1 /* 2 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD. 3 * Copyright (c) 2016 FUJITSU LIMITED 4 * Copyright (c) 2016 Intel Corporation 5 * 6 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or 9 * later. See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "trace.h" 14 #include "colo.h" 15 #include "net/filter.h" 16 #include "net/net.h" 17 #include "qemu/error-report.h" 18 #include "qom/object.h" 19 #include "qemu/main-loop.h" 20 #include "qemu/iov.h" 21 #include "net/checksum.h" 22 #include "net/colo.h" 23 #include "migration/colo.h" 24 #include "util.h" 25 26 #define TYPE_FILTER_REWRITER "filter-rewriter" 27 OBJECT_DECLARE_SIMPLE_TYPE(RewriterState, FILTER_REWRITER) 28 29 #define FAILOVER_MODE_ON true 30 #define FAILOVER_MODE_OFF false 31 32 struct RewriterState { 33 NetFilterState parent_obj; 34 NetQueue *incoming_queue; 35 /* hashtable to save connection */ 36 GHashTable *connection_track_table; 37 bool vnet_hdr; 38 bool failover_mode; 39 }; 40 41 static void filter_rewriter_failover_mode(RewriterState *s) 42 { 43 s->failover_mode = FAILOVER_MODE_ON; 44 } 45 46 static void filter_rewriter_flush(NetFilterState *nf) 47 { 48 RewriterState *s = FILTER_REWRITER(nf); 49 50 if (!qemu_net_queue_flush(s->incoming_queue)) { 51 /* Unable to empty the queue, purge remaining packets */ 52 qemu_net_queue_purge(s->incoming_queue, nf->netdev); 53 } 54 } 55 56 /* 57 * Return 1 on success, if return 0 means the pkt 58 * is not TCP packet 59 */ 60 static int is_tcp_packet(Packet *pkt) 61 { 62 if (!parse_packet_early(pkt) && 63 pkt->ip->ip_p == IPPROTO_TCP) { 64 return 1; 65 } else { 66 return 0; 67 } 68 } 69 70 /* handle tcp packet from primary guest */ 71 static int handle_primary_tcp_pkt(RewriterState *rf, 72 Connection *conn, 73 Packet *pkt, ConnectionKey *key) 74 { 75 struct tcp_hdr *tcp_pkt; 76 77 tcp_pkt = (struct tcp_hdr *)pkt->transport_header; 78 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) { 79 trace_colo_filter_rewriter_pkt_info(__func__, 80 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 81 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 82 tcp_pkt->th_flags); 83 } 84 if (trace_event_get_state_backends( 85 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) { 86 trace_colo_filter_rewriter_conn_offset(conn->offset); 87 } 88 89 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) && 90 conn->tcp_state == TCPS_SYN_SENT) { 91 conn->tcp_state = TCPS_ESTABLISHED; 92 } 93 94 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 95 /* 96 * we use this flag update offset func 97 * run once in independent tcp connection 98 */ 99 conn->tcp_state = TCPS_SYN_RECEIVED; 100 } 101 102 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) { 103 if (conn->tcp_state == TCPS_SYN_RECEIVED) { 104 /* 105 * offset = secondary_seq - primary seq 106 * ack packet sent by guest from primary node, 107 * so we use th_ack - 1 get primary_seq 108 */ 109 conn->offset -= (ntohl(tcp_pkt->th_ack) - 1); 110 conn->tcp_state = TCPS_ESTABLISHED; 111 } 112 if (conn->offset) { 113 /* handle packets to the secondary from the primary */ 114 tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset); 115 116 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 117 pkt->size - pkt->vnet_hdr_len, CSUM_TCP); 118 } 119 120 /* 121 * Passive close step 3 122 */ 123 if ((conn->tcp_state == TCPS_LAST_ACK) && 124 (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) { 125 conn->tcp_state = TCPS_CLOSED; 126 g_hash_table_remove(rf->connection_track_table, key); 127 } 128 } 129 130 if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) { 131 /* 132 * Passive close. 133 * Step 1: 134 * The *server* side of this connect is VM, *client* tries to close 135 * the connection. We will into CLOSE_WAIT status. 136 * 137 * Step 2: 138 * In this step we will into LAST_ACK status. 139 * 140 * We got 'fin=1, ack=1' packet from server side, we need to 141 * record the seq of 'fin=1, ack=1' packet. 