pflogd.c revision 210878 
1/*	$OpenBSD: pflogd.c,v 1.37 2006/10/26 13:34:47 jmc Exp $	*/
2
3/*
4 * Copyright (c) 2001 Theo de Raadt
5 * Copyright (c) 2001 Can Erkin Acar
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 *    - Redistributions of source code must retain the above copyright
13 *      notice, this list of conditions and the following disclaimer.
14 *    - Redistributions in binary form must reproduce the above
15 *      copyright notice, this list of conditions and the following
16 *      disclaimer in the documentation and/or other materials provided
17 *      with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33#include <sys/cdefs.h>
34__FBSDID("$FreeBSD: head/contrib/pf/pflogd/pflogd.c 210878 2010-08-05 18:49:06Z csjp $");
35
36#include <sys/types.h>
37#include <sys/ioctl.h>
38#include <sys/file.h>
39#include <sys/stat.h>
40#ifdef __FreeBSD__
41#include <net/bpf.h>	/* BIOCLOCK */
42#endif
43#include <stdio.h>
44#include <stdlib.h>
45#include <string.h>
46#include <unistd.h>
47#include <pcap-int.h>
48#include <pcap.h>
49#include <syslog.h>
50#include <signal.h>
51#include <errno.h>
52#include <stdarg.h>
53#include <fcntl.h>
54#ifdef __FreeBSD__
55#include "pidfile.h"
56#else
57#include <util.h>
58#endif
59
60#include "pflogd.h"
61
62pcap_t *hpcap;
63static FILE *dpcap;
64
65int Debug = 0;
66static int snaplen = DEF_SNAPLEN;
67static int cur_snaplen = DEF_SNAPLEN;
68
69volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;
70
71char *filename = PFLOGD_LOG_FILE;
72char *interface = PFLOGD_DEFAULT_IF;
73char *filter = NULL;
74
75char errbuf[PCAP_ERRBUF_SIZE];
76
77int log_debug = 0;
78unsigned int delay = FLUSH_DELAY;
79
80char *copy_argv(char * const *);
81void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
82void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
83int   flush_buffer(FILE *);
84int   init_pcap(void);
85void  logmsg(int, const char *, ...);
86void  purge_buffer(void);
87int   reset_dump(int);
88int   scan_dump(FILE *, off_t);
89int   set_snaplen(int);
90void  set_suspended(int);
91void  sig_alrm(int);
92void  sig_close(int);
93void  sig_hup(int);
94void  usage(void);
95
96static int try_reset_dump(int);
97
98/* buffer must always be greater than snaplen */
99static int    bufpkt = 0;	/* number of packets in buffer */
100static int    buflen = 0;	/* allocated size of buffer */
101static char  *buffer = NULL;	/* packet buffer */
102static char  *bufpos = NULL;	/* position in buffer */
103static int    bufleft = 0;	/* bytes left in buffer */
104
105/* if error, stop logging but count dropped packets */
106static int suspended = -1;
107static long packets_dropped = 0;
108
109void
110set_suspended(int s)
111{
112	if (suspended == s)
113		return;
114
115	suspended = s;
116	setproctitle("[%s] -s %d -i %s -f %s",
117	    suspended ? "suspended" : "running",
118	    cur_snaplen, interface, filename);
119}
120
121char *
122copy_argv(char * const *argv)
123{
124	size_t len = 0, n;
125	char *buf;
126
127	if (argv == NULL)
128		return (NULL);
129
130	for (n = 0; argv[n]; n++)
131		len += strlen(argv[n])+1;
132	if (len == 0)
133		return (NULL);
134
135	buf = malloc(len);
136	if (buf == NULL)
137		return (NULL);
138
139	strlcpy(buf, argv[0], len);
140	for (n = 1; argv[n]; n++) {
141		strlcat(buf, " ", len);
142		strlcat(buf, argv[n], len);
143	}
144	return (buf);
145}
146
147void
148logmsg(int pri, const char *message, ...)
