Import userland of pf 3.5 from OpenBSD (OPENBSD_3_5_BASE).

5 files changed, 851 insertions, 123 deletions

diff --git a/contrib/pf/pflogd/pflogd.8 b/contrib/pf/pflogd/pflogd.8
index ab63259..ac8fe78 100644
--- a/contrib/pf/pflogd/pflogd.8
+++ b/contrib/pf/pflogd/pflogd.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: pflogd.8,v 1.22 2003/06/03 13:16:08 jmc Exp $
+.\"	$OpenBSD: pflogd.8,v 1.24 2004/01/16 10:45:49 jmc Exp $
 .\"
 .\" Copyright (c) 2001 Can Erkin Acar.  All rights reserved.
 .\"
@@ -32,7 +32,7 @@
 .Nd packet filter logging daemon
 .Sh SYNOPSIS
 .Nm pflogd
-.Op Fl D
+.Op Fl Dx
 .Op Fl d Ar delay
 .Op Fl f Ar filename
 .Op Fl s Ar snaplen
@@ -57,11 +57,11 @@ hopefully offline in case there are bugs in the packet parsing code of
 .Pp
 .Nm
 closes and then re-opens the log file when it receives
-.Va SIGHUP ,
+.Dv SIGHUP ,
 permitting
 .Xr newsyslog 8
 to rotate logfiles automatically.
-.Va SIGALRM
+.Dv SIGALRM
 causes
 .Nm
 to flush the current logfile buffers to the disk, thus making the most
@@ -71,22 +71,32 @@ The buffers are also flushed every
 seconds.
 .Pp
 If the log file contains data after a restart or a
-.Va SIGHUP ,
+.Dv SIGHUP ,
 new logs are appended to the existing file.
 If the existing log file was created with a different snaplen,
 .Nm
 temporarily uses the old snaplen to keep the log file consistent.
 .Pp
+.Nm
+tries to preserve the integrity of the log file against I/O errors.
+Furthermore, integrity of an existing log file is verified before
+appending.
+If there is an invalid log file or an I/O error, logging is suspended until a
+.Dv SIGHUP
+or a
+.Dv SIGALRM
+is received.
+.Pp
 The options are as follows:
 .Bl -tag -width Ds
-.It Fl d Ar delay
-Time in seconds to delay between automatic flushes of the file.
-This may be specified with a value between 5 and 3600 seconds.
-If not specified, the default is 60 seconds.
 .It Fl D
 Debugging mode.
 .Nm
 does not disassociate from the controlling terminal.
+.It Fl d Ar delay
+Time in seconds to delay between automatic flushes of the file.
+This may be specified with a value between 5 and 3600 seconds.
+If not specified, the default is 60 seconds.
 .It Fl f Ar filename
 Log output filename.
 Default is
@@ -98,6 +108,8 @@ bytes of data from each packet rather than the default of 96.
 The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may
 truncate protocol information for other protocols.
 Other file parsers may desire a higher snaplen.
+.It Fl x
+Check the integrity of an existing log file, and return.
 .It Ar expression
 Selects which packets will be dumped, using the regular language of
 .Xr tcpdump 8 .
@@ -106,13 +118,13 @@ Selects which packets will be dumped, using the regular language of
 .Bl -tag -width /var/run/pflogd.pid -compact
 .It Pa /var/run/pflogd.pid
 Process ID of the currently running
-.Nm pflogd .
+.Nm .
 .It Pa /var/log/pflog
 Default log file.
 .El
 .Sh EXAMPLES
 Log specific tcp packets to a different log file with a large snaplen
-(useful with a log-all rule to dump complete sessions)
+(useful with a log-all rule to dump complete sessions):
 .Bd -literal -offset indent
 # pflogd -s 1600 -f suspicious.log port 80 and host evilhost
 .Ed
@@ -123,7 +135,8 @@ Display binary logs:
 .Ed
 .Pp
 Display the logs in real time (this does not interfere with the
-operation of pflogd):
+operation of
+.Nm ) :
 .Bd -literal -offset indent
 # tcpdump -n -e -ttt -i pflog0
 .Ed
@@ -133,7 +146,7 @@ structure defined in
 .Aq Ar net/if_pflog.h .
 Tcpdump can restrict the output
 to packets logged on a specified interface, a rule number, a reason,
-a direction, an ip family or an action.
+a direction, an IP family or an action.
 .Pp
 .Bl -tag -width "reason match " -compact
 .It ip
@@ -141,9 +154,9 @@ Address family equals IPv4.
 .It ip6
 Address family equals IPv6.
 .It ifname kue0
-Interface name equals "kue0"
+Interface name equals "kue0".
 .It on kue0
-Interface name equals "kue0"
+Interface name equals "kue0".
 .It rulenum 10
 Rule number equals 10.
 .It reason match
diff --git a/contrib/pf/pflogd/pflogd.c b/contrib/pf/pflogd/pflogd.c
index 9777f15..7e19ae6 100644
--- a/contrib/pf/pflogd/pflogd.c
+++ b/contrib/pf/pflogd/pflogd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pflogd.c,v 1.21 2003/08/22 21:50:34 david Exp $	*/
+/*	$OpenBSD: pflogd.c,v 1.27 2004/02/13 19:01:57 otto Exp $	*/
 
 /*
  * Copyright (c) 2001 Theo de Raadt
@@ -31,6 +31,7 @@
  */
 
 #include <sys/types.h>
+#include <sys/ioctl.h>
 #include <sys/file.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ -45,21 +46,14 @@
 #include <stdarg.h>
 #include <fcntl.h>
 #include <util.h>
-
-#define DEF_SNAPLEN 116		/* default plus allow for larger header of pflog */
-#define PCAP_TO_MS 500		/* pcap read timeout (ms) */
-#define PCAP_NUM_PKTS 1000	/* max number of packets to process at each loop */
-#define PCAP_OPT_FIL 0		/* filter optimization */
-#define FLUSH_DELAY 60		/* flush delay */
-
-#define PFLOGD_LOG_FILE		"/var/log/pflog"
-#define PFLOGD_DEFAULT_IF	"pflog0"
+#include "pflogd.h"
 
 pcap_t *hpcap;
-pcap_dumper_t *dpcap;
+static FILE *dpcap;
 
 int Debug = 0;
-int snaplen = DEF_SNAPLEN;
+static int snaplen = DEF_SNAPLEN;
+static int cur_snaplen = DEF_SNAPLEN;
 
 volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;
 
@@ -72,15 +66,43 @@ char errbuf[PCAP_ERRBUF_SIZE];
 int log_debug = 0;
 unsigned int delay = FLUSH_DELAY;
 
-char *copy_argv(char * const *argv);
+char *copy_argv(char * const *);
+void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
+void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
+int   flush_buffer(FILE *);
 int   init_pcap(void);
-void  logmsg(int priority, const char *message, ...);
+void  logmsg(int, const char *, ...);
+void  purge_buffer(void);
 int   reset_dump(void);
+int   scan_dump(FILE *, off_t);
+int   set_snaplen(int);
+void  set_suspended(int);
 void  sig_alrm(int);
 void  sig_close(int);
 void  sig_hup(int);
 void  usage(void);
 
+/* buffer must always be greater than snaplen */
+static int    bufpkt = 0;	/* number of packets in buffer */
+static int    buflen = 0;	/* allocated size of buffer */
+static char  *buffer = NULL;	/* packet buffer */
+static char  *bufpos = NULL;	/* position in buffer */
+static int    bufleft = 0;	/* bytes left in buffer */
+
+/* if error, stop logging but count dropped packets */
+static int suspended = -1;
+static long packets_dropped = 0;
+
+void
+set_suspended(int s)
+{
+	if (suspended == s)
+		return;
+
+	suspended = s;
+	setproctitle("[%s] -s %d -f %s",
+            suspended ? "suspended" : "running", cur_snaplen, filename);
+}
 
 char *
 copy_argv(char * const *argv)
@@ -125,7 +147,7 @@ logmsg(int pri, const char *message, ...)
 __dead void
 usage(void)
 {
-	fprintf(stderr, "usage: pflogd [-D] [-d delay] [-f filename] ");
+	fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename] ");
 	fprintf(stderr, "[-s snaplen] [expression]\n");
 	exit(1);
 }
@@ -148,37 +170,60 @@ sig_alrm(int sig)
 	gotsig_alrm = 1;
 }
 
-int
-init_pcap(void)
+void
+set_pcap_filter(void)
 {
 	struct bpf_program bprog;
-	pcap_t *oldhpcap = hpcap;
 
+	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
+		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
+	else {
+		if (pcap_setfilter(hpcap, &bprog) < 0)
+			logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
+		pcap_freecode(&bprog);
+	}
+}
+
+int
+init_pcap(void)
+{
 	hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
 	if (hpcap == NULL) {
 		logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
-		hpcap = oldhpcap;
 		return (-1);
 	}
 
-	if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
-		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
-	else if (pcap_setfilter(hpcap, &bprog) < 0)
-		logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
-	if (filter != NULL)
-		free(filter);
-
 	if (pcap_datalink(hpcap) != DLT_PFLOG) {
 		logmsg(LOG_ERR, "Invalid datalink type");
 		pcap_close(hpcap);
-		hpcap = oldhpcap;
+		hpcap = NULL;
 		return (-1);
 	}
 
-	if (oldhpcap)
-		pcap_close(oldhpcap);
+	set_pcap_filter();
+
+	cur_snaplen = snaplen = pcap_snapshot(hpcap);
+
+	/* lock */
+	if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
+		logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
+		return (-1);
+	}
+
+	return (0);
+}
+
+int
+set_snaplen(int snap)
+{
+	if (priv_set_snaplen(snap))
+		return (1);
+
+	if (cur_snaplen > snap)
+		purge_buffer();
+
+	cur_snaplen = snap;
 
-	snaplen = pcap_snapshot(hpcap);
 	return (0);
 }
 
@@ -187,45 +232,51 @@ reset_dump(void)
 {
 	struct pcap_file_header hdr;
 	struct stat st;
-	int tmpsnap;
+	int fd;
 	FILE *fp;
 
 	if (hpcap == NULL)
-		return (1);
+		return (-1);
+
 	if (dpcap) {
-		pcap_dump_close(dpcap);
-		dpcap = 0;
+		flush_buffer(dpcap);
+		fclose(dpcap);
+		dpcap = NULL;
 	}
 
 	/*
 	 * Basically reimplement pcap_dump_open() because it truncates
 	 * files and duplicates headers and such.
 	 */
-	fp = fopen(filename, "a+");
+	fd = priv_open_log();
+	if (fd < 0)
+		return (1);
+
+	fp = fdopen(fd, "a+");
+
 	if (fp == NULL) {
-		snprintf(hpcap->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
-		    filename, pcap_strerror(errno));
-		logmsg(LOG_ERR, "Error: %s", pcap_geterr(hpcap));
+		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
 		return (1);
 	}
 	if (fstat(fileno(fp), &st) == -1) {
-		snprintf(hpcap->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
-		    filename, pcap_strerror(errno));
-		logmsg(LOG_ERR, "Error: %s", pcap_geterr(hpcap));
+		logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
 		return (1);
 	}
 
-	dpcap = (pcap_dumper_t *)fp;
+	/* set FILE unbuffered, we do our own buffering */
+	if (setvbuf(fp, NULL, _IONBF, 0)) {
+		logmsg(LOG_ERR, "Failed to set output buffers");
+		return (1);
+	}
 
 #define TCPDUMP_MAGIC 0xa1b2c3d4
 
 	if (st.st_size == 0) {
-		if (snaplen != pcap_snapshot(hpcap)) {
+		if (snaplen != cur_snaplen) {
 			logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
-			if (init_pcap()) {
-				logmsg(LOG_ERR, "Failed to initialize");
-				if (hpcap == NULL) return (-1);
-				logmsg(LOG_NOTICE, "Using old settings");
+			if (set_snaplen(snaplen)) {
+				logmsg(LOG_WARNING,
+				    "Failed, using old settings");
 			}
 		}
 		hdr.magic = TCPDUMP_MAGIC;
@@ -237,58 +288,224 @@ reset_dump(void)
 		hdr.linktype = hpcap->linktype;
 
 		if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
-			dpcap = NULL;
 			fclose(fp);
-			return (-1);
+			return (1);
 		}
-		return (0);
+	} else if (scan_dump(fp, st.st_size)) {
+		/* XXX move file and continue? */
+		fclose(fp);
+		return (1);
 	}
 
+	dpcap = fp;
+
+	set_suspended(0);
+	flush_buffer(fp);
+
+	return (0);
+}
+
+int
+scan_dump(FILE *fp, off_t size)
+{
+	struct pcap_file_header hdr;
+	struct pcap_pkthdr ph;
+	off_t pos;
+
 	/*
-	 * XXX Must read the file, compare the header against our new
+	 * Must read the file, compare the header against our new
 	 * options (in particular, snaplen) and adjust our options so
-	 * that we generate a correct file.
+	 * that we generate a correct file. Furthermore, check the file
+	 * for consistency so that we can append safely.
+	 *
+	 * XXX this may take a long time for large logs.
 	 */
 	(void) fseek(fp, 0L, SEEK_SET);
-	if (fread((char *)&hdr, sizeof(hdr), 1, fp) == 1) {
-		if (hdr.magic != TCPDUMP_MAGIC ||
-		    hdr.version_major != PCAP_VERSION_MAJOR ||
-		    hdr.version_minor != PCAP_VERSION_MINOR ||
-		    hdr.linktype != hpcap->linktype) {
-			logmsg(LOG_ERR,
-			    "Invalid/incompatible log file, move it away");
-			fclose(fp);
-			return (1);
-		    }
-		if (hdr.snaplen != snaplen) {
+
+	if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
+		logmsg(LOG_ERR, "Short file header");
+		return (1);
+	}
+
+	if (hdr.magic != TCPDUMP_MAGIC ||
+	    hdr.version_major != PCAP_VERSION_MAJOR ||
+	    hdr.version_minor != PCAP_VERSION_MINOR ||
+	    hdr.linktype != hpcap->linktype ||
+	    hdr.snaplen > PFLOGD_MAXSNAPLEN) {
+		logmsg(LOG_ERR, "Invalid/incompatible log file, move it away");
+		return (1);
+	}
+
+	pos = sizeof(hdr);
+
+	while (!feof(fp)) {
+		off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
+		if (len == 0)
+			break;
+
+		if (len != sizeof(ph))
+			goto error;
+		if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
+			goto error;
+		pos += sizeof(ph) + ph.caplen;
+		if (pos > size)
+			goto error;
+		fseek(fp, ph.caplen, SEEK_CUR);
+	}
+
+	if (pos != size)
+		goto error;
+
+	if (hdr.snaplen != cur_snaplen) {
+		logmsg(LOG_WARNING,
+		       "Existing file has different snaplen %u, using it",
+		       hdr.snaplen);
+		if (set_snaplen(hdr.snaplen)) {
 			logmsg(LOG_WARNING,
-			    "Existing file specifies a snaplen of %u, using it",
-			    hdr.snaplen);
-			tmpsnap = snaplen;
-			snaplen = hdr.snaplen;
-			if (init_pcap()) {
-				logmsg(LOG_ERR, "Failed to re-initialize");
-				if (hpcap == 0)
-					return (-1);
-				logmsg(LOG_NOTICE,
-					"Using old settings, offset: %llu",
-					(unsigned long long)st.st_size);
-			}
-			snaplen = tmpsnap;
+			       "Failed, using old settings, offset %llu",
+			       (unsigned long long) size);
 		}
 	}
 
-	(void) fseek(fp, 0L, SEEK_END);
 	return (0);
+
+ error:
+	logmsg(LOG_ERR, "Corrupted log file.");
+	return (1);
+}
+
+/* dump a packet directly to the stream, which is unbuffered */
+void
+dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
+{
+	FILE *f = (FILE *)user;
+
+	if (suspended) {
+		packets_dropped++;
+		return;
+	}
+
+	if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
+		/* try to undo header to prevent corruption */
+		off_t pos = ftello(f);
+		if (pos < sizeof(*h) ||
+		    ftruncate(fileno(f), pos - sizeof(*h))) {
+			logmsg(LOG_ERR, "Write failed, corrupted logfile!");
+			set_suspended(1);
+			gotsig_close = 1;
+			return;
+		}
+		goto error;
+	}
+
+	if (fwrite((char *)sp, h->caplen, 1, f) != 1)
+		goto error;
+
+	return;
+
+error:
+	set_suspended(1);
+	packets_dropped ++;
+	logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
+}
+
+int
+flush_buffer(FILE *f)
+{
+	off_t offset;
+	int len = bufpos - buffer;
+
+	if (len <= 0)
+		return (0);
+
+	offset = ftello(f);
+	if (offset == (off_t)-1) {
+		set_suspended(1);
+		logmsg(LOG_ERR, "Logging suspended: ftello: %s",
+		    strerror(errno));
+		return (1);
+	}
+
+	if (fwrite(buffer, len, 1, f) != 1) {
+		set_suspended(1);
+		logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
+		    strerror(errno));
+		ftruncate(fileno(f), offset);
+		return (1);
+	}
+
+	set_suspended(0);
+	bufpos = buffer;
+	bufleft = buflen;
+	bufpkt = 0;
+
+	return (0);
+}
+
+void
+purge_buffer(void)
+{
+	packets_dropped += bufpkt;
+
+	set_suspended(0);
+	bufpos = buffer;
+	bufleft = buflen;
+	bufpkt = 0;
+}
+
+/* append packet to the buffer, flushing if necessary */
+void
+dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
+{
+	FILE *f = (FILE *)user;
+	size_t len = sizeof(*h) + h->caplen;
+
+	if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
+		logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
+		       len, cur_snaplen, snaplen);
+		packets_dropped++;
+		return;
+	}
+
+	if (len <= bufleft)
+		goto append;
+
+	if (suspended) {
+		packets_dropped++;
+		return;
+	}
+
+	if (flush_buffer(f)) {
+		packets_dropped++;
+		return;
+	}
+
+	if (len > bufleft) {
+		dump_packet_nobuf(user, h, sp);
+		return;
+	}
+
+ append:	
+	memcpy(bufpos, h, sizeof(*h));
+	memcpy(bufpos + sizeof(*h), sp, h->caplen);
+
+	bufpos += len;
+	bufleft -= len;
+	bufpkt++;
+
+	return;
 }
 
 int
 main(int argc, char **argv)
 {
 	struct pcap_stat pstat;
-	int ch, np;
+	int ch, np, Xflag = 0;
+	pcap_handler phandler = dump_packet;
 
-	while ((ch = getopt(argc, argv, "Dd:s:f:")) != -1) {
+	closefrom(STDERR_FILENO + 1);
+
+	while ((ch = getopt(argc, argv, "Dxd:s:f:")) != -1) {
 		switch (ch) {
 		case 'D':
 			Debug = 1;
@@ -305,6 +522,11 @@ main(int argc, char **argv)
 			snaplen = atoi(optarg);
 			if (snaplen <= 0)
 				snaplen = DEF_SNAPLEN;
+			if (snaplen > PFLOGD_MAXSNAPLEN)
+				snaplen = PFLOGD_MAXSNAPLEN;
+			break;
+		case 'x':
+			Xflag++;
 			break;
 		default:
 			usage();
@@ -327,32 +549,57 @@ main(int argc, char **argv)
 
 	(void)umask(S_IRWXG | S_IRWXO);
 
-	signal(SIGTERM, sig_close);
-	signal(SIGINT, sig_close);
-	signal(SIGQUIT, sig_close);
-	signal(SIGALRM, sig_alrm);
-	signal(SIGHUP, sig_hup);
-	alarm(delay);
-
+	/* filter will be used by the privileged process */
 	if (argc) {
 		filter = copy_argv(argv);
 		if (filter == NULL)
 			logmsg(LOG_NOTICE, "Failed to form filter expression");
 	}
 
+	/* initialize pcap before dropping privileges */
 	if (init_pcap()) {
 		logmsg(LOG_ERR, "Exiting, init failure");
 		exit(1);
 	}
 
-	if (reset_dump()) {
-		logmsg(LOG_ERR, "Failed to open log file %s", filename);
-		pcap_close(hpcap);
+	/* Privilege separation begins here */
+	if (priv_init()) {
+		logmsg(LOG_ERR, "unable to privsep");
 		exit(1);
 	}
 
+	setproctitle("[initializing]");
+	/* Process is now unprivileged and inside a chroot */
+	signal(SIGTERM, sig_close);
+	signal(SIGINT, sig_close);
+	signal(SIGQUIT, sig_close);
+	signal(SIGALRM, sig_alrm);
+	signal(SIGHUP, sig_hup);
+	alarm(delay);
+
+	buffer = malloc(PFLOGD_BUFSIZE);
+
+	if (buffer == NULL) {
+		logmsg(LOG_WARNING, "Failed to allocate output buffer");
+		phandler = dump_packet_nobuf;
+	} else {
+		bufleft = buflen = PFLOGD_BUFSIZE;
+		bufpos = buffer;
+		bufpkt = 0;
+	}
+
+	if (reset_dump()) {
+		if (Xflag)
+			return (1);
+
+		logmsg(LOG_ERR, "Logging suspended: open error");
+		set_suspended(1);
+	} else if (Xflag)
+		return (0);
+
 	while (1) {
-		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS, pcap_dump, (u_char *)dpcap);
+		np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
+		    dump_packet, (u_char *)dpcap);
 		if (np < 0)
 			logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
 
@@ -360,38 +607,34 @@ main(int argc, char **argv)
 			break;
 		if (gotsig_hup) {
 			if (reset_dump()) {
-				logmsg(LOG_ERR, "Failed to open log file!");
-				break;
+				logmsg(LOG_ERR,
+				    "Logging suspended: open error");
+				set_suspended(1);
 			}
-			logmsg(LOG_NOTICE, "Reopened logfile");
 			gotsig_hup = 0;
 		}
 
 		if (gotsig_alrm) {
-			/* XXX pcap_dumper is an incomplete type which libpcap
-			 * casts to a FILE* currently.  For now it is safe to
-			 * make the same assumption, however this may change
-			 * in the future.
-			 */
-			if (dpcap) {
-				if (fflush((FILE *)dpcap) == EOF) {
-					break;
-				}
-			}
+			if (dpcap)
+				flush_buffer(dpcap);
 			gotsig_alrm = 0;
 			alarm(delay);
 		}
 	}
 
