx64, gm_clock_id);
	*len -= 8;
	bp += 8;
	/* steps removed */
	steps_removed = GET_BE_U_2(bp);
	- ND_PRINT(", steps removed : %u", steps_removed);
	+ ND_PRINT(", steps removed: %u", steps_removed);
	*len -= 2;
	bp += 2;
	/* Time source */
	time_src = GET_U_1(bp);
	- ND_PRINT(", time source : 0x%x", time_src);
	+ ND_PRINT(", time source: 0x%x", time_src);
	*len -= 1;
	bp += 1;

	}
	-static void
	+
	+static const u_char *
	ptp_print_port_id(netdissect_options ndo, const u_char bp, u_int *len)
	{
	uint16_t port_id;
	@@ -622,24 +625,25 @@

	/* port identity*/
	port_identity = GET_BE_U_8(bp);
	- ND_PRINT(", port identity : 0x%"PRIx64, port_identity);
	+ ND_PRINT(", port identity: 0x%"PRIx64, port_identity);
	*len -= 8;
	bp += 8;

	/* port id */
	port_id = GET_BE_U_2(bp);
	- ND_PRINT(", port id : %u", port_id);
	+ ND_PRINT(", port id: %u", port_id);
	*len -= 2;
	bp += 2;

	+ return bp;
	}

	static void
	ptp_print_mgmt_msg(netdissect_options ndo, const u_char bp, u_int *len)
	{
	- ptp_print_port_id(ndo, bp, len);
	- print_field(ndo, ", start boundary hops ", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
	- print_field(ndo, ", boundary hops ", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
	- print_field(ndo, ", flags ", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
	- print_field(ndo, ", reserved ", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
	+ bp = ptp_print_port_id(ndo, bp, len);
	+ bp = print_field(ndo, "start boundary hops:", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
	+ bp = print_field(ndo, "boundary hops:", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
	+ bp = print_field(ndo, "flags:", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
	+ bp = print_field(ndo, "reserved:", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
	}
	diff --git a/contrib/tcpdump/print-raw.c b/contrib/tcpdump/print-raw.c
	--- a/contrib/tcpdump/print-raw.c
	+++ b/contrib/tcpdump/print-raw.c
	@@ -28,7 +28,7 @@
	#include "netdissect.h"

	/*
	- * The DLT_RAW packet has no header. It contains a raw IP packet.
	+ * The DLT_RAW packet has no header. It contains a raw IPv4 or IPv6 packet.
	*/

	void
	diff --git a/contrib/tcpdump/print-tcp.c b/contrib/tcpdump/print-tcp.c
	--- a/contrib/tcpdump/print-tcp.c
	+++ b/contrib/tcpdump/print-tcp.c
	@@ -302,15 +302,21 @@
	"%s: calloc", __func__);
	}
	th->addr = tha;
	- if (rev)
	- th->ack = seq, th->seq = ack - 1;
	- else
	- th->seq = seq, th->ack = ack - 1;
	+ if (rev) {
	+ th->ack = seq;
	+ th->seq = ack - 1;
	+ } else {
	+ th->seq = seq;
	+ th->ack = ack - 1;
	+ }
	} else {
	- if (rev)
	- seq -= th->ack, ack -= th->seq;
	- else
	- seq -= th->seq, ack -= th->ack;
	+ if (rev) {
	+ seq -= th->ack;
	+ ack -= th->seq;
	+ } else {
	+ seq -= th->seq;
	+ ack -= th->ack;
	+ }
	}

	thseq = th->seq;
	@@ -360,15 +366,21 @@
	"%s: calloc", __func__);
	}
	th->addr = tha;
	- if (rev)
	- th->ack = seq, th->seq = ack - 1;
	- else
	- th->seq = seq, th->ack = ack - 1;
	+ if (rev) {
	+ th->ack = seq;
	+ th->seq = ack - 1;
	+ } else {
	+ th->seq = seq;
	+ th->ack = ack - 1;
	+ }
	} else {
	- if (rev)
	- seq -= th->ack, ack -= th->seq;
	- else
	- seq -= th->seq, ack -= th->ack;
	+ if (rev) {
	+ seq -= th->ack;
	+ ack -= th->seq;
	+ } else {
	+ seq -= th->seq;
	+ ack -= th->ack;
	+ }
	}

	thseq = th->seq;
	@@ -425,14 +437,19 @@
	}
	}

	- if (flags & TH_ACK) {
	+ if (flags & TH_ACK)
	ND_PRINT(", ack %u", ack);
	- }
	+ else
	+ if (ndo->ndo_vflag > 1 && ack != 0)
	+ ND_PRINT(", [ack %u != 0 while ACK flag not set]", ack);

	ND_PRINT(", win %u", win);

	if (flags & TH_URG)
	ND_PRINT(", urg %u", urp);
	+ else
	+ if (ndo->ndo_vflag > 1 && urp != 0)
	+ ND_PRINT(", [urg %u != 0 while URG flag not set]", urp);
	/*
	* Handle any options.
	*/
	@@ -715,8 +732,11 @@
	nd_trunc_longjmp(ndo);
	}
	bp += header_len;
	- if ((flags & TH_RST) && ndo->ndo_vflag) {
	- print_tcp_rst_data(ndo, bp, length);
	+ if (flags & TH_RST) {
	+ if(ndo->ndo_vflag)
	+ print_tcp_rst_data(ndo, bp, length);
	+ else
	+ ND_TCHECK_LEN(bp, length);
	return;
	}

	diff --git a/contrib/tcpdump/print-udp.c b/contrib/tcpdump/print-udp.c
	--- a/contrib/tcpdump/print-udp.c
	+++ b/contrib/tcpdump/print-udp.c
	@@ -697,8 +697,8 @@
	lwapp_data_print(ndo, cp, length);
	else if (IS_SRC_OR_DST_PORT(SIP_PORT))
	sip_print(ndo, cp, length);
	- else if (IS_SRC_OR_DST_PORT(OTV_PORT))
	- otv_print(ndo, cp, length);
	+ else if (IS_SRC_OR_DST_PORT(VXLAN_LINUX_PORT))
	+ vxlan_print(ndo, cp, length);
	else if (IS_SRC_OR_DST_PORT(VXLAN_PORT))
	vxlan_print(ndo, cp, length);
	else if (dport == GENEVE_PORT)
	diff --git a/contrib/tcpdump/print-zep.c b/contrib/tcpdump/print-zep.c
	--- a/contrib/tcpdump/print-zep.c
	+++ b/contrib/tcpdump/print-zep.c
	@@ -30,6 +30,8 @@

