Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	sbin/pflogd/pflogd.c	Lines:	0	313	0.0 %
Date:	2016-12-06	Branches:	0	187	0.0 %


/*	$OpenBSD: pflogd.c,v 1.53 2016/01/16 03:17:48 canacar Exp $	*/

/*
 * Copyright (c) 2001 Theo de Raadt
 * Copyright (c) 2001 Can Erkin Acar
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *    - Redistributions of source code must retain the above copyright
 *      notice, this list of conditions and the following disclaimer.
 *    - Redistributions in binary form must reproduce the above
 *      copyright notice, this list of conditions and the following
 *      disclaimer in the documentation and/or other materials provided
 *      with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <net/if.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <pcap-int.h>
#include <pcap.h>
#include <syslog.h>
#include <signal.h>
#include <err.h>
#include <errno.h>
#include <stdarg.h>
#include <fcntl.h>
#include <util.h>
#include "pflogd.h"

pcap_t *hpcap;
static FILE *dpcap;

int Debug = 0;
static int snaplen = DEF_SNAPLEN;
static int cur_snaplen = DEF_SNAPLEN;

volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;

char *filename = PFLOGD_LOG_FILE;
char *interface = PFLOGD_DEFAULT_IF;
char *filter = NULL;

char errbuf[PCAP_ERRBUF_SIZE];

int log_debug = 0;
unsigned int delay = FLUSH_DELAY;

char *copy_argv(char * const *);
void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
int   flush_buffer(FILE *);
int   if_exists(char *);
int   init_pcap(void);
void  logmsg(int, const char *, ...);
void  purge_buffer(void);
int   reset_dump(int);
int   scan_dump(FILE *, off_t);
int   set_snaplen(int);
void  set_suspended(int);
void  sig_alrm(int);
void  sig_close(int);
void  sig_hup(int);
void  usage(void);

static int try_reset_dump(int);

/* buffer must always be greater than snaplen */
static int    bufpkt = 0;	/* number of packets in buffer */
static int    buflen = 0;	/* allocated size of buffer */
static char  *buffer = NULL;	/* packet buffer */
static char  *bufpos = NULL;	/* position in buffer */
static int    bufleft = 0;	/* bytes left in buffer */

/* if error, stop logging but count dropped packets */
static int suspended = -1;
static long packets_dropped = 0;

void
set_suspended(int s)
{
	if (suspended == s)
		return;

	suspended = s;
	setproctitle("[%s] -s %d -i %s -f %s",
	    suspended ? "suspended" : "running",
	    cur_snaplen, interface, filename);
}

char *
copy_argv(char * const *argv)
{
	size_t len = 0, n;
	char *buf;

	if (argv == NULL)
		return (NULL);

	for (n = 0; argv[n]; n++)
		len += strlen(argv[n])+1;
	if (len == 0)
		return (NULL);

	buf = malloc(len);
	if (buf == NULL)
		return (NULL);

	strlcpy(buf, argv[0], len);
	for (n = 1; argv[n]; n++) {
		strlcat(buf, " ", len);
		strlcat(buf, argv[n], len);
	}
	return (buf);
}

void
logmsg(int pri, const char *message, ...)
{
	va_list ap;
	va_start(ap, message);

	if (log_debug) {
		vfprintf(stderr, message, ap);
		fprintf(stderr, "\n");
	} else
		vsyslog(pri, message, ap);
	va_end(ap);
}

__dead void
usage(void)
{
	fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]");
	fprintf(stderr, " [-i interface] [-s snaplen]\n");
	fprintf(stderr, "              [expression]\n");
	exit(1);
}

void
sig_close(int sig)
{
	gotsig_close = 1;
}

void
sig_hup(int sig)
{
	gotsig_hup = 1;
}

void
sig_alrm(int sig)
{
	gotsig_alrm = 1;
}

void
set_pcap_filter(void)
{
	struct bpf_program bprog;

	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
	else {
		if (pcap_setfilter(hpcap, &bprog) < 0)
			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
		pcap_freecode(&bprog);
	}
}

int
if_exists(char *ifname)
{
	int s, ret = 1;
	struct ifreq ifr;
	struct if_data ifrdat;

