net_dm: Add dissector for drop monitor netlink packets

The Linux kernel includes a module called drop monitor which -
unsurprisingly - monitors packet drops.

Once enabled, the module will periodically send netlink notifications to
user space over generic netlink. Historically, these notifications only
included the program counter where the drop occurred and the number of
packets that were dropped in this location in the last interval.

Patches in net-next (queued for Linux kernel 5.4) extend drop monitor
with another mode of operation where the dropped packets themselves are
sent to user space along with relevant metadata as netlink
notifications. This allows users to perform a more detailed analysis of
the dropped packets.

This patch adds a dissector for these netlink packets. The dissector is
expected to be invoked by the generic netlink dissector and during its
hand off routine it adds an entry in the 'genl.family' dissector table.

The various netlink attributes are dissected by calling
dissect_netlink_attributes(), in a similar fashion to the rtnetlink
dissector. The dropped packet itself is encoded in the netlink attribute
'NET_DM_ATTR_PAYLOAD' and dissected by invoking a dissector from the
'sll.ltype' dissector table based on the packet's protocol which is
encoded in the 'NET_DM_ATTR_PROTO' attribute.

Bug: 16018
Change-Id: I10bfa4b9c9d8f5e82769c250f929f74693142a23
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-on: https://code.wireshark.org/review/34351
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

3 files changed, 503 insertions, 0 deletions

diff --git a/docbook/release-notes.adoc b/docbook/release-notes.adoc
index 79334e161a..6448c560c1 100644
--- a/docbook/release-notes.adoc
+++ b/docbook/release-notes.adoc
@@ -99,6 +99,7 @@ Network Controller Sideband Interface (NCSI)
 NR Positioning Protocol A (NRPPa) TS 38.455
 NVM Express over Fabrics for TCP (nvme-tcp)
 OsmoTRX Protocol (GSM Transceiver control and data)
+Linux net_dm (network drop monitor) protocol
 --
 
 === Updated Protocol Support
diff --git a/epan/dissectors/CMakeLists.txt b/epan/dissectors/CMakeLists.txt
index d81a79ca34..fc7c60caaa 100644
--- a/epan/dissectors/CMakeLists.txt
+++ b/epan/dissectors/CMakeLists.txt
@@ -1451,6 +1451,7 @@ set(DISSECTOR_SRC
 	${CMAKE_CURRENT_SOURCE_DIR}/packet-netflow.c
 	${CMAKE_CURRENT_SOURCE_DIR}/packet-netlink-generic.c
 	${CMAKE_CURRENT_SOURCE_DIR}/packet-netlink-netfilter.c
+	${CMAKE_CURRENT_SOURCE_DIR}/packet-netlink-net_dm.c
 	${CMAKE_CURRENT_SOURCE_DIR}/packet-netlink-nl80211.c
 	${CMAKE_CURRENT_SOURCE_DIR}/packet-netlink-route.c
 	${CMAKE_CURRENT_SOURCE_DIR}/packet-netlink-sock_diag.c
diff --git a/epan/dissectors/packet-netlink-net_dm.c b/epan/dissectors/packet-netlink-net_dm.c
new file mode 100644
index 0000000000..64e462a212
--- /dev/null
+++ b/epan/dissectors/packet-netlink-net_dm.c
@@ -0,0 +1,501 @@
+/* packet-netlink-net_dm.c
+ * Routines for netlink-net_dm dissection
+ * Based on netlink-route and netlink-generic dissectors
+ * Copyright 2019, Mellanox Technologies Ltd.
