From ba16753ccb2c72041fb33678ddbafeecde3996e3 Mon Sep 17 00:00:00 2001 From: Mathieu Poirier Date: Sun, 20 Apr 2014 18:58:16 -0600 Subject: nfacct: adding quota capabilities The accounting framework now supports quota at the packet and byte level. The tool is simply enhanced with two optional arguments to specify the whether accounting for byte of packet and the limit associated with each. Also adding a monitor mode that listens for quota attainment notification. Examples: /* create an accounting object that isn't associated to a quota */ $ nfacct add first_no_quota /* create a quota object with byte count limited to 50 byte */ $ nfacct add second_quota byte 50 /* create a quota object with packet count limited to 5 */ $ nfacct add third_quota packet 5 From there the accounting objects can be used in iptables the same way as they did before: /* limit the number of icmp packets allowed through the OUTPUT chain */ $ iptables -I OUTPUT -p icmp -m nfacct --nfacct-name third_quota -j REJECT /* listening for quota attainment notification */ $ nfacct monitor Everything else works the same way. Signed-off-by: Mathieu Poirier Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/nfnetlink_acct.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include/linux/netfilter/nfnetlink_acct.h') diff --git a/include/linux/netfilter/nfnetlink_acct.h b/include/linux/netfilter/nfnetlink_acct.h index 7c4279b..44dcd17 100644 --- a/include/linux/netfilter/nfnetlink_acct.h +++ b/include/linux/netfilter/nfnetlink_acct.h @@ -10,15 +10,24 @@ enum nfnl_acct_msg_types { NFNL_MSG_ACCT_GET, NFNL_MSG_ACCT_GET_CTRZERO, NFNL_MSG_ACCT_DEL, + NFNL_MSG_ACCT_OVERQUOTA, NFNL_MSG_ACCT_MAX }; +enum nfnl_acct_flags { + NFACCT_F_QUOTA_PKTS = (1 << 0), + NFACCT_F_QUOTA_BYTES = (1 << 1), + NFACCT_F_OVERQUOTA = (1 << 2), /* can't be set from userspace */ +}; + enum nfnl_acct_type { NFACCT_UNSPEC, NFACCT_NAME, NFACCT_PKTS, NFACCT_BYTES, NFACCT_USE, + NFACCT_FLAGS, + NFACCT_QUOTA, __NFACCT_MAX }; #define NFACCT_MAX (__NFACCT_MAX - 1) -- cgit v1.2.3