Home | History | Annotate | Line # | Download | only in pflogd
pflogd.c revision 1.1.1.2 
      1 /*	$OpenBSD: pflogd.c,v 1.30 2004/08/08 19:04:25 deraadt Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2001 Theo de Raadt
      5  * Copyright (c) 2001 Can Erkin Acar
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  *
     12  *    - Redistributions of source code must retain the above copyright
     13  *      notice, this list of conditions and the following disclaimer.
     14  *    - Redistributions in binary form must reproduce the above
     15  *      copyright notice, this list of conditions and the following
     16  *      disclaimer in the documentation and/or other materials provided
     17  *      with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
     23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
     27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
     29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30  * POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 #include <sys/types.h>
     34 #include <sys/ioctl.h>
     35 #include <sys/file.h>
     36 #include <sys/stat.h>
     37 #include <stdio.h>
     38 #include <stdlib.h>
     39 #include <string.h>
     40 #include <unistd.h>
     41 #include <pcap-int.h>
     42 #include <pcap.h>
     43 #include <syslog.h>
     44 #include <signal.h>
     45 #include <errno.h>
     46 #include <stdarg.h>
     47 #include <fcntl.h>
     48 #include <util.h>
     49 #include "pflogd.h"
     50 
     51 pcap_t *hpcap;
     52 static FILE *dpcap;
     53 
     54 int Debug = 0;
     55 static int snaplen = DEF_SNAPLEN;
     56 static int cur_snaplen = DEF_SNAPLEN;
     57 
     58 volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;
     59 
     60 char *filename = PFLOGD_LOG_FILE;
     61 char *interface = PFLOGD_DEFAULT_IF;
     62 char *filter = NULL;
     63 
     64 char errbuf[PCAP_ERRBUF_SIZE];
     65 
     66 int log_debug = 0;
     67 unsigned int delay = FLUSH_DELAY;
     68 
     69 char *copy_argv(char * const *);
     70 void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
     71 void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
     72 int   flush_buffer(FILE *);
     73 int   init_pcap(void);
     74 void  logmsg(int, const char *, ...);
     75 void  purge_buffer(void);
     76 int   reset_dump(void);
     77 int   scan_dump(FILE *, off_t);
     78 int   set_snaplen(int);
     79 void  set_suspended(int);
     80 void  sig_alrm(int);
     81 void  sig_close(int);
     82 void  sig_hup(int);
     83 void  usage(void);
     84 
     85 /* buffer must always be greater than snaplen */
     86 static int    bufpkt = 0;	/* number of packets in buffer */
     87 static int    buflen = 0;	/* allocated size of buffer */
     88 static char  *buffer = NULL;	/* packet buffer */
     89 static char  *bufpos = NULL;	/* position in buffer */
     90 static int    bufleft = 0;	/* bytes left in buffer */
     91 
     92 /* if error, stop logging but count dropped packets */
     93 static int suspended = -1;
     94 static long packets_dropped = 0;
     95 
     96 void
     97 set_suspended(int s)
     98 {
     99 	if (suspended == s)
    100 		return;
    101 
    102 	suspended = s;
    103 	setproctitle("[%s] -s %d -f %s",
    104             suspended ? "suspended" : "running", cur_snaplen, filename);
    105 }
    106 
    107 char *
    108 copy_argv(char * const *argv)
    109 {
    110 	size_t len = 0, n;
    111 	char *buf;
    112 
    113 	if (argv == NULL)
    114 		return (NULL);
    115 
    116 	for (n = 0; argv[n]; n++)
    117 		len += strlen(argv[n])+1;
    118 	if (len == 0)
    119 		return (NULL);
    120 
    121 	buf = malloc(len);
    122 	if (buf == NULL)
    123 		return (NULL);
    124 
    125 	strlcpy(buf, argv[0], len);
    126 	for (n = 1; argv[n]; n++) {
    127 		strlcat(buf, " ", len);
    128 		strlcat(buf, argv[n], len);
    129 	}
    130 	return (buf);
    131 }
    132 
    133 void
    134 logmsg(int pri, const char *message, ...)