149{
150	va_list ap;
151	va_start(ap, message);
152
153	if (log_debug) {
154		vfprintf(stderr, message, ap);
155		fprintf(stderr, "\n");
156	} else
157		vsyslog(pri, message, ap);
158	va_end(ap);
159}
160
161#ifdef __FreeBSD__
162__dead2 void
163#else
164__dead void
165#endif
166usage(void)
167{
168	fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]");
169	fprintf(stderr, " [-i interface] [-s snaplen]\n");
170	fprintf(stderr, "              [expression]\n");
171	exit(1);
172}
173
174void
175sig_close(int sig)
176{
177	gotsig_close = 1;
178}
179
180void
181sig_hup(int sig)
182{
183	gotsig_hup = 1;
184}
185
186void
187sig_alrm(int sig)
188{
189	gotsig_alrm = 1;
190}
191
192void
193set_pcap_filter(void)
194{
195	struct bpf_program bprog;
196
197	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
198		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
199	else {
200		if (pcap_setfilter(hpcap, &bprog) < 0)
201			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
202		pcap_freecode(&bprog);
203	}
204}
205
206int
207init_pcap(void)
208{
209	hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
210	if (hpcap == NULL) {
211		logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
212		return (-1);
213	}
214
215	if (pcap_datalink(hpcap) != DLT_PFLOG) {
216		logmsg(LOG_ERR, "Invalid datalink type");
217		pcap_close(hpcap);
218		hpcap = NULL;
219		return (-1);
220	}
221
222	set_pcap_filter();
223
224	cur_snaplen = snaplen = pcap_snapshot(hpcap);
225
226	/* lock */
227	if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
228		logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
229		return (-1);
230	}
231
232	return (0);
233}
234
235int
236set_snaplen(int snap)
237{
238	if (priv_set_snaplen(snap))
239		return (1);
240
241	if (cur_snaplen > snap)
242		purge_buffer();
243
244	cur_snaplen = snap;
245
246	return (0);
247}
248
249int
250reset_dump(int nomove)
251{
252	int ret;
253
254	for (;;) {
255		ret = try_reset_dump(nomove);
256		if (ret <= 0)
257			break;
258	}
259
260	return (ret);
261}
262
263/*
264 * tries to (re)open log file, nomove flag is used with -x switch
265 * returns 0: success, 1: retry (log moved), -1: error
266 */
267int
268try_reset_dump(int nomove)
269{
270	struct pcap_file_header hdr;
271	struct stat st;
272	int fd;
273	FILE *fp;
274
275	if (hpcap == NULL)
276		return (-1);
277
278	if (dpcap) {
279		flush_buffer(dpcap);
280		fclose(dpcap);
281		dpcap = NULL;
282	}
283
284	/*
285	 * Basically reimplement pcap_dump_open() because it truncates
286	 * files and duplicates headers and such.
287	 */
288	fd = priv_open_log();
289	if (fd < 0)
290		return (-1);
291
292	fp = fdopen(fd, "a+");
293
294	if (fp == NULL) {
295		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
296		close(fd);
297		return (-1);
298	}
299	if (fstat(fileno(fp), &st) == -1) {
300		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
301		fclose(fp);
302		return (-1);
303	}
304
305	/* set FILE unbuffered, we do our own buffering */
306	if (setvbuf(fp, NULL, _IONBF, 0)) {
307		logmsg(LOG_ERR, "Failed to set output buffers");
308		fclose(fp);
309		return (-1);
310	}
311
312#define TCPDUMP_MAGIC 0xa1b2c3d4
313
314	if (st.st_size == 0) {
315		if (snaplen != cur_snaplen) {
316			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
317			if (set_snaplen(snaplen))
318				logmsg(LOG_WARNING,
319				    "Failed, using old settings");
320		}
321		hdr.magic = TCPDUMP_MAGIC;
322		hdr.version_major = PCAP_VERSION_MAJOR;
323		hdr.version_minor = PCAP_VERSION_MINOR;
324		hdr.thiszone = hpcap->tzoff;
325		hdr.snaplen = hpcap->snapshot;
326		hdr.sigfigs = 0;
327		hdr.linktype = hpcap->linktype;
328
329		if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
330			fclose(fp);
331			return (-1);
332		}
333	} else if (scan_dump(fp, st.st_size)) {
334		fclose(fp);
335		if (nomove || priv_move_log()) {
336			logmsg(LOG_ERR,
337			    "Invalid/incompatible log file, move it away");
338			return (-1);
339		}
340		return (1);
341	}
342
343	dpcap = fp;
344
345	set_suspended(0);
346	flush_buffer(fp);
347
348	return (0);
349}
350
351int
352scan_dump(FILE *fp, off_t size)
353{
354	struct pcap_file_header hdr;
355#ifdef __FreeBSD__
356	struct pcap_sf_pkthdr ph;
357#else
358	struct pcap_pkthdr ph;
359#endif
360	off_t pos;
361
362	/*
363	 * Must read the file, compare the header against our new
364	 * options (in particular, snaplen) and adjust our options so
365	 * that we generate a correct file. Furthermore, check the file
366	 * for consistency so that we can append safely.
367	 *
368	 * XXX this may take a long time for large logs.