+ * Code by Ido Schimmel <idosch@mellanox.com>
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+/* net_dm (network drop monitor) is a netlink-based protocol via which alerts
+ * about dropped packets are sent to user space
+ *
+ * Relevant header file:
+ * https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/tree/include/uapi/linux/net_dropmon.h
+ *
+ * Man page:
+ * man 1 dropwatch
+ */
+
+#define NEW_PROTO_TREE_API
+
+#include "config.h"
+
+#include <epan/packet.h>
+
+#include "packet-netlink.h"
+#include "packet-sll.h"
+
+void proto_register_netlink_net_dm(void);
+void proto_reg_handoff_netlink_net_dm(void);
+
+enum ws_net_dm_commands {
+	WS_NET_DM_CMD_UNSPEC,
+	WS_NET_DM_CMD_ALERT,
+	WS_NET_DM_CMD_CONFIG,
+	WS_NET_DM_CMD_START,
+	WS_NET_DM_CMD_STOP,
+	WS_NET_DM_CMD_PACKET_ALERT,
+	WS_NET_DM_CMD_CONFIG_GET,
+	WS_NET_DM_CMD_CONFIG_NEW,
+	WS_NET_DM_CMD_STATS_GET,
+	WS_NET_DM_CMD_STATS_NEW,
+};
+
+enum ws_net_dm_attrs {
+	WS_NET_DM_ATTR_UNSPEC,
+	WS_NET_DM_ATTR_ALERT_MODE,
+	WS_NET_DM_ATTR_PC,
+	WS_NET_DM_ATTR_SYMBOL,
+	WS_NET_DM_ATTR_IN_PORT,
+	WS_NET_DM_ATTR_TIMESTAMP,
+	WS_NET_DM_ATTR_PROTO,
+	WS_NET_DM_ATTR_PAYLOAD,
+	WS_NET_DM_ATTR_PAD,
+	WS_NET_DM_ATTR_TRUNC_LEN,
+	WS_NET_DM_ATTR_ORIG_LEN,
+	WS_NET_DM_ATTR_QUEUE_LEN,
+	WS_NET_DM_ATTR_STATS,
+	WS_NET_DM_ATTR_HW_STATS,
+	WS_NET_DM_ATTR_ORIGIN,
+	WS_NET_DM_ATTR_HW_TRAP_GROUP_NAME,
+	WS_NET_DM_ATTR_HW_TRAP_NAME,
+	WS_NET_DM_ATTR_HW_ENTRIES,
+	WS_NET_DM_ATTR_HW_ENTRY,
+	WS_NET_DM_ATTR_HW_TRAP_COUNT,
+	WS_NET_DM_ATTR_SW_DROPS,
+	WS_NET_DM_ATTR_HW_DROPS,
+};
+
+enum ws_net_dm_attrs_port {
+	WS_NET_DM_ATTR_PORT_NETDEV_IFINDEX,
+	WS_NET_DM_ATTR_PORT_NETDEV_NAME,
+};
+
+enum ws_net_dm_attrs_stats {
+	WS_NET_DM_ATTR_STATS_DROPPED,
+};
+
+enum ws_net_dm_alert_mode {
+	WS_NET_DM_ALERT_MODE_SUMMARY,
+	WS_NET_DM_ALERT_MODE_PACKET,
+};
+
+enum ws_net_dm_origin {
+	WS_NET_DM_ORIGIN_SW,
+	WS_NET_DM_ORIGIN_HW,
+};
+
+struct netlink_net_dm_info {
+	packet_info *pinfo;
+	struct packet_netlink_data *data;
+	int encoding; /* copy of data->encoding */
+	guint16 protocol; /* protocol for packet payload */
+};
+
+static int proto_netlink_net_dm = -1;
+
+static dissector_handle_t netlink_net_dm_handle;
+static dissector_table_t sll_ltype_table;
+
+static header_field_info *hfi_netlink_net_dm = NULL;
+
+#define NETLINK_NET_DM_HFI_INIT HFI_INIT(proto_netlink_net_dm)
+
+static gint ett_net_dm = -1;
+static gint ett_net_dm_attrs = -1;
+static gint ett_net_dm_attrs_in_port = -1;
+static gint ett_net_dm_attrs_stats = -1;
+static gint ett_net_dm_attrs_hw_stats = -1;
+static gint ett_net_dm_attrs_hw_entries = -1;
+static gint ett_net_dm_attrs_hw_entry = -1;
+
+static const value_string ws_net_dm_commands_vals[] = {
+	{ WS_NET_DM_CMD_UNSPEC,			"Unspecified command" },
+	{ WS_NET_DM_CMD_ALERT,			"Drop alert (summary)" },
+	{ WS_NET_DM_CMD_CONFIG,			"Configure drop monitor" },
+	{ WS_NET_DM_CMD_START,			"Start monitoring" },
+	{ WS_NET_DM_CMD_STOP,			"Stop monitoring" },
