1 /* $OpenBSD: pflogd.c,v 1.45 2007/06/06 14:11:26 henning Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Theo de Raadt 5 * Copyright (c) 2001 Can Erkin Acar 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/ioctl.h> 35 #include <sys/file.h> 36 #include <sys/stat.h> 37 #include <sys/socket.h> 38 #include <net/if.h> 39 40 #include <errno.h> 41 #include <err.h> 42 #include <fcntl.h> 43 #include <syslog.h> 44 #include <signal.h> 45 #include <stdarg.h> 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <string.h> 49 #include <unistd.h> 50 51 #include <libutil.h> 52 #include <pcap-int.h> 53 #include <pcap.h> 54 55 #include "pflogd.h" 56 57 pcap_t *hpcap; 58 static FILE *dpcap; 59 60 int Debug = 0; 61 static int snaplen = DEF_SNAPLEN; 62 static int cur_snaplen = DEF_SNAPLEN; 63 64 volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup, gotsig_usr1; 65 66 const char *filename = PFLOGD_LOG_FILE; 67 const char *interface = PFLOGD_DEFAULT_IF; 68 char *filter = NULL; 69 70 char errbuf[PCAP_ERRBUF_SIZE]; 71 72 int log_debug = 0; 73 unsigned int delay = FLUSH_DELAY; 74 75 char *copy_argv(char * const *); 76 void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 77 void dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *); 78 void log_pcap_stats(void); 79 int flush_buffer(FILE *); 80 int if_exists(char *); 81 int init_pcap(void); 82 void purge_buffer(void); 83 int reset_dump(int); 84 int scan_dump(FILE *, off_t); 85 int set_snaplen(int); 86 void set_suspended(int); 87 void sig_alrm(int); 88 void sig_usr1(int); 89 void sig_close(int); 90 void sig_hup(int); 91 void usage(void) __dead2; 92 93 static int try_reset_dump(int); 94 95 /* buffer must always be greater than snaplen */ 96 static int bufpkt = 0; /* number of packets in buffer */ 97 static size_t buflen = 0; /* allocated size of buffer */ 98 static char *buffer = NULL; /* packet buffer */ 99 static char *bufpos = NULL; /* position in buffer */ 100 static size_t bufleft = 0; /* bytes left in buffer */ 101 102 /* if error, stop logging but count dropped packets */ 103 static int suspended = -1; 104 static long packets_dropped = 0; 105 106 void 107 set_suspended(int s) 108 { 109 if (suspended == s) 110 return; 111 112 suspended = s; 113 setproctitle("[%s] -s %d -i %s -f %s", 114 suspended ? "suspended" : "running", 115 cur_snaplen, interface, filename); 116 } 117 118 char * 119 copy_argv(char * const *argv) 120 { 121 size_t len = 0, n; 122 char *buf; 123 124 if (argv == NULL) 125 return (NULL); 126 127 for (n = 0; argv[n]; n++) 128 len += strlen(argv[n])+1; 129 if (len == 0) 130 return (NULL); 131 132 buf = malloc(len); 133 if (buf == NULL) 134 return (NULL); 135 136 strlcpy(buf, argv[0], len); 137 for (n = 1; argv[n]; n++) { 138 strlcat(buf, " ", len); 139 strlcat(buf, argv[n], len); 140 } 141 return (buf); 142 } 143 144 void 145 logmsg(int pri, const char *message, ...) 