dist/pf/sbin/pflogd/pflogd.c

   1 /*      $NetBSD: pflogd.c,v 1.6 2009/07/15 18:05:17 christos Exp $      */
   2 /*      $OpenBSD: pflogd.c,v 1.45 2007/06/06 14:11:26 henning Exp $     */
   3
   4 /*
   5  * Copyright (c) 2001 Theo de Raadt
   6  * Copyright (c) 2001 Can Erkin Acar
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  *    - Redistributions of source code must retain the above copyright
  14  *      notice, this list of conditions and the following disclaimer.
  15  *    - Redistributions in binary form must reproduce the above
  16  *      copyright notice, this list of conditions and the following
  17  *      disclaimer in the documentation and/or other materials provided
  18  *      with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  */
  33
  34 #include <sys/types.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/file.h>
  37 #include <sys/stat.h>
  38 #include <sys/socket.h>
  39 #include <net/if.h>
  40 #include <stdio.h>
  41 #include <stdlib.h>
  42 #include <string.h>
  43 #include <unistd.h>
  44 /*
  45  * If we're going to include parts of the libpcap internals we MUST
  46  * set the feature-test macros they expect, or they may misbehave.
  47  */
  48 #define HAVE_STRLCPY
  49 #define HAVE_SNPRINTF
  50 #define HAVE_VSNPRINTF
  51 #include <pcap-int.h>
  52 #include <pcap.h>
  53 #include <syslog.h>
  54 #include <signal.h>
  55 #include <err.h>
  56 #include <errno.h>
  57 #include <stdarg.h>
  58 #include <fcntl.h>
  59 #include <util.h>
  60 #include "pflogd.h"
  61
  62 pcap_t *hpcap;
  63 static FILE *dpcap;
  64
  65 int Debug = 0;
  66 static int snaplen = DEF_SNAPLEN;
  67 static int cur_snaplen = DEF_SNAPLEN;
  68
  69 volatile sig_atomic_t gotsig_close, gotsig_alrm, gotsig_hup;
  70
  71 char *filename = PFLOGD_LOG_FILE;
  72 char *interface = PFLOGD_DEFAULT_IF;
  73 char *filter = NULL;
  74
  75 char errbuf[PCAP_ERRBUF_SIZE];
  76
  77 int log_debug = 0;
  78 unsigned int delay = FLUSH_DELAY;
  79
  80 char *copy_argv(char * const *);
  81 void  dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
  82 void  dump_packet_nobuf(u_char *, const struct pcap_pkthdr *, const u_char *);
  83 int   flush_buffer(FILE *);
  84 int   if_exists(char *);
  85 int   init_pcap(void);
  86 void  logmsg(int, const char *, ...);
  87 void  purge_buffer(void);
  88 int   reset_dump(int);
  89 int   scan_dump(FILE *, off_t);
  90 int   set_snaplen(int);
  91 void  set_suspended(int);
  92 void  sig_alrm(int);
  93 void  sig_close(int);
  94 void  sig_hup(int);
  95 void  usage(void);
  96
  97 static int try_reset_dump(int);
  98
  99 /* buffer must always be greater than snaplen */
 100 static int    bufpkt = 0;       /* number of packets in buffer */
 101 static int    buflen = 0;       /* allocated size of buffer */
 102 static char  *buffer = NULL;    /* packet buffer */
 103 static char  *bufpos = NULL;    /* position in buffer */
 104 static int    bufleft = 0;      /* bytes left in buffer */
 105
 106 /* if error, stop logging but count dropped packets */
 107 static int suspended = -1;
 108 static long packets_dropped = 0;
 109
 110 void
 111 set_suspended(int s)
 112 {
 113         if (suspended == s)
 114                 return;
 115
 116         suspended = s;
 117         setproctitle("[%s] -s %d -i %s -f %s",
 118             suspended ? "suspended" : "running",
 119             cur_snaplen, interface, filename);
 120 }
 121
 122 char *
 123 copy_argv(char * const *argv)
 124 {
 125         size_t len = 0, n;
 126         char *buf;
 127
 128         if (argv == NULL)
 129                 return (NULL);
 130
 131         for (n = 0; argv[n]; n++)
 132                 len += strlen(argv[n])+1;
 133         if (len == 0)
 134                 return (NULL);
 135
 136         buf = malloc(len);
 137         if (buf == NULL)
 138                 return (NULL);
 139
 140         strlcpy(buf, argv[0], len);
 141         for (n = 1; argv[n]; n++) {
 142                 strlcat(buf, " ", len);
 143                 strlcat(buf, argv[n], len);
 144         }
 145         return (buf);
 146 }
 147
 148 void
 149 logmsg(int pri, const char *message, ...)