+	{ WS_NET_DM_CMD_PACKET_ALERT,		"Drop alert (packet)" },
+	{ WS_NET_DM_CMD_CONFIG_GET,		"Get drop monitor configuration" },
+	{ WS_NET_DM_CMD_CONFIG_NEW,		"New drop monitor configuration" },
+	{ WS_NET_DM_CMD_STATS_GET,		"Get drop monitor statistics" },
+	{ WS_NET_DM_CMD_STATS_NEW,		"New drop monitor statistics" },
+	{ 0, NULL },
+};
+
+static value_string_ext ws_net_dm_commands_vals_ext = VALUE_STRING_EXT_INIT(ws_net_dm_commands_vals);
+
+static const value_string ws_net_dm_attrs_vals[] = {
+	{ WS_NET_DM_ATTR_UNSPEC,			"Unspecified" },
+	{ WS_NET_DM_ATTR_ALERT_MODE,			"Alert mode" },
+	{ WS_NET_DM_ATTR_PC,				"Drop location (PC)" },
+	{ WS_NET_DM_ATTR_SYMBOL,			"Drop location (symbol)" },
+	{ WS_NET_DM_ATTR_IN_PORT,			"Input port" },
+	{ WS_NET_DM_ATTR_TIMESTAMP,			"Timestamp" },
+	{ WS_NET_DM_ATTR_PROTO,				"Protocol" },
+	{ WS_NET_DM_ATTR_PAYLOAD,			"Payload" },
+	{ WS_NET_DM_ATTR_PAD,				"Pad" },
+	{ WS_NET_DM_ATTR_TRUNC_LEN,			"Truncation length" },
+	{ WS_NET_DM_ATTR_ORIG_LEN,			"Original length" },
+	{ WS_NET_DM_ATTR_QUEUE_LEN,			"Queue length" },
+	{ WS_NET_DM_ATTR_STATS,				"Software statistics" },
+	{ WS_NET_DM_ATTR_HW_STATS,			"Hardware statistics" },
+	{ WS_NET_DM_ATTR_ORIGIN,			"Packet origin" },
+	{ WS_NET_DM_ATTR_HW_TRAP_GROUP_NAME,		"Hardware trap group name" },
+	{ WS_NET_DM_ATTR_HW_TRAP_NAME,			"Hardware trap name" },
+	{ WS_NET_DM_ATTR_HW_ENTRIES,			"Hardware trap entries" },
+	{ WS_NET_DM_ATTR_HW_ENTRY,			"Hardware trap entry" },
+	{ WS_NET_DM_ATTR_HW_TRAP_COUNT,			"Hardware trap count" },
+	{ WS_NET_DM_ATTR_SW_DROPS,			"Software drops" },
+	{ WS_NET_DM_ATTR_HW_DROPS,			"Hardware drops" },
+	{ 0, NULL },
+};
+
+static value_string_ext ws_net_dm_attrs_vals_ext = VALUE_STRING_EXT_INIT(ws_net_dm_attrs_vals);
+
+static const value_string ws_net_dm_attrs_port_vals[] = {
+	{ WS_NET_DM_ATTR_PORT_NETDEV_IFINDEX,		"Net device index" },
+	{ WS_NET_DM_ATTR_PORT_NETDEV_NAME,		"Net device name" },
+	{ 0, NULL },
+};
+
+static const value_string ws_net_dm_attrs_stats_vals[] = {
+	{ WS_NET_DM_ATTR_STATS_DROPPED,			"Dropped" },
+	{ 0, NULL },
+};
+
+static const value_string ws_net_dm_alert_mode_vals[] = {
+	{ WS_NET_DM_ALERT_MODE_SUMMARY,		"Summary" },
+	{ WS_NET_DM_ALERT_MODE_PACKET,		"Packet" },
+	{ 0, NULL },
+};
+
+static const value_string ws_net_dm_origin_vals[] = {
+	{ WS_NET_DM_ORIGIN_SW,		"Software" },
+	{ WS_NET_DM_ORIGIN_HW,		"Hardware" },
+	{ 0, NULL },
+};
+
+static header_field_info hfi_net_dm_commands NETLINK_NET_DM_HFI_INIT =
+	{ "Command", "net_dm.cmd", FT_UINT8, BASE_DEC | BASE_EXT_STRING,
+	  &ws_net_dm_commands_vals_ext, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_attrs NETLINK_NET_DM_HFI_INIT =
+	{ "Attribute type", "net_dm.attr_type", FT_UINT16, BASE_DEC | BASE_EXT_STRING,
+	  &ws_net_dm_attrs_vals_ext, NLA_TYPE_MASK, NULL, HFILL };
+
+static header_field_info hfi_net_dm_alert_mode NETLINK_NET_DM_HFI_INIT =
+	{ "Alert mode", "net_dm.alert_mode", FT_UINT8, BASE_DEC,
