Skip to content

libpcap: get MAC addresses on Darwin, *BSD and illumos correctly - #5224

Open
evverx wants to merge 1 commit into
secdev:masterfrom
evverx:mac-sockaddr-dl
Open

evverx wants to merge 1 commit into
secdev:masterfrom
evverx:mac-sockaddr-dl

Conversation

@evverx

@evverx evverx commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

It fixes a bug where scapy ended up with "00:00:00:00:00:00" on Darwin and *BSD and with MAC addresses like "04:00:06:03:06:00" (where 4, 6, 3 and 6 were the ifindex, the type, the name length and the address length accordingly) on illumos. With this patch applied scapy extracts the lengths from the sockaddr_dl structure, skips the names and gets the MAC addresses by analogy with what it already did before 07dedfd was merged. The bug didn't affect Linux because AF_LINK isn't there so ioctl with SIOCGIFHWADDR is used instead.

It was tested on Darwin, FreeBSD, NetBSD, OpenBSD, illumos and Linux.

It fixes a bug where scapy ended up with "00:00:00:00:00:00" on Darwin
and *BSD and with MAC addresses like "04:00:06:03:06:00" (where 4, 6, 3
and 6 were the ifindex, the type, the name length and the address length
accordingly) on illumos. With this patch applied scapy extracts the
lengths from the sockaddr_dl structure, skips the names and gets the MAC
addresses by analogy with what it already did before
07dedfd was merged. The bug didn't
affect Linux because AF_LINK isn't there so ioctl with SIOCGIFHWADDR is
used instead.

It was tested on Darwin, FreeBSD, NetBSD, OpenBSD, illumos and Linux.

AI-Assisted: no
@codecov

codecov Bot commented Oct 7, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.14%. Comparing base (d1bbdaf) to head (053144e).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5224      +/-   ##
==========================================
+ Coverage   80.84%   81.14%   +0.30%     
==========================================
  Files         393      393              
  Lines       98325    98327       +2     
==========================================
+ Hits        79488    79791     +303     
+ Misses      18837    18536     -301     
Files with missing lines Coverage Δ
scapy/arch/libpcap.py 77.28% <100.00%> (+2.48%) ⬆️

... and 25 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread scapy/arch/libpcap.py
# https://github.com/illumos/illumos-gate/blob/6a2df4aa5381599179ab6afb3165db81960dee35/usr/src/uts/common/net/if_dl.h#L65-L76
# https://github.com/NetBSD/src/blob/bc2d21a8880597d1affe4ec581e0b65637258dc4/sys/net/if_dl.h#L78-L91
# https://github.com/openbsd/src/blob/ce063bbc9d6190c8ba255f11feb6910dc3541f29/sys/net/if_dl.h#L56-L70
sockaddr_dl = ccast(ap, POINTER(c_ubyte))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the PR. Wasn't it possible to keep the structure? This is a bit harder to read. I'm not sure I understand what happened wrong in the previous structure, since 1 and 2 bytes-long fields should be pretty much padded the same on all plateforms. Thanks !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants