1e6eee8abSZhang Chen /* 2e6eee8abSZhang Chen * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD. 3e6eee8abSZhang Chen * Copyright (c) 2016 FUJITSU LIMITED 4e6eee8abSZhang Chen * Copyright (c) 2016 Intel Corporation 5e6eee8abSZhang Chen * 6e6eee8abSZhang Chen * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> 7e6eee8abSZhang Chen * 8e6eee8abSZhang Chen * This work is licensed under the terms of the GNU GPL, version 2 or 9e6eee8abSZhang Chen * later. See the COPYING file in the top-level directory. 10e6eee8abSZhang Chen */ 11e6eee8abSZhang Chen 12e6eee8abSZhang Chen #include "qemu/osdep.h" 1330656b09SZhang Chen #include "trace.h" 14e6eee8abSZhang Chen #include "net/colo.h" 15e6eee8abSZhang Chen #include "net/filter.h" 16e6eee8abSZhang Chen #include "net/net.h" 17e6eee8abSZhang Chen #include "qemu-common.h" 18e6eee8abSZhang Chen #include "qapi/error.h" 19e6eee8abSZhang Chen #include "qapi/qmp/qerror.h" 20e6eee8abSZhang Chen #include "qapi-visit.h" 21e6eee8abSZhang Chen #include "qom/object.h" 22e6eee8abSZhang Chen #include "qemu/main-loop.h" 23e6eee8abSZhang Chen #include "qemu/iov.h" 24e6eee8abSZhang Chen #include "net/checksum.h" 25e6eee8abSZhang Chen 26e6eee8abSZhang Chen #define FILTER_COLO_REWRITER(obj) \ 27e6eee8abSZhang Chen OBJECT_CHECK(RewriterState, (obj), TYPE_FILTER_REWRITER) 28e6eee8abSZhang Chen 29e6eee8abSZhang Chen #define TYPE_FILTER_REWRITER "filter-rewriter" 30e6eee8abSZhang Chen 31e6eee8abSZhang Chen typedef struct RewriterState { 32e6eee8abSZhang Chen NetFilterState parent_obj; 33e6eee8abSZhang Chen NetQueue *incoming_queue; 34e6eee8abSZhang Chen /* hashtable to save connection */ 35e6eee8abSZhang Chen GHashTable *connection_track_table; 36e6eee8abSZhang Chen } RewriterState; 37e6eee8abSZhang Chen 38e6eee8abSZhang Chen static void filter_rewriter_flush(NetFilterState *nf) 39e6eee8abSZhang Chen { 40e6eee8abSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 41e6eee8abSZhang Chen 42e6eee8abSZhang Chen if (!qemu_net_queue_flush(s->incoming_queue)) { 43e6eee8abSZhang Chen /* Unable to empty the queue, purge remaining packets */ 44e6eee8abSZhang Chen qemu_net_queue_purge(s->incoming_queue, nf->netdev); 45e6eee8abSZhang Chen } 46e6eee8abSZhang Chen } 47e6eee8abSZhang Chen 48afe46124SZhang Chen /* 49afe46124SZhang Chen * Return 1 on success, if return 0 means the pkt 50afe46124SZhang Chen * is not TCP packet 51afe46124SZhang Chen */ 52afe46124SZhang Chen static int is_tcp_packet(Packet *pkt) 53afe46124SZhang Chen { 54afe46124SZhang Chen if (!parse_packet_early(pkt) && 55afe46124SZhang Chen pkt->ip->ip_p == IPPROTO_TCP) { 56afe46124SZhang Chen return 1; 57afe46124SZhang Chen } else { 58afe46124SZhang Chen return 0; 59afe46124SZhang Chen } 60afe46124SZhang Chen } 61afe46124SZhang Chen 6230656b09SZhang Chen /* handle tcp packet from primary guest */ 6330656b09SZhang Chen static int handle_primary_tcp_pkt(NetFilterState *nf, 6430656b09SZhang Chen Connection *conn, 6530656b09SZhang Chen Packet *pkt) 6630656b09SZhang Chen { 6730656b09SZhang Chen struct tcphdr *tcp_pkt; 6830656b09SZhang Chen 6930656b09SZhang Chen tcp_pkt = (struct tcphdr *)pkt->transport_header; 7030656b09SZhang Chen if (trace_event_get_state(TRACE_COLO_FILTER_REWRITER_DEBUG)) { 71*2061c14cSZhang Chen trace_colo_filter_rewriter_pkt_info(__func__, 72*2061c14cSZhang Chen inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 7330656b09SZhang Chen ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 7430656b09SZhang Chen tcp_pkt->th_flags); 7530656b09SZhang Chen trace_colo_filter_rewriter_conn_offset(conn->offset); 7630656b09SZhang Chen } 7730656b09SZhang Chen 7830656b09SZhang Chen if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 7930656b09SZhang Chen /* 8030656b09SZhang Chen * we use this flag update offset func 8130656b09SZhang Chen * run once in independent tcp connection 8230656b09SZhang Chen */ 8330656b09SZhang Chen conn->syn_flag = 1; 8430656b09SZhang Chen } 8530656b09SZhang Chen 8630656b09SZhang Chen if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) { 8730656b09SZhang Chen if (conn->syn_flag) { 8830656b09SZhang Chen /* 8930656b09SZhang Chen * offset = secondary_seq - primary seq 9030656b09SZhang Chen * ack packet sent by guest from primary node, 9130656b09SZhang Chen * so we use th_ack - 1 get primary_seq 9230656b09SZhang Chen */ 9330656b09SZhang Chen conn->offset -= (ntohl(tcp_pkt->th_ack) - 1); 9430656b09SZhang Chen conn->syn_flag = 0; 9530656b09SZhang Chen } 9630656b09SZhang Chen /* handle packets to the secondary from the primary */ 9730656b09SZhang Chen tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset); 9830656b09SZhang Chen 9930656b09SZhang Chen net_checksum_calculate((uint8_t *)pkt->data, pkt->size); 10030656b09SZhang Chen } 10130656b09SZhang Chen 10230656b09SZhang Chen return 0; 10330656b09SZhang Chen } 10430656b09SZhang Chen 10530656b09SZhang Chen /* handle tcp packet from secondary guest */ 10630656b09SZhang Chen static int handle_secondary_tcp_pkt(NetFilterState *nf, 10730656b09SZhang Chen Connection *conn, 10830656b09SZhang Chen Packet *pkt) 10930656b09SZhang Chen { 11030656b09SZhang Chen struct tcphdr *tcp_pkt; 11130656b09SZhang Chen 11230656b09SZhang Chen tcp_pkt = (struct tcphdr *)pkt->transport_header; 11330656b09SZhang Chen 11430656b09SZhang Chen if (trace_event_get_state(TRACE_COLO_FILTER_REWRITER_DEBUG)) { 115*2061c14cSZhang Chen trace_colo_filter_rewriter_pkt_info(__func__, 116*2061c14cSZhang Chen inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 11730656b09SZhang Chen ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 11830656b09SZhang Chen tcp_pkt->th_flags); 11930656b09SZhang Chen trace_colo_filter_rewriter_conn_offset(conn->offset); 12030656b09SZhang Chen } 12130656b09SZhang Chen 12230656b09SZhang Chen if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) { 12330656b09SZhang Chen /* 12430656b09SZhang Chen * save offset = secondary_seq and then 12530656b09SZhang Chen * in handle_primary_tcp_pkt make offset 12630656b09SZhang Chen * = secondary_seq - primary_seq 12730656b09SZhang Chen */ 12830656b09SZhang Chen conn->offset = ntohl(tcp_pkt->th_seq); 12930656b09SZhang Chen } 13030656b09SZhang Chen 13130656b09SZhang Chen if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) { 13230656b09SZhang Chen /* handle packets to the primary from the secondary*/ 13330656b09SZhang Chen tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset); 13430656b09SZhang Chen 13530656b09SZhang Chen net_checksum_calculate((uint8_t *)pkt->data, pkt->size); 13630656b09SZhang Chen } 13730656b09SZhang Chen 13830656b09SZhang Chen return 0; 13930656b09SZhang Chen } 14030656b09SZhang Chen 141e6eee8abSZhang Chen static ssize_t colo_rewriter_receive_iov(NetFilterState *nf, 142e6eee8abSZhang Chen NetClientState *sender, 143e6eee8abSZhang Chen unsigned flags, 144e6eee8abSZhang Chen const struct iovec *iov, 145e6eee8abSZhang Chen int iovcnt, 146e6eee8abSZhang Chen NetPacketSent *sent_cb) 147e6eee8abSZhang Chen { 148afe46124SZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 149afe46124SZhang Chen Connection *conn; 150afe46124SZhang Chen ConnectionKey key; 151afe46124SZhang Chen Packet *pkt; 152afe46124SZhang Chen ssize_t size = iov_size(iov, iovcnt); 153afe46124SZhang Chen char *buf = g_malloc0(size); 154afe46124SZhang Chen 155afe46124SZhang Chen iov_to_buf(iov, iovcnt, 0, buf, size); 156afe46124SZhang Chen pkt = packet_new(buf, size); 157*2061c14cSZhang Chen g_free(buf); 158afe46124SZhang Chen 159e6eee8abSZhang Chen /* 160e6eee8abSZhang Chen * if we get tcp packet 161e6eee8abSZhang Chen * we will rewrite it to make secondary guest's 162e6eee8abSZhang Chen * connection established successfully 163e6eee8abSZhang Chen */ 164afe46124SZhang Chen if (pkt && is_tcp_packet(pkt)) { 165afe46124SZhang Chen 166afe46124SZhang Chen fill_connection_key(pkt, &key); 167afe46124SZhang Chen 168afe46124SZhang Chen if (sender == nf->netdev) { 169afe46124SZhang Chen /* 170afe46124SZhang Chen * We need make tcp TX and RX packet 171afe46124SZhang Chen * into one connection. 