Create a more modular type system for the FT_* types. Put them

into epan/ftypes.

Re-write display filter routines using Lemon parser instead of yacc.
Besides using a different tool, the new grammar is much simpler, while
the display filter engine itself is more powerful and more easily extended.

Add dftest executable, to test display filter "bytecode" generation.
Add option to "configure" to build dftest or randpkt, both of which are not
built by default.

Implement Ed Warnicke's ideas about dranges in the new display filter and
ftype code.

Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered
as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree,
while FT_PROTOCOL is used for protocols. This was necessary for being
able to make byte slices (ranges) out of protocols, like "frame[0:3]"

Win32 Makefile.nmake's will be added tonight.

svn path=/trunk/; revision=2967

24 files changed, 2914 insertions, 0 deletions

diff --git a/epan/dfilter/.cvsignore b/epan/dfilter/.cvsignore
new file mode 100644
index 0000000000..8881f6cef9
--- /dev/null
+++ b/epan/dfilter/.cvsignore
@@ -0,0 +1,8 @@
+.cvsignore
+.deps
+scanner.c
+Makefile
+grammar.h
+grammar.out
+Makefile.in
+grammar.c
diff --git a/epan/dfilter/Makefile.am b/epan/dfilter/Makefile.am
new file mode 100644
index 0000000000..3de048250d
--- /dev/null
+++ b/epan/dfilter/Makefile.am
@@ -0,0 +1,81 @@
+# Makefile.am
+# Automake file for the GTK interface routines for Ethereal
+#
+# $Id: Makefile.am,v 1.1 2001/02/01 20:21:18 gram Exp $
+#
+# Ethereal - Network traffic analyzer
+# By Gerald Combs <gerald@zing.org>
+# Copyright 2001 Gerald Combs
+#
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+# We produce an archive library. In the future, when libethereal is a
+# shared library, this will be linked into libethereal. While libethereal
+# is an archive library, any executable linking against libethereal will
+# also need to link against libftypes.
+noinst_LIBRARIES = libdfilter.a
+
+CLEANFILES = \
+	libdfilter.a		\
+	*~
+
+INCLUDES = -I$(srcdir)/../..  -I$(srcdir)/$(LEMON)
+
+libdfilter_a_SOURCES = \
+	cppmagic.h		\
+	dfilter.c		\
+	dfilter.h		\
+	dfilter-int.h		\
+	dfvm.c			\
+	dfvm.h			\
+	gencode.c		\
+	gencode.h		\
+	glib-util.c		\
+	glib-util.h		\
+	grammar.c		\
+	grammar.h		\
+	scanner.c		\
+	semcheck.c		\
+	semcheck.h		\
+	sttype-pointer.c	\
+	sttype-range.c		\
+	sttype-range.h		\
+	sttype-string.c		\
+	sttype-test.c		\
+	sttype-test.h		\
+	syntax-tree.c		\
+	syntax-tree.h
+
+#	Makefile.nmake		
+EXTRA_DIST = \
+	grammar.lemon		\
+	lemonflex-head.inc	\
+	lemonflex-tail.inc	\
+	lemon.c			\
+	lempar.c		\
+	scanner.l
+
+scanner.c : scanner.l
+	$(LEX) -Pdf_ -oscanner.c $(srcdir)/scanner.l
+
+scanner.o : scanner.c grammar.h
+
+LEMON=../../tools/lemon
+
+grammar.c grammar.h : grammar.lemon
+	$(LEMON)/lemon t=$(srcdir)/$(LEMON)/lempar.c $(srcdir)/grammar.lemon || \
+		(rm -f grammar.c grammar.h ; false)
+
diff --git a/epan/dfilter/cppmagic.h b/epan/dfilter/cppmagic.h
new file mode 100644
index 0000000000..92bef11eb1
--- /dev/null
+++ b/epan/dfilter/cppmagic.h
@@ -0,0 +1,14 @@
+/* $Id: cppmagic.h,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+/**************************************** CPP definitions ***************/
+
+/* CPP magic: Concatenate two strings or macros that resolve to strings.
+ * Use CONCAT(), not _CONCAT() */
+#define _CONCAT(a,b)		a ## b
+#define CONCAT(a,b)		_CONCAT(a,b)
+
+/* CPP magic: Surround a string or a macro that resolves to a string with
+ * double quotes. */
+#define _STRINGIFY(a)		# a
+#define STRINGIFY(a)		_STRINGIFY(a)
+
diff --git a/epan/dfilter/dfilter-int.h b/epan/dfilter/dfilter-int.h
new file mode 100644
index 0000000000..e3bd84325e
--- /dev/null
+++ b/epan/dfilter/dfilter-int.h
@@ -0,0 +1,52 @@
+/* dfilter-int.h
+ * Header information for use by multiple files in the dfilter submodule.
+ *
+ * $Id: dfilter-int.h,v 1.1 2001/02/01 20:21:18 gram Exp $
+ *
+ */
+
+#ifndef DFILTER_INT_H
+#define DFILTER_INT_H
+
+#include "dfilter.h"
+#include "syntax-tree.h"
+
+#include "proto.h"
+
+/* Passed back to user */
+struct _dfilter_t {
+	GPtrArray	*insns;
+	int		num_registers;
+	GList		**registers;
+	gboolean	*attempted_load;
+};
+
+typedef struct {
+	/* Syntax Tree stuff */
+	stnode_t	*st_root;
+	gboolean	syntax_error;
+	GPtrArray	*insns;
+	GHashTable	*loaded_fields;
+	int		next_insn_id;
+	int		next_register;
+} dfwork_t;
+
+/* Constructor/Destructor prototypes for Lemon Parser */
+void *DfilterAlloc(void* (*)());
+void DfilterFree(void*, void (*)());
+void Dfilter(void*, int, stnode_t*, dfwork_t*);
+
+/* Scanner's lval */
+extern stnode_t *df_lval;
+
+/* Given a field abbreviation, returns the proto ID, or -1 if
+ * it doesn't exist. */
+header_field_info*
+dfilter_lookup_token(char *abbrev);
+
+/* Set dfilter_error_msg_buf and dfilter_error_msg */
+void
+dfilter_fail(char *format, ...);
+
+
+#endif
diff --git a/epan/dfilter/dfilter.c b/epan/dfilter/dfilter.c
new file mode 100644
index 0000000000..a8d249cbf4
--- /dev/null
+++ b/epan/dfilter/dfilter.c
@@ -0,0 +1,352 @@
+/* dfilter.c
+ * Main entry point for dfilter routines
+ *
+ * $Id: dfilter.c,v 1.1 2001/02/01 20:21:18 gram Exp $
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+
+#ifdef NEED_SNPRINTF_H
+#include "snprintf.h"
+#endif
+
+#include "dfilter-int.h"
+#include "syntax-tree.h"
+#include "gencode.h"
+#include "semcheck.h"
+#include "dfvm.h"
+
+
+/* Balanced tree of abbreviations and IDs */
+GTree *dfilter_tokens = NULL;
+
+#define DFILTER_TOKEN_ID_OFFSET	1
+
+/* Comparision function for tree insertion. A wrapper around strcmp() */
+static int g_strcmp(gconstpointer a, gconstpointer b);
+
+/* Global error message space for dfilter_compile errors */
+gchar dfilter_error_msg_buf[1024];
+gchar *dfilter_error_msg;	/* NULL when no error resulted */
+
+/* In proto.c */
+extern int hf_text_only;
+
+/* From scanner.c */
+void    df_scanner_text(const char *text);
+void    df_scanner_file(FILE *fh);
+void    df_scanner_cleanup(void);
+int     df_lex(void);
+
+/* Holds the singular instance of our Lemon parser object */
+void*		ParserObj = NULL;
+
+void
+dfilter_fail(char *format, ...)
+{
+	va_list	args;
+
+	/* If we've already reported one error, don't overwite it */
+	if (dfilter_error_msg != NULL)
+		return;
+
+	va_start(args, format);
+
+	vsnprintf(dfilter_error_msg_buf, sizeof(dfilter_error_msg_buf),
+			format, args);
+	dfilter_error_msg = dfilter_error_msg_buf;
+	va_end(args);
+}
+
+
+/* Initialize the dfilter module */
+void
+dfilter_init(void)
+{
+	int 			id, num_symbols;
+	char 			*abbrev;
+	header_field_info	*hfinfo, *same_name_hfinfo;
+
+	num_symbols = proto_registrar_n();
+
+	if (dfilter_tokens) {
+		/* XXX - needed? */
+		g_message("I expected hf_ids to be NULL\n");
+		g_tree_destroy(dfilter_tokens);
+
+		/* Make sure the hfinfo->same_name links are broken */
+		for (id = 0; id < num_symbols; id++) {
+			hfinfo = proto_registrar_get_nth(id);
+			hfinfo->same_name = NULL;
+		}
+	}
+	dfilter_tokens = g_tree_new(g_strcmp);
+
+	/* Populate the abbrev/ID GTree (header-field symbol table) */
+
+	
+	for (id = 0; id < num_symbols; id++) {
+		if (id == hf_text_only) {
+			continue;
+		}
+		abbrev = proto_registrar_get_abbrev(id);
+		hfinfo = proto_registrar_get_nth(id);
+
+		g_assert(abbrev);		/* Not Null */
+		g_assert(abbrev[0] != 0);	/* Not empty string */
+
+		/* We allow multiple hfinfo's to be registered under the same
+		 * abbreviation. This was done for X.25 */
+		same_name_hfinfo = g_tree_lookup(dfilter_tokens, abbrev);
+		if (same_name_hfinfo) {
+			/* Set the "same_name" pointer in the hfinfo, then
+			 * allow the code after this if{} block to replace the
+			 * old hfinfo with the new hfinfo in the GTree. Thus,
+			 * we end up with a linked-list of same-named hfinfo's,
+			 * with the root of the list being the hfinfo in the GTree */
+			hfinfo->same_name = same_name_hfinfo;
+
+		}
+		g_tree_insert(dfilter_tokens, abbrev, hfinfo);
+	}
+
+	if (ParserObj) {
+		g_message("I expected ParserObj to be NULL\n");
+		/* Free the Lemon Parser object */
+		DfilterFree(ParserObj, g_free);
+	}
+	/* Allocate an instance of our Lemon-based parser */
+	ParserObj = DfilterAlloc(g_malloc);
+
+	/* Initialize the syntax-tree sub-sub-system */
+	sttype_init();
+}
+
+/* Clean-up the dfilter module */
+void
+dfilter_cleanup(void)
+{
+	/* Free the abbrev/ID GTree */
+	if (dfilter_tokens) {
+		g_tree_destroy(dfilter_tokens);
+		dfilter_tokens = NULL;
+	}
+
+	/* Free the Lemon Parser object */
