net/filter-rewriter.c

   1 /*
   2  * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
   3  * Copyright (c) 2016 FUJITSU LIMITED
   4  * Copyright (c) 2016 Intel Corporation
   5  *
   6  * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
   7  *
   8  * This work is licensed under the terms of the GNU GPL, version 2 or
   9  * later.  See the COPYING file in the top-level directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13 #include "trace.h"
  14 #include "colo.h"
  15 #include "net/filter.h"
  16 #include "net/net.h"
  17 #include "qemu/error-report.h"
  18 #include "qom/object.h"
  19 #include "qemu/main-loop.h"
  20 #include "qemu/iov.h"
  21 #include "net/checksum.h"
  22 #include "net/colo.h"
  23 #include "migration/colo.h"
  24 #include "util.h"
  25
  26 #define FILTER_COLO_REWRITER(obj) \
  27     OBJECT_CHECK(RewriterState, (obj), TYPE_FILTER_REWRITER)
  28
  29 #define TYPE_FILTER_REWRITER "filter-rewriter"
  30 #define FAILOVER_MODE_ON  true
  31 #define FAILOVER_MODE_OFF false
  32
  33 typedef struct RewriterState {
  34     NetFilterState parent_obj;
  35     NetQueue *incoming_queue;
  36     /* hashtable to save connection */
  37     GHashTable *connection_track_table;
  38     bool vnet_hdr;
  39     bool failover_mode;
  40 } RewriterState;
  41
  42 static void filter_rewriter_failover_mode(RewriterState *s)
  43 {
  44     s->failover_mode = FAILOVER_MODE_ON;
  45 }
  46
  47 static void filter_rewriter_flush(NetFilterState *nf)
  48 {
  49     RewriterState *s = FILTER_COLO_REWRITER(nf);
  50
  51     if (!qemu_net_queue_flush(s->incoming_queue)) {
  52         /* Unable to empty the queue, purge remaining packets */
  53         qemu_net_queue_purge(s->incoming_queue, nf->netdev);
  54     }
  55 }
  56
  57 /*
  58  * Return 1 on success, if return 0 means the pkt
  59  * is not TCP packet
  60  */
  61 static int is_tcp_packet(Packet *pkt)
  62 {
  63     if (!parse_packet_early(pkt) &&
  64         pkt->ip->ip_p == IPPROTO_TCP) {
  65         return 1;
  66     } else {
  67         return 0;
  68     }
  69 }
  70
  71 /* handle tcp packet from primary guest */
  72 static int handle_primary_tcp_pkt(RewriterState *rf,
  73                                   Connection *conn,
  74                                   Packet *pkt, ConnectionKey *key)
  75 {
  76     struct tcp_hdr *tcp_pkt;
  77
  78     tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
  79     if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) {
  80         trace_colo_filter_rewriter_pkt_info(__func__,
  81                     inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
  82                     ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
  83                     tcp_pkt->th_flags);
  84     }
  85     if (trace_event_get_state_backends(
  86           TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) {
  87         trace_colo_filter_rewriter_conn_offset(conn->offset);
  88     }
  89
  90     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) &&
  91         conn->tcp_state == TCPS_SYN_SENT) {
  92         conn->tcp_state = TCPS_ESTABLISHED;
  93     }
  94
  95     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
  96         /*
  97          * we use this flag update offset func
  98          * run once in independent tcp connection
  99          */
 100         conn->tcp_state = TCPS_SYN_RECEIVED;
 101     }
 102
 103     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) {
 104         if (conn->tcp_state == TCPS_SYN_RECEIVED) {
 105             /*
 106              * offset = secondary_seq - primary seq
 107              * ack packet sent by guest from primary node,
 108              * so we use th_ack - 1 get primary_seq
 109              */
 110             conn->offset -= (ntohl(tcp_pkt->th_ack) - 1);
 111             conn->tcp_state = TCPS_ESTABLISHED;
 112         }
 113         if (conn->offset) {
 114             /* handle packets to the secondary from the primary */
 115             tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset);
 116
 117             net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
 118                                    pkt->size - pkt->vnet_hdr_len);
 119         }
 120
 121         /*
 122          * Passive close step 3
 123          */
 124         if ((conn->tcp_state == TCPS_LAST_ACK) &&
 125             (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) {
 126             conn->tcp_state = TCPS_CLOSED;
 127             g_hash_table_remove(rf->connection_track_table, key);
 128         }
 129     }
 130
 131     if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) {
 132         /*
 133          * Passive close.
 134          * Step 1:
 135          * The *server* side of this connect is VM, *client* tries to close
 136          * the connection. We will into CLOSE_WAIT status.
 137          *
 138          * Step 2:
 139          * In this step we will into LAST_ACK status.
 140          *
 141          * We got 'fin=1, ack=1' packet from server side, we need to
 142          * record the seq of 'fin=1, ack=1' packet.
