2 * Copyright (c) 2015 FUJITSU LIMITED
3 * Author: Yang Hongyang <yanghy@cn.fujitsu.com>
5 * This work is licensed under the terms of the GNU GPL, version 2 or
6 * later. See the COPYING file in the top-level directory.
9 #include "qemu/osdep.h"
10 #include "qemu-common.h"
11 #include "qapi/qmp/qerror.h"
12 #include "qemu/error-report.h"
14 #include "net/filter.h"
16 #include "net/vhost_net.h"
17 #include "qom/object_interfaces.h"
20 static inline bool qemu_can_skip_netfilter(NetFilterState
*nf
)
25 ssize_t
qemu_netfilter_receive(NetFilterState
*nf
,
26 NetFilterDirection direction
,
27 NetClientState
*sender
,
29 const struct iovec
*iov
,
31 NetPacketSent
*sent_cb
)
33 if (qemu_can_skip_netfilter(nf
)) {
36 if (nf
->direction
== direction
||
37 nf
->direction
== NET_FILTER_DIRECTION_ALL
) {
38 return NETFILTER_GET_CLASS(OBJECT(nf
))->receive_iov(
39 nf
, sender
, flags
, iov
, iovcnt
, sent_cb
);
45 static NetFilterState
*netfilter_next(NetFilterState
*nf
,
46 NetFilterDirection dir
)
50 if (dir
== NET_FILTER_DIRECTION_TX
) {
51 /* forward walk through filters */
52 next
= QTAILQ_NEXT(nf
, next
);
55 next
= QTAILQ_PREV(nf
, NetFilterHead
, next
);
61 ssize_t
qemu_netfilter_pass_to_next(NetClientState
*sender
,
63 const struct iovec
*iov
,
69 NetFilterState
*nf
= opaque
;
70 NetFilterState
*next
= NULL
;
72 if (!sender
|| !sender
->peer
) {
73 /* no receiver, or sender been deleted, no need to pass it further */
77 if (nf
->direction
== NET_FILTER_DIRECTION_ALL
) {
78 if (sender
== nf
->netdev
) {
79 /* This packet is sent by netdev itself */
80 direction
= NET_FILTER_DIRECTION_TX
;
82 direction
= NET_FILTER_DIRECTION_RX
;
85 direction
= nf
->direction
;
88 next
= netfilter_next(nf
, direction
);
91 * if qemu_netfilter_pass_to_next been called, means that
92 * the packet has been hold by filter and has already retured size
93 * to the sender, so sent_cb shouldn't be called later, just
96 ret
= qemu_netfilter_receive(next
, direction
, sender
, flags
, iov
,
101 next
= netfilter_next(next
, direction
);
105 * We have gone through all filters, pass it to receiver.
106 * Do the valid check again incase sender or receiver been
107 * deleted while we go through filters.
