From: Victor Julien <vjulien@oisf.net>
Date: Fri, 12 Apr 2024 09:02:13 +0000 (+0200)
Subject: pcap: support LINKTYPE_IPV6 (229)
X-Git-Tag: suricata-6.0.19~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1aac268242002b333fcca3a619867146d6a30f30;p=thirdparty%2Fsuricata.git

pcap: support LINKTYPE_IPV6 (229)

This is just another variant of DLT_RAW.

Ticket: #6943.
(cherry picked from commit 76322368ed3ef89c04082939c58535c7234d7173)
---

diff --git a/src/decode.h b/src/decode.h
index a77c7c7f18..eeb292fa26 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -1150,6 +1150,7 @@ void DecodeUnregisterCounters(void);
  * Libpcap on at least OpenBSD returns 101 as datalink type for RAW pcaps though. */
 #define LINKTYPE_RAW2        101
 #define LINKTYPE_IPV4        228
+#define LINKTYPE_IPV6        229
 #define LINKTYPE_GRE_OVER_IP 778
 #define LINKTYPE_CISCO_HDLC  DLT_C_HDLC
 #define PPP_OVER_GRE         11
diff --git a/src/source-pcap-file-helper.c b/src/source-pcap-file-helper.c
index 9f13a4c17e..6300601419 100644
--- a/src/source-pcap-file-helper.c
+++ b/src/source-pcap-file-helper.c
@@ -252,6 +252,7 @@ TmEcode ValidateLinkType(int datalink, DecoderFunc *DecoderFn)
             *DecoderFn = DecodePPP;
             break;
         case LINKTYPE_IPV4:
+        case LINKTYPE_IPV6:
         case LINKTYPE_RAW:
         case LINKTYPE_RAW2:
         case LINKTYPE_GRE_OVER_IP: