Skip to contentSkip to conversation

update quota match for xtables + fix -D bug

PATCH In review Phil Oester 2 participants 2 messages Aug 2, 2006 – Aug 8, 2006 netfilter

lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 update quota match for xtables + fix -D bug

The iptables quota match has not been updated to reflect the new xtables location/structures in 2.6.18-rc. In addition, it has a bug which makes it impossible to delete a rule once added. E.g.:

# iptables -A foo -m quota --quota 1111 -j RETURN
# iptables -D foo -m quota --quota 1111 -j RETURN
iptables: Bad rule (does a matching rule exist in that chain?)

Below patch fixes both issues and resolve bugzilla #496.

Phil

extensions/libipt_quota.c +7 -6
diff -ru ipt-orig/extensions/libipt_quota.c ipt-new/extensions/libipt_quota.c
@@ -3,12 +3,13 @@
  *
  * Sam Johnston <[email protected]>
  */
+#include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <getopt.h>
 #include <iptables.h>
 
-#include <linux/netfilter_ipv4/ipt_quota.h>
+#include <linux/netfilter/xt_quota.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 
 static struct option opts[] = {

@@ -28,7 +29,7 @@
 static void
 print(const struct ipt_ip *ip, const struct ipt_entry_match *match, int numeric)
 {
-        struct ipt_quota_info *q = (struct ipt_quota_info *) match->data;
+        struct xt_quota_info *q = (struct xt_quota_info *) match->data;
         printf("quota: %llu bytes", (unsigned long long) q->quota);
 }
 

@@ -36,7 +37,7 @@
 static void
 save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 {
-        struct ipt_quota_info *q = (struct ipt_quota_info *) match->data;
+        struct xt_quota_info *q = (struct xt_quota_info *) match->data;
         printf("--quota %llu ", (unsigned long long) q->quota);
 }
 

@@ -62,7 +63,7 @@
       const struct ipt_entry *entry,
       unsigned int *nfcache, struct ipt_entry_match **match)
 {
-        struct ipt_quota_info *info = (struct ipt_quota_info *) (*match)->data;
+        struct xt_quota_info *info = (struct xt_quota_info *) (*match)->data;
 
         switch (c) {
         case '1':

@@ -89,8 +90,8 @@
 	.next		= NULL,
 	.name		= "quota",
 	.version	= IPTABLES_VERSION,
-	.size		= IPT_ALIGN(sizeof (struct ipt_quota_info)),
-	.userspacesize	= IPT_ALIGN(sizeof (struct ipt_quota_info)),
+	.size		= IPT_ALIGN(sizeof (struct xt_quota_info)),
+	.userspacesize	= offsetof(struct xt_quota_info, quota),
 	.help		= &help,
 	.parse		= &parse,
 	.final_check	= &final_check,
extensions/.quota-test +1 -1
diff -ru ipt-orig/extensions/.quota-test ipt-new/extensions/.quota-test
@@ -1,3 +1,3 @@
 #!/bin/sh
-[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_quota.h ] && echo quota
+[ -f $KERNEL_DIR/include/linux/netfilter/xt_quota.h ] && echo quota
#1 lore raw
Quoted 9 lines · Phil Oester

The iptables quota match has not been updated to reflect the new xtables location/structures in 2.6.18-rc. In addition, it has a bug which makes it impossible to delete a rule once added. E.g.:

# iptables -A foo -m quota --quota 1111 -j RETURN
# iptables -D foo -m quota --quota 1111 -j RETURN
iptables: Bad rule (does a matching rule exist in that chain?)

Below patch fixes both issues and resolve bugzilla #496.

Also applied, thanks.