	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
		err(1, "socket");
	bzero(&ifr, sizeof(ifr));
	if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
		sizeof(ifr.ifr_name))
			errx(1, "main ifr_name: strlcpy");
	ifr.ifr_data = (caddr_t)&ifrdat;
	if (ioctl(s, SIOCGIFDATA, (caddr_t)&ifr) == -1)
		ret = 0;
	if (close(s))
		err(1, "close");

	return (ret);
}

int
init_pcap(void)
{
	hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
	if (hpcap == NULL) {
		logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
		return (-1);
	}

	if (pcap_datalink(hpcap) != DLT_PFLOG) {
		logmsg(LOG_ERR, "Invalid datalink type");
		pcap_close(hpcap);
		hpcap = NULL;
		return (-1);
	}

	set_pcap_filter();

	cur_snaplen = snaplen = pcap_snapshot(hpcap);

	/* lock */
	if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
		logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
		return (-1);
	}

	return (0);
}

int
set_snaplen(int snap)
{
	if (priv_set_snaplen(snap))
		return (1);

	if (cur_snaplen > snap)
		purge_buffer();

	cur_snaplen = snap;

	return (0);
}

int
reset_dump(int nomove)
{
	int ret;

	for (;;) {
		ret = try_reset_dump(nomove);
		if (ret <= 0)
			break;
	}

	return (ret);
}

/*
 * tries to (re)open log file, nomove flag is used with -x switch
 * returns 0: success, 1: retry (log moved), -1: error
 */
int
try_reset_dump(int nomove)
{
	struct pcap_file_header hdr;
	struct stat st;
	int fd;
	FILE *fp;

	if (hpcap == NULL)
		return (-1);

	if (dpcap) {
		flush_buffer(dpcap);
		fclose(dpcap);
		dpcap = NULL;
	}

	/*
	 * Basically reimplement pcap_dump_open() because it truncates
	 * files and duplicates headers and such.
	 */
	fd = priv_open_log();
	if (fd < 0)
		return (-1);

	fp = fdopen(fd, "a+");

	if (fp == NULL) {
		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
		close(fd);
		return (-1);
	}
	if (fstat(fileno(fp), &st) == -1) {
		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
		fclose(fp);
		return (-1);
	}

	/* set FILE unbuffered, we do our own buffering */
	if (setvbuf(fp, NULL, _IONBF, 0)) {
		logmsg(LOG_ERR, "Failed to set output buffers");
		fclose(fp);
		return (-1);
	}

#define TCPDUMP_MAGIC 0xa1b2c3d4

	if (st.st_size == 0) {
		if (snaplen != cur_snaplen) {
			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
			if (set_snaplen(snaplen))
				logmsg(LOG_WARNING,
				    "Failed, using old settings");
		}
		hdr.magic = TCPDUMP_MAGIC;
		hdr.version_major = PCAP_VERSION_MAJOR;
		hdr.version_minor = PCAP_VERSION_MINOR;
		hdr.thiszone = hpcap->tzoff;
		hdr.snaplen = hpcap->snapshot;
		hdr.sigfigs = 0;
		hdr.linktype = hpcap->linktype;

		if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
			fclose(fp);
			return (-1);
		}
	} else if (scan_dump(fp, st.st_size)) {
		fclose(fp);
		if (nomove || priv_move_log()) {
			logmsg(LOG_ERR,
			    "Invalid/incompatible log file, move it away");
			return (-1);
		}
		return (1);
	}

	dpcap = fp;

	set_suspended(0);
	flush_buffer(fp);

	return (0);
}

int
scan_dump(FILE *fp, off_t size)
{
	struct pcap_file_header hdr;
	struct pcap_pkthdr ph;
	off_t pos;

	/*
	 * Must read the file, compare the header against our new
	 * options (in particular, snaplen) and adjust our options so
	 * that we generate a correct file. Furthermore, check the file
	 * for consistency so that we can append safely.
	 *
	 * XXX this may take a long time for large logs.
	 */
	(void) fseek(fp, 0L, SEEK_SET);

	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
		logmsg(LOG_ERR, "Short file header");
		return (1);
	}

	if (hdr.magic != TCPDUMP_MAGIC ||
	    hdr.version_major != PCAP_VERSION_MAJOR ||
	    hdr.version_minor != PCAP_VERSION_MINOR ||
	    hdr.linktype != hpcap->linktype ||
	    hdr.snaplen > PFLOGD_MAXSNAPLEN) {
		return (1);
	}

	pos = sizeof(hdr);

	while (!feof(fp)) {
		off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
		if (len == 0)
			break;

		if (len != sizeof(ph))
			goto error;
		if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
			goto error;
		pos += sizeof(ph) + ph.caplen;
		if (pos > size)
			goto error;
		fseek(fp, ph.caplen, SEEK_CUR);
	}

