Home | History | Annotate | Line # | Download | only in pflogd
pflogd.c revision 1.4.12.1 
      1 /*	$NetBSD: pflogd.c,v 1.4.12.1 2008/06/23 04:28:53 wrstuden Exp $	*/
      2 /*	$OpenBSD: pflogd.c,v 1.45 2007/06/06 14:11:26 henning Exp $	*/
      3 
      4 /*
      5  * Copyright (c) 2001 Theo de Raadt
      6  * Copyright (c) 2001 Can Erkin Acar
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  *
     13  *    - Redistributions of source code must retain the above copyright
     14  *      notice, this list of conditions and the following disclaimer.
     15  *    - Redistributions in binary form must reproduce the above
     16  *      copyright notice, this list of conditions and the following
     17  *      disclaimer in the documentation and/or other materials provided
     18  *      with the distribution.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
     24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
     28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
     30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     31  * POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #include <sys/types.h>
     35 #include <sys/ioctl.h>
     36 #include <sys/file.h>
     37 #include <sys/stat.h>
     38 #include <sys/socket.h>
     39 #include <net/if.h>
     40 #include <stdio.h>
     41 #include <stdlib.h>
     42 #include <string.h>
     43 #include <unistd.h>
     44 /*
     45  * If we're going to include parts of the libpcap internals we MUST
     46  * set the feature-test macros they expect, or they may misbehave.
     47  */
     48 #define HAVE_STRLCPY
     49 #define HAVE_SNPRINTF
     50 #define HAVE_VSNPRINTF
     51 #include <pcap-int.h>
     52 #include <pcap.h>
     53 #include <syslog.h>
     54 #include <signal.h>
     55 #include <err.h>
     56 #include <errno.h>
     57 #include <stdarg.h>
     58 #include <fcntl.h>
     59 #include <util.h>
     60 #include "pflogd.h"
     61 
     62 pcap_t *hpcap;
     63 static FILE *dpcap;
     64 
     65 int Debug = 0;
     66 static int snaplen = DEF_SNAPLEN;
     67 static int cur_snaplen = DEF_SNAPLEN;
     68 
     69 volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;
     70 
     71 char *filename = PFLOGD_LOG_FILE;
     72 char *interface = PFLOGD_DEFAULT_IF;
     73 char *filter = NULL;
     74 
     75 char errbuf[PCAP_ERRBUF_SIZE];
     76 
     77 int log_debug = 0;
     78 unsigned int delay = FLUSH_DELAY;
     79 
     80 char *copy_argv(char * const *);
     81 void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
     82 void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
     83 int   flush_buffer(FILE *);
     84 int   if_exists(char *);
     85 int   init_pcap(void);
     86 void  logmsg(int, const char *, ...);
     87 void  purge_buffer(void);
     88 int   reset_dump(int);
     89 int   scan_dump(FILE *, off_t);
     90 int   set_snaplen(int);
     91 void  set_suspended(int);
     92 void  sig_alrm(int);
     93 void  sig_close(int);
     94 void  sig_hup(int);
     95 void  usage(void);
     96 
     97 static int try_reset_dump(int);
     98 
     99 /* buffer must always be greater than snaplen */
    100 static int    bufpkt = 0;	/* number of packets in buffer */
    101 static int    buflen = 0;	/* allocated size of buffer */
    102 static char  *buffer = NULL;	/* packet buffer */
    103 static char  *bufpos = NULL;	/* position in buffer */
    104 static int    bufleft = 0;	/* bytes left in buffer */
    105 
    106 /* if error, stop logging but count dropped packets */
    107 static int suspended = -1;
    108 static long packets_dropped = 0;
    109 
    110 void
    111 set_suspended(int s)
    112 {
    113 	if (suspended == s)
    114 		return;
    115 
    116 	suspended = s;
    117 	setproctitle("[%s] -s %d -i %s -f %s",
    118 	    suspended ? "suspended" : "running",
    119 	    cur_snaplen, interface, filename);
    120 }
    121 
    122 char *
    123 copy_argv(char * const *argv)
    124 {
    125 	size_t len = 0, n;
    126 	char *buf;
    127 
    128 	if (argv == NULL)
    129 		return (NULL);
    130 
    131 	for (n = 0; argv[n]; n++)
    132 		len += strlen(argv[n])+1;
    133 	if (len == 0)
    134 		return (NULL);
    135 
    136 	buf = malloc(len);
    137 	if (buf == NULL)
    138 		return (NULL);
    139 
    140 	strlcpy(buf, argv[0], len);
    141 	for (n = 1; argv[n]; n++) {
    142 		strlcat(buf, " ", len);
    143 		strlcat(buf, argv[n], len);
    144 	}
    145 	return (buf);
    146 }
    147 
    148 void
    149 logmsg(int pri, const char *message, ...)
