From 95015692958ba836f46bad24f9e0e593f1a50520 Mon Sep 17 00:00:00 2001 From: mlaier Date: Tue, 3 Jul 2007 12:22:02 +0000 Subject: Import pf userland from OpenBSD 4.1 and (for ftp-proxy) libevent 1.3b as a local lib. --- contrib/pf/pflogd/pflogd.8 | 44 +++++++++++++++++++----- contrib/pf/pflogd/pflogd.c | 74 ++++++++++++++++++++++++++------------- contrib/pf/pflogd/pflogd.h | 3 +- contrib/pf/pflogd/privsep.c | 84 ++++++++++++++++++++++++++++++++++++++------- 4 files changed, 159 insertions(+), 46 deletions(-) (limited to 'contrib/pf/pflogd') diff --git a/contrib/pf/pflogd/pflogd.8 b/contrib/pf/pflogd/pflogd.8 index d13b772..cbb7802 100644 --- a/contrib/pf/pflogd/pflogd.8 +++ b/contrib/pf/pflogd/pflogd.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: pflogd.8,v 1.25 2005/01/02 18:15:02 jmc Exp $ +.\" $OpenBSD: pflogd.8,v 1.32 2006/12/08 10:26:38 joel Exp $ .\" .\" Copyright (c) 2001 Can Erkin Acar. All rights reserved. .\" @@ -35,14 +35,17 @@ .Op Fl Dx .Op Fl d Ar delay .Op Fl f Ar filename +.Op Fl i Ar interface .Op Fl s Ar snaplen .Op Ar expression .Sh DESCRIPTION .Nm is a background daemon which reads packets logged by .Xr pf 4 -to the packet logging interface -.Pa pflog0 +to a +.Xr pflog 4 +interface, normally +.Pa pflog0 , and writes the packets to a logfile (normally .Pa /var/log/pflog ) in @@ -81,7 +84,9 @@ temporarily uses the old snaplen to keep the log file consistent. tries to preserve the integrity of the log file against I/O errors. Furthermore, integrity of an existing log file is verified before appending. -If there is an invalid log file or an I/O error, logging is suspended until a +If there is an invalid log file or an I/O error, the log file is moved +out of the way and a new one is created. +If a new file cannot be created, logging is suspended until a .Dv SIGHUP or a .Dv SIGALRM @@ -101,11 +106,19 @@ If not specified, the default is 60 seconds. Log output filename. Default is .Pa /var/log/pflog . +.It Fl i Ar interface +Specifies the +.Xr pflog 4 +interface to use. +By default, +.Nm +will use +.Ar pflog0 . .It Fl s Ar snaplen Analyze at most the first .Ar snaplen -bytes of data from each packet rather than the default of 96. -The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may +bytes of data from each packet rather than the default of 116. +The default of 116 is adequate for IP, ICMP, TCP, and UDP headers but may truncate protocol information for other protocols. Other file parsers may desire a higher snaplen. .It Fl x @@ -129,6 +142,13 @@ Log specific tcp packets to a different log file with a large snaplen # pflogd -s 1600 -f suspicious.log port 80 and host evilhost .Ed .Pp +Log from another +.Xr pflog 4 +interface, excluding specific packets: +.Bd -literal -offset indent +# pflogd -i pflog3 -f network3.log "not (tcp and port 23)" +.Ed +.Pp Display binary logs: .Bd -literal -offset indent # tcpdump -n -e -ttt -r /var/log/pflog @@ -148,7 +168,7 @@ Tcpdump can restrict the output to packets logged on a specified interface, a rule number, a reason, a direction, an IP family or an action. .Pp -.Bl -tag -width "reason match " -compact +.Bl -tag -width "ruleset authpf " -compact .It ip Address family equals IPv4. .It ip6 @@ -157,12 +177,16 @@ Address family equals IPv6. Interface name equals "kue0". .It on kue0 Interface name equals "kue0". +.It ruleset authpf +Ruleset name equals "authpf". .It rulenum 10 Rule number equals 10. .It reason match Reason equals match. Also accepts "bad-offset", "fragment", "bad-timestamp", "short", -"normalize" and "memory". +"normalize", "memory", "congestion", "ip-option", "proto-cksum", +"state-mismatch", "state-insert", "state-limit", "src-limit", +and "synproxy". .It action pass Action equals pass. Also accepts "block". @@ -190,4 +214,6 @@ The command appeared in .Ox 3.0 . .Sh AUTHORS -Can Erkin Acar +.Nm +was written by +.An Can Erkin Acar Aq canacar@openbsd.org . diff --git a/contrib/pf/pflogd/pflogd.c b/contrib/pf/pflogd/pflogd.c index cc474e3..168deb1 100644 --- a/contrib/pf/pflogd/pflogd.c +++ b/contrib/pf/pflogd/pflogd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pflogd.c,v 