	#include "extract.h"

	+#include "ntp.h"
	+
	/* From wireshark packet-zep.c:
	*
	***********************************************************************
	@@ -55,39 +57,6 @@
	*------------------------------------------------------------
	*/

	-#define JAN_1970 2208988800U
	-
	-/* Print timestamp */
	-static void zep_print_ts(netdissect_options ndo, const u_char p)
	-{
	- int32_t i;
	- uint32_t uf;
	- uint32_t f;
	- float ff;
	-
	- i = GET_BE_U_4(p);
	- uf = GET_BE_U_4(p + 4);
	- ff = (float) uf;
	- if (ff < 0.0) /* some compilers are buggy */
	- ff += FMAXINT;
	- ff = (float) (ff / FMAXINT); /* shift radix point by 32 bits */
	- f = (uint32_t) (ff * 1000000000.0); /* treat fraction as parts per
	- billion */
	- ND_PRINT("%u.%09d", i, f);
	-
	- /*
	- * print the time in human-readable format.
	- */
	- if (i) {
	- time_t seconds = i - JAN_1970;
	- char time_buf[128];
	-
	- ND_PRINT(" (%s)",
	- nd_format_time(time_buf, sizeof (time_buf), "%Y-%m-%d %H:%M:%S",
	- localtime(&seconds)));
	- }
	-}
	-
	/*
	* Main function to print packets.
	*/
	@@ -151,7 +120,12 @@
	else
	ND_PRINT("LQI %u, ", GET_U_1(bp + 8));

	- zep_print_ts(ndo, bp + 9);
	+ /*
	+ * XXX - why a space rather than a "T"
	+ * between the date and time?
	+ */
	+ p_ntp_time_fmt(ndo, "%Y-%m-%d %H:%M:%S",
	+ (const struct l_fixedpt *)(bp + 9));
	seq_no = GET_BE_U_4(bp + 17);
	inner_len = GET_U_1(bp + 31);
	ND_PRINT(", seq# = %u, inner len = %u",
	diff --git a/contrib/tcpdump/tcpdump.1.in b/contrib/tcpdump/tcpdump.1.in
	--- a/contrib/tcpdump/tcpdump.1.in
	+++ b/contrib/tcpdump/tcpdump.1.in
	@@ -20,18 +20,19 @@
	.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
	.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
	.\"
	-.TH TCPDUMP 1 "26 March 2024"
	+.TH TCPDUMP 1 "30 June 2025"
	.SH NAME
	tcpdump \- dump traffic on a network
	.SH SYNOPSIS
	.na
	.B tcpdump
	[
	-.B \-AbdDefhHIJKlLnNOpqStuUvxX#
	+.B \-AbdDefghHIJKlLnNOpqStuUvxX#
	] [
	.B \-B
	.I buffer_size
	]
	+.br
	.ti +8
	[
	.B \-c
	@@ -44,11 +45,13 @@
	.B \-C
	.I file_size
	]
	+.br
	.ti +8
	[
	.B \-E
	.I spi@ipaddr algo:secret,...
	]
	+.br
	.ti +8
	[
	.B \-F
	@@ -62,6 +65,7 @@
	.B \-i
	.I interface
	]
	+.br
	.ti +8
	[
	.B \-\-immediate\-mode
	@@ -74,6 +78,7 @@
	.B \-m
	.I module
	]
	+.br
	.ti +8
	[
	.B \-M
	@@ -105,7 +110,6 @@
	[
	.B \-\-version
	]
	-.ti +8
	[
	.B \-V
	.I file
	@@ -118,11 +122,12 @@
	.B \-W
	.I filecount
	]
	+.br
	+.ti +8
	[
	.B \-y
	.I datalinktype
	]
	-.ti +8
	[
	.B \-z
	.I postrotate-command
	@@ -131,17 +136,18 @@
	.B \-Z
	.I user
	]
	+.br
	.ti +8
	[
	.BI \-\-time\-stamp\-precision= tstamp_precision
	]
	-.ti +8
	[
	.BI \-\-micro
	]
	[
	.BI \-\-nano
	]
	+.br
	.ti +8
	[
	.I expression
	@@ -150,7 +156,7 @@
	.ad
	.SH DESCRIPTION
	.LP
	-\fITcpdump\fP prints out a description of the contents of packets on a
	+\fItcpdump\fP prints out a description of the contents of packets on a
	network interface that match the Boolean \fIexpression\fP (see
	.BR \%pcap-filter (@MAN_MISC_INFO@)
	for the \fIexpression\fP syntax); the
	@@ -170,7 +176,7 @@
	will be processed by
	.IR tcpdump .
	.LP
	-.I Tcpdump
	+.I tcpdump
	will, if not run with the
	.B \-c
	flag, continue capturing packets until it is interrupted by a SIGINT
	@@ -237,6 +243,11 @@
	.B \-A
	Print each packet (minus its link level header) in ASCII. Handy for
	capturing web pages.
	+No effect when
	+.B \-x[x]
	+or
	+.B \-X[X]
	+options are used.
	.TP
	.B \-b
	Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN
	@@ -266,8 +277,12 @@
	have the name specified with the
	.B \-w
	flag, with a number after it, starting at 1 and continuing upward.
	-The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes,
	+The default unit of \fIfile_size\fP is millions of bytes (1,000,000 bytes,
	not 1,048,576 bytes).
	+.IP
	+By adding a suffix of k/K, m/M or g/G to the value, the unit
	+can be changed to 1,024 (KiB), 1,048,576 (MiB), or 1,073,741,824 (GiB)
	+respectively.
	.TP
	.B \-d
	Dump the compiled packet-matching code in a human readable form to
	@@ -388,15 +403,21 @@
	netmask of the interface on that capture is being done. If that
	address or netmask are not available, either because the
	interface on that capture is being done has no address or netmask or
	-because it is the "any" pseudo-interface, which is
	-available in Linux and in recent versions of macOS and Solaris, and which
	-can capture on more than one interface, this option will not work
	-correctly.
	+because it is the "any" pseudo-interface (see the
	+.B \-i
	+flag below), this option will not work correctly.
	.TP
	.BI \-F " file"
	Use \fIfile\fP as input for the filter expression.
	An additional expression given on the command line is ignored.
	.TP
	+.B \-g
	+.PD 0
	+.TP
	+.BI \-\-ip\-oneline
	+.PD
	+Do not insert a line break after the IP header in verbose mode.
	+.TP
	.BI \-G " rotate_seconds"
	If specified, rotates the dump file specified with the
	.B \-w
	@@ -442,10 +463,19 @@
	interface list for the lowest numbered, configured up interface
	(excluding loopback), which may turn out to be, for example, ``eth0''.
	.IP
	-On Linux systems with 2.2 or later kernels and on recent versions of macOS
	+On all supported Linux systems, as well as on recent versions of macOS
	and Solaris, an
	.I interface
	-argument of ``any'' can be used to capture packets from all interfaces.
	+argument of ``any'' means a special pseudo-interface, which captures packets
	+from all regular network interfaces of the OS. What is considered a regular
	+network interface is an implementation detail of the OS (for example, on
	+Linux this includes SocketCAN devices), so packets captured on the ``any''
	+pseudo-interface may represent more different network protocols than expected.
	+Also all regular network interfaces are a subset of all available capture
	+devices as printed by the
	+.B \-D
	+flag. The latter may also include capture devices that libpcap implements by
	+means other than the OS network stack: Bluetooth, DAG, D-Bus, SNF and USB.
	Note that captures on the ``any'' pseudo-interface will not be done in promiscuous
	mode.
	.IP
	@@ -851,7 +881,7 @@
	The MIME type \fIapplication/vnd.tcpdump.pcap\fP has been registered
	with IANA for \fIpcap\fP files. The filename extension \fI.pcap\fP
	appears to be the most commonly used along with \fI.cap\fP and
	-\fI.dmp\fP. \fITcpdump\fP itself doesn't check the extension when
	+\fI.dmp\fP. \fItcpdump\fP itself doesn't check the extension when
	reading capture files and doesn't add an extension when writing them
	(it uses magic numbers in the file header instead). However, many
	operating systems and applications will use the extension if it is
	@@ -897,6 +927,9 @@
	In the current implementation this flag may have the same effect as
	.B \-xx
	if the packet is truncated.
	+No effect when
	+.B \-X[X]
	+option is used.
	.TP
	.B \-xx
	When parsing and printing,
	@@ -904,6 +937,9 @@
	each packet,
	.I including
	its link level header, in hex.
	+No effect when
	+.B \-X[X]
	+option is used.
	.TP
	.B \-X
	When parsing and printing,
	@@ -949,6 +985,8 @@
	.B \-z bzip2
	will compress each savefile using gzip or bzip2.
	.IP
	+This option can only be used if fork subprocess is implemented (e.g. not on Windows systems).
	+.IP
	Note that tcpdump will run the command in parallel to the capture, using
	the lowest priority so that this doesn't disturb the capture process.
	.IP
	diff --git a/contrib/tcpdump/tcpdump.c b/contrib/tcpdump/tcpdump.c
	--- a/contrib/tcpdump/tcpdump.c
	+++ b/contrib/tcpdump/tcpdump.c
	@@ -34,6 +34,9 @@
	*/