    150 {
    151 	va_list ap;
    152 	va_start(ap, message);
    153 
    154 	if (log_debug) {
    155 		vfprintf(stderr, message, ap);
    156 		fprintf(stderr, "\n");
    157 	} else
    158 		vsyslog(pri, message, ap);
    159 	va_end(ap);
    160 }
    161 
    162 __dead void
    163 usage(void)
    164 {
    165 	fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]");
    166 	fprintf(stderr, " [-i interface] [-p pidfile]\n");
    167 	fprintf(stderr, "              [-s snaplen] [expression]\n");
    168 	exit(1);
    169 }
    170 
    171 void
    172 sig_close(int sig)
    173 {
    174 	gotsig_close = 1;
    175 }
    176 
    177 void
    178 sig_hup(int sig)
    179 {
    180 	gotsig_hup = 1;
    181 }
    182 
    183 void
    184 sig_alrm(int sig)
    185 {
    186 	gotsig_alrm = 1;
    187 }
    188 
    189 void
    190 set_pcap_filter(void)
    191 {
    192 	struct bpf_program bprog;
    193 
    194 	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
    195 		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
    196 	else {
    197 		if (pcap_setfilter(hpcap, &bprog) < 0)
    198 			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
    199 		pcap_freecode(&bprog);
    200 	}
    201 }
    202 
    203 int
    204 if_exists(char *ifname)
    205 {
    206 	int s;
    207 	struct ifreq ifr;
    208 	struct if_data ifrdat;
    209 
    210 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
    211 		err(1, "socket");
    212 	bzero(&ifr, sizeof(ifr));
    213 	if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
    214 		sizeof(ifr.ifr_name))
    215 			errx(1, "main ifr_name: strlcpy");
    216 	ifr.ifr_data = (caddr_t)&ifrdat;
    217 	if (ioctl(s, SIOCGIFDATA, (caddr_t)&ifr) == -1)
    218 		return (0);
    219 	if (close(s))
    220 		err(1, "close");
    221 
    222 	return (1);
    223 }
    224 
    225 int
    226 init_pcap(void)
    227 {
    228 	hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
    229 	if (hpcap == NULL) {
    230 		logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
    231 		return (-1);
    232 	}
    233 
    234 	if (pcap_datalink(hpcap) != DLT_PFLOG) {
    235 		logmsg(LOG_ERR, "Invalid datalink type");
    236 		pcap_close(hpcap);
    237 		hpcap = NULL;
    238 		return (-1);
    239 	}
    240 
    241 	set_pcap_filter();
    242 
    243 	cur_snaplen = snaplen = pcap_snapshot(hpcap);
    244 
    245 	/* lock */
    246 #ifdef __OpenBSD__
    247 	if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
    248 		logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
    249 		return (-1);
    250 	}
    251 #endif
    252 
    253 	return (0);
    254 }
    255 
    256 int
    257 set_snaplen(int snap)
    258 {
    259 	if (priv_set_snaplen(snap))
    260 		return (1);
    261 
    262 	if (cur_snaplen > snap)
    263 		purge_buffer();
    264 
    265 	cur_snaplen = snap;
    266 
    267 	return (0);
    268 }
    269 
    270 int
    271 reset_dump(int nomove)
    272 {
    273 	int ret;
    274 
    275 	for (;;) {
    276 		ret = try_reset_dump(nomove);
    277 		if (ret <= 0)
    278 			break;
    279 	}
    280 
    281 	return (ret);
    282 }
    283 
    284 /*
    285  * tries to (re)open log file, nomove flag is used with -x switch
    286  * returns 0: success, 1: retry (log moved), -1: error
    287  */
    288 int
    289 try_reset_dump(int nomove)
    290 {
    291 	struct pcap_file_header hdr;
    292 	struct stat st;
    293 	int fd;
    294 	FILE *fp;
    295 
    296 	if (hpcap == NULL)
    297 		return (-1);
    298 
    299 	if (dpcap) {
    300 		flush_buffer(dpcap);
    301 		fclose(dpcap);
    302 		dpcap = NULL;
    303 	}
    304 
    305 	/*
    306 	 * Basically reimplement pcap_dump_open() because it truncates
    307 	 * files and duplicates headers and such.