    135 {
    136 	va_list ap;
    137 	va_start(ap, message);
    138 
    139 	if (log_debug) {
    140 		vfprintf(stderr, message, ap);
    141 		fprintf(stderr, "\n");
    142 	} else
    143 		vsyslog(pri, message, ap);
    144 	va_end(ap);
    145 }
    146 
    147 __dead void
    148 usage(void)
    149 {
    150 	fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename] ");
    151 	fprintf(stderr, "[-s snaplen] [expression]\n");
    152 	exit(1);
    153 }
    154 
    155 void
    156 sig_close(int sig)
    157 {
    158 	gotsig_close = 1;
    159 }
    160 
    161 void
    162 sig_hup(int sig)
    163 {
    164 	gotsig_hup = 1;
    165 }
    166 
    167 void
    168 sig_alrm(int sig)
    169 {
    170 	gotsig_alrm = 1;
    171 }
    172 
    173 void
    174 set_pcap_filter(void)
    175 {
    176 	struct bpf_program bprog;
    177 
    178 	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
    179 		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
    180 	else {
    181 		if (pcap_setfilter(hpcap, &bprog) < 0)
    182 			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
    183 		pcap_freecode(&bprog);
    184 	}
    185 }
    186 
    187 int
    188 init_pcap(void)
    189 {
    190 	hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
    191 	if (hpcap == NULL) {
    192 		logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
    193 		return (-1);
    194 	}
    195 
    196 	if (pcap_datalink(hpcap) != DLT_PFLOG) {
    197 		logmsg(LOG_ERR, "Invalid datalink type");
    198 		pcap_close(hpcap);
    199 		hpcap = NULL;
    200 		return (-1);
    201 	}
    202 
    203 	set_pcap_filter();
    204 
    205 	cur_snaplen = snaplen = pcap_snapshot(hpcap);
    206 
    207 	/* lock */
    208 	if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
    209 		logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
    210 		return (-1);
    211 	}
    212 
    213 	return (0);
    214 }
    215 
    216 int
    217 set_snaplen(int snap)
    218 {
    219 	if (priv_set_snaplen(snap))
    220 		return (1);
    221 
    222 	if (cur_snaplen > snap)
    223 		purge_buffer();
    224 
    225 	cur_snaplen = snap;
    226 
    227 	return (0);
    228 }
    229 
    230 int
    231 reset_dump(void)
    232 {
    233 	struct pcap_file_header hdr;
    234 	struct stat st;
    235 	int fd;
    236 	FILE *fp;
    237 
    238 	if (hpcap == NULL)
    239 		return (-1);
    240 
    241 	if (dpcap) {
    242 		flush_buffer(dpcap);
    243 		fclose(dpcap);
    244 		dpcap = NULL;
    245 	}
    246 
    247 	/*
    248 	 * Basically reimplement pcap_dump_open() because it truncates
    249 	 * files and duplicates headers and such.