+	  VALS(ws_net_dm_alert_mode_vals), 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_pc NETLINK_NET_DM_HFI_INIT =
+	{ "Program counter", "net_dm.pc", FT_UINT64, BASE_HEX,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_symbol NETLINK_NET_DM_HFI_INIT =
+	{ "Symbol", "net_dm.symbol", FT_STRINGZ, STR_ASCII,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_attrs_port NETLINK_NET_DM_HFI_INIT =
+	{ "Attribute type", "net_dm.port.attr_type", FT_UINT16, BASE_DEC,
+	  VALS(ws_net_dm_attrs_port_vals), NLA_TYPE_MASK, NULL, HFILL };
+
+static header_field_info hfi_net_dm_timestamp NETLINK_NET_DM_HFI_INIT =
+	{ "Timestamp", "net_dm.timestamp", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_proto NETLINK_NET_DM_HFI_INIT =
+	{ "Protocol", "net_dm.proto", FT_UINT16, BASE_HEX,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_trunc_len NETLINK_NET_DM_HFI_INIT =
+	{ "Truncation length", "net_dm.trunc_len", FT_UINT32, BASE_DEC,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_orig_len NETLINK_NET_DM_HFI_INIT =
+	{ "Original length", "net_dm.orig_len", FT_UINT32, BASE_DEC,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_queue_len NETLINK_NET_DM_HFI_INIT =
+	{ "Queue length", "net_dm.queue_len", FT_UINT32, BASE_DEC,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_attrs_stats NETLINK_NET_DM_HFI_INIT =
+	{ "Attribute type", "net_dm.stats.attr_type", FT_UINT16, BASE_DEC,
+	  VALS(ws_net_dm_attrs_stats_vals), NLA_TYPE_MASK, NULL, HFILL };
+
+static header_field_info hfi_net_dm_origin NETLINK_NET_DM_HFI_INIT =
+	{ "Packet origin", "net_dm.origin", FT_UINT16, BASE_DEC,
+	  VALS(ws_net_dm_origin_vals), 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_hw_trap_group_name NETLINK_NET_DM_HFI_INIT =
+	{ "Hardware trap group name", "net_dm.hw_trap_group_name", FT_STRINGZ,
+	  STR_ASCII, NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_hw_trap_name NETLINK_NET_DM_HFI_INIT =
+	{ "Hardware trap name", "net_dm.hw_trap_name", FT_STRINGZ,
+	  STR_ASCII, NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_hw_trap_count NETLINK_NET_DM_HFI_INIT =
+	{ "Hardware trap count", "net_dm.hw_trap_count", FT_UINT32, BASE_DEC,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_sw NETLINK_NET_DM_HFI_INIT =
+	{ "Software", "net_dm.sw", FT_NONE, BASE_NONE, NULL, 0x00, NULL,
+	  HFILL };
+
+static header_field_info hfi_net_dm_hw NETLINK_NET_DM_HFI_INIT =
+	{ "Hardware", "net_dm.hw", FT_NONE, BASE_NONE, NULL, 0x00, NULL,
+	  HFILL };
+
+static header_field_info hfi_net_dm_port_netdev_index NETLINK_NET_DM_HFI_INIT =
+	{ "Port net device index", "net_dm.port.netdev_index", FT_UINT32, BASE_DEC,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_port_netdev_name NETLINK_NET_DM_HFI_INIT =
+	{ "Port net device name", "net_dm.port.netdev_name", FT_STRINGZ, STR_ASCII,
+	  NULL, 0x00, NULL, HFILL };
+
+static header_field_info hfi_net_dm_stats_dropped NETLINK_NET_DM_HFI_INIT =
+	{ "Dropped", "net_dm.stats.dropped", FT_UINT64, BASE_DEC,
+	  NULL, 0x00, NULL, HFILL };
