This commit was generated by cvs2svn to compensate for changes in r130614,

which included commits to RCS files with non-trunk default branches.

4 files changed, 500 insertions, 15 deletions

diff --git a/contrib/pf/pflogd/pflogd.8 b/contrib/pf/pflogd/pflogd.8
index ab63259..ac8fe78 100644
--- a/contrib/pf/pflogd/pflogd.8
+++ b/contrib/pf/pflogd/pflogd.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: pflogd.8,v 1.22 2003/06/03 13:16:08 jmc Exp $
+.\"	$OpenBSD: pflogd.8,v 1.24 2004/01/16 10:45:49 jmc Exp $
 .\"
 .\" Copyright (c) 2001 Can Erkin Acar.  All rights reserved.
 .\"
@@ -32,7 +32,7 @@
 .Nd packet filter logging daemon
 .Sh SYNOPSIS
 .Nm pflogd
-.Op Fl D
+.Op Fl Dx
 .Op Fl d Ar delay
 .Op Fl f Ar filename
 .Op Fl s Ar snaplen
@@ -57,11 +57,11 @@ hopefully offline in case there are bugs in the packet parsing code of
 .Pp
 .Nm
 closes and then re-opens the log file when it receives
-.Va SIGHUP ,
+.Dv SIGHUP ,
 permitting
 .Xr newsyslog 8
 to rotate logfiles automatically.
-.Va SIGALRM
+.Dv SIGALRM
 causes
 .Nm
 to flush the current logfile buffers to the disk, thus making the most
@@ -71,22 +71,32 @@ The buffers are also flushed every
 seconds.
 .Pp
 If the log file contains data after a restart or a
-.Va SIGHUP ,
+.Dv SIGHUP ,
 new logs are appended to the existing file.
 If the existing log file was created with a different snaplen,
 .Nm
 temporarily uses the old snaplen to keep the log file consistent.
 .Pp
+.Nm
+tries to preserve the integrity of the log file against I/O errors.
+Furthermore, integrity of an existing log file is verified before
+appending.
+If there is an invalid log file or an I/O error, logging is suspended until a
+.Dv SIGHUP
+or a
+.Dv SIGALRM
+is received.
+.Pp
 The options are as follows:
 .Bl -tag -width Ds
-.It Fl d Ar delay
-Time in seconds to delay between automatic flushes of the file.
-This may be specified with a value between 5 and 3600 seconds.
-If not specified, the default is 60 seconds.
 .It Fl D
 Debugging mode.
 .Nm
 does not disassociate from the controlling terminal.
+.It Fl d Ar delay
+Time in seconds to delay between automatic flushes of the file.
+This may be specified with a value between 5 and 3600 seconds.
+If not specified, the default is 60 seconds.
 .It Fl f Ar filename
 Log output filename.
 Default is
@@ -98,6 +108,8 @@ bytes of data from each packet rather than the default of 96.
 The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may
 truncate protocol information for other protocols.
 Other file parsers may desire a higher snaplen.
+.It Fl x
+Check the integrity of an existing log file, and return.
 .It Ar expression
 Selects which packets will be dumped, using the regular language of
 .Xr tcpdump 8 .
@@ -106,13 +118,13 @@ Selects which packets will be dumped, using the regular language of
 .Bl -tag -width /var/run/pflogd.pid -compact
 .It Pa /var/run/pflogd.pid
 Process ID of the currently running
-.Nm pflogd .
+.Nm .
 .It Pa /var/log/pflog
 Default log file.
 .El
 .Sh EXAMPLES
 Log specific tcp packets to a different log file with a large snaplen
-(useful with a log-all rule to dump complete sessions)
+(useful with a log-all rule to dump complete sessions):
 .Bd -literal -offset indent
 # pflogd -s 1600 -f suspicious.log port 80 and host evilhost
 .Ed
@@ -123,7 +135,8 @@ Display binary logs:
 .Ed
 .Pp
 Display the logs in real time (this does not interfere with the
-operation of pflogd):
+operation of
+.Nm ) :
 .Bd -literal -offset indent
 # tcpdump -n -e -ttt -i pflog0
 .Ed
@@ -133,7 +146,7 @@ structure defined in
 .Aq Ar net/if_pflog.h .
 Tcpdump can restrict the output
 to packets logged on a specified interface, a rule number, a reason,
-a direction, an ip family or an action.
+a direction, an IP family or an action.
 .Pp
 .Bl -tag -width "reason match " -compact
 .It ip
@@ -141,9 +154,9 @@ Address family equals IPv4.
 .It ip6
 Address family equals IPv6.
 .It ifname kue0
-Interface name equals "kue0"
+Interface name equals "kue0".
 .It on kue0
-Interface name equals "kue0"
+Interface name equals "kue0".
 .It rulenum 10
 Rule number equals 10.
 .It reason match
diff --git a/contrib/pf/pflogd/pflogd.h b/contrib/pf/pflogd/pflogd.h
new file mode 100644
index 0000000..3baecb6
--- /dev/null
+++ b/contrib/pf/pflogd/pflogd.h
@@ -0,0 +1,47 @@
+/*	$OpenBSD: pflogd.h,v 1.2 2004/01/15 20:15:14 canacar Exp $ */
+
+/*
+ * Copyright (c) 2003 Can Erkin Acar
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/limits.h>
+#include <pcap.h>
+
+#define DEF_SNAPLEN 116		/* default plus allow for larger header of pflog */
+#define PCAP_TO_MS 500		/* pcap read timeout (ms) */
+#define PCAP_NUM_PKTS 1000	/* max number of packets to process at each loop */
+#define PCAP_OPT_FIL 1		/* filter optimization */
+#define FLUSH_DELAY 60		/* flush delay */
+
+#define PFLOGD_LOG_FILE		"/var/log/pflog"
+#define PFLOGD_DEFAULT_IF	"pflog0"
+
+#define PFLOGD_MAXSNAPLEN	INT_MAX
+#define PFLOGD_BUFSIZE		65536	/* buffer size for incoming packets */
+
+void  logmsg(int priority, const char *message, ...);
+
+/* Privilege separation */
+int	priv_init(void);
+int	priv_set_snaplen(int snaplen);
+int	priv_open_log(void);
+pcap_t *pcap_open_live_fd(int fd, int snaplen, char *ebuf);
+
+void set_pcap_filter(void);
+/* File descriptor send/recv */
+void send_fd(int, int);
+int  receive_fd(int);
+
+extern int Debug;
diff --git a/contrib/pf/pflogd/privsep.c b/contrib/pf/pflogd/privsep.c
new file mode 100644
index 0000000..50807ad
--- /dev/null
+++ b/contrib/pf/pflogd/privsep.c
@@ -0,0 +1,305 @@
+/*	$OpenBSD: privsep.c,v 1.8 2004/03/14 19:17:05 otto Exp $	*/
+
+/*
+ * Copyright (c) 2003 Can Erkin Acar
+ * Copyright (c) 2003 Anil Madhavapeddy <anil@recoil.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+
+#include <net/if.h>
+#include <net/bpf.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pcap.h>
+#include <pcap-int.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+#include <unistd.h>
+#include "pflogd.h"
+
+enum cmd_types {
+	PRIV_SET_SNAPLEN,	/* set the snaplength */
+	PRIV_OPEN_LOG		/* open logfile for appending */
+};
+
+static int priv_fd = -1;
+static volatile pid_t child_pid = -1;
+
+volatile sig_atomic_t gotsig_chld = 0;
+
+static void sig_pass_to_chld(int);
+static void sig_chld(int);
+static int  may_read(int, void *, size_t);
+static void must_read(int, void *, size_t);
+static void must_write(int, void *, size_t);
+static int  set_snaplen(int snap);
+
+/* bpf filter expression common to parent and child */
+extern char *filter;
+extern char *errbuf;
+extern char *filename;
+extern pcap_t *hpcap;
+
+/* based on syslogd privsep */
+int
+priv_init(void)
+{
+	int i, fd, socks[2], cmd;
+	int snaplen, ret;
+	struct passwd *pw;
+
+	for (i = 1; i < _NSIG; i++)
+		signal(i, SIG_DFL);
+
+	/* Create sockets */
+	if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, socks) == -1)
+		err(1, "socketpair() failed");
+
+	pw = getpwnam("_pflogd");
+	if (pw == NULL)
+		errx(1, "unknown user _pflogd");
+	endpwent();
+
+	child_pid = fork();
+	if (child_pid < 0)
+		err(1, "fork() failed");
+
+	if (!child_pid) {
+		gid_t gidset[1];
+
+		/* Child - drop privileges and return */
