1 /* 2 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD. 3 * Copyright (c) 2016 FUJITSU LIMITED 4 * Copyright (c) 2016 Intel Corporation 5 * 6 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or 9 * later. See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "trace.h" 14 #include "colo.h" 15 #include "net/filter.h" 16 #include "net/net.h" 17 #include "qemu/error-report.h" 18 #include "qom/object.h" 19 #include "qemu/main-loop.h" 20 #include "qemu/iov.h" 21 #include "net/checksum.h" 22 #include "net/colo.h" 23 #include "migration/colo.h" 24 #include "util.h" 25 26 #define FILTER_COLO_REWRITER(obj) \ 27 OBJECT_CHECK(RewriterState, (obj), TYPE_FILTER_REWRITER) 28 29 #define TYPE_FILTER_REWRITER "filter-rewriter" 30 #define FAILOVER_MODE_ON true 31 #define FAILOVER_MODE_OFF false 32 33 typedef struct RewriterState { 34 NetFilterState parent_obj; 35 NetQueue *incoming_queue; 36 /* hashtable to save connection */ 37 GHashTable *connection_track_table; 38 bool vnet_hdr; 39 bool failover_mode; 40 } RewriterState; 41 42 static void filter_rewriter_failover_mode(RewriterState *s) 43 { 44 s->failover_mode = FAILOVER_MODE_ON; 45 } 46 47 static void filter_rewriter_flush(NetFilterState *nf) 48 { 49 RewriterState *s = FILTER_COLO_REWRITER(nf); 50 51 if (!qemu_net_queue_flush(s->incoming_queue)) { 52 /* Unable to empty the queue, purge remaining packets */ 53 qemu_net_queue_purge(s->incoming_queue, nf->netdev); 54 } 55 } 56 57 /* 58 * Return 1 on success, if return 0 means the pkt 59 * is not TCP packet 60 */ 61 static int is_tcp_packet(Packet *pkt) 62 { 63 if (!parse_packet_early(pkt) && 64 pkt->ip->ip_p == IPPROTO_TCP) { 65 return 1; 66 } else { 67 return 0; 68 } 69 } 70 71 /* handle tcp packet from primary guest */ 72 static int handle_primary_tcp_pkt(RewriterState *rf, 73 Connection *conn, 74 Packet *pkt, ConnectionKey *key) 75 { 76 struct tcp_hdr *tcp_pkt; 77 78 tcp_pkt = (struct tcp_hdr *)pkt->transport_header; 79 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_DEBUG)) { 80 trace_colo_filter_rewriter_pkt_info(__func__, 81 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 82 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 83 tcp_pkt->th_flags); 84 trace_colo_filter_rewriter_conn_offset(conn->offset); 85 } 86 87 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) && 88 conn->tcp_state == TCPS_SYN_SENT) { 89 conn->tcp_state = TCPS_ESTABLISHED; 90 } 91 92 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 93 /* 94 * we use this flag update offset func 95 * run once in independent tcp connection 96 */ 97 conn->tcp_state = TCPS_SYN_RECEIVED; 98 } 99 100 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) { 101 if (conn->tcp_state == TCPS_SYN_RECEIVED) { 102 /* 103 * offset = secondary_seq - primary seq 104 * ack packet sent by guest from primary node, 105 * so we use th_ack - 1 get primary_seq 106 */ 107 conn->offset -= (ntohl(tcp_pkt->th_ack) - 1); 108 conn->tcp_state = TCPS_ESTABLISHED; 109 } 110 if (conn->offset) { 111 /* handle packets to the secondary from the primary */ 112 tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset); 113 114 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 115 pkt->size - pkt->vnet_hdr_len); 116 } 117 118 /* 119 * Passive close step 3 120 */ 121 if ((conn->tcp_state == TCPS_LAST_ACK) && 122 (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) { 123 conn->tcp_state = TCPS_CLOSED; 124 g_hash_table_remove(rf->connection_track_table, key); 125 } 126 } 127 128 if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) { 129 /* 130 * Passive close. 131 * Step 1: 132 * The *server* side of this connect is VM, *client* tries to close 133 * the connection. We will into CLOSE_WAIT status. 134 * 135 * Step 2: 136 * In this step we will into LAST_ACK status. 137 * 138 * We got 'fin=1, ack=1' packet from server side, we need to 139 * record the seq of 'fin=1, ack=1' packet. 