+
+static int
+dissect_net_dm_attrs_port(tvbuff_t *tvb, void *data, proto_tree *tree, int nla_type, int offset, int len)
+{
+	enum ws_net_dm_attrs_port type = (enum ws_net_dm_attrs_port) nla_type & NLA_TYPE_MASK;
+	struct netlink_net_dm_info *info = (struct netlink_net_dm_info *) data;
+	const guint8 *str;
+
+	switch (type) {
+	case WS_NET_DM_ATTR_PORT_NETDEV_IFINDEX:
+		proto_item_append_text(tree, ": %u", tvb_get_guint32(tvb, offset, info->encoding));
+		proto_tree_add_item(tree, &hfi_net_dm_port_netdev_index, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_PORT_NETDEV_NAME:
+		proto_tree_add_item_ret_string(tree, &hfi_net_dm_port_netdev_name, tvb, offset, len, ENC_ASCII | ENC_NA, wmem_packet_scope(), &str);
+		proto_item_append_text(tree, ": %s", str);
+		return 1;
+	default:
+		return 0;
+	}
+}
+
+static int
+dissect_net_dm_attrs_stats(tvbuff_t *tvb, void *data, proto_tree *tree, int nla_type, int offset, int len)
+{
+	enum ws_net_dm_attrs_port type = (enum ws_net_dm_attrs_port) nla_type & NLA_TYPE_MASK;
+	struct netlink_net_dm_info *info = (struct netlink_net_dm_info *) data;
+
+	switch (type) {
+	case WS_NET_DM_ATTR_STATS_DROPPED:
+		proto_tree_add_item(tree, &hfi_net_dm_stats_dropped, tvb, offset, len, info->encoding);
+		return 1;
+	default:
+		return 0;
+	}
+}
+
+static int
+dissect_net_dm_attrs(tvbuff_t *tvb, void *data, proto_tree *tree, int nla_type, int offset, int len)
+{
+	enum ws_net_dm_attrs type = (enum ws_net_dm_attrs) nla_type & NLA_TYPE_MASK;
+	struct netlink_net_dm_info *info = (struct netlink_net_dm_info *) data;
+	guint64 timestamp, pc;
+	tvbuff_t *next_tvb;
+	nstime_t ts_nstime;
+	const guint8 *str;
+
+	switch (type) {
+	case WS_NET_DM_ATTR_ALERT_MODE:
+		proto_tree_add_item(tree, &hfi_net_dm_alert_mode, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_PC:
+		proto_tree_add_item_ret_uint64(tree, hfi_net_dm_pc.id, tvb,
+					       offset, 8, info->encoding, &pc);
+		proto_item_append_text(tree, ": 0x%" G_GINT64_MODIFIER "x", pc);
+		return 1;
+	case WS_NET_DM_ATTR_SYMBOL:
+		proto_tree_add_item_ret_string(tree, &hfi_net_dm_symbol, tvb, offset, len, ENC_ASCII | ENC_NA, wmem_packet_scope(), &str);
+		proto_item_append_text(tree, ": %s", str);
+		return 1;
+	case WS_NET_DM_ATTR_IN_PORT:
+		return dissect_netlink_attributes(tvb, &hfi_net_dm_attrs_port, ett_net_dm_attrs_in_port, info, info->data, tree, offset, len,
+						  dissect_net_dm_attrs_port);
+	case WS_NET_DM_ATTR_TIMESTAMP:
+		timestamp = tvb_get_guint64(tvb, offset, info->encoding);
+		ts_nstime.secs = timestamp / 1000000000;
+		ts_nstime.nsecs = timestamp % 1000000000;
+		proto_tree_add_time(tree, &hfi_net_dm_timestamp, tvb, offset, 8, &ts_nstime);
+		return 1;
+	case WS_NET_DM_ATTR_PROTO:
+		info->protocol = tvb_get_guint16(tvb, offset, info->encoding);
+		/* This attribute encodes 'skb->protocol' and if it is greater
+		 * than or equal to 1536 (0x0600), then it is an Ethertype and
+		 * we need to treat the packet as Ethernet.
