1e6eee8abSZhang Chen /* 2e6eee8abSZhang Chen * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD. 3e6eee8abSZhang Chen * Copyright (c) 2016 FUJITSU LIMITED 4e6eee8abSZhang Chen * Copyright (c) 2016 Intel Corporation 5e6eee8abSZhang Chen * 6e6eee8abSZhang Chen * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> 7e6eee8abSZhang Chen * 8e6eee8abSZhang Chen * This work is licensed under the terms of the GNU GPL, version 2 or 9e6eee8abSZhang Chen * later. See the COPYING file in the top-level directory. 10e6eee8abSZhang Chen */ 11e6eee8abSZhang Chen 12e6eee8abSZhang Chen #include "qemu/osdep.h" 1330656b09SZhang Chen #include "trace.h" 14*f27f01dbSMichael S. Tsirkin #include "colo.h" 15e6eee8abSZhang Chen #include "net/filter.h" 16e6eee8abSZhang Chen #include "net/net.h" 17e6eee8abSZhang Chen #include "qemu-common.h" 184b39bdceSZhang Chen #include "qemu/error-report.h" 19e6eee8abSZhang Chen #include "qom/object.h" 20e6eee8abSZhang Chen #include "qemu/main-loop.h" 21e6eee8abSZhang Chen #include "qemu/iov.h" 22e6eee8abSZhang Chen #include "net/checksum.h" 23e6eee8abSZhang Chen 24e6eee8abSZhang Chen #define FILTER_COLO_REWRITER(obj) \ 25e6eee8abSZhang Chen OBJECT_CHECK(RewriterState, (obj), TYPE_FILTER_REWRITER) 26e6eee8abSZhang Chen 27e6eee8abSZhang Chen #define TYPE_FILTER_REWRITER "filter-rewriter" 28e6eee8abSZhang Chen 29e6eee8abSZhang Chen typedef struct RewriterState { 30e6eee8abSZhang Chen NetFilterState parent_obj; 31e6eee8abSZhang Chen NetQueue *incoming_queue; 32e6eee8abSZhang Chen /* hashtable to save connection */ 33e6eee8abSZhang Chen GHashTable *connection_track_table; 344b39bdceSZhang Chen bool vnet_hdr; 35e6eee8abSZhang Chen } RewriterState; 36e6eee8abSZhang Chen 37e6eee8abSZhang Chen static void filter_rewriter_flush(NetFilterState *nf) 38e6eee8abSZhang Chen { 39e6eee8abSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 40e6eee8abSZhang Chen 41e6eee8abSZhang Chen if (!qemu_net_queue_flush(s->incoming_queue)) { 42e6eee8abSZhang Chen /* Unable to empty the queue, purge remaining packets */ 43e6eee8abSZhang Chen qemu_net_queue_purge(s->incoming_queue, nf->netdev); 44e6eee8abSZhang Chen } 45e6eee8abSZhang Chen } 46e6eee8abSZhang Chen 47afe46124SZhang Chen /* 48afe46124SZhang Chen * Return 1 on success, if return 0 means the pkt 49afe46124SZhang Chen * is not TCP packet 50afe46124SZhang Chen */ 51afe46124SZhang Chen static int is_tcp_packet(Packet *pkt) 52afe46124SZhang Chen { 53afe46124SZhang Chen if (!parse_packet_early(pkt) && 54afe46124SZhang Chen pkt->ip->ip_p == IPPROTO_TCP) { 55afe46124SZhang Chen return 1; 56afe46124SZhang Chen } else { 57afe46124SZhang Chen return 0; 58afe46124SZhang Chen } 59afe46124SZhang Chen } 60afe46124SZhang Chen 6130656b09SZhang Chen /* handle tcp packet from primary guest */ 6230656b09SZhang Chen static int handle_primary_tcp_pkt(NetFilterState *nf, 6330656b09SZhang Chen Connection *conn, 6430656b09SZhang Chen Packet *pkt) 6530656b09SZhang Chen { 6630656b09SZhang Chen struct tcphdr *tcp_pkt; 6730656b09SZhang Chen 6830656b09SZhang Chen tcp_pkt = (struct tcphdr *)pkt->transport_header; 69d87aa138SStefan Hajnoczi if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_DEBUG)) { 702061c14cSZhang Chen trace_colo_filter_rewriter_pkt_info(__func__, 712061c14cSZhang Chen inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 7230656b09SZhang Chen ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 