+		if (chroot(pw->pw_dir) != 0)
+			err(1, "unable to chroot");
+		if (chdir("/") != 0)
+			err(1, "unable to chdir");
+
+		gidset[0] = pw->pw_gid;
+		if (setgroups(1, gidset) == -1)
+			err(1, "setgroups() failed");
+		if (setegid(pw->pw_gid) == -1)
+			err(1, "setegid() failed");
+		if (setgid(pw->pw_gid) == -1)
+			err(1, "setgid() failed");
+		if (seteuid(pw->pw_uid) == -1)
+			err(1, "seteuid() failed");
+		if (setuid(pw->pw_uid) == -1)
+			err(1, "setuid() failed");
+		close(socks[0]);
+		priv_fd = socks[1];
+		return 0;
+	}
+
+	/* Father */
+	/* Pass ALRM/TERM/HUP through to child, and accept CHLD */
+	signal(SIGALRM, sig_pass_to_chld);
+	signal(SIGTERM, sig_pass_to_chld);
+	signal(SIGHUP,  sig_pass_to_chld);
+	signal(SIGCHLD, sig_chld);
+
+	setproctitle("[priv]");
+	close(socks[1]);
+
+	while (!gotsig_chld) {
+		if (may_read(socks[0], &cmd, sizeof(int)))
+			break;
+		switch (cmd) {
+		case PRIV_SET_SNAPLEN:
+			logmsg(LOG_DEBUG,
+			    "[priv]: msg PRIV_SET_SNAPLENGTH received");
+			must_read(socks[0], &snaplen, sizeof(int));
+
+			ret = set_snaplen(snaplen);
+			if (ret) {
+				logmsg(LOG_NOTICE,
+				   "[priv]: set_snaplen failed for snaplen %d",
+				   snaplen);
+			}
+
+			must_write(socks[0], &ret, sizeof(int));
+			break;
+
+		case PRIV_OPEN_LOG:
+			logmsg(LOG_DEBUG,
+			    "[priv]: msg PRIV_OPEN_LOG received");
+			/* create or append logs but do not follow symlinks */
+			fd = open(filename,
+			    O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_NOFOLLOW,
+			    0600);
+			if (fd < 0)
+				logmsg(LOG_NOTICE,
+				    "[priv]: failed to open %s: %s",
+				    filename, strerror(errno));
+			send_fd(socks[0], fd);
+			close(fd);
+			break;
+
+		default:
+			logmsg(LOG_ERR, "[priv]: unknown command %d", cmd);
+			_exit(1);
+			/* NOTREACHED */
+		}
+	}
+
+	_exit(1);
+}
+
+/* this is called from parent */
+static int
+set_snaplen(int snap)
+{
+	if (hpcap == NULL)
+		return (1);
+
+	hpcap->snapshot = snap;
+	set_pcap_filter();
+
+	return 0;
+}
+
+
+/*
+ * send the snaplength to privileged process
+ */
+int
+priv_set_snaplen(int snaplen)
+{
+	int cmd, ret;
+
+	if (priv_fd < 0)
+		errx(1, "%s: called from privileged portion", __func__);
+
+	cmd = PRIV_SET_SNAPLEN;
+
+	must_write(priv_fd, &cmd, sizeof(int));
+	must_write(priv_fd, &snaplen, sizeof(int));
+
+	must_read(priv_fd, &ret, sizeof(int));
+
+	/* also set hpcap->snapshot in child */
+	if (ret == 0)
+		hpcap->snapshot = snaplen;
+
+	return (ret);
+}
+
+/* Open log-file */
+int
+priv_open_log(void)
+{
+	int cmd, fd;
+
+	if (priv_fd < 0)
+		errx(1, "%s: called from privileged portion\n", __func__);
+
+	cmd = PRIV_OPEN_LOG;
+	must_write(priv_fd, &cmd, sizeof(int));
+	fd = receive_fd(priv_fd);
+
+	return (fd);
+}
+
+/* If priv parent gets a TERM or HUP, pass it through to child instead */
+static void
+sig_pass_to_chld(int sig)
+{
+	int oerrno = errno;
+
+	if (child_pid != -1)
+		kill(child_pid, sig);
+	errno = oerrno;
+}
+
+/* if parent gets a SIGCHLD, it will exit */
+static void
+sig_chld(int sig)
+{
+	gotsig_chld = 1;
+}
+
+/* Read all data or return 1 for error.  */
+static int
+may_read(int fd, void *buf, size_t n)
+{
+	char *s = buf;
+	ssize_t res, pos = 0;
+
+	while (n > pos) {
+		res = read(fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+		case 0:
+			return (1);
+		default:
+			pos += res;
+		}
+	}
+	return (0);
+}
+
+/* Read data with the assertion that it all must come through, or
