xref: /freebsd/contrib/pf/pflogd/pflogd.c (revision d6b92ffa) 
1 /*	$OpenBSD: pflogd.c,v 1.46 2008/10/22 08:16:49 henning Exp $	*/
2 
3 /*
4  * Copyright (c) 2001 Theo de Raadt
5  * Copyright (c) 2001 Can Erkin Acar
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <sys/types.h>
37 #include <sys/ioctl.h>
38 #include <sys/file.h>
39 #include <sys/stat.h>
40 #include <sys/socket.h>
41 #include <net/if.h>
42 #include <stdio.h>
43 #include <stdlib.h>
44 #include <string.h>
45 #include <unistd.h>
46 #include <pcap-int.h>
47 #include <pcap.h>
48 #include <syslog.h>
49 #include <signal.h>
50 #include <err.h>
51 #include <errno.h>
52 #include <stdarg.h>
53 #include <fcntl.h>
54 #ifdef __FreeBSD__
55 #include <ifaddrs.h>
56 #include "pidfile.h"
57 #else
58 #include <util.h>
59 #endif
60 #include "pflogd.h"
61 
62 pcap_t *hpcap;
63 static FILE *dpcap;
64 
65 int Debug = 0;
66 static int snaplen = DEF_SNAPLEN;
67 static int cur_snaplen = DEF_SNAPLEN;
68 
69 volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup, gotsig_usr1;
70 
71 char *filename = PFLOGD_LOG_FILE;
72 char *interface = PFLOGD_DEFAULT_IF;
73 char *filter = NULL;
74 
75 char errbuf[PCAP_ERRBUF_SIZE];
76 
77 int log_debug = 0;
78 unsigned int delay = FLUSH_DELAY;
79 
80 char *copy_argv(char * const *);
81 void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
82 void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
83 void  log_pcap_stats(void);
84 int   flush_buffer(FILE *);
85 int   if_exists(char *);
86 int   init_pcap(void);
87 void  logmsg(int, const char *, ...);
88 void  purge_buffer(void);
89 int   reset_dump(int);
90 int   scan_dump(FILE *, off_t);
91 int   set_snaplen(int);
92 void  set_suspended(int);
93 void  sig_alrm(int);
94 void  sig_usr1(int);
95 void  sig_close(int);
96 void  sig_hup(int);
97 void  usage(void);
98 
99 static int try_reset_dump(int);
100 
101 /* buffer must always be greater than snaplen */
102 static int    bufpkt = 0;	/* number of packets in buffer */
103 static int    buflen = 0;	/* allocated size of buffer */
104 static char  *buffer = NULL;	/* packet buffer */
105 static char  *bufpos = NULL;	/* position in buffer */
106 static int    bufleft = 0;	/* bytes left in buffer */
107 
108 /* if error, stop logging but count dropped packets */
109 static int suspended = -1;
110 static long packets_dropped = 0;
111 
112 void
113 set_suspended(int s)
114 {
115 	if (suspended == s)
116 		return;
117 
118 	suspended = s;
119 	setproctitle("[%s] -s %d -i %s -f %s",
120 	    suspended ? "suspended" : "running",
121 	    cur_snaplen, interface, filename);
122 }
123 
124 char *
125 copy_argv(char * const *argv)
126 {
127 	size_t len = 0, n;
128 	char *buf;
129 
130 	if (argv == NULL)
131 		return (NULL);
132 
133 	for (n = 0; argv[n]; n++)
134 		len += strlen(argv[n])+1;
135 	if (len == 0)
136 		return (NULL);
137 
138 	buf = malloc(len);
139 	if (buf == NULL)
140 		return (NULL);
141 
142 	strlcpy(buf, argv[0], len);
143 	for (n = 1; argv[n]; n++) {
144 		strlcat(buf, " ", len);
145 		strlcat(buf, argv[n], len);
146 	}
147 	return (buf);
148 }
149 
150 void
151 logmsg(int pri, const char *message, ...)