7330656b09SZhang Chen tcp_pkt->th_flags); 7430656b09SZhang Chen trace_colo_filter_rewriter_conn_offset(conn->offset); 7530656b09SZhang Chen } 7630656b09SZhang Chen 7730656b09SZhang Chen if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_SYN)) { 7830656b09SZhang Chen /* 7930656b09SZhang Chen * we use this flag update offset func 8030656b09SZhang Chen * run once in independent tcp connection 8130656b09SZhang Chen */ 8230656b09SZhang Chen conn->syn_flag = 1; 8330656b09SZhang Chen } 8430656b09SZhang Chen 8530656b09SZhang Chen if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK)) { 8630656b09SZhang Chen if (conn->syn_flag) { 8730656b09SZhang Chen /* 8830656b09SZhang Chen * offset = secondary_seq - primary seq 8930656b09SZhang Chen * ack packet sent by guest from primary node, 9030656b09SZhang Chen * so we use th_ack - 1 get primary_seq 9130656b09SZhang Chen */ 9230656b09SZhang Chen conn->offset -= (ntohl(tcp_pkt->th_ack) - 1); 9330656b09SZhang Chen conn->syn_flag = 0; 9430656b09SZhang Chen } 95db0a762eSzhanghailiang if (conn->offset) { 9630656b09SZhang Chen /* handle packets to the secondary from the primary */ 9730656b09SZhang Chen tcp_pkt->th_ack = htonl(ntohl(tcp_pkt->th_ack) + conn->offset); 9830656b09SZhang Chen 996ce310b5SZhang Chen net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 1006ce310b5SZhang Chen pkt->size - pkt->vnet_hdr_len); 10130656b09SZhang Chen } 102db0a762eSzhanghailiang } 10330656b09SZhang Chen 10430656b09SZhang Chen return 0; 10530656b09SZhang Chen } 10630656b09SZhang Chen 10730656b09SZhang Chen /* handle tcp packet from secondary guest */ 10830656b09SZhang Chen static int handle_secondary_tcp_pkt(NetFilterState *nf, 10930656b09SZhang Chen Connection *conn, 11030656b09SZhang Chen Packet *pkt) 11130656b09SZhang Chen { 11230656b09SZhang Chen struct tcphdr *tcp_pkt; 11330656b09SZhang Chen 11430656b09SZhang Chen tcp_pkt = (struct tcphdr *)pkt->transport_header; 11530656b09SZhang Chen 116d87aa138SStefan Hajnoczi if (trace_event_get_state_backends(TRACE_COLO_FILTER_REWRITER_DEBUG)) { 1172061c14cSZhang Chen trace_colo_filter_rewriter_pkt_info(__func__, 1182061c14cSZhang Chen inet_ntoa(pkt->ip->ip_src), inet_ntoa(pkt->ip->ip_dst), 11930656b09SZhang Chen ntohl(tcp_pkt->th_seq), ntohl(tcp_pkt->th_ack), 12030656b09SZhang Chen tcp_pkt->th_flags); 12130656b09SZhang Chen trace_colo_filter_rewriter_conn_offset(conn->offset); 12230656b09SZhang Chen } 12330656b09SZhang Chen 12430656b09SZhang Chen if (((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == (TH_ACK | TH_SYN))) { 12530656b09SZhang Chen /* 12630656b09SZhang Chen * save offset = secondary_seq and then 12730656b09SZhang Chen * in handle_primary_tcp_pkt make offset 12830656b09SZhang Chen * = secondary_seq - primary_seq 12930656b09SZhang Chen */ 13030656b09SZhang Chen conn->offset = ntohl(tcp_pkt->th_seq); 13130656b09SZhang Chen } 13230656b09SZhang Chen 13330656b09SZhang Chen if ((tcp_pkt->th_flags & (TH_ACK | TH_SYN)) == TH_ACK) { 134db0a762eSzhanghailiang /* Only need to adjust seq while offset is Non-zero */ 135db0a762eSzhanghailiang if (conn->offset) { 13630656b09SZhang Chen /* handle packets to the primary from the secondary*/ 13730656b09SZhang Chen tcp_pkt->th_seq = htonl(ntohl(tcp_pkt->th_seq) - conn->offset); 13830656b09SZhang Chen 1396ce310b5SZhang Chen net_checksum_calculate((uint8_t *)pkt->data + pkt->vnet_hdr_len, 