109 if (sender
&& sender
->peer
) {
110 qemu_net_queue_send_iov(sender
->peer
->incoming_queue
,
111 sender
, flags
, iov
, iovcnt
, NULL
);
115 /* no receiver, or sender been deleted */
116 return iov_size(iov
, iovcnt
);
119 static char *netfilter_get_netdev_id(Object
*obj
, Error
**errp
)
121 NetFilterState
*nf
= NETFILTER(obj
);
123 return g_strdup(nf
->netdev_id
);
126 static void netfilter_set_netdev_id(Object
*obj
, const char *str
, Error
**errp
)
128 NetFilterState
*nf
= NETFILTER(obj
);
130 nf
->netdev_id
= g_strdup(str
);
133 static int netfilter_get_direction(Object
*obj
, Error
**errp G_GNUC_UNUSED
)
135 NetFilterState
*nf
= NETFILTER(obj
);
136 return nf
->direction
;
139 static void netfilter_set_direction(Object
*obj
, int direction
, Error
**errp
)
141 NetFilterState
*nf
= NETFILTER(obj
);
142 nf
->direction
= direction
;
145 static char *netfilter_get_status(Object
*obj
, Error
**errp
)
147 NetFilterState
*nf
= NETFILTER(obj
);
149 return nf
->on
? g_strdup("on") : g_strdup("off");
152 static void netfilter_set_status(Object
*obj
, const char *str
, Error
**errp
)
154 NetFilterState
*nf
= NETFILTER(obj
);
155 NetFilterClass
*nfc
= NETFILTER_GET_CLASS(obj
);
157 if (strcmp(str
, "on") && strcmp(str
, "off")) {
158 error_setg(errp
, "Invalid value for netfilter status, "
159 "should be 'on' or 'off'");
162 if (nf
->on
== !strcmp(str
, "on")) {
166 if (nfc
->status_changed
) {
167 nfc
->status_changed(nf
, errp
);
171 static void netfilter_init(Object
*obj
)
173 NetFilterState
*nf
= NETFILTER(obj
);
177 object_property_add_str(obj
, "netdev",
178 netfilter_get_netdev_id
, netfilter_set_netdev_id
,
180 object_property_add_enum(obj
, "queue", "NetFilterDirection",
181 NetFilterDirection_lookup
,
182 netfilter_get_direction
, netfilter_set_direction
,
184 object_property_add_str(obj
, "status",
185 netfilter_get_status
, netfilter_set_status
,
189 static void netfilter_complete(UserCreatable
*uc
, Error
**errp
)
191 NetFilterState
*nf
= NETFILTER(uc
);
192 NetClientState
*ncs
[MAX_QUEUE_NUM
];
193 NetFilterClass
*nfc
= NETFILTER_GET_CLASS(uc
);
195 Error
*local_err
= NULL
;
197 if (!nf
->netdev_id
) {
198 error_setg(errp
, "Parameter 'netdev' is required");
202 queues
= qemu_find_net_clients_except(nf
->netdev_id
, ncs
,
203 NET_CLIENT_OPTIONS_KIND_NIC
,
206 error_setg(errp
, QERR_INVALID_PARAMETER_VALUE
, "netdev",
207 "a network backend id");
209 } else if (queues
> 1) {
210 error_setg(errp
, "multiqueue is not supported");
214 if (get_vhost_net(ncs
[0])) {
215 error_setg(errp
, "Vhost is not supported");
222 nfc
->setup(nf
, &local_err
);
224 error_propagate(errp
, local_err
);
228 QTAILQ_INSERT_TAIL(&nf
->netdev
->filters
, nf
, next
);
231 static void netfilter_finalize(Object
*obj
)
233 NetFilterState
*nf
= NETFILTER(obj
);
234 NetFilterClass
*nfc
= NETFILTER_GET_CLASS(obj
);
240 if (nf
->netdev
&& !QTAILQ_EMPTY(&nf
->netdev
->filters
) &&
242 QTAILQ_REMOVE(&nf
->netdev
->filters
, nf
, next
);
244 g_free(nf
->netdev_id
);
247 static void netfilter_class_init(ObjectClass
*oc
, void *data
)
249 UserCreatableClass
*ucc
= USER_CREATABLE_CLASS(oc
);
251 ucc
->complete
= netfilter_complete
;
254 static const TypeInfo netfilter_info
= {
255 .name
= TYPE_NETFILTER
,
256 .parent
= TYPE_OBJECT
,
258 .class_size
= sizeof(NetFilterClass
),
259 .class_init
= netfilter_class_init
,
260 .instance_size
= sizeof(NetFilterState
),
261 .instance_init
= netfilter_init
,
262 .instance_finalize
= netfilter_finalize
,
263 .interfaces
= (InterfaceInfo
[]) {
264 { TYPE_USER_CREATABLE
},
269 static void register_types(void)
271 type_register_static(&netfilter_info
);
274 type_init(register_types
);