2 * netfilter module to enforce network quotas
4 * Sam Johnston <samj@samj.net>
6 #include <linux/skbuff.h>
7 #include <linux/spinlock.h>
9 #include <linux/netfilter/x_tables.h>
10 #include <linux/netfilter/xt_quota.h>
12 MODULE_LICENSE("GPL");
13 MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
14 MODULE_ALIAS("ipt_quota");
15 MODULE_ALIAS("ip6t_quota");
17 static DEFINE_SPINLOCK(quota_lock
);
20 match(const struct sk_buff
*skb
,
21 const struct net_device
*in
, const struct net_device
*out
,
22 const struct xt_match
*match
, const void *matchinfo
,
23 int offset
, unsigned int protoff
, int *hotdrop
)
25 struct xt_quota_info
*q
= ((struct xt_quota_info
*)matchinfo
)->master
;
26 int ret
= q
->flags
& XT_QUOTA_INVERT
? 1 : 0;
28 spin_lock_bh("a_lock
);
29 if (q
->quota
>= skb
->len
) {
33 /* we do not allow even small packets from now on */
36 spin_unlock_bh("a_lock
);
42 checkentry(const char *tablename
, const void *entry
,
43 const struct xt_match
*match
, void *matchinfo
,
44 unsigned int matchsize
, unsigned int hook_mask
)
46 struct xt_quota_info
*q
= (struct xt_quota_info
*)matchinfo
;
48 if (q
->flags
& ~XT_QUOTA_MASK
)
50 /* For SMP, we only want to use one set of counters. */
55 static struct xt_match quota_match
= {
59 .matchsize
= sizeof(struct xt_quota_info
),
60 .checkentry
= checkentry
,
64 static struct xt_match quota_match6
= {
68 .matchsize
= sizeof(struct xt_quota_info
),
69 .checkentry
= checkentry
,
73 static int __init
xt_quota_init(void)
77 ret
= xt_register_match("a_match
);
80 ret
= xt_register_match("a_match6
);
86 xt_unregister_match("a_match
);
91 static void __exit
xt_quota_fini(void)
93 xt_unregister_match("a_match6
);
94 xt_unregister_match("a_match
);
97 module_init(xt_quota_init
);
98 module_exit(xt_quota_fini
);