X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=src%2Fiptables.c;h=72b4481cc5148ff500d6ed01076c12378a6c3932;hb=a00feb12d82ae2f46db99d0336b955f387f7f354;hp=b6aa938ea631f546fdceb221f254e36aaa9f48a1;hpb=d92c34382175773e1583810359db0d3330e0cfc7;p=collectd.git diff --git a/src/iptables.c b/src/iptables.c index b6aa938e..72b4481c 100644 --- a/src/iptables.c +++ b/src/iptables.c @@ -24,47 +24,15 @@ #include "common.h" #include "plugin.h" #include "configfile.h" -#include "utils_debug.h" #if HAVE_LIBIPTC_LIBIPTC_H # include #endif -#if HAVE_LIBIPTC_LIBIPTC_H -# define IPTABLES_HAVE_READ 1 -#else -# define IPTABLES_HAVE_READ 0 -#endif - -#define MODULE_NAME "iptables" -#define BUFSIZE 512 - /* * (Module-)Global variables */ -/* - * Removed packet count for now, should have config option if you want to save - * them Although other collectd models don't seem to care much for options - * eitherway for what to log - */ -/* Limit to ~125MByte/s (~1GBit/s) */ -static data_source_t dsrc[1] = -{ - {"value", DS_TYPE_COUNTER, 0.0, 134217728.0} -}; - -static data_set_t ipt_bytes_ds = -{ - "ipt_bytes", 1, dsrc -}; - -static data_set_t ipt_packets_ds = -{ - "ipt_packets", 1, dsrc -}; - -#if IPTABLES_HAVE_READ /* * Config format should be `Chain table chainname', * e. g. `Chain mangle incoming' @@ -120,7 +88,9 @@ static int iptables_config (const char *key, const char *value) value_copy = strdup (value); if (value_copy == NULL) { - ERROR ("strdup failed: %s", strerror (errno)); + char errbuf[1024]; + ERROR ("strdup failed: %s", + sstrerror (errno, errbuf, sizeof (errbuf))); return (1); } @@ -136,7 +106,7 @@ static int iptables_config (const char *key, const char *value) chain = fields[1]; table_len = strlen (table); - if (table_len >= sizeof(temp.table)) + if ((unsigned int)table_len >= sizeof(temp.table)) { ERROR ("Table `%s' too long.", table); free (value_copy); @@ -146,7 +116,7 @@ static int iptables_config (const char *key, const char *value) temp.table[table_len] = '\0'; chain_len = strlen (chain); - if (chain_len >= sizeof(temp.chain)) + if ((unsigned int)chain_len >= sizeof(temp.chain)) { ERROR ("Chain `%s' too long.", chain); free (value_copy); @@ -167,8 +137,12 @@ static int iptables_config (const char *key, const char *value) } else { - strncpy (temp.rule.comment, comment, - sizeof (temp.rule.comment) - 1); + temp.rule.comment = strdup (comment); + if (temp.rule.comment == NULL) + { + free (value_copy); + return (1); + } temp.rule_type = RTYPE_COMMENT; } } @@ -188,16 +162,20 @@ static int iptables_config (const char *key, const char *value) list = (ip_chain_t **) realloc (chain_list, (chain_num + 1) * sizeof (ip_chain_t *)); if (list == NULL) { - ERROR ("realloc failed: %s", strerror (errno)); - return (1); + char errbuf[1024]; + ERROR ("realloc failed: %s", + sstrerror (errno, errbuf, sizeof (errbuf))); + return (1); } chain_list = list; final = (ip_chain_t *) malloc( sizeof(temp) ); if (final == NULL) { - ERROR ("malloc failed: %s", strerror (errno)); - return (1); + char errbuf[1024]; + ERROR ("malloc failed: %s", + sstrerror (errno, errbuf, sizeof (errbuf))); + return (1); } memcpy (final, &temp, sizeof (temp)); chain_list[chain_num] = final; @@ -212,9 +190,7 @@ static int iptables_config (const char *key, const char *value) return (0); } /* int iptables_config */ -#endif /* IPTABLES_HAVE_READ */ -#if IPTABLES_HAVE_READ /* This needs to return `int' for IPT_MATCH_ITERATE to work. */ static int submit_match (const struct ipt_entry_match *match, const struct ipt_entry *entry, @@ -248,7 +224,7 @@ static int submit_match (const struct ipt_entry_match *match, status = snprintf (vl.plugin_instance, sizeof (vl.plugin_instance), "%s-%s", chain->table, chain->chain); - if ((status >= sizeof (vl.plugin_instance)) || (status < 1)) + if ((status < 1) || ((unsigned int)status >= sizeof (vl.plugin_instance))) return (0); if (chain->name[0] != '\0') @@ -308,7 +284,7 @@ static void submit_chain( iptc_handle_t *handle, ip_chain_t *chain ) { static int iptables_read (void) { int i; - static complain_t complaint; + int num_failures = 0; /* Init the iptc handle structure and query the correct table */ for (i = 0; i < chain_num; i++) @@ -319,26 +295,24 @@ static int iptables_read (void) chain = chain_list[i]; if (!chain) { - DEBUG ("chain == NULL"); + DEBUG ("iptables plugin: chain == NULL"); continue; } - handle = iptc_init( chain->table ); + handle = iptc_init (chain->table); if (!handle) { - DEBUG ("iptc_init (%s) failed: %s", chain->table, iptc_strerror (errno)); - plugin_complain (LOG_ERR, &complaint, "iptc_init (%s) failed: %s", + ERROR ("iptables plugin: iptc_init (%s) failed: %s", chain->table, iptc_strerror (errno)); + num_failures++; continue; } - plugin_relief (LOG_INFO, &complaint, "iptc_init (%s) succeeded", - chain->table); submit_chain (&handle, chain); iptc_free (&handle); - } + } /* for (i = 0 .. chain_num) */ - return (0); + return ((num_failures < chain_num) ? 0 : -1); } /* int iptables_read */ static int iptables_shutdown (void) @@ -346,28 +320,25 @@ static int iptables_shutdown (void) int i; for (i = 0; i < chain_num; i++) + { + if ((chain_list[i] != NULL) && (chain_list[i]->rule_type == RTYPE_COMMENT)) + { + sfree (chain_list[i]->rule.comment); + } sfree (chain_list[i]); + } sfree (chain_list); return (0); } /* int iptables_shutdown */ -#endif /* IPTABLES_HAVE_READ */ void module_register (void) { - plugin_register_data_set (&ipt_bytes_ds); - plugin_register_data_set (&ipt_packets_ds); - -#if IPTABLES_HAVE_READ plugin_register_config ("iptables", iptables_config, config_keys, config_keys_num); plugin_register_read ("iptables", iptables_read); plugin_register_shutdown ("iptables", iptables_shutdown); -#endif -} - -#undef BUFSIZE -#undef MODULE_NAME +} /* void module_register */ /* * vim:shiftwidth=4:softtabstop=4:tabstop=8