1 /* 2 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD. 3 * Copyright (c) 2016 FUJITSU LIMITED 4 * Copyright (c) 2016 Intel Corporation 5 * 6 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or 9 * later. See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "trace.h" 14 #include "colo.h" 15 #include "net/filter.h" 16 #include "net/net.h" 17 #include "qemu/error-report.h" 18 #include "qom/object.h" 19 #include "qemu/main-loop.h" 20 #include "qemu/iov.h" 21 #include "net/checksum.h" 22 #include "net/colo.h" 23 #include "migration/colo.h" 24 #include "util.h" 25 26 #define TYPE_FILTER_REWRITER "filter-rewriter" 27 typedef struct RewriterState RewriterState; 28 DECLARE_INSTANCE_CHECKER(RewriterState, FILTER_REWRITER, 29 TYPE_FILTER_REWRITER) 30 31 #define FAILOVER_MODE_ON true 32 #define FAILOVER_MODE_OFF false 33 34 struct RewriterState { 35 NetFilterState parent_obj; 36 NetQueue *incoming_queue; 37 /* hashtable to save connection */ 38 GHashTable *connection_track_table; 39 bool vnet_hdr; 40 bool failover_mode; 41 }; 42 43 static void filter_rewriter_failover_mode(RewriterState *s) 44 { 45 s->failover_mode = FAILOVER_MODE_ON; 46 } 47 48 static void filter_rewriter_flush(NetFilterState *nf) 49 { 50 RewriterState *s = FILTER_REWRITER(nf); 51 52 if (!qemu_net_queue_flush(s->incoming_queue)) { 53 /* Unable to empty the queue, purge remaining packets */ 54 qemu_net_queue_purge(s->incoming_queue, nf->netdev); 55 } 56 } 57 58 /* 59 * Return 1 on success, if return 0 means the pkt 60 * is not TCP packet 61 */ 62 static int is_tcp_packet(Packet *pkt) 63 { 64 if (!parse_packet_early(pkt) && 65 pkt->ip->ip_p == IPPROTO_TCP) { 66 return 1; 67 } else { 68 return 0; 69 } 70 } 71 72 /* handle tcp packet from primary guest */ 73 static int handle_primary_tcp_pkt(RewriterState *rf, 74 Connection *conn, 75 Packet *pkt, ConnectionKey *key) 76 { 77 struct tcp_hdr *tcp_pkt; 78 79 tcp_pkt = (struct tcp_hdr *)pkt->transport_header; 80 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) { 81 trace_colo_filter_rewriter_pkt_info(__func__, 82 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 83 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 84 tcp_pkt->th_flags); 85 } 86 if (trace_event_get_state_backends( 87 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) { 88 trace_colo_filter_rewriter_conn_offset(conn->offset); 89 } 90 91 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) && 92 conn->tcp_state == TCPS_SYN_SENT) { 93 conn->tcp_state = TCPS_ESTABLISHED; 94 } 95 96 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 97 /* 98 * we use this flag update offset func 99 * run once in independent tcp connection 100 */ 101 conn->tcp_state = TCPS_SYN_RECEIVED; 102 } 103 104 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) { 105 if (conn->tcp_state == TCPS_SYN_RECEIVED) { 106 /* 107 * offset = secondary_seq - primary seq 108 * ack packet sent by guest from primary node, 109 * so we use th_ack - 1 get primary_seq 110 */ 111 conn->offset -= (ntohl(tcp_pkt->th_ack) - 1); 112 conn->tcp_state = TCPS_ESTABLISHED; 113 } 114 if (conn->offset) { 115 /* handle packets to the secondary from the primary */ 116 tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset); 117 118 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 119 pkt->size - pkt->vnet_hdr_len); 120 } 121 122 /* 123 * Passive close step 3 124 */ 125 if ((conn->tcp_state == TCPS_LAST_ACK) && 126 (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) { 127 conn->tcp_state = TCPS_CLOSED; 128 g_hash_table_remove(rf->connection_track_table, key); 129 } 130 } 131 132 if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) { 133 /* 134 * Passive close. 135 * Step 1: 136 * The *server* side of this connect is VM, *client* tries to close 137 * the connection. We will into CLOSE_WAIT status. 138 * 139 * Step 2: 140 * In this step we will into LAST_ACK status. 141 * 142 * We got 'fin=1, ack=1' packet from server side, we need to 143 * record the seq of 'fin=1, ack=1' packet. 