Is there a way to query specific interface using netlink?

Question

From what I understand, sending a RTM_GETLINK request dumps all the interface on the system. I am interested in a specific interface only. Is there a way that I can set my request to give me all the information about a particular interface? I know the name of the interface I am interested in.

Answer 1

I know this is kind of an old question but the information online, at least what I found, on how to archive kernel filtering with netlink is not as good as one would like to.

Here is a promising paper explaining the topic and possible filters, I have not tested all of them, so no guarantees whatsoever. Unfortunately it lacks some more practical examples in code...

I found more information here, though it confused me that this source is talking about the NETLINK_DUMP_STRICT_CHK socket flag, which I could not find in my netlink headers. Seems they changed it to NETLINK_GET_STRICT_CHK in kernel 4.20.

Anyway, after a little bit of research and stracing some iproute2 commands, I figured out how to apply kernel filters (at least for RTM_GETLINK nad RTM_GETADDR but the other should work the same way).

Example code for querying link information for one interface (needs to be specified in INTERFACE_NAME!):

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <net/if.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>

#define INTERFACE_NAME "wlp59s0"

int main(int argc, char ** argv) {
    // We do not specify nl_groups, as we do not want to be part of a kernel multi
    struct sockaddr_nl src_addr = {AF_NETLINK, 0, (__u32) getpid(), 0};
    struct sockaddr_nl dest_addr = {AF_NETLINK};
    int optval = 1;
    struct {
        struct nlmsghdr nh;
        struct ifinfomsg ifi;
    } request = {};
    char buffer[4096];
    struct iovec iov = {};
    struct msghdr msg = {};
    struct nlmsghdr *nh;
    struct ifinfomsg *ifi;
    struct rtattr *attr;
    ssize_t n, attr_len;

    // Open a netlink socket
    int request_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
    if (request_fd == -1) {
        fprintf(stderr, "Netlink socket create failed: %s\n", strerror(errno));
        return EXIT_FAILURE;
    }
    // Enable kernel filtering
    if (setsockopt(request_fd, SOL_NETLINK, NETLINK_GET_STRICT_CHK, &optval, sizeof(optval)) < 0) {
        fprintf(stderr, "Netlink set socket option \"NETLINK_GET_STRICT_CHK\" failed: %s\n", strerror(errno));
        return EXIT_FAILURE;
    }
    // Bind the file descriptor with the option specified in src_addr
    if (bind(request_fd, (struct sockaddr *) &src_addr, sizeof(src_addr)) < 0) {
        fprintf(stderr, "Netlink socket bind failed: %s\n", strerror(errno));
        return EXIT_FAILURE;
    }
    // Prepare address request for the kernel
    // Message length
    request.nh.nlmsg_len = NLMSG_LENGTH(sizeof(request.ifi));
    // We are interested in link information
    request.nh.nlmsg_type = RTM_GETLINK;
    // Request and dump filtered flags
    request.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP_FILTERED;
    // No address family specified
    request.ifi.ifi_family = AF_NETLINK;
    // The filter option we pass to netlink. More filters are possible...
    request.ifi.ifi_index = (int) if_nametoindex(INTERFACE_NAME);
    // Place the request in iovec
    iov.iov_base = &request;
    iov.iov_len = request.nh.nlmsg_len;
    // Place iovec struct in message
    msg.msg_name = &dest_addr;
    msg.msg_namelen = sizeof(dest_addr);
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;

    // Send the request message
    if (sendmsg(request_fd, (struct msghdr *) &msg, 0) < 0) {
        fprintf(stderr, "Error sending interface request to netlink: %s\n", strerror(errno));
        return EXIT_FAILURE;
    }
    // Prepare iovec for the response
    memset(&iov, 0, sizeof(iov));
    iov.iov_base = buffer;
    iov.iov_len = sizeof(buffer);
    // Receive the response from netlink
    n = recvmsg(request_fd, &msg, 0);
    if (n < 0) {
        fprintf(stderr, "Error receiving message from netlink: %s\n", strerror(errno));
        return EXIT_FAILURE;
    }
    // Loop over the netlink header contained in the message (should only be one, since we requested one specific interface)
    for (nh = (struct nlmsghdr *) buffer; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n)) {
        // type of the response we are looking for
        if (nh->nlmsg_type == RTM_NEWLINK) {
            // Get and print ifinfomsg struct
            ifi = (struct ifinfomsg *) NLMSG_DATA(nh);
            printf("Family: %u\n", ifi->ifi_family);
            printf("Device type: %u\n", ifi->ifi_type);
            printf("Index: %u\n", ifi->ifi_index);
            printf("Flags: %u\n", ifi->ifi_flags);
            printf("Change mask: %u\n", ifi->ifi_change);
            attr_len = nh->nlmsg_len - NLMSG_LENGTH(sizeof(*ifi));
            // Iterate over following routing attributes (we do only care for the MAC address)
            for (attr = IFLA_RTA(ifi); RTA_OK(attr, attr_len); attr = RTA_NEXT(attr, attr_len)) {
                if (attr->rta_type == IFLA_ADDRESS) {
                    char name[IFNAMSIZ];
                    char buf[64];
                    unsigned char *ptr = (unsigned char *) RTA_DATA(attr);
                    snprintf(buf, 64, " %02x:%02x:%02x:%02x:%02x:%02x",
                             ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]);
                    // Convert the interface index back to the name, we expect the value defined in INTERFACE_NAME!
                    printf("%s hs the MAC address: %s\n",if_indextoname(ifi->ifi_index, name),  buf);
                }
            }
        }
    }
    return EXIT_SUCCESS;
}

Just change INTERFACE_NAME to whatever you need and the rest should work.

Please note that the code does not wait for NLMSG_DONE, as we do not expect a multipart message. If you apply a filter that possibly matches multiple interfaces, you need to read the socket in a loop and check for the NLMSG_DONE message type.