142 * 143 * Step 3: 144 * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1' 145 * packet from server side. From this point, we can ensure that there 146 * will be no packets in the connection, except that, some errors 147 * happen between the path of 'filter object' and vNIC, if this rare 148 * case really happen, we can still create a new connection, 149 * So it is safe to remove the connection from connection_track_table. 150 * 151 */ 152 if (conn->tcp_state == TCPS_ESTABLISHED) { 153 conn->tcp_state = TCPS_CLOSE_WAIT; 154 } 155 156 /* 157 * Active close step 2. 158 */ 159 if (conn->tcp_state == TCPS_FIN_WAIT_1) { 160 /* 161 * For simplify implementation, we needn't wait 2MSL time 162 * in filter rewriter. Because guest kernel will track the 163 * TCP status and wait 2MSL time, if client resend the FIN 164 * packet, guest will apply the last ACK too. 165 * So, we skip the TCPS_TIME_WAIT state here and go straight 166 * to TCPS_CLOSED state. 167 */ 168 conn->tcp_state = TCPS_CLOSED; 169 g_hash_table_remove(rf->connection_track_table, key); 170 } 171 } 172 173 return 0; 174 } 175 176 /* handle tcp packet from secondary guest */ 177 static int handle_secondary_tcp_pkt(RewriterState *rf, 178 Connection *conn, 179 Packet *pkt, ConnectionKey *key) 180 { 181 struct tcp_hdr *tcp_pkt; 182 183 tcp_pkt = (struct tcp_hdr *)pkt->transport_header; 184 185 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) { 186 trace_colo_filter_rewriter_pkt_info(__func__, 187 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 188 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 189 tcp_pkt->th_flags); 190 } 191 if (trace_event_get_state_backends( 192 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) { 193 trace_colo_filter_rewriter_conn_offset(conn->offset); 194 } 195 196 if (conn->tcp_state == TCPS_SYN_RECEIVED && 197 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) { 198 /* 199 * save offset = secondary_seq and then 200 * in handle_primary_tcp_pkt make offset 201 * = secondary_seq - primary_seq 202 */ 203 conn->offset = ntohl(tcp_pkt->th_seq); 204 } 205 206 /* VM active connect */ 207 if (conn->tcp_state == TCPS_CLOSED && 208 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 209 conn->tcp_state = TCPS_SYN_SENT; 210 } 211 212 if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) { 213 /* Only need to adjust seq while offset is Non-zero */ 214 if (conn->offset) { 215 /* handle packets to the primary from the secondary*/ 216 tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset); 217 218 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 219 pkt->size - pkt->vnet_hdr_len, CSUM_TCP); 220 } 221 } 222 223 /* 224 * Passive close step 2: 225 */ 226 if (conn->tcp_state == TCPS_CLOSE_WAIT && 227 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) { 228 conn->fin_ack_seq = ntohl(tcp_pkt->th_seq); 229 conn->tcp_state = TCPS_LAST_ACK; 230 } 231 232 /* 233 * Active close 234 * 235 * Step 1: 236 * The *server* side of this connect is VM, *server* tries to close 237 * the connection. 238 * 239 * Step 2: 240 * We will into CLOSE_WAIT status. 241 * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and 242 * CLOSING status. 243 */ 244 if (conn->tcp_state == TCPS_ESTABLISHED && 245 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) { 246 conn->tcp_state = TCPS_FIN_WAIT_1; 247 } 248 249 return 0; 250 } 251 252 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf, 253 NetClientState *sender, 254 unsigned flags, 255 const struct iovec *iov, 256 int iovcnt, 257 NetPacketSent *sent_cb) 258 { 259 RewriterState *s = FILTER_REWRITER(nf); 260 Connection *conn; 261 ConnectionKey key; 262 Packet *pkt; 263 ssize_t size = iov_size(iov, iovcnt); 264 ssize_t vnet_hdr_len = 0; 265 char *buf = g_malloc0(size); 266 267 iov_to_buf(iov, iovcnt, 0, buf, size); 268 269 if (s->vnet_hdr) { 270 vnet_hdr_len = nf->netdev->vnet_hdr_len; 271 } 272 273 pkt = packet_new_nocopy(buf, size, vnet_hdr_len); 274 275 /* 276 * if we get tcp packet 277 * we will rewrite it to make secondary guest's 278 * connection established successfully 279 */ 280 if (pkt && is_tcp_packet(pkt)) { 281 282 fill_connection_key(pkt, &key, sender == nf->netdev); 283 284 /* After failover we needn't change new TCP packet */ 285 if (s->failover_mode && 286 !connection_has_tracked(s->connection_track_table, &key)) { 287 goto out; 288 } 289 290 conn = connection_get(s->connection_track_table, 291 &key, 292 NULL); 293 294 if (sender == nf->netdev) { 295 /* NET_FILTER_DIRECTION_TX */ 296 if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) { 297 qemu_net_queue_send(s->incoming_queue, sender, 0, 298 (const uint8_t *)pkt->data, pkt->size, NULL); 299 packet_destroy(pkt, NULL); 300 pkt = NULL; 301 /* 302 * We block the packet here,after rewrite pkt 303 * and will send it 304 */ 305 return 1; 306 } 307 } else { 308 /* NET_FILTER_DIRECTION_RX */ 309 if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) { 310 qemu_net_queue_send(s->incoming_queue, sender, 0, 311 (const uint8_t *)pkt->data, pkt->size, NULL); 312 packet_destroy(pkt, NULL); 313 pkt = NULL; 314 /* 315 * We block the packet here,after rewrite pkt 316 * and will send it 317 */ 318 return 1; 319 } 320 } 321 } 322 323 out: 324 packet_destroy(pkt, NULL); 325 pkt = NULL; 326 return 0; 327 } 328 329 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data) 330 { 331 Connection *conn = (Connection *)value; 332 333 conn->offset = 0; 334 } 335 336 static gboolean offset_is_nonzero(gpointer key, 337 gpointer value, 338 gpointer user_data) 339 { 340 Connection *conn = (Connection *)value; 341 342 return conn->offset ? true : false; 343 } 344 345 static void colo_rewriter_handle_event(NetFilterState *nf, int event, 346 Error **errp) 347 { 348 RewriterState *rs = FILTER_REWRITER(nf); 349 350 switch (event) { 351 case COLO_EVENT_CHECKPOINT: 352 g_hash_table_foreach(rs->connection_track_table, 353 reset_seq_offset, NULL); 354 break; 355 case COLO_EVENT_FAILOVER: 356 if (!g_hash_table_find(rs->connection_track_table, 357 offset_is_nonzero, NULL)) { 358 filter_rewriter_failover_mode(rs); 359 } 360 break; 361 default: 362 break; 363 } 364 } 365 366 static void colo_rewriter_cleanup(NetFilterState *nf) 367 { 368 RewriterState *s = FILTER_REWRITER(nf); 369 370 /* flush packets */ 371 if (s->incoming_queue) { 372 filter_rewriter_flush(nf); 373 g_free(s->incoming_queue); 374 } 375 376 g_hash_table_destroy(s->connection_track_table); 377 } 378 379 static void colo_rewriter_setup(NetFilterState *nf, Error **errp) 380 { 381 RewriterState *s = FILTER_REWRITER(nf); 382 383 s->connection_track_table = g_hash_table_new_full(connection_key_hash, 384 connection_key_equal, 385 g_free, 386 connection_destroy); 387 s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf); 388 } 389 390 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp) 391 { 392 RewriterState *s = FILTER_REWRITER(obj); 393 394 return s->vnet_hdr; 395 } 396 397 static void filter_rewriter_set_vnet_hdr(Object *obj, 398 bool value, 399 Error **errp) 400 { 401 RewriterState *s = FILTER_REWRITER(obj); 402 403 s->vnet_hdr = value; 404 } 405 406 static void filter_rewriter_init(Object *obj) 407 { 408 RewriterState *s = FILTER_REWRITER(obj); 409 410 s->vnet_hdr = false; 411 s->failover_mode = FAILOVER_MODE_OFF; 412 } 413 414 static void colo_rewriter_class_init(ObjectClass *oc, void *data) 415 { 416 NetFilterClass *nfc = NETFILTER_CLASS(oc); 417 418 object_class_property_add_bool(oc, "vnet_hdr_support", 419 filter_rewriter_get_vnet_hdr, 420 filter_rewriter_set_vnet_hdr); 421 422 nfc->setup = colo_rewriter_setup; 423 nfc->cleanup = colo_rewriter_cleanup; 424 nfc->receive_iov = colo_rewriter_receive_iov; 425 nfc->handle_event = colo_rewriter_handle_event; 426 } 427 428 static const TypeInfo colo_rewriter_info = { 429 .name = TYPE_FILTER_REWRITER, 430 .parent = TYPE_NETFILTER, 431 .class_init = colo_rewriter_class_init, 432 .instance_init = filter_rewriter_init, 433 .instance_size = sizeof(RewriterState), 434 }; 435 436 static void register_types(void) 437 { 438 type_register_static(&colo_rewriter_info); 439 } 440 441 type_init(register_types); 442