 150 {
 151         va_list ap;
 152         va_start(ap, message);
 153
 154         if (log_debug) {
 155                 vfprintf(stderr, message, ap);
 156                 fprintf(stderr, "\n");
 157         } else
 158                 vsyslog(pri, message, ap);
 159         va_end(ap);
 160 }
 161
 162 __dead void
 163 usage(void)
 164 {
 165         fprintf(stderr, "usage: pflogd [-Dx] [-d delay] [-f filename]");
 166         fprintf(stderr, " [-i interface] [-p pidfile]\n");
 167         fprintf(stderr, "              [-s snaplen] [expression]\n");
 168         exit(1);
 169 }
 170
 171 void
 172 sig_close(int sig)
 173 {
 174         gotsig_close = 1;
 175 }
 176
 177 void
 178 sig_hup(int sig)
 179 {
 180         gotsig_hup = 1;
 181 }
 182
 183 void
 184 sig_alrm(int sig)
 185 {
 186         gotsig_alrm = 1;
 187 }
 188
 189 void
 190 set_pcap_filter(void)
 191 {
 192         struct bpf_program bprog;
 193
 194         if (pcap_compile(hpcap, &bprog, filter, PCAP_OPT_FIL, 0) < 0)
 195                 logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
 196         else {
 197                 if (pcap_setfilter(hpcap, &bprog) < 0)
 198                         logmsg(LOG_WARNING, "%s", pcap_geterr(hpcap));
 199                 pcap_freecode(&bprog);
 200         }
 201 }
 202
 203 int
 204 if_exists(char *ifname)
 205 {
 206         int s;
 207 #ifdef SIOCGIFDATA
 208         struct ifdatareq ifr;
 209 #define ifr_name ifdr_name
 210 #else
 211         struct ifreq ifr;
 212         struct if_data ifrdat;
 213 #endif
 214
 215         if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
 216                 err(1, "socket");
 217         bzero(&ifr, sizeof(ifr));
 218         if (strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)) >=
 219                 sizeof(ifr.ifr_name))
 220                         errx(1, "main ifr_name: strlcpy");
 221 #ifndef ifr_name
 222         ifr.ifr_data = (caddr_t)&ifrdat;
 223 #endif
 224         if (ioctl(s, SIOCGIFDATA, (caddr_t)&ifr) == -1)
 225                 return (0);
 226         if (close(s))
 227                 err(1, "close");
 228
 229         return (1);
 230 }
 231
 232 int
 233 init_pcap(void)
 234 {
 235         hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
 236         if (hpcap == NULL) {
 237                 logmsg(LOG_ERR, "Failed to initialize: %s", errbuf);
 238                 return (-1);
 239         }
 240
 241         if (pcap_datalink(hpcap) != DLT_PFLOG) {
 242                 logmsg(LOG_ERR, "Invalid datalink type");
 243                 pcap_close(hpcap);
 244                 hpcap = NULL;
 245                 return (-1);
 246         }
 247
 248         set_pcap_filter();
 249
 250         cur_snaplen = snaplen = pcap_snapshot(hpcap);
 251
 252         /* lock */
 253 #ifdef __OpenBSD__
 254         if (ioctl(pcap_fileno(hpcap), BIOCLOCK) < 0) {
 255                 logmsg(LOG_ERR, "BIOCLOCK: %s", strerror(errno));
 256                 return (-1);
 257         }
 258 #endif
 259
 260         return (0);
 261 }
 262
 263 int
 264 set_snaplen(int snap)
 265 {
 266         if (priv_set_snaplen(snap))
 267                 return (1);
 268
 269         if (cur_snaplen > snap)
 270                 purge_buffer();
 271
 272         cur_snaplen = snap;
 273
 274         return (0);
 275 }
 276
 277 int
 278 reset_dump(int nomove)
 279 {
 280         int ret;
 281
 282         for (;;) {
 283                 ret = try_reset_dump(nomove);
 284                 if (ret <= 0)
 285                         break;
 286         }
 287
 288         return (ret);
 289 }
 290
 291 /*
 292  * tries to (re)open log file, nomove flag is used with -x switch
 293  * returns 0: success, 1: retry (log moved), -1: error
 294  */
 295 int
 296 try_reset_dump(int nomove)
 297 {
 298         struct pcap_file_header hdr;
 299         struct stat st;
 300         int fd;
 301         FILE *fp;
 302
 303         if (hpcap == NULL)
 304                 return (-1);
 305
 306         if (dpcap) {
 307                 flush_buffer(dpcap);
 308                 fclose(dpcap);
 309                 dpcap = NULL;
 310         }
 311
 312         /*
 313          * Basically reimplement pcap_dump_open() because it truncates
 314          * files and duplicates headers and such.