152 {
153 	va_list ap;
154 	va_start(ap, message);
155 
156 	if (log_debug) {
157 		vfprintf(stderr, message, ap);
158 		fprintf(stderr, "\n");
159 	} else
160 		vsyslog(pri, message, ap);
161 	va_end(ap);
162 }
163 
164 #ifdef __FreeBSD__
165 __dead2 void
166 #else
167 __dead void
168 #endif
169 usage(void)
170 {
171 	fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]");
172 	fprintf(stderr, " [-i interface] [-p pidfile]\n");
173 	fprintf(stderr, "              [-s snaplen] [expression]\n");
174 	exit(1);
175 }
176 
177 void
178 sig_close(int sig)
179 {
180 	gotsig_close = 1;
181 }
182 
183 void
184 sig_hup(int sig)
185 {
186 	gotsig_hup = 1;
187 }
188 
189 void
190 sig_alrm(int sig)
191 {
192 	gotsig_alrm = 1;
193 }
194 
195 void
196 sig_usr1(int sig)
197 {
198 	gotsig_usr1 = 1;
199 }
200 
201 void
202 set_pcap_filter(void)
203 {
204 	struct bpf_program bprog;
205 
206 	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
207 		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
208 	else {
209 		if (pcap_setfilter(hpcap, &bprog) < 0)
210 			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
211 		pcap_freecode(&bprog);
212 	}
213 }
214 
215 int
216 if_exists(char *ifname)
217 {
218 #ifdef __FreeBSD__
219 	struct ifaddrs *ifdata, *mb;
220 	int exists = 0;
221 
222 	getifaddrs(&ifdata);
223         if (ifdata == NULL)
224 		return (0);
225 
226 	for (mb = ifdata; mb != NULL; mb = mb->ifa_next) {
227 		if (mb == NULL)
228 			continue;
229 		if (strlen(ifname) != strlen(mb->ifa_name))
230 			continue;
231 		if (strncmp(ifname, mb->ifa_name, strlen(ifname)) != 0)
232 			continue;
233 		exists = 1;
234 		break;
235 	}
236 	freeifaddrs(ifdata);
237 
238 	return (exists);
239 #else
240 	int s;
241 	struct ifreq ifr;
242 	struct if_data ifrdat;
243 
244 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
245 		err(1, "socket");
246 	bzero(&ifr, sizeof(ifr));
247 	if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
248 		sizeof(ifr.ifr_name))
249 			errx(1, "main ifr_name: strlcpy");
250 	ifr.ifr_data = (caddr_t)&ifrdat;
251 	if (ioctl(s, SIOCGIFDATA, (caddr_t)&ifr) == -1)
252 		return (0);
253 	if (close(s))
254 		err(1, "close");
255 
256 	return (1);
257 #endif
258 }
259 
260 int
261 init_pcap(void)
262 {
263 	hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
264 	if (hpcap == NULL) {
265 		logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
266 		return (-1);
267 	}
268 
269 	if (pcap_datalink(hpcap) != DLT_PFLOG) {
270 		logmsg(LOG_ERR, "Invalid datalink type");
271 		pcap_close(hpcap);
272 		hpcap = NULL;
273 		return (-1);
274 	}
275 
276 	set_pcap_filter();
277 
278 	cur_snaplen = snaplen = pcap_snapshot(hpcap);
279 
280 	/* lock */
281 	if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
282 		logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
283 		return (-1);
284 	}
285 
286 	return (0);
287 }
288 
289 int
290 set_snaplen(int snap)
291 {
292 	if (priv_set_snaplen(snap))
293 		return (1);
294 
295 	if (cur_snaplen > snap)
296 		purge_buffer();
297 
298 	cur_snaplen = snap;
299 
300 	return (0);
301 }
302 
303 int
304 reset_dump(int nomove)
305 {
306 	int ret;
307 
308 	for (;;) {
309 		ret = try_reset_dump(nomove);
310 		if (ret <= 0)
311 			break;
312 	}
313 
314 	return (ret);
315 }
316 
317 /*
318  * tries to (re)open log file, nomove flag is used with -x switch
319  * returns 0: success, 1: retry (log moved), -1: error
320  */
321 int
322 try_reset_dump(int nomove)
323 {
324 	struct pcap_file_header hdr;
325 	struct stat st;
326 	int fd;
327 	FILE *fp;
328 
329 	if (hpcap == NULL)
330 		return (-1);
331 
332 	if (dpcap) {
333 		flush_buffer(dpcap);
334 		fclose(dpcap);
335 		dpcap = NULL;
336 	}
337 
338 	/*
339 	 * Basically reimplement pcap_dump_open() because it truncates
340 	 * files and duplicates headers and such.