+		 */
+		if (info->protocol >= 1536 || info->protocol == LINUX_SLL_P_802_2)
+			info->protocol = LINUX_SLL_P_ETHERNET;
+		proto_tree_add_item(tree, &hfi_net_dm_proto, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_PAYLOAD:
+		next_tvb = tvb_new_subset_length(tvb, offset, len);
+		if (!dissector_try_uint(sll_ltype_table, info->protocol, next_tvb, info->pinfo, tree))
+			call_data_dissector(next_tvb, info->pinfo, tree);
+		return 1;
+	case WS_NET_DM_ATTR_TRUNC_LEN:
+		proto_item_append_text(tree, ": %u", tvb_get_guint32(tvb, offset, info->encoding));
+		proto_tree_add_item(tree, &hfi_net_dm_trunc_len, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_ORIG_LEN:
+		proto_item_append_text(tree, ": %u", tvb_get_guint32(tvb, offset, info->encoding));
+		proto_tree_add_item(tree, &hfi_net_dm_orig_len, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_QUEUE_LEN:
+		proto_item_append_text(tree, ": %u", tvb_get_guint32(tvb, offset, info->encoding));
+		proto_tree_add_item(tree, &hfi_net_dm_queue_len, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_STATS:
+		return dissect_netlink_attributes(tvb, &hfi_net_dm_attrs_stats, ett_net_dm_attrs_stats, info, info->data, tree, offset, len,
+						  dissect_net_dm_attrs_stats);
+	case WS_NET_DM_ATTR_HW_STATS:
+		return dissect_netlink_attributes(tvb, &hfi_net_dm_attrs_stats, ett_net_dm_attrs_hw_stats, info, info->data, tree, offset, len,
+						  dissect_net_dm_attrs_stats);
+	case WS_NET_DM_ATTR_ORIGIN:
+		proto_tree_add_item(tree, &hfi_net_dm_origin, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_HW_TRAP_GROUP_NAME:
+		proto_tree_add_item_ret_string(tree, &hfi_net_dm_hw_trap_group_name, tvb, offset, len, ENC_ASCII | ENC_NA, wmem_packet_scope(), &str);
+		proto_item_append_text(tree, ": %s", str);
+		return 1;
+	case WS_NET_DM_ATTR_HW_TRAP_NAME:
+		proto_tree_add_item_ret_string(tree, &hfi_net_dm_hw_trap_name, tvb, offset, len, ENC_ASCII | ENC_NA, wmem_packet_scope(), &str);
+		proto_item_append_text(tree, ": %s", str);
+		return 1;
+	case WS_NET_DM_ATTR_HW_ENTRIES:
+		return dissect_netlink_attributes(tvb, &hfi_net_dm_attrs, ett_net_dm_attrs_hw_entries, info, info->data, tree, offset, len,
+						  dissect_net_dm_attrs);
+	case WS_NET_DM_ATTR_HW_ENTRY:
+		return dissect_netlink_attributes(tvb, &hfi_net_dm_attrs, ett_net_dm_attrs_hw_entry, info, info->data, tree, offset, len,
+						  dissect_net_dm_attrs);
+	case WS_NET_DM_ATTR_HW_TRAP_COUNT:
+		proto_item_append_text(tree, ": %u", tvb_get_guint32(tvb, offset, info->encoding));
+		proto_tree_add_item(tree, &hfi_net_dm_hw_trap_count, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_SW_DROPS:
+		proto_tree_add_item(tree, &hfi_net_dm_sw, tvb, offset, len, info->encoding);
+		return 1;
+	case WS_NET_DM_ATTR_HW_DROPS:
+		proto_tree_add_item(tree, &hfi_net_dm_hw, tvb, offset, len, info->encoding);