369	 */
370	(void) fseek(fp, 0L, SEEK_SET);
371
372	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
373		logmsg(LOG_ERR, "Short file header");
374		return (1);
375	}
376
377	if (hdr.magic != TCPDUMP_MAGIC ||
378	    hdr.version_major != PCAP_VERSION_MAJOR ||
379	    hdr.version_minor != PCAP_VERSION_MINOR ||
380	    hdr.linktype != hpcap->linktype ||
381	    hdr.snaplen > PFLOGD_MAXSNAPLEN) {
382		return (1);
383	}
384
385	pos = sizeof(hdr);
386
387	while (!feof(fp)) {
388		off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
389		if (len == 0)
390			break;
391
392		if (len != sizeof(ph))
393			goto error;
394		if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
395			goto error;
396		pos += sizeof(ph) + ph.caplen;
397		if (pos > size)
398			goto error;
399		fseek(fp, ph.caplen, SEEK_CUR);
400	}
401
402	if (pos != size)
403		goto error;
404
405	if (hdr.snaplen != cur_snaplen) {
406		logmsg(LOG_WARNING,
407		       "Existing file has different snaplen %u, using it",
408		       hdr.snaplen);
409		if (set_snaplen(hdr.snaplen)) {
410			logmsg(LOG_WARNING,
411			       "Failed, using old settings, offset %llu",
412			       (unsigned long long) size);
413		}
414	}
415
416	return (0);
417
418 error:
419	logmsg(LOG_ERR, "Corrupted log file.");
420	return (1);
421}
422
423/* dump a packet directly to the stream, which is unbuffered */
424void
425dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
426{
427	FILE *f = (FILE *)user;
428#ifdef __FreeBSD__
429	struct pcap_sf_pkthdr sh;
430#endif
431
432	if (suspended) {
433		packets_dropped++;
434		return;
435	}
436
437#ifdef __FreeBSD__
438	sh.ts.tv_sec = (bpf_int32)h->ts.tv_sec;
439	sh.ts.tv_usec = (bpf_int32)h->ts.tv_usec;
440	sh.caplen = h->caplen;
441	sh.len = h->len;
442
443	if (fwrite((char *)&sh, sizeof(sh), 1, f) != 1) {
444#else
445	if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
446#endif
447		off_t pos = ftello(f);
448
449		/* try to undo header to prevent corruption */
450#ifdef __FreeBSD__
451		if (pos < sizeof(sh) ||
452		    ftruncate(fileno(f), pos - sizeof(sh))) {
453#else
454		if (pos < sizeof(*h) ||
455		    ftruncate(fileno(f), pos - sizeof(*h))) {
456#endif
457			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
458			set_suspended(1);
459			gotsig_close = 1;
460			return;
461		}
462		goto error;
463	}
464
465	if (fwrite((char *)sp, h->caplen, 1, f) != 1)
466		goto error;
467
468	return;
469
470error:
471	set_suspended(1);
472	packets_dropped ++;
473	logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
474}
475
476int
477flush_buffer(FILE *f)
478{
479	off_t offset;
480	int len = bufpos - buffer;
481
482	if (len <= 0)
483		return (0);
484
485	offset = ftello(f);
486	if (offset == (off_t)-1) {
487		set_suspended(1);
488		logmsg(LOG_ERR, "Logging suspended: ftello: %s",
489		    strerror(errno));
490		return (1);
491	}
492
493	if (fwrite(buffer, len, 1, f) != 1) {
494		set_suspended(1);
495		logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
496		    strerror(errno));
497		ftruncate(fileno(f), offset);
498		return (1);
499	}
500
501	set_suspended(0);
502	bufpos = buffer;
503	bufleft = buflen;
504	bufpkt = 0;
505
506	return (0);
507}
508
509void
510purge_buffer(void)
511{
512	packets_dropped += bufpkt;
513
514	set_suspended(0);
515	bufpos = buffer;
516	bufleft = buflen;
517	bufpkt = 0;
518}
519
520/* append packet to the buffer, flushing if necessary */
521void
522dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
523{
524	FILE *f = (FILE *)user;
525#ifdef __FreeBSD__
526	struct pcap_sf_pkthdr sh;
527	size_t len = sizeof(sh) + h->caplen;
528#else
529	size_t len = sizeof(*h) + h->caplen;
530#endif
531
532	if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
533		logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
534		       len, cur_snaplen, snaplen);
535		packets_dropped++;
536		return;
537	}
538
539	if (len <= bufleft)
540		goto append;
541
542	if (suspended) {
543		packets_dropped++;
544		return;
545	}
546
547	if (flush_buffer(f)) {
548		packets_dropped++;
549		return;
550	}
551
552	if (len > bufleft) {
553		dump_packet_nobuf(user, h, sp);
