net/filter-rewriter.c

   1 /*
   2  * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
   3  * Copyright (c) 2016 FUJITSU LIMITED
   4  * Copyright (c) 2016 Intel Corporation
   5  *
   6  * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
   7  *
   8  * This work is licensed under the terms of the GNU GPL, version 2 or
   9  * later.  See the COPYING file in the top-level directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13 #include "trace.h"
  14 #include "colo.h"
  15 #include "net/filter.h"
  16 #include "net/net.h"
  17 #include "qemu/error-report.h"
  18 #include "qom/object.h"
  19 #include "qemu/main-loop.h"
  20 #include "qemu/iov.h"
  21 #include "net/checksum.h"
  22 #include "net/colo.h"
  23 #include "migration/colo.h"
  24 #include "util.h"
  25
  26 #define TYPE_FILTER_REWRITER "filter-rewriter"
  27 typedef struct RewriterState RewriterState;
  28 DECLARE_INSTANCE_CHECKER(RewriterState, FILTER_REWRITER,
  29                          TYPE_FILTER_REWRITER)
  30
  31 #define FAILOVER_MODE_ON  true
  32 #define FAILOVER_MODE_OFF false
  33
  34 struct RewriterState {
  35     NetFilterState parent_obj;
  36     NetQueue *incoming_queue;
  37     /* hashtable to save connection */
  38     GHashTable *connection_track_table;
  39     bool vnet_hdr;
  40     bool failover_mode;
  41 };
  42
  43 static void filter_rewriter_failover_mode(RewriterState *s)
  44 {
  45     s->failover_mode = FAILOVER_MODE_ON;
  46 }
  47
  48 static void filter_rewriter_flush(NetFilterState *nf)
  49 {
  50     RewriterState *s = FILTER_REWRITER(nf);
  51
  52     if (!qemu_net_queue_flush(s->incoming_queue)) {
  53         /* Unable to empty the queue, purge remaining packets */
  54         qemu_net_queue_purge(s->incoming_queue, nf->netdev);
  55     }
  56 }
  57
  58 /*
  59  * Return 1 on success, if return 0 means the pkt
  60  * is not TCP packet
  61  */
  62 static int is_tcp_packet(Packet *pkt)
  63 {
  64     if (!parse_packet_early(pkt) &&
  65         pkt->ip->ip_p == IPPROTO_TCP) {
  66         return 1;
  67     } else {
  68         return 0;
  69     }
  70 }
  71
  72 /* handle tcp packet from primary guest */
  73 static int handle_primary_tcp_pkt(RewriterState *rf,
  74                                   Connection *conn,
  75                                   Packet *pkt, ConnectionKey *key)
  76 {
  77     struct tcp_hdr *tcp_pkt;
  78
  79     tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
  80     if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) {
  81         trace_colo_filter_rewriter_pkt_info(__func__,
  82                     inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
  83                     ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
  84                     tcp_pkt->th_flags);
  85     }
  86     if (trace_event_get_state_backends(
  87           TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) {
  88         trace_colo_filter_rewriter_conn_offset(conn->offset);
  89     }
  90
  91     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) &&
  92         conn->tcp_state == TCPS_SYN_SENT) {
  93         conn->tcp_state = TCPS_ESTABLISHED;
  94     }
  95
  96     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
  97         /*
  98          * we use this flag update offset func
  99          * run once in independent tcp connection
 100          */
 101         conn->tcp_state = TCPS_SYN_RECEIVED;
 102     }
 103
 104     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) {
 105         if (conn->tcp_state == TCPS_SYN_RECEIVED) {
 106             /*
 107              * offset = secondary_seq - primary seq
 108              * ack packet sent by guest from primary node,
 109              * so we use th_ack - 1 get primary_seq
 110              */
 111             conn->offset -= (ntohl(tcp_pkt->th_ack) - 1);
 112             conn->tcp_state = TCPS_ESTABLISHED;
 113         }
 114         if (conn->offset) {
 115             /* handle packets to the secondary from the primary */
 116             tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset);
 117
 118             net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
 119                                    pkt->size - pkt->vnet_hdr_len);
 120         }
 121
 122         /*
 123          * Passive close step 3
 124          */
 125         if ((conn->tcp_state == TCPS_LAST_ACK) &&
 126             (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) {
 127             conn->tcp_state = TCPS_CLOSED;
 128             g_hash_table_remove(rf->connection_track_table, key);
 129         }
 130     }
 131
 132     if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) {
 133         /*
 134          * Passive close.
 135          * Step 1:
 136          * The *server* side of this connect is VM, *client* tries to close
 137          * the connection. We will into CLOSE_WAIT status.
 138          *
 139          * Step 2:
 140          * In this step we will into LAST_ACK status.
 141          *
 142          * We got 'fin=1, ack=1' packet from server side, we need to
 143          * record the seq of 'fin=1, ack=1' packet.