144 * 145 * Step 3: 146 * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1' 147 * packet from server side. From this point, we can ensure that there 148 * will be no packets in the connection, except that, some errors 149 * happen between the path of 'filter object' and vNIC, if this rare 150 * case really happen, we can still create a new connection, 151 * So it is safe to remove the connection from connection_track_table. 152 * 153 */ 154 if (conn->tcp_state == TCPS_ESTABLISHED) { 155 conn->tcp_state = TCPS_CLOSE_WAIT; 156 } 157 158 /* 159 * Active close step 2. 160 */ 161 if (conn->tcp_state == TCPS_FIN_WAIT_1) { 162 /* 163 * For simplify implementation, we needn't wait 2MSL time 164 * in filter rewriter. Because guest kernel will track the 165 * TCP status and wait 2MSL time, if client resend the FIN 166 * packet, guest will apply the last ACK too. 167 * So, we skip the TCPS_TIME_WAIT state here and go straight 168 * to TCPS_CLOSED state. 169 */ 170 conn->tcp_state = TCPS_CLOSED; 171 g_hash_table_remove(rf->connection_track_table, key); 172 } 173 } 174 175 return 0; 176 } 177 178 /* handle tcp packet from secondary guest */ 179 static int handle_secondary_tcp_pkt(RewriterState *rf, 180 Connection *conn, 181 Packet *pkt, ConnectionKey *key) 182 { 183 struct tcp_hdr *tcp_pkt; 184 185 tcp_pkt = (struct tcp_hdr *)pkt->transport_header; 186 187 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) { 188 trace_colo_filter_rewriter_pkt_info(__func__, 189 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 190 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 191 tcp_pkt->th_flags); 192 } 193 if (trace_event_get_state_backends( 194 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) { 195 trace_colo_filter_rewriter_conn_offset(conn->offset); 196 } 197 198 if (conn->tcp_state == TCPS_SYN_RECEIVED && 199 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) { 200 /* 201 * save offset = secondary_seq and then 202 * in handle_primary_tcp_pkt make offset 203 * = secondary_seq - primary_seq 204 */ 205 conn->offset = ntohl(tcp_pkt->th_seq); 206 } 207 208 /* VM active connect */ 209 if (conn->tcp_state == TCPS_CLOSED && 210 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 211 conn->tcp_state = TCPS_SYN_SENT; 212 } 213 214 if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) { 215 /* Only need to adjust seq while offset is Non-zero */ 216 if (conn->offset) { 217 /* handle packets to the primary from the secondary*/ 218 tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset); 219 220 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 221 pkt->size - pkt->vnet_hdr_len); 222 } 223 } 224 225 /* 226 * Passive close step 2: 227 */ 228 if (conn->tcp_state == TCPS_CLOSE_WAIT && 229 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) { 230 conn->fin_ack_seq = ntohl(tcp_pkt->th_seq); 231 conn->tcp_state = TCPS_LAST_ACK; 232 } 233 234 /* 235 * Active close 236 * 237 * Step 1: 238 * The *server* side of this connect is VM, *server* tries to close 239 * the connection. 240 * 241 * Step 2: 242 * We will into CLOSE_WAIT status. 243 * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and 244 * CLOSING status. 245 */ 246 if (conn->tcp_state == TCPS_ESTABLISHED && 247 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) { 248 conn->tcp_state = TCPS_FIN_WAIT_1; 249 } 250 251 return 0; 252 } 253 254 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf, 255 NetClientState *sender, 256 unsigned flags, 257 const struct iovec *iov, 258 int iovcnt, 259 NetPacketSent *sent_cb) 260 { 261 RewriterState *s = FILTER_REWRITER(nf); 262 Connection *conn; 263 ConnectionKey key; 264 Packet *pkt; 265 ssize_t size = iov_size(iov, iovcnt); 266 ssize_t vnet_hdr_len = 0; 267 char *buf = g_malloc0(size); 268 269 iov_to_buf(iov, iovcnt, 0, buf, size); 270 271 if (s->vnet_hdr) { 272 vnet_hdr_len = nf->netdev->vnet_hdr_len; 273 } 274 275 pkt = packet_new(buf, size, vnet_hdr_len); 276 g_free(buf); 277 278 /* 279 * if we get tcp packet 280 * we will rewrite it to make secondary guest's 281 * connection established successfully 282 */ 283 if (pkt && is_tcp_packet(pkt)) { 284 285 fill_connection_key(pkt, &key); 286 287 if (sender == nf->netdev) { 288 /* 289 * We need make tcp TX and RX packet 290 * into one connection. 