	#include <config.h>
	+#ifndef TCPDUMP_CONFIG_H_
	+#error "The included config.h header is not from the tcpdump build."
	+#endif

	/*
	* Some older versions of Mac OS X ship pcap.h from libpcap 0.6 with a
	@@ -149,7 +152,6 @@
	#include <sys/sysctl.h>
	#endif /* __FreeBSD__ */

	-#include "netdissect-stdinc.h"
	#include "netdissect.h"
	#include "interface.h"
	#include "addrtoname.h"
	@@ -226,7 +228,9 @@
	#endif
	static int Wflag; /* recycle output files after this number of files */
	static int WflagChars;
	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	static char zflag = NULL; / compress each savefile using a specified command (like gzip or bzip2) */
	+#endif
	static int timeout = 1000; /* default timeout = 1000 ms = 1 s */
	#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
	static int immediate_mode;
	@@ -250,7 +254,9 @@
	static NORETURN void exit_tcpdump(int);
	static void (setsignal (int sig, void (func)(int)))(int);
	static void cleanup(int);
	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	static void child_cleanup(int);
	+#endif
	static void print_version(FILE *);
	static void print_usage(FILE *);
	#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
	@@ -597,14 +603,11 @@
	/*
	* Short options.
	*
	- * Note that there we use all letters for short options except for g, k,
	+ * Note that there we use all letters for short options except for k,
	* o, and P, and those are used by other versions of tcpdump, and we should
	* only use them for the same purposes that the other versions of tcpdump
	* use them:
	*
	- * macOS tcpdump uses -g to force non--v output for IP to be on one
	- * line, making it more "g"repable;
	- *
	* macOS tcpdump uses -k to specify that packet comments in pcapng files
	* should be printed;
	*
	@@ -676,7 +679,27 @@
	#define U_FLAG
	#endif

	-#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	+#define z_FLAG "z:"
	+#define z_FLAG_USAGE "[ -z postrotate-command ] "
	+#else
	+#define z_FLAG
	+#define z_FLAG_USAGE
	+#endif
	+
	+#ifdef HAVE_LIBCRYPTO
	+#define E_FLAG "E:"
	+#define E_FLAG_USAGE "[ -E algo:secret ] "
	+#define M_FLAG "M:"
	+#define M_FLAG_USAGE "[ -M secret ] "
	+#else
	+#define E_FLAG
	+#define E_FLAG_USAGE
	+#define M_FLAG
	+#define M_FLAG_USAGE
	+#endif
	+
	+#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "e" E_FLAG "fF:gG:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:" M_FLAG "nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Y" z_FLAG "Z:#"

	/*
	* Long options.
	@@ -707,6 +730,7 @@
	#define OPTION_TSTAMP_NANO 134
	#define OPTION_FP_TYPE 135
	#define OPTION_COUNT 136
	+#define OPTION_TIME_T_SIZE 139

