1 /* 2 * netfilter module to enforce network quotas 3 * 4 * Sam Johnston <samj@samj.net> 5 */ 6 #include <linux/skbuff.h> 7 #include <linux/slab.h> 8 #include <linux/spinlock.h> 9 10 #include <linux/netfilter/x_tables.h> 11 #include <linux/netfilter/xt_quota.h> 12 13 struct xt_quota_priv { 14 uint64_t quota; 15 }; 16 17 MODULE_LICENSE("GPL"); 18 MODULE_AUTHOR("Sam Johnston <samj@samj.net>"); 19 MODULE_DESCRIPTION("Xtables: countdown quota match"); 20 MODULE_ALIAS("ipt_quota"); 21 MODULE_ALIAS("ip6t_quota"); 22 23 static DEFINE_SPINLOCK(quota_lock); 24 25 static bool 26 quota_mt(const struct sk_buff *skb, struct xt_action_param *par) 27 { 28 struct xt_quota_info *q = (void *)par->matchinfo; 29 struct xt_quota_priv *priv = q->master; 30 bool ret = q->flags & XT_QUOTA_INVERT; 31 32 spin_lock_bh("a_lock); 33 if (priv->quota >= skb->len) { 34 priv->quota -= skb->len; 35 ret = !ret; 36 } else { 37 /* we do not allow even small packets from now on */ 38 priv->quota = 0; 39 } 40 /* Copy quota back to matchinfo so that iptables can display it */ 41 q->quota = priv->quota; 42 spin_unlock_bh("a_lock); 43 44 return ret; 45 } 46 47 static int quota_mt_check(const struct xt_mtchk_param *par) 48 { 49 struct xt_quota_info *q = par->matchinfo; 50 51 if (q->flags & ~XT_QUOTA_MASK) 52 return -EINVAL; 53 54 q->master = kmalloc(sizeof(*q->master), GFP_KERNEL); 55 if (q->master == NULL) 56 return -ENOMEM; 57 58 q->master->quota = q->quota; 59 return 0; 60 } 61 62 static void quota_mt_destroy(const struct xt_mtdtor_param *par) 63 { 64 const struct xt_quota_info *q = par->matchinfo; 65 66 kfree(q->master); 67 } 68 69 static struct xt_match quota_mt_reg __read_mostly = { 70 .name = "quota", 71 .revision = 0, 72 .family = NFPROTO_UNSPEC, 73 .match = quota_mt, 74 .checkentry = quota_mt_check, 75 .destroy = quota_mt_destroy, 76 .matchsize = sizeof(struct xt_quota_info), 77 .me = THIS_MODULE, 78 }; 79 80 static int __init quota_mt_init(void) 81 { 82 return xt_register_match("a_mt_reg); 83 } 84 85 static void __exit quota_mt_exit(void) 86 { 87 xt_unregister_match("a_mt_reg); 88 } 89 90 module_init(quota_mt_init); 91 module_exit(quota_mt_exit); 92