	if (pos != size)
		goto error;

	if (hdr.snaplen != cur_snaplen) {
		logmsg(LOG_WARNING,
		       "Existing file has different snaplen %u, using it",
		       hdr.snaplen);
		if (set_snaplen(hdr.snaplen)) {
			logmsg(LOG_WARNING,
			       "Failed, using old settings, offset %llu",
			       (unsigned long long) size);
		}
	}

	return (0);

 error:
	logmsg(LOG_ERR, "Corrupted log file.");
	return (1);
}

/* dump a packet directly to the stream, which is unbuffered */
void
dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
{
	FILE *f = (FILE *)user;

	if (suspended) {
		packets_dropped++;
		return;
	}

	if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
		off_t pos = ftello(f);

		/* try to undo header to prevent corruption */
		if (pos < sizeof(*h) ||
		    ftruncate(fileno(f), pos - sizeof(*h))) {
			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
			set_suspended(1);
			gotsig_close = 1;
			return;
		}
		goto error;
	}

	if (fwrite((char *)sp, h->caplen, 1, f) != 1)
		goto error;

	return;

error:
	set_suspended(1);
	packets_dropped ++;
	logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
}

int
flush_buffer(FILE *f)
{
	off_t offset;
	int len = bufpos - buffer;

	if (len <= 0)
		return (0);

	offset = ftello(f);
	if (offset == (off_t)-1) {
		set_suspended(1);
		logmsg(LOG_ERR, "Logging suspended: ftello: %s",
		    strerror(errno));
		return (1);
	}

	if (fwrite(buffer, len, 1, f) != 1) {
		set_suspended(1);
		logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
		    strerror(errno));
		ftruncate(fileno(f), offset);
		return (1);
	}

	set_suspended(0);
	bufpos = buffer;
	bufleft = buflen;
	bufpkt = 0;

	return (0);
}

void
purge_buffer(void)
{
	packets_dropped += bufpkt;

	set_suspended(0);
	bufpos = buffer;
	bufleft = buflen;
	bufpkt = 0;
}

/* append packet to the buffer, flushing if necessary */
void
dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
{
	FILE *f = (FILE *)user;
	size_t len = sizeof(*h) + h->caplen;

	if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
		logmsg(LOG_NOTICE, "invalid size %zu (%d/%d), packet dropped",
		       len, cur_snaplen, snaplen);
		packets_dropped++;
		return;
	}

	if (len <= bufleft)
		goto append;

	if (suspended) {
		packets_dropped++;
		return;
	}

	if (flush_buffer(f)) {
		packets_dropped++;
		return;
	}

	if (len > bufleft) {
		dump_packet_nobuf(user, h, sp);
		return;
	}

 append:
	memcpy(bufpos, h, sizeof(*h));
	memcpy(bufpos + sizeof(*h), sp, h->caplen);

	bufpos += len;
	bufleft -= len;
	bufpkt++;

	return;
}

int
main(int argc, char **argv)
{
	int ch, np, ret, Xflag = 0;
	pcap_handler phandler = dump_packet;
	const char *errstr = NULL;

	ret = 0;

	closefrom(STDERR_FILENO + 1);

	while ((ch = getopt(argc, argv, "Dxd:f:i:s:")) != -1) {
		switch (ch) {
		case 'D':
			Debug = 1;
			break;
		case 'd':
			delay = strtonum(optarg, 5, 60*60, &errstr);
			if (errstr)
				usage();
			break;
		case 'f':
			filename = optarg;
			break;
		case 'i':
			interface = optarg;
			break;
		case 's':
			snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
			    &errstr);
			if (snaplen <= 0)
				snaplen = DEF_SNAPLEN;
			if (errstr)
				snaplen = PFLOGD_MAXSNAPLEN;
			break;
		case 'x':
			Xflag = 1;
			break;
		default:
			usage();
		}

	}

	log_debug = Debug;
	argc -= optind;
	argv += optind;

	/* does interface exist */
	if (!if_exists(interface)) {
		warn("Failed to initialize: %s", interface);
		logmsg(LOG_ERR, "Failed to initialize: %s", interface);
		logmsg(LOG_ERR, "Exiting, init failure");
		exit(1);
	}

	if (!Debug) {
		openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON);
		if (daemon(0, 0)) {
			logmsg(LOG_WARNING, "Failed to become daemon: %s",
			    strerror(errno));
		}
	}

	tzset();
	(void)umask(S_IRWXG | S_IRWXO);

