diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-18 01:46:06 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-22 11:42:18 +0200 |
| commit | 3d2f30a1df907e3ef4175121f0d21456630a72aa (patch) | |
| tree | 2b6b9df712759bfc4894fa679109a2d5d01a0629 /net/netfilter/Kconfig | |
| parent | netfilter: nf_conntrack: restore nf_conntrack_htable_size as exported symbol (diff) | |
| download | linux-dev-3d2f30a1df907e3ef4175121f0d21456630a72aa.tar.xz linux-dev-3d2f30a1df907e3ef4175121f0d21456630a72aa.zip | |
netfilter: nf_tables: add quota expression
This patch adds the quota expression. This new stateful expression
integrate easily into the dynset expression to build 'hashquota' flow
tables.
Arguably, we could use instead "counter bytes > 1000" instead, but this
approach has several problems:
1) We only support for one single stateful expression in dynamic set
definitions, and the expression above is a composite of two
expressions: get counter + comparison.
2) We would need to restore the packed counter representation (that we
used to have) based on seqlock to synchronize this, since per-cpu is
not suitable for this.
So instead of bloating the counter expression back with the seqlock
representation and extending the existing set infrastructure to make it
more complex for the composite described above, let's follow the more
simple approach of adding a quota expression that we can plug into our
existing infrastructure.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/Kconfig')
| -rw-r--r-- | net/netfilter/Kconfig | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index 9cfaa00c79b2..29a8078deafa 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -542,6 +542,12 @@ config NFT_QUEUE This is required if you intend to use the userspace queueing infrastructure (also known as NFQUEUE) from nftables. +config NFT_QUOTA + tristate "Netfilter nf_tables quota module" + help + This option adds the "quota" expression that you can use to match + enforce bytes quotas. + config NFT_REJECT default m if NETFILTER_ADVANCED=n tristate "Netfilter nf_tables reject support" |