    308 	 */
    309 	fd = priv_open_log();
    310 	if (fd < 0)
    311 		return (-1);
    312 
    313 	fp = fdopen(fd, "a+");
    314 
    315 	if (fp == NULL) {
    316 		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
    317 		close(fd);
    318 		return (-1);
    319 	}
    320 	if (fstat(fileno(fp), &st) == -1) {
    321 		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
    322 		fclose(fp);
    323 		return (-1);
    324 	}
    325 
    326 	/* set FILE unbuffered, we do our own buffering */
    327 	if (setvbuf(fp, NULL, _IONBF, 0)) {
    328 		logmsg(LOG_ERR, "Failed to set output buffers");
    329 		fclose(fp);
    330 		return (-1);
    331 	}
    332 
    333 #define TCPDUMP_MAGIC 0xa1b2c3d4
    334 
    335 	if (st.st_size == 0) {
    336 		if (snaplen != cur_snaplen) {
    337 			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
    338 			if (set_snaplen(snaplen))
    339 				logmsg(LOG_WARNING,
    340 				    "Failed, using old settings");
    341 		}
    342 		hdr.magic = TCPDUMP_MAGIC;
    343 		hdr.version_major = PCAP_VERSION_MAJOR;
    344 		hdr.version_minor = PCAP_VERSION_MINOR;
    345 		hdr.thiszone = hpcap->tzoff;
    346 		hdr.snaplen = hpcap->snapshot;
    347 		hdr.sigfigs = 0;
    348 		hdr.linktype = hpcap->linktype;
    349 
    350 		if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
    351 			fclose(fp);
    352 			return (-1);
    353 		}
    354 	} else if (scan_dump(fp, st.st_size)) {
    355 		fclose(fp);
    356 		if (nomove || priv_move_log()) {
    357 			logmsg(LOG_ERR,
    358 			    "Invalid/incompatible log file, move it away");
    359 			return (-1);
    360 		}
    361 		return (1);
    362 	}
    363 
    364 	dpcap = fp;
    365 
    366 	set_suspended(0);
    367 	flush_buffer(fp);
    368 
    369 	return (0);
    370 }
    371 
    372 int
    373 scan_dump(FILE *fp, off_t size)
    374 {
    375 	struct pcap_file_header hdr;
    376 #ifdef __OpenBSD__
    377 	struct pcap_pkthdr ph;
    378 #else
    379 	struct pcap_sf_pkthdr ph;
    380 #endif
    381 	off_t pos;
    382 
    383 	/*
    384 	 * Must read the file, compare the header against our new
    385 	 * options (in particular, snaplen) and adjust our options so
    386 	 * that we generate a correct file. Furthermore, check the file
    387 	 * for consistency so that we can append safely.
    388 	 *
    389 	 * XXX this may take a long time for large logs.