	/* filter will be used by the privileged process */
	if (argc) {
		filter = copy_argv(argv);
		if (filter == NULL)
			logmsg(LOG_NOTICE, "Failed to form filter expression");
	}

	/* initialize pcap before dropping privileges */
	if (init_pcap()) {
		logmsg(LOG_ERR, "Exiting, init failure");
		exit(1);
	}

	/* Privilege separation begins here */
	if (priv_init()) {
		logmsg(LOG_ERR, "unable to privsep");
		exit(1);
	}

	/*
	 * XXX needs wpath cpath rpath, for try_reset_dump() ?
	 */
	if (pledge("stdio rpath wpath cpath unix recvfd", NULL) == -1)
		err(1, "pledge");

	setproctitle("[initializing]");
	/* Process is now unprivileged and inside a chroot */
	signal(SIGTERM, sig_close);
	signal(SIGINT, sig_close);
	signal(SIGQUIT, sig_close);
	signal(SIGALRM, sig_alrm);
	signal(SIGHUP, sig_hup);
	alarm(delay);

	buffer = malloc(PFLOGD_BUFSIZE);

	if (buffer == NULL) {
		logmsg(LOG_WARNING, "Failed to allocate output buffer");
		phandler = dump_packet_nobuf;
	} else {
		bufleft = buflen = PFLOGD_BUFSIZE;
		bufpos = buffer;
		bufpkt = 0;
	}

	if (reset_dump(Xflag) < 0) {
		if (Xflag)
			return (1);

		logmsg(LOG_ERR, "Logging suspended: open error");
		set_suspended(1);
	} else if (Xflag)
		return (0);

	while (1) {
		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
		    phandler, (u_char *)dpcap);
		if (np < 0) {
			if (!if_exists(interface)) {
				logmsg(LOG_NOTICE, "interface %s went away",
				    interface);
				ret = -1;
				break;
			}
			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
		}

		if (gotsig_close)
			break;
		if (gotsig_hup) {
			if (reset_dump(0)) {
				logmsg(LOG_ERR,
				    "Logging suspended: open error");
				set_suspended(1);
			}
			gotsig_hup = 0;
		}

		if (gotsig_alrm) {
			if (dpcap)
				flush_buffer(dpcap);
			else
				gotsig_hup = 1;
			gotsig_alrm = 0;
			alarm(delay);
		}
	}

	logmsg(LOG_NOTICE, "Exiting");
	if (dpcap) {
		flush_buffer(dpcap);
		fclose(dpcap);
	}
	purge_buffer();