	static const struct option longopts[] = {
	#if defined(HAVE_PCAP_CREATE) \|\| defined(_WIN32)
	@@ -754,6 +778,8 @@
	{ "fp-type", no_argument, NULL, OPTION_FP_TYPE },
	{ "number", no_argument, NULL, '#' },
	{ "print", no_argument, NULL, OPTION_PRINT },
	+ { "time-t-size", no_argument, NULL, OPTION_TIME_T_SIZE },
	+ { "ip-oneline", no_argument, NULL, 'g' },
	{ "version", no_argument, NULL, OPTION_VERSION },
	{ NULL, 0, NULL, 0 }
	};
	@@ -791,7 +817,7 @@
	{
	int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
	if (ret < 0)
	- error("capng_change_id(): return %d\n", ret);
	+ error("capng_change_id(): return %d", ret);
	else
	fprintf(stderr, "dropped privs to %s\n", username);
	}
	@@ -997,7 +1023,7 @@
	* that requires that it be able to do an F_GETFL fcntl() to read
	* the O_ flags.
	*
	- * Tcpdump uses ftell() to determine how much data has been written
	+ * tcpdump uses ftell() to determine how much data has been written
	* to a file in order to, when used with -C, determine when it's time
	* to rotate capture files. ftell() therefore needs to do an lseek()
	* to find out the file offset and must, thanks to the aforementioned
	@@ -1237,6 +1263,8 @@
	status = pcap_findalldevs(&devlist, ebuf);
	if (status < 0)
	error("%s", ebuf);
	+ if (devlist == NULL)
	+ error("no interfaces available for capture");
	/*
	* Look for the devnum-th entry in the list of devices (1-based).
	*/
	@@ -1245,8 +1273,8 @@
	;
	if (dev == NULL) {
	pcap_freealldevs(devlist);
	- error("Invalid adapter index %ld: only %ld interfaces found",
	- devnum, i);
	+ error("Invalid adapter index %ld: only %ld interface%s found",
	+ devnum, i, (i == 1) ? "" : "s");
	}
	device = strdup(dev->name);
	pcap_freealldevs(devlist);
	@@ -1393,7 +1421,7 @@
	*/
	cp = pcap_geterr(pc);
	if (status == PCAP_ERROR)
	- error("%s", cp);
	+ error("%s: %s", device, cp);
	else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
	/*
	* Return an error for our caller to handle.
	@@ -1403,6 +1431,11 @@
	} else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
	error("%s: %s\n(%s)", device,
	pcap_statustostr(status), cp);
	+#ifdef PCAP_ERROR_CAPTURE_NOTSUP
	+ else if (status == PCAP_ERROR_CAPTURE_NOTSUP && *cp != '\0')
	+ error("%s: %s\n(%s)", device,
	+ pcap_statustostr(status), cp);
	+#endif
	#ifdef __FreeBSD__
	else if (status == PCAP_ERROR_RFMON_NOTSUP &&
	strncmp(device, "wlan", 4) == 0) {
	@@ -1420,7 +1453,7 @@
	* specific case would be an error message that looks a bit odd.
	*/
	newdev[strlen(newdev)-1]++;
	- error("%s is not a monitor mode VAP\n"
	+ error("%s is not a monitor mode VAP"
	"To create a new monitor mode VAP use:\n"
	" ifconfig %s create wlandev %s wlanmode monitor\n"
	"and use %s as the tcpdump interface",
	@@ -1521,10 +1554,162 @@
	int yflag_dlt = -1;
	const char *yflag_dlt_name = NULL;
	int print = 0;
	+ long Cflagmult;

	netdissect_options Ndo;
	netdissect_options *ndo = &Ndo;

