tests/acpi: update expected data files for microvm
[qemu.git] / net / filter-rewriter.c
1 /*
2 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
3 * Copyright (c) 2016 FUJITSU LIMITED
4 * Copyright (c) 2016 Intel Corporation
5 *
6 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
7 *
8 * This work is licensed under the terms of the GNU GPL, version 2 or
9 * later. See the COPYING file in the top-level directory.
10 */
11
12 #include "qemu/osdep.h"
13 #include "trace.h"
14 #include "colo.h"
15 #include "net/filter.h"
16 #include "net/net.h"
17 #include "qemu/error-report.h"
18 #include "qom/object.h"
19 #include "qemu/main-loop.h"
20 #include "qemu/iov.h"
21 #include "net/checksum.h"
22 #include "net/colo.h"
23 #include "migration/colo.h"
24 #include "util.h"
25
26 #define TYPE_FILTER_REWRITER "filter-rewriter"
27 typedef struct RewriterState RewriterState;
28 DECLARE_INSTANCE_CHECKER(RewriterState, FILTER_REWRITER,
29 TYPE_FILTER_REWRITER)
30
31 #define FAILOVER_MODE_ON true
32 #define FAILOVER_MODE_OFF false
33
34 struct RewriterState {
35 NetFilterState parent_obj;
36 NetQueue *incoming_queue;
37 /* hashtable to save connection */
38 GHashTable *connection_track_table;
39 bool vnet_hdr;
40 bool failover_mode;
41 };
42
43 static void filter_rewriter_failover_mode(RewriterState *s)
44 {
45 s->failover_mode = FAILOVER_MODE_ON;
46 }
47
48 static void filter_rewriter_flush(NetFilterState *nf)
49 {
50 RewriterState *s = FILTER_REWRITER(nf);
51
52 if (!qemu_net_queue_flush(s->incoming_queue)) {
53 /* Unable to empty the queue, purge remaining packets */
54 qemu_net_queue_purge(s->incoming_queue, nf->netdev);
55 }
56 }
57
58 /*
59 * Return 1 on success, if return 0 means the pkt
60 * is not TCP packet
61 */
62 static int is_tcp_packet(Packet *pkt)
63 {
64 if (!parse_packet_early(pkt) &&
65 pkt->ip->ip_p == IPPROTO_TCP) {
66 return 1;
67 } else {
68 return 0;
69 }
70 }
71
72 /* handle tcp packet from primary guest */
73 static int handle_primary_tcp_pkt(RewriterState *rf,
74 Connection *conn,
75 Packet *pkt, ConnectionKey *key)
76 {
77 struct tcp_hdr *tcp_pkt;
78
79 tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
80 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) {
81 trace_colo_filter_rewriter_pkt_info(__func__,
82 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
83 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
84 tcp_pkt->th_flags);
85 }
86 if (trace_event_get_state_backends(
87 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) {
88 trace_colo_filter_rewriter_conn_offset(conn->offset);
89 }
90
91 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN)) &&
92 conn->tcp_state == TCPS_SYN_SENT) {
93 conn->tcp_state = TCPS_ESTABLISHED;
94 }
95
96 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
97 /*
98 * we use this flag update offset func
99 * run once in independent tcp connection
100 */
101 conn->tcp_state = TCPS_SYN_RECEIVED;
102 }
103
104 if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) {
105 if (conn->tcp_state == TCPS_SYN_RECEIVED) {
106 /*
107 * offset = secondary_seq - primary seq
108 * ack packet sent by guest from primary node,
109 * so we use th_ack - 1 get primary_seq
110 */
111 conn->offset -= (ntohl(tcp_pkt->th_ack) - 1);
112 conn->tcp_state = TCPS_ESTABLISHED;
113 }
114 if (conn->offset) {
115 /* handle packets to the secondary from the primary */
116 tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset);
117
118 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
119 pkt->size - pkt->vnet_hdr_len);
120 }
121
122 /*
123 * Passive close step 3
124 */
125 if ((conn->tcp_state == TCPS_LAST_ACK) &&
126 (ntohl(tcp_pkt->th_ack) == (conn->fin_ack_seq + 1))) {
127 conn->tcp_state = TCPS_CLOSED;
128 g_hash_table_remove(rf->connection_track_table, key);
129 }
130 }
131
132 if ((tcp_pkt->th_flags & TH_FIN) == TH_FIN) {
133 /*
134 * Passive close.
135 * Step 1:
136 * The *server* side of this connect is VM, *client* tries to close
137 * the connection. We will into CLOSE_WAIT status.
138 *
139 * Step 2:
140 * In this step we will into LAST_ACK status.
141 *
142 * We got 'fin=1, ack=1' packet from server side, we need to
143 * record the seq of 'fin=1, ack=1' packet.