+	if (ParserObj) {
+		DfilterFree(ParserObj, g_free);
+	}
+
+	/* Clean up the syntax-tree sub-sub-system */
+	sttype_cleanup();
+}
+
+
+
+/* Lookup an abbreviation in our token tree, returing the ID #
+ * If the abbreviation doesn't exit, returns -1 */
+header_field_info*
+dfilter_lookup_token(char *abbrev)
+{
+	g_assert(abbrev != NULL);
+	return g_tree_lookup(dfilter_tokens, abbrev);
+}
+
+/* String comparison func for dfilter_token GTree */
+static int
+g_strcmp(gconstpointer a, gconstpointer b)
+{
+	return strcmp((const char*)a, (const char*)b);
+}
+
+static dfilter_t*
+dfilter_new(void)
+{
+	dfilter_t	*df;
+
+	df = g_new(dfilter_t, 1);
+	df->insns = NULL;
+
+	return df;
+}
+
+/* Given a GPtrArray of instructions (dfvm_insn_t),
+ * free them. */
+static void
+free_insns(GPtrArray *insns)
+{
+	int		i;
+	dfvm_insn_t	*insn;
+
+	for (i = 0; i < insns->len; i++) {
+		insn = g_ptr_array_index(insns, i);
+		dfvm_insn_free(insn);
+	}
+}
+
+void
+dfilter_free(dfilter_t *df)
+{
+	if (df->insns) {
+		free_insns(df->insns);
+	}
+
+	g_free(df->registers);
+	g_free(df->attempted_load);
+	g_free(df);
+}
+
+
+static dfwork_t*
+dfwork_new(void)
+{
+	dfwork_t	*dfw;
+
+	dfw = g_new(dfwork_t, 1);
+
+	dfw->st_root = NULL;
+	dfw->syntax_error = FALSE;
+	dfw->insns = NULL;
+	dfw->loaded_fields = NULL;
+	dfw->next_insn_id = 0;
+	dfw->next_register = 0;
+
+	return dfw;
+}
+
+static void
+dfwork_free(dfwork_t *dfw)
+{
+	if (dfw->st_root) {
+		stnode_free(dfw->st_root);
+	}
+
+	if (dfw->loaded_fields) {
+		g_hash_table_destroy(dfw->loaded_fields);
+	}
+
+	if (dfw->insns) {
+		free_insns(dfw->insns);
+	}
+
+	g_free(dfw);
+}
+
+
+gboolean
+dfilter_compile(gchar *text, dfilter_t **dfp)
+{
+	int		token;
+	dfilter_t	*dfilter;
+	dfwork_t	*dfw;
+
+	dfilter_error_msg = NULL;
+
+	dfw = dfwork_new();
+
+	df_scanner_text(text);
+
+	while (1) {
+		df_lval = stnode_new(STTYPE_UNINITIALIZED, NULL);
+		token = df_lex();
+
+		/* Check for end-of-input */
+		if (token == 0) {
+			/* Tell the parser that we have reached the end of input */
+			Dfilter(ParserObj, 0, NULL, dfw);
+
+			/* Free the stnode_t that we just generated, since
+			 * the parser doesn't know about it and won't free it
+			 * for us. */
+			stnode_free(df_lval);
+			df_lval = NULL;
+			break;
+		}
+
+		/* Give the token to the parser */
+		Dfilter(ParserObj, token, df_lval, dfw);
+
+		if (dfw->syntax_error) {
+			break;
+		}
+	}
+
+	/* One last check for syntax error (after EOF) */
+	if (dfw->syntax_error) {
+		goto FAILURE;
+	}
+
+
+	/* Success, but was it an empty filter? If so, discard
+	 * it and set *dfp to NULL */
+	if (dfw->st_root == NULL) {
+		*dfp = NULL;
+	}
+	else {
+
+		/* Check semantics and do necessary type conversion*/
+		if (!dfw_semcheck(dfw)) {
+			goto FAILURE;
+		}
+
+		/* Create bytecode */
+		dfw_gencode(dfw);
+	
+		/* Tuck away the bytecode in the dfilter_t */
+		dfilter = dfilter_new();
+		dfilter->insns = dfw->insns;
+		dfw->insns = NULL;
+
+		/* Initialize run-time space */
+		dfilter->num_registers = dfw->next_register;
+		dfilter->registers = g_new0(GList*, dfilter->num_registers);
+		dfilter->attempted_load = g_new0(gboolean, dfilter->num_registers);
+
+		/* And give it to the user. */
+		*dfp = dfilter;
+	}
+	/* SUCCESS */
+	dfwork_free(dfw);
+
+	/* Reset flex */
+	df_scanner_cleanup();
+
+	return TRUE;
+
+FAILURE:
+	if (dfw) {
+		dfwork_free(dfw);
+	}
+	dfilter_fail("Unable to parse filter string \"%s\".", text);
+	*dfp = NULL;
+
+	/* Reset flex */
+	df_scanner_cleanup();
+	return FALSE;
+
+}
+
+
+gboolean
+dfilter_apply(dfilter_t *df, tvbuff_t *tvb, proto_tree *tree)
+{
+	return dfvm_apply(df, tvb, tree);
+}
+
+gboolean
+dfilter_apply_edt(dfilter_t *df, epan_dissect_t* edt)
+{
+	return dfvm_apply(df, edt->tvb, edt->tree);
+}
+
+
+void
+dfilter_dump(dfilter_t *df)
+{
+	dfvm_dump(stdout, df->insns);
+}
diff --git a/epan/dfilter/dfilter.h b/epan/dfilter/dfilter.h
new file mode 100644
index 0000000000..b9442f42c8
--- /dev/null
+++ b/epan/dfilter/dfilter.h
@@ -0,0 +1,65 @@
+/* dfilter.h
+ *
+ * $Id: dfilter.h,v 1.1 2001/02/01 20:21:18 gram Exp $
+ */
+
+#ifndef DFILTER_H
+#define DFILTER_H
+
+#include <glib.h>
+#include "epan.h"
+#include "proto.h"
+
+/* Passed back to user */
+typedef struct _dfilter_t dfilter_t;
+
+/* Module-level initialization */
+void
+dfilter_init(void);
+
+/* Module-level cleanup */
+void
+dfilter_cleanup(void);
+
+/* Compiles a string to a dfilter_t.
+ * On success, sets the dfilter* pointed to by dfp
+ * to either a NULL pointer (if the filter is a null
+ * filter, as generated by an all-blank string) or to
+ * a pointer to the newly-allocated dfilter_t
+ * structure.
+ *
+ * On failure, dfilter_error_msg points to an
+ * appropriate error message. This error message is
+ * a global string, so another invocation of
+ * dfilter_compile() will clear it. The dfilter*
+ * will be set to NULL after a failure.
+ *
+ * Returns TRUE on success, FALSE on failure.
+ */
+gboolean
+dfilter_compile(gchar *text, dfilter_t **dfp);
+
+/* Frees all memory used by dfilter, and frees
+ * the dfilter itself. */
+void
+dfilter_free(dfilter_t *df);
+
+
+/* dfilter_error_msg is NULL if there was no error during dfilter_compile,
+ * otherwise it points to a displayable error message. */
+extern gchar *dfilter_error_msg;
+
+/* Apply compiled dfilter */
+gboolean
+dfilter_apply_edt(dfilter_t *df, epan_dissect_t* edt);
+
+/* Apply compiled dfilter */
+gboolean
+dfilter_apply(dfilter_t *df, tvbuff_t *tvb, proto_tree *tree);
+
+
+/* Print bytecode of dfilter to stdout */
+void
+dfilter_dump(dfilter_t *df);
+
+#endif
diff --git a/epan/dfilter/dfvm.c b/epan/dfilter/dfvm.c
new file mode 100644
index 0000000000..bf8bfe8e17
--- /dev/null
+++ b/epan/dfilter/dfvm.c
@@ -0,0 +1,395 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "dfvm.h"
+
+dfvm_insn_t*
+dfvm_insn_new(dfvm_opcode_t op)
+{
+	dfvm_insn_t	*insn;
+
+	insn = g_new(dfvm_insn_t, 1);
+	insn->op = op;
+	insn->arg1 = NULL;
+	insn->arg2 = NULL;
+	insn->arg3 = NULL;
+	insn->arg4 = NULL;
+	return insn;
+}
+
+void
+dfvm_insn_free(dfvm_insn_t *insn)
+{
+	if (insn->arg1) {
+		dfvm_value_free(insn->arg1);
+	}
+	if (insn->arg2) {
+		dfvm_value_free(insn->arg2);
+	}
+	if (insn->arg3) {
+		dfvm_value_free(insn->arg3);
+	}
+	if (insn->arg4) {
+		dfvm_value_free(insn->arg4);
+	}
+	g_free(insn);
+}
+
+
+
+dfvm_value_t*
+dfvm_value_new(dfvm_value_type_t type)
+{
+	dfvm_value_t	*v;
+
+	v = g_new(dfvm_value_t, 1);
+	v->type = type;
+	return v;
+}
+
+void
+dfvm_value_free(dfvm_value_t *v)
+{
+	switch (v->type) {
+		case FVALUE:
+			fvalue_free(v->value.fvalue);
+			break;
+		default:
+			/* nothing */
+			;
+	}
+	g_free(v);
+}
+
+
+void
+dfvm_dump(FILE *f, GPtrArray *insns)
+{
+	int		id, length;
+	dfvm_insn_t	*insn;
+	dfvm_value_t	*arg1;
+	dfvm_value_t	*arg2;
+	dfvm_value_t	*arg3;
+	dfvm_value_t	*arg4;
+
+	length = insns->len;
+
+	for (id = 0; id < length; id++) {
+
+		insn = g_ptr_array_index(insns, id);
+		arg1 = insn->arg1;
+		arg2 = insn->arg2;
+		arg3 = insn->arg3;
+		arg4 = insn->arg4;
+
+		switch (insn->op) {
+			case CHECK_EXISTS:
+				fprintf(f, "%05d CHECK_EXISTS\t%s\n",
+					id, proto_registrar_get_abbrev(arg1->value.numeric));
+				break;
+
+			case READ_TREE:
+				fprintf(f, "%05d READ_TREE\t\t%s -> reg#%d\n",
+					id, proto_registrar_get_abbrev(arg1->value.numeric),
+					arg2->value.numeric);
+				break;
+
+			case PUT_FVALUE:
+				fprintf(f, "%05d PUT_FVALUE\t<%s> -> reg#%d\n",
+					id, fvalue_type_name(arg1->value.fvalue),
+					arg2->value.numeric);
+				break;
+
+			case MK_RANGE:
+				fprintf(f, "%05d MK_RANGE\t\treg#%d[%d:%d] -> reg#%d\n",
+					id,
+					arg1->value.numeric,
+					arg3->value.numeric,
+					arg4->value.numeric,
+					arg2->value.numeric);
+				break;
+
+			case ANY_EQ:
+				fprintf(f, "%05d ANY_EQ\t\treg#%d == reg#%d\n",
+					id, arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_NE:
+				fprintf(f, "%05d ANY_NE\t\treg#%d == reg#%d\n",
+					id, arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_GT:
+				fprintf(f, "%05d ANY_GT\t\treg#%d == reg#%d\n",
+					id, arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_GE:
+				fprintf(f, "%05d ANY_GE\t\treg#%d == reg#%d\n",
+					id, arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_LT:
+				fprintf(f, "%05d ANY_LT\t\treg#%d == reg#%d\n",
+					id, arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_LE:
+				fprintf(f, "%05d ANY_LE\t\treg#%d == reg#%d\n",
+					id, arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case NOT:
