Is it possible to implement traffic quotas (absolute limits, not rate limits) based on the network classifier cgroup?
I see there is the iptables netfilter 'quota' extension, which seems to do essentially what I am trying to do: On a given interface and direction, ALLOW traffic up to a given quota, then DROP - or do something else. However, since I only want to apply this quota to a given cgroup, I would have to use the net_cls module to identify the traffic.
I know I can set a rate limit using Linux traffic control (tc) based on the classid. I could also drop traffic, if I have an appropriate classifier. What I can't seem to find is either an absolute counter for tc, or a way for iptables to filter based on classid.