146 { 147 va_list ap; 148 va_start(ap, message); 149 150 if (log_debug) { 151 vfprintf(stderr, message, ap); 152 fprintf(stderr, "\n"); 153 } else 154 vsyslog(pri, message, ap); 155 va_end(ap); 156 } 157 158 void 159 usage(void) 160 { 161 fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]"); 162 fprintf(stderr, " [-i interface] [-p pidfile]\n"); 163 fprintf(stderr, " [-s snaplen] [expression]\n"); 164 exit(1); 165 } 166 167 void 168 sig_close(int sig __unused) 169 { 170 gotsig_close = 1; 171 } 172 173 void 174 sig_hup(int sig __unused) 175 { 176 gotsig_hup = 1; 177 } 178 179 void 180 sig_alrm(int sig __unused) 181 { 182 gotsig_alrm = 1; 183 } 184 185 void 186 sig_usr1(int sig __unused) 187 { 188 gotsig_usr1 = 1; 189 } 190 191 void 192 set_pcap_filter(void) 193 { 194 struct bpf_program bprog; 195 196 if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0) 197 logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap)); 198 else { 199 if (pcap_setfilter(hpcap, &bprog) < 0) 200 logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap)); 201 pcap_freecode(&bprog); 202 } 203 } 204 205 int 206 if_exists(char *ifname) 207 { 208 int s; 209 struct ifreq ifr; 210 struct if_data ifrdat; 211 212 if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 213 err(1, "socket"); 214 bzero(&ifr, sizeof(ifr)); 215 if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >= 216 sizeof(ifr.ifr_name)) 217 errx(1, "main ifr_name: strlcpy"); 218 ifr.ifr_data = (caddr_t)&ifrdat; 219 if (ioctl(s, SIOCGIFDATA, (caddr_t)&ifr) == -1) 220 return (0); 221 if (close(s)) 222 err(1, "close"); 223 224 return (1); 225 } 226 227 int 228 init_pcap(void) 229 { 230 hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf); 231 if (hpcap == NULL) { 232 logmsg(LOG_ERR, "Failed to initialize: %s", errbuf); 233 return (-1); 234 } 235 236 if (pcap_datalink(hpcap) != DLT_PFLOG) { 237 logmsg(LOG_ERR, "Invalid datalink type"); 238 pcap_close(hpcap); 239 hpcap = NULL; 240 return (-1); 241 } 242 243 set_pcap_filter(); 244 245 cur_snaplen = snaplen = pcap_snapshot(hpcap); 246 247 /* From contrib/pf/pflogd.c 1.5 FreeBSD: BPF locking is not 248 * (yet) supported. 249 */ 250 #ifndef __DragonFly__ 251 /* lock */ 252 if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) { 253 logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno)); 254 return (-1); 255 } 256 #endif 257 258 return (0); 259 } 260 261 int 262 set_snaplen(int snap) 263 { 264 if (priv_set_snaplen(snap)) 265 return (1); 266 267 if (cur_snaplen > snap) 268 purge_buffer(); 269 270 cur_snaplen = snap; 271 272 return (0); 273 } 274 275 int 276 reset_dump(int nomove) 277 { 278 int ret; 279 280 for (;;) { 281 ret = try_reset_dump(nomove); 282 if (ret <= 0) 283 break; 284 } 285 286 return (ret); 287 } 288 289 /* 290 * tries to (re)open log file, nomove flag is used with -x switch 291 * returns 0: success, 1: retry (log moved), -1: error 292 */ 293 int 294 try_reset_dump(int nomove) 295 { 296 struct pcap_file_header hdr; 297 struct stat st; 298 int fd; 299 FILE *fp; 300 301 if (hpcap == NULL) 302 return (-1); 303 304 if (dpcap) { 305 flush_buffer(dpcap); 306 fclose(dpcap); 307 dpcap = NULL; 308 } 309 310 /* 311 * Basically reimplement pcap_dump_open() because it truncates 312 * files and duplicates headers and such. 313 */ 314 fd = priv_open_log(); 315 if (fd < 0) 316 return (-1); 317 318 fp = fdopen(fd, "a+"); 319 320 if (fp == NULL) { 321 logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno)); 322 close(fd); 323 return (-1); 324 } 325 if (fstat(fileno(fp), &st) == -1) { 326 logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno)); 327 fclose(fp); 328 return (-1); 329 } 330 331 /* set FILE unbuffered, we do our own buffering */ 332 if (setvbuf(fp, NULL, _IONBF, 0)) { 333 logmsg(LOG_ERR, "Failed to set output buffers"); 334 fclose(fp); 335 return (-1); 336 } 337 338 #define TCPDUMP_MAGIC 0xa1b2c3d4 339 340 if (st.st_size == 0) { 341 if (snaplen != cur_snaplen) { 342 logmsg(LOG_NOTICE, "Using snaplen %d", snaplen); 343 if (set_snaplen(snaplen)) 344 logmsg(LOG_WARNING, 345 "Failed, using old settings"); 346 } 347 hdr.magic = TCPDUMP_MAGIC; 348 hdr.version_major = PCAP_VERSION_MAJOR; 349 hdr.version_minor = PCAP_VERSION_MINOR; 350 /* https://www.tcpdump.org/manpages/pcap-savefile.5.txt */ 351 hdr.thiszone = 0; 352 hdr.snaplen = hpcap->snapshot; 353 hdr.sigfigs = 0; 354 hdr.linktype = hpcap->linktype; 355 356 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) { 357 fclose(fp); 358 return (-1); 359 } 360 } else if (scan_dump(fp, st.st_size)) { 361 fclose(fp); 362 if (nomove || priv_move_log()) { 363 logmsg(LOG_ERR, 364 "Invalid/incompatible log file, move it away"); 365 return (-1); 366 } 367 return (1); 368 } 369 370 dpcap = fp; 371 372 set_suspended(0); 373 flush_buffer(fp); 374 375 return (0); 376 } 377 378 int 379 scan_dump(FILE *fp, off_t size) 380 { 381 struct pcap_file_header hdr; 382 struct pcap_sf_pkthdr ph; 383 off_t pos; 384 385 /* 386 * Must read the file, compare the header against our new 387 * options (in particular, snaplen) and adjust our options so 388 * that we generate a correct file. Furthermore, check the file 389 * for consistency so that we can append safely. 390 * 391 * XXX this may take a long time for large logs. 392 */ 393 fseek(fp, 0L, SEEK_SET); 394 395 if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) { 396 logmsg(LOG_ERR, "Short file header"); 397 return (1); 398 } 399 400 if (hdr.magic != TCPDUMP_MAGIC || 401 hdr.version_major != PCAP_VERSION_MAJOR || 402 hdr.version_minor != PCAP_VERSION_MINOR || 403 (int)hdr.linktype != hpcap->linktype || 404 hdr.snaplen > PFLOGD_MAXSNAPLEN) { 405 return (1); 406 } 407 408 pos = sizeof(hdr); 409 410 while (!feof(fp)) { 411 off_t len = fread((char *)&ph, 1, sizeof(ph), fp); 412 if (len == 0) 413 break; 414 415 if (len != sizeof(ph)) 416 goto error; 417 if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN) 418 goto error; 419 pos += sizeof(ph) + ph.caplen; 420 if (pos > size) 421 goto error; 422 fseek(fp, ph.caplen, SEEK_CUR); 423 } 424 425 if (pos != size) 426 goto error; 427 428 if ((int)hdr.snaplen != cur_snaplen) { 429 logmsg(LOG_WARNING, 430 "Existing file has different snaplen %u, using it", 431 hdr.snaplen); 432 if (set_snaplen(hdr.snaplen)) { 433 logmsg(LOG_WARNING, 434 "Failed, using old settings, offset %llu", 435 (unsigned long long) size); 436 } 437 } 438 439 return (0); 440 441 error: 442 logmsg(LOG_ERR, "Corrupted log file."); 443 return (1); 444 } 445 446 /* dump a packet directly to the stream, which is unbuffered */ 447 void 448 dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 449 { 450 FILE *f = (FILE *)user; 451 struct pcap_sf_pkthdr sh; 452 453 if (suspended) { 454 packets_dropped++; 455 return; 456 } 457 458 sh.ts.tv_sec = (bpf_int32)h->ts.tv_sec; 459 sh.ts.tv_usec = (bpf_int32)h->ts.tv_usec; 460 sh.caplen = h->caplen; 461 sh.len = h->len; 462 463 if (fwrite((char *)&sh, sizeof(sh), 