1.33 2005/02/09 12:09:30 henning Exp $ */ +/* $OpenBSD: pflogd.c,v 1.37 2006/10/26 13:34:47 jmc Exp $ */ /* * Copyright (c) 2001 Theo de Raadt @@ -73,7 +73,7 @@ int flush_buffer(FILE *); int init_pcap(void); void logmsg(int, const char *, ...); void purge_buffer(void); -int reset_dump(void); +int reset_dump(int); int scan_dump(FILE *, off_t); int set_snaplen(int); void set_suspended(int); @@ -82,6 +82,8 @@ void sig_close(int); void sig_hup(int); void usage(void); +static int try_reset_dump(int); + /* buffer must always be greater than snaplen */ static int bufpkt = 0; /* number of packets in buffer */ static int buflen = 0; /* allocated size of buffer */ @@ -100,8 +102,9 @@ set_suspended(int s) return; suspended = s; - setproctitle("[%s] -s %d -f %s", - suspended ? "suspended" : "running", cur_snaplen, filename); + setproctitle("[%s] -s %d -i %s -f %s", + suspended ? "suspended" : "running", + cur_snaplen, interface, filename); } char * @@ -147,8 +150,9 @@ logmsg(int pri, const char *message, ...) __dead void usage(void) { - fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename] "); - fprintf(stderr, "[-s snaplen] [expression]\n"); + fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]"); + fprintf(stderr, " [-i interface] [-s snaplen]\n"); + fprintf(stderr, " [expression]\n"); exit(1); } @@ -228,7 +232,25 @@ set_snaplen(int snap) } int -reset_dump(void) +reset_dump(int nomove) +{ + int ret; + + for (;;) { + ret = try_reset_dump(nomove); + if (ret <= 0) + break; + } + + return (ret); +} + +/* + * tries to (re)open log file, nomove flag is used with -x switch + * returns 0: success, 1: retry (log moved), -1: error + */ +int +try_reset_dump(int nomove) { struct pcap_file_header hdr; struct stat st; @@ -250,26 +272,26 @@ reset_dump(void) */ fd = priv_open_log(); if (fd < 0) - return (1); + return (-1); fp = fdopen(fd, "a+"); if (fp == NULL) { - close(fd); logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno)); - return (1); + close(fd); + return (-1); } if (fstat(fileno(fp), &st) == -1) { - fclose(fp); logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno)); - return (1); + fclose(fp); + return (-1); } /* set FILE unbuffered, we do our own buffering */ if (setvbuf(fp, NULL, _IONBF, 0)) { - fclose(fp); logmsg(LOG_ERR, "Failed to set output buffers"); - return (1); + fclose(fp); + return (-1); } #define TCPDUMP_MAGIC 0xa1b2c3d4 @@ -277,11 +299,9 @@ reset_dump(void) if (st.st_size == 0) { if (snaplen != cur_snaplen) { logmsg(LOG_NOTICE, "Using snaplen %d", snaplen); - if (set_snaplen(snaplen)) { - fclose(fp); + if (set_snaplen(snaplen)) logmsg(LOG_WARNING, "Failed, using old settings"); - } } hdr.magic = TCPDUMP_MAGIC; hdr.version_major = PCAP_VERSION_MAJOR; @@ -293,11 +313,15 @@ reset_dump(void) if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) { fclose(fp); - return (1); + return (-1); } } else if (scan_dump(fp, st.st_size)) { - /* XXX move file and continue? */ fclose(fp); + if (nomove || priv_move_log()) { + logmsg(LOG_ERR, + "Invalid/incompatible log file, move it away"); + return (-1); + } return (1); } @@ -336,7 +360,6 @@ scan_dump(FILE *fp, off_t size) hdr.version_minor != PCAP_VERSION_MINOR || hdr.linktype != hpcap->linktype || hdr.snaplen > PFLOGD_MAXSNAPLEN) { - logmsg(LOG_ERR, "Invalid/incompatible log file, move it away"); return (1); } @@ -511,7 +534,7 @@ main(int argc, char **argv) closefrom(STDERR_FILENO + 1); - while ((ch = getopt(argc, argv, "Dxd:s:f:")) != -1) { + while ((ch = getopt(argc, argv, "Dxd:f:i:s:")) != -1) { switch (ch) { case 'D': Debug = 1; @@ -524,6 +547,9 @@ main(int argc, char **argv) case 'f': filename = optarg; break; + case 'i': + interface = optarg; + break; case 's': snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN, &errstr); @@ -596,7 +622,7 @@ main(int argc, char **argv) bufpkt = 0; } - if (reset_dump()) { + if (reset_dump(Xflag) < 0) { if (Xflag) return (1); @@ -614,7 +640,7 @@ main(int argc, char **argv) if (gotsig_close) break; if (gotsig_hup) { - if (reset_dump()) { + if (reset_dump(0)) { logmsg(LOG_ERR, "Logging suspended: open error"); set_suspended(1); @@ -625,6 +651,8 @@ main(int argc, char **argv) if (gotsig_alrm) { if (dpcap) flush_buffer(dpcap); + else + gotsig_hup = 1; gotsig_alrm = 0; alarm(delay); } diff --git a/contrib/pf/pflogd/pflogd.h b/contrib/pf/pflogd/pflogd.h index 3baecb6..596e696 100644 --- a/contrib/pf/pflogd/pflogd.h +++ b/contrib/pf/pflogd/pflogd.