	+#ifdef _WIN32
	+ /*
	+ * We need to look for wpcap.dll in \Windows\System32\Npcap first,
	+ * as either:
	+ *
	+ * 1) WinPcap isn't installed and Npcap isn't installed in "WinPcap
	+ * API-compatible Mode", so there's no wpcap.dll in
	+ * \Windows\System32, only in \Windows\System32\Npcap;
	+ *
	+ * 2) WinPcap is installed and Npcap isn't installed in "WinPcap
	+ * API-compatible Mode", so the wpcap.dll in \Windows\System32
	+ * is a WinPcap DLL, but we'd prefer an Npcap DLL (we should
	+ * work with either one if we're configured against WinPcap,
	+ * and we'll probably require Npcap if we're configured against
	+ * it), and that's in \Windows\System32\Npcap;
	+ *
	+ * 3) Npcap is installed in "WinPcap API-compatible Mode", so both
	+ * \Windows\System32 and \Windows\System32\Npcap have an Npcap
	+ * wpcap.dll.
	+ *
	+ * Unfortunately, Windows has no notion of an rpath, so we can't
	+ * set the rpath to include \Windows\System32\Npcap at link time;
	+ * what we need to do is to link wpcap as a delay-load DLL and
	+ * add \Windows\System32\Npcap to the DLL search path early in
	+ * main() with a call to SetDllDirectory().
	+ *
	+ * The same applies to packet.dll.
	+ *
	+ * We add \Windows\System32\Npcap here.
	+ *
	+ * See https://npcap.com/guide/npcap-devguide.html#npcap-feature-native-dll-implicitly
	+ */
	+ WCHAR *dll_directory = NULL;
	+ size_t dll_directory_buf_len = 0; /* units of bytes */
	+ UINT system_directory_buf_len = 0; /* units of WCHARs */
	+ UINT system_directory_len; /* units of WCHARs */
	+ static const WCHAR npcap[] = L"\\Npcap";
	+
	+ /*
	+ * Get the system directory path, in UTF-16, into a buffer that's
	+ * large enough for that directory path plus "\Npcap".
	+ *
	+ * String manipulation in C, plus fetching a variable-length
	+ * string into a buffer whose size is fixed at the time of
	+ * the call, with an oddball return value (see below), is just
	+ * a huge bag of fun.
	+ *
	+ * And it's even more fun when dealing with UTF-16, so that the
	+ * buffer sizes used in GetSystemDirectoryW() are in different
	+ * units from the buffer sizes used in realloc()! We maintain
	+ * all sizes/length in units of bytes, not WCHARs, so that our
	+ * heads don't explode.
	+ */
	+ for (;;) {
	+ /*
	+ * Try to fetch the system directory.
	+ *
	+ * GetSystemDirectoryW() expects a buffer size in units
	+ * of WCHARs, not bytes, and returns a directory path
	+ * length in units of WCHARs, not bytes.
	+ *
	+ * For extra fun, if GetSystemDirectoryW() succeeds,
	+ * the return value is the length of the directory
	+ * path in units of WCHARs, not including the
	+ * terminating '\0', but if it fails because the
	+ * path string wouldn't fit, the return value is
	+ * the length of the directory path in units of WCHARs,
	+ * including the terminating '\0'.
	+ */
	+ system_directory_len = GetSystemDirectoryW(dll_directory,
	+ system_directory_buf_len);
	+ if (system_directory_len == 0)
	+ error("GetSystemDirectoryW() failed");
	+
	+ /*
	+ * Did the directory path fit in the buffer?
	+ *
	+ * As per the above, this means that the return value
	+ * plus 1, so that the terminating '\0' is counted,
	+ * is <= the buffer size.
	+ *
	+ * (If the directory path, complete with the terminating
	+ * '\0', fits exactly, the return value would be the
	+ * size of the buffer minus 1, as it doesn't count the
	+ * terminating '\0', so the test below would succeed.
	+ *
	+ * If everything but the terminating '\0' fits,
	+ * the return value would be the size of the buffer + 1,
	+ * i.e., the size that the string in question would
	+ * have required.
	+ *
	+ * The astute reader will note that returning the
	+ * size of the buffer is not one of the two cases
	+ * above, and should never happen.)
	+ */
	+ if ((system_directory_len + 1) <= system_directory_buf_len) {
	+ /*
	+ * No. We have a buffer that's large enough
	+ * for our purposes.
	+ */
	+ break;
	+ }
	+
	+ /*
	+ * Yes. Grow the buffer.
	+ *
	+ * The space we'll need in the buffer for the system
	+ * directory, in units of WCHARs, is system_directory_len,
	+ * as that's the length of the system directory path
	+ * including the terminating '\0'.
	+ */
	+ system_directory_buf_len = system_directory_len;
	+
	+ /*
	+ * The size of the DLL directory buffer, in bytes, must
	+ * be the number of WCHARs taken by the system directory,
	+ * minus the terminating '\0' (as we'll overwrite that
	+ * with the "\" of the "\Npcap" string), multiplied by
	+ * sizeof(WCHAR) to convert it to the number of bytes,
	+ * plus the size of the "\Npcap" string, in bytes (which
	+ * will include the terminating '\0', as that will become
	+ * the DLL path's terminating '\0').
	+ */
	+ dll_directory_buf_len =
	+ ((system_directory_len - 1)*sizeof(WCHAR)) + sizeof npcap;
	+ dll_directory = realloc(dll_directory, dll_directory_buf_len);
	+ if (dll_directory == NULL)
	+ error("Can't allocate string for Npcap directory");
	+ }
	+
	+ /*
	+ * OK, that worked.
	+ *
	+ * Now append \Npcap. We add the length of the system directory path,
	+ * in WCHARs, not including the terminating '\0' (which, since
	+ * GetSystemDirectoryW() succeeded, is the return value of
	+ * GetSystemDirectoryW(), as per the above), to the pointer to the
	+ * beginning of the path, to go past the end of the system directory
	+ * to point to the terminating '\0'.
	+ */
	+ memcpy(dll_directory + system_directory_len, npcap, sizeof npcap);
	+
	+ /*
	+ * Now add that as a system DLL directory.
	+ */
	+ if (!SetDllDirectoryW(dll_directory))
	+ error("SetDllDirectory failed");
	+
	+ free(dll_directory);
	+#endif
	+
	/*
	* Initialize the netdissect code.
	*/
	@@ -1609,19 +1794,77 @@
	#else
	Cflag = strtol(optarg, &endp, 10);
	#endif
	- if (endp == optarg \|\| *endp != '\0' \|\| errno != 0
	- \|\| Cflag <= 0)
	+ if (endp == optarg \|\| errno != 0 \|\| Cflag <= 0)
	error("invalid file size %s", optarg);
	+
	+ if (*endp == '\0') {
	+ /*
	+ * There's nothing after the file size,
	+ * so the size is in units of 1 MB
	+ * (1,000,000 bytes).
	+ */
	+ Cflagmult = 1000000;
	+ } else {
	+ /*
	+ * There's something after the file
	+ * size.
	+ *
	+ * If it's a single letter, then:
	+ *
	+ * if the letter is k or K, the size
	+ * is in units of 1 KiB (1024 bytes);
	+ *
	+ * if the letter is m or M, the size
	+ * is in units of 1 MiB (1,048,576 bytes);
	+ *
	+ * if the letter is g or G, the size
	+ * is in units of 1 GiB (1,073,741,824 bytes).
	+ *
	+ * Otherwise, it's an error.
	+ */
	+ switch (*endp) {
	+
	+ case 'k':
	+ case 'K':
	+ Cflagmult = 1024;
	+ break;
	+
	+ case 'm':
	+ case 'M':
	+ Cflagmult = 1024*1024;
	+ break;
	+
	+ case 'g':
	+ case 'G':
	+ Cflagmult = 102410241024;
	+ break;
	+
	+ default:
	+ error("invalid file size %s", optarg);
	+ }
	+
	+ /*
	+ * OK, there was a letter that we treat
	+ * as a units indication; was there
	+ * anything after it?
	+ */
	+ endp++;
	+ if (*endp != '\0') {
	+ /* Yes - error */
	+ error("invalid file size %s", optarg);
	+ }
	+ }
	+
	/*
	- * Will multiplying it by 1000000 overflow?
	+ * Will multiplying it by multiplier overflow?
	*/
	#ifdef HAVE_PCAP_DUMP_FTELL64
	- if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000)
	+ if (Cflag > INT64_MAX / Cflagmult)
	#else
	- if (Cflag > LONG_MAX / 1000000)
	+ if (Cflag > LONG_MAX / Cflagmult)
	#endif
	error("file size %s is too large", optarg);
	- Cflag *= 1000000;
	+ Cflag *= Cflagmult;
	break;

	case 'd':
	@@ -1648,12 +1891,11 @@
	++ndo->ndo_eflag;
	break;

	+#ifdef HAVE_LIBCRYPTO
	case 'E':
	-#ifndef HAVE_LIBCRYPTO
	- warning("crypto code not compiled in");
	-#endif
	ndo->ndo_espsecret = optarg;
	break;
	+#endif

	case 'f':
	++ndo->ndo_fflag;
	@@ -1663,6 +1905,10 @@
	infile = optarg;
	break;

	+ case 'g':
	+ ++ndo->ndo_gflag;
	+ break;
	+
	case 'G':
	Gflag = atoi(optarg);
	if (Gflag < 0)
	@@ -1746,13 +1992,12 @@
	}
	break;

	+#ifdef HAVE_LIBCRYPTO
	case 'M':
	/* TCP-MD5 shared secret */
	-#ifndef HAVE_LIBCRYPTO
	- warning("crypto code not compiled in");
	-#endif
	ndo->ndo_sigsecret = optarg;
	break;
	+#endif

	case 'n':
	++ndo->ndo_nflag;
	@@ -1908,9 +2153,12 @@
	}
	break;
	#endif
	+
	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	case 'z':
	zflag = optarg;
	break;
	+#endif

	case 'Z':
	username = optarg;
	@@ -1920,6 +2168,10 @@
	ndo->ndo_packet_number = 1;
	break;