+				fprintf(f, "%05d NOT\n", id);
+				break;
+
+			case RETURN:
+				fprintf(f, "%05d RETURN\n", id);
+				break;
+
+			case IF_TRUE_GOTO:
+				fprintf(f, "%05d IF-TRUE-GOTO\t%d\n",
+						id, arg1->value.numeric);
+				break;
+
+			case IF_FALSE_GOTO:
+				fprintf(f, "%05d IF-FALSE-GOTO\t%d\n",
+						id, arg1->value.numeric);
+				break;
+
+			default:
+				g_assert_not_reached();
+				break;
+		}
+	}
+}
+
+/* Reads a field from the proto_tree and loads the fvalues into a register,
+ * if that field has not already been read. */
+static gboolean
+read_tree(dfilter_t *df, proto_tree *tree, int field_id, int reg)
+{
+	GPtrArray	*finfos;
+	field_info	*finfo;
+	int		i, len;
+	GList		*fvalues = NULL;
+
+	/* Already loaded in this run of the dfilter? */
+	if (df->attempted_load[reg]) {
+		if (df->registers[reg]) {
+			return TRUE;
+		}
+		else {
+			return FALSE;
+		}
+	}
+
+	df->attempted_load[reg] = TRUE;
+
+	finfos = proto_get_finfo_ptr_array(tree, field_id);
+	if (!finfos) {
+		return FALSE;
+	}
+
+	len = finfos->len;
+	for (i = 0; i < len; i++) {
+		finfo = g_ptr_array_index(finfos, i);
+		fvalues = g_list_prepend(fvalues, finfo->value);
+	}
+	fvalues = g_list_reverse(fvalues);
+
+	df->registers[reg] = fvalues;
+	return TRUE;
+}
+
+
+static gboolean
+put_fvalue(dfilter_t *df, fvalue_t *fv, int reg)
+{
+	df->registers[reg] = g_list_append(NULL, fv);
+	return TRUE;
+}
+
+typedef gboolean (*FvalueCmpFunc)(fvalue_t*, fvalue_t*);
+
+static gboolean
+any_test(dfilter_t *df, FvalueCmpFunc cmp, int reg1, int reg2)
+{
+	GList	*list_a, *list_b;
+
+	list_a = df->registers[reg1];
+
+	while (list_a) {
+		list_b = df->registers[reg2];
+		while (list_b) {
+			if (cmp(list_a->data, list_b->data)) {
+				return TRUE;
+			}
+			list_b = g_list_next(list_b);
+		}
+		list_a = g_list_next(list_a);
+	}
+	return FALSE;
+}
+
+
+/* Free the list nodes w/o freeing the memory that each
+ * list node points to. */
+static void
+free_register_overhead(dfilter_t* df)
+{
+	int i;
+
+	for (i = 0; i < df->num_registers; i++) {
+		if (df->registers[i]) {
+			g_list_free(df->registers[i]);
+		}
+	}
+}
+
+/* Takes the list of fvalue_t's in a register, uses fvalue_slice()
+ * to make a new list of fvalue_t's (which are ranges, or byte-slices),
+ * and puts the new list into a new register. */
+static void
+mk_range(dfilter_t *df, int from_reg, int to_reg, int start, int end)
+{
+	GList		*from_list, *to_list;
+	fvalue_t	*old_fv, *new_fv;
+
+	to_list = NULL;
+	from_list = df->registers[from_reg];
+
+	while (from_list) {
+		old_fv = from_list->data;
+		new_fv = fvalue_slice(old_fv, start, end);
+		/* Assert there because semcheck.c should have
+		 * already caught the cases in which a slice
+		 * cannot be made. */
+		g_assert(new_fv);
+		to_list = g_list_append(to_list, new_fv);
+
+		from_list = g_list_next(from_list);
+	}
+
+	df->registers[to_reg] = to_list;
+}
+
+
+
+gboolean
+dfvm_apply(dfilter_t *df, tvbuff_t *tvb, proto_tree *tree)
+{
+	int		i, id, length;
+	gboolean	accum = TRUE;
+	dfvm_insn_t	*insn;
+	dfvm_value_t	*arg1;
+	dfvm_value_t	*arg2;
+	dfvm_value_t	*arg3;
+	dfvm_value_t	*arg4;
+
+	g_assert(tvb);
+	g_assert(tree);
+
+
+	/* Clear registers */
+	for (i = 0; i < df->num_registers; i++) {
+		df->registers[i] = NULL;
+		df->attempted_load[i] = FALSE;
+	}
+
+	length = df->insns->len;
+
+	for (id = 0; id < length; id++) {
+
+	  AGAIN:
+		insn = g_ptr_array_index(df->insns, id);
+		arg1 = insn->arg1;
+		arg2 = insn->arg2;
+
+		switch (insn->op) {
+			case CHECK_EXISTS:
+				accum = proto_check_for_protocol_or_field(tree,
+						arg1->value.numeric);
+				break;
+
+			case READ_TREE:
+				accum = read_tree(df, tree,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case PUT_FVALUE:
+				accum = put_fvalue(df,
+						arg1->value.fvalue, arg2->value.numeric);
+				break;
+
+			case MK_RANGE:
+				arg3 = insn->arg3;
+				arg4 = insn->arg4;
+				mk_range(df,
+						arg1->value.numeric, arg2->value.numeric,
+						arg3->value.numeric, arg4->value.numeric);
+				break;
+
+			case ANY_EQ:
+				accum = any_test(df, fvalue_eq,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_NE:
+				accum = any_test(df, fvalue_ne,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_GT:
+				accum = any_test(df, fvalue_gt,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_GE:
+				accum = any_test(df, fvalue_ge,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_LT:
+				accum = any_test(df, fvalue_lt,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case ANY_LE:
+				accum = any_test(df, fvalue_le,
+						arg1->value.numeric, arg2->value.numeric);
+				break;
+
+			case NOT:
+				accum = !accum;
+				break;
+
+			case RETURN:
+				free_register_overhead(df);
+				return accum;
+
+			case IF_TRUE_GOTO:
+				if (accum) {
+					id = arg1->value.numeric;
+					goto AGAIN;
+				}
+				break;
+
+			case IF_FALSE_GOTO:
+				if (!accum) {
+					id = arg1->value.numeric;
+					goto AGAIN;
+				}
+				break;
+
+
+			default:
+				g_assert_not_reached();
+				break;
+		}
+	}
+
+	g_assert_not_reached();
+	return FALSE; /* to appease the compiler */
+}
diff --git a/epan/dfilter/dfvm.h b/epan/dfilter/dfvm.h
new file mode 100644
index 0000000000..d7803635da
--- /dev/null
+++ b/epan/dfilter/dfvm.h
@@ -0,0 +1,77 @@
+#ifndef DFVM_H
+#define DFVM_H
+
+#include <stdio.h>
+#include "proto.h"
+#include "dfilter-int.h"
+#include "syntax-tree.h"
+
+typedef enum {
+	EMPTY,
+	FVALUE,
+	FIELD_ID,
+	INSN_NUMBER,
+	REGISTER,
+	INTEGER
+} dfvm_value_type_t;
+
+typedef struct {
+	dfvm_value_type_t	type;
+
+	union {
+		fvalue_t	*fvalue;
+		guint32		numeric;
+	} value;
+
+} dfvm_value_t;
+
+
+typedef enum {
+
+	IF_TRUE_GOTO,
+	IF_FALSE_GOTO,
+	CHECK_EXISTS,
+	NOT,
+	RETURN,
+	READ_TREE,
+	PUT_FVALUE,
+	ANY_EQ,
+	ANY_NE,
+	ANY_GT,
+	ANY_GE,
+	ANY_LT,
+	ANY_LE,
+	MK_RANGE
+	
+} dfvm_opcode_t;
+
+typedef struct {
+	int		id;
+	int		LHS;
+	dfvm_opcode_t	op;
+	dfvm_value_t	*arg1;
+	dfvm_value_t	*arg2;
+	dfvm_value_t	*arg3;
+	dfvm_value_t	*arg4;
+} dfvm_insn_t;
+
+dfvm_insn_t*
+dfvm_insn_new(dfvm_opcode_t op);
+
+void
+dfvm_insn_free(dfvm_insn_t *insn);
+
+dfvm_value_t*
+dfvm_value_new(dfvm_value_type_t type);
+
+void
+dfvm_value_free(dfvm_value_t *v);
+
+void
+dfvm_dump(FILE *f, GPtrArray *insns);
+
+gboolean
+dfvm_apply(dfilter_t *df, tvbuff_t *tvb, proto_tree *tree);
+
+
+#endif
diff --git a/epan/dfilter/gencode.c b/epan/dfilter/gencode.c
new file mode 100644
index 0000000000..61c5546cb6
--- /dev/null
+++ b/epan/dfilter/gencode.c
@@ -0,0 +1,299 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "dfilter-int.h"
+#include "dfvm.h"
+#include "syntax-tree.h"
+#include "sttype-range.h"
+#include "sttype-test.h"
+#include "ftypes/ftypes.h"
+#include "gdebug.h"
+
+static void
+gencode(dfwork_t *dfw, stnode_t *st_node);
+
+static void
+dfw_append_insn(dfwork_t *dfw, dfvm_insn_t *insn)
+{
+	insn->id = dfw->next_insn_id;
+	dfw->next_insn_id++;
+	g_ptr_array_add(dfw->insns, insn);
+}
+
+/* returns register number */
+static int
+dfw_append_read_tree(dfwork_t *dfw, int field_id)
+{
+	dfvm_insn_t	*insn;
+	dfvm_value_t	*val1, *val2;
+	int		reg = -1;
+
+	/* Keep track of which registers
+	 * were used for which field_id's so that we
+	 * can re-use registers. */
+	reg = GPOINTER_TO_UINT(
+			g_hash_table_lookup(dfw->loaded_fields,
+			GUINT_TO_POINTER(field_id)));
+	if (reg) {
+		/* Reg's are stored in has as reg+1, so
+		 * that the non-existence of a field_id in
+		 * the hash, or 0, can be differentiated from
+		 * a field_id being loaded into register #0. */
+		reg--;
+	}
+	else {
+		reg = dfw->next_register++;
+		g_hash_table_insert(dfw->loaded_fields,
+			GUINT_TO_POINTER(field_id),
+			GUINT_TO_POINTER(reg + 1));
+	}
+
+	insn = dfvm_insn_new(READ_TREE);
+	val1 = dfvm_value_new(FIELD_ID);
+	val1->value.numeric = field_id;
+	val2 = dfvm_value_new(REGISTER);
+	val2->value.numeric = reg;
+
+	insn->arg1 = val1;
+	insn->arg2 = val2;
+	dfw_append_insn(dfw, insn);
+
+	return reg;
+}
+
+/* returns register number */
+static int
+dfw_append_put_fvalue(dfwork_t *dfw, fvalue_t *fv)
+{
+	dfvm_insn_t	*insn;
+	dfvm_value_t	*val1, *val2;
+	int		reg;
+
+	insn = dfvm_insn_new(PUT_FVALUE);
+	val1 = dfvm_value_new(FVALUE);
+	val1->value.fvalue = fv;
+	val2 = dfvm_value_new(REGISTER);
+	reg = dfw->next_register++;
+	val2->value.numeric = reg;
+	insn->arg1 = val1;
+	insn->arg2 = val2;
+	dfw_append_insn(dfw, insn);
+
+	return reg;
+}
+
+/* returns register number */
+static int
+dfw_append_mk_range(dfwork_t *dfw, stnode_t *node)