1, f) != 1) { 464 off_t pos = ftello(f); 465 466 /* try to undo header to prevent corruption */ 467 if ((size_t)pos < sizeof(sh) || 468 ftruncate(fileno(f), pos - sizeof(sh))) { 469 logmsg(LOG_ERR, "Write failed, corrupted logfile!"); 470 set_suspended(1); 471 gotsig_close = 1; 472 return; 473 } 474 goto error; 475 } 476 477 if (fwrite(sp, h->caplen, 1, f) != 1) 478 goto error; 479 480 return; 481 482 error: 483 set_suspended(1); 484 packets_dropped ++; 485 logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno)); 486 } 487 488 int 489 flush_buffer(FILE *f) 490 { 491 off_t offset; 492 int len = bufpos - buffer; 493 494 if (len <= 0) 495 return (0); 496 497 offset = ftello(f); 498 if (offset == (off_t)-1) { 499 set_suspended(1); 500 logmsg(LOG_ERR, "Logging suspended: ftello: %s", 501 strerror(errno)); 502 return (1); 503 } 504 505 if (fwrite(buffer, len, 1, f) != 1) { 506 set_suspended(1); 507 logmsg(LOG_ERR, "Logging suspended: fwrite: %s", 508 strerror(errno)); 509 ftruncate(fileno(f), offset); 510 return (1); 511 } 512 513 set_suspended(0); 514 bufpos = buffer; 515 bufleft = buflen; 516 bufpkt = 0; 517 518 return (0); 519 } 520 521 void 522 purge_buffer(void) 523 { 524 packets_dropped += bufpkt; 525 526 set_suspended(0); 527 bufpos = buffer; 528 bufleft = buflen; 529 bufpkt = 0; 530 } 531 532 /* append packet to the buffer, flushing if necessary */ 533 void 534 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 535 { 536 FILE *f = (FILE *)user; 537 struct pcap_sf_pkthdr sh; 538 size_t len = sizeof(sh) + h->caplen; 539 540 if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) { 541 logmsg(LOG_NOTICE, "invalid size %zd (%u/%u), packet dropped", 542 len, cur_snaplen, snaplen); 543 packets_dropped++; 544 return; 545 } 546 547 if (len <= bufleft) 548 goto append; 549 550 if (suspended) { 551 packets_dropped++; 552 return; 553 } 554 555 if (flush_buffer(f)) { 556 packets_dropped++; 557 return; 558 } 559 560 if (len > bufleft) { 561 dump_packet_nobuf(user, h, sp); 562 return; 563 } 564 565 append: 566 sh.ts.tv_sec = (bpf_int32)h->ts.tv_sec; 567 sh.ts.tv_usec = (bpf_int32)h->ts.tv_usec; 568 sh.caplen = h->caplen; 569 sh.len = h->len; 570 571 memcpy(bufpos, &sh, sizeof(sh)); 572 memcpy(bufpos + sizeof(sh), sp, h->caplen); 573 574 bufpos += len; 575 bufleft -= len; 576 bufpkt++; 577 578 return; 579 } 580 581 void 582 log_pcap_stats(void) 583 { 584 struct pcap_stat pstat; 585 if (pcap_stats(hpcap, &pstat) < 0) 586 logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap)); 587 else 588 logmsg(LOG_NOTICE, 589 "%u packets received, %u/%ld dropped (kernel/pflogd)", 590 pstat.ps_recv, pstat.ps_drop, packets_dropped); 591 } 592 593 int 594 main(int argc, char **argv) 595 { 596 int ch, np, ret, Xflag = 0; 597 pcap_handler phandler = dump_packet; 598 const char *errstr = NULL; 599 struct pidfh *pfh = NULL; 600 char *pidf = NULL; 601 602 ret = 0; 603 604 /* Neither FreeBSD nor DFly have this; Max seems to think this may 605 * be a paranoid check. Comment it out: 606 closefrom(STDERR_FILENO + 1); 607 */ 608 609 while ((ch = getopt(argc, argv, "Dxd:f:i:p:s:")) != -1) { 610 switch (ch) { 611 case 'D': 612 Debug = 1; 613 break; 614 case 'd': 615 delay = strtonum(optarg, 5, 60*60, &errstr); 616 if (errstr) 617 usage(); 618 break; 