+		return 1;
+	default:
+		return 0;
+	}
+}
+
+static int
+dissect_netlink_net_dm(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
+{
+	genl_info_t *genl_info = (genl_info_t *)data;
+	struct netlink_net_dm_info info;
+	proto_tree *nlmsg_tree;
+	proto_item *pi;
+	int offset;
+
+	DISSECTOR_ASSERT(genl_info);
+
+	col_set_str(pinfo->cinfo, COL_PROTOCOL, "net_dm");
+	col_clear(pinfo->cinfo, COL_INFO);
+
+	/* Generic netlink header */
+	offset = dissect_genl_header(tvb, genl_info, &hfi_net_dm_commands);
+
+	/* Not all commands have a payload */
+	if (!tvb_reported_length_remaining(tvb, offset))
+		return offset;
+
+	pi = proto_tree_add_item(tree, proto_registrar_get_nth(proto_netlink_net_dm), tvb, offset, -1, ENC_NA);
+	nlmsg_tree = proto_item_add_subtree(pi, ett_net_dm);
+
+	info.encoding = genl_info->encoding;
+	info.pinfo = pinfo;
+	info.data = genl_info->data;
+	info.protocol = 0;
+
+	offset = dissect_netlink_attributes(tvb, &hfi_net_dm_attrs, ett_net_dm_attrs, &info, genl_info->data, nlmsg_tree, offset, -1, dissect_net_dm_attrs);
+
+	return offset;
+}
+
+void
+proto_register_netlink_net_dm(void)
+{
+#ifndef HAVE_HFI_SECTION_INIT
+	static header_field_info *hfi[] = {
+		&hfi_net_dm_commands,
+		&hfi_net_dm_attrs,
+		&hfi_net_dm_alert_mode,
+		&hfi_net_dm_pc,
+		&hfi_net_dm_symbol,
+		&hfi_net_dm_attrs_port,
+		&hfi_net_dm_timestamp,
+		&hfi_net_dm_proto,
+		&hfi_net_dm_trunc_len,
+		&hfi_net_dm_orig_len,
+		&hfi_net_dm_queue_len,
+		&hfi_net_dm_attrs_stats,
+		&hfi_net_dm_origin,
+		&hfi_net_dm_hw_trap_group_name,
+		&hfi_net_dm_hw_trap_name,
+		&hfi_net_dm_hw_trap_count,
+		&hfi_net_dm_sw,
+		&hfi_net_dm_hw,
+		&hfi_net_dm_port_netdev_index,
+		&hfi_net_dm_port_netdev_name,
+		&hfi_net_dm_stats_dropped,
+	};
+#endif
+
+	static gint *ett[] = {
+		&ett_net_dm,
+		&ett_net_dm_attrs,
+		&ett_net_dm_attrs_in_port,
+		&ett_net_dm_attrs_stats,
+		&ett_net_dm_attrs_hw_stats,
+		&ett_net_dm_attrs_hw_entries,
+		&ett_net_dm_attrs_hw_entry,
+	};
+
+	proto_netlink_net_dm = proto_register_protocol("Linux net_dm (network drop monitor) protocol", "net_dm", "net_dm");
+	hfi_netlink_net_dm = proto_registrar_get_nth(proto_netlink_net_dm);
+
+	proto_register_fields(proto_netlink_net_dm, hfi, array_length(hfi));
+	proto_register_subtree_array(ett, array_length(ett));
+
+	netlink_net_dm_handle = create_dissector_handle(dissect_netlink_net_dm, proto_netlink_net_dm);
+}
+
+void
+proto_reg_handoff_netlink_net_dm(void)
+{
+	dissector_add_string("genl.family", "NET_DM", netlink_net_dm_handle);
+	sll_ltype_table = find_dissector_table("sll.ltype");
+}
+
+/*
+ * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 8
+ * tab-width: 8
+ * indent-tabs-mode: t
+ * End:
+ *
+ * vi: set shiftwidth=8 tabstop=8 noexpandtab:
+ * :indentSize=8:tabSize=8:noTabs=false:
+ */