-	logmsg(LOG_NOTICE, "Exiting due to signal");
-	if (dpcap)
-		pcap_dump_close(dpcap);
+	logmsg(LOG_NOTICE, "Exiting");
+	if (dpcap) {
+		flush_buffer(dpcap);
+		fclose(dpcap);
+	}
+	purge_buffer();
 
 	if (pcap_stats(hpcap, &pstat) < 0)
 		logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap));
 	else
-		logmsg(LOG_NOTICE, "%u packets received, %u dropped",
-		    pstat.ps_recv, pstat.ps_drop);
+		logmsg(LOG_NOTICE,
+		    "%u packets received, %u/%u dropped (kernel/pflogd)",
+		    pstat.ps_recv, pstat.ps_drop, packets_dropped);
 
 	pcap_close(hpcap);
 	if (!Debug)
diff --git a/contrib/pf/pflogd/pflogd.h b/contrib/pf/pflogd/pflogd.h
new file mode 100644
index 0000000..3baecb6
--- /dev/null
+++ b/contrib/pf/pflogd/pflogd.h
@@ -0,0 +1,47 @@
+/*	$OpenBSD: pflogd.h,v 1.2 2004/01/15 20:15:14 canacar Exp $ */
+
+/*
+ * Copyright (c) 2003 Can Erkin Acar
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/limits.h>
+#include <pcap.h>
+
+#define DEF_SNAPLEN 116		/* default plus allow for larger header of pflog */
+#define PCAP_TO_MS 500		/* pcap read timeout (ms) */
+#define PCAP_NUM_PKTS 1000	/* max number of packets to process at each loop */
+#define PCAP_OPT_FIL 1		/* filter optimization */
+#define FLUSH_DELAY 60		/* flush delay */
+
+#define PFLOGD_LOG_FILE		"/var/log/pflog"
+#define PFLOGD_DEFAULT_IF	"pflog0"
+
+#define PFLOGD_MAXSNAPLEN	INT_MAX
+#define PFLOGD_BUFSIZE		65536	/* buffer size for incoming packets */
+
+void  logmsg(int priority, const char *message, ...);
+
+/* Privilege separation */
+int	priv_init(void);
+int	priv_set_snaplen(int snaplen);
+int	priv_open_log(void);
+pcap_t *pcap_open_live_fd(int fd, int snaplen, char *ebuf);
+
+void set_pcap_filter(void);
+/* File descriptor send/recv */
+void send_fd(int, int);
+int  receive_fd(int);
+
+extern int Debug;
diff --git a/contrib/pf/pflogd/privsep.c b/contrib/pf/pflogd/privsep.c
new file mode 100644
index 0000000..50807ad
--- /dev/null
+++ b/contrib/pf/pflogd/privsep.c
@@ -0,0 +1,305 @@
+/*	$OpenBSD: privsep.c,v 1.8 2004/03/14 19:17:05 otto Exp $	*/
+
+/*
+ * Copyright (c) 2003 Can Erkin Acar
+ * Copyright (c) 2003 Anil Madhavapeddy <anil@recoil.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+
+#include <net/if.h>
+#include <net/bpf.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pcap.h>
+#include <pcap-int.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+#include <unistd.h>
+#include "pflogd.h"
+
+enum cmd_types {
+	PRIV_SET_SNAPLEN,	/* set the snaplength */
+	PRIV_OPEN_LOG		/* open logfile for appending */
+};
+
+static int priv_fd = -1;
+static volatile pid_t child_pid = -1;
+
+volatile sig_atomic_t gotsig_chld = 0;
+
+static void sig_pass_to_chld(int);
+static void sig_chld(int);
+static int  may_read(int, void *, size_t);
+static void must_read(int, void *, size_t);
+static void must_write(int, void *, size_t);
+static int  set_snaplen(int snap);
+
+/* bpf filter expression common to parent and child */
+extern char *filter;
+extern char *errbuf;
+extern char *filename;
+extern pcap_t *hpcap;
+
+/* based on syslogd privsep */
+int
+priv_init(void)
+{
+	int i, fd, socks[2], cmd;
+	int snaplen, ret;
+	struct passwd *pw;
+
+	for (i = 1; i < _NSIG; i++)
+		signal(i, SIG_DFL);
+
+	/* Create sockets */
+	if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, socks) == -1)
+		err(1, "socketpair() failed");
+
+	pw = getpwnam("_pflogd");
+	if (pw == NULL)
+		errx(1, "unknown user _pflogd");
+	endpwent();
+
