Nftables, netdev table, ingress hook and cgroup classes

[Mikhail Morfikov <mmorfikov@xxxxxxxxx>]

I'm reading a presentation concerning the netdev table of nftables[1], and I
wanted to limit the network traffic for certain apps based on cgroups classes.
For now all apps in my system that want to connect to the internet have to be
explicitly allowed by nftables.

Basically I use the "cgrulesengd" daemon to catch the app pids and add them
to the cgroups "tasks" file. Then I simply set a cgroup class for the app in
the following way:

    echo "6" > $CGDIR/net_cls,net_prio/user-apps/wget/net_cls.classid

And I use the following nftables rules:

   create chain inet filter check-cgroup
   add rule inet filter OUTPUT meta cgroup { 0-4095 } counter jump check-cgroup
   add rule inet filter check-cgroup meta cgroup { 6 } tcp dport { 443, 80 } counter accept comment "wget"

This setup works well, and I'm able to block certain apps from accessing the
internet, or to just allow them to connect only using some specific ports and
protocols.

Now I want to limit a connection speed of that app. So I added the following
rules:

    create table netdev traffic-control
    create chain netdev traffic-control INGRESS { type filter hook ingress device bond0 priority 0; policy accept; }
    add rule netdev traffic-control INGRESS meta cgroup { 6 } limit rate over 10 kbytes/second burst 0 bytes counter drop

The rules were added successfully, but the last one doesn't limit the speed. It
actually can't even match any packet.

# nft list table netdev traffic-control
table netdev traffic-control {
        chain INGRESS {
                type filter hook ingress device "bond0" priority filter; policy accept;
                meta cgroup { 6 } limit rate over 10 kbytes/second counter packets 0 bytes 0 drop
        }
}

# nft list table inet filter | grep wget
                meta cgroup { 6 } tcp dport { 80, 443 } counter packets 93 bytes 5580 accept comment "wget"

When I remove "meta cgroup { 6 }" from the rule of the netdev table, then 
the speed starts to be limited, but of course for all apps at the same time.

# nft list table netdev traffic-control
table netdev traffic-control {
        chain INGRESS {
                type filter hook ingress device "bond0" priority filter; policy accept;
                limit rate over 10 kbytes/second counter packets 49 bytes 70952 drop
        }
}

Can cgroup classes work with the ingress hook of the netdev table?


[1] https://www.netdevconf.org/1.1/proceedings/slides/pablo-neira-nft-ingress.pdf

Attachment: signature.asc
Description: OpenPGP digital signature