skb->protocol 0x300?!

Hi,

I’m needing to introspect packets to get the TCP/UDP port and
am writing packet parsing code (as apparently there is no easy
API to use). So far, so well, but my code starts with this…

	switch (skb->protocol) {
	case htons(ETH_P_IP): {
…
	    }
	case htons(ETH_P_IPV6): {
…
	    }
	default:
		// debug log
	}

… to figure out whether it’s an IP packet in the first place.

Now I’m getting 0x300 in skb->protocol for what tcpdump -X makes
me believe is a fragmented IP packet.

Why? And where is that documented? What does 0x300 there even mean?
And how can I figure out properly if a packet is IP, Legacy IP, or
something else?

Thanks,
//mirabilos
-- 
Infrastrukturexperte • tarent solutions GmbH
Am Dickobskreuz 10, D-53121 Bonn • http://www.tarent.de/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 5168 • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

                        ****************************************************
/⁀\ The UTF-8 Ribbon
╲ ╱ Campaign against      Mit dem tarent-Newsletter nichts mehr verpassen:
 ╳  HTML eMail! Also,     https://www.tarent.de/newsletter
╱ ╲ header encryption!

1 more lines

On Fri, 1 Jul 2022, Thorsten Glaser wrote:

Now I’m getting 0x300 in skb->protocol for what tcpdump -X makes
me believe is a fragmented IP packet.

I also get it for unfragmented packets, and the kernel source does
not ever set it, which got me on the right track for searching.

Turns out that the buster-backports kernel has the fix already:
https://lore.kernel.org/netdev/20190318053952.115180-1-komachi.yoshiki@lab.ntt.co.jp/t/
describes my problem, and booting into 5.10 instead of 4.19 gives
me the correct skb->protocol value.

bye,
//mirabilos
-- 
Infrastrukturexperte • tarent solutions GmbH
Am Dickobskreuz 10, D-53121 Bonn • http://www.tarent.de/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 5168 • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

                        ****************************************************
/⁀\ The UTF-8 Ribbon
╲ ╱ Campaign against      Mit dem tarent-Newsletter nichts mehr verpassen:
 ╳  HTML eMail! Also,     https://www.tarent.de/newsletter
╱ ╲ header encryption!
                        ****************************************************