+{
+	int			hf_reg, reg;
+	header_field_info	*hfinfo;
+	dfvm_insn_t		*insn;
+	dfvm_value_t		*val;
+
+	hfinfo = sttype_range_hfinfo(node);
+	hf_reg = dfw_append_read_tree(dfw, hfinfo->id);
+
+	insn = dfvm_insn_new(MK_RANGE);
+
+	val = dfvm_value_new(REGISTER);
+	val->value.numeric = hf_reg;
+	insn->arg1 = val;
+
+	val = dfvm_value_new(REGISTER);
+	reg =dfw->next_register++;
+	val->value.numeric = reg;
+	insn->arg2 = val;
+
+	val = dfvm_value_new(INTEGER);
+	val->value.numeric = sttype_range_start(node);
+	insn->arg3 = val;
+
+	val = dfvm_value_new(INTEGER);
+	val->value.numeric = sttype_range_end(node);
+	insn->arg4 = val;
+
+	dfw_append_insn(dfw, insn);
+
+	return reg;
+}
+
+
+static void
+gen_relation(dfwork_t *dfw, dfvm_opcode_t op, stnode_t *st_arg1, stnode_t *st_arg2)
+{
+	sttype_id_t	type1, type2;
+	dfvm_insn_t	*insn;
+	dfvm_value_t	*val1, *val2;
+	dfvm_value_t	*jmp1 = NULL, *jmp2 = NULL;
+	int		reg1 = -1, reg2 = -1;
+	header_field_info	*hfinfo;
+
+	fvalue_t	*junk = NULL;
+
+	type1 = stnode_type_id(st_arg1);
+	type2 = stnode_type_id(st_arg2);
+
+	if (type1 == STTYPE_FIELD) {
+		hfinfo = stnode_data(st_arg1);
+		reg1 = dfw_append_read_tree(dfw, hfinfo->id);
+
+		insn = dfvm_insn_new(IF_FALSE_GOTO);
+		jmp1 = dfvm_value_new(INSN_NUMBER);
+		insn->arg1 = jmp1;
+		dfw_append_insn(dfw, insn);
+	}
+	else if (type1 == STTYPE_FVALUE) {
+		reg1 = dfw_append_put_fvalue(dfw, stnode_data(st_arg1));
+	}
+	else if (type1 == STTYPE_RANGE) {
+		reg1 = dfw_append_mk_range(dfw, st_arg1);
+	}
+	else {
+		g_assert_not_reached();
+	}
+
+	if (type2 == STTYPE_FIELD) {
+		hfinfo = stnode_data(st_arg2);
+		reg2 = dfw_append_read_tree(dfw, hfinfo->id);
+
+		insn = dfvm_insn_new(IF_FALSE_GOTO);
+		jmp2 = dfvm_value_new(INSN_NUMBER);
+		insn->arg1 = jmp2;
+		dfw_append_insn(dfw, insn);
+	}
+	else if (type2 == STTYPE_FVALUE) {
+		reg2 = dfw_append_put_fvalue(dfw, stnode_data(st_arg2));
+	}
+	else {
+		g_assert_not_reached();
+	}
+
+	insn = dfvm_insn_new(op);
+	val1 = dfvm_value_new(REGISTER);
+	val1->value.numeric = reg1;
+	val2 = dfvm_value_new(REGISTER);
+	val2->value.numeric = reg2;
+	insn->arg1 = val1;
+	insn->arg2 = val2;
+	dfw_append_insn(dfw, insn);
+
+	if (jmp1) {
+		jmp1->value.numeric = dfw->next_insn_id;
+	}
+
+	if (jmp2) {
+		jmp2->value.numeric = dfw->next_insn_id;
+	}
+}
+
+
+static void
+gen_test(dfwork_t *dfw, stnode_t *st_node)
+{
+	test_op_t	st_op;
+	stnode_t	*st_arg1, *st_arg2;
+	dfvm_value_t	*val1;
+	dfvm_insn_t	*insn;
+
+	header_field_info	*hfinfo;
+
+	sttype_test_get(st_node, &st_op, &st_arg1, &st_arg2);
+
+	switch (st_op) {
+		case TEST_OP_UNINITIALIZED:
+			g_assert_not_reached();
+			break;
+
+		case TEST_OP_EXISTS:
+			val1 = dfvm_value_new(FIELD_ID);
+			hfinfo = stnode_data(st_arg1);
+			val1->value.numeric = hfinfo->id;
+			insn = dfvm_insn_new(CHECK_EXISTS);
+			insn->arg1 = val1;
+			dfw_append_insn(dfw, insn);
+			break;
+
+		case TEST_OP_NOT:
+			gencode(dfw, st_arg1);
+			insn = dfvm_insn_new(NOT);
+			dfw_append_insn(dfw, insn);
+			break;
+
+		case TEST_OP_AND:
+			gencode(dfw, st_arg1);
+
+			insn = dfvm_insn_new(IF_FALSE_GOTO);
+			val1 = dfvm_value_new(INSN_NUMBER);
+			insn->arg1 = val1;
+			dfw_append_insn(dfw, insn);
+
+			gencode(dfw, st_arg2);
+			val1->value.numeric = dfw->next_insn_id;
+			break;
+
+		case TEST_OP_OR:
+			gencode(dfw, st_arg1);
+
+			insn = dfvm_insn_new(IF_TRUE_GOTO);
+			val1 = dfvm_value_new(INSN_NUMBER);
+			insn->arg1 = val1;
+			dfw_append_insn(dfw, insn);
+
+			gencode(dfw, st_arg2);
+			val1->value.numeric = dfw->next_insn_id;
+			break;
+
+		case TEST_OP_EQ:
+			gen_relation(dfw, ANY_EQ, st_arg1, st_arg2);
+			break;
+
+		case TEST_OP_NE:
+			gen_relation(dfw, ANY_NE, st_arg1, st_arg2);
+			break;
+
+		case TEST_OP_GT:
+			gen_relation(dfw, ANY_GT, st_arg1, st_arg2);
+			break;
+
+		case TEST_OP_GE:
+			gen_relation(dfw, ANY_GE, st_arg1, st_arg2);
+			break;
+
+		case TEST_OP_LT:
+			gen_relation(dfw, ANY_LT, st_arg1, st_arg2);
+			break;
+
+		case TEST_OP_LE:
+			gen_relation(dfw, ANY_LE, st_arg1, st_arg2);
+			break;
+	}
+}
+
+static void
+gencode(dfwork_t *dfw, stnode_t *st_node)
+{
+	const char	*name;
+
+	name = stnode_type_name(st_node);
+
+	switch (stnode_type_id(st_node)) {
+		case STTYPE_TEST:
+			gen_test(dfw, st_node);
+			break;
+		default:
+			g_assert_not_reached();
+	}
+}
+
+
+void
+dfw_gencode(dfwork_t *dfw)
+{
+	dfw->insns = g_ptr_array_new();
+	dfw->loaded_fields = g_hash_table_new(g_direct_hash, g_direct_equal);
+	gencode(dfw, dfw->st_root);
+	dfw_append_insn(dfw, dfvm_insn_new(RETURN));
+}
+
diff --git a/epan/dfilter/gencode.h b/epan/dfilter/gencode.h
new file mode 100644
index 0000000000..db56b9082c
--- /dev/null
+++ b/epan/dfilter/gencode.h
@@ -0,0 +1,7 @@
+#ifndef GENCODE_H
+#define GENCODE_H
+
+void
+dfw_gencode(dfwork_t *dfw);
+
+#endif
diff --git a/epan/dfilter/glib-util.c b/epan/dfilter/glib-util.c
new file mode 100644
index 0000000000..9e63fab4f3
--- /dev/null
+++ b/epan/dfilter/glib-util.c
@@ -0,0 +1,47 @@
+/* $Id: glib-util.c,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+#include <string.h>
+#include <glib.h>
+
+
+#include <glib-util.h>
+
+char*
+g_substrdup(const char *s, int start, int len)
+{
+	int s_len, abs_start, abs_len;
+	char *newstring;
+
+
+	s_len = strlen(s);
+
+	if (start < 0) {
+		abs_start = s_len + start;
+		if (abs_start < 0) {
+			return NULL;
+		}
+	}
+	else {
+		abs_start = start;
+	}
+
+	if (len < 0) {
+		abs_len = s_len + len + 1 - abs_start;
+		if (abs_len < 0) {
+			return NULL;
+		}
+	}
+	else {
+		abs_len = len;
+	}
+
+
+	if (abs_start + abs_len > s_len) {
+		return NULL;
+	}
+
+	newstring = g_strndup(s + abs_start, abs_len + 1);
+	newstring[abs_len] = 0;
+
+	return newstring;
+}	
diff --git a/epan/dfilter/glib-util.h b/epan/dfilter/glib-util.h
new file mode 100644
index 0000000000..90a81f7eed
--- /dev/null
+++ b/epan/dfilter/glib-util.h
@@ -0,0 +1,4 @@
+/* $Id: glib-util.h,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+char*
+g_substrdup(const char *s, int start, int len);
diff --git a/epan/dfilter/grammar.lemon b/epan/dfilter/grammar.lemon
new file mode 100644
index 0000000000..8072458ab7
--- /dev/null
+++ b/epan/dfilter/grammar.lemon
@@ -0,0 +1,185 @@
+/* $Id: grammar.lemon,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+%include {
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "dfilter-int.h"
+#include "syntax-tree.h"
+#include "sttype-range.h"
+#include "sttype-test.h"
+
+/*extern char *df_text;*/
+
+/* End of C code */
+}
+
+/* Parser Information */
+%name		Dfilter
+%token_prefix	TOKEN_
+%extra_argument	{dfwork_t *dfw}
+
+/* Terminal and Non-Terminal types and destructors */
+%token_type			{stnode_t*}
+%token_destructor		{stnode_free($$);}
+
+%type		sentence	{stnode_t*}
+%destructor	sentence	{stnode_free($$);}
+
+%type		expr		{stnode_t*}
+%destructor	expr		{stnode_free($$);}
+
+%type		entity		{stnode_t*}
+%destructor	entity		{stnode_free($$);}
+
+%type		relation_test	{stnode_t*}
+%destructor	relation_test	{stnode_free($$);}
+
+%type		logical_test	{stnode_t*}
+%destructor	logical_test	{stnode_free($$);}
+
+%type		rel_op2		{test_op_t}
+
+%type		range		{stnode_t*}
+%destructor	range		{stnode_free($$);}
+
+/* This is called as soon as a syntax error happens. After that, 
+any "error" symbols are shifted, if possible. */
+%syntax_error {
+
+	header_field_info	*hfinfo;
+
+	if (!TOKEN) {
+		dfilter_fail("Unexpected end of filter string.");
+		return;
+	}
+
+	switch(stnode_type_id(TOKEN)) {
+	        case STTYPE_UNINITIALIZED:
+			dfilter_fail("Syntax error.");
+			break;
+		case STTYPE_TEST:
+			dfilter_fail("Syntax error, TEST.");
+			break;
+		case STTYPE_STRING:
+			dfilter_fail("The string \"%s\" was unexpected in this context.",
+				stnode_data(TOKEN));
+			break;
+		case STTYPE_FIELD:
+			hfinfo = stnode_data(TOKEN);
+			dfilter_fail("Syntax error near \"%s\".", hfinfo->abbrev);
+			break;
+
+		/* These aren't handed to use as terminal tokens from
+		   the scanner, so was can assert that we'll never
+		   see them here. */
+		case STTYPE_NUM_TYPES:
+		case STTYPE_RANGE:
+		case STTYPE_FVALUE:
+			g_assert_not_reached();
+			break;
+	}
+}
+
+/* When a parse fails, mark an error. This occurs after
+the above syntax_error code and after the parser fails to
+use error recovery, shifting an "error" symbol and successfully
+shifting 3 more symbols. */
+%parse_failure {
+	dfw->syntax_error = TRUE;
+}
+
+/* ----------------- The grammar -------------- */
+
+/* Associativity */
+%left TEST_AND.