    390 	 */
    391 	(void) fseek(fp, 0L, SEEK_SET);
    392 
    393 	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
    394 		logmsg(LOG_ERR, "Short file header");
    395 		return (1);
    396 	}
    397 
    398 	if (hdr.magic != TCPDUMP_MAGIC ||
    399 	    hdr.version_major != PCAP_VERSION_MAJOR ||
    400 	    hdr.version_minor != PCAP_VERSION_MINOR ||
    401 	    hdr.linktype != hpcap->linktype ||
    402 	    hdr.snaplen > PFLOGD_MAXSNAPLEN) {
    403 		return (1);
    404 	}
    405 
    406 	pos = sizeof(hdr);
    407 
    408 	while (!feof(fp)) {
    409 		off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
    410 		if (len == 0)
    411 			break;
    412 
    413 		if (len != sizeof(ph))
    414 			goto error;
    415 		if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
    416 			goto error;
    417 		pos += sizeof(ph) + ph.caplen;
    418 		if (pos > size)
    419 			goto error;
    420 		fseek(fp, ph.caplen, SEEK_CUR);
    421 	}
    422 
    423 	if (pos != size)
    424 		goto error;
    425 
    426 	if (hdr.snaplen != cur_snaplen) {
    427 		logmsg(LOG_WARNING,
    428 		       "Existing file has different snaplen %u, using it",
    429 		       hdr.snaplen);
    430 		if (set_snaplen(hdr.snaplen)) {
    431 			logmsg(LOG_WARNING,
    432 			       "Failed, using old settings, offset %llu",
    433 			       (unsigned long long) size);
    434 		}
    435 	}
    436 
    437 	return (0);
    438 
    439  error:
    440 	logmsg(LOG_ERR, "Corrupted log file.");
    441 	return (1);
    442 }
    443 
    444 /* dump a packet directly to the stream, which is unbuffered */
    445 void
    446 dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
    447 {
    448 #ifndef __OpenBSD__
    449 	struct pcap_sf_pkthdr sf_hdr;
    450 #endif
    451 	FILE *f = (FILE *)user;
    452 
    453 	if (suspended) {
    454 		packets_dropped++;
    455 		return;
    456 	}
    457 
    458 #ifndef __OpenBSD__
    459 	sf_hdr.ts.tv_sec  = h->ts.tv_sec;
    460 	sf_hdr.ts.tv_usec = h->ts.tv_usec;
    461 	sf_hdr.caplen     = h->caplen;
    462 	sf_hdr.len        = h->len;
    463 #endif
    464 
    465 #ifdef __OpenBSD__
    466 	if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
    467 #else
    468 	if (fwrite(&sf_hdr, sizeof(sf_hdr), 1, f) != 1) {
    469 #endif
    470 		/* try to undo header to prevent corruption */
    471 		off_t pos = ftello(f);
    472 #ifdef __OpenBSD__
    473 		if (pos < sizeof(*h) ||
    474 		    ftruncate(fileno(f), pos - sizeof(*h))) {
    475 #else
    476 		if (pos < sizeof(sf_hdr) ||
    477 		    ftruncate(fileno(f), pos - sizeof(sf_hdr))) {
    478 #endif
    479 			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
    480 			set_suspended(1);
    481 			gotsig_close = 1;
    482 			return;
    483 		}
    484 		goto error;
    485 	}
    486 
    487 	if (fwrite((char *)sp, h->caplen, 1, f) != 1)
    488 		goto error;
    489 
    490 	return;
    491 
    492 error:
    493 	set_suspended(1);
    494 	packets_dropped ++;
    495 	logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
    496 }
    497 
    498 int
    499 flush_buffer(FILE *f)
    500 {
    501 	off_t offset;
    502 	int len = bufpos - buffer;
    503 
    504 	if (len <= 0)
    505 		return (0);
    506 
    507 	offset = ftello(f);
    508 	if (offset == (off_t)-1) {
    509 		set_suspended(1);
    510 		logmsg(LOG_ERR, "Logging suspended: ftello: %s",
    511 		    strerror(errno));
    512 		return (1);
    513 	}
