xt_quota.c revision acc738fec03bdaa5b77340c32a82fbfedaaabef0
1/* 2 * netfilter module to enforce network quotas 3 * 4 * Sam Johnston <samj@samj.net> 5 */ 6#include <linux/skbuff.h> 7#include <linux/spinlock.h> 8 9#include <linux/netfilter/x_tables.h> 10#include <linux/netfilter/xt_quota.h> 11 12struct xt_quota_priv { 13 uint64_t quota; 14}; 15 16MODULE_LICENSE("GPL"); 17MODULE_AUTHOR("Sam Johnston <samj@samj.net>"); 18MODULE_DESCRIPTION("Xtables: countdown quota match"); 19MODULE_ALIAS("ipt_quota"); 20MODULE_ALIAS("ip6t_quota"); 21 22static DEFINE_SPINLOCK(quota_lock); 23 24static bool 25quota_mt(const struct sk_buff *skb, const struct xt_match_param *par) 26{ 27 struct xt_quota_info *q = (void *)par->matchinfo; 28 struct xt_quota_priv *priv = q->master; 29 bool ret = q->flags & XT_QUOTA_INVERT; 30 31 spin_lock_bh("a_lock); 32 if (priv->quota >= skb->len) { 33 priv->quota -= skb->len; 34 ret = !ret; 35 } else { 36 /* we do not allow even small packets from now on */ 37 priv->quota = 0; 38 } 39 /* Copy quota back to matchinfo so that iptables can display it */ 40 q->quota = priv->quota; 41 spin_unlock_bh("a_lock); 42 43 return ret; 44} 45 46static bool quota_mt_check(const struct xt_mtchk_param *par) 47{ 48 struct xt_quota_info *q = par->matchinfo; 49 50 if (q->flags & ~XT_QUOTA_MASK) 51 return false; 52 53 q->master = kmalloc(sizeof(*q->master), GFP_KERNEL); 54 if (q->master == NULL) 55 return -ENOMEM; 56 57 return true; 58} 59 60static void quota_mt_destroy(const struct xt_mtdtor_param *par) 61{ 62 const struct xt_quota_info *q = par->matchinfo; 63 64 kfree(q->master); 65} 66 67static struct xt_match quota_mt_reg __read_mostly = { 68 .name = "quota", 69 .revision = 0, 70 .family = NFPROTO_UNSPEC, 71 .match = quota_mt, 72 .checkentry = quota_mt_check, 73 .destroy = quota_mt_destroy, 74 .matchsize = sizeof(struct xt_quota_info), 75 .me = THIS_MODULE, 76}; 77 78static int __init quota_mt_init(void) 79{ 80 return xt_register_match("a_mt_reg); 81} 82 83static void __exit quota_mt_exit(void) 84{ 85 xt_unregister_match("a_mt_reg); 86} 87 88module_init(quota_mt_init); 89module_exit(quota_mt_exit); 90