[NETFILTER]: x_tables: add quota match (62b77434) · Commits · e / devices / android_kernel_oneplus_sm7250

include/linux/netfilter/xt_quota.h

0 → 100644

+16 −0

Original line number	Diff line number	Diff line
		#ifndef _XT_QUOTA_H
		#define _XT_QUOTA_H

		enum xt_quota_flags {
		XT_QUOTA_INVERT = 0x1,
		};
		#define XT_QUOTA_MASK 0x1

		struct xt_quota_info {
		u_int32_t flags;
		u_int32_t pad;
		aligned_u64 quota;
		struct xt_quota_info *master;
		};

		#endif /* _XT_QUOTA_H */

net/netfilter/Kconfig

+10 −0

Original line number	Diff line number	Diff line
		@@ -329,6 +329,16 @@ config NETFILTER_XT_MATCH_PKTTYPE

		To compile it as a module, choose M here. If unsure, say N.

		config NETFILTER_XT_MATCH_QUOTA
		tristate '"quota" match support'
		depends on NETFILTER_XTABLES
		help
		This option adds a `quota' match, which allows to match on a
		byte counter.

		If you want to compile it as a module, say M here and read
		<file:Documentation/modules.txt>. If unsure, say `N'.

		config NETFILTER_XT_MATCH_REALM
		tristate '"realm" match support'
		depends on NETFILTER_XTABLES

net/netfilter/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -44,6 +44,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o

net/netfilter/xt_quota.c

0 → 100644

+96 −0

Original line number	Diff line number	Diff line
		/*
		* netfilter module to enforce network quotas
		*
		* Sam Johnston <samj@samj.net>
		*/
		#include <linux/skbuff.h>
		#include <linux/spinlock.h>

		#include <linux/netfilter/x_tables.h>
		#include <linux/netfilter/xt_quota.h>

		MODULE_LICENSE("GPL");
		MODULE_AUTHOR("Sam Johnston <samj@samj.net>");

		static DEFINE_SPINLOCK(quota_lock);

		static int
		match(const struct sk_buff *skb,
		const struct net_device in, const struct net_device out,
		const struct xt_match match, const void matchinfo,
		int offset, unsigned int protoff, int *hotdrop)
		{
		struct xt_quota_info q = ((struct xt_quota_info )matchinfo)->master;
		int ret = q->flags & XT_QUOTA_INVERT ? 1 : 0;

		spin_lock_bh(&quota_lock);
		if (q->quota >= skb->len) {
		q->quota -= skb->len;
		ret ^= 1;
		} else {
		/* we do not allow even small packets from now on */
		q->quota = 0;
		}
		spin_unlock_bh(&quota_lock);

		return ret;
		}

		static int
		checkentry(const char tablename, const void entry,
		const struct xt_match match, void matchinfo,
		unsigned int matchsize, unsigned int hook_mask)
		{
		struct xt_quota_info q = (struct xt_quota_info )matchinfo;

		if (q->flags & ~XT_QUOTA_MASK)
		return 0;
		/* For SMP, we only want to use one set of counters. */
		q->master = q;
		return 1;
		}

		static struct xt_match quota_match = {
		.name = "quota",
		.family = AF_INET,
		.match = match,
		.matchsize = sizeof(struct xt_quota_info),
		.checkentry = checkentry,
		.me = THIS_MODULE
		};

		static struct xt_match quota_match6 = {
		.name = "quota",
		.family = AF_INET6,
		.match = match,
		.matchsize = sizeof(struct xt_quota_info),
		.checkentry = checkentry,
		.me = THIS_MODULE
		};

		static int __init xt_quota_init(void)
		{
		int ret;

		ret = xt_register_match(&quota_match);
		if (ret)
		goto err1;
		ret = xt_register_match(&quota_match6);
		if (ret)
		goto err2;
		return ret;

		err2:
		xt_unregister_match(&quota_match);
		err1:
		return ret;
		}

		static void __exit xt_quota_fini(void)
		{
		xt_unregister_match(&quota_match6);
		xt_unregister_match(&quota_match);
		}

		module_init(xt_quota_init);
		module_exit(xt_quota_fini);