    514 
    515 	if (fwrite(buffer, len, 1, f) != 1) {
    516 		set_suspended(1);
    517 		logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
    518 		    strerror(errno));
    519 		ftruncate(fileno(f), offset);
    520 		return (1);
    521 	}
    522 
    523 	set_suspended(0);
    524 	bufpos = buffer;
    525 	bufleft = buflen;
    526 	bufpkt = 0;
    527 
    528 	return (0);
    529 }
    530 
    531 void
    532 purge_buffer(void)
    533 {
    534 	packets_dropped += bufpkt;
    535 
    536 	set_suspended(0);
    537 	bufpos = buffer;
    538 	bufleft = buflen;
    539 	bufpkt = 0;
    540 }
    541 
    542 /* append packet to the buffer, flushing if necessary */
    543 void
    544 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
    545 {
    546 	FILE *f = (FILE *)user;
    547 #ifdef __OpenBSD__
    548 	size_t len = sizeof(*h) + h->caplen;
    549 #else
    550 	struct pcap_sf_pkthdr sf_hdr;
    551 	size_t len = sizeof(sf_hdr) + h->caplen;
    552 #endif
    553 
    554 	if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
    555 		logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
    556 		       len, cur_snaplen, snaplen);
    557 		packets_dropped++;
    558 		return;
    559 	}
    560 
    561 	if (len <= bufleft)
    562 		goto append;
    563 
    564 	if (suspended) {
    565 		packets_dropped++;
    566 		return;
    567 	}
    568 
    569 	if (flush_buffer(f)) {
    570 		packets_dropped++;
    571 		return;
    572 	}
    573 
    574 	if (len > bufleft) {
    575 		dump_packet_nobuf(user, h, sp);
    576 		return;
    577 	}
    578 
    579  append:
    580 #ifdef __OpenBSD__
    581 	memcpy(bufpos, h, sizeof(*h));
    582 	memcpy(bufpos + sizeof(*h), sp, h->caplen);
    583 #else
    584 	sf_hdr.ts.tv_sec  = h->ts.tv_sec;
    585 	sf_hdr.ts.tv_usec = h->ts.tv_usec;
    586 	sf_hdr.caplen     = h->caplen;
    587 	sf_hdr.len        = h->len;
    588 
    589 	memcpy(bufpos, &sf_hdr, sizeof(sf_hdr));
    590 	memcpy(bufpos + sizeof(sf_hdr), sp, h->caplen);
    591 #endif
    592 
    593 	bufpos += len;
    594 	bufleft -= len;
    595 	bufpkt++;
    596 
    597 	return;
    598 }
    599 
    600 int
    601 main(int argc, char **argv)
    602 {
    603 	struct pcap_stat pstat;
    604 	int ch, np, ret, Xflag = 0;
    605 	pcap_handler phandler = dump_packet;
    606 	const char *errstr = NULL;
    607 	char *pidf = NULL;
    608 
    609 	ret = 0;
    610 
    611 	closefrom(STDERR_FILENO + 1);
    612 
    613 	while ((ch = getopt(argc, argv, "Dxd:f:i:p:s:")) != -1) {
    614 		switch (ch) {
    615 		case 'D':
    616 			Debug = 1;
    617 			break;
    618 		case 'd':
    619 			delay = strtonum(optarg, 5, 60*60, &errstr);
    620 			if (errstr)
    621 				usage();
    622 			break;
    623 		case 'f':
    624 			filename = optarg;
    625 			break;
    626 		case 'i':
    627 			interface = optarg;
    628 			break;
    629 		case 'p':
    630 			pidf = optarg;
    631 			break;
    632 		case 's':
    633 			snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
    634 			    &errstr);
    635 			if (snaplen <= 0)
    636 				snaplen = DEF_SNAPLEN;
    637 			if (errstr)
    638 				snaplen = PFLOGD_MAXSNAPLEN;
    639 			break;
    640 		case 'x':
    641 			Xflag++;
    642 			break;
    643 		default:
    644 			usage();
    645 		}
    646 
    647 	}
    648 
    649 	log_debug = Debug;
    650 	argc -= optind;
    651 	argv += optind;
    652 
    653 	/* does interface exist */