140 * 141 * Step 3: 142 * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1' 143 * packet from server side. From this point, we can ensure that there 144 * will be no packets in the connection, except that, some errors 145 * happen between the path of 'filter object' and vNIC, if this rare 146 * case really happen, we can still create a new connection, 147 * So it is safe to remove the connection from connection_track_table. 148 * 149 */ 150 if (conn->tcp_state == TCPS_ESTABLISHED) { 151 conn->tcp_state = TCPS_CLOSE_WAIT; 152 } 153 154 /* 155 * Active close step 2. 156 */ 157 if (conn->tcp_state == TCPS_FIN_WAIT_1) { 158 /* 159 * For simplify implementation, we needn't wait 2MSL time 160 * in filter rewriter. Because guest kernel will track the 161 * TCP status and wait 2MSL time, if client resend the FIN 162 * packet, guest will apply the last ACK too. 163 * So, we skip the TCPS_TIME_WAIT state here and go straight 164 * to TCPS_CLOSED state. 165 */ 166 conn->tcp_state = TCPS_CLOSED; 167 g_hash_table_remove(rf->connection_track_table, key); 168 } 169 } 170 171 return 0; 172 } 173 174 /* handle tcp packet from secondary guest */ 175 static int handle_secondary_tcp_pkt(RewriterState *rf, 176 Connection *conn, 177 Packet *pkt, ConnectionKey *key) 178 { 179 struct tcp_hdr *tcp_pkt; 180 181 tcp_pkt = (struct tcp_hdr *)pkt->transport_header; 182 183 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_DEBUG)) { 184 trace_colo_filter_rewriter_pkt_info(__func__, 185 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 186 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 187 tcp_pkt->th_flags); 188 trace_colo_filter_rewriter_conn_offset(conn->offset); 189 } 190 191 if (conn->tcp_state == TCPS_SYN_RECEIVED && 192 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) { 193 /* 194 * save offset = secondary_seq and then 195 * in handle_primary_tcp_pkt make offset 196 * = secondary_seq - primary_seq 197 */ 198 conn->offset = ntohl(tcp_pkt->th_seq); 199 } 200 201 /* VM active connect */ 202 if (conn->tcp_state == TCPS_CLOSED && 203 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 204 conn->tcp_state = TCPS_SYN_SENT; 205 } 206 207 if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) { 208 /* Only need to adjust seq while offset is Non-zero */ 209 if (conn->offset) { 210 /* handle packets to the primary from the secondary*/ 211 tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset); 212 213 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 214 pkt->size - pkt->vnet_hdr_len); 215 } 216 } 217 218 /* 219 * Passive close step 2: 220 */ 221 if (conn->tcp_state == TCPS_CLOSE_WAIT && 222 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) { 223 conn->fin_ack_seq = ntohl(tcp_pkt->th_seq); 224 conn->tcp_state = TCPS_LAST_ACK; 225 } 226 227 /* 228 * Active close 229 * 230 * Step 1: 231 * The *server* side of this connect is VM, *server* tries to close 232 * the connection. 233 * 234 * Step 2: 235 * We will into CLOSE_WAIT status. 236 * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and 237 * CLOSING status. 238 */ 239 if (conn->tcp_state == TCPS_ESTABLISHED && 240 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) { 241 conn->tcp_state = TCPS_FIN_WAIT_1; 242 } 243 244 return 0; 245 } 246 247 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf, 248 NetClientState *sender, 249 unsigned flags, 250 const struct iovec *iov, 251 int iovcnt, 252 NetPacketSent *sent_cb) 253 { 254 RewriterState *s = FILTER_COLO_REWRITER(nf); 255 Connection *conn; 256 ConnectionKey key; 257 Packet *pkt; 258 ssize_t size = iov_size(iov, iovcnt); 259 ssize_t vnet_hdr_len = 0; 260 char *buf = g_malloc0(size); 261 262 iov_to_buf(iov, iovcnt, 0, buf, size); 263 264 if (s->vnet_hdr) { 265 vnet_hdr_len = nf->netdev->vnet_hdr_len; 266 } 267 268 pkt = packet_new(buf, size, vnet_hdr_len); 269 g_free(buf); 270 271 /* 272 * if we get tcp packet 273 * we will rewrite it to make secondary guest's 274 * connection established successfully 275 */ 276 if (pkt && is_tcp_packet(pkt)) { 277 278 fill_connection_key(pkt, &key); 279 280 if (sender == nf->netdev) { 281 /* 282 * We need make tcp TX and RX packet 283 * into one connection. 