X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=src%2Fiptables.c;h=e1694af3475407ae75ba98de73e8b48598e63a56;hb=ee9507500f738d21858f76128501772d212c069c;hp=b6aa938ea631f546fdceb221f254e36aaa9f48a1;hpb=d92c34382175773e1583810359db0d3330e0cfc7;p=collectd.git diff --git a/src/iptables.c b/src/iptables.c index b6aa938e..e1694af3 100644 --- a/src/iptables.c +++ b/src/iptables.c @@ -24,47 +24,17 @@ #include "common.h" #include "plugin.h" #include "configfile.h" -#include "utils_debug.h" -#if HAVE_LIBIPTC_LIBIPTC_H -# include -#endif - -#if HAVE_LIBIPTC_LIBIPTC_H -# define IPTABLES_HAVE_READ 1 +#if OWN_LIBIPTC +# include "libiptc/libiptc.h" #else -# define IPTABLES_HAVE_READ 0 +# include #endif -#define MODULE_NAME "iptables" -#define BUFSIZE 512 - /* * (Module-)Global variables */ -/* - * Removed packet count for now, should have config option if you want to save - * them Although other collectd models don't seem to care much for options - * eitherway for what to log - */ -/* Limit to ~125MByte/s (~1GBit/s) */ -static data_source_t dsrc[1] = -{ - {"value", DS_TYPE_COUNTER, 0.0, 134217728.0} -}; - -static data_set_t ipt_bytes_ds = -{ - "ipt_bytes", 1, dsrc -}; - -static data_set_t ipt_packets_ds = -{ - "ipt_packets", 1, dsrc -}; - -#if IPTABLES_HAVE_READ /* * Config format should be `Chain table chainname', * e. g. `Chain mangle incoming' @@ -120,7 +90,9 @@ static int iptables_config (const char *key, const char *value) value_copy = strdup (value); if (value_copy == NULL) { - ERROR ("strdup failed: %s", strerror (errno)); + char errbuf[1024]; + ERROR ("strdup failed: %s", + sstrerror (errno, errbuf, sizeof (errbuf))); return (1); } @@ -135,25 +107,23 @@ static int iptables_config (const char *key, const char *value) table = fields[0]; chain = fields[1]; - table_len = strlen (table); - if (table_len >= sizeof(temp.table)) + table_len = strlen (table) + 1; + if ((unsigned int)table_len > sizeof(temp.table)) { ERROR ("Table `%s' too long.", table); free (value_copy); return (1); } - strncpy (temp.table, table, table_len); - temp.table[table_len] = '\0'; + sstrncpy (temp.table, table, table_len); - chain_len = strlen (chain); - if (chain_len >= sizeof(temp.chain)) + chain_len = strlen (chain) + 1; + if ((unsigned int)chain_len > sizeof(temp.chain)) { ERROR ("Chain `%s' too long.", chain); free (value_copy); return (1); } - strncpy (temp.chain, chain, chain_len); - temp.chain[chain_len] = '\0'; + sstrncpy (temp.chain, chain, chain_len); if (fields_num >= 3) { @@ -167,8 +137,12 @@ static int iptables_config (const char *key, const char *value) } else { - strncpy (temp.rule.comment, comment, - sizeof (temp.rule.comment) - 1); + temp.rule.comment = strdup (comment); + if (temp.rule.comment == NULL) + { + free (value_copy); + return (1); + } temp.rule_type = RTYPE_COMMENT; } } @@ -178,7 +152,7 @@ static int iptables_config (const char *key, const char *value) } if (fields_num >= 4) - strncpy (temp.name, fields[3], sizeof (temp.name) - 1); + sstrncpy (temp.name, fields[3], sizeof (temp.name)); free (value_copy); value_copy = NULL; @@ -188,16 +162,20 @@ static int iptables_config (const char *key, const char *value) list = (ip_chain_t **) realloc (chain_list, (chain_num + 1) * sizeof (ip_chain_t *)); if (list == NULL) { - ERROR ("realloc failed: %s", strerror (errno)); - return (1); + char errbuf[1024]; + ERROR ("realloc failed: %s", + sstrerror (errno, errbuf, sizeof (errbuf))); + return (1); } chain_list = list; final = (ip_chain_t *) malloc( sizeof(temp) ); if (final == NULL) { - ERROR ("malloc failed: %s", strerror (errno)); - return (1); + char errbuf[1024]; + ERROR ("malloc failed: %s", + sstrerror (errno, errbuf, sizeof (errbuf))); + return (1); } memcpy (final, &temp, sizeof (temp)); chain_list[chain_num] = final; @@ -212,9 +190,7 @@ static int iptables_config (const char *key, const char *value) return (0); } /* int iptables_config */ -#endif /* IPTABLES_HAVE_READ */ -#if IPTABLES_HAVE_READ /* This needs to return `int' for IPT_MATCH_ITERATE to work. */ static int submit_match (const struct ipt_entry_match *match, const struct ipt_entry *entry, @@ -243,34 +219,35 @@ static int submit_match (const struct ipt_entry_match *match, vl.values = values; vl.values_len = 1; vl.time = time (NULL); - strcpy (vl.host, hostname_g); - strcpy (vl.plugin, "iptables"); + sstrncpy (vl.host, hostname_g, sizeof (vl.host)); + sstrncpy (vl.plugin, "iptables", sizeof (vl.plugin)); - status = snprintf (vl.plugin_instance, sizeof (vl.plugin_instance), + status = ssnprintf (vl.plugin_instance, sizeof (vl.plugin_instance), "%s-%s", chain->table, chain->chain); - if ((status >= sizeof (vl.plugin_instance)) || (status < 1)) + if ((status < 1) || ((unsigned int)status >= sizeof (vl.plugin_instance))) return (0); if (chain->name[0] != '\0') { - strncpy (vl.type_instance, chain->name, sizeof (vl.type_instance)); + sstrncpy (vl.type_instance, chain->name, sizeof (vl.type_instance)); } else { if (chain->rule_type == RTYPE_NUM) - snprintf (vl.type_instance, sizeof (vl.type_instance), + ssnprintf (vl.type_instance, sizeof (vl.type_instance), "%i", chain->rule.num); else - strncpy (vl.type_instance, (char *) match->data, + sstrncpy (vl.type_instance, (char *) match->data, sizeof (vl.type_instance)); } - vl.type_instance[sizeof (vl.type_instance) - 1] = '\0'; + sstrncpy (vl.type, "ipt_bytes", sizeof (vl.type)); values[0].counter = (counter_t) entry->counters.bcnt; - plugin_dispatch_values ("ipt_bytes", &vl); + plugin_dispatch_values (&vl); + sstrncpy (vl.type, "ipt_packets", sizeof (vl.type)); values[0].counter = (counter_t) entry->counters.pcnt; - plugin_dispatch_values ("ipt_packets", &vl); + plugin_dispatch_values (&vl); return (0); } /* void submit_match */ @@ -308,7 +285,7 @@ static void submit_chain( iptc_handle_t *handle, ip_chain_t *chain ) { static int iptables_read (void) { int i; - static complain_t complaint; + int num_failures = 0; /* Init the iptc handle structure and query the correct table */ for (i = 0; i < chain_num; i++) @@ -319,26 +296,24 @@ static int iptables_read (void) chain = chain_list[i]; if (!chain) { - DEBUG ("chain == NULL"); + DEBUG ("iptables plugin: chain == NULL"); continue; } - handle = iptc_init( chain->table ); + handle = iptc_init (chain->table); if (!handle) { - DEBUG ("iptc_init (%s) failed: %s", chain->table, iptc_strerror (errno)); - plugin_complain (LOG_ERR, &complaint, "iptc_init (%s) failed: %s", + ERROR ("iptables plugin: iptc_init (%s) failed: %s", chain->table, iptc_strerror (errno)); + num_failures++; continue; } - plugin_relief (LOG_INFO, &complaint, "iptc_init (%s) succeeded", - chain->table); submit_chain (&handle, chain); iptc_free (&handle); - } + } /* for (i = 0 .. chain_num) */ - return (0); + return ((num_failures < chain_num) ? 0 : -1); } /* int iptables_read */ static int iptables_shutdown (void) @@ -346,28 +321,25 @@ static int iptables_shutdown (void) int i; for (i = 0; i < chain_num; i++) + { + if ((chain_list[i] != NULL) && (chain_list[i]->rule_type == RTYPE_COMMENT)) + { + sfree (chain_list[i]->rule.comment); + } sfree (chain_list[i]); + } sfree (chain_list); return (0); } /* int iptables_shutdown */ -#endif /* IPTABLES_HAVE_READ */ void module_register (void) { - plugin_register_data_set (&ipt_bytes_ds); - plugin_register_data_set (&ipt_packets_ds); - -#if IPTABLES_HAVE_READ plugin_register_config ("iptables", iptables_config, config_keys, config_keys_num); plugin_register_read ("iptables", iptables_read); plugin_register_shutdown ("iptables", iptables_shutdown); -#endif -} - -#undef BUFSIZE -#undef MODULE_NAME +} /* void module_register */ /* * vim:shiftwidth=4:softtabstop=4:tabstop=8