619 case 'f': 620 filename = optarg; 621 break; 622 case 'i': 623 interface = optarg; 624 break; 625 case 'p': 626 pidf = optarg; 627 break; 628 case 's': 629 snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN, 630 &errstr); 631 if (snaplen <= 0) 632 snaplen = DEF_SNAPLEN; 633 if (errstr) 634 snaplen = PFLOGD_MAXSNAPLEN; 635 break; 636 case 'x': 637 Xflag++; 638 break; 639 default: 640 usage(); 641 } 642 643 } 644 645 log_debug = Debug; 646 argc -= optind; 647 argv += optind; 648 649 /* does interface exist */ 650 if (!if_exists(__DECONST(char *, interface))) { 651 warn("Failed to initialize: %s", interface); 652 logmsg(LOG_ERR, "Failed to initialize: %s", interface); 653 logmsg(LOG_ERR, "Exiting, init failure"); 654 exit(1); 655 } 656 657 if (!Debug) { 658 openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON); 659 pfh = pidfile_open(pidf, 0600, NULL); 660 if (daemon(0, 0)) { 661 logmsg(LOG_WARNING, "Failed to become daemon: %s", 662 strerror(errno)); 663 } 664 pidfile_write(pfh); 665 } 666 667 tzset(); 668 umask(S_IRWXG | S_IRWXO); 669 670 /* filter will be used by the privileged process */ 671 if (argc) { 672 filter = copy_argv(argv); 673 if (filter == NULL) 674 logmsg(LOG_NOTICE, "Failed to form filter expression"); 675 } 676 677 /* initialize pcap before dropping privileges */ 678 if (init_pcap()) { 679 logmsg(LOG_ERR, "Exiting, init failure"); 680 exit(1); 681 } 682 683 /* Privilege separation begins here */ 684 if (priv_init()) { 685 logmsg(LOG_ERR, "unable to privsep"); 686 exit(1); 687 } 688 689 setproctitle("[initializing]"); 690 /* Process is now unprivileged and inside a chroot */ 691 signal(SIGTERM, sig_close); 692 signal(SIGINT, sig_close); 693 signal(SIGQUIT, sig_close); 694 signal(SIGALRM, sig_alrm); 695 signal(SIGUSR1, sig_usr1); 696 signal(SIGHUP, sig_hup); 697 alarm(delay); 698 699 buffer = malloc(PFLOGD_BUFSIZE); 700 701 if (buffer == NULL) { 702 logmsg(LOG_WARNING, "Failed to allocate output buffer"); 703 phandler = dump_packet_nobuf; 704 } else { 705 bufleft = buflen = PFLOGD_BUFSIZE; 706 bufpos = buffer; 707 bufpkt = 0; 708 } 709 710 if (reset_dump(Xflag) < 0) { 711 if (Xflag) 712 return (1); 713 714 logmsg(LOG_ERR, "Logging suspended: open error"); 715 set_suspended(1); 716 } else if (Xflag) 717 return (0); 718 719 while (1) { 720 np = pcap_dispatch(hpcap, PCAP_NUM_PKTS, 721 phandler, (u_char *)dpcap); 722 if (np < 0) { 723 if (!if_exists(__DECONST(char *, interface))) { 724 logmsg(LOG_NOTICE, "interface %s went away", 725 interface); 726 ret = -1; 727 break; 728 } 729 logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap)); 730 } 731 732 if (gotsig_close) 733 break; 734 if (gotsig_hup) { 735 if (reset_dump(0)) { 736 logmsg(LOG_ERR, 737 "Logging suspended: open error"); 738 set_suspended(1); 739 } 740 gotsig_hup = 0; 741 } 742 743 if (gotsig_alrm) { 744 if (dpcap) 745 flush_buffer(dpcap); 746 else 747 gotsig_hup = 1; 748 gotsig_alrm = 0; 749 alarm(delay); 750 } 751 752 if (gotsig_usr1) { 753 log_pcap_stats(); 754 gotsig_usr1 = 0; 755 } 756 } 757 758 logmsg(LOG_NOTICE, "Exiting"); 759 if (dpcap) { 760 flush_buffer(dpcap); 761 fclose(dpcap); 762 } 763 purge_buffer(); 764 765 log_pcap_stats(); 766 pcap_close(hpcap); 767 if (!Debug) 768 closelog(); 769 return (ret); 770 } 771