defrag: fix wrong datalink being logged

[victorjulien]

Bug: #6887.

https://redmine.openinfosecfoundation.org/issues/6887

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.76%. Comparing base (172b55c) to head (478198c).

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #10807   +/-   ##
=======================================
  Coverage   82.75%   82.76%           
=======================================
  Files         928      928           
  Lines      247913   247915    +2     
=======================================
+ Hits       205162   205176   +14     
+ Misses      42751    42739   -12     

Flag	Coverage Δ
fuzzcorpus	64.23% <100.00%> (+<0.01%)	⬆️
suricata-verify	62.01% <100.00%> (+<0.01%)	⬆️
unittests	62.18% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[catenacyber]

How do you test this ?
How gets datalink field used ?

[victorjulien]

How do you test this ? How gets datalink field used ?

It's logged in eve and tells you the data type of the packet logging. So if there is an ethernet header, the datalink should reflect that, instead of claiming RAW (so first byte is start of the IP header)

[catenacyber]

So, is there a SV test for this fix ?

[suricata-qa]

Information:

ERROR: QA failed on SURI_TLPR1_suri_time.

field	baseline	test	%
	SURI_TLPR1_stats_chk
.uptime	645	691	107.13%

Pipeline 20016

[victorjulien]

So, is there a SV test for this fix ?

OISF/suricata-verify#1756

Replaced by #10817.