 144          *
 145          * Step 3:
 146          * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1'
 147          * packet from server side. From this point, we can ensure that there
 148          * will be no packets in the connection, except that, some errors
 149          * happen between the path of 'filter object' and vNIC, if this rare
 150          * case really happen, we can still create a new connection,
 151          * So it is safe to remove the connection from connection_track_table.
 152          *
 153          */
 154         if (conn->tcp_state == TCPS_ESTABLISHED) {
 155             conn->tcp_state = TCPS_CLOSE_WAIT;
 156         }
 157
 158         /*
 159          * Active close step 2.
 160          */
 161         if (conn->tcp_state == TCPS_FIN_WAIT_1) {
 162             /*
 163              * For simplify implementation, we needn't wait 2MSL time
 164              * in filter rewriter. Because guest kernel will track the
 165              * TCP status and wait 2MSL time, if client resend the FIN
 166              * packet, guest will apply the last ACK too.
 167              * So, we skip the TCPS_TIME_WAIT state here and go straight
 168              * to TCPS_CLOSED state.
 169              */
 170             conn->tcp_state = TCPS_CLOSED;
 171             g_hash_table_remove(rf->connection_track_table, key);
 172         }
 173     }
 174
 175     return 0;
 176 }
 177
 178 /* handle tcp packet from secondary guest */
 179 static int handle_secondary_tcp_pkt(RewriterState *rf,
 180                                     Connection *conn,
 181                                     Packet *pkt, ConnectionKey *key)
 182 {
 183     struct tcp_hdr *tcp_pkt;
 184
 185     tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
 186
 187     if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) {
 188         trace_colo_filter_rewriter_pkt_info(__func__,
 189                     inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
 190                     ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
 191                     tcp_pkt->th_flags);
 192     }
 193     if (trace_event_get_state_backends(
 194           TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) {
 195         trace_colo_filter_rewriter_conn_offset(conn->offset);
 196     }
 197
 198     if (conn->tcp_state == TCPS_SYN_RECEIVED &&
 199         ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) {
 200         /*
 201          * save offset = secondary_seq and then
 202          * in handle_primary_tcp_pkt make offset
 203          * = secondary_seq - primary_seq
 204          */
 205         conn->offset = ntohl(tcp_pkt->th_seq);
 206     }
 207
 208     /* VM active connect */
 209     if (conn->tcp_state == TCPS_CLOSED &&
 210         ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
 211         conn->tcp_state = TCPS_SYN_SENT;
 212     }
 213
 214     if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) {
 215         /* Only need to adjust seq while offset is Non-zero */
 216         if (conn->offset) {
 217             /* handle packets to the primary from the secondary*/
 218             tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset);
 219
 220             net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
 221                                    pkt->size - pkt->vnet_hdr_len);
 222         }
 223     }
 224
 225     /*
 226      * Passive close step 2:
 227      */
 228     if (conn->tcp_state == TCPS_CLOSE_WAIT &&
 229         (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) {
 230         conn->fin_ack_seq = ntohl(tcp_pkt->th_seq);
 231         conn->tcp_state = TCPS_LAST_ACK;
 232     }
 233
 234     /*
 235      * Active close
 236      *
 237      * Step 1:
 238      * The *server* side of this connect is VM, *server* tries to close
 239      * the connection.
 240      *
 241      * Step 2:
 242      * We will into CLOSE_WAIT status.
 243      * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and
 244      * CLOSING status.
 245      */
 246     if (conn->tcp_state == TCPS_ESTABLISHED &&
 247         (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) {
 248         conn->tcp_state = TCPS_FIN_WAIT_1;
 249     }
 250
 251     return 0;
 252 }
 253
 254 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
 255                                          NetClientState *sender,
 256                                          unsigned flags,
 257                                          const struct iovec *iov,
 258                                          int iovcnt,
 259                                          NetPacketSent *sent_cb)
 260 {
 261     RewriterState *s = FILTER_REWRITER(nf);
 262     Connection *conn;
 263     ConnectionKey key;
 264     Packet *pkt;
 265     ssize_t size = iov_size(iov, iovcnt);
 266     ssize_t vnet_hdr_len = 0;
 267     char *buf = g_malloc0(size);
 268
 269     iov_to_buf(iov, iovcnt, 0, buf, size);
 270
 271     if (s->vnet_hdr) {
 272         vnet_hdr_len = nf->netdev->vnet_hdr_len;
 273     }
 274
 275     pkt = packet_new(buf, size, vnet_hdr_len);
 276     g_free(buf);
 277
 278     /*
 279      * if we get tcp packet
 280      * we will rewrite it to make secondary guest's
 281      * connection established successfully
 282      */
 283     if (pkt && is_tcp_packet(pkt)) {
 284
 285         fill_connection_key(pkt, &key);
 286
 287         if (sender == nf->netdev) {
 288             /*
 289              * We need make tcp TX and RX packet
 290              * into one connection.
