[Bug] tcprewrite Unsupported DLT_NULL/DLT_LOOP PF_ type: 0x001c - for IPV6 Null Packets

[chrisfleming]

Describe the bug

I captured a pcap from a PFSENSE (BSD) router, when I try and rewrite the header, I get the error message below.

 tcprewrite  --dlt=enet  --enet-dmac=00:12:13:14:15:16,00:22:33:44:55:66 --enet-smac=00:12:13:14:15:16,00:22:33:44:55:66   -i ipv6.pcap  -o ipv6_enet.pcap

Fatal Error in tcpedit.c:tcpedit_packet() line 129:
 From ./plugins/dlt_null/null.c:dlt_null_proto() line 228:
Unsupported DLT_NULL/DLT_LOOP PF_ type: 0x001c

To Reproduce
Steps to reproduce the behavior:

Use: ipv6_head.zip

 tcprewrite  --dlt=enet  --enet-dmac=00:12:13:14:15:16,00:22:33:44:55:66 --enet-smac=00:12:13:14:15:16,00:22:33:44:55:66   -i ipv6.pcap  -o ipv6_enet.pcap

Expected behavior
I think we should recognize this as IPV6

[chrisfleming]

I've just done some extra reading on this, and the values can be: 24, 28, or 30

From: https://gitlab.com/wireshark/wireshark/-/wikis/NullLoopback

"AF_INET6, unfortunately, has different values in {NetBSD,OpenBSD,BSD/OS}, {FreeBSD,DragonFlyBSD}, and {Darwin/macOS}, so an IPv6 packet might have a link-layer header with 24, 28, or 30 as the AF_ value."

[gothburz]

I'm experiencing the same issue with PF_Type 0x0018
Fatal Error in tcpedit.c:tcpedit_packet() line 114: From ./plugins/dlt_null/null.c:dlt_null_proto() line 252: Unsupported DLT_NULL/DLT_LOOP PF_ type: 0x0018

[fklassen]

Use: ipv6_head.zip

This is an empty PCAP file, i.e it is 24 bytes long which suggests it is a pcap file header with no packets. Did you have another file for me?

[fklassen]

"AF_INET6, unfortunately, has different values in {NetBSD,OpenBSD,BSD/OS}, {FreeBSD,DragonFlyBSD}, and {Darwin/macOS}, so an IPv6 packet might have a link-layer header with 24, 28, or 30 as the AF_ value."

Linux is 10.

[fklassen]

Applied patch in PR #642 but don't have pcap files to test this with. Please open new issue if required.