+%left TEST_OR.
+%nonassoc TEST_EQ TEST_NE TEST_LT TEST_LE TEST_GT TEST_GE.
+%right TEST_NOT.
+
+/* Top-level targets */
+sentence ::= expr(X).  		{ dfw->st_root = X; }
+sentence ::= .  		{ dfw->st_root = NULL; }
+
+expr(X) ::= relation_test(R).	{ X = R; }
+expr(X) ::= logical_test(L).	{ X = L; }
+
+expr(X) ::= LPAREN expr(Y) RPAREN.
+{
+	X = Y;
+}
+
+
+/* Logical tests */
+logical_test(T) ::= expr(E) TEST_AND expr(F).
+{
+	T = stnode_new(STTYPE_TEST, NULL);
+	sttype_test_set2(T, TEST_OP_AND, E, F);
+}
+
+logical_test(T) ::= expr(E) TEST_OR expr(F).
+{
+	T = stnode_new(STTYPE_TEST, NULL);
+	sttype_test_set2(T, TEST_OP_OR, E, F);
+}
+
+logical_test(T) ::= TEST_NOT expr(E).
+{
+	T = stnode_new(STTYPE_TEST, NULL);
+	sttype_test_set1(T, TEST_OP_NOT, E);
+}
+
+logical_test(T) ::= FIELD(F).
+{
+	T = stnode_new(STTYPE_TEST, NULL);
+	sttype_test_set1(T, TEST_OP_EXISTS, F);
+}
+
+
+
+/* Entities, or things that can be compared/tested/checked */
+entity(E) ::= FIELD(F).		{ E = F; }
+entity(E) ::= STRING(S).	{ E = S; }
+entity(E) ::= range(R).		{ E = R; }
+
+range(R) ::= FIELD(F) LBRACKET STRING(X) COLON STRING(Y) RBRACKET.
+{
+	R = stnode_new(STTYPE_RANGE, NULL);
+	sttype_range_set(R, F, X, Y);
+}
+
+range(R) ::= FIELD(F) LBRACKET STRING(X) COLON RBRACKET.
+{
+	R = stnode_new(STTYPE_RANGE, NULL);
+	sttype_range_set(R, F, X, NULL);
+}
+
+range(R) ::= FIELD(F) LBRACKET COLON STRING(Y) RBRACKET.
+{
+	R = stnode_new(STTYPE_RANGE, NULL);
+	sttype_range_set(R, F, NULL, Y);
+}
+
+range(R) ::= FIELD(F) LBRACKET STRING(Y) RBRACKET.
+{
+	R = stnode_new(STTYPE_RANGE, NULL);
+	sttype_range_set1(R, F, Y);
+}
+
+/* Relational tests */
+relation_test(T) ::= entity(E) rel_op2(O) entity(F).
+{
+	T = stnode_new(STTYPE_TEST, NULL);
+	sttype_test_set2(T, O, E, F);
+}
+
+rel_op2(O) ::= TEST_EQ.  { O = TEST_OP_EQ; }
+rel_op2(O) ::= TEST_NE.  { O = TEST_OP_NE; }
+rel_op2(O) ::= TEST_GT.  { O = TEST_OP_GT; }
+rel_op2(O) ::= TEST_GE.  { O = TEST_OP_GE; }
+rel_op2(O) ::= TEST_LT.  { O = TEST_OP_LT; }
+rel_op2(O) ::= TEST_LE.  { O = TEST_OP_LE; }
+
+
+
diff --git a/epan/dfilter/scanner.l b/epan/dfilter/scanner.l
new file mode 100644
index 0000000000..a10c9fd77f
--- /dev/null
+++ b/epan/dfilter/scanner.l
@@ -0,0 +1,157 @@
+%{
+/* scanner.l
+ * Scanner for Ethereal's dfilter language
+ *
+ * $Id: scanner.l,v 1.1 2001/02/01 20:21:18 gram Exp $
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "glib-util.h"
+#include "dfilter-int.h"
+#include "syntax-tree.h"
+#include "grammar.h"
+
+#define LVAL		df_lval
+#define LVAL_TYPE	stnode_t*
+#define LVAL_INIT_VAL	NULL
+#define MODNAME		df
+
+#include <lemonflex-head.inc>
+
+/*#undef YY_NO_UNPUT*/
+
+int set_lval(int token, gpointer data);
+int simple(int token);
+
+%}
+
+%x RANGE
+
+BWCHARS		[[:alnum:]\[\]\-_.+!@#%^&*=/:]
+INITVAR		[_A-Za-z]
+VARCHARS	[[:alnum:]_]
+
+
+%%
+
+[[:blank:]\n]+	/* ignore whitespace */
+
+
+
+"("				return simple(TOKEN_LPAREN);
+")"				return simple(TOKEN_RPAREN);
+
+"=="				return simple(TOKEN_TEST_EQ);
+"eq"				return simple(TOKEN_TEST_EQ);
+"!="				return simple(TOKEN_TEST_NE);
+"ne"				return simple(TOKEN_TEST_NE);
+">"				return simple(TOKEN_TEST_GT);
+"gt"				return simple(TOKEN_TEST_GT);
+">="				return simple(TOKEN_TEST_GE);
+"ge"				return simple(TOKEN_TEST_GE);
+"<"				return simple(TOKEN_TEST_LT);
+"lt"				return simple(TOKEN_TEST_LT);
+"<="				return simple(TOKEN_TEST_LE);
+"le"				return simple(TOKEN_TEST_LE);
+
+"!"				return simple(TOKEN_TEST_NOT);
+"not"				return simple(TOKEN_TEST_NOT);
+"&&"				return simple(TOKEN_TEST_AND);
+"and"				return simple(TOKEN_TEST_AND);
+"||"				return simple(TOKEN_TEST_OR);
+"or"				return simple(TOKEN_TEST_OR);
+
+
+"["				{
+	BEGIN(RANGE);
+	return simple(TOKEN_LBRACKET);
+}
+
+<RANGE>[+-]?[[:digit:]]+		{
+	return set_lval(TOKEN_STRING, g_strdup(yytext));
+}
+<RANGE>[+-]?0x[[:xdigit:]]+		{
+	return set_lval(TOKEN_STRING, g_strdup(yytext));
+}
+<RANGE>":"			return simple(TOKEN_COLON);
+
+<RANGE>"]"			{
+	BEGIN(INITIAL);
+	return simple(TOKEN_RBRACKET);
+}
+
+
+\"[^"]*\"				{
+	return set_lval(TOKEN_STRING, g_substrdup(yytext, 1, -2));
+}
+
+
+
+[[:alnum:]_.:]+	{
+	/* Is it a field name? */
+	header_field_info *hfinfo;
+
+	hfinfo = dfilter_lookup_token(yytext);
+	if (hfinfo) {
+		/* Yes, it's a field name */
+		return set_lval(TOKEN_FIELD, hfinfo);
+	}
+	else {
+		/* No, so treat it as a string */
+		return set_lval(TOKEN_STRING, g_strdup(yytext));
+	}
+}
+
+
+
+%%
+
+int
+simple(int token)
+{
+	switch (token) {
+		case TOKEN_LPAREN:
+		case TOKEN_RPAREN:
+		case TOKEN_LBRACKET:
+		case TOKEN_RBRACKET:
+		case TOKEN_COLON:
+		case TOKEN_TEST_EQ:
+		case TOKEN_TEST_NE:
+		case TOKEN_TEST_GT:
+		case TOKEN_TEST_GE:
+		case TOKEN_TEST_LT:
+		case TOKEN_TEST_LE:
+		case TOKEN_TEST_NOT:
+		case TOKEN_TEST_AND:
+		case TOKEN_TEST_OR:
+			break;
+		default:
+			g_assert_not_reached();
+	}
+	return token;
+}
+
+int
+set_lval(int token, gpointer data)
+{
+	sttype_id_t	type_id = STTYPE_UNINITIALIZED;
+
+	switch (token) {
+		case TOKEN_STRING:
+			type_id = STTYPE_STRING;
+			break;
+		case TOKEN_FIELD:
+			type_id = STTYPE_FIELD;
+			break;
+		default:
+			g_assert_not_reached();
+	}
+
+	stnode_init(df_lval, type_id, data);
+	return token;
+}
+
+#include <lemonflex-tail.inc>
diff --git a/epan/dfilter/semcheck.c b/epan/dfilter/semcheck.c
new file mode 100644
index 0000000000..24b1b93f80
--- /dev/null
+++ b/epan/dfilter/semcheck.c
@@ -0,0 +1,472 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+
+#include "dfilter-int.h"
+#include "syntax-tree.h"
+#include "sttype-range.h"
+#include "sttype-test.h"
+
+#include "exceptions.h"
+
+static void
+semcheck(dfwork_t *dfw, stnode_t *st_node);
+
+typedef gboolean (*FtypeCanFunc)(enum ftenum);
+
+/* Compares to ftenum_t's and decides if they're
+ * compatible or not (if they're the same basic type) */
+static gboolean
+compatible_ftypes(ftenum_t a, ftenum_t b)
+{
+	switch (a) {
+		case FT_NONE:
+		case FT_PROTOCOL:
+		case FT_DOUBLE:
+		case FT_ABSOLUTE_TIME:
+		case FT_RELATIVE_TIME:
+		case FT_IPv4:
+		case FT_IPv6:
+		case FT_IPXNET:
+			return a == b;
+
+		case FT_ETHER:
+		case FT_BYTES:
+			return (b == FT_ETHER || b == FT_BYTES);
+
+		case FT_BOOLEAN:
+		case FT_UINT8:
+		case FT_UINT16:
+		case FT_UINT24:
+		case FT_UINT32:
+		case FT_INT8:
+		case FT_INT16:
+		case FT_INT24:
+		case FT_INT32:
+			switch (b) {
+				case FT_BOOLEAN:
+				case FT_UINT8:
+				case FT_UINT16:
+				case FT_UINT24:
+				case FT_UINT32:
+				case FT_INT8:
+				case FT_INT16:
+				case FT_INT24:
+				case FT_INT32:
+					return TRUE;
+				default:
+					return FALSE;
+			}
+			
+		case FT_STRING:
+		case FT_STRINGZ:
+		case FT_UINT_STRING:
+			switch (b) {
+				case FT_STRING:
+				case FT_STRINGZ:
+				case FT_UINT_STRING:
+					return TRUE;
+				default:
+					return FALSE;
+			}
+
+		case FT_NUM_TYPES:
+			g_assert_not_reached();
+	}
+
+	g_assert_not_reached();
+	return FALSE;
+}
+
+/* Creates a FT_UINT32 fvalue with a given value. */
+static fvalue_t*
+mk_uint32_fvalue(guint32 val)
+{
+	fvalue_t *fv;
+
+	fv = fvalue_new(FT_UINT32);
+	fvalue_set_integer(fv, val);
+
+	return fv;
+}
+
+
+/* Try to make an fvalue from a string using a value_string or true_false_string.
+ * This works only for ftypes that are integers. Returns the created fvalue_t*
+ * or NULL if impossible. */
+static fvalue_t*
+mk_fvalue_from_val_string(header_field_info *hfinfo, char *s)
+{
+	static true_false_string        default_tf = { "True", "False" };
+	true_false_string		*tf = &default_tf;
+	value_string			*vals;
+
+	/* Early return? */
+	switch(hfinfo->type) {
+		case FT_NONE:
+		case FT_PROTOCOL:
+		case FT_DOUBLE:
+		case FT_ABSOLUTE_TIME:
+		case FT_RELATIVE_TIME:
+		case FT_IPv4:
+		case FT_IPv6:
+		case FT_IPXNET:
+		case FT_ETHER:
+		case FT_BYTES:
+		case FT_STRING:
+		case FT_STRINGZ:
+		case FT_UINT_STRING:
+			return FALSE;
+
+		case FT_BOOLEAN:
+		case FT_UINT8:
+		case FT_UINT16:
+		case FT_UINT24:
+		case FT_UINT32:
+		case FT_INT8:
+		case FT_INT16:
+		case FT_INT24:
+		case FT_INT32:
+			break;
+			
+		case FT_NUM_TYPES:
+			g_assert_not_reached();
+	}
+
+	/* Reset the dfilter error message, since *something* interesting
+	 * will happen, and the error message will be more interesting than
+	 * any error message I happen to have now. */
+	dfilter_error_msg = NULL;
+
+	/* TRUE/FALSE *always* exist for FT_BOOLEAN. */
+	if (hfinfo->type == FT_BOOLEAN) {
+		if (hfinfo->strings) {
+			tf = hfinfo->strings;
+		}
+
+		if (strcasecmp(s, tf->true_string) == 0) {
+			return mk_uint32_fvalue(TRUE);
+		}
+		else if (strcasecmp(s, tf->false_string) == 0) {
+			return mk_uint32_fvalue(FALSE);
+		}
+		else {
+		dfilter_fail("\"%s\" cannot be found among the possible values for %s.",
+				s, hfinfo->abbrev);
+			return NULL;
+		}
+	}
+
+	/* Do val_strings exist? */
+	if (!hfinfo->strings) {
+		dfilter_fail("%s cannot accept strings as values.",
+				hfinfo->abbrev);
+		return FALSE;
+	}
+
+	vals = hfinfo->strings;
+	while (vals->strptr != NULL) {
+		if (strcasecmp(s, vals->strptr) == 0) {
+			return mk_uint32_fvalue(vals->value);
+		}
+		vals++;
+	}
+	dfilter_fail("\"%s\" cannot be found among the possible values for %s.",
+			s, hfinfo->abbrev);
+	return FALSE;
+}
+
+
+static gboolean
+is_bytes_type(enum ftenum type)
+{
+	switch(type) {
+		case FT_ETHER:
+		case FT_BYTES:
+		case FT_IPv6:
+			return TRUE;
+
+		case FT_NONE:
+		case FT_PROTOCOL:
+		case FT_DOUBLE:
+		case FT_ABSOLUTE_TIME:
+		case FT_RELATIVE_TIME:
+		case FT_IPv4:
+		case FT_IPXNET:
+		case FT_STRING:
+		case FT_STRINGZ:
+		case FT_UINT_STRING:
+		case FT_BOOLEAN:
+		case FT_UINT8:
+		case FT_UINT16:
+		case FT_UINT24:
+		case FT_UINT32:
+		case FT_INT8:
+		case FT_INT16:
+		case FT_INT24:
+		case FT_INT32:
+			return FALSE;
+			
+		case FT_NUM_TYPES:
+			g_assert_not_reached();
+	}
+
+	g_assert_not_reached();
+	return FALSE;
+}
+
+/* This could really be split up... it's too big. */	
+static void
+check_relation(dfwork_t *dfw, FtypeCanFunc can_func, stnode_t *st_node,
+		stnode_t *st_arg1, stnode_t *st_arg2)
+{
+	stnode_t		*new_st;
+	sttype_id_t		type1, type2;
+	header_field_info	*hfinfo1, *hfinfo2;
+	ftenum_t		ftype1, ftype2;
+	fvalue_t		*fvalue;
+	char			*s;
+
+	type1 = stnode_type_id(st_arg1);
+	type2 = stnode_type_id(st_arg2);
+	if (type1 == STTYPE_FIELD) {
+		hfinfo1 = stnode_data(st_arg1);
+		ftype1 = hfinfo1->type;
+
+		if (!can_func(ftype1)) {
+			dfilter_fail("%s (type=%s) cannot participate in specified comparison.",
+					hfinfo1->abbrev, ftype_pretty_name(ftype1));
+			THROW(TypeError);
+		}
+
+
+		if (type2 == STTYPE_FIELD) {
+			hfinfo2 = stnode_data(st_arg2);
+			ftype2 = hfinfo2->type;
+
+			if (!compatible_ftypes(ftype1, ftype2)) {
+				dfilter_fail("%s and %s are not of compatible types.",
+						hfinfo1->abbrev, hfinfo2->abbrev);
+				THROW(TypeError);
+			}
+			/* Do this check even though you'd think that if
+			 * they're compatible, then can_func() would pass. */
+			if (!can_func(ftype2)) {
+				dfilter_fail("%s (type=%s) cannot participate in specified comparison.",
+						hfinfo2->abbrev, ftype_pretty_name(ftype2));
+				THROW(TypeError);
+			}
+		}
+		else if (type2 == STTYPE_STRING) {
+			s = stnode_data(st_arg2);
+			fvalue = fvalue_from_string(ftype1, s, dfilter_fail);
+			if (!fvalue) {
+				/* check value_string */
+				fvalue = mk_fvalue_from_val_string(hfinfo1, s);
+				if (!fvalue) {
+					THROW(TypeError);
+				}
+			}
+
+			new_st = stnode_new(STTYPE_FVALUE, fvalue);
+			sttype_test_set2_args(st_node, st_arg1, new_st);
+			stnode_free(st_arg2);
+		}
+		else if (type2 == STTYPE_RANGE) {
+			if (!is_bytes_type(ftype1)) {
+				if (!ftype_can_slice(ftype1)) {
+					dfilter_fail("\"%s\" is a %s and cannot be converted into a sequence of bytes.",
+							hfinfo1->abbrev,
+							ftype_pretty_name(ftype1));
+					THROW(TypeError);
+				}
+
+				/* Convert entire field to bytes */
+				new_st = stnode_new(STTYPE_RANGE, NULL);
+
+				/* st_arg1 is freed in this step */
+				sttype_range_set(new_st, st_arg1, NULL, NULL);
+
+				sttype_test_set2_args(st_node, new_st, st_arg2);
+			}
+		}
+		else {
+			g_assert_not_reached();
+		}
+	}
+	else if (type1 == STTYPE_STRING) {
+		
+		if (type2 == STTYPE_FIELD) {
+			hfinfo2 = stnode_data(st_arg2);
+			ftype2 = hfinfo2->type;
+
+			s = stnode_data(st_arg1);
+			fvalue = fvalue_from_string(ftype2, s, dfilter_fail);
+			if (!fvalue) {
+				/* check value_string */
+				fvalue = mk_fvalue_from_val_string(hfinfo2, s);
+				if (!fvalue) {
+					THROW(TypeError);
+				}
+			}
+
+			new_st = stnode_new(STTYPE_FVALUE, fvalue);
+			sttype_test_set2_args(st_node, new_st, st_arg2);
+			stnode_free(st_arg1);
+		}
+		else if (type2 == STTYPE_STRING) {
+			/* Well now that's silly... */
+			dfilter_fail("Neither \"%s\" nor \"%s\" are field or protocol names.",
+					stnode_data(st_arg1),
+					stnode_data(st_arg2));
+			THROW(TypeError);
+		}
+		else if (type2 == STTYPE_RANGE) {
+			s = stnode_data(st_arg1);
+			fvalue = fvalue_from_string(FT_BYTES, s, dfilter_fail);
+			if (!fvalue) {
+				THROW(TypeError);
+			}
+			new_st = stnode_new(STTYPE_FVALUE, fvalue);
+			sttype_test_set2_args(st_node, new_st, st_arg2);
+			stnode_free(st_arg1);
+		}
+		else {
+			g_assert_not_reached();
+		}
+	}
+	else if (type1 == STTYPE_RANGE) {
+		hfinfo1 = sttype_range_hfinfo(st_arg1);
+		ftype1 = hfinfo1->type;
+
+		if (!ftype_can_slice(ftype1)) {
+			dfilter_fail("\"%s\" is a %s and cannot be sliced into a sequence of bytes.",
+					hfinfo1->abbrev, ftype_pretty_name(ftype1));
+			THROW(TypeError);
+		}
+
+
+		if (type2 == STTYPE_FIELD) {
+			hfinfo2 = sttype_range_hfinfo(st_arg2);
+			ftype2 = hfinfo2->type;
+
+			if (!is_bytes_type(ftype2)) {
+				if (!ftype_can_slice(ftype2)) {
+					dfilter_fail("\"%s\" is a %s and cannot be converted into a sequence of bytes.",
+							hfinfo2->abbrev,
+							ftype_pretty_name(ftype2));
+					THROW(TypeError);
+				}
+
+				/* Convert entire field to bytes */
+				new_st = stnode_new(STTYPE_RANGE, NULL);
+
+				/* st_arg2 is freed in this step */
+				sttype_range_set(new_st, st_arg2, NULL, NULL);
+
+				sttype_test_set2_args(st_node, st_arg1, new_st);
+			}
+		}
+		else if (type2 == STTYPE_STRING) {
+			s = stnode_data(st_arg2);
+			fvalue = fvalue_from_string(FT_BYTES, s, dfilter_fail);
+			if (!fvalue) {
+				THROW(TypeError);
+			}
+			new_st = stnode_new(STTYPE_FVALUE, fvalue);
+			sttype_test_set2_args(st_node, st_arg1, new_st);
+			stnode_free(st_arg2);
+		}
+		else if (type2 == STTYPE_RANGE) {
+			/* XXX - check lengths of both ranges */
+		}
+		else {
+			g_assert_not_reached();
+		}
+	}
+	else {
+		g_assert_not_reached();
+	}
+}
+
+static void
+check_test(dfwork_t *dfw, stnode_t *st_node)
+{
+	test_op_t		st_op;
+	stnode_t		*st_arg1, *st_arg2;
+
+	sttype_test_get(st_node, &st_op, &st_arg1, &st_arg2);
+
+	switch (st_op) {
+		case TEST_OP_UNINITIALIZED:
+			g_assert_not_reached();
+			break;
+