341 	 */
342 	fd = priv_open_log();
343 	if (fd < 0)
344 		return (-1);
345 
346 	fp = fdopen(fd, "a+");
347 
348 	if (fp == NULL) {
349 		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
350 		close(fd);
351 		return (-1);
352 	}
353 	if (fstat(fileno(fp), &st) == -1) {
354 		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
355 		fclose(fp);
356 		return (-1);
357 	}
358 
359 	/* set FILE unbuffered, we do our own buffering */
360 	if (setvbuf(fp, NULL, _IONBF, 0)) {
361 		logmsg(LOG_ERR, "Failed to set output buffers");
362 		fclose(fp);
363 		return (-1);
364 	}
365 
366 #define TCPDUMP_MAGIC 0xa1b2c3d4
367 
368 	if (st.st_size == 0) {
369 		if (snaplen != cur_snaplen) {
370 			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
371 			if (set_snaplen(snaplen))
372 				logmsg(LOG_WARNING,
373 				    "Failed, using old settings");
374 		}
375 		hdr.magic = TCPDUMP_MAGIC;
376 		hdr.version_major = PCAP_VERSION_MAJOR;
377 		hdr.version_minor = PCAP_VERSION_MINOR;
378 		hdr.thiszone = hpcap->tzoff;
379 		hdr.snaplen = hpcap->snapshot;
380 		hdr.sigfigs = 0;
381 		hdr.linktype = hpcap->linktype;
382 
383 		if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
384 			fclose(fp);
385 			return (-1);
386 		}
387 	} else if (scan_dump(fp, st.st_size)) {
388 		fclose(fp);
389 		if (nomove || priv_move_log()) {
390 			logmsg(LOG_ERR,
391 			    "Invalid/incompatible log file, move it away");
392 			return (-1);
393 		}
394 		return (1);
395 	}
396 
397 	dpcap = fp;
398 
399 	set_suspended(0);
400 	flush_buffer(fp);
401 
402 	return (0);
403 }
404 
405 int
406 scan_dump(FILE *fp, off_t size)
407 {
408 	struct pcap_file_header hdr;
409 #ifdef __FreeBSD__
410 	struct pcap_sf_pkthdr ph;
411 #else
412 	struct pcap_pkthdr ph;
413 #endif
414 	off_t pos;
415 
416 	/*
417 	 * Must read the file, compare the header against our new
418 	 * options (in particular, snaplen) and adjust our options so
419 	 * that we generate a correct file. Furthermore, check the file
420 	 * for consistency so that we can append safely.
421 	 *
422 	 * XXX this may take a long time for large logs.
423 	 */
424 	(void) fseek(fp, 0L, SEEK_SET);
425 
426 	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
427 		logmsg(LOG_ERR, "Short file header");
428 		return (1);
429 	}
430 
431 	if (hdr.magic != TCPDUMP_MAGIC ||
432 	    hdr.version_major != PCAP_VERSION_MAJOR ||
433 	    hdr.version_minor != PCAP_VERSION_MINOR ||
434 	    hdr.linktype != hpcap->linktype ||
435 	    hdr.snaplen > PFLOGD_MAXSNAPLEN) {
436 		return (1);
437 	}
438 
439 	pos = sizeof(hdr);
440 
441 	while (!feof(fp)) {
442 		off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
443 		if (len == 0)
444 			break;
445 
446 		if (len != sizeof(ph))
447 			goto error;
448 		if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
449 			goto error;
450 		pos += sizeof(ph) + ph.caplen;
451 		if (pos > size)
452 			goto error;
453 		fseek(fp, ph.caplen, SEEK_CUR);
454 	}
455 
456 	if (pos != size)
457 		goto error;
458 
459 	if (hdr.snaplen != cur_snaplen) {
460 		logmsg(LOG_WARNING,
461 		       "Existing file has different snaplen %u, using it",
462 		       hdr.snaplen);
463 		if (set_snaplen(hdr.snaplen)) {
464 			logmsg(LOG_WARNING,
465 			       "Failed, using old settings, offset %llu",
466 			       (unsigned long long) size);
467 		}
468 	}
469 
470 	return (0);
471 
472  error:
473 	logmsg(LOG_ERR, "Corrupted log file.");
474 	return (1);
475 }
476 
477 /* dump a packet directly to the stream, which is unbuffered */
478 void
479 dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
480 {
481 	FILE *f = (FILE *)user;
482 #ifdef __FreeBSD__
483 	struct pcap_sf_pkthdr sh;
484 #endif
485 
486 	if (suspended) {
487 		packets_dropped++;