1406ce310b5SZhang Chen pkt->size - pkt->vnet_hdr_len); 14130656b09SZhang Chen } 142db0a762eSzhanghailiang } 14330656b09SZhang Chen 14430656b09SZhang Chen return 0; 14530656b09SZhang Chen } 14630656b09SZhang Chen 147e6eee8abSZhang Chen static ssize_t colo_rewriter_receive_iov(NetFilterState *nf, 148e6eee8abSZhang Chen NetClientState *sender, 149e6eee8abSZhang Chen unsigned flags, 150e6eee8abSZhang Chen const struct iovec *iov, 151e6eee8abSZhang Chen int iovcnt, 152e6eee8abSZhang Chen NetPacketSent *sent_cb) 153e6eee8abSZhang Chen { 154afe46124SZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 155afe46124SZhang Chen Connection *conn; 156afe46124SZhang Chen ConnectionKey key; 157afe46124SZhang Chen Packet *pkt; 158afe46124SZhang Chen ssize_t size = iov_size(iov, iovcnt); 1594b39bdceSZhang Chen ssize_t vnet_hdr_len = 0; 160afe46124SZhang Chen char *buf = g_malloc0(size); 161afe46124SZhang Chen 162afe46124SZhang Chen iov_to_buf(iov, iovcnt, 0, buf, size); 1634b39bdceSZhang Chen 1644b39bdceSZhang Chen if (s->vnet_hdr) { 1654b39bdceSZhang Chen vnet_hdr_len = nf->netdev->vnet_hdr_len; 1664b39bdceSZhang Chen } 1674b39bdceSZhang Chen 1684b39bdceSZhang Chen pkt = packet_new(buf, size, vnet_hdr_len); 1692061c14cSZhang Chen g_free(buf); 170afe46124SZhang Chen 171e6eee8abSZhang Chen /* 172e6eee8abSZhang Chen * if we get tcp packet 173e6eee8abSZhang Chen * we will rewrite it to make secondary guest's 174e6eee8abSZhang Chen * connection established successfully 175e6eee8abSZhang Chen */ 176afe46124SZhang Chen if (pkt && is_tcp_packet(pkt)) { 177afe46124SZhang Chen 178afe46124SZhang Chen fill_connection_key(pkt, &key); 179afe46124SZhang Chen 180afe46124SZhang Chen if (sender == nf->netdev) { 181afe46124SZhang Chen /* 182afe46124SZhang Chen * We need make tcp TX and RX packet 183afe46124SZhang Chen * into one connection. 184afe46124SZhang Chen */ 185afe46124SZhang Chen reverse_connection_key(&key); 186afe46124SZhang Chen } 187afe46124SZhang Chen conn = connection_get(s->connection_track_table, 188afe46124SZhang Chen &key, 189afe46124SZhang Chen NULL); 190afe46124SZhang Chen 191afe46124SZhang Chen if (sender == nf->netdev) { 192afe46124SZhang Chen /* NET_FILTER_DIRECTION_TX */ 19330656b09SZhang Chen if (!handle_primary_tcp_pkt(nf, conn, pkt)) { 19430656b09SZhang Chen qemu_net_queue_send(s->incoming_queue, sender, 0, 19530656b09SZhang Chen (const uint8_t *)pkt->data, pkt->size, NULL); 19630656b09SZhang Chen packet_destroy(pkt, NULL); 19730656b09SZhang Chen pkt = NULL; 19830656b09SZhang Chen /* 19930656b09SZhang Chen * We block the packet here,after rewrite pkt 20030656b09SZhang Chen * and will send it 20130656b09SZhang Chen */ 20230656b09SZhang Chen return 1; 20330656b09SZhang Chen } 204afe46124SZhang Chen } else { 205afe46124SZhang Chen /* NET_FILTER_DIRECTION_RX */ 20630656b09SZhang Chen if (!handle_secondary_tcp_pkt(nf, conn, pkt)) { 20730656b09SZhang Chen qemu_net_queue_send(s->incoming_queue, sender, 0, 20830656b09SZhang Chen (const uint8_t *)pkt->data, pkt->size, NULL); 20930656b09SZhang Chen packet_destroy(pkt, NULL); 21030656b09SZhang Chen pkt = NULL; 21130656b09SZhang Chen /* 21230656b09SZhang Chen * We block the packet here,after rewrite pkt 21330656b09SZhang Chen * and will send it 21430656b09SZhang Chen */ 21530656b09SZhang Chen return 1; 21630656b09SZhang Chen } 217afe46124SZhang Chen } 218afe46124SZhang Chen } 219afe46124SZhang Chen 