	pcap_close(hpcap);
	if (!Debug)
		closelog();
	return (ret);
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: pflogd.c,v 1.53 2016/01/16 03:17:48 canacar Exp $ */
2
3			/*
4			* Copyright (c) 2001 Theo de Raadt
5			* Copyright (c) 2001 Can Erkin Acar
6			* All rights reserved.
7			*
8			* Redistribution and use in source and binary forms, with or without
9			* modification, are permitted provided that the following conditions
10			* are met:
11			*
12			* - Redistributions of source code must retain the above copyright
13			* notice, this list of conditions and the following disclaimer.
14			* - Redistributions in binary form must reproduce the above
15			* copyright notice, this list of conditions and the following
16			* disclaimer in the documentation and/or other materials provided
17			* with the distribution.
18			*
19			* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20			* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21			* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22			* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23			* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24			* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25			* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26			* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27			* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28			* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29			* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30			* POSSIBILITY OF SUCH DAMAGE.
31			*/
32
33			#include <sys/types.h>
34			#include <sys/ioctl.h>
35			#include <sys/stat.h>
36			#include <sys/socket.h>
37			#include <net/if.h>
38			#include <stdio.h>
39			#include <stdlib.h>
40			#include <string.h>
41			#include <unistd.h>
42			#include <pcap-int.h>
43			#include <pcap.h>
44			#include <syslog.h>
45			#include <signal.h>
46			#include <err.h>
47			#include <errno.h>
48			#include <stdarg.h>
49			#include <fcntl.h>
50			#include <util.h>
51			#include "pflogd.h"
52
53			pcap_t *hpcap;
54			static FILE *dpcap;
55
56			int Debug = 0;
57			static int snaplen = DEF_SNAPLEN;
58			static int cur_snaplen = DEF_SNAPLEN;
59
60			volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;
61
62			char *filename = PFLOGD_LOG_FILE;
63			char *interface = PFLOGD_DEFAULT_IF;
64			char *filter = NULL;
65
66			char errbuf[PCAP_ERRBUF_SIZE];
67
68			int log_debug = 0;
69			unsigned int delay = FLUSH_DELAY;
70
71			char copy_argv(char const *);
72			void dump_packet(u_char , const struct pcap_pkthdr , const u_char *);
73			void dump_packet_nobuf(u_char , const struct pcap_pkthdr , const u_char *);
74			int flush_buffer(FILE *);
75			int if_exists(char *);
76			int init_pcap(void);
77			void logmsg(int, const char *, ...);
78			void purge_buffer(void);
79			int reset_dump(int);
80			int scan_dump(FILE *, off_t);
81			int set_snaplen(int);
82			void set_suspended(int);
83			void sig_alrm(int);
84			void sig_close(int);
85			void sig_hup(int);
86			void usage(void);
87
88			static int try_reset_dump(int);
89
90			/* buffer must always be greater than snaplen */
91			static int bufpkt = 0; /* number of packets in buffer */
92			static int buflen = 0; /* allocated size of buffer */
93			static char buffer = NULL; / packet buffer */
94			static char bufpos = NULL; / position in buffer */
95			static int bufleft = 0; /* bytes left in buffer */
96
97			/* if error, stop logging but count dropped packets */
98			static int suspended = -1;
99			static long packets_dropped = 0;
100
101			void
102			set_suspended(int s)
103			{
104			if (suspended == s)
105			return;
106
107			suspended = s;
108			setproctitle("[%s] -s %d -i %s -f %s",
109			suspended ? "suspended" : "running",
110			cur_snaplen, interface, filename);
111			}
112
113			char *
114			copy_argv(char * const *argv)
115			{
116			size_t len = 0, n;
117			char *buf;
118
119			if (argv == NULL)
120			return (NULL);
121
122			for (n = 0; argv[n]; n++)
123			len += strlen(argv[n])+1;
124			if (len == 0)
125			return (NULL);
126
127			buf = malloc(len);
128			if (buf == NULL)
129			return (NULL);
130
131			strlcpy(buf, argv[0], len);
132			for (n = 1; argv[n]; n++) {
133			strlcat(buf, " ", len);
134			strlcat(buf, argv[n], len);
135			}
136			return (buf);
137			}
138
139			void
140			logmsg(int pri, const char *message, ...)
141			{
142			va_list ap;
143			va_start(ap, message);