554		return;
555	}
556
557 append:
558#ifdef __FreeBSD__
559 	sh.ts.tv_sec = (bpf_int32)h->ts.tv_sec;
560 	sh.ts.tv_usec = (bpf_int32)h->ts.tv_usec;
561	sh.caplen = h->caplen;
562	sh.len = h->len;
563
564	memcpy(bufpos, &sh, sizeof(sh));
565	memcpy(bufpos + sizeof(sh), sp, h->caplen);
566#else
567	memcpy(bufpos, h, sizeof(*h));
568	memcpy(bufpos + sizeof(*h), sp, h->caplen);
569#endif
570
571	bufpos += len;
572	bufleft -= len;
573	bufpkt++;
574
575	return;
576}
577
578int
579main(int argc, char **argv)
580{
581	struct pcap_stat pstat;
582	int ch, np, Xflag = 0;
583	pcap_handler phandler = dump_packet;
584	const char *errstr = NULL;
585
586	closefrom(STDERR_FILENO + 1);
587
588	while ((ch = getopt(argc, argv, "Dxd:f:i:s:")) != -1) {
589		switch (ch) {
590		case 'D':
591			Debug = 1;
592			break;
593		case 'd':
594			delay = strtonum(optarg, 5, 60*60, &errstr);
595			if (errstr)
596				usage();
597			break;
598		case 'f':
599			filename = optarg;
600			break;
601		case 'i':
602			interface = optarg;
603			break;
604		case 's':
605			snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
606			    &errstr);
607			if (snaplen <= 0)
608				snaplen = DEF_SNAPLEN;
609			if (errstr)
610				snaplen = PFLOGD_MAXSNAPLEN;
611			break;
612		case 'x':
613			Xflag++;
614			break;
615		default:
616			usage();
617		}
618
619	}
620
621	log_debug = Debug;
622	argc -= optind;
623	argv += optind;
624
625	if (!Debug) {
626		openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON);
627		if (daemon(0, 0)) {
628			logmsg(LOG_WARNING, "Failed to become daemon: %s",
629			    strerror(errno));
630		}
631		pidfile(NULL);
632	}
633
634	tzset();
635	(void)umask(S_IRWXG | S_IRWXO);
636
637	/* filter will be used by the privileged process */
638	if (argc) {
639		filter = copy_argv(argv);
640		if (filter == NULL)
641			logmsg(LOG_NOTICE, "Failed to form filter expression");
642	}
643
644	/* initialize pcap before dropping privileges */
645	if (init_pcap()) {
646		logmsg(LOG_ERR, "Exiting, init failure");
647		exit(1);
648	}
649
650	/* Privilege separation begins here */
651	if (priv_init()) {
652		logmsg(LOG_ERR, "unable to privsep");
653		exit(1);
654	}
655
656	setproctitle("[initializing]");
657	/* Process is now unprivileged and inside a chroot */
658	signal(SIGTERM, sig_close);
659	signal(SIGINT, sig_close);
660	signal(SIGQUIT, sig_close);
661	signal(SIGALRM, sig_alrm);
662	signal(SIGHUP, sig_hup);
663	alarm(delay);
664
665	buffer = malloc(PFLOGD_BUFSIZE);
666
667	if (buffer == NULL) {
668		logmsg(LOG_WARNING, "Failed to allocate output buffer");
669		phandler = dump_packet_nobuf;
670	} else {
671		bufleft = buflen = PFLOGD_BUFSIZE;
672		bufpos = buffer;
673		bufpkt = 0;
674	}
675
676	if (reset_dump(Xflag) < 0) {
677		if (Xflag)
678			return (1);
679
680		logmsg(LOG_ERR, "Logging suspended: open error");
681		set_suspended(1);
682	} else if (Xflag)
683		return (0);
684
685	while (1) {
686		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
687		    phandler, (u_char *)dpcap);
688		if (np < 0) {
689#ifdef __FreeBSD__
690			if (errno == ENXIO) {
691				logmsg(LOG_ERR,
692				    "Device not/no longer configured");
693				break;
694			}
695#endif
696			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
697		}
698
699		if (gotsig_close)
700			break;
701		if (gotsig_hup) {
702			if (reset_dump(0)) {
703				logmsg(LOG_ERR,
704				    "Logging suspended: open error");
705				set_suspended(1);
706			}
707			gotsig_hup = 0;
708		}
709
710		if (gotsig_alrm) {
711			if (dpcap)
712				flush_buffer(dpcap);
713			else
714				gotsig_hup = 1;
715			gotsig_alrm = 0;
716			alarm(delay);
717		}
718	}
719
720	logmsg(LOG_NOTICE, "Exiting");
721	if (dpcap) {
722		flush_buffer(dpcap);
723		fclose(dpcap);
724	}
725	purge_buffer();
726
727	if (pcap_stats(hpcap, &pstat) < 0)
728		logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap));
729	else
730		logmsg(LOG_NOTICE,
731		    "%u packets received, %u/%u dropped (kernel/pflogd)",
732		    pstat.ps_recv, pstat.ps_drop, packets_dropped);
733
734	pcap_close(hpcap);
735	if (!Debug)
736		closelog();
737	return (0);
738}
739