+		case TEST_OP_EXISTS:
+			/* nothing */
+			break;
+
+		case TEST_OP_NOT:
+			semcheck(dfw, st_arg1);
+			break;
+
+		case TEST_OP_AND:
+		case TEST_OP_OR:
+			semcheck(dfw, st_arg1);
+			semcheck(dfw, st_arg2);
+			break;
+
+		case TEST_OP_EQ:
+			check_relation(dfw, ftype_can_eq, st_node, st_arg1, st_arg2);
+			break;
+		case TEST_OP_NE:
+			check_relation(dfw, ftype_can_ne, st_node, st_arg1, st_arg2);
+			break;
+		case TEST_OP_GT:
+			check_relation(dfw, ftype_can_gt, st_node, st_arg1, st_arg2);
+			break;
+		case TEST_OP_GE:
+			check_relation(dfw, ftype_can_ge, st_node, st_arg1, st_arg2);
+			break;
+		case TEST_OP_LT:
+			check_relation(dfw, ftype_can_lt, st_node, st_arg1, st_arg2);
+			break;
+		case TEST_OP_LE:
+			check_relation(dfw, ftype_can_le, st_node, st_arg1, st_arg2);
+			break;
+	}
+}
+
+
+static void
+semcheck(dfwork_t *dfw, stnode_t *st_node)
+{
+	const char	*name;
+
+	name = stnode_type_name(st_node);
+
+	switch (stnode_type_id(st_node)) {
+		case STTYPE_TEST:
+			check_test(dfw, st_node);
+			break;
+		default:
+			g_assert_not_reached();
+	}
+}
+
+
+gboolean
+dfw_semcheck(dfwork_t *dfw)
+{
+	TRY {
+		semcheck(dfw, dfw->st_root);
+	}
+	CATCH(TypeError) {
+		return FALSE;
+	}
+	ENDTRY;
+
+	return TRUE;
+}
diff --git a/epan/dfilter/semcheck.h b/epan/dfilter/semcheck.h
new file mode 100644
index 0000000000..54f795dfe4
--- /dev/null
+++ b/epan/dfilter/semcheck.h
@@ -0,0 +1,10 @@
+#ifndef SEMCHECK_H
+#define SEMCHECK_H
+
+
+
+gboolean
+dfw_semcheck(dfwork_t *dfw);
+
+
+#endif
diff --git a/epan/dfilter/sttype-pointer.c b/epan/dfilter/sttype-pointer.c
new file mode 100644
index 0000000000..64a49658f2
--- /dev/null
+++ b/epan/dfilter/sttype-pointer.c
@@ -0,0 +1,28 @@
+/* $Id: sttype-pointer.c,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "ftypes/ftypes.h"
+#include "syntax-tree.h"
+
+void
+sttype_register_pointer(void)
+{
+	static sttype_t field_type = {
+		STTYPE_FIELD,
+		"FIELD",
+		NULL,
+		NULL,
+	};
+	static sttype_t fvalue_type = {
+		STTYPE_FVALUE,
+		"FVALUE",
+		NULL,
+		NULL,
+	};
+
+	sttype_register(&field_type);
+	sttype_register(&fvalue_type);
+}
diff --git a/epan/dfilter/sttype-range.c b/epan/dfilter/sttype-range.c
new file mode 100644
index 0000000000..12bada4cc4
--- /dev/null
+++ b/epan/dfilter/sttype-range.c
@@ -0,0 +1,174 @@
+/* $Id: sttype-range.c,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+/* The ideas in this code came from Ed Warnicke's original implementation
+ * of dranges for the old display filter code (Ethereal 0.8.15 and before).
+ * The code is different, but definitely inspired by his code.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include "proto.h"
+#include "sttype-range.h"
+
+typedef struct {
+	guint32			magic;
+	header_field_info	*hfinfo;
+	gint			start;
+	gint			end;
+	char			*start_error;
+	char			*end_error;
+} range_t;
+
+#define RANGE_MAGIC	0xec0990ce
+
+static gpointer
+range_new(gpointer junk)
+{
+	range_t		*range;
+
+	g_assert(junk == NULL);
+
+	range = g_new(range_t, 1);
+
+	range->magic = RANGE_MAGIC;
+	range->hfinfo = NULL;
+	range->start = 0;
+	range->end = -1;
+	range->start_error = NULL;
+	range->end_error = NULL;
+
+	return (gpointer) range;
+}
+
+static void
+range_free(gpointer value)
+{
+	range_t	*range = value;
+	assert_magic(range, RANGE_MAGIC);
+
+	if (range->start_error)
+		g_free(range->start_error);
+	if (range->end_error)
+		g_free(range->end_error);
+
+	g_free(range);
+}
+
+static gint
+string_to_gint(char *s, gboolean *success)
+{
+	char	*endptr;
+	gint	val;
+
+	*success = TRUE;
+	val = strtol(s, &endptr, 0);
+
+	if (endptr == s || *endptr != '\0') {
+		*success = FALSE;
+	}
+	else if (errno == ERANGE) {
+		*success = FALSE;
+	}
+
+	return val;
+}
+
+static void
+range_set(stnode_t *node, stnode_t *field, char *start, char *end)
+{
+	range_t		*range;
+	gboolean	success;
+
+	range = stnode_data(node);
+	assert_magic(range, RANGE_MAGIC);
+
+	range->hfinfo = stnode_data(field);
+	stnode_free(field);
+
+	if (start) { 
+		range->start = string_to_gint(start, &success);
+		if (!success) {
+			/* Save the error-causing string for later reporting */
+			range->start_error = g_strdup(start);
+		}
+	}
+	else {
+		range->start = 0;
+	}
+
+	if (end) {
+		range->end = string_to_gint(end, &success);
+
+		if (!success) {
+			/* Save the error-causing string for later reporting */
+			range->end_error = g_strdup(end);
+		}
+	}
+	else {
+		range->end = G_MAXINT;
+	}
+}
+
+void
+sttype_range_set(stnode_t *node, stnode_t *field, stnode_t *start, stnode_t *end)
+{
+	char		*start_str, *end_str;
+
+	if (start) { 
+		start_str = stnode_data(start);
+	}
+	else {
+		start_str = NULL;
+	}
+
+	if (end) {
+		end_str = stnode_data(end);
+	}
+	else {
+		end_str = NULL;
+	}
+
+	range_set(node, field, start_str, end_str);
+
+	if (start)
+		stnode_free(start);
+	if (end)
+		stnode_free(end);
+}
+
+void
+sttype_range_set1(stnode_t *node, stnode_t *field, stnode_t *offset)
+{
+	char		*offset_str;
+	
+	g_assert(offset);
+
+	offset_str = stnode_data(offset);
+	range_set(node, field, offset_str, "1");
+	stnode_free(offset);
+}
+
+
+STTYPE_ACCESSOR(header_field_info*, range, hfinfo, RANGE_MAGIC)
+STTYPE_ACCESSOR(gint, range, start, RANGE_MAGIC)
+STTYPE_ACCESSOR(gint, range, end, RANGE_MAGIC)
+STTYPE_ACCESSOR(char*, range, start_error, RANGE_MAGIC)
+STTYPE_ACCESSOR(char*, range, end_error, RANGE_MAGIC)
+
+
+void
+sttype_register_range(void)
+{
+	static sttype_t range_type = {
+		STTYPE_RANGE,
+		"RANGE",
+		range_new,
+		range_free,
+	};
+
+	sttype_register(&range_type);
+}
diff --git a/epan/dfilter/sttype-range.h b/epan/dfilter/sttype-range.h
new file mode 100644
index 0000000000..aff39c84b5
--- /dev/null
+++ b/epan/dfilter/sttype-range.h
@@ -0,0 +1,20 @@
+#ifndef STTYPE_RANGE_H
+#define STTYPE_RANGE_H
+
+#include "syntax-tree.h"
+
+STTYPE_ACCESSOR_PROTOTYPE(header_field_info*, range, hfinfo)
+STTYPE_ACCESSOR_PROTOTYPE(gint, range, start)
+STTYPE_ACCESSOR_PROTOTYPE(gint, range, end)
+STTYPE_ACCESSOR_PROTOTYPE(char*, range, start_error)
+STTYPE_ACCESSOR_PROTOTYPE(char*, range, end_error)
+
+/* Set a range, [x:y], [:y], [x:] */
+void
+sttype_range_set(stnode_t *node, stnode_t *field, stnode_t *start, stnode_t *end);
+
+/* Set a single-byte lookup, [x] */
+void
+sttype_range_set1(stnode_t *node, stnode_t *field, stnode_t *offset);
+
+#endif
diff --git a/epan/dfilter/sttype-string.c b/epan/dfilter/sttype-string.c
new file mode 100644
index 0000000000..c19797844d
--- /dev/null
+++ b/epan/dfilter/sttype-string.c
@@ -0,0 +1,29 @@
+/* $Id: sttype-string.c,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+#include "syntax-tree.h"
+
+static gpointer
+string_new(gpointer string)
+{
+	return (gpointer) g_strdup((char*) string);
+}
+
+static void
+string_free(gpointer value)
+{
+	g_free(value);
+}
+
+
+void
+sttype_register_string(void)
+{
+	static sttype_t string_type = {
+		STTYPE_STRING,
+		"STRING",
+		string_new,
+		string_free,
+	};
+
+	sttype_register(&string_type);
+}
diff --git a/epan/dfilter/sttype-test.c b/epan/dfilter/sttype-test.c
new file mode 100644
index 0000000000..90b07048e0
--- /dev/null
+++ b/epan/dfilter/sttype-test.c
@@ -0,0 +1,144 @@
+/* $Id: sttype-test.c,v 1.1 2001/02/01 20:21:18 gram Exp $ */
+
+#include "syntax-tree.h"
+#include "sttype-test.h"
+
+typedef struct {
+	guint32		magic;
+	test_op_t	op;
+	stnode_t	*val1;
+	stnode_t	*val2;
+} test_t;
+
+#define TEST_MAGIC	0xab9009ba
+
+static gpointer
+test_new(gpointer junk)
+{
+	test_t		*test;
+
+	g_assert(junk == NULL);
+
+	test = g_new(test_t, 1);
+
+	test->magic = TEST_MAGIC;
+	test->op = TEST_OP_UNINITIALIZED;
+	test->val1 = NULL;
+	test->val2 = NULL;
+
+	return (gpointer) test;
+}
+
+static void
+test_free(gpointer value)
+{
+	test_t	*test = value;