	+ case OPTION_TIME_T_SIZE:
	+ printf("%zu\n", sizeof(time_t) * 8);
	+ return 0;
	+
	case OPTION_VERSION:
	print_version(stdout);
	exit_tcpdump(S_SUCCESS);
	@@ -1974,6 +2226,21 @@
	/* NOTREACHED */
	}

	+ if (ndo->ndo_Aflag && ndo->ndo_xflag)
	+ error("-A and -x[x] are mutually exclusive.");
	+ if (ndo->ndo_Aflag && ndo->ndo_Xflag)
	+ error("-A and -X[X] are mutually exclusive.");
	+ if (ndo->ndo_xflag && ndo->ndo_Xflag)
	+ error("-x[x] and -X[X] are mutually exclusive.");
	+ if (Cflag != 0 && WFileName == NULL)
	+ error("-C cannot be used without -w.");
	+ if (Gflag != 0 && WFileName == NULL)
	+ error("-G cannot be used without -w.");
	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	+ if (zflag != NULL && (WFileName == NULL \|\| (Cflag == 0 && Gflag == 0)))
	+ error("-z cannot be used without -w and (-C or -G).");
	+#endif
	+
	#ifdef HAVE_PCAP_FINDALLDEVS
	if (Dflag)
	show_devices_and_exit();
	@@ -1999,7 +2266,7 @@
	}

	if (ndo->ndo_fflag != 0 && (VFileName != NULL \|\| RFileName != NULL))
	- error("-f can not be used with -V or -r");
	+ error("-f cannot be used with -V or -r.");

	if (VFileName != NULL && RFileName != NULL)
	error("-V and -r are mutually exclusive.");
	@@ -2067,11 +2334,11 @@
	VFile = fopen(VFileName, "r");

	if (VFile == NULL)
	- error("Unable to open file: %s\n", pcap_strerror(errno));
	+ error("Unable to open file: %s", pcap_strerror(errno));

	ret = get_next_file(VFile, VFileLine);
	if (!ret)
	- error("Nothing in %s\n", VFileName);
	+ error("Nothing in %s", VFileName);
	RFileName = VFileLine;
	}

	@@ -2333,7 +2600,7 @@
	* devices, and can't just give users that permission,
	* you'd make tcpdump set-UID or set-GID).
	*
	- * Tcpdump doesn't necessarily write only to one savefile;
	+ * tcpdump doesn't necessarily write only to one savefile;
	* the general only way to allow a -Z instance to write to
	* savefiles as the user under whose UID it's run, rather
	* than as the user specified with -Z, would thus be to switch
	@@ -2649,6 +2916,7 @@
	info(1);
	}
	pcap_close(pd);
	+ pd = NULL;
	if (VFileName != NULL) {
	ret = get_next_file(VFile, VFileLine);
	if (ret) {
	@@ -2797,7 +3065,8 @@
	* to do anything with standard I/O streams in a signal handler -
	* the ANSI C standard doesn't say it is).
	*/
	- pcap_breakloop(pd);
	+ if (pd)
	+ pcap_breakloop(pd);
	#else
	/*
	* We don't have "pcap_breakloop()"; this isn't safe, but
	@@ -2890,8 +3159,8 @@
	child = fork_subprocess();
	if (child == -1) {
	fprintf(stderr,
	- "compress_savefile: fork failed: %s\n",
	- pcap_strerror(errno));
	+ "%s: fork failed: %s\n",
	+ __func__, pcap_strerror(errno));
	return;
	}
	if (child != 0) {
	@@ -2910,24 +3179,15 @@
	#endif
	if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
	fprintf(stderr,
	- "compress_savefile: execlp(%s, %s) failed: %s\n",
	- zflag,
	- filename,
	- pcap_strerror(errno));
	+ "%s: execlp(%s, %s) failed: %s\n",
	+ __func__, zflag, filename, pcap_strerror(errno));
	#ifdef HAVE_FORK
	exit(S_ERR_HOST_PROGRAM);
	#else
	_exit(S_ERR_HOST_PROGRAM);
	#endif
	}
	-#else /* HAVE_FORK && HAVE_VFORK */
	-static void
	-compress_savefile(const char *filename)
	-{
	- fprintf(stderr,
	- "compress_savefile failed. Functionality not implemented under your system\n");
	-}
	-#endif /* HAVE_FORK && HAVE_VFORK */
	+#endif /* HAVE_FORK \|\| HAVE_VFORK */

	static void
	dump_packet_and_trunc(u_char user, const struct pcap_pkthdr h, const u_char *sp)
	@@ -2975,11 +3235,13 @@
	*/
	pcap_dump_close(dump_info->pdd);

	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	/*
	* Compress the file we just closed, if the user asked for it
	*/
	if (zflag != NULL)
	compress_savefile(dump_info->CurrentFileName);
	+#endif

	/*
	* Check to see if we've exceeded the Wflag (when
	@@ -3080,12 +3342,14 @@
	*/
	pcap_dump_close(dump_info->pdd);

	+#if defined(HAVE_FORK) \|\| defined(HAVE_VFORK)
	/*
	* Compress the file we just closed, if the user
	* asked for it.
	*/
	if (zflag != NULL)
	compress_savefile(dump_info->CurrentFileName);
	+#endif

	Cflag_count++;
	if (Wflag > 0) {
	@@ -3279,9 +3543,9 @@
	{
	print_version(f);
	(void)fprintf(f,
	-"Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
	+"Usage: %s [-Abd" D_FLAG "efghH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
	(void)fprintf(f,
	-"\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
	+"\t\t[ -C file_size ] " E_FLAG_USAGE "[ -F file ] [ -G seconds ]\n");
	(void)fprintf(f,
	"\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");
	#ifdef HAVE_PCAP_FINDALLDEVS_EX
	@@ -3293,7 +3557,7 @@
	"\t\t" m_FLAG_USAGE "\n");
	#endif
	(void)fprintf(f,
	-"\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");
	+"\t\t" M_FLAG_USAGE "[ --number ] [ --print ]" Q_FLAG_USAGE "\n");
	(void)fprintf(f,
	"\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");
	(void)fprintf(f,
	@@ -3303,5 +3567,5 @@
	"\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
	#endif
	(void)fprintf(f,
	-"\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");
	+"\t\t" z_FLAG_USAGE "[ -Z user ] [ expression ]\n");
	}
	diff --git a/contrib/tcpdump/timeval-operations.h b/contrib/tcpdump/timeval-operations.h
	--- a/contrib/tcpdump/timeval-operations.h
	+++ b/contrib/tcpdump/timeval-operations.h
	@@ -32,6 +32,8 @@