+	child_pid = fork();
+	if (child_pid < 0)
+		err(1, "fork() failed");
+
+	if (!child_pid) {
+		gid_t gidset[1];
+
+		/* Child - drop privileges and return */
+		if (chroot(pw->pw_dir) != 0)
+			err(1, "unable to chroot");
+		if (chdir("/") != 0)
+			err(1, "unable to chdir");
+
+		gidset[0] = pw->pw_gid;
+		if (setgroups(1, gidset) == -1)
+			err(1, "setgroups() failed");
+		if (setegid(pw->pw_gid) == -1)
+			err(1, "setegid() failed");
+		if (setgid(pw->pw_gid) == -1)
+			err(1, "setgid() failed");
+		if (seteuid(pw->pw_uid) == -1)
+			err(1, "seteuid() failed");
+		if (setuid(pw->pw_uid) == -1)
+			err(1, "setuid() failed");
+		close(socks[0]);
+		priv_fd = socks[1];
+		return 0;
+	}
+
+	/* Father */
+	/* Pass ALRM/TERM/HUP through to child, and accept CHLD */
+	signal(SIGALRM, sig_pass_to_chld);
+	signal(SIGTERM, sig_pass_to_chld);
+	signal(SIGHUP,  sig_pass_to_chld);
+	signal(SIGCHLD, sig_chld);
+
+	setproctitle("[priv]");
+	close(socks[1]);
+
+	while (!gotsig_chld) {
+		if (may_read(socks[0], &cmd, sizeof(int)))
+			break;
+		switch (cmd) {
+		case PRIV_SET_SNAPLEN:
+			logmsg(LOG_DEBUG,
+			    "[priv]: msg PRIV_SET_SNAPLENGTH received");
+			must_read(socks[0], &snaplen, sizeof(int));
+
+			ret = set_snaplen(snaplen);
+			if (ret) {
+				logmsg(LOG_NOTICE,
+				   "[priv]: set_snaplen failed for snaplen %d",
+				   snaplen);
+			}
+
+			must_write(socks[0], &ret, sizeof(int));
+			break;
+
+		case PRIV_OPEN_LOG:
+			logmsg(LOG_DEBUG,
+			    "[priv]: msg PRIV_OPEN_LOG received");
+			/* create or append logs but do not follow symlinks */
+			fd = open(filename,
+			    O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_NOFOLLOW,
+			    0600);
+			if (fd < 0)
+				logmsg(LOG_NOTICE,
+				    "[priv]: failed to open %s: %s",
+				    filename, strerror(errno));
+			send_fd(socks[0], fd);
+			close(fd);
+			break;
+
+		default:
+			logmsg(LOG_ERR, "[priv]: unknown command %d", cmd);
+			_exit(1);
+			/* NOTREACHED */
+		}
+	}
+
+	_exit(1);
+}
+
+/* this is called from parent */
+static int
+set_snaplen(int snap)
+{
+	if (hpcap == NULL)
+		return (1);
+
+	hpcap->snapshot = snap;
+	set_pcap_filter();
+
+	return 0;
+}
+
+
+/*
+ * send the snaplength to privileged process
+ */
+int
+priv_set_snaplen(int snaplen)
+{
+	int cmd, ret;
+
+	if (priv_fd < 0)
+		errx(1, "%s: called from privileged portion", __func__);
+
+	cmd = PRIV_SET_SNAPLEN;
+
+	must_write(priv_fd, &cmd, sizeof(int));
+	must_write(priv_fd, &snaplen, sizeof(int));
+
+	must_read(priv_fd, &ret, sizeof(int));
+
+	/* also set hpcap->snapshot in child */
+	if (ret == 0)
+		hpcap->snapshot = snaplen;
+
+	return (ret);
+}
+
+/* Open log-file */
+int
+priv_open_log(void)
+{
+	int cmd, fd;
+
+	if (priv_fd < 0)
+		errx(1, "%s: called from privileged portion\n", __func__);
+
+	cmd = PRIV_OPEN_LOG;
+	must_write(priv_fd, &cmd, sizeof(int));
+	fd = receive_fd(priv_fd);
+
+	return (fd);
+}
+
+/* If priv parent gets a TERM or HUP, pass it through to child instead */
+static void
+sig_pass_to_chld(int sig)
+{
+	int oerrno = errno;
+
+	if (child_pid != -1)
+		kill(child_pid, sig);
+	errno = oerrno;
+}
+
+/* if parent gets a SIGCHLD, it will exit */
+static void
+sig_chld(int sig)
+{
+	gotsig_chld = 1;
+}
+
+/* Read all data or return 1 for error.  */
+static int
+may_read(int fd, void *buf, size_t n)
+{
+	char *s = buf;
+	ssize_t res, pos = 0;
+
+	while (n > pos) {
+		res = read(fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+		case 0:
+			return (1);