172afe46124SZhang Chen */ 173afe46124SZhang Chen reverse_connection_key(&key); 174afe46124SZhang Chen } 175afe46124SZhang Chen conn = connection_get(s->connection_track_table, 176afe46124SZhang Chen &key, 177afe46124SZhang Chen NULL); 178afe46124SZhang Chen 179afe46124SZhang Chen if (sender == nf->netdev) { 180afe46124SZhang Chen /* NET_FILTER_DIRECTION_TX */ 18130656b09SZhang Chen if (!handle_primary_tcp_pkt(nf, conn, pkt)) { 18230656b09SZhang Chen qemu_net_queue_send(s->incoming_queue, sender, 0, 18330656b09SZhang Chen (const uint8_t *)pkt->data, pkt->size, NULL); 18430656b09SZhang Chen packet_destroy(pkt, NULL); 18530656b09SZhang Chen pkt = NULL; 18630656b09SZhang Chen /* 18730656b09SZhang Chen * We block the packet here,after rewrite pkt 18830656b09SZhang Chen * and will send it 18930656b09SZhang Chen */ 19030656b09SZhang Chen return 1; 19130656b09SZhang Chen } 192afe46124SZhang Chen } else { 193afe46124SZhang Chen /* NET_FILTER_DIRECTION_RX */ 19430656b09SZhang Chen if (!handle_secondary_tcp_pkt(nf, conn, pkt)) { 19530656b09SZhang Chen qemu_net_queue_send(s->incoming_queue, sender, 0, 19630656b09SZhang Chen (const uint8_t *)pkt->data, pkt->size, NULL); 19730656b09SZhang Chen packet_destroy(pkt, NULL); 19830656b09SZhang Chen pkt = NULL; 19930656b09SZhang Chen /* 20030656b09SZhang Chen * We block the packet here,after rewrite pkt 20130656b09SZhang Chen * and will send it 20230656b09SZhang Chen */ 20330656b09SZhang Chen return 1; 20430656b09SZhang Chen } 205afe46124SZhang Chen } 206afe46124SZhang Chen } 207afe46124SZhang Chen 208afe46124SZhang Chen packet_destroy(pkt, NULL); 209afe46124SZhang Chen pkt = NULL; 210e6eee8abSZhang Chen return 0; 211e6eee8abSZhang Chen } 212e6eee8abSZhang Chen 213e6eee8abSZhang Chen static void colo_rewriter_cleanup(NetFilterState *nf) 214e6eee8abSZhang Chen { 215e6eee8abSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 216e6eee8abSZhang Chen 217e6eee8abSZhang Chen /* flush packets */ 218e6eee8abSZhang Chen if (s->incoming_queue) { 219e6eee8abSZhang Chen filter_rewriter_flush(nf); 220e6eee8abSZhang Chen g_free(s->incoming_queue); 221e6eee8abSZhang Chen } 222e6eee8abSZhang Chen } 223e6eee8abSZhang Chen 224e6eee8abSZhang Chen static void colo_rewriter_setup(NetFilterState *nf, Error **errp) 225e6eee8abSZhang Chen { 226e6eee8abSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 227e6eee8abSZhang Chen 228e6eee8abSZhang Chen s->connection_track_table = g_hash_table_new_full(connection_key_hash, 229e6eee8abSZhang Chen connection_key_equal, 230e6eee8abSZhang Chen g_free, 231e6eee8abSZhang Chen connection_destroy); 232e6eee8abSZhang Chen s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf); 233e6eee8abSZhang Chen } 234e6eee8abSZhang Chen 235e6eee8abSZhang Chen static void colo_rewriter_class_init(ObjectClass *oc, void *data) 236e6eee8abSZhang Chen { 237e6eee8abSZhang Chen NetFilterClass *nfc = NETFILTER_CLASS(oc); 238e6eee8abSZhang Chen 239e6eee8abSZhang Chen nfc->setup = colo_rewriter_setup; 240e6eee8abSZhang Chen nfc->cleanup = colo_rewriter_cleanup; 241e6eee8abSZhang Chen nfc->receive_iov = colo_rewriter_receive_iov; 242e6eee8abSZhang Chen } 243e6eee8abSZhang Chen 244e6eee8abSZhang Chen static const TypeInfo colo_rewriter_info = { 245e6eee8abSZhang Chen .name = TYPE_FILTER_REWRITER, 246e6eee8abSZhang Chen .parent = TYPE_NETFILTER, 247e6eee8abSZhang Chen .class_init = colo_rewriter_class_init, 248e6eee8abSZhang Chen .instance_size = sizeof(RewriterState), 249e6eee8abSZhang Chen }; 250e6eee8abSZhang Chen 251e6eee8abSZhang Chen static void register_types(void) 252e6eee8abSZhang Chen { 253e6eee8abSZhang Chen type_register_static(&colo_rewriter_info); 254e6eee8abSZhang Chen } 255e6eee8abSZhang Chen 256e6eee8abSZhang Chen type_init(register_types); 257