libpcap get MAC from AF_LINK sockaddr_dl (OSX)

Question

I am trying to obtain the MAC addresses of all of my interface on OSX using C. The common ways to obtain it Linux dont work on BSD - from everything I have seen, you must obtain the interfaces and look for the ones that are of type AF_LINK. My problem is that the LLADDR(sockaddr_dl) gives me a whole bunch of data (which includes my MAC) and I dont know what format the data is in. For example; the following code will output:

Device: en1 link sdl_alen: 101 mac: 31:f8:1e:df:d6:22:1d:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:b0:06:10:00:01:00:00:00:c0:02:10:00:01:00:00:00:00:00:00:00:00:00:00:00:40 :03:10:00:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:03:00:6c:6f:30:00:00:00:00:00:00:00:00:00:00:00:00:00:70:03:10:00:01:00:00:00:e0: 02:10:00:01:00:00:

My MAC is bolded. It seems that this is the format all of the time, but I would be a lot more comfortable if I could cast LLADDR(sockaddr_dl) to something. In the net/if_dl.h, LLADDR is defied as:

#define LLADDR(s) ((caddr_t)((s)->sdl_data + (s)->sdl_nlen))

which, as far as I can tell, is saying that the results are of type (void *) - no help.

Other posts like:

Having a problem figuring out how to get Ethernet interface info on Mac OS X using ioctl/SIOCGIFADDR/SIOCGIFCONF?

seem to think they have it figured out, but if you look through the code, you can see it will not work due to sdl_alen not being 6.

int main() {
    pcap_if_t *alldevs;
    pcap_if_t *d;
    pcap_addr_t *alladdrs;
    pcap_addr_t *a;

    struct sockaddr_dl* link;

    char eb[PCAP_ERRBUF_SIZE];
    char *addr_buf[40];

    if (pcap_findalldevs(&alldevs, eb) == -1) {
        printf("no devs found\n");
        return(-1);
    }

    for (d = alldevs; d != NULL; d = d->next) {
        printf("Device: %s\n", d->name);
        alladdrs = d->addresses;
        for (a = alladdrs; a != NULL; a = a->next) {
            if(a->addr->sa_family == AF_LINK && a->addr->sa_data != NULL){
                // MAC ADDRESS
                //struct sockaddr_dl *sdl = (struct sockaddr_dl *) a->addr->sa_data;
                link = (struct sockaddr_dl*)a->addr->sa_data;

                char mac[link->sdl_alen];
                caddr_t macaddr = LLADDR(link);

                memcpy(mac, LLADDR(link), link->sdl_alen);
                printf("link sdl_alen: %i\n", link->sdl_alen);
                int i;
                printf("mac: ");
                for(i = 0; i<link->sdl_alen; i++){
                    printf("%02x:", (unsigned char)mac[i]);
                }
                printf("\n");
            }
        }
    }
}

Answer 1

The problem is that you are casting the sockaddr->sa_data to sockaddr_dl instead of casting the sockaddr itself to sockaddr_dl. Keep in mind that sockaddr_dl is an OS X/BSD thing, so #ifdef that part for portability.

Don't do:

link = (struct sockaddr_dl*)a->addr->sa_data;

Do:

link = (struct sockaddr_dl*)a->addr;

Then you will get the correct sdl_alen and things will work with out any hacks. And if you want to really easily get the name of addresses that may be either AF_INET, AF_INET6, or AF_LINK use getnameinfo():

#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <net/if_dl.h>

int get_sock_len(struct sockaddr *sa)
{
    switch (sa->sa_family) {
    case AF_INET:
        return sizeof(struct sockaddr_in);
    case AF_INET6:
        return sizeof(struct sockaddr_in6);
    case AF_LINK:
        return sizeof(struct sockaddr_dl);
    default:
        return -1;
    }
}

int get_numeric_address(struct sockaddr *sa, char *outbuf, size_t buflen) {
    socklen_t len;
    if ((len = get_sock_len(sa)) < 0) {
        return -1;
    }
    if (getnameinfo(sa, len, outbuf, buflen, NULL, 0, NI_NUMERICHOST)) {
        return -1;
    }
    return 0;
}

...
char buf[NI_MAXHOST];
if (!get_numeric_address(sa, buf, sizeof(buf))) { /* For some struct sockaddr *sa */
    printf("address: %s\n", buf);
} else {
    printf("doh!\n");
}