144 *
145 * Step 3:
146 * We got 'ack=1' packets from client side, it acks 'fin=1, ack=1'
147 * packet from server side. From this point, we can ensure that there
148 * will be no packets in the connection, except that, some errors
149 * happen between the path of 'filter object' and vNIC, if this rare
150 * case really happen, we can still create a new connection,
151 * So it is safe to remove the connection from connection_track_table.
152 *
153 */
154 if (conn->tcp_state == TCPS_ESTABLISHED) {
155 conn->tcp_state = TCPS_CLOSE_WAIT;
156 }
157
158 /*
159 * Active close step 2.
160 */
161 if (conn->tcp_state == TCPS_FIN_WAIT_1) {
162 /*
163 * For simplify implementation, we needn't wait 2MSL time
164 * in filter rewriter. Because guest kernel will track the
165 * TCP status and wait 2MSL time, if client resend the FIN
166 * packet, guest will apply the last ACK too.
167 * So, we skip the TCPS_TIME_WAIT state here and go straight
168 * to TCPS_CLOSED state.
169 */
170 conn->tcp_state = TCPS_CLOSED;
171 g_hash_table_remove(rf->connection_track_table, key);
172 }
173 }
174
175 return 0;
176 }
177
178 /* handle tcp packet from secondary guest */
179 static int handle_secondary_tcp_pkt(RewriterState *rf,
180 Connection *conn,
181 Packet *pkt, ConnectionKey *key)
182 {
183 struct tcp_hdr *tcp_pkt;
184
185 tcp_pkt = (struct tcp_hdr *)pkt->transport_header;
186
187 if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_PKT_INFO)) {
188 trace_colo_filter_rewriter_pkt_info(__func__,
189 inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst),
190 ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack),
191 tcp_pkt->th_flags);
192 }
193 if (trace_event_get_state_backends(
194 TRACE_COLO_FILTER_REWRITER_CONN_OFFSET)) {
195 trace_colo_filter_rewriter_conn_offset(conn->offset);
196 }
197
198 if (conn->tcp_state == TCPS_SYN_RECEIVED &&
199 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) {
200 /*
201 * save offset = secondary_seq and then
202 * in handle_primary_tcp_pkt make offset
203 * = secondary_seq - primary_seq
204 */
205 conn->offset = ntohl(tcp_pkt->th_seq);
206 }
207
208 /* VM active connect */
209 if (conn->tcp_state == TCPS_CLOSED &&
210 ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) {
211 conn->tcp_state = TCPS_SYN_SENT;
212 }
213
214 if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) {
215 /* Only need to adjust seq while offset is Non-zero */
216 if (conn->offset) {
217 /* handle packets to the primary from the secondary*/
218 tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset);
219
220 net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len,
221 pkt->size - pkt->vnet_hdr_len);
222 }
223 }
224
225 /*
226 * Passive close step 2:
227 */
228 if (conn->tcp_state == TCPS_CLOSE_WAIT &&
229 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == (TH_ACK | TH_FIN)) {
230 conn->fin_ack_seq = ntohl(tcp_pkt->th_seq);
231 conn->tcp_state = TCPS_LAST_ACK;
232 }
233
234 /*
235 * Active close
236 *
237 * Step 1:
238 * The *server* side of this connect is VM, *server* tries to close
239 * the connection.
240 *
241 * Step 2:
242 * We will into CLOSE_WAIT status.
243 * We simplify the TCPS_FIN_WAIT_2, TCPS_TIME_WAIT and
244 * CLOSING status.
245 */
246 if (conn->tcp_state == TCPS_ESTABLISHED &&
247 (tcp_pkt->th_flags & (TH_ACK | TH_FIN)) == TH_FIN) {
248 conn->tcp_state = TCPS_FIN_WAIT_1;
249 }
250
251 return 0;
252 }
253
254 static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
255 NetClientState *sender,
256 unsigned flags,
257 const struct iovec *iov,
258 int iovcnt,
259 NetPacketSent *sent_cb)
260 {
261 RewriterState *s = FILTER_REWRITER(nf);
262 Connection *conn;
263 ConnectionKey key;
264 Packet *pkt;
265 ssize_t size = iov_size(iov, iovcnt);
266 ssize_t vnet_hdr_len = 0;
267 char *buf = g_malloc0(size);
268
269 iov_to_buf(iov, iovcnt, 0, buf, size);
270
271 if (s->vnet_hdr) {
272 vnet_hdr_len = nf->netdev->vnet_hdr_len;
273 }
274
275 pkt = packet_new(buf, size, vnet_hdr_len);
276 g_free(buf);
277
278 /*
279 * if we get tcp packet
280 * we will rewrite it to make secondary guest's
281 * connection established successfully
282 */
283 if (pkt && is_tcp_packet(pkt)) {
284
285 fill_connection_key(pkt, &key);
286
287 if (sender == nf->netdev) {
288 /*
289 * We need make tcp TX and RX packet
290 * into one connection.
