2 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
3 * Copyright (c) 2016 FUJITSU LIMITED
4 * Copyright (c) 2016 Intel Corporation
6 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
8 * This work is licensed under the terms of the GNU GPL, version 2 or
9 * later. See the COPYING file in the top-level directory.
12 #include "qemu/osdep.h"
15 #include "net/filter.h"
17 #include "qemu/error-report.h"
18 #include "qom/object.h"
19 #include "qemu/main-loop.h"
21 #include "net/checksum.h"
23 #include "migration/colo.h"
26 #define TYPE_FILTER_REWRITER "filter-rewriter"
27 typedef struct RewriterState RewriterState
;
28 DECLARE_INSTANCE_CHECKER(RewriterState
, FILTER_REWRITER
,
31 #define FAILOVER_MODE_ON true
32 #define FAILOVER_MODE_OFF false
34 struct RewriterState
{
35 NetFilterState parent_obj
;
36 NetQueue
*incoming_queue
;
37 /* hashtable to save connection */
38 GHashTable
*connection_track_table
;
43 static void filter_rewriter_failover_mode(RewriterState
*s
)
45 s
->failover_mode
= FAILOVER_MODE_ON
;
48 static void filter_rewriter_flush(NetFilterState
*nf
)
50 RewriterState
*s
= FILTER_REWRITER(nf
);
52 if (!qemu_net_queue_flush(s
->incoming_queue
)) {
53 /* Unable to empty the queue, purge remaining packets */
54 qemu_net_queue_purge(s
->incoming_queue
, nf
->netdev
);
59 * Return 1 on success, if return 0 means the pkt
62 static int is_tcp_packet(Packet
*pkt
)
64 if (!parse_packet_early(pkt
) &&
65 pkt
->ip
->ip_p
== IPPROTO_TCP
) {
72 /* handle tcp packet from primary guest */
73 static int handle_primary_tcp_pkt(RewriterState
*rf
,
75 Packet
*pkt
, ConnectionKey
*key
)
77 struct tcp_hdr
*tcp_pkt
;
79 tcp_pkt
= (struct tcp_hdr
*)pkt
->transport_header
;
80 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO
)) {
81 trace_colo_filter_rewriter_pkt_info(__func__
,
82 inet_ntoa(pkt
->ip
->ip_src
), inet_ntoa(pkt
->ip
->ip_dst
),
83 ntohl(tcp_pkt
->th_seq
), ntohl(tcp_pkt
->th_ack
),
86 if (trace_event_get_state_backends(
87 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET
)) {
88 trace_colo_filter_rewriter_conn_offset(conn
->offset
);
91 if (((tcp_pkt
->th_flags
& (TH_ACK
| TH_SYN
)) == (TH_ACK
| TH_SYN
)) &&
92 conn
->tcp_state
== TCPS_SYN_SENT
) {
93 conn
->tcp_state
= TCPS_ESTABLISHED
;
96 if (((tcp_pkt
->th_flags
& (TH_ACK
| TH_SYN
)) == TH_SYN
)) {
98 * we use this flag update offset func
99 * run once in independent tcp connection
101 conn
->tcp_state
= TCPS_SYN_RECEIVED
;
104 if (((tcp_pkt
->th_flags
& (TH_ACK
| TH_SYN
)) == TH_ACK
)) {
105 if (conn
->tcp_state
== TCPS_SYN_RECEIVED
) {
107 * offset = secondary_seq - primary seq
108 * ack packet sent by guest from primary node,
109 * so we use th_ack - 1 get primary_seq
111 conn
->offset
-= (ntohl(tcp_pkt
->th_ack
) - 1);
112 conn
->tcp_state
= TCPS_ESTABLISHED
;
115 /* handle packets to the secondary from the primary */
116 tcp_pkt
->th_ack
= htonl(ntohl(tcp_pkt
->th_ack
) + conn
->offset
);
118 net_checksum_calculate((uint8_t *)pkt
->data
+ pkt
->vnet_hdr_len
,
119 pkt
->size
- pkt
->vnet_hdr_len
);
123 * Passive close step 3
125 if ((conn
->tcp_state
== TCPS_LAST_ACK
) &&
126 (ntohl(tcp_pkt
->th_ack
) == (conn
->fin_ack_seq
+ 1))) {
127 conn
->tcp_state
= TCPS_CLOSED
;
128 g_hash_table_remove(rf
->connection_track_table
, key
);
132 if ((tcp_pkt
->th_flags
& TH_FIN
) == TH_FIN
) {
136 * The *server* side of this connect is VM, *client* tries to close
137 * the connection. We will into CLOSE_WAIT status.
140 * In this step we will into LAST_ACK status.