284 */ 285 reverse_connection_key(&key); 286 } 287 288 /* After failover we needn't change new TCP packet */ 289 if (s->failover_mode && 290 !connection_has_tracked(s->connection_track_table, &key)) { 291 goto out; 292 } 293 294 conn = connection_get(s->connection_track_table, 295 &key, 296 NULL); 297 298 if (sender == nf->netdev) { 299 /* NET_FILTER_DIRECTION_TX */ 300 if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) { 301 qemu_net_queue_send(s->incoming_queue, sender, 0, 302 (const uint8_t *)pkt->data, pkt->size, NULL); 303 packet_destroy(pkt, NULL); 304 pkt = NULL; 305 /* 306 * We block the packet here,after rewrite pkt 307 * and will send it 308 */ 309 return 1; 310 } 311 } else { 312 /* NET_FILTER_DIRECTION_RX */ 313 if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) { 314 qemu_net_queue_send(s->incoming_queue, sender, 0, 315 (const uint8_t *)pkt->data, pkt->size, NULL); 316 packet_destroy(pkt, NULL); 317 pkt = NULL; 318 /* 319 * We block the packet here,after rewrite pkt 320 * and will send it 321 */ 322 return 1; 323 } 324 } 325 } 326 327 out: 328 packet_destroy(pkt, NULL); 329 pkt = NULL; 330 return 0; 331 } 332 333 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data) 334 { 335 Connection *conn = (Connection *)value; 336 337 conn->offset = 0; 338 } 339 340 static gboolean offset_is_nonzero(gpointer key, 341 gpointer value, 342 gpointer user_data) 343 { 344 Connection *conn = (Connection *)value; 345 346 return conn->offset ? true : false; 347 } 348 349 static void colo_rewriter_handle_event(NetFilterState *nf, int event, 350 Error **errp) 351 { 352 RewriterState *rs = FILTER_COLO_REWRITER(nf); 353 354 switch (event) { 355 case COLO_EVENT_CHECKPOINT: 356 g_hash_table_foreach(rs->connection_track_table, 357 reset_seq_offset, NULL); 358 break; 359 case COLO_EVENT_FAILOVER: 360 if (!g_hash_table_find(rs->connection_track_table, 361 offset_is_nonzero, NULL)) { 362 filter_rewriter_failover_mode(rs); 363 } 364 break; 365 default: 366 break; 367 } 368 } 369 370 static void colo_rewriter_cleanup(NetFilterState *nf) 371 { 372 RewriterState *s = FILTER_COLO_REWRITER(nf); 373 374 /* flush packets */ 375 if (s->incoming_queue) { 376 filter_rewriter_flush(nf); 377 g_free(s->incoming_queue); 378 } 379 } 380 381 static void colo_rewriter_setup(NetFilterState *nf, Error **errp) 382 { 383 RewriterState *s = FILTER_COLO_REWRITER(nf); 384 385 s->connection_track_table = g_hash_table_new_full(connection_key_hash, 386 connection_key_equal, 387 g_free, 388 connection_destroy); 389 s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf); 390 } 391 392 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp) 393 { 394 RewriterState *s = FILTER_COLO_REWRITER(obj); 395 396 return s->vnet_hdr; 397 } 398 399 static void filter_rewriter_set_vnet_hdr(Object *obj, 400 bool value, 401 Error **errp) 402 { 403 RewriterState *s = FILTER_COLO_REWRITER(obj); 404 405 s->vnet_hdr = value; 406 } 407 408 static void filter_rewriter_init(Object *obj) 409 { 410 RewriterState *s = FILTER_COLO_REWRITER(obj); 411 412 s->vnet_hdr = false; 413 s->failover_mode = FAILOVER_MODE_OFF; 414 object_property_add_bool(obj, "vnet_hdr_support", 415 filter_rewriter_get_vnet_hdr, 416 filter_rewriter_set_vnet_hdr); 417 } 418 419 static void colo_rewriter_class_init(ObjectClass *oc, void *data) 420 { 421 NetFilterClass *nfc = NETFILTER_CLASS(oc); 422 423 nfc->setup = colo_rewriter_setup; 424 nfc->cleanup = colo_rewriter_cleanup; 425 nfc->receive_iov = colo_rewriter_receive_iov; 426 nfc->handle_event = colo_rewriter_handle_event; 427 } 428 429 static const TypeInfo colo_rewriter_info = { 430 .name = TYPE_FILTER_REWRITER, 431 .parent = TYPE_NETFILTER, 432 .class_init = colo_rewriter_class_init, 433 .instance_init = filter_rewriter_init, 434 .instance_size = sizeof(RewriterState), 435 }; 436 437 static void register_types(void) 438 { 439 type_register_static(&colo_rewriter_info); 440 } 441 442 type_init(register_types); 443