target/linux/generic-2.4/patches/612-netfilter_quota.patch

   1 Index: linux-2.4.35.4/Documentation/Configure.help
   2 ===================================================================
   3 --- linux-2.4.35.4.orig/Documentation/Configure.help
   4 +++ linux-2.4.35.4/Documentation/Configure.help
   5 @@ -2888,6 +2888,13 @@ CONFIG_IP_NF_MATCH_LIMIT
   6    If you want to compile it as a module, say M here and read
   7    <file:Documentation/modules.txt>.  If unsure, say `N'.
   8
   9 +quota match support
  10 +CONFIG_IP_NF_MATCH_QUOTA
  11 +  This match implements network quotas.
  12 +
  13 +  If you want to compile it as a module, say M here and read
  14 +  Documentation/modules.txt.  If unsure, say `N'.
  15 +
  16  skb->pkt_type packet match support
  17  CONFIG_IP_NF_MATCH_PKTTYPE
  18    This patch allows you to match packet in accrodance
  19 Index: linux-2.4.35.4/include/linux/netfilter_ipv4/ipt_quota.h
  20 ===================================================================
  21 --- /dev/null
  22 +++ linux-2.4.35.4/include/linux/netfilter_ipv4/ipt_quota.h
  23 @@ -0,0 +1,12 @@
  24 +#ifndef _IPT_QUOTA_H
  25 +#define _IPT_QUOTA_H
  26 +
  27 +/* print debug info in both kernel/netfilter module & iptable library */
  28 +//#define DEBUG_IPT_QUOTA
  29 +
  30 +struct ipt_quota_info {
  31 +        u_int64_t quota;
  32 +       struct ipt_quota_info *master;
  33 +};
  34 +
  35 +#endif /*_IPT_QUOTA_H*/
  36 Index: linux-2.4.35.4/net/ipv4/netfilter/Config.in
  37 ===================================================================
  38 --- linux-2.4.35.4.orig/net/ipv4/netfilter/Config.in
  39 +++ linux-2.4.35.4/net/ipv4/netfilter/Config.in
  40 @@ -24,6 +24,7 @@ tristate 'IP tables support (required fo
  41  if [ "$CONFIG_IP_NF_IPTABLES" != "n" ]; then
  42  # The simple matches.
  43    dep_tristate '  limit match support' CONFIG_IP_NF_MATCH_LIMIT $CONFIG_IP_NF_IPTABLES
  44 +  dep_tristate '  quota match support' CONFIG_IP_NF_MATCH_QUOTA $CONFIG_IP_NF_IPTABLES
  45
  46    dep_tristate '  IP set support' CONFIG_IP_NF_SET $CONFIG_IP_NF_IPTABLES
  47    if [ "$CONFIG_IP_NF_SET" != "n" ]; then
  48 Index: linux-2.4.35.4/net/ipv4/netfilter/Makefile
  49 ===================================================================
  50 --- linux-2.4.35.4.orig/net/ipv4/netfilter/Makefile
  51 +++ linux-2.4.35.4/net/ipv4/netfilter/Makefile
  52 @@ -74,6 +74,7 @@ obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
  53  # matches
  54  obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
  55  obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
  56 +obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
  57  obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
  58  obj-$(CONFIG_IP_NF_MATCH_SET) += ipt_set.o
  59  obj-$(CONFIG_IP_NF_TARGET_SET) += ipt_SET.o
  60 Index: linux-2.4.35.4/net/ipv4/netfilter/ipt_quota.c
  61 ===================================================================
  62 --- /dev/null
  63 +++ linux-2.4.35.4/net/ipv4/netfilter/ipt_quota.c
  64 @@ -0,0 +1,88 @@
  65 +/*
  66 + * netfilter module to enforce network quotas
  67 + *
  68 + * Sam Johnston <samj@samj.net>
  69 + *
  70 + * 30/01/05: Fixed on SMP --Pablo Neira <pablo@eurodev.net>
  71 + */
  72 +#include <linux/module.h>
  73 +#include <linux/skbuff.h>
  74 +#include <linux/spinlock.h>
  75 +#include <linux/interrupt.h>
  76 +
  77 +#include <linux/netfilter_ipv4/ip_tables.h>
  78 +#include <linux/netfilter_ipv4/ipt_quota.h>
  79 +
  80 +MODULE_LICENSE("GPL");
  81 +
  82 +static spinlock_t quota_lock = SPIN_LOCK_UNLOCKED;
  83 +
  84 +static int
  85 +match(const struct sk_buff *skb,
  86 +      const struct net_device *in,
  87 +      const struct net_device *out,
  88 +      const void *matchinfo,
  89 +      int offset, const void *hdr, u_int16_t datalen, int *hotdrop)
  90 +{
  91 +       struct ipt_quota_info *q =
  92 +               ((struct ipt_quota_info *) matchinfo)->master;
  93 +
  94 +        spin_lock_bh(&quota_lock);
  95 +
  96 +        if (q->quota >= datalen) {
  97 +                /* we can afford this one */
  98 +                q->quota -= datalen;
  99 +                spin_unlock_bh(&quota_lock);
 100 +
 101 +#ifdef DEBUG_IPT_QUOTA
 102 +                printk("IPT Quota OK: %llu datlen %d \n", q->quota, datalen);
 103 +#endif
 104 +                return 1;
 105 +        }
 106 +
 107 +        /* so we do not allow even small packets from now on */
 108 +        q->quota = 0;
 109 +
 110 +#ifdef DEBUG_IPT_QUOTA
 111 +        printk("IPT Quota Failed: %llu datlen %d \n", q->quota, datalen);
 112 +#endif
 113 +
 114 +        spin_unlock_bh(&quota_lock);
 115 +        return 0;
 116 +}
 117 +
 118 +static int
 119 +checkentry(const char *tablename,
 120 +           const struct ipt_ip *ip,
 121 +           void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
 122 +{
 123 +        /* TODO: spinlocks? sanity checks? */
 124 +       struct ipt_quota_info *q = (struct ipt_quota_info *) matchinfo;
 125 +
 126 +        if (matchsize != IPT_ALIGN(sizeof (struct ipt_quota_info)))
 127 +                return 0;
 128 +
 129 +       /* For SMP, we only want to use one set of counters. */
 130 +       q->master = q;
 131 +
 132 +        return 1;
 133 +}
 134 +
 135 +static struct ipt_match quota_match
 136 +    = { {NULL, NULL}, "quota", &match, &checkentry, NULL, THIS_MODULE };
 137 +
 138 +static int __init
 139 +init(void)
 140 +{
 141 +        return ipt_register_match(&quota_match);
 142 +}
 143 +
 144 +static void __exit
 145 +fini(void)
 146 +{
 147 +        ipt_unregister_match(&quota_match);
 148 +}
 149 +
 150 +module_init(init);
 151 +module_exit(fini);
 152 +