    250 	 */
    251 	fd = priv_open_log();
    252 	if (fd < 0)
    253 		return (1);
    254 
    255 	fp = fdopen(fd, "a+");
    256 
    257 	if (fp == NULL) {
    258 		close(fd);
    259 		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
    260 		return (1);
    261 	}
    262 	if (fstat(fileno(fp), &st) == -1) {
    263 		fclose(fp);
    264 		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
    265 		return (1);
    266 	}
    267 
    268 	/* set FILE unbuffered, we do our own buffering */
    269 	if (setvbuf(fp, NULL, _IONBF, 0)) {
    270 		fclose(fp);
    271 		logmsg(LOG_ERR, "Failed to set output buffers");
    272 		return (1);
    273 	}
    274 
    275 #define TCPDUMP_MAGIC 0xa1b2c3d4
    276 
    277 	if (st.st_size == 0) {
    278 		if (snaplen != cur_snaplen) {
    279 			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
    280 			if (set_snaplen(snaplen)) {
    281 				fclose(fp);
    282 				logmsg(LOG_WARNING,
    283 				    "Failed, using old settings");
    284 			}
    285 		}
    286 		hdr.magic = TCPDUMP_MAGIC;
    287 		hdr.version_major = PCAP_VERSION_MAJOR;
    288 		hdr.version_minor = PCAP_VERSION_MINOR;
    289 		hdr.thiszone = hpcap->tzoff;
    290 		hdr.snaplen = hpcap->snapshot;
    291 		hdr.sigfigs = 0;
    292 		hdr.linktype = hpcap->linktype;
    293 
    294 		if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
    295 			fclose(fp);
    296 			return (1);
    297 		}
    298 	} else if (scan_dump(fp, st.st_size)) {
    299 		/* XXX move file and continue? */
    300 		fclose(fp);
    301 		return (1);
    302 	}
    303 
    304 	dpcap = fp;
    305 
    306 	set_suspended(0);
    307 	flush_buffer(fp);
    308 
    309 	return (0);
    310 }
    311 
    312 int
    313 scan_dump(FILE *fp, off_t size)
    314 {
    315 	struct pcap_file_header hdr;
    316 	struct pcap_pkthdr ph;
    317 	off_t pos;
    318 
    319 	/*
    320 	 * Must read the file, compare the header against our new
    321 	 * options (in particular, snaplen) and adjust our options so
    322 	 * that we generate a correct file. Furthermore, check the file
    323 	 * for consistency so that we can append safely.
    324 	 *
    325 	 * XXX this may take a long time for large logs.
    326 	 */
    327 	(void) fseek(fp, 0L, SEEK_SET);
    328 
    329 	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
    330 		logmsg(LOG_ERR, "Short file header");
    331 		return (1);
    332 	}
    333 
    334 	if (hdr.magic != TCPDUMP_MAGIC ||
    335 	    hdr.version_major != PCAP_VERSION_MAJOR ||
    336 	    hdr.version_minor != PCAP_VERSION_MINOR ||
    337 	    hdr.linktype != hpcap->linktype ||
    338 	    hdr.snaplen > PFLOGD_MAXSNAPLEN) {
    339 		logmsg(LOG_ERR, "Invalid/incompatible log file, move it away");
    340 		return (1);
    341 	}
    342 
    343 	pos = sizeof(hdr);
    344 
    345 	while (!feof(fp)) {
    346 		off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
    347 		if (len == 0)
    348 			break;
    349 
    350 		if (len != sizeof(ph))
    351 			goto error;
    352 		if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
    353 			goto error;
    354 		pos += sizeof(ph) + ph.caplen;
    355 		if (pos > size)
    356 			goto error;
    357 		fseek(fp, ph.caplen, SEEK_CUR);
    358 	}
    359 
    360 	if (pos != size)
    361 		goto error;
    362 
    363 	if (hdr.snaplen != cur_snaplen) {
    364 		logmsg(LOG_WARNING,
    365 		       "Existing file has different snaplen %u, using it",
    366 		       hdr.snaplen);
    367 		if (set_snaplen(hdr.snaplen)) {
    368 			logmsg(LOG_WARNING,
    369 			       "Failed, using old settings, offset %llu",
