net/filter-rewriter.c

   1 /*
   2  * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
   3  * Copyright (c) 2016 FUJITSU LIMITED
   4  * Copyright (c) 2016 Intel Corporation
   5  *
   6  * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
   7  *
   8  * This work is licensed under the terms of the GNU GPL, version 2 or
   9  * later.  See the COPYING file in the top-level directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13 #include "trace.h"
  14 #include "colo.h"
  15 #include "net/filter.h"
  16 #include "net/net.h"
  17 #include "qemu/error-report.h"
  18 #include "qom/object.h"
  19 #include "qemu/main-loop.h"
  20 #include "qemu/iov.h"
  21 #include "net/checksum.h"
  22 #include "net/colo.h"
  23 #include "migration/colo.h"
  24 #include "util.h"
  25
  26 #define TYPE_FILTER_REWRITER "filter-rewriter"
  27 typedef struct RewriterState RewriterState;
  28 DECLARE_INSTANCE_CHECKER(RewriterState, FILTER_COLO_REWRITER,
  29                          TYPE_FILTER_REWRITER)
  30
  31 #define FAILOVER_MODE_ON  true
  32 #define FAILOVER_MODE_OFF false
  33
  34 struct RewriterState {
  35     NetFilterState parent_obj;
  36     NetQueue *incoming_queue;
  37     /* hashtable to save connection */
  38     GHashTable *connection_track_table;
  39     bool vnet_hdr;
  40     bool failover_mode;
  41 };
  42
  43 static void filter_rewriter_failover_mode(RewriterState *s)
  44 {
  45     s->failover_mode = FAILOVER_MODE_ON;
  46 }
  47
  48 static void filter_rewriter_flush(NetFilterState *nf)
  49 {
  50     RewriterState *s = FILTER_COLO_REWRITER(nf);
  51
  52     if (!qemu_net_queue_flush(s->incoming_queue)) {
  53         /* Unable to empty the queue, purge remaining packets */
  54         qemu_net_queue_purge(s->incoming_queue, nf->netdev);
  55     }
  56 }
  57
  58 /*
  59  * Return 1 on success, if return 0 means the pkt
  60  * is not TCP packet
  61  */
  62 static int is_tcp_packet(Packet *pkt)
  63 {
  64     if (!parse_packet_early(pkt) &&
  65         pkt->ip->ip_p == IPPROTO_TCP) {
  66         return 1;
  67     } else {
  68         return 0;
  69     }
  70 }
  71
  72 /* handle tcp packet from primary guest */
  73 static int handle_primary_tcp_pkt(RewriterState *rf,
  74                                   Connection *conn,
  75                                   Packet *pkt, ConnectionKey *key)
  76 {
  77     struct tcp_hdr *tcp_pkt;
  78
  79     tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
  80     if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_DEBUG)) {
  81         trace_colo_filter_rewriter_pkt_info(__func__,
  82                     inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
  83                     ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
  84                     tcp_pkt->th_flags);
  85         trace_colo_filter_rewriter_conn_offset(conn->offset);
  86     }
  87
  88     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) &&
  89         conn->tcp_state == TCPS_SYN_SENT) {
  90         conn->tcp_state = TCPS_ESTABLISHED;
  91     }
  92
  93     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
  94         /*
  95          * we use this flag update offset func
  96          * run once in independent tcp connection
  97          */
  98         conn->tcp_state = TCPS_SYN_RECEIVED;
  99     }
 100
 101     if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) {
 102         if (conn->tcp_state == TCPS_SYN_RECEIVED) {
 103             /*
 104              * offset = secondary_seq - primary seq
 105              * ack packet sent by guest from primary node,
 106              * so we use th_ack - 1 get primary_seq
 107              */
 108             conn->offset -= (ntohl(tcp_pkt->th_ack) - 1);
 109             conn->tcp_state = TCPS_ESTABLISHED;
 110         }
 111         if (conn->offset) {
 112             /* handle packets to the secondary from the primary */
 113             tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset);
 114
 115             net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
 116                                    pkt->size - pkt->vnet_hdr_len);
 117         }
 118
 119         /*
 120          * Passive close step 3
 121          */
 122         if ((conn->tcp_state == TCPS_LAST_ACK) &&
 123             (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) {
 124             conn->tcp_state = TCPS_CLOSED;
 125             g_hash_table_remove(rf->connection_track_table, key);
 126         }
 127     }
 128
 129     if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) {
 130         /*
 131          * Passive close.
 132          * Step 1:
 133          * The *server* side of this connect is VM, *client* tries to close
 134          * the connection. We will into CLOSE_WAIT status.
 135          *
 136          * Step 2:
 137          * In this step we will into LAST_ACK status.
 138          *
 139          * We got 'fin=1, ack=1' packet from server side, we need to
 140          * record the seq of 'fin=1, ack=1' packet.
