A major flaw of the current xt_quota module is that quota in a specific rule gets reset every time there is a rule change in the same table. It makes the xt_quota module not very useful in a table in which iptables rules are changed at run time. This fix introduces a new counter that is visible to userspace as the remaining quota of the current rule. When userspace restores the rules in a table, it can restore the counter to the remaining quota instead of resetting it to the full quota.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -15,9 +15,11 @@ struct xt_quota_info { · 14 unmodified lines | |||
| 15 | __u32 flags; | 15 | __u32 flags; |
| 16 | __u32 pad; | 16 | __u32 pad; |
| 17 | __aligned_u64 quota; | 17 | __aligned_u64 quota; |
| 18 | 18 | #ifdef __KERNEL__ | |
| 19 | /* Used internally by the kernel */ | 19 | atomic64_t counter; |
| 20 | struct xt_quota_priv *master; | 20 | #else |
| 21 | __aligned_u64 remain; | ||
| 22 | #endif | ||
| 21 | }; | 23 | }; |
| 22 | 24 | ||
| 23 | #endif /* _XT_QUOTA_H */ | 25 | #endif /* _XT_QUOTA_H */ |