 143          *
 144          * Step 3:
 145          * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1'
 146          * packet from server side. From this point, we can ensure that there
 147          * will be no packets in the connection, except that, some errors
 148          * happen between the path of 'filter object' and vNIC, if this rare
 149          * case really happen, we can still create a new connection,
 150          * So it is safe to remove the connection from connection_track_table.
 151          *
 152          */
 153         if (conn->tcp_state == TCPS_ESTABLISHED) {
 154             conn->tcp_state = TCPS_CLOSE_WAIT;
 155         }
 156
 157         /*
 158          * Active close step 2.
 159          */
 160         if (conn->tcp_state == TCPS_FIN_WAIT_1) {
 161             /*
 162              * For simplify implementation, we needn't wait 2MSL time
 163              * in filter rewriter. Because guest kernel will track the
 164              * TCP status and wait 2MSL time, if client resend the FIN
 165              * packet, guest will apply the last ACK too.
 166              * So, we skip the TCPS_TIME_WAIT state here and go straight
 167              * to TCPS_CLOSED state.
 168              */
 169             conn->tcp_state = TCPS_CLOSED;
 170             g_hash_table_remove(rf->connection_track_table, key);
 171         }
 172     }
 173
 174     return 0;
 175 }
 176
 177 /* handle tcp packet from secondary guest */
 178 static int handle_secondary_tcp_pkt(RewriterState *rf,
 179                                     Connection *conn,
 180                                     Packet *pkt, ConnectionKey *key)
 181 {
 182     struct tcp_hdr *tcp_pkt;
 183
 184     tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
 185
 186     if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) {
 187         trace_colo_filter_rewriter_pkt_info(__func__,
 188                     inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
 189                     ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
 190                     tcp_pkt->th_flags);
 191     }
 192     if (trace_event_get_state_backends(
 193           TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) {
 194         trace_colo_filter_rewriter_conn_offset(conn->offset);
 195     }
 196
 197     if (conn->tcp_state == TCPS_SYN_RECEIVED &&
 198         ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) {
 199         /*
 200          * save offset = secondary_seq and then
 201          * in handle_primary_tcp_pkt make offset
 202          * = secondary_seq - primary_seq
 203          */
 204         conn->offset = ntohl(tcp_pkt->th_seq);
 205     }
 206
 207     /* VM active connect */
 208     if (conn->tcp_state == TCPS_CLOSED &&
 209         ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
 210         conn->tcp_state = TCPS_SYN_SENT;
 211     }
 212
 213     if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) {
 214         /* Only need to adjust seq while offset is Non-zero */
 215         if (conn->offset) {
 216             /* handle packets to the primary from the secondary*/
 217             tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset);
 218
 219             net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
 220                                    pkt->size - pkt->vnet_hdr_len);
 221         }
 222     }
 223
 224     /*
 225      * Passive close step 2:
 226      */
 227     if (conn->tcp_state == TCPS_CLOSE_WAIT &&
 228         (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) {
 229         conn->fin_ack_seq = ntohl(tcp_pkt->th_seq);
 230         conn->tcp_state = TCPS_LAST_ACK;
 231     }
 232
 233     /*
 234      * Active close
 235      *
 236      * Step 1:
 237      * The *server* side of this connect is VM, *server* tries to close
 238      * the connection.
 239      *
 240      * Step 2:
 241      * We will into CLOSE_WAIT status.
 242      * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and
 243      * CLOSING status.
 244      */
 245     if (conn->tcp_state == TCPS_ESTABLISHED &&
 246         (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) {
 247         conn->tcp_state = TCPS_FIN_WAIT_1;
 248     }
 249
 250     return 0;
 251 }
 252
 253 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
 254                                          NetClientState *sender,
 255                                          unsigned flags,
 256                                          const struct iovec *iov,
 257                                          int iovcnt,
 258                                          NetPacketSent *sent_cb)
 259 {
 260     RewriterState *s = FILTER_COLO_REWRITER(nf);
 261     Connection *conn;
 262     ConnectionKey key;
 263     Packet *pkt;
 264     ssize_t size = iov_size(iov, iovcnt);
 265     ssize_t vnet_hdr_len = 0;
 266     char *buf = g_malloc0(size);
 267
 268     iov_to_buf(iov, iovcnt, 0, buf, size);
 269
 270     if (s->vnet_hdr) {
 271         vnet_hdr_len = nf->netdev->vnet_hdr_len;
 272     }
 273
 274     pkt = packet_new(buf, size, vnet_hdr_len);
 275     g_free(buf);
 276
 277     /*
 278      * if we get tcp packet
 279      * we will rewrite it to make secondary guest's
 280      * connection established successfully
 281      */
 282     if (pkt && is_tcp_packet(pkt)) {
 283
 284         fill_connection_key(pkt, &key);
 285
 286         if (sender == nf->netdev) {
 287             /*
 288              * We need make tcp TX and RX packet
 289              * into one connection.