 141          *
 142          * Step 3:
 143          * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1'
 144          * packet from server side. From this point, we can ensure that there
 145          * will be no packets in the connection, except that, some errors
 146          * happen between the path of 'filter object' and vNIC, if this rare
 147          * case really happen, we can still create a new connection,
 148          * So it is safe to remove the connection from connection_track_table.
 149          *
 150          */
 151         if (conn->tcp_state == TCPS_ESTABLISHED) {
 152             conn->tcp_state = TCPS_CLOSE_WAIT;
 153         }
 154
 155         /*
 156          * Active close step 2.
 157          */
 158         if (conn->tcp_state == TCPS_FIN_WAIT_1) {
 159             /*
 160              * For simplify implementation, we needn't wait 2MSL time
 161              * in filter rewriter. Because guest kernel will track the
 162              * TCP status and wait 2MSL time, if client resend the FIN
 163              * packet, guest will apply the last ACK too.
 164              * So, we skip the TCPS_TIME_WAIT state here and go straight
 165              * to TCPS_CLOSED state.
 166              */
 167             conn->tcp_state = TCPS_CLOSED;
 168             g_hash_table_remove(rf->connection_track_table, key);
 169         }
 170     }
 171
 172     return 0;
 173 }
 174
 175 /* handle tcp packet from secondary guest */
 176 static int handle_secondary_tcp_pkt(RewriterState *rf,
 177                                     Connection *conn,
 178                                     Packet *pkt, ConnectionKey *key)
 179 {
 180     struct tcp_hdr *tcp_pkt;
 181
 182     tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
 183
 184     if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_DEBUG)) {
 185         trace_colo_filter_rewriter_pkt_info(__func__,
 186                     inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
 187                     ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
 188                     tcp_pkt->th_flags);
 189         trace_colo_filter_rewriter_conn_offset(conn->offset);
 190     }
 191
 192     if (conn->tcp_state == TCPS_SYN_RECEIVED &&
 193         ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) {
 194         /*
 195          * save offset = secondary_seq and then
 196          * in handle_primary_tcp_pkt make offset
 197          * = secondary_seq - primary_seq
 198          */
 199         conn->offset = ntohl(tcp_pkt->th_seq);
 200     }
 201
 202     /* VM active connect */
 203     if (conn->tcp_state == TCPS_CLOSED &&
 204         ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
 205         conn->tcp_state = TCPS_SYN_SENT;
 206     }
 207
 208     if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) {
 209         /* Only need to adjust seq while offset is Non-zero */
 210         if (conn->offset) {
 211             /* handle packets to the primary from the secondary*/
 212             tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset);
 213
 214             net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
 215                                    pkt->size - pkt->vnet_hdr_len);
 216         }
 217     }
 218
 219     /*
 220      * Passive close step 2:
 221      */
 222     if (conn->tcp_state == TCPS_CLOSE_WAIT &&
 223         (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) {
 224         conn->fin_ack_seq = ntohl(tcp_pkt->th_seq);
 225         conn->tcp_state = TCPS_LAST_ACK;
 226     }
 227
 228     /*
 229      * Active close
 230      *
 231      * Step 1:
 232      * The *server* side of this connect is VM, *server* tries to close
 233      * the connection.
 234      *
 235      * Step 2:
 236      * We will into CLOSE_WAIT status.
 237      * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and
 238      * CLOSING status.
 239      */
 240     if (conn->tcp_state == TCPS_ESTABLISHED &&
 241         (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) {
 242         conn->tcp_state = TCPS_FIN_WAIT_1;
 243     }
 244
 245     return 0;
 246 }
 247
 248 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
 249                                          NetClientState *sender,
 250                                          unsigned flags,
 251                                          const struct iovec *iov,
 252                                          int iovcnt,
 253                                          NetPacketSent *sent_cb)
 254 {
 255     RewriterState *s = FILTER_COLO_REWRITER(nf);
 256     Connection *conn;
 257     ConnectionKey key;
 258     Packet *pkt;
 259     ssize_t size = iov_size(iov, iovcnt);
 260     ssize_t vnet_hdr_len = 0;
 261     char *buf = g_malloc0(size);
 262
 263     iov_to_buf(iov, iovcnt, 0, buf, size);
 264
 265     if (s->vnet_hdr) {
 266         vnet_hdr_len = nf->netdev->vnet_hdr_len;
 267     }
 268
 269     pkt = packet_new(buf, size, vnet_hdr_len);
 270     g_free(buf);
 271
 272     /*
 273      * if we get tcp packet
 274      * we will rewrite it to make secondary guest's
 275      * connection established successfully
 276      */
 277     if (pkt && is_tcp_packet(pkt)) {
 278
 279         fill_connection_key(pkt, &key);
 280
 281         if (sender == nf->netdev) {
 282             /*
 283              * We need make tcp TX and RX packet
 284              * into one connection.