 315          */
 316         fd = priv_open_log();
 317         if (fd < 0)
 318                 return (-1);
 319
 320         fp = fdopen(fd, "a+");
 321
 322         if (fp == NULL) {
 323                 logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
 324                 close(fd);
 325                 return (-1);
 326         }
 327         if (fstat(fileno(fp), &st) == -1) {
 328                 logmsg(LOG_ERR, "Error: %s: %s", filename, strerror(errno));
 329                 fclose(fp);
 330                 return (-1);
 331         }
 332
 333         /* set FILE unbuffered, we do our own buffering */
 334         if (setvbuf(fp, NULL, _IONBF, 0)) {
 335                 logmsg(LOG_ERR, "Failed to set output buffers");
 336                 fclose(fp);
 337                 return (-1);
 338         }
 339
 340 #define TCPDUMP_MAGIC 0xa1b2c3d4
 341
 342         if (st.st_size == 0) {
 343                 if (snaplen != cur_snaplen) {
 344                         logmsg(LOG_NOTICE, "Using snaplen %d", snaplen);
 345                         if (set_snaplen(snaplen))
 346                                 logmsg(LOG_WARNING,
 347                                     "Failed, using old settings");
 348                 }
 349                 hdr.magic = TCPDUMP_MAGIC;
 350                 hdr.version_major = PCAP_VERSION_MAJOR;
 351                 hdr.version_minor = PCAP_VERSION_MINOR;
 352                 hdr.thiszone = hpcap->tzoff;
 353                 hdr.snaplen = hpcap->snapshot;
 354                 hdr.sigfigs = 0;
 355                 hdr.linktype = hpcap->linktype;
 356
 357                 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
 358                         fclose(fp);
 359                         return (-1);
 360                 }
 361         } else if (scan_dump(fp, st.st_size)) {
 362                 fclose(fp);
 363                 if (nomove || priv_move_log()) {
 364                         logmsg(LOG_ERR,
 365                             "Invalid/incompatible log file, move it away");
 366                         return (-1);
 367                 }
 368                 return (1);
 369         }
 370
 371         dpcap = fp;
 372
 373         set_suspended(0);
 374         flush_buffer(fp);
 375
 376         return (0);
 377 }
 378
 379 int
 380 scan_dump(FILE *fp, off_t size)
 381 {
 382         struct pcap_file_header hdr;
 383 #ifdef __OpenBSD__
 384         struct pcap_pkthdr ph;
 385 #else
 386         struct pcap_sf_pkthdr ph;
 387 #endif
 388         off_t pos;
 389
 390         /*
 391          * Must read the file, compare the header against our new
 392          * options (in particular, snaplen) and adjust our options so
 393          * that we generate a correct file. Furthermore, check the file
 394          * for consistency so that we can append safely.
 395          *
 396          * XXX this may take a long time for large logs.