	#define ND_MICRO_PER_SEC 1000000
	#define ND_NANO_PER_SEC 1000000000
	+#define ND_INVALID_MICRO_SEC_STR "(invalid us)"
	+#define ND_INVALID_NANO_SEC_STR "(invalid ns)"

	#define netdissect_timevalclear(tvp) ((tvp)->tv_sec = (tvp)->tv_usec = 0)

	diff --git a/contrib/tcpdump/udp.h b/contrib/tcpdump/udp.h
	--- a/contrib/tcpdump/udp.h
	+++ b/contrib/tcpdump/udp.h
	@@ -227,8 +227,8 @@
	#ifndef HNCP_PORT
	#define HNCP_PORT 8231 /* RFC 7788 */
	#endif
	-#ifndef OTV_PORT
	-#define OTV_PORT 8472 /* draft-hasmit-otv-04 */
	+#ifndef VXLAN_LINUX_PORT
	+#define VXLAN_LINUX_PORT 8472 /* Linux, drivers/net/vxlan/vxlan_core.c */
	#endif
	#ifndef ISAKMP_PORT_USER2
	#define ISAKMP_PORT_USER2 8500 /XXX - nonstandard/
	diff --git a/contrib/tcpdump/util-print.c b/contrib/tcpdump/util-print.c
	--- a/contrib/tcpdump/util-print.c
	+++ b/contrib/tcpdump/util-print.c
	@@ -216,10 +216,14 @@

	case PCAP_TSTAMP_PRECISION_MICRO:
	ND_PRINT(".%06u", (unsigned)tv->tv_usec);
	+ if ((unsigned)tv->tv_usec > ND_MICRO_PER_SEC - 1)
	+ ND_PRINT(" " ND_INVALID_MICRO_SEC_STR);
	break;

	case PCAP_TSTAMP_PRECISION_NANO:
	ND_PRINT(".%09u", (unsigned)tv->tv_usec);
	+ if ((unsigned)tv->tv_usec > ND_NANO_PER_SEC - 1)
	+ ND_PRINT(" " ND_INVALID_NANO_SEC_STR);
	break;

	default:
	@@ -228,6 +232,8 @@
	}
	#else
	ND_PRINT(".%06u", (unsigned)tv->tv_usec);
	+ if ((unsigned)tv->tv_usec > ND_MICRO_PER_SEC - 1)
	+ ND_PRINT(" " ND_INVALID_MICRO_SEC_STR);
	#endif
	}

	@@ -243,16 +249,32 @@
	struct tm *tm;
	char timebuf[32];
	const char *timestr;
	+#ifdef _WIN32
	+ time_t sec;
	+#endif

	if (tv->tv_sec < 0) {
	- ND_PRINT("[timestamp < 1970-01-01 00:00:00 UTC]");
	+ ND_PRINT("[timestamp overflow]");
	return;
	}

	+#ifdef _WIN32
	+ /* on Windows tv->tv_sec is a long not a 64-bit time_t. */
	+ sec = tv->tv_sec;
	+#endif
	+
	if (time_flag == LOCAL_TIME)
	+#ifdef _WIN32
	+ tm = localtime(&sec);
	+#else
	tm = localtime(&tv->tv_sec);
	+#endif
	else
	+#ifdef _WIN32
	+ tm = gmtime(&sec);
	+#else
	tm = gmtime(&tv->tv_sec);
	+#endif

	if (date_flag == WITH_DATE) {
	timestr = nd_format_time(timebuf, sizeof(timebuf),
	@@ -273,11 +295,11 @@
	ts_unix_print(netdissect_options ndo, const struct timeval tv)
	{
	if (tv->tv_sec < 0) {
	- ND_PRINT("[timestamp < 1970-01-01 00:00:00 UTC]");
	+ ND_PRINT("[timestamp overflow]");
	return;
	}

	- ND_PRINT("%u", (unsigned)tv->tv_sec);
	+ ND_PRINT("%" PRId64, (int64_t)tv->tv_sec);
	ts_frac_print(ndo, tv);
	}

	@@ -467,19 +489,14 @@

	int
	print_unknown_data(netdissect_options ndo, const u_char cp,
	- const char *ident, u_int len)
	+ const char *indent, u_int len)
	{
	- u_int len_to_print;
	-
	- len_to_print = len;
	if (!ND_TTEST_LEN(cp, 0)) {
	- ND_PRINT("%sDissector error: print_unknown_data called with pointer past end of packet",
	- ident);
	+ ND_PRINT("%sDissector error: %s() called with pointer past end of packet",
	+ indent, __func__);
	return(0);
	}
	- if (ND_BYTES_AVAILABLE_AFTER(cp) < len_to_print)
	- len_to_print = ND_BYTES_AVAILABLE_AFTER(cp);
	- hex_print(ndo, ident, cp, len_to_print);
	+ hex_print(ndo, indent, cp, ND_MIN(len, ND_BYTES_AVAILABLE_AFTER(cp)));
	return(1); /* everything is ok */
	}

	@@ -488,7 +505,7 @@
	*/
	static const char *
	tok2strbuf(const struct tok lp, const char fmt,
	- u_int v, char *buf, size_t bufsize)
	+ const u_int v, char *buf, const size_t bufsize)
	{
	if (lp != NULL) {
	while (lp->s != NULL) {
	@@ -510,8 +527,7 @@
	* in round-robin fashion.
	*/
	const char *
	-tok2str(const struct tok lp, const char fmt,
	- u_int v)
	+tok2str(const struct tok lp, const char fmt, const u_int v)
	{
	static char buf[4][TOKBUFSIZE];
	static int idx = 0;
	@@ -532,7 +548,7 @@
	*/
	static char *
	bittok2str_internal(const struct tok lp, const char fmt,
	- u_int v, const char *sep)
	+ const u_int v, const char *sep)
	{
	static char buf[1024+1]; /* our string buffer */
	char *bufp = buf;
	@@ -572,8 +588,7 @@
	* this is useful for parsing bitfields, the output strings are not separated.
	*/
	char *
	-bittok2str_nosep(const struct tok lp, const char fmt,
	- u_int v)
	+bittok2str_nosep(const struct tok lp, const char fmt, const u_int v)
	{
	return (bittok2str_internal(lp, fmt, v, ""));
	}
	@@ -583,8 +598,7 @@
	* this is useful for parsing bitfields, the output strings are comma separated.
	*/
	char *
	-bittok2str(const struct tok lp, const char fmt,
	- u_int v)
	+bittok2str(const struct tok lp, const char fmt, const u_int v)
	{
	return (bittok2str_internal(lp, fmt, v, ", "));
	}
	@@ -596,8 +610,7 @@
	* correct for bounds-checking.
	*/
	const char *
	-tok2strary_internal(const char *lp, int n, const char fmt,
	- int v)
	+tok2strary_internal(const char *lp, int n, const char fmt, const int v)
	{
	static char buf[TOKBUFSIZE];