144
145			if (log_debug) {
146			vfprintf(stderr, message, ap);
147			fprintf(stderr, "\n");
148			} else
149			vsyslog(pri, message, ap);
150			va_end(ap);
151			}
152
153			__dead void
154			usage(void)
155			{
156			fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]");
157			fprintf(stderr, " [-i interface] [-s snaplen]\n");
158			fprintf(stderr, " [expression]\n");
159			exit(1);
160			}
161
162			void
163			sig_close(int sig)
164			{
165			gotsig_close = 1;
166			}
167
168			void
169			sig_hup(int sig)
170			{
171			gotsig_hup = 1;
172			}
173
174			void
175			sig_alrm(int sig)
176			{
177			gotsig_alrm = 1;
178			}
179
180			void
181			set_pcap_filter(void)
182			{
183			struct bpf_program bprog;
184
185			if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
186			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
187			else {
188			if (pcap_setfilter(hpcap, &bprog) < 0)
189			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
190			pcap_freecode(&bprog);
191			}
192			}
193
194			int
195			if_exists(char *ifname)
196			{
197			int s, ret = 1;
198			struct ifreq ifr;
199			struct if_data ifrdat;
200
201			if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
202			err(1, "socket");
203			bzero(&ifr, sizeof(ifr));
204			if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
205			sizeof(ifr.ifr_name))
206			errx(1, "main ifr_name: strlcpy");
207			ifr.ifr_data = (caddr_t)&ifrdat;
208			if (ioctl(s, SIOCGIFDATA, (caddr_t)&ifr) == -1)
209			ret = 0;
210			if (close(s))
211			err(1, "close");
212
213			return (ret);
214			}
215
216			int
217			init_pcap(void)
218			{
219			hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
220			if (hpcap == NULL) {
221			logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
222			return (-1);
223			}
224
225			if (pcap_datalink(hpcap) != DLT_PFLOG) {
226			logmsg(LOG_ERR, "Invalid datalink type");
227			pcap_close(hpcap);
228			hpcap = NULL;
229			return (-1);
230			}
231
232			set_pcap_filter();
233
234			cur_snaplen = snaplen = pcap_snapshot(hpcap);
235
236			/* lock */
237			if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
238			logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
239			return (-1);
240			}
241
242			return (0);
243			}
244
245			int
246			set_snaplen(int snap)
247			{
248			if (priv_set_snaplen(snap))
249			return (1);
250
251			if (cur_snaplen > snap)
252			purge_buffer();
253
254			cur_snaplen = snap;
255
256			return (0);
257			}
258
259			int
260			reset_dump(int nomove)
261			{
262			int ret;
263
264			for (;;) {
265			ret = try_reset_dump(nomove);
266			if (ret <= 0)
267			break;
268			}
269
270			return (ret);
271			}
272
273			/*
274			* tries to (re)open log file, nomove flag is used with -x switch
275			* returns 0: success, 1: retry (log moved), -1: error
276			*/
277			int
278			try_reset_dump(int nomove)
279			{
280			struct pcap_file_header hdr;
281			struct stat st;
282			int fd;
283			FILE *fp;
284
285			if (hpcap == NULL)
286			return (-1);
287
288			if (dpcap) {
289			flush_buffer(dpcap);
290			fclose(dpcap);
291			dpcap = NULL;
292			}
293
294			/*
295			* Basically reimplement pcap_dump_open() because it truncates
296			* files and duplicates headers and such.
297			*/
298			fd = priv_open_log();
299			if (fd < 0)
300			return (-1);
301
302			fp = fdopen(fd, "a+");
303
304			if (fp == NULL) {
305			logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
306			close(fd);
307			return (-1);
308			}
309			if (fstat(fileno(fp), &st) == -1) {
310			logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
311			fclose(fp);
312			return (-1);
313			}
314
315			/* set FILE unbuffered, we do our own buffering */
316			if (setvbuf(fp, NULL, _IONBF, 0)) {
317			logmsg(LOG_ERR, "Failed to set output buffers");
318			fclose(fp);
319			return (-1);
320			}
321
322			#define TCPDUMP_MAGIC 0xa1b2c3d4
323
324			if (st.st_size == 0) {
325			if (snaplen != cur_snaplen) {
326			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
327			if (set_snaplen(snaplen))
328			logmsg(LOG_WARNING,
329			"Failed, using old settings");
330			}
331			hdr.magic = TCPDUMP_MAGIC;
332			hdr.version_major = PCAP_VERSION_MAJOR;
333			hdr.version_minor = PCAP_VERSION_MINOR;
334			hdr.thiszone = hpcap->tzoff;
335			hdr.snaplen = hpcap->snapshot;
336			hdr.sigfigs = 0;
337			hdr.linktype = hpcap->linktype;
338