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pflogd.h,v 1.2 2004/01/15 20:15:14 canacar Exp $ */ +/* $OpenBSD: pflogd.h,v 1.3 2006/01/15 16:38:04 canacar Exp $ */ /* * Copyright (c) 2003 Can Erkin Acar @@ -37,6 +37,7 @@ void logmsg(int priority, const char *message, ...); int priv_init(void); int priv_set_snaplen(int snaplen); int priv_open_log(void); +int priv_move_log(void); pcap_t *pcap_open_live_fd(int fd, int snaplen, char *ebuf); void set_pcap_filter(void); diff --git a/contrib/pf/pflogd/privsep.c b/contrib/pf/pflogd/privsep.c index 33d6b9c..1139cb4 100644 --- a/contrib/pf/pflogd/privsep.c +++ b/contrib/pf/pflogd/privsep.c @@ -1,4 +1,4 @@ -/* $OpenBSD: privsep.c,v 1.13 2004/12/22 09:21:02 otto Exp $ */ +/* $OpenBSD: privsep.c,v 1.16 2006/10/25 20:55:04 moritz Exp $ */ /* * Copyright (c) 2003 Can Erkin Acar @@ -16,7 +16,6 @@ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -#include #include #include #include @@ -28,6 +27,7 @@ #include #include #include +#include #include #include #include @@ -41,6 +41,7 @@ enum cmd_types { PRIV_SET_SNAPLEN, /* set the snaplength */ + PRIV_MOVE_LOG, /* move logfile away */ PRIV_OPEN_LOG /* open logfile for appending */ }; @@ -55,10 +56,8 @@ static int may_read(int, void *, size_t); static void must_read(int, void *, size_t); static void must_write(int, void *, size_t); static int set_snaplen(int snap); +static int move_log(const char *name); -/* bpf filter expression common to parent and child */ -extern char *filter; -extern char *errbuf; extern char *filename; extern pcap_t *hpcap; @@ -96,16 +95,12 @@ priv_init(void) err(1, "unable to chdir"); gidset[0] = pw->pw_gid; + if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) + err(1, "setresgid() failed"); if (setgroups(1, gidset) == -1) err(1, "setgroups() failed"); - if (setegid(pw->pw_gid) == -1) - err(1, "setegid() failed"); - if (setgid(pw->pw_gid) == -1) - err(1, "setgid() failed"); - if (seteuid(pw->pw_uid) == -1) - err(1, "seteuid() failed"); - if (setuid(pw->pw_uid) == -1) - err(1, "setuid() failed"); + if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1) + err(1, "setresuid() failed"); close(socks[0]); priv_fd = socks[1]; return 0; @@ -159,6 +154,13 @@ priv_init(void) close(fd); break; + case PRIV_MOVE_LOG: + logmsg(LOG_DEBUG, + "[priv]: msg PRIV_MOVE_LOG received"); + ret = move_log(filename); + must_write(socks[0], &ret, sizeof(int)); + break; + default: logmsg(LOG_ERR, "[priv]: unknown command %d", cmd); _exit(1); @@ -182,6 +184,47 @@ set_snaplen(int snap) return 0; } +static int +move_log(const char *name) +{ + char ren[PATH_MAX]; + int len; + + for (;;) { + int fd; + + len = snprintf(ren, sizeof(ren), "%s.bad.%08x", + name, arc4random()); + if (len >= sizeof(ren)) { + logmsg(LOG_ERR, "[priv] new name too long"); + return (1); + } + + /* lock destinanion */ + fd = open(ren, O_CREAT|O_EXCL, 0); + if (fd >= 0) { + close(fd); + break; + } + /* if file exists, try another name */ + if (errno != EEXIST && errno != EINTR) { + logmsg(LOG_ERR, "[priv] failed to create new name: %s", + strerror(errno)); + return (1); + } + } + + if (rename(name, ren)) { + logmsg(LOG_ERR, "[priv] failed to rename %s to %s: %s", + name, ren, strerror(errno)); + return (1); + } + + logmsg(LOG_NOTICE, + "[priv]: log file %s moved to %s", name, ren); + + return (0); +} /* * send the snaplength to privileged process @@ -223,6 +266,21 @@ priv_open_log(void) return (fd); } +/* Move-away and reopen log-file */ +int +priv_move_log(void) +{ + int cmd, ret; + + if (priv_fd < 0) + errx(1, "%s: called from privileged portion\n", __func__); + + cmd = PRIV_MOVE_LOG; + must_write(priv_fd, &cmd, sizeof(int)); + must_read(priv_fd, &ret, sizeof(int)); + + return (ret); +} /* If priv parent gets a TERM or HUP, pass it through to child instead */ static void -- cgit v1.1