cgroupv2 nft rule about nftables

[turekt]

Hi @ramonskie,

you have correctly identified where the problem is. It seems that nftables does not work with strings when it comes to specifying cgroups. For your code to work you will have to use ControlGroupID. Observe the below example:

$ nft --debug=all add rule ip filter nats_output socket cgroupv2 level 2 "system.slice/dbus.service" ip daddr 1.2.3.4 tcp dport 1234 log prefix "\"Matched cgroup myservice nats rule: \"" accept
...
ip filter nats_output
  [ socket load cgroupv2 => reg 1 ]
  [ cmp eq reg 1 0x00000b06 0x00000000 ]
  [ payload load 4b @ network header + 16 => reg 1 ]
  [ cmp eq reg 1 0x04030201 ]
  [ meta load l4proto => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ payload load 2b @ transport header + 2 => reg 1 ]
  [ cmp eq reg 1 0x0000d204 ]
  [ log prefix Matched cgroup myservice nats rule:  ]
  [ immediate reg 0 accept ]
...
$ systemctl show --property ControlGroupId --value dbus.service
2822
$ python3 -c 'print(hex(2822))'
0xb06

Note that your cmp is a bit different from one created by nft cli and that the value in the register corresponds to a hex value of the ControlGroupId property:

&expr.Cmp{Register: 1, Op: expr.CmpOpEq, Data: []byte("system.slice/bosh-agent.service")}
...
cmp eq reg 1 0x00000b06 0x00000000

So, for your rule to work, you have to specify the ControlGroupId in the first expr.Cmp. Here is a working example with dbus.service having ControlGroupId set to 2822:

package main

import (
	"github.com/google/nftables"
	"github.com/google/nftables/binaryutil"
	"github.com/google/nftables/expr"
)

func main() {
	c, err := nftables.New(nftables.AsLasting())
	if err != nil {
		panic(err)
	}

	filter := c.AddTable(&nftables.Table{
		Family: nftables.TableFamilyIPv4,
		Name:   "filter",
	})

	nats := c.AddChain(&nftables.Chain{
		Name:     "nats_output",
		Hooknum:  nftables.ChainHookOutput,
		Priority: nftables.ChainPriorityFilter,
		Table:    filter,
		Type:     nftables.ChainTypeFilter,
	})

	c.AddRule(&nftables.Rule{
		Table: filter,
		Chain: nats,
		Exprs: []expr.Any{
			&expr.Socket{Key: expr.SocketKeyCgroupv2, Level: 2, Register: 1},
			// $ systemctl show --property ControlGroupId --value dbus.service
			// 2822
			&expr.Cmp{Register: 1, Op: expr.CmpOpEq, Data: binaryutil.NativeEndian.PutUint64(2822)},
			&expr.Payload{OperationType: expr.PayloadLoad, Base: expr.PayloadBaseNetworkHeader, Offset: 16, Len: 4, DestRegister: 2},
			// &expr.Cmp{Register: 2, Op: expr.CmpOpEq, Data: ipToBytes(host)},
			&expr.Cmp{Register: 2, Op: expr.CmpOpEq, Data: []byte{0x01, 0x02, 0x03, 0x04}},
			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
			&expr.Cmp{Op: 0, Register: 1, Data: []byte{6}},
			&expr.Payload{OperationType: expr.PayloadLoad, Base: expr.PayloadBaseTransportHeader, Offset: 2, Len: 2, DestRegister: 3},
			// &expr.Cmp{Register: 3, Op: expr.CmpOpEq, Data: portToBytes(port)},
			&expr.Cmp{Register: 3, Op: expr.CmpOpEq, Data: binaryutil.BigEndian.PutUint16(1234)},
			&expr.Log{Level: 4, Key: 36, Data: []byte("Matched cgroup myservice nats rule: ")},
			&expr.Verdict{Kind: expr.VerdictAccept},
		},
	})

	if err := c.Flush(); err != nil {
		panic(err)
	}
}

And working code in action:

# nft delete chain ip filter nats_output
# go run main.go
# nft list chain ip filter nats_output
table ip filter {
	chain nats_output {
		type filter hook output priority filter; policy accept;
		socket cgroupv2 level 2 "system.slice/dbus.service" ip daddr 1.2.3.4 tcp dport 1234 log prefix "Matched cgroup myservice nats rule: " accept
	}
}

I hope that this resolves your issue.

[ramonskie]

thank you very much.
i will go on the hunt for a golang lib to revrieve the controlgroup id

[ramonskie]

ppl intereset in how it was solved see:
cloudfoundry/bosh-agent#332