291 */ 292 reverse_connection_key(&key); 293 } 294 295 /* After failover we needn't change new TCP packet */ 296 if (s->failover_mode && 297 !connection_has_tracked(s->connection_track_table, &key)) { 298 goto out; 299 } 300 301 conn = connection_get(s->connection_track_table, 302 &key, 303 NULL); 304 305 if (sender == nf->netdev) { 306 /* NET_FILTER_DIRECTION_TX */ 307 if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) { 308 qemu_net_queue_send(s->incoming_queue, sender, 0, 309 (const uint8_t *)pkt->data, pkt->size, NULL); 310 packet_destroy(pkt, NULL); 311 pkt = NULL; 312 /* 313 * We block the packet here,after rewrite pkt 314 * and will send it 315 */ 316 return 1; 317 } 318 } else { 319 /* NET_FILTER_DIRECTION_RX */ 320 if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) { 321 qemu_net_queue_send(s->incoming_queue, sender, 0, 322 (const uint8_t *)pkt->data, pkt->size, NULL); 323 packet_destroy(pkt, NULL); 324 pkt = NULL; 325 /* 326 * We block the packet here,after rewrite pkt 327 * and will send it 328 */ 329 return 1; 330 } 331 } 332 } 333 334 out: 335 packet_destroy(pkt, NULL); 336 pkt = NULL; 337 return 0; 338 } 339 340 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data) 341 { 342 Connection *conn = (Connection *)value; 343 344 conn->offset = 0; 345 } 346 347 static gboolean offset_is_nonzero(gpointer key, 348 gpointer value, 349 gpointer user_data) 350 { 351 Connection *conn = (Connection *)value; 352 353 return conn->offset ? true : false; 354 } 355 356 static void colo_rewriter_handle_event(NetFilterState *nf, int event, 357 Error **errp) 358 { 359 RewriterState *rs = FILTER_REWRITER(nf); 360 361 switch (event) { 362 case COLO_EVENT_CHECKPOINT: 363 g_hash_table_foreach(rs->connection_track_table, 364 reset_seq_offset, NULL); 365 break; 366 case COLO_EVENT_FAILOVER: 367 if (!g_hash_table_find(rs->connection_track_table, 368 offset_is_nonzero, NULL)) { 369 filter_rewriter_failover_mode(rs); 370 } 371 break; 372 default: 373 break; 374 } 375 } 376 377 static void colo_rewriter_cleanup(NetFilterState *nf) 378 { 379 RewriterState *s = FILTER_REWRITER(nf); 380 381 /* flush packets */ 382 if (s->incoming_queue) { 383 filter_rewriter_flush(nf); 384 g_free(s->incoming_queue); 385 } 386 } 387 388 static void colo_rewriter_setup(NetFilterState *nf, Error **errp) 389 { 390 RewriterState *s = FILTER_REWRITER(nf); 391 392 s->connection_track_table = g_hash_table_new_full(connection_key_hash, 393 connection_key_equal, 394 g_free, 395 connection_destroy); 396 s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf); 397 } 398 399 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp) 400 { 401 RewriterState *s = FILTER_REWRITER(obj); 402 403 return s->vnet_hdr; 404 } 405 406 static void filter_rewriter_set_vnet_hdr(Object *obj, 407 bool value, 408 Error **errp) 409 { 410 RewriterState *s = FILTER_REWRITER(obj); 411 412 s->vnet_hdr = value; 413 } 414 415 static void filter_rewriter_init(Object *obj) 416 { 417 RewriterState *s = FILTER_REWRITER(obj); 418 419 s->vnet_hdr = false; 420 s->failover_mode = FAILOVER_MODE_OFF; 421 object_property_add_bool(obj, "vnet_hdr_support", 422 filter_rewriter_get_vnet_hdr, 423 filter_rewriter_set_vnet_hdr); 424 } 425 426 static void colo_rewriter_class_init(ObjectClass *oc, void *data) 427 { 428 NetFilterClass *nfc = NETFILTER_CLASS(oc); 429 430 nfc->setup = colo_rewriter_setup; 431 nfc->cleanup = colo_rewriter_cleanup; 432 nfc->receive_iov = colo_rewriter_receive_iov; 433 nfc->handle_event = colo_rewriter_handle_event; 434 } 435 436 static const TypeInfo colo_rewriter_info = { 437 .name = TYPE_FILTER_REWRITER, 438 .parent = TYPE_NETFILTER, 439 .class_init = colo_rewriter_class_init, 440 .instance_init = filter_rewriter_init, 441 .instance_size = sizeof(RewriterState), 442 }; 443 444 static void register_types(void) 445 { 446 type_register_static(&colo_rewriter_info); 447 } 448 449 type_init(register_types); 450