On Wed, Mar 06, 2019 at 01:01:26PM +0100, Mikhail Morfikov wrote:
> I'm reading a presentation concerning the netdev table of nftables[1], and I
> wanted to limit the network traffic for certain apps based on cgroups classes.
> For now all apps in my system that want to connect to the internet have to be
> explicitly allowed by nftables.
>
> Basically I use the "cgrulesengd" daemon to catch the app pids and add them
> to the cgroups "tasks" file. Then I simply set a cgroup class for the app in
> the following way:
>
> echo "6" > $CGDIR/net_cls,net_prio/user-apps/wget/net_cls.classid
>
> And I use the following nftables rules:
>
> create chain inet filter check-cgroup
> add rule inet filter OUTPUT meta cgroup { 0-4095 } counter jump check-cgroup
> add rule inet filter check-cgroup meta cgroup { 6 } tcp dport { 443, 80 } counter accept comment "wget"
>
> This setup works well, and I'm able to block certain apps from accessing the
> internet, or to just allow them to connect only using some specific ports and
> protocols.
>
> Now I want to limit a connection speed of that app. So I added the following
> rules:
>
> create table netdev traffic-control
> create chain netdev traffic-control INGRESS { type filter hook ingress device bond0 priority 0; policy accept; }
> add rule netdev traffic-control INGRESS meta cgroup { 6 } limit rate over 10 kbytes/second burst 0 bytes counter drop
>
> The rules were added successfully, but the last one doesn't limit the speed. It
> actually can't even match any packet.
>
> # nft list table netdev traffic-control
> table netdev traffic-control {
> chain INGRESS {
> type filter hook ingress device "bond0" priority filter; policy accept;
> meta cgroup { 6 } limit rate over 10 kbytes/second counter packets 0 bytes 0 drop
> }
> }
>
> # nft list table inet filter | grep wget
> meta cgroup { 6 } tcp dport { 80, 443 } counter packets 93 bytes 5580 accept comment "wget"
>
> When I remove "meta cgroup { 6 }" from the rule of the netdev table, then
> the speed starts to be limited, but of course for all apps at the same time.
>
> # nft list table netdev traffic-control
> table netdev traffic-control {
> chain INGRESS {
> type filter hook ingress device "bond0" priority filter; policy accept;
> limit rate over 10 kbytes/second counter packets 49 bytes 70952 drop
> }
> }
>
> Can cgroup classes work with the ingress hook of the netdev table?
Socket early demux comes before the prerouting hook and after ingress, see:
commit a00e76349f3564bb8129fc0510dfd93248c3084d
Author: Alexey Perevalov <a.perevalov@xxxxxxxxxxx>
Date: Wed Mar 19 10:58:42 2014 +0400
netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks
The information is not available until we get there.
Once conntrack for netdev table is in place, we can probably achieve
this via marks.
Another posibility to use nft_socket from your netdev ruleset, this
triggers an implicit socket lookup when checking for the socket mark.
A bit kludgy as it is now, probably better to have a explicit
NFT_SOCKET_EXISTS there that we can call from the ingress path, then
match on the cgroup information.
All this looks doable to me.