 291              */
 292             reverse_connection_key(&key);
 293         }
 294
 295         /* After failover we needn't change new TCP packet */
 296         if (s->failover_mode &&
 297             !connection_has_tracked(s->connection_track_table, &key)) {
 298             goto out;
 299         }
 300
 301         conn = connection_get(s->connection_track_table,
 302                               &key,
 303                               NULL);
 304
 305         if (sender == nf->netdev) {
 306             /* NET_FILTER_DIRECTION_TX */
 307             if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) {
 308                 qemu_net_queue_send(s->incoming_queue, sender, 0,
 309                 (const uint8_t *)pkt->data, pkt->size, NULL);
 310                 packet_destroy(pkt, NULL);
 311                 pkt = NULL;
 312                 /*
 313                  * We block the packet here,after rewrite pkt
 314                  * and will send it
 315                  */
 316                 return 1;
 317             }
 318         } else {
 319             /* NET_FILTER_DIRECTION_RX */
 320             if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) {
 321                 qemu_net_queue_send(s->incoming_queue, sender, 0,
 322                 (const uint8_t *)pkt->data, pkt->size, NULL);
 323                 packet_destroy(pkt, NULL);
 324                 pkt = NULL;
 325                 /*
 326                  * We block the packet here,after rewrite pkt
 327                  * and will send it
 328                  */
 329                 return 1;
 330             }
 331         }
 332     }
 333
 334 out:
 335     packet_destroy(pkt, NULL);
 336     pkt = NULL;
 337     return 0;
 338 }
 339
 340 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data)
 341 {
 342     Connection *conn = (Connection *)value;
 343
 344     conn->offset = 0;
 345 }
 346
 347 static gboolean offset_is_nonzero(gpointer key,
 348                                   gpointer value,
 349                                   gpointer user_data)
 350 {
 351     Connection *conn = (Connection *)value;
 352
 353     return conn->offset ? true : false;
 354 }
 355
 356 static void colo_rewriter_handle_event(NetFilterState *nf, int event,
 357                                        Error **errp)
 358 {
 359     RewriterState *rs = FILTER_REWRITER(nf);
 360
 361     switch (event) {
 362     case COLO_EVENT_CHECKPOINT:
 363         g_hash_table_foreach(rs->connection_track_table,
 364                             reset_seq_offset, NULL);
 365         break;
 366     case COLO_EVENT_FAILOVER:
 367         if (!g_hash_table_find(rs->connection_track_table,
 368                               offset_is_nonzero, NULL)) {
 369             filter_rewriter_failover_mode(rs);
 370         }
 371         break;
 372     default:
 373         break;
 374     }
 375 }
 376
 377 static void colo_rewriter_cleanup(NetFilterState *nf)
 378 {
 379     RewriterState *s = FILTER_REWRITER(nf);
 380
 381     /* flush packets */
 382     if (s->incoming_queue) {
 383         filter_rewriter_flush(nf);
 384         g_free(s->incoming_queue);
 385     }
 386 }
 387
 388 static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
 389 {
 390     RewriterState *s = FILTER_REWRITER(nf);
 391
 392     s->connection_track_table = g_hash_table_new_full(connection_key_hash,
 393                                                       connection_key_equal,
 394                                                       g_free,
 395                                                       connection_destroy);
 396     s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
 397 }
 398
 399 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp)
 400 {
 401     RewriterState *s = FILTER_REWRITER(obj);
 402
 403     return s->vnet_hdr;
 404 }
 405
 406 static void filter_rewriter_set_vnet_hdr(Object *obj,
 407                                          bool value,
 408                                          Error **errp)
 409 {
 410     RewriterState *s = FILTER_REWRITER(obj);
 411
 412     s->vnet_hdr = value;
 413 }
 414
 415 static void filter_rewriter_init(Object *obj)
 416 {
 417     RewriterState *s = FILTER_REWRITER(obj);
 418
 419     s->vnet_hdr = false;
 420     s->failover_mode = FAILOVER_MODE_OFF;
 421     object_property_add_bool(obj, "vnet_hdr_support",
 422                              filter_rewriter_get_vnet_hdr,
 423                              filter_rewriter_set_vnet_hdr);
 424 }
 425
 426 static void colo_rewriter_class_init(ObjectClass *oc, void *data)
 427 {
 428     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 429
 430     nfc->setup = colo_rewriter_setup;
 431     nfc->cleanup = colo_rewriter_cleanup;
 432     nfc->receive_iov = colo_rewriter_receive_iov;
 433     nfc->handle_event = colo_rewriter_handle_event;
 434 }
 435
 436 static const TypeInfo colo_rewriter_info = {
 437     .name = TYPE_FILTER_REWRITER,
 438     .parent = TYPE_NETFILTER,
 439     .class_init = colo_rewriter_class_init,
 440     .instance_init = filter_rewriter_init,
 441     .instance_size = sizeof(RewriterState),
 442 };
 443
 444 static void register_types(void)
 445 {
 446     type_register_static(&colo_rewriter_info);
 447 }
 448
 449 type_init(register_types);