 290              */
 291             reverse_connection_key(&key);
 292         }
 293
 294         /* After failover we needn't change new TCP packet */
 295         if (s->failover_mode &&
 296             !connection_has_tracked(s->connection_track_table, &key)) {
 297             goto out;
 298         }
 299
 300         conn = connection_get(s->connection_track_table,
 301                               &key,
 302                               NULL);
 303
 304         if (sender == nf->netdev) {
 305             /* NET_FILTER_DIRECTION_TX */
 306             if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) {
 307                 qemu_net_queue_send(s->incoming_queue, sender, 0,
 308                 (const uint8_t *)pkt->data, pkt->size, NULL);
 309                 packet_destroy(pkt, NULL);
 310                 pkt = NULL;
 311                 /*
 312                  * We block the packet here,after rewrite pkt
 313                  * and will send it
 314                  */
 315                 return 1;
 316             }
 317         } else {
 318             /* NET_FILTER_DIRECTION_RX */
 319             if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) {
 320                 qemu_net_queue_send(s->incoming_queue, sender, 0,
 321                 (const uint8_t *)pkt->data, pkt->size, NULL);
 322                 packet_destroy(pkt, NULL);
 323                 pkt = NULL;
 324                 /*
 325                  * We block the packet here,after rewrite pkt
 326                  * and will send it
 327                  */
 328                 return 1;
 329             }
 330         }
 331     }
 332
 333 out:
 334     packet_destroy(pkt, NULL);
 335     pkt = NULL;
 336     return 0;
 337 }
 338
 339 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data)
 340 {
 341     Connection *conn = (Connection *)value;
 342
 343     conn->offset = 0;
 344 }
 345
 346 static gboolean offset_is_nonzero(gpointer key,
 347                                   gpointer value,
 348                                   gpointer user_data)
 349 {
 350     Connection *conn = (Connection *)value;
 351
 352     return conn->offset ? true : false;
 353 }
 354
 355 static void colo_rewriter_handle_event(NetFilterState *nf, int event,
 356                                        Error **errp)
 357 {
 358     RewriterState *rs = FILTER_COLO_REWRITER(nf);
 359
 360     switch (event) {
 361     case COLO_EVENT_CHECKPOINT:
 362         g_hash_table_foreach(rs->connection_track_table,
 363                             reset_seq_offset, NULL);
 364         break;
 365     case COLO_EVENT_FAILOVER:
 366         if (!g_hash_table_find(rs->connection_track_table,
 367                               offset_is_nonzero, NULL)) {
 368             filter_rewriter_failover_mode(rs);
 369         }
 370         break;
 371     default:
 372         break;
 373     }
 374 }
 375
 376 static void colo_rewriter_cleanup(NetFilterState *nf)
 377 {
 378     RewriterState *s = FILTER_COLO_REWRITER(nf);
 379
 380     /* flush packets */
 381     if (s->incoming_queue) {
 382         filter_rewriter_flush(nf);
 383         g_free(s->incoming_queue);
 384     }
 385 }
 386
 387 static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
 388 {
 389     RewriterState *s = FILTER_COLO_REWRITER(nf);
 390
 391     s->connection_track_table = g_hash_table_new_full(connection_key_hash,
 392                                                       connection_key_equal,
 393                                                       g_free,
 394                                                       connection_destroy);
 395     s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
 396 }
 397
 398 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp)
 399 {
 400     RewriterState *s = FILTER_COLO_REWRITER(obj);
 401
 402     return s->vnet_hdr;
 403 }
 404
 405 static void filter_rewriter_set_vnet_hdr(Object *obj,
 406                                          bool value,
 407                                          Error **errp)
 408 {
 409     RewriterState *s = FILTER_COLO_REWRITER(obj);
 410
 411     s->vnet_hdr = value;
 412 }
 413
 414 static void filter_rewriter_init(Object *obj)
 415 {
 416     RewriterState *s = FILTER_COLO_REWRITER(obj);
 417
 418     s->vnet_hdr = false;
 419     s->failover_mode = FAILOVER_MODE_OFF;
 420     object_property_add_bool(obj, "vnet_hdr_support",
 421                              filter_rewriter_get_vnet_hdr,
 422                              filter_rewriter_set_vnet_hdr);
 423 }
 424
 425 static void colo_rewriter_class_init(ObjectClass *oc, void *data)
 426 {
 427     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 428
 429     nfc->setup = colo_rewriter_setup;
 430     nfc->cleanup = colo_rewriter_cleanup;
 431     nfc->receive_iov = colo_rewriter_receive_iov;
 432     nfc->handle_event = colo_rewriter_handle_event;
 433 }
 434
 435 static const TypeInfo colo_rewriter_info = {
 436     .name = TYPE_FILTER_REWRITER,
 437     .parent = TYPE_NETFILTER,
 438     .class_init = colo_rewriter_class_init,
 439     .instance_init = filter_rewriter_init,
 440     .instance_size = sizeof(RewriterState),
 441 };
 442
 443 static void register_types(void)
 444 {
 445     type_register_static(&colo_rewriter_info);
 446 }
 447
 448 type_init(register_types);