nfacct objects already support accounting at the byte and packet level. As such it is a natural extension to add the possiblity to define a ceiling limit for both metrics. All the support for quotas itself is added to nfnetlink acctounting framework to stay coherent with current accounting object management. Quota limit checks are implemented in xt_nfacct filter where statistic collection is already done. Pablo Neira Ayuso has also contributed to this feature.
Showing the changes to include/uapi/linux (2 of 5 files). Show all
Unified · Split
| @@ -20,6 +20,8 @@ enum nfnetlink_groups { · 19 unmodified lines | ||
| 20 | 20 | #define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY |
| 21 | 21 | NFNLGRP_NFTABLES, |
| 22 | 22 | #define NFNLGRP_NFTABLES NFNLGRP_NFTABLES |
| 23 | + NFNLGRP_ACCT_QUOTA, | |
| 24 | +#define NFNLGRP_ACCT_QUOTA NFNLGRP_ACCT_QUOTA | |
| 23 | 25 | __NFNLGRP_MAX, |
| 24 | 26 | }; |
| 25 | 27 | #define NFNLGRP_MAX (__NFNLGRP_MAX - 1) |
| @@ -10,15 +10,24 @@ enum nfnl_acct_msg_types { · 9 unmodified lines | ||
| 10 | 10 | NFNL_MSG_ACCT_GET, |
| 11 | 11 | NFNL_MSG_ACCT_GET_CTRZERO, |
| 12 | 12 | NFNL_MSG_ACCT_DEL, |
| 13 | + NFNL_MSG_ACCT_OVERQUOTA, | |
| 13 | 14 | NFNL_MSG_ACCT_MAX |
| 14 | 15 | }; |
| 15 | 16 | |
| 17 | +enum nfnl_acct_flags { | |
| 18 | + NFACCT_F_QUOTA_PKTS = (1 << 0), | |
| 19 | + NFACCT_F_QUOTA_BYTES = (1 << 1), | |
| 20 | + NFACCT_F_OVERQUOTA = (1 << 2), /* can't be set from userspace */ | |
| 21 | +}; | |
| 22 | + | |
| 16 | 23 | enum nfnl_acct_type { |
| 17 | 24 | NFACCT_UNSPEC, |
| 18 | 25 | NFACCT_NAME, |
| 19 | 26 | NFACCT_PKTS, |
| 20 | 27 | NFACCT_BYTES, |
| 21 | 28 | NFACCT_USE, |
| 29 | + NFACCT_FLAGS, | |
| 30 | + NFACCT_QUOTA, | |
| 22 | 31 | __NFACCT_MAX |
| 23 | 32 | }; |
| 24 | 33 | #define NFACCT_MAX (__NFACCT_MAX - 1) |