 285              */
 286             reverse_connection_key(&key);
 287         }
 288
 289         /* After failover we needn't change new TCP packet */
 290         if (s->failover_mode &&
 291             !connection_has_tracked(s->connection_track_table, &key)) {
 292             goto out;
 293         }
 294
 295         conn = connection_get(s->connection_track_table,
 296                               &key,
 297                               NULL);
 298
 299         if (sender == nf->netdev) {
 300             /* NET_FILTER_DIRECTION_TX */
 301             if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) {
 302                 qemu_net_queue_send(s->incoming_queue, sender, 0,
 303                 (const uint8_t *)pkt->data, pkt->size, NULL);
 304                 packet_destroy(pkt, NULL);
 305                 pkt = NULL;
 306                 /*
 307                  * We block the packet here,after rewrite pkt
 308                  * and will send it
 309                  */
 310                 return 1;
 311             }
 312         } else {
 313             /* NET_FILTER_DIRECTION_RX */
 314             if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) {
 315                 qemu_net_queue_send(s->incoming_queue, sender, 0,
 316                 (const uint8_t *)pkt->data, pkt->size, NULL);
 317                 packet_destroy(pkt, NULL);
 318                 pkt = NULL;
 319                 /*
 320                  * We block the packet here,after rewrite pkt
 321                  * and will send it
 322                  */
 323                 return 1;
 324             }
 325         }
 326     }
 327
 328 out:
 329     packet_destroy(pkt, NULL);
 330     pkt = NULL;
 331     return 0;
 332 }
 333
 334 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data)
 335 {
 336     Connection *conn = (Connection *)value;
 337
 338     conn->offset = 0;
 339 }
 340
 341 static gboolean offset_is_nonzero(gpointer key,
 342                                   gpointer value,
 343                                   gpointer user_data)
 344 {
 345     Connection *conn = (Connection *)value;
 346
 347     return conn->offset ? true : false;
 348 }
 349
 350 static void colo_rewriter_handle_event(NetFilterState *nf, int event,
 351                                        Error **errp)
 352 {
 353     RewriterState *rs = FILTER_COLO_REWRITER(nf);
 354
 355     switch (event) {
 356     case COLO_EVENT_CHECKPOINT:
 357         g_hash_table_foreach(rs->connection_track_table,
 358                             reset_seq_offset, NULL);
 359         break;
 360     case COLO_EVENT_FAILOVER:
 361         if (!g_hash_table_find(rs->connection_track_table,
 362                               offset_is_nonzero, NULL)) {
 363             filter_rewriter_failover_mode(rs);
 364         }
 365         break;
 366     default:
 367         break;
 368     }
 369 }
 370
 371 static void colo_rewriter_cleanup(NetFilterState *nf)
 372 {
 373     RewriterState *s = FILTER_COLO_REWRITER(nf);
 374
 375     /* flush packets */
 376     if (s->incoming_queue) {
 377         filter_rewriter_flush(nf);
 378         g_free(s->incoming_queue);
 379     }
 380 }
 381
 382 static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
 383 {
 384     RewriterState *s = FILTER_COLO_REWRITER(nf);
 385
 386     s->connection_track_table = g_hash_table_new_full(connection_key_hash,
 387                                                       connection_key_equal,
 388                                                       g_free,
 389                                                       connection_destroy);
 390     s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
 391 }
 392
 393 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp)
 394 {
 395     RewriterState *s = FILTER_COLO_REWRITER(obj);
 396
 397     return s->vnet_hdr;
 398 }
 399
 400 static void filter_rewriter_set_vnet_hdr(Object *obj,
 401                                          bool value,
 402                                          Error **errp)
 403 {
 404     RewriterState *s = FILTER_COLO_REWRITER(obj);
 405
 406     s->vnet_hdr = value;
 407 }
 408
 409 static void filter_rewriter_init(Object *obj)
 410 {
 411     RewriterState *s = FILTER_COLO_REWRITER(obj);
 412
 413     s->vnet_hdr = false;
 414     s->failover_mode = FAILOVER_MODE_OFF;
 415     object_property_add_bool(obj, "vnet_hdr_support",
 416                              filter_rewriter_get_vnet_hdr,
 417                              filter_rewriter_set_vnet_hdr);
 418 }
 419
 420 static void colo_rewriter_class_init(ObjectClass *oc, void *data)
 421 {
 422     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 423
 424     nfc->setup = colo_rewriter_setup;
 425     nfc->cleanup = colo_rewriter_cleanup;
 426     nfc->receive_iov = colo_rewriter_receive_iov;
 427     nfc->handle_event = colo_rewriter_handle_event;
 428 }
 429
 430 static const TypeInfo colo_rewriter_info = {
 431     .name = TYPE_FILTER_REWRITER,
 432     .parent = TYPE_NETFILTER,
 433     .class_init = colo_rewriter_class_init,
 434     .instance_init = filter_rewriter_init,
 435     .instance_size = sizeof(RewriterState),
 436 };
 437
 438 static void register_types(void)
 439 {
 440     type_register_static(&colo_rewriter_info);
 441 }
 442
 443 type_init(register_types);