291 */
292 reverse_connection_key(&key);
293 }
294
295 /* After failover we needn't change new TCP packet */
296 if (s->failover_mode &&
297 !connection_has_tracked(s->connection_track_table, &key)) {
298 goto out;
299 }
300
301 conn = connection_get(s->connection_track_table,
302 &key,
303 NULL);
304
305 if (sender == nf->netdev) {
306 /* NET_FILTER_DIRECTION_TX */
307 if (!handle_primary_tcp_pkt(s, conn, pkt, &key)) {
308 qemu_net_queue_send(s->incoming_queue, sender, 0,
309 (const uint8_t *)pkt->data, pkt->size, NULL);
310 packet_destroy(pkt, NULL);
311 pkt = NULL;
312 /*
313 * We block the packet here,after rewrite pkt
314 * and will send it
315 */
316 return 1;
317 }
318 } else {
319 /* NET_FILTER_DIRECTION_RX */
320 if (!handle_secondary_tcp_pkt(s, conn, pkt, &key)) {
321 qemu_net_queue_send(s->incoming_queue, sender, 0,
322 (const uint8_t *)pkt->data, pkt->size, NULL);
323 packet_destroy(pkt, NULL);
324 pkt = NULL;
325 /*
326 * We block the packet here,after rewrite pkt
327 * and will send it
328 */
329 return 1;
330 }
331 }
332 }
333
334 out:
335 packet_destroy(pkt, NULL);
336 pkt = NULL;
337 return 0;
338 }
339
340 static void reset_seq_offset(gpointer key, gpointer value, gpointer user_data)
341 {
342 Connection *conn = (Connection *)value;
343
344 conn->offset = 0;
345 }
346
347 static gboolean offset_is_nonzero(gpointer key,
348 gpointer value,
349 gpointer user_data)
350 {
351 Connection *conn = (Connection *)value;
352
353 return conn->offset ? true : false;
354 }
355
356 static void colo_rewriter_handle_event(NetFilterState *nf, int event,
357 Error **errp)
358 {
359 RewriterState *rs = FILTER_REWRITER(nf);
360
361 switch (event) {
362 case COLO_EVENT_CHECKPOINT:
363 g_hash_table_foreach(rs->connection_track_table,
364 reset_seq_offset, NULL);
365 break;
366 case COLO_EVENT_FAILOVER:
367 if (!g_hash_table_find(rs->connection_track_table,
368 offset_is_nonzero, NULL)) {
369 filter_rewriter_failover_mode(rs);
370 }
371 break;
372 default:
373 break;
374 }
375 }
376
377 static void colo_rewriter_cleanup(NetFilterState *nf)
378 {
379 RewriterState *s = FILTER_REWRITER(nf);
380
381 /* flush packets */
382 if (s->incoming_queue) {
383 filter_rewriter_flush(nf);
384 g_free(s->incoming_queue);
385 }
386 }
387
388 static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
389 {
390 RewriterState *s = FILTER_REWRITER(nf);
391
392 s->connection_track_table = g_hash_table_new_full(connection_key_hash,
393 connection_key_equal,
394 g_free,
395 connection_destroy);
396 s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
397 }
398
399 static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp)
400 {
401 RewriterState *s = FILTER_REWRITER(obj);
402
403 return s->vnet_hdr;
404 }
405
406 static void filter_rewriter_set_vnet_hdr(Object *obj,
407 bool value,
408 Error **errp)
409 {
410 RewriterState *s = FILTER_REWRITER(obj);
411
412 s->vnet_hdr = value;
413 }
414
415 static void filter_rewriter_init(Object *obj)
416 {
417 RewriterState *s = FILTER_REWRITER(obj);
418
419 s->vnet_hdr = false;
420 s->failover_mode = FAILOVER_MODE_OFF;
421 object_property_add_bool(obj, "vnet_hdr_support",
422 filter_rewriter_get_vnet_hdr,
423 filter_rewriter_set_vnet_hdr);
424 }
425
426 static void colo_rewriter_class_init(ObjectClass *oc, void *data)
427 {
428 NetFilterClass *nfc = NETFILTER_CLASS(oc);
429
430 nfc->setup = colo_rewriter_setup;
431 nfc->cleanup = colo_rewriter_cleanup;
432 nfc->receive_iov = colo_rewriter_receive_iov;
433 nfc->handle_event = colo_rewriter_handle_event;
434 }
435
436 static const TypeInfo colo_rewriter_info = {
437 .name = TYPE_FILTER_REWRITER,
438 .parent = TYPE_NETFILTER,
439 .class_init = colo_rewriter_class_init,
440 .instance_init = filter_rewriter_init,
441 .instance_size = sizeof(RewriterState),
442 };
443
444 static void register_types(void)
445 {
446 type_register_static(&colo_rewriter_info);
447 }
448
449 type_init(register_types);