Repository navigation
Conversation
Part of #2460. - Add Netlink (nlmsghdr 16-octet framing: nlmsg_len/type/flags/seq/pid), with schema/data modules, registered in all 7 places LinuxSLL/VLAN use (plus pcapkit/all.py, an 8th aggregator caught by test_all_exports_unit.py). - Byte order is ambiguous for Netlink (kernel/userspace IPC, not wire format); resolved by nlmsg_byteorder(), the same heuristic Wireshark's own netlink dissector uses. - Wire LinuxSLL/LinuxSLL2's _import_next_layer to dispatch ARPHRD_NETLINK to Netlink instead of Raw; update the two LinuxSLL test modules' now-stale Raw assertions. - Per-family message payloads and multiple nlmsghdr messages packed into one capture are out of scope for this first cut; every payload is kept as Raw. IPGRE/IP6GRE and IEEE80211_RADIOTAP remain Raw. - Add tests/protocols/link/test_netlink_unit.py, a short-read case, and exemptions in test_rfc_constants_one_home_1739_unit.py for the 16/65535 literals this module shares with unrelated homed constants. - Changelog entry in 1.6.0.rst, regenerated CHANGELOG.md, and a docs page. Build: pylint 10.00/10, mypy clean. Tests: tests/protocols/link/ (176 passed, 2301 subtests), tests/protocols/test_short_read_roundtrip_unit.py (9 passed, 1374 subtests), tests/project/ (2132 passed, 80 skipped, 10555 subtests, 0 failed) -- all green, confirmed by a full re-run after the two project-wide fixes above.
JarryShaw
added
feat
JarryShaw
added
review: running
JarryShaw
added
review: good-to-go
Owner
Author
|
Cross-review (Sonnet) at |
This was referenced Oct 31, 2026
Contributor
|
Coverage: 94.47% (unit tier, Python 3.15,
Per-file detail: the |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #2460.
What
LinuxSLL/LinuxSLL2fell back toRawfor theNETLINKarphrd_type(824). This adds
pcapkit.protocols.link.netlink.Netlink, dissecting thefixed 16-octet
nlmsghdrframing (nlmsg_len/nlmsg_type/nlmsg_flags/nlmsg_seq/nlmsg_pid), and wiresLinuxSLL's shared_import_next_layerto dispatch
ARPHRD_NETLINKthere instead.Scope
In scope: the generic
nlmsghdrframing itself. Researched from theLinux kernel's own
netlink(7)man page and RFC 3549 §2.3.2 (both quoted inthe module docstring).
Out of scope, documented explicitly:
NETLINK_GENERIC,etc.) — a large surface of its own, numerous and family-specific. Every
message's payload is kept as
Raw, unconditionally.nlmsghdrmessages packed into one capture frame — netlinkreads commonly carry more than one message back to back. This first cut
dissects only the first message's header; everything after it (that
message's own payload, and any sibling messages) is kept together as the
undissected
Rawpayload. Tracked as future work on Dissectors for non-ethertype ARPHRD types on LINUX_SLL/SLL2 (NETLINK/IPGRE/IP6GRE/802.11 radiotap/FRAD) #2460.Byte order is ambiguous — Netlink is kernel/userspace IPC, not wire
format, and neither
netlink(7), RFC 3549, nor tcpdump.org'sLINKTYPE_NETLINKpage record a byte-order marker for it.nlmsg_byteorder()resolves it with the same heuristic Wireshark's own netlink dissector uses
(
packet-netlink.c): decode the length field both ways and keep whicheverreading comes closer to the octets actually available. This mirrors the
existing precedent in this codebase —
pcapkit.protocols.link.loopback.family_byteordersolves the identicalproblem for
LINKTYPE_NULL.Registration
Registered in all 7 places
Loopback/VLANare (plus an 8th,pcapkit/all.py,caught by
test_all_exports_unit.pyon the way):pcapkit/protocols/link/__init__.py,pcapkit/__init__.py,pcapkit/protocols/__init__.py,pcapkit/protocols/data/__init__.py,pcapkit/protocols/data/link/__init__.py,pcapkit/protocols/schema/__init__.py,pcapkit/protocols/schema/link/__init__.py,pcapkit/all.py.Tests
tests/protocols/link/test_netlink_unit.py(new): 14 tests / 49 subtests.test_linux_sll1_unit.py/test_linux_sll2_unit.py's now-stale"NETLINK stays Raw" assertions, added an explicit dispatch test to each.
test_short_read_roundtrip_unit.py.tests/project/'s two project-wide sweeps caught two real gaps: a missingpcapkit/all.pyexport, and this module's16/65535literals collidingwith unrelated homed constants in
test_rfc_constants_one_home_1739_unit.py'ssweep — both fixed with the same precedent
linux_sll1.pyalready uses.Counts:
tests/protocols/link/185 passed / 1076 subtests (incl. thetwo project sweeps above);
tests/protocols/test_short_read_roundtrip_unit.py9 passed / 1374 subtests;
tests/project/full run 2132 passed, 80 skipped,10555 subtests, 0 failed. pylint 10.00/10, mypy clean on all touched files.
Changelog & docs
Entry in
docs/source/changelog/1.6.0.rst,CHANGELOG.mdregenerated(
util/changelog_md.py --checkclean), new docs pagedocs/source/pcapkit/protocols/link/netlink.rstindexed in the link-layertoctree.