1/* $OpenBSD: pflogd.c,v 1.27 2004/02/13 19:01:57 otto Exp $ */
2
3/*
4 * Copyright (c) 2001 Theo de Raadt
5 * Copyright (c) 2001 Can Erkin Acar
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without

--- 17 unchanged lines hidden (view full) ---

26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33#include <sys/cdefs.h>
34__FBSDID("$FreeBSD: head/contrib/pf/pflogd/pflogd.c 130617 2004-06-16 23:39:33Z mlaier $");
35
36#include <sys/types.h>
37#include <sys/ioctl.h>
38#include <sys/file.h>
39#include <sys/stat.h>
40#include <stdio.h>
41#include <stdlib.h>
42#include <string.h>

--- 277 unchanged lines hidden (view full) ---

320
321 return (0);
322}
323
324int
325scan_dump(FILE *fp, off_t size)
326{
327 struct pcap_file_header hdr;
328 struct pcap_pkthdr ph;
329 off_t pos;
330
331 /*
332 * Must read the file, compare the header against our new
333 * options (in particular, snaplen) and adjust our options so
334 * that we generate a correct file. Furthermore, check the file
335 * for consistency so that we can append safely.
336 *

--- 53 unchanged lines hidden (view full) ---

390 return (1);
391}
392
393/* dump a packet directly to the stream, which is unbuffered */
394void
395dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
396{
397 FILE *f = (FILE *)user;
398
399 if (suspended) {
400 packets_dropped++;
401 return;
402 }
403
404 if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
405 /* try to undo header to prevent corruption */
406 off_t pos = ftello(f);
407 if (pos < sizeof(*h) ||
408 ftruncate(fileno(f), pos - sizeof(*h))) {
409 logmsg(LOG_ERR, "Write failed, corrupted logfile!");
410 set_suspended(1);
411 gotsig_close = 1;
412 return;
413 }
414 goto error;
415 }
416

--- 52 unchanged lines hidden (view full) ---

469 bufpkt = 0;
470}
471
472/* append packet to the buffer, flushing if necessary */
473void
474dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
475{
476 FILE *f = (FILE *)user;
477 size_t len = sizeof(*h) + h->caplen;
478
479 if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
480 logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
481 len, cur_snaplen, snaplen);
482 packets_dropped++;
483 return;
484 }
485

--- 11 unchanged lines hidden (view full) ---

497 }
498
499 if (len > bufleft) {
500 dump_packet_nobuf(user, h, sp);
501 return;
502 }
503
504 append:
505 memcpy(bufpos, h, sizeof(*h));
506 memcpy(bufpos + sizeof(*h), sp, h->caplen);
507
508 bufpos += len;
509 bufleft -= len;
510 bufpkt++;
511
512 return;
513}
514

--- 149 unchanged lines hidden ---