    370 			       (unsigned long long) size);
    371 		}
    372 	}
    373 
    374 	return (0);
    375 
    376  error:
    377 	logmsg(LOG_ERR, "Corrupted log file.");
    378 	return (1);
    379 }
    380 
    381 /* dump a packet directly to the stream, which is unbuffered */
    382 void
    383 dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
    384 {
    385 	FILE *f = (FILE *)user;
    386 
    387 	if (suspended) {
    388 		packets_dropped++;
    389 		return;
    390 	}
    391 
    392 	if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
    393 		/* try to undo header to prevent corruption */
    394 		off_t pos = ftello(f);
    395 		if (pos < sizeof(*h) ||
    396 		    ftruncate(fileno(f), pos - sizeof(*h))) {
    397 			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
    398 			set_suspended(1);
    399 			gotsig_close = 1;
    400 			return;
    401 		}
    402 		goto error;
    403 	}
    404 
    405 	if (fwrite((char *)sp, h->caplen, 1, f) != 1)
    406 		goto error;
    407 
    408 	return;
    409 
    410 error:
    411 	set_suspended(1);
    412 	packets_dropped ++;
    413 	logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
    414 }
    415 
    416 int
    417 flush_buffer(FILE *f)
    418 {
    419 	off_t offset;
    420 	int len = bufpos - buffer;
    421 
    422 	if (len <= 0)
    423 		return (0);
    424 
    425 	offset = ftello(f);
    426 	if (offset == (off_t)-1) {
    427 		set_suspended(1);
    428 		logmsg(LOG_ERR, "Logging suspended: ftello: %s",
    429 		    strerror(errno));
    430 		return (1);
    431 	}
    432 
    433 	if (fwrite(buffer, len, 1, f) != 1) {
    434 		set_suspended(1);
    435 		logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
    436 		    strerror(errno));
    437 		ftruncate(fileno(f), offset);
    438 		return (1);
    439 	}
    440 
    441 	set_suspended(0);
    442 	bufpos = buffer;
    443 	bufleft = buflen;
    444 	bufpkt = 0;
    445 
    446 	return (0);
    447 }
    448 
    449 void
    450 purge_buffer(void)
    451 {
    452 	packets_dropped += bufpkt;
    453 
    454 	set_suspended(0);
    455 	bufpos = buffer;
    456 	bufleft = buflen;
    457 	bufpkt = 0;
    458 }
    459 
    460 /* append packet to the buffer, flushing if necessary */
    461 void
    462 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
    463 {
    464 	FILE *f = (FILE *)user;
    465 	size_t len = sizeof(*h) + h->caplen;
    466 
    467 	if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
    468 		logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
    469 		       len, cur_snaplen, snaplen);
    470 		packets_dropped++;
    471 		return;
    472 	}
    473 
    474 	if (len <= bufleft)
    475 		goto append;
    476 
    477 	if (suspended) {
    478 		packets_dropped++;
    479 		return;
    480 	}
    481 
    482 	if (flush_buffer(f)) {
    483 		packets_dropped++;
    484 		return;
    485 	}
    486 
    487 	if (len > bufleft) {
    488 		dump_packet_nobuf(user, h, sp);
    489 		return;
    490 	}
    491 
    492  append:
    493 	memcpy(bufpos, h, sizeof(*h));
    494 	memcpy(bufpos + sizeof(*h), sp, h->caplen);
    495 
    496 	bufpos += len;
    497 	bufleft -= len;
    498 	bufpkt++;
    499 
    500 	return;
    501 }
    502 
    503 int
    504 main(int argc, char **argv)
    505 {
    506 	struct pcap_stat pstat;
    507 	int ch, np, Xflag = 0;
    508 	pcap_handler phandler = dump_packet;
    509 	const char *errstr = NULL;
    510 
    511 	closefrom(STDERR_FILENO + 1);
    512 
    513 	while ((ch = getopt(argc, argv, "Dxd:s:f:")) != -1) {
    514 		switch (ch) {
    515 		case 'D':
    516 			Debug = 1;
    517 			break;