488 		return;
489 	}
490 
491 #ifdef __FreeBSD__
492 	sh.ts.tv_sec = (bpf_int32)h->ts.tv_sec;
493 	sh.ts.tv_usec = (bpf_int32)h->ts.tv_usec;
494 	sh.caplen = h->caplen;
495 	sh.len = h->len;
496 
497 	if (fwrite((char *)&sh, sizeof(sh), 1, f) != 1) {
498 #else
499 	if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
500 #endif
501 		off_t pos = ftello(f);
502 
503 		/* try to undo header to prevent corruption */
504 #ifdef __FreeBSD__
505 		if (pos < sizeof(sh) ||
506 		    ftruncate(fileno(f), pos - sizeof(sh))) {
507 #else
508 		if (pos < sizeof(*h) ||
509 		    ftruncate(fileno(f), pos - sizeof(*h))) {
510 #endif
511 			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
512 			set_suspended(1);
513 			gotsig_close = 1;
514 			return;
515 		}
516 		goto error;
517 	}
518 
519 	if (fwrite((char *)sp, h->caplen, 1, f) != 1)
520 		goto error;
521 
522 	return;
523 
524 error:
525 	set_suspended(1);
526 	packets_dropped ++;
527 	logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
528 }
529 
530 int
531 flush_buffer(FILE *f)
532 {
533 	off_t offset;
534 	int len = bufpos - buffer;
535 
536 	if (len <= 0)
537 		return (0);
538 
539 	offset = ftello(f);
540 	if (offset == (off_t)-1) {
541 		set_suspended(1);
542 		logmsg(LOG_ERR, "Logging suspended: ftello: %s",
543 		    strerror(errno));
544 		return (1);
545 	}
546 
547 	if (fwrite(buffer, len, 1, f) != 1) {
548 		set_suspended(1);
549 		logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
550 		    strerror(errno));
551 		ftruncate(fileno(f), offset);
552 		return (1);
553 	}
554 
555 	set_suspended(0);
556 	bufpos = buffer;
557 	bufleft = buflen;
558 	bufpkt = 0;
559 
560 	return (0);
561 }
562 
563 void
564 purge_buffer(void)
565 {
566 	packets_dropped += bufpkt;
567 
568 	set_suspended(0);
569 	bufpos = buffer;
570 	bufleft = buflen;
571 	bufpkt = 0;
572 }
573 
574 /* append packet to the buffer, flushing if necessary */
575 void
576 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
577 {
578 	FILE *f = (FILE *)user;
579 #ifdef __FreeBSD__
580 	struct pcap_sf_pkthdr sh;
581 	size_t len = sizeof(sh) + h->caplen;
582 #else
583 	size_t len = sizeof(*h) + h->caplen;
584 #endif
585 
586 	if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
587 		logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
588 		       len, cur_snaplen, snaplen);
589 		packets_dropped++;
590 		return;
591 	}
592 
593 	if (len <= bufleft)
594 		goto append;
595 
596 	if (suspended) {
597 		packets_dropped++;
598 		return;
599 	}
600 
601 	if (flush_buffer(f)) {
602 		packets_dropped++;
603 		return;
604 	}
605 
606 	if (len > bufleft) {
607 		dump_packet_nobuf(user, h, sp);
608 		return;
609 	}
610 
611  append:
612 #ifdef __FreeBSD__
613 	sh.ts.tv_sec = (bpf_int32)h->ts.tv_sec;
614 	sh.ts.tv_usec = (bpf_int32)h->ts.tv_usec;
615 	sh.caplen = h->caplen;
616 	sh.len = h->len;
617 
618 	memcpy(bufpos, &sh, sizeof(sh));
619 	memcpy(bufpos + sizeof(sh), sp, h->caplen);
620 #else
621 	memcpy(bufpos, h, sizeof(*h));
622 	memcpy(bufpos + sizeof(*h), sp, h->caplen);
623 #endif
624 
625 	bufpos += len;
626 	bufleft -= len;
627 	bufpkt++;
628 
629 	return;
630 }
631 
632 void
633 log_pcap_stats(void)
634 {
635 	struct pcap_stat pstat;
636 	if (pcap_stats(hpcap, &pstat) < 0)
637 		logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap));
638 	else
639 		logmsg(LOG_NOTICE,
640 			"%u packets received, %u/%u dropped (kernel/pflogd)",
641 			pstat.ps_recv, pstat.ps_drop, packets_dropped);
642 }
643 
644 int
645 main(int argc, char **argv)
646 {
647 	int ch, np, ret, Xflag = 0;
648 	pcap_handler phandler = dump_packet;
649 	const char *errstr = NULL;
650 	char *pidf = NULL;
651 
652 	ret = 0;
653 
654 	closefrom(STDERR_FILENO + 1);
655 