+ * else abort the process.  Based on atomicio() from openssh. */
+static void
+must_read(int fd, void *buf, size_t n)
+{
+	char *s = buf;
+	ssize_t res, pos = 0;
+
+	while (n > pos) {
+		res = read(fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+		case 0:
+			_exit(0);
+		default:
+			pos += res;
+		}
+	}
+}
+
+/* Write data with the assertion that it all has to be written, or
+ * else abort the process.  Based on atomicio() from openssh. */
+static void
+must_write(int fd, void *buf, size_t n)
+{
+	char *s = buf;
+	ssize_t res, pos = 0;
+
+	while (n > pos) {
+		res = write(fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR || errno == EAGAIN)
+				continue;
+		case 0:
+			_exit(0);
+		default:
+			pos += res;
+		}
+	}
+}
diff --git a/contrib/pf/pflogd/privsep_fdpass.c b/contrib/pf/pflogd/privsep_fdpass.c
new file mode 100644
index 0000000..166b693
--- /dev/null
+++ b/contrib/pf/pflogd/privsep_fdpass.c
@@ -0,0 +1,120 @@
+/*	$OpenBSD: privsep_fdpass.c,v 1.1 2003/10/22 18:51:55 canacar Exp $	*/
+
+/*
+ * Copyright 2001 Niels Provos <provos@citi.umich.edu>
+ * All rights reserved.
+ *
+ * Copyright (c) 2002 Matthieu Herrb
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *    - Redistributions of source code must retain the above copyright
+ *      notice, this list of conditions and the following disclaimer.
+ *    - Redistributions in binary form must reproduce the above
+ *      copyright notice, this list of conditions and the following
+ *      disclaimer in the documentation and/or other materials provided
+ *      with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#include <sys/param.h>
+#include <sys/uio.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "pflogd.h"
+
+void
+send_fd(int sock, int fd)
+{
+	struct msghdr msg;
+	char tmp[CMSG_SPACE(sizeof(int))];
+	struct cmsghdr *cmsg;
+	struct iovec vec;
+	int result = 0;
+	ssize_t n;
+
+	memset(&msg, 0, sizeof(msg));
+
+	if (fd >= 0) {
+		msg.msg_control = (caddr_t)tmp;
+		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		cmsg = CMSG_FIRSTHDR(&msg);
+		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+		cmsg->cmsg_level = SOL_SOCKET;
+		cmsg->cmsg_type = SCM_RIGHTS;
+		*(int *)CMSG_DATA(cmsg) = fd;
+	} else {
+		result = errno;
+	}
+
+	vec.iov_base = &result;
+	vec.iov_len = sizeof(int);
+	msg.msg_iov = &vec;
+	msg.msg_iovlen = 1;
+
+	if ((n = sendmsg(sock, &msg, 0)) == -1)
+		warn("%s: sendmsg(%d)", __func__, sock);
+	if (n != sizeof(int))
+		warnx("%s: sendmsg: expected sent 1 got %ld",
+		    __func__, (long)n);
+}
+
+int
+receive_fd(int sock)
+{
+	struct msghdr msg;
+	char tmp[CMSG_SPACE(sizeof(int))];
+	struct cmsghdr *cmsg;
+	struct iovec vec;
+	ssize_t n;
+	int result;
+	int fd;
+
+	memset(&msg, 0, sizeof(msg));
+	vec.iov_base = &result;
+	vec.iov_len = sizeof(int);
+	msg.msg_iov = &vec;
+	msg.msg_iovlen = 1;
+	msg.msg_control = tmp;
+	msg.msg_controllen = sizeof(tmp);
+
+	if ((n = recvmsg(sock, &msg, 0)) == -1)
+		warn("%s: recvmsg", __func__);
+	if (n != sizeof(int))
+		warnx("%s: recvmsg: expected received 1 got %ld",
+		    __func__, (long)n);
+	if (result == 0) {
+		cmsg = CMSG_FIRSTHDR(&msg);
+		if (cmsg->cmsg_type != SCM_RIGHTS)
+			warnx("%s: expected type %d got %d", __func__,
+			    SCM_RIGHTS, cmsg->cmsg_type);
+		fd = (*(int *)CMSG_DATA(cmsg));
+		return fd;
+	} else {
+		errno = result;
+		return -1;
+	}
+}