220afe46124SZhang Chen packet_destroy(pkt, NULL); 221afe46124SZhang Chen pkt = NULL; 222e6eee8abSZhang Chen return 0; 223e6eee8abSZhang Chen } 224e6eee8abSZhang Chen 225e6eee8abSZhang Chen static void colo_rewriter_cleanup(NetFilterState *nf) 226e6eee8abSZhang Chen { 227e6eee8abSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 228e6eee8abSZhang Chen 229e6eee8abSZhang Chen /* flush packets */ 230e6eee8abSZhang Chen if (s->incoming_queue) { 231e6eee8abSZhang Chen filter_rewriter_flush(nf); 232e6eee8abSZhang Chen g_free(s->incoming_queue); 233e6eee8abSZhang Chen } 234e6eee8abSZhang Chen } 235e6eee8abSZhang Chen 236e6eee8abSZhang Chen static void colo_rewriter_setup(NetFilterState *nf, Error **errp) 237e6eee8abSZhang Chen { 238e6eee8abSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(nf); 239e6eee8abSZhang Chen 240e6eee8abSZhang Chen s->connection_track_table = g_hash_table_new_full(connection_key_hash, 241e6eee8abSZhang Chen connection_key_equal, 242e6eee8abSZhang Chen g_free, 243e6eee8abSZhang Chen connection_destroy); 244e6eee8abSZhang Chen s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf); 245e6eee8abSZhang Chen } 246e6eee8abSZhang Chen 2474b39bdceSZhang Chen static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp) 2484b39bdceSZhang Chen { 2494b39bdceSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(obj); 2504b39bdceSZhang Chen 2514b39bdceSZhang Chen return s->vnet_hdr; 2524b39bdceSZhang Chen } 2534b39bdceSZhang Chen 2544b39bdceSZhang Chen static void filter_rewriter_set_vnet_hdr(Object *obj, 2554b39bdceSZhang Chen bool value, 2564b39bdceSZhang Chen Error **errp) 2574b39bdceSZhang Chen { 2584b39bdceSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(obj); 2594b39bdceSZhang Chen 2604b39bdceSZhang Chen s->vnet_hdr = value; 2614b39bdceSZhang Chen } 2624b39bdceSZhang Chen 2634b39bdceSZhang Chen static void filter_rewriter_init(Object *obj) 2644b39bdceSZhang Chen { 2654b39bdceSZhang Chen RewriterState *s = FILTER_COLO_REWRITER(obj); 2664b39bdceSZhang Chen 2674b39bdceSZhang Chen s->vnet_hdr = false; 2684b39bdceSZhang Chen object_property_add_bool(obj, "vnet_hdr_support", 2694b39bdceSZhang Chen filter_rewriter_get_vnet_hdr, 2704b39bdceSZhang Chen filter_rewriter_set_vnet_hdr, NULL); 2714b39bdceSZhang Chen } 2724b39bdceSZhang Chen 273e6eee8abSZhang Chen static void colo_rewriter_class_init(ObjectClass *oc, void *data) 274e6eee8abSZhang Chen { 275e6eee8abSZhang Chen NetFilterClass *nfc = NETFILTER_CLASS(oc); 276e6eee8abSZhang Chen 277e6eee8abSZhang Chen nfc->setup = colo_rewriter_setup; 278e6eee8abSZhang Chen nfc->cleanup = colo_rewriter_cleanup; 279e6eee8abSZhang Chen nfc->receive_iov = colo_rewriter_receive_iov; 280e6eee8abSZhang Chen } 281e6eee8abSZhang Chen 282e6eee8abSZhang Chen static const TypeInfo colo_rewriter_info = { 283e6eee8abSZhang Chen .name = TYPE_FILTER_REWRITER, 284e6eee8abSZhang Chen .parent = TYPE_NETFILTER, 285e6eee8abSZhang Chen .class_init = colo_rewriter_class_init, 2864b39bdceSZhang Chen .instance_init = filter_rewriter_init, 287e6eee8abSZhang Chen .instance_size = sizeof(RewriterState), 288e6eee8abSZhang Chen }; 289e6eee8abSZhang Chen 290e6eee8abSZhang Chen static void register_types(void) 291e6eee8abSZhang Chen { 292e6eee8abSZhang Chen type_register_static(&colo_rewriter_info); 293e6eee8abSZhang Chen } 294e6eee8abSZhang Chen 295e6eee8abSZhang Chen type_init(register_types); 296