+	assert_magic(test, TEST_MAGIC);
+
+	if (test->val1)
+		stnode_free(test->val1);
+	if (test->val2)
+		stnode_free(test->val2);
+
+	g_free(test);
+}
+
+static int
+num_operands(test_op_t op)
+{
+	switch(op) {
+		case TEST_OP_UNINITIALIZED:
+			g_assert_not_reached();
+		case TEST_OP_EXISTS:
+			return 1;
+		case TEST_OP_NOT:
+			return 1;
+		case TEST_OP_AND:
+			return 2;
+		case TEST_OP_OR:
+			return 2;
+		case TEST_OP_EQ:
+			return 2;
+		case TEST_OP_NE:
+			return 2;
+		case TEST_OP_GT:
+			return 2;
+		case TEST_OP_GE:
+			return 2;
+		case TEST_OP_LT:
+			return 2;
+		case TEST_OP_LE:
+			return 2;
+	}
+	g_assert_not_reached();
+	return -1;
+}
+
+
+void
+sttype_test_set1(stnode_t *node, test_op_t op, stnode_t *val1)
+{
+	test_t	*test;
+
+	test = stnode_data(node);
+	assert_magic(test, TEST_MAGIC);
+
+	g_assert(num_operands(op) == 1);
+	test->op = op;
+	test->val1 = val1;
+}
+
+void
+sttype_test_set2(stnode_t *node, test_op_t op, stnode_t *val1, stnode_t *val2)
+{
+	test_t	*test;
+
+	test = stnode_data(node);
+	assert_magic(test, TEST_MAGIC);
+
+	g_assert(num_operands(op) == 2);
+	test->op = op;
+	test->val1 = val1;
+	test->val2 = val2;
+}
+
+void
+sttype_test_set2_args(stnode_t *node, stnode_t *val1, stnode_t *val2)
+{
+	test_t	*test;
+
+	test = stnode_data(node);
+	assert_magic(test, TEST_MAGIC);
+
+	if (num_operands(test->op) == 1) {
+		g_assert(val2 == NULL);
+	}
+	test->val1 = val1;
+	test->val2 = val2;
+}
+
+void
+sttype_test_get(stnode_t *node, test_op_t *p_op, stnode_t **p_val1, stnode_t **p_val2)
+{
+	test_t	*test;
+
+	test = stnode_data(node);
+	assert_magic(test, TEST_MAGIC);
+
+	*p_op = test->op;
+	*p_val1 = test->val1;
+	*p_val2 = test->val2;
+}
+
+void
+sttype_register_test(void)
+{
+	static sttype_t test_type = {
+		STTYPE_TEST,
+		"TEST",
+		test_new,
+		test_free,
+	};
+
+	sttype_register(&test_type);
+}
diff --git a/epan/dfilter/sttype-test.h b/epan/dfilter/sttype-test.h
new file mode 100644
index 0000000000..69765df9e3
--- /dev/null
+++ b/epan/dfilter/sttype-test.h
@@ -0,0 +1,30 @@
+#ifndef STTYPE_TEST_H
+#define STTYPE_TEST_H
+
+typedef enum {
+	TEST_OP_UNINITIALIZED,
+	TEST_OP_EXISTS,
+	TEST_OP_NOT,
+	TEST_OP_AND,
+	TEST_OP_OR,
+	TEST_OP_EQ,
+	TEST_OP_NE,
+	TEST_OP_GT,
+	TEST_OP_GE,
+	TEST_OP_LT,
+	TEST_OP_LE
+} test_op_t;
+
+void
+sttype_test_set1(stnode_t *node, test_op_t op, stnode_t *val1);
+
+void
+sttype_test_set2(stnode_t *node, test_op_t op, stnode_t *val1, stnode_t *val2);
+
+void
+sttype_test_set2_args(stnode_t *node, stnode_t *val1, stnode_t *val2);
+
+void
+sttype_test_get(stnode_t *node, test_op_t *p_op, stnode_t **p_val1, stnode_t **p_val2);
+
+#endif
diff --git a/epan/dfilter/syntax-tree.c b/epan/dfilter/syntax-tree.c
new file mode 100644
index 0000000000..238f685d84
--- /dev/null
+++ b/epan/dfilter/syntax-tree.c
@@ -0,0 +1,169 @@
+/* syntax-tree.c
+ *
+ * $Id: syntax-tree.c,v 1.1 2001/02/01 20:21:18 gram Exp $
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "syntax-tree.h"
+
+/* Keep track of sttype_t's via their sttype_id_t number */
+static sttype_t* type_list[STTYPE_NUM_TYPES];
+
+/* These are the sttype_t registration function prototypes. */
+void sttype_register_pointer(void);
+void sttype_register_range(void);
+void sttype_register_string(void);
+void sttype_register_test(void);
+
+
+#define STNODE_MAGIC	0xe9b00b9e
+
+
+void
+sttype_init(void)
+{
+	sttype_register_pointer();
+	sttype_register_range();
+	sttype_register_string();
+	sttype_register_test();
+}
+
+void
+sttype_cleanup(void)
+{
+	/* nothing to do */
+}
+
+
+void
+sttype_register(sttype_t *type)
+{
+	sttype_id_t	type_id;
+
+	type_id = type->id;
+
+	/* Check input */
+	g_assert(type_id >= 0);
+	g_assert(type_id < STTYPE_NUM_TYPES);
+
+        /* Don't re-register. */
+        g_assert(type_list[type_id] == NULL);
+
+        type_list[type_id] = type;
+}
+
+static sttype_t*
+sttype_lookup(sttype_id_t type_id)
+{
+	sttype_t	*result;
+
+	/* Check input */
+	g_assert(type_id >= 0);
+	g_assert(type_id < STTYPE_NUM_TYPES);
+
+	result = type_list[type_id];
+
+	/* Check output. */
+        g_assert(result != NULL);
+
+        return result;
+}
+
+
+stnode_t*
+stnode_new(sttype_id_t type_id, gpointer data)
+{
+	sttype_t	*type;
+	stnode_t	*node;
+
+	node = g_new(stnode_t, 1);
+	node->magic = STNODE_MAGIC;
+
+	if (type_id == STTYPE_UNINITIALIZED) {
+		node->type = NULL;
+		node->data = NULL;
+	}
+	else {
+		type = sttype_lookup(type_id);
+		g_assert(type);
+		node->type = type;
+		if (type->func_new) {
+			node->data = type->func_new(data);
+		}
+		else {
+			node->data = data;
+		}
+
+	}
+
+	return node;
+}
+
+void
+stnode_init(stnode_t *node, sttype_id_t type_id, gpointer data)
+{
+	sttype_t	*type;
+
+	assert_magic(node, STNODE_MAGIC);
+	g_assert(!node->type);
+	g_assert(!node->data);
+
+	type = sttype_lookup(type_id);
+	g_assert(type);
+	node->type = type;
+	if (type->func_new) {
+		node->data = type->func_new(data);
+	}
+	else {
+		node->data = data;
+	}
+}
+
+void
+stnode_free(stnode_t *node)
+{
+	assert_magic(node, STNODE_MAGIC);
+	if (node->type) {
+		if (node->type->func_free) {
+			node->type->func_free(node->data);
+		}
+	}
+	else {
+		g_assert(!node->data);
+	}
+	g_free(node);
+}
+
+const char*
+stnode_type_name(stnode_t *node)
+{
+	assert_magic(node, STNODE_MAGIC);
+	if (node->type)
+		return node->type->name;
+	else
+		return "UNINITIALIZED";
+}
+
+sttype_id_t
+stnode_type_id(stnode_t *node)
+{
+	assert_magic(node, STNODE_MAGIC);
+	if (node->type)
+		return node->type->id;
+	else
+		return STTYPE_UNINITIALIZED;
+}
+
+gpointer
+stnode_data(stnode_t *node)
+{
+	assert_magic(node, STNODE_MAGIC);
+	if (node)
+		return node->data;
+	else
+		return NULL;
+}
diff --git a/epan/dfilter/syntax-tree.h b/epan/dfilter/syntax-tree.h
new file mode 100644
index 0000000000..3f60c09f1a
--- /dev/null
+++ b/epan/dfilter/syntax-tree.h
@@ -0,0 +1,95 @@
+/* syntax-tree.h
+ *
+ * $Id: syntax-tree.h,v 1.1 2001/02/01 20:21:18 gram Exp $
+ *
+ */
+#ifndef SYNTAX_TREE_H
+#define SYNTAX_TREE_H
+
+#include <glib.h>
+#include "cppmagic.h"
+
+typedef enum {
+	STTYPE_UNINITIALIZED,
+	STTYPE_TEST,
+	STTYPE_STRING,
+	STTYPE_FIELD,
+	STTYPE_FVALUE,
+	STTYPE_RANGE,
+	STTYPE_NUM_TYPES
+} sttype_id_t;
+
+typedef gpointer        (*STTypeNewFunc)(gpointer);
+typedef void            (*STTypeFreeFunc)(gpointer);
+
+
+/* Type information */
+typedef struct {
+	sttype_id_t		id;
+	const char		*name;
+	STTypeNewFunc		func_new;
+	STTypeFreeFunc		func_free;
+} sttype_t;
+
+/* Node (type instance) information */
+typedef struct {
+	guint32		magic;
+	sttype_t	*type;
+	gpointer	data;
+
+} stnode_t;
+
+void
+sttype_init(void);
+
+void
+sttype_cleanup(void);
+
+void
+sttype_register(sttype_t *type);
+
+stnode_t*
+stnode_new(sttype_id_t type_id, gpointer data);
+
+void
+stnode_init(stnode_t *node, sttype_id_t type_id, gpointer data);
+
+void
+stnode_free(stnode_t *node);
+
+const char*
+stnode_type_name(stnode_t *node);
+
+sttype_id_t
+stnode_type_id(stnode_t *node);
+
+gpointer
+stnode_data(stnode_t *node);
+
+#define assert_magic(obj, mnum) \
+        g_assert((obj)); \
+        if ((obj)->magic != (mnum)) { \
+                g_print("\nMagic num is 0x%08x, but should be 0x%08x", \
+                                (obj)->magic, (mnum)); \
+                g_assert((obj)->magic == (mnum)); \
+        }
+
+
+
+
+#define STTYPE_ACCESSOR(ret,type,attr,magicnum) \
+	ret \
+	CONCAT(CONCAT(CONCAT(sttype_,type),_),attr) (stnode_t *node) \
+{\
+	CONCAT(type,_t)	*value; \
+	value = stnode_data(node);\
+	assert_magic(value, magicnum); \
+	return value->attr; \
+}
+	
+#define STTYPE_ACCESSOR_PROTOTYPE(ret,type,attr) \
+	ret \
+	CONCAT(CONCAT(CONCAT(sttype_,type),_),attr) (stnode_t *node);
+
+
+#endif