	@@ -630,7 +643,7 @@
	*/

	int
	-mask2plen(uint32_t mask)
	+mask2plen(const uint32_t mask)
	{
	const uint32_t bitmasks[33] = {
	0x00000000,
	@@ -696,9 +709,9 @@
	* either a space character at the beginning of the line (this
	* includes a blank line) or no more tokens remaining on the line.
	*/
	-static int
	+static u_int
	fetch_token(netdissect_options ndo, const u_char pptr, u_int idx, u_int len,
	- u_char *tbuf, size_t tbuflen)
	+ u_char *tbuf, size_t tbuflen)
	{
	size_t toklen = 0;
	u_char c;
	diff --git a/usr.sbin/tcpdump/tcpdump/Makefile b/usr.sbin/tcpdump/tcpdump/Makefile
	--- a/usr.sbin/tcpdump/tcpdump/Makefile
	+++ b/usr.sbin/tcpdump/tcpdump/Makefile
	@@ -116,7 +116,6 @@
	print-openflow-1.0.c \
	print-ospf.c \
	print-ospf6.c \
	- print-otv.c \
	print-pgm.c \
	print-pim.c \
	print-pktap.c \
	diff --git a/usr.sbin/tcpdump/tcpdump/config.h b/usr.sbin/tcpdump/tcpdump/config.h
	--- a/usr.sbin/tcpdump/tcpdump/config.h
	+++ b/usr.sbin/tcpdump/tcpdump/config.h
	@@ -3,9 +3,17 @@
	/* config.h. Generated from config.h.in by configure. */
	/* config.h.in. Generated from configure.ac by autoheader. */

	+
	+#ifndef TCPDUMP_CONFIG_H_
	+#define TCPDUMP_CONFIG_H_
	+
	+
	/* Define to 1 if arpa/inet.h declares `ether_ntohost' */
	/* #undef ARPA_INET_H_DECLARES_ETHER_NTOHOST */

	+/* define if you want to build the instrument functions code */
	+/* #undef ENABLE_INSTRUMENT_FUNCTIONS */
	+
	/* define if you want to build the possibly-buggy SMB printer */
	#define ENABLE_SMB 1

	@@ -43,9 +51,6 @@
	/* Define to 1 if you have the `EVP_DecryptInit_ex' function. */
	#define HAVE_EVP_DECRYPTINIT_EX 1

	-/* Define to 1 if you have the <fcntl.h> header file. */
	-#define HAVE_FCNTL_H 1
	-
	/* Define to 1 if you have the `fork' function. */
	#define HAVE_FORK 1

	@@ -64,32 +69,23 @@
	/* Define to 1 if you have the `cap-ng' library (-lcap-ng). */
	/* #undef HAVE_LIBCAP_NG */

	-/* Define to 1 if you have the `crypto' library (-lcrypto). */
	+/* Define to 1 if you have a usable `crypto' library (-lcrypto). */
	/* See Makefile */
	/* #undef HAVE_LIBCRYPTO */

	/* Define to 1 if you have the `rpc' library (-lrpc). */
	/* #undef HAVE_LIBRPC */

	-/* Define to 1 if you have the <memory.h> header file. */
	-#define HAVE_MEMORY_H 1
	-
	/* Define to 1 if you have the <net/if.h> header file. */
	#define HAVE_NET_IF_H 1

	-/* Define to 1 if printf(3) does not support the z length modifier. */
	-/* #undef HAVE_NO_PRINTF_Z */
	-
	/* Define to 1 if you have the `openat' function. */
	#define HAVE_OPENAT 1

	-/* Define to 1 if you have the <openssl/evp.h> header file. */
	-#define HAVE_OPENSSL_EVP_H 1
	-
	/* define if the OS provides AF_INET6 and struct in6_addr */
	#define HAVE_OS_IPV6_SUPPORT 1

	-/* if there's an os_proto.h for this platform, to use additional prototypes */
	+/* if there's an os-proto.h for this platform, to use additional prototypes */
	/* #undef HAVE_OS_PROTO_H */

	/* Define to 1 if you have the `pcap_breakloop' function. */
	@@ -179,6 +175,9 @@
	/* Define to 1 if you have the <stdint.h> header file. */
	#define HAVE_STDINT_H 1

	+/* Define to 1 if you have the <stdio.h> header file. */
	+#define HAVE_STDIO_H 1
	+
	/* Define to 1 if you have the <stdlib.h> header file. */
	#define HAVE_STDLIB_H 1

	@@ -237,7 +236,7 @@
	#define PACKAGE_NAME "tcpdump"

	/* Define to the full name and version of this package. */
	-#define PACKAGE_STRING "tcpdump 4.99.5"
	+#define PACKAGE_STRING "tcpdump 4.99.6"

	/* Define to the one symbol short name of this package. */
	#define PACKAGE_TARNAME "tcpdump"
	@@ -246,12 +245,11 @@
	#define PACKAGE_URL ""

	/* Define to the version of this package. */
	-#define PACKAGE_VERSION "4.99.5"
	-
	-/* The size of `void ', as computed by sizeof. /
	-/* #undef SIZEOF_VOID_P */
	+#define PACKAGE_VERSION "4.99.6"

	-/* Define to 1 if you have the ANSI C header files. */
	+/* Define to 1 if all of the C90 standard headers exist (not just the ones
	+ required in a freestanding environment). This macro is provided for
	+ backward compatibility; new code need not use it. */
	#define STDC_HEADERS 1

	/* Define to 1 if sys/ethernet.h declares `ether_ntohost' */
	@@ -293,3 +291,7 @@
	/* Define to the type of an unsigned integer type wide enough to hold a
	pointer, if such a type exists, and if the system does not define it. */
	/* #undef uintptr_t */
	+
	+
	+#endif // TCPDUMP_CONFIG_H_
	+

File Metadata

Mime Type: text/plain
Expires: Fri, Jun 26, 6:54 PM (7 h, 15 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 34321446
Default Alt Text: D55578.id.diff (179 KB)

D55578.id.diffNo OneTemporaryActions

D55578.id.diffView Options

File Metadata

Event Timeline

D55578.id.diff
No OneTemporary
Actions

D55578.id.diff
View Options