 397          */
 398         (void) fseek(fp, 0L, SEEK_SET);
 399
 400         if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) {
 401                 logmsg(LOG_ERR, "Short file header");
 402                 return (1);
 403         }
 404
 405         if (hdr.magic != TCPDUMP_MAGIC ||
 406             hdr.version_major != PCAP_VERSION_MAJOR ||
 407             hdr.version_minor != PCAP_VERSION_MINOR ||
 408             hdr.linktype != hpcap->linktype ||
 409             hdr.snaplen > PFLOGD_MAXSNAPLEN) {
 410                 return (1);
 411         }
 412
 413         pos = sizeof(hdr);
 414
 415         while (!feof(fp)) {
 416                 off_t len = fread((char *)&ph, 1, sizeof(ph), fp);
 417                 if (len == 0)
 418                         break;
 419
 420                 if (len != sizeof(ph))
 421                         goto error;
 422                 if (ph.caplen > hdr.snaplen || ph.caplen > PFLOGD_MAXSNAPLEN)
 423                         goto error;
 424                 pos += sizeof(ph) + ph.caplen;
 425                 if (pos > size)
 426                         goto error;
 427                 fseek(fp, ph.caplen, SEEK_CUR);
 428         }
 429
 430         if (pos != size)
 431                 goto error;
 432
 433         if (hdr.snaplen != cur_snaplen) {
 434                 logmsg(LOG_WARNING,
 435                        "Existing file has different snaplen %u, using it",
 436                        hdr.snaplen);
 437                 if (set_snaplen(hdr.snaplen)) {
 438                         logmsg(LOG_WARNING,
 439                                "Failed, using old settings, offset %llu",
 440                                (unsigned long long) size);
 441                 }
 442         }
 443
 444         return (0);
 445
 446  error:
 447         logmsg(LOG_ERR, "Corrupted log file.");
 448         return (1);
 449 }
 450
 451 /* dump a packet directly to the stream, which is unbuffered */
 452 void
 453 dump_packet_nobuf(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 454 {
 455 #ifndef __OpenBSD__
 456         struct pcap_sf_pkthdr sf_hdr;
 457 #endif
 458         FILE *f = (FILE *)user;
 459
 460         if (suspended) {
 461                 packets_dropped++;
 462                 return;
 463         }
 464
 465 #ifndef __OpenBSD__
 466         sf_hdr.ts.tv_sec  = h->ts.tv_sec;
 467         sf_hdr.ts.tv_usec = h->ts.tv_usec;
 468         sf_hdr.caplen     = h->caplen;
 469         sf_hdr.len        = h->len;
 470 #endif
 471
 472 #ifdef __OpenBSD__
 473         if (fwrite((char *)h, sizeof(*h), 1, f) != 1) {
 474 #else
 475         if (fwrite(&sf_hdr, sizeof(sf_hdr), 1, f) != 1) {
 476 #endif
 477                 /* try to undo header to prevent corruption */
 478                 off_t pos = ftello(f);
 479 #ifdef __OpenBSD__
 480                 if (pos < sizeof(*h) ||
 481                     ftruncate(fileno(f), pos - sizeof(*h))) {
 482 #else
 483                 if (pos < sizeof(sf_hdr) ||
 484                     ftruncate(fileno(f), pos - sizeof(sf_hdr))) {
 485 #endif
 486                         logmsg(LOG_ERR, "Write failed, corrupted logfile!");
 487                         set_suspended(1);
 488                         gotsig_close = 1;
 489                         return;
 490                 }
 491                 goto error;
 492         }
 493
 494         if (fwrite((char *)sp, h->caplen, 1, f) != 1)
 495                 goto error;
 496
 497         return;
 498
 499 error:
 500         set_suspended(1);
 501         packets_dropped ++;
 502         logmsg(LOG_ERR, "Logging suspended: fwrite: %s", strerror(errno));
 503 }
 504
 505 int
 506 flush_buffer(FILE *f)
 507 {
 508         off_t offset;
 509         int len = bufpos - buffer;
 510
 511         if (len <= 0)
 512                 return (0);
 513
 514         offset = ftello(f);
 515         if (offset == (off_t)-1) {
 516                 set_suspended(1);
 517                 logmsg(LOG_ERR, "Logging suspended: ftello: %s",
 518                     strerror(errno));
 519                 return (1);
 520         }
 521
 522         if (fwrite(buffer, len, 1, f) != 1) {
 523                 set_suspended(1);
 524                 logmsg(LOG_ERR, "Logging suspended: fwrite: %s",
