tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/*
2 * netfilter module to enforce network quotas
3 *
4 * Sam Johnston <samj@samj.net>
5 */
6#include <linux/skbuff.h>
7#include <linux/spinlock.h>
8
9#include <linux/netfilter/x_tables.h>
10#include <linux/netfilter/xt_quota.h>
11
12MODULE_LICENSE("GPL");
13MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
14MODULE_ALIAS("ipt_quota");
15MODULE_ALIAS("ip6t_quota");
16
17static DEFINE_SPINLOCK(quota_lock);
18
19static bool
20match(const struct sk_buff *skb,
21 const struct net_device *in, const struct net_device *out,
22 const struct xt_match *match, const void *matchinfo,
23 int offset, unsigned int protoff, bool *hotdrop)
24{
25 struct xt_quota_info *q =
26 ((const struct xt_quota_info *)matchinfo)->master;
27 bool ret = q->flags & XT_QUOTA_INVERT;
28
29 spin_lock_bh("a_lock);
30 if (q->quota >= skb->len) {
31 q->quota -= skb->len;
32 ret = !ret;
33 } else {
34 /* we do not allow even small packets from now on */
35 q->quota = 0;
36 }
37 spin_unlock_bh("a_lock);
38
39 return ret;
40}
41
42static bool
43checkentry(const char *tablename, const void *entry,
44 const struct xt_match *match, void *matchinfo,
45 unsigned int hook_mask)
46{
47 struct xt_quota_info *q = matchinfo;
48
49 if (q->flags & ~XT_QUOTA_MASK)
50 return false;
51 /* For SMP, we only want to use one set of counters. */
52 q->master = q;
53 return true;
54}
55
56static struct xt_match xt_quota_match[] __read_mostly = {
57 {
58 .name = "quota",
59 .family = AF_INET,
60 .checkentry = checkentry,
61 .match = match,
62 .matchsize = sizeof(struct xt_quota_info),
63 .me = THIS_MODULE
64 },
65 {
66 .name = "quota",
67 .family = AF_INET6,
68 .checkentry = checkentry,
69 .match = match,
70 .matchsize = sizeof(struct xt_quota_info),
71 .me = THIS_MODULE
72 },
73};
74
75static int __init xt_quota_init(void)
76{
77 return xt_register_matches(xt_quota_match, ARRAY_SIZE(xt_quota_match));
78}
79
80static void __exit xt_quota_fini(void)
81{
82 xt_unregister_matches(xt_quota_match, ARRAY_SIZE(xt_quota_match));
83}
84
85module_init(xt_quota_init);
86module_exit(xt_quota_fini);