142 * We got 'fin=1, ack=1' packet from server side, we need to
143 * record the seq of 'fin=1, ack=1' packet.
146 * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1'
147 * packet from server side. From this point, we can ensure that there
148 * will be no packets in the connection, except that, some errors
149 * happen between the path of 'filter object' and vNIC, if this rare
150 * case really happen, we can still create a new connection,
151 * So it is safe to remove the connection from connection_track_table.
154 if (conn
->tcp_state
== TCPS_ESTABLISHED
) {
155 conn
->tcp_state
= TCPS_CLOSE_WAIT
;
159 * Active close step 2.
161 if (conn
->tcp_state
== TCPS_FIN_WAIT_1
) {
163 * For simplify implementation, we needn't wait 2MSL time
164 * in filter rewriter. Because guest kernel will track the
165 * TCP status and wait 2MSL time, if client resend the FIN
166 * packet, guest will apply the last ACK too.
167 * So, we skip the TCPS_TIME_WAIT state here and go straight
168 * to TCPS_CLOSED state.
170 conn
->tcp_state
= TCPS_CLOSED
;
171 g_hash_table_remove(rf
->connection_track_table
, key
);
178 /* handle tcp packet from secondary guest */
179 static int handle_secondary_tcp_pkt(RewriterState
*rf
,
181 Packet
*pkt
, ConnectionKey
*key
)
183 struct tcp_hdr
*tcp_pkt
;
185 tcp_pkt
= (struct tcp_hdr
*)pkt
->transport_header
;
187 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO
)) {
188 trace_colo_filter_rewriter_pkt_info(__func__
,
189 inet_ntoa(pkt
->ip
->ip_src
), inet_ntoa(pkt
->ip
->ip_dst
),
190 ntohl(tcp_pkt
->th_seq
), ntohl(tcp_pkt
->th_ack
),
193 if (trace_event_get_state_backends(
194 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET
)) {
195 trace_colo_filter_rewriter_conn_offset(conn
->offset
);
198 if (conn
->tcp_state
== TCPS_SYN_RECEIVED
&&
199 ((tcp_pkt
->th_flags
& (TH_ACK
| TH_SYN
)) == (TH_ACK
| TH_SYN
))) {
201 * save offset = secondary_seq and then
202 * in handle_primary_tcp_pkt make offset
203 * = secondary_seq - primary_seq
205 conn
->offset
= ntohl(tcp_pkt
->th_seq
);
208 /* VM active connect */
209 if (conn
->tcp_state
== TCPS_CLOSED
&&
210 ((tcp_pkt
->th_flags
& (TH_ACK
| TH_SYN
)) == TH_SYN
)) {
211 conn
->tcp_state
= TCPS_SYN_SENT
;
214 if ((tcp_pkt
->th_flags
& (TH_ACK
| TH_SYN
)) == TH_ACK
) {
215 /* Only need to adjust seq while offset is Non-zero */
217 /* handle packets to the primary from the secondary*/
218 tcp_pkt
->th_seq
= htonl(ntohl(tcp_pkt
->th_seq
) - conn
->offset
);
220 net_checksum_calculate((uint8_t *)pkt
->data
+ pkt
->vnet_hdr_len
,
221 pkt
->size
- pkt
->vnet_hdr_len
);
226 * Passive close step 2:
228 if (conn
->tcp_state
== TCPS_CLOSE_WAIT
&&
229 (tcp_pkt
->th_flags
& (TH_ACK
| TH_FIN
)) == (TH_ACK
| TH_FIN
)) {
230 conn
->fin_ack_seq
= ntohl(tcp_pkt
->th_seq
);
231 conn
->tcp_state
= TCPS_LAST_ACK
;
238 * The *server* side of this connect is VM, *server* tries to close
242 * We will into CLOSE_WAIT status.
243 * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and
246 if (conn
->tcp_state
== TCPS_ESTABLISHED
&&
247 (tcp_pkt
->th_flags
& (TH_ACK
| TH_FIN
)) == TH_FIN
) {
248 conn
->tcp_state
= TCPS_FIN_WAIT_1
;
254 static ssize_t
colo_rewriter_receive_iov(NetFilterState
*nf
,
255 NetClientState
*sender
,
257 const struct iovec
*iov
,
259 NetPacketSent
*sent_cb
)
261 RewriterState
*s
= FILTER_REWRITER(nf
);
265 ssize_t size
= iov_size(iov
, iovcnt
);
266 ssize_t vnet_hdr_len
= 0;
267 char *buf
= g_malloc0(size
);
269 iov_to_buf(iov
, iovcnt
, 0, buf
, size
);
272 vnet_hdr_len
= nf
->netdev
->vnet_hdr_len
;
275 pkt
= packet_new(buf
, size
, vnet_hdr_len
);
279 * if we get tcp packet
280 * we will rewrite it to make secondary guest's
281 * connection established successfully
283 if (pkt
&& is_tcp_packet(pkt
)) {
285 fill_connection_key(pkt
, &key
);
287 if (sender
== nf
->netdev
) {
289 * We need make tcp TX and RX packet
290 * into one connection.