    654 	if (!if_exists(interface)) {
    655 		warn("Failed to initialize: %s", interface);
    656 		logmsg(LOG_ERR, "Failed to initialize: %s", interface);
    657 		logmsg(LOG_ERR, "Exiting, init failure");
    658 		exit(1);
    659 	}
    660 
    661 	if (!Debug) {
    662 		openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON);
    663 		if (daemon(0, 0)) {
    664 			logmsg(LOG_WARNING, "Failed to become daemon: %s",
    665 			    strerror(errno));
    666 		}
    667 		pidfile(pidf);
    668 	}
    669 
    670 	tzset();
    671 	(void)umask(S_IRWXG | S_IRWXO);
    672 
    673 	/* filter will be used by the privileged process */
    674 	if (argc) {
    675 		filter = copy_argv(argv);
    676 		if (filter == NULL)
    677 			logmsg(LOG_NOTICE, "Failed to form filter expression");
    678 	}
    679 
    680 	/* initialize pcap before dropping privileges */
    681 	if (init_pcap()) {
    682 		logmsg(LOG_ERR, "Exiting, init failure");
    683 		exit(1);
    684 	}
    685 
    686 	/* Privilege separation begins here */
    687 	if (priv_init()) {
    688 		logmsg(LOG_ERR, "unable to privsep");
    689 		exit(1);
    690 	}
    691 
    692 	setproctitle("[initializing]");
    693 	/* Process is now unprivileged and inside a chroot */
    694 	signal(SIGTERM, sig_close);
    695 	signal(SIGINT, sig_close);
    696 	signal(SIGQUIT, sig_close);
    697 	signal(SIGALRM, sig_alrm);
    698 	signal(SIGHUP, sig_hup);
    699 	alarm(delay);
    700 
    701 	buffer = malloc(PFLOGD_BUFSIZE);
    702 
    703 	if (buffer == NULL) {
    704 		logmsg(LOG_WARNING, "Failed to allocate output buffer");
    705 		phandler = dump_packet_nobuf;
    706 	} else {
    707 		bufleft = buflen = PFLOGD_BUFSIZE;
    708 		bufpos = buffer;
    709 		bufpkt = 0;
    710 	}
    711 
    712 	if (reset_dump(Xflag) < 0) {
    713 		if (Xflag)
    714 			return (1);
    715 
    716 		logmsg(LOG_ERR, "Logging suspended: open error");
    717 		set_suspended(1);
    718 	} else if (Xflag)
    719 		return (0);
    720 
    721 	while (1) {
    722 		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
    723 		    phandler, (u_char *)dpcap);
    724 		if (np < 0) {
    725 			if (!if_exists(interface) == -1) {
    726 				logmsg(LOG_NOTICE, "interface %s went away",
    727 				    interface);
    728 				ret = -1;
    729 				break;
    730 			}
    731 			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
    732 		}
    733 
    734 		if (gotsig_close)
    735 			break;
    736 		if (gotsig_hup) {
    737 			if (reset_dump(0)) {
    738 				logmsg(LOG_ERR,
    739 				    "Logging suspended: open error");
    740 				set_suspended(1);
    741 			}
    742 			gotsig_hup = 0;
    743 		}
    744 
    745 		if (gotsig_alrm) {
    746 			if (dpcap)
    747 				flush_buffer(dpcap);
    748 			else
    749 				gotsig_hup = 1;
    750 			gotsig_alrm = 0;
    751 			alarm(delay);
    752 		}
    753 	}
    754 
    755 	logmsg(LOG_NOTICE, "Exiting");
    756 	if (dpcap) {
    757 		flush_buffer(dpcap);
    758 		fclose(dpcap);
    759 	}
    760 	purge_buffer();
    761 
    762 	if (pcap_stats(hpcap, &pstat) < 0)
    763 		logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap));
    764 	else
    765 		logmsg(LOG_NOTICE,
    766 		    "%u packets received, %u/%u dropped (kernel/pflogd)",
    767 		    pstat.ps_recv, pstat.ps_drop, packets_dropped);
    768 
    769 	pcap_close(hpcap);
    770 	if (!Debug)
    771 		closelog();
    772 	return (ret);
    773 }
    774