+		default:
+			pos += res;
+		}
+	}
+	return (0);
+}
+
+/* Read data with the assertion that it all must come through, or
+ * else abort the process.  Based on atomicio() from openssh. */
+static void
+must_read(int fd, void *buf, size_t n)
+{
+	char *s = buf;
+	ssize_t res, pos = 0;
+
+	while (n > pos) {
+		res = read(fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+		case 0:
+			_exit(0);
+		default:
+			pos += res;
+		}
+	}
+}
+
+/* Write data with the assertion that it all has to be written, or
+ * else abort the process.  Based on atomicio() from openssh. */
+static void
+must_write(int fd, void *buf, size_t n)
+{
+	char *s = buf;
+	ssize_t res, pos = 0;
+
+	while (n > pos) {
+		res = write(fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+		case 0:
+			_exit(0);
+		default:
+			pos += res;
+		}
+	}
+}
diff --git a/contrib/pf/pflogd/privsep_fdpass.c b/contrib/pf/pflogd/privsep_fdpass.c
new file mode 100644
index 0000000..166b693
--- /dev/null
+++ b/contrib/pf/pflogd/privsep_fdpass.c
@@ -0,0 +1,120 @@
+/*	$OpenBSD: privsep_fdpass.c,v 1.1 2003/10/22 18:51:55 canacar Exp $	*/
+
+/*
+ * Copyright 2001 Niels Provos <provos@citi.umich.edu>
+ * All rights reserved.
+ *
+ * Copyright (c) 2002 Matthieu Herrb
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *    - Redistributions of source code must retain the above copyright
+ *      notice, this list of conditions and the following disclaimer.
+ *    - Redistributions in binary form must reproduce the above
+ *      copyright notice, this list of conditions and the following
+ *      disclaimer in the documentation and/or other materials provided
+ *      with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#include <sys/param.h>
+#include <sys/uio.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "pflogd.h"
+
+void
+send_fd(int sock, int fd)
+{
+	struct msghdr msg;
+	char tmp[CMSG_SPACE(sizeof(int))];
+	struct cmsghdr *cmsg;
+	struct iovec vec;
+	int result = 0;
+	ssize_t n;
+
+	memset(&msg, 0, sizeof(msg));
+
+	if (fd >= 0) {
+		msg.msg_control = (caddr_t)tmp;
+		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		cmsg = CMSG_FIRSTHDR(&msg);
+		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+		cmsg->cmsg_level = SOL_SOCKET;
+		cmsg->cmsg_type = SCM_RIGHTS;
+		*(int *)CMSG_DATA(cmsg) = fd;
+	} else {
+		result = errno;
+	}
+
+	vec.iov_base = &result;
+	vec.iov_len = sizeof(int);
+	msg.msg_iov = &vec;
+	msg.msg_iovlen = 1;
+
+	if ((n = sendmsg(sock, &msg, 0)) == -1)
+		warn("%s: sendmsg(%d)", __func__, sock);
+	if (n != sizeof(int))
+		warnx("%s: sendmsg: expected sent 1 got %ld",
+		    __func__, (long)n);
+}
+
+int
+receive_fd(int sock)
+{
+	struct msghdr msg;
+	char tmp[CMSG_SPACE(sizeof(int))];
+	struct cmsghdr *cmsg;
+	struct iovec vec;
+	ssize_t n;
+	int result;
+	int fd;
+
+	memset(&msg, 0, sizeof(msg));
+	vec.iov_base = &result;
+	vec.iov_len = sizeof(int);
+	msg.msg_iov = &vec;
+	msg.msg_iovlen = 1;
+	msg.msg_control = tmp;
+	msg.msg_controllen = sizeof(tmp);
+
+	if ((n = recvmsg(sock, &msg, 0)) == -1)
+		warn("%s: recvmsg", __func__);
+	if (n != sizeof(int))
+		warnx("%s: recvmsg: expected received 1 got %ld",
+		    __func__, (long)n);
+	if (result == 0) {
+		cmsg = CMSG_FIRSTHDR(&msg);
+		if (cmsg->cmsg_type != SCM_RIGHTS)
+			warnx("%s: expected type %d got %d", __func__,
+			    SCM_RIGHTS, cmsg->cmsg_type);
+		fd = (*(int *)CMSG_DATA(cmsg));
+		return fd;
+	} else {
+		errno = result;
+		return -1;
+	}
+}