292 reverse_connection_key(&key
);
295 /* After failover we needn't change new TCP packet */
296 if (s
->failover_mode
&&
297 !connection_has_tracked(s
->connection_track_table
, &key
)) {
301 conn
= connection_get(s
->connection_track_table
,
305 if (sender
== nf
->netdev
) {
306 /* NET_FILTER_DIRECTION_TX */
307 if (!handle_primary_tcp_pkt(s
, conn
, pkt
, &key
)) {
308 qemu_net_queue_send(s
->incoming_queue
, sender
, 0,
309 (const uint8_t *)pkt
->data
, pkt
->size
, NULL
);
310 packet_destroy(pkt
, NULL
);
313 * We block the packet here,after rewrite pkt
319 /* NET_FILTER_DIRECTION_RX */
320 if (!handle_secondary_tcp_pkt(s
, conn
, pkt
, &key
)) {
321 qemu_net_queue_send(s
->incoming_queue
, sender
, 0,
322 (const uint8_t *)pkt
->data
, pkt
->size
, NULL
);
323 packet_destroy(pkt
, NULL
);
326 * We block the packet here,after rewrite pkt
335 packet_destroy(pkt
, NULL
);
340 static void reset_seq_offset(gpointer key
, gpointer value
, gpointer user_data
)
342 Connection
*conn
= (Connection
*)value
;
347 static gboolean
offset_is_nonzero(gpointer key
,
351 Connection
*conn
= (Connection
*)value
;
353 return conn
->offset
? true : false;
356 static void colo_rewriter_handle_event(NetFilterState
*nf
, int event
,
359 RewriterState
*rs
= FILTER_REWRITER(nf
);
362 case COLO_EVENT_CHECKPOINT
:
363 g_hash_table_foreach(rs
->connection_track_table
,
364 reset_seq_offset
, NULL
);
366 case COLO_EVENT_FAILOVER
:
367 if (!g_hash_table_find(rs
->connection_track_table
,
368 offset_is_nonzero
, NULL
)) {
369 filter_rewriter_failover_mode(rs
);
377 static void colo_rewriter_cleanup(NetFilterState
*nf
)
379 RewriterState
*s
= FILTER_REWRITER(nf
);
382 if (s
->incoming_queue
) {
383 filter_rewriter_flush(nf
);
384 g_free(s
->incoming_queue
);
388 static void colo_rewriter_setup(NetFilterState
*nf
, Error
**errp
)
390 RewriterState
*s
= FILTER_REWRITER(nf
);
392 s
->connection_track_table
= g_hash_table_new_full(connection_key_hash
,
393 connection_key_equal
,
396 s
->incoming_queue
= qemu_new_net_queue(qemu_netfilter_pass_to_next
, nf
);
399 static bool filter_rewriter_get_vnet_hdr(Object
*obj
, Error
**errp
)
401 RewriterState
*s
= FILTER_REWRITER(obj
);
406 static void filter_rewriter_set_vnet_hdr(Object
*obj
,
410 RewriterState
*s
= FILTER_REWRITER(obj
);
415 static void filter_rewriter_init(Object
*obj
)
417 RewriterState
*s
= FILTER_REWRITER(obj
);
420 s
->failover_mode
= FAILOVER_MODE_OFF
;
421 object_property_add_bool(obj
, "vnet_hdr_support",
422 filter_rewriter_get_vnet_hdr
,
423 filter_rewriter_set_vnet_hdr
);
426 static void colo_rewriter_class_init(ObjectClass
*oc
, void *data
)
428 NetFilterClass
*nfc
= NETFILTER_CLASS(oc
);
430 nfc
->setup
= colo_rewriter_setup
;
431 nfc
->cleanup
= colo_rewriter_cleanup
;
432 nfc
->receive_iov
= colo_rewriter_receive_iov
;
433 nfc
->handle_event
= colo_rewriter_handle_event
;
436 static const TypeInfo colo_rewriter_info
= {
437 .name
= TYPE_FILTER_REWRITER
,
438 .parent
= TYPE_NETFILTER
,
439 .class_init
= colo_rewriter_class_init
,
440 .instance_init
= filter_rewriter_init
,
441 .instance_size
= sizeof(RewriterState
),
444 static void register_types(void)
446 type_register_static(&colo_rewriter_info
);
449 type_init(register_types
);