 525                     strerror(errno));
 526                 ftruncate(fileno(f), offset);
 527                 return (1);
 528         }
 529
 530         set_suspended(0);
 531         bufpos = buffer;
 532         bufleft = buflen;
 533         bufpkt = 0;
 534
 535         return (0);
 536 }
 537
 538 void
 539 purge_buffer(void)
 540 {
 541         packets_dropped += bufpkt;
 542
 543         set_suspended(0);
 544         bufpos = buffer;
 545         bufleft = buflen;
 546         bufpkt = 0;
 547 }
 548
 549 /* append packet to the buffer, flushing if necessary */
 550 void
 551 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 552 {
 553         FILE *f = (FILE *)user;
 554 #ifdef __OpenBSD__
 555         size_t len = sizeof(*h) + h->caplen;
 556 #else
 557         struct pcap_sf_pkthdr sf_hdr;
 558         size_t len = sizeof(sf_hdr) + h->caplen;
 559 #endif
 560
 561         if (len < sizeof(*h) || h->caplen > (size_t)cur_snaplen) {
 562                 logmsg(LOG_NOTICE, "invalid size %u (%u/%u), packet dropped",
 563                        len, cur_snaplen, snaplen);
 564                 packets_dropped++;
 565                 return;
 566         }
 567
 568         if (len <= bufleft)
 569                 goto append;
 570
 571         if (suspended) {
 572                 packets_dropped++;
 573                 return;
 574         }
 575
 576         if (flush_buffer(f)) {
 577                 packets_dropped++;
 578                 return;
 579         }
 580
 581         if (len > bufleft) {
 582                 dump_packet_nobuf(user, h, sp);
 583                 return;
 584         }
 585
 586  append:
 587 #ifdef __OpenBSD__
 588         memcpy(bufpos, h, sizeof(*h));
 589         memcpy(bufpos + sizeof(*h), sp, h->caplen);
 590 #else
 591         sf_hdr.ts.tv_sec  = h->ts.tv_sec;
 592         sf_hdr.ts.tv_usec = h->ts.tv_usec;
 593         sf_hdr.caplen     = h->caplen;
 594         sf_hdr.len        = h->len;
 595
 596         memcpy(bufpos, &sf_hdr, sizeof(sf_hdr));
 597         memcpy(bufpos + sizeof(sf_hdr), sp, h->caplen);
 598 #endif
 599
 600         bufpos += len;
 601         bufleft -= len;
 602         bufpkt++;
 603
 604         return;
 605 }
 606
 607 int
 608 main(int argc, char **argv)
 609 {
 610         struct pcap_stat pstat;
 611         int ch, np, ret, Xflag = 0;
 612         pcap_handler phandler = dump_packet;
 613         const char *errstr = NULL;
 614         char *pidf = NULL;
 615
 616         ret = 0;
 617
 618         closefrom(STDERR_FILENO + 1);
 619
 620         while ((ch = getopt(argc, argv, "Dxd:f:i:p:s:")) != -1) {
 621                 switch (ch) {
 622                 case 'D':
 623                         Debug = 1;
 624                         break;
 625                 case 'd':
 626                         delay = strtonum(optarg, 5, 60*60, &errstr);
 627                         if (errstr)
 628                                 usage();
 629                         break;
 630                 case 'f':
 631                         filename = optarg;
 632                         break;
 633                 case 'i':
 634                         interface = optarg;
 635                         break;
 636                 case 'p':
 637                         pidf = optarg;
 638                         break;
 639                 case 's':
 640                         snaplen = strtonum(optarg, 0, PFLOGD_MAXSNAPLEN,
 641                             &errstr);
 642                         if (snaplen <= 0)
 643                                 snaplen = DEF_SNAPLEN;
 644                         if (errstr)
 645                                 snaplen = PFLOGD_MAXSNAPLEN;
 646                         break;
 647                 case 'x':
 648                         Xflag++;
 649                         break;
 650                 default:
 651                         usage();
 652                 }
 653
 654         }
 655
 656         log_debug = Debug;
 657         argc -= optind;
 658         argv += optind;
 659
 660         /* does interface exist */
 661         if (!if_exists(interface)) {
 662                 warn("Failed to initialize: %s", interface);
 663                 logmsg(LOG_ERR, "Failed to initialize: %s", interface);
 664                 logmsg(LOG_ERR, "Exiting, init failure");
