]> git.ipfire.org Git - thirdparty/suricata.git/commit
defrag: fix wrong datalink being logged
authorVictor Julien <vjulien@oisf.net>
Sat, 23 Mar 2024 19:17:54 +0000 (20:17 +0100)
committerVictor Julien <victor@inliniac.net>
Thu, 18 Apr 2024 08:30:21 +0000 (10:30 +0200)
commit6f1412c90103b2788567334c046939521c2e01a0
treea48ba14bb22a5ff977ac0c7ad4bac7a51e6ea51b
parent5950fe2cdaa369fee36de78ddde1a0e13a6ed495
defrag: fix wrong datalink being logged

Eve's packet_info.linktype should correctly indicated what the `packet`
field contains. Until now it was using DLT_RAW even if Ethernet or other
L2+ headers were present.

This commit records the datalink of the packet creating the first
fragment, which can include the L2+ header data.

Bug: #6887.
(cherry picked from commit 49c67b2bb1baa84b7105bca82afe6909be890855)
src/decode.c
src/defrag.c
src/defrag.h