    518 		case 'd':
    519 			delay = strtonum(optarg, 5, 60*60, &errstr);
    520 			if (errstr)
    521 				usage();
    522 			break;
    523 		case 'f':
    524 			filename = optarg;
    525 			break;
    526 		case 's':
    527 			snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
    528 			    &errstr);
    529 			if (snaplen <= 0)
    530 				snaplen = DEF_SNAPLEN;
    531 			if (errstr)
    532 				snaplen = PFLOGD_MAXSNAPLEN;
    533 			break;
    534 		case 'x':
    535 			Xflag++;
    536 			break;
    537 		default:
    538 			usage();
    539 		}
    540 
    541 	}
    542 
    543 	log_debug = Debug;
    544 	argc -= optind;
    545 	argv += optind;
    546 
    547 	if (!Debug) {
    548 		openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON);
    549 		if (daemon(0, 0)) {
    550 			logmsg(LOG_WARNING, "Failed to become daemon: %s",
    551 			    strerror(errno));
    552 		}
    553 		pidfile(NULL);
    554 	}
    555 
    556 	(void)umask(S_IRWXG | S_IRWXO);
    557 
    558 	/* filter will be used by the privileged process */
    559 	if (argc) {
    560 		filter = copy_argv(argv);
    561 		if (filter == NULL)
    562 			logmsg(LOG_NOTICE, "Failed to form filter expression");
    563 	}
    564 
    565 	/* initialize pcap before dropping privileges */
    566 	if (init_pcap()) {
    567 		logmsg(LOG_ERR, "Exiting, init failure");
    568 		exit(1);
    569 	}
    570 
    571 	/* Privilege separation begins here */
    572 	if (priv_init()) {
    573 		logmsg(LOG_ERR, "unable to privsep");
    574 		exit(1);
    575 	}
    576 
    577 	setproctitle("[initializing]");
    578 	/* Process is now unprivileged and inside a chroot */
    579 	signal(SIGTERM, sig_close);
    580 	signal(SIGINT, sig_close);
    581 	signal(SIGQUIT, sig_close);
    582 	signal(SIGALRM, sig_alrm);
    583 	signal(SIGHUP, sig_hup);
    584 	alarm(delay);
    585 
    586 	buffer = malloc(PFLOGD_BUFSIZE);
    587 
    588 	if (buffer == NULL) {
    589 		logmsg(LOG_WARNING, "Failed to allocate output buffer");
    590 		phandler = dump_packet_nobuf;
    591 	} else {
    592 		bufleft = buflen = PFLOGD_BUFSIZE;
    593 		bufpos = buffer;
    594 		bufpkt = 0;
    595 	}
    596 
    597 	if (reset_dump()) {
    598 		if (Xflag)
    599 			return (1);
    600 
    601 		logmsg(LOG_ERR, "Logging suspended: open error");
    602 		set_suspended(1);
    603 	} else if (Xflag)
    604 		return (0);
    605 
    606 	while (1) {
    607 		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
    608 		    dump_packet, (u_char *)dpcap);
    609 		if (np < 0)
    610 			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
    611 
    612 		if (gotsig_close)
    613 			break;
    614 		if (gotsig_hup) {
    615 			if (reset_dump()) {
    616 				logmsg(LOG_ERR,
    617 				    "Logging suspended: open error");
    618 				set_suspended(1);
    619 			}
    620 			gotsig_hup = 0;
    621 		}
    622 
    623 		if (gotsig_alrm) {
    624 			if (dpcap)
    625 				flush_buffer(dpcap);
    626 			gotsig_alrm = 0;
    627 			alarm(delay);
    628 		}
    629 	}
    630 
    631 	logmsg(LOG_NOTICE, "Exiting");
    632 	if (dpcap) {
    633 		flush_buffer(dpcap);
    634 		fclose(dpcap);
    635 	}
    636 	purge_buffer();
    637 
    638 	if (pcap_stats(hpcap, &pstat) < 0)
    639 		logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap));
    640 	else
    641 		logmsg(LOG_NOTICE,
    642 		    "%u packets received, %u/%u dropped (kernel/pflogd)",
    643 		    pstat.ps_recv, pstat.ps_drop, packets_dropped);
    644 
    645 	pcap_close(hpcap);
    646 	if (!Debug)
    647 		closelog();
    648 	return (0);
    649 }
    650