339			if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
340			fclose(fp);
341			return (-1);
342			}
343			} else if (scan_dump(fp, st.st_size)) {
344			fclose(fp);
345			if (nomove \|\| priv_move_log()) {
346			logmsg(LOG_ERR,
347			"Invalid/incompatible log file, move it away");
348			return (-1);
349			}
350			return (1);
351			}
352
353			dpcap = fp;
354
355			set_suspended(0);
356			flush_buffer(fp);
357
358			return (0);
359			}
360
361			int
362			scan_dump(FILE *fp, off_t size)
363			{
364			struct pcap_file_header hdr;
365			struct pcap_pkthdr ph;
366			off_t pos;
367
368			/*
369			* Must read the file, compare the header against our new
370			* options (in particular, snaplen) and adjust our options so
371			* that we generate a correct file. Furthermore, check the file
372			* for consistency so that we can append safely.
373			*
374			* XXX this may take a long time for large logs.
375			*/
376			(void) fseek(fp, 0L, SEEK_SET);
377
378			if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
379			logmsg(LOG_ERR, "Short file header");
380			return (1);
381			}
382
383			if (hdr.magic != TCPDUMP_MAGIC \|\|
384			hdr.version_major != PCAP_VERSION_MAJOR \|\|
385			hdr.version_minor != PCAP_VERSION_MINOR \|\|
386			hdr.linktype != hpcap->linktype \|\|
387			hdr.snaplen > PFLOGD_MAXSNAPLEN) {
388			return (1);
389			}
390
391			pos = sizeof(hdr);
392
393			while (!feof(fp)) {
394			off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
395			if (len == 0)
396			break;
397
398			if (len != sizeof(ph))
399			goto error;
400			if (ph.caplen > hdr.snaplen \|\| ph.caplen > PFLOGD_MAXSNAPLEN)
401			goto error;
402			pos += sizeof(ph) + ph.caplen;
403			if (pos > size)
404			goto error;
405			fseek(fp, ph.caplen, SEEK_CUR);
406			}
407
408			if (pos != size)
409			goto error;
410
411			if (hdr.snaplen != cur_snaplen) {
412			logmsg(LOG_WARNING,
413			"Existing file has different snaplen %u, using it",
414			hdr.snaplen);
415			if (set_snaplen(hdr.snaplen)) {
416			logmsg(LOG_WARNING,
417			"Failed, using old settings, offset %llu",
418			(unsigned long long) size);
419			}
420			}
421
422			return (0);
423
424			error:
425			logmsg(LOG_ERR, "Corrupted log file.");
426			return (1);
427			}
428
429			/* dump a packet directly to the stream, which is unbuffered */
430			void
431			dump_packet_nobuf(u_char user, const struct pcap_pkthdr h, const u_char *sp)
432			{
433			FILE f = (FILE )user;
434
435			if (suspended) {
436			packets_dropped++;
437			return;
438			}
439
440			if (fwrite((char )h, sizeof(h), 1, f) != 1) {
441			off_t pos = ftello(f);
442
443			/* try to undo header to prevent corruption */
444			if (pos < sizeof(*h) \|\|
445			ftruncate(fileno(f), pos - sizeof(*h))) {
446			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
447			set_suspended(1);
448			gotsig_close = 1;
449			return;
450			}
451			goto error;
452			}
453
454			if (fwrite((char *)sp, h->caplen, 1, f) != 1)
455			goto error;
456
457			return;
458
459			error:
460			set_suspended(1);
461			packets_dropped ++;
462			logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
463			}
464
465			int
466			flush_buffer(FILE *f)
467			{
468			off_t offset;
469			int len = bufpos - buffer;
470
471			if (len <= 0)
472			return (0);
473
474			offset = ftello(f);
475			if (offset == (off_t)-1) {
476			set_suspended(1);
477			logmsg(LOG_ERR, "Logging suspended: ftello: %s",
478			strerror(errno));
479			return (1);
480			}
481
482			if (fwrite(buffer, len, 1, f) != 1) {
483			set_suspended(1);
484			logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
485			strerror(errno));
486			ftruncate(fileno(f), offset);
487			return (1);
488			}
489
490			set_suspended(0);
491			bufpos = buffer;
492			bufleft = buflen;
493			bufpkt = 0;
494
495			return (0);
496			}
497
498			void
499			purge_buffer(void)
500			{
501			packets_dropped += bufpkt;
502
503			set_suspended(0);
504			bufpos = buffer;
505			bufleft = buflen;
506			bufpkt = 0;
507			}
508
509			/* append packet to the buffer, flushing if necessary */
510			void
511			dump_packet(u_char user, const struct pcap_pkthdr h, const u_char *sp)
512			{
513			FILE f = (FILE )user;
514			size_t len = sizeof(*h) + h->caplen;
515
516			if (len < sizeof(*h) \|\| h->caplen > (size_t)cur_snaplen) {
517			logmsg(LOG_NOTICE, "invalid size %zu (%d/%d), packet dropped",
518			len, cur_snaplen, snaplen);
519			packets_dropped++;