 665                 exit(1);
 666         }
 667
 668         if (!Debug) {
 669                 openlog("pflogd", LOG_PID | LOG_CONS, LOG_DAEMON);
 670                 if (daemon(0, 0)) {
 671                         logmsg(LOG_WARNING, "Failed to become daemon: %s",
 672                             strerror(errno));
 673                 }
 674                 pidfile(pidf);
 675         }
 676
 677         tzset();
 678         (void)umask(S_IRWXG | S_IRWXO);
 679
 680         /* filter will be used by the privileged process */
 681         if (argc) {
 682                 filter = copy_argv(argv);
 683                 if (filter == NULL)
 684                         logmsg(LOG_NOTICE, "Failed to form filter expression");
 685         }
 686
 687         /* initialize pcap before dropping privileges */
 688         if (init_pcap()) {
 689                 logmsg(LOG_ERR, "Exiting, init failure");
 690                 exit(1);
 691         }
 692
 693         /* Privilege separation begins here */
 694         if (priv_init()) {
 695                 logmsg(LOG_ERR, "unable to privsep");
 696                 exit(1);
 697         }
 698
 699         setproctitle("[initializing]");
 700         /* Process is now unprivileged and inside a chroot */
 701         signal(SIGTERM, sig_close);
 702         signal(SIGINT, sig_close);
 703         signal(SIGQUIT, sig_close);
 704         signal(SIGALRM, sig_alrm);
 705         signal(SIGHUP, sig_hup);
 706         alarm(delay);
 707
 708         buffer = malloc(PFLOGD_BUFSIZE);
 709
 710         if (buffer == NULL) {
 711                 logmsg(LOG_WARNING, "Failed to allocate output buffer");
 712                 phandler = dump_packet_nobuf;
 713         } else {
 714                 bufleft = buflen = PFLOGD_BUFSIZE;
 715                 bufpos = buffer;
 716                 bufpkt = 0;
 717         }
 718
 719         if (reset_dump(Xflag) < 0) {
 720                 if (Xflag)
 721                         return (1);
 722
 723                 logmsg(LOG_ERR, "Logging suspended: open error");
 724                 set_suspended(1);
 725         } else if (Xflag)
 726                 return (0);
 727
 728         while (1) {
 729                 np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
 730                     phandler, (u_char *)dpcap);
 731                 if (np < 0) {
 732                         if (!if_exists(interface) == -1) {
 733                                 logmsg(LOG_NOTICE, "interface %s went away",
 734                                     interface);
 735                                 ret = -1;
 736                                 break;
 737                         }
 738                         logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
 739                 }
 740
 741                 if (gotsig_close)
 742                         break;
 743                 if (gotsig_hup) {
 744                         if (reset_dump(0)) {
 745                                 logmsg(LOG_ERR,
 746                                     "Logging suspended: open error");
 747                                 set_suspended(1);
 748                         }
 749                         gotsig_hup = 0;
 750                 }
 751
 752                 if (gotsig_alrm) {
 753                         if (dpcap)
 754                                 flush_buffer(dpcap);
 755                         else
 756                                 gotsig_hup = 1;
 757                         gotsig_alrm = 0;
 758                         alarm(delay);
 759                 }
 760         }
 761
 762         logmsg(LOG_NOTICE, "Exiting");
 763         if (dpcap) {
 764                 flush_buffer(dpcap);
 765                 fclose(dpcap);
 766         }
 767         purge_buffer();
 768
 769         if (pcap_stats(hpcap, &pstat) < 0)
 770                 logmsg(LOG_WARNING, "Reading stats: %s", pcap_geterr(hpcap));
 771         else
 772                 logmsg(LOG_NOTICE,
 773                     "%u packets received, %u/%u dropped (kernel/pflogd)",
 774                     pstat.ps_recv, pstat.ps_drop, packets_dropped);
 775
 776         pcap_close(hpcap);
 777         if (!Debug)
 778                 closelog();
 779         return (ret);
 780 }