1
2
3
4
5
6#include <linux/skbuff.h>
7#include <linux/spinlock.h>
8
9#include <linux/netfilter/x_tables.h>
10#include <linux/netfilter/xt_quota.h>
11
12struct xt_quota_priv {
13 uint64_t quota;
14};
15
16MODULE_LICENSE("GPL");
17MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
18MODULE_DESCRIPTION("Xtables: countdown quota match");
19MODULE_ALIAS("ipt_quota");
20MODULE_ALIAS("ip6t_quota");
21
22static DEFINE_SPINLOCK(quota_lock);
23
24static bool
25quota_mt(const struct sk_buff *skb, const struct xt_match_param *par)
26{
27 struct xt_quota_info *q = (void *)par->matchinfo;
28 struct xt_quota_priv *priv = q->master;
29 bool ret = q->flags & XT_QUOTA_INVERT;
30
31 spin_lock_bh("a_lock);
32 if (priv->quota >= skb->len) {
33 priv->quota -= skb->len;
34 ret = !ret;
35 } else {
36
37 priv->quota = 0;
38 }
39
40 q->quota = priv->quota;
41 spin_unlock_bh("a_lock);
42
43 return ret;
44}
45
46static bool quota_mt_check(const struct xt_mtchk_param *par)
47{
48 struct xt_quota_info *q = par->matchinfo;
49
50 if (q->flags & ~XT_QUOTA_MASK)
51 return false;
52
53 q->master = kmalloc(sizeof(*q->master), GFP_KERNEL);
54 if (q->master == NULL)
55 return false;
56
57 q->master->quota = q->quota;
58 return true;
59}
60
61static void quota_mt_destroy(const struct xt_mtdtor_param *par)
62{
63 const struct xt_quota_info *q = par->matchinfo;
64
65 kfree(q->master);
66}
67
68static struct xt_match quota_mt_reg __read_mostly = {
69 .name = "quota",
70 .revision = 0,
71 .family = NFPROTO_UNSPEC,
72 .match = quota_mt,
73 .checkentry = quota_mt_check,
74 .destroy = quota_mt_destroy,
75 .matchsize = sizeof(struct xt_quota_info),
76 .me = THIS_MODULE,
77};
78
79static int __init quota_mt_init(void)
80{
81 return xt_register_match("a_mt_reg);
82}
83
84static void __exit quota_mt_exit(void)
85{
86 xt_unregister_match("a_mt_reg);
87}
88
89module_init(quota_mt_init);
90module_exit(quota_mt_exit);
91