520			return;
521			}
522
523			if (len <= bufleft)
524			goto append;
525
526			if (suspended) {
527			packets_dropped++;
528			return;
529			}
530
531			if (flush_buffer(f)) {
532			packets_dropped++;
533			return;
534			}
535
536			if (len > bufleft) {
537			dump_packet_nobuf(user, h, sp);
538			return;
539			}
540
541			append:
542			memcpy(bufpos, h, sizeof(*h));
543			memcpy(bufpos + sizeof(*h), sp, h->caplen);
544
545			bufpos += len;
546			bufleft -= len;
547			bufpkt++;
548
549			return;
550			}
551
552			int
553			main(int argc, char **argv)
554			{
555			int ch, np, ret, Xflag = 0;
556			pcap_handler phandler = dump_packet;
557			const char *errstr = NULL;
558
559			ret = 0;
560
561			closefrom(STDERR_FILENO + 1);
562
563			while ((ch = getopt(argc, argv, "Dxd:f:i:s:")) != -1) {
564			switch (ch) {
565			case 'D':
566			Debug = 1;
567			break;
568			case 'd':
569			delay = strtonum(optarg, 5, 60*60, &errstr);
570			if (errstr)
571			usage();
572			break;
573			case 'f':
574			filename = optarg;
575			break;
576			case 'i':
577			interface = optarg;
578			break;
579			case 's':
580			snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
581			&errstr);
582			if (snaplen <= 0)
583			snaplen = DEF_SNAPLEN;
584			if (errstr)
585			snaplen = PFLOGD_MAXSNAPLEN;
586			break;
587			case 'x':
588			Xflag = 1;
589			break;
590			default:
591			usage();
592			}
593
594			}
595
596			log_debug = Debug;
597			argc -= optind;
598			argv += optind;
599
600			/* does interface exist */
601			if (!if_exists(interface)) {
602			warn("Failed to initialize: %s", interface);
603			logmsg(LOG_ERR, "Failed to initialize: %s", interface);
604			logmsg(LOG_ERR, "Exiting, init failure");
605			exit(1);
606			}
607
608			if (!Debug) {
609			openlog("pflogd", LOG_PID \| LOG_CONS, LOG_DAEMON);
610			if (daemon(0, 0)) {
611			logmsg(LOG_WARNING, "Failed to become daemon: %s",
612			strerror(errno));
613			}
614			}
615
616			tzset();
617			(void)umask(S_IRWXG \| S_IRWXO);
618
619			/* filter will be used by the privileged process */
620			if (argc) {
621			filter = copy_argv(argv);
622			if (filter == NULL)
623			logmsg(LOG_NOTICE, "Failed to form filter expression");
624			}
625
626			/* initialize pcap before dropping privileges */
627			if (init_pcap()) {
628			logmsg(LOG_ERR, "Exiting, init failure");
629			exit(1);
630			}
631
632			/* Privilege separation begins here */
633			if (priv_init()) {
634			logmsg(LOG_ERR, "unable to privsep");
635			exit(1);
636			}
637
638			/*
639			* XXX needs wpath cpath rpath, for try_reset_dump() ?
640			*/
641			if (pledge("stdio rpath wpath cpath unix recvfd", NULL) == -1)
642			err(1, "pledge");
643
644			setproctitle("[initializing]");
645			/* Process is now unprivileged and inside a chroot */
646			signal(SIGTERM, sig_close);
647			signal(SIGINT, sig_close);
648			signal(SIGQUIT, sig_close);
649			signal(SIGALRM, sig_alrm);
650			signal(SIGHUP, sig_hup);
651			alarm(delay);
652
653			buffer = malloc(PFLOGD_BUFSIZE);
654
655			if (buffer == NULL) {
656			logmsg(LOG_WARNING, "Failed to allocate output buffer");
657			phandler = dump_packet_nobuf;
658			} else {
659			bufleft = buflen = PFLOGD_BUFSIZE;
660			bufpos = buffer;
661			bufpkt = 0;
662			}
663
664			if (reset_dump(Xflag) < 0) {
665			if (Xflag)
666			return (1);
667
668			logmsg(LOG_ERR, "Logging suspended: open error");
669			set_suspended(1);
670			} else if (Xflag)
671			return (0);
672
673			while (1) {
674			np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
675			phandler, (u_char *)dpcap);
676			if (np < 0) {
677			if (!if_exists(interface)) {
678			logmsg(LOG_NOTICE, "interface %s went away",
679			interface);
680			ret = -1;
681			break;
682			}
683			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
684			}
685
686			if (gotsig_close)
687			break;
688			if (gotsig_hup) {
689			if (reset_dump(0)) {
690			logmsg(LOG_ERR,
691			"Logging suspended: open error");
692			set_suspended(1);
693			}
694			gotsig_hup = 0;
695			}
696
697			if (gotsig_alrm) {
698			if (dpcap)
699			flush_buffer(dpcap);
700			else
701			gotsig_hup = 1;
702			gotsig_alrm = 0;
703			alarm(delay);
704			}
705			}
706
707			logmsg(LOG_NOTICE, "Exiting");
708			if (dpcap) {
709			flush_buffer(dpcap);
710			fclose(dpcap);
711			}
712			purge_buffer();
713
714			pcap_close(hpcap);
715			if (!Debug)
716			closelog();
717			return (ret);
718			}