656 	while ((ch = getopt(argc, argv, "Dxd:f:i:p:s:")) != -1) {
657 		switch (ch) {
658 		case 'D':
659 			Debug = 1;
660 			break;
661 		case 'd':
662 			delay = strtonum(optarg, 5, 60*60, &errstr);
663 			if (errstr)
664 				usage();
665 			break;
666 		case 'f':
667 			filename = optarg;
668 			break;
669 		case 'i':
670 			interface = optarg;
671 			break;
672 		case 'p':
673 			pidf = optarg;
674 			break;
675 		case 's':
676 			snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
677 			    &errstr);
678 			if (snaplen <= 0)
679 				snaplen = DEF_SNAPLEN;
680 			if (errstr)
681 				snaplen = PFLOGD_MAXSNAPLEN;
682 			break;
683 		case 'x':
684 			Xflag++;
685 			break;
686 		default:
687 			usage();
688 		}
689 
690 	}
691 
692 	log_debug = Debug;
693 	argc -= optind;
694 	argv += optind;
695 
696 	/* does interface exist */
697 	if (!if_exists(interface)) {
698 		warn("Failed to initialize: %s", interface);
699 		logmsg(LOG_ERR, "Failed to initialize: %s", interface);
700 		logmsg(LOG_ERR, "Exiting, init failure");
701 		exit(1);
702 	}
703 
704 	if (!Debug) {
705 		openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON);
706 		if (daemon(0, 0)) {
707 			logmsg(LOG_WARNING, "Failed to become daemon: %s",
708 			    strerror(errno));
709 		}
710 		pidfile(pidf);
711 	}
712 
713 	tzset();
714 	(void)umask(S_IRWXG | S_IRWXO);
715 
716 	/* filter will be used by the privileged process */
717 	if (argc) {
718 		filter = copy_argv(argv);
719 		if (filter == NULL)
720 			logmsg(LOG_NOTICE, "Failed to form filter expression");
721 	}
722 
723 	/* initialize pcap before dropping privileges */
724 	if (init_pcap()) {
725 		logmsg(LOG_ERR, "Exiting, init failure");
726 		exit(1);
727 	}
728 
729 	/* Privilege separation begins here */
730 	if (priv_init()) {
731 		logmsg(LOG_ERR, "unable to privsep");
732 		exit(1);
733 	}
734 
735 	setproctitle("[initializing]");
736 	/* Process is now unprivileged and inside a chroot */
737 	signal(SIGTERM, sig_close);
738 	signal(SIGINT, sig_close);
739 	signal(SIGQUIT, sig_close);
740 	signal(SIGALRM, sig_alrm);
741 	signal(SIGUSR1, sig_usr1);
742 	signal(SIGHUP, sig_hup);
743 	alarm(delay);
744 
745 	buffer = malloc(PFLOGD_BUFSIZE);
746 
747 	if (buffer == NULL) {
748 		logmsg(LOG_WARNING, "Failed to allocate output buffer");
749 		phandler = dump_packet_nobuf;
750 	} else {
751 		bufleft = buflen = PFLOGD_BUFSIZE;
752 		bufpos = buffer;
753 		bufpkt = 0;
754 	}
755 
756 	if (reset_dump(Xflag) < 0) {
757 		if (Xflag)
758 			return (1);
759 
760 		logmsg(LOG_ERR, "Logging suspended: open error");
761 		set_suspended(1);
762 	} else if (Xflag)
763 		return (0);
764 
765 	while (1) {
766 		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
767 		    phandler, (u_char *)dpcap);
768 		if (np < 0) {
769 			if (!if_exists(interface)) {
770 				logmsg(LOG_NOTICE, "interface %s went away",
771 				    interface);
772 				ret = -1;
773 				break;
774 			}
775 			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
776 		}
777 
778 		if (gotsig_close)
779 			break;
780 		if (gotsig_hup) {
781 			if (reset_dump(0)) {
782 				logmsg(LOG_ERR,
783 				    "Logging suspended: open error");
784 				set_suspended(1);
785 			}
786 			gotsig_hup = 0;
787 		}
788 
789 		if (gotsig_alrm) {
790 			if (dpcap)
791 				flush_buffer(dpcap);
792 			else
793 				gotsig_hup = 1;
794 			gotsig_alrm = 0;
795 			alarm(delay);
796 		}
797 
798 		if (gotsig_usr1) {
799 			log_pcap_stats();
800 			gotsig_usr1 = 0;
801 		}
802 	}
803 
804 	logmsg(LOG_NOTICE, "Exiting");
805 	if (dpcap) {
806 		flush_buffer(dpcap);
807 		fclose(dpcap);
808 	}
809 	purge_buffer();
810 
811 	log_pcap_stats();
812 	pcap_close(hpcap);
813 	if (!Debug)
814 		closelog();
815 	return (ret);
816 }
817