A major flaw of the current xt_quota module is that quota in a specific rule gets reset every time there is a rule change in the same table. It makes the xt_quota module not very useful in a table in which iptables rules are changed at run time. This fix introduces a new counter that is visible to userspace as the remaining quota of the current rule. When userspace restores the rules in a table, it can restore the counter to the remaining quota instead of resetting it to the full quota.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -15,9 +15,11 @@ struct xt_quota_info { · 14 unmodified lines | ||
| 15 | 15 | __u32 flags; |
| 16 | 16 | __u32 pad; |
| 17 | 17 | __aligned_u64 quota; |
| 18 | − | |
| 19 | − /* Used internally by the kernel */ | |
| 20 | − struct xt_quota_priv *master; | |
| 18 | +#ifdef __KERNEL__ | |
| 19 | + atomic64_t counter; | |
| 20 | +#else | |
| 21 | + __aligned_u64 remain; | |
| 22 | +#endif | |
| 21 | 23 | }; |
| 22 | 24 | |
| 23 | 25 | #endif /* _XT_QUOTA_H */ |