xref: /qemu/net/filter.c (revision 727385c4) 
1 /*
2  * Copyright (c) 2015 FUJITSU LIMITED
3  * Author: Yang Hongyang <yanghy@cn.fujitsu.com>
4  *
5  * This work is licensed under the terms of the GNU GPL, version 2 or
6  * later.  See the COPYING file in the top-level directory.
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qapi/error.h"
11 #include "qapi/qmp/qerror.h"
12 #include "qemu/error-report.h"
13 
14 #include "net/filter.h"
15 #include "net/net.h"
16 #include "net/vhost_net.h"
17 #include "qom/object_interfaces.h"
18 #include "qemu/iov.h"
19 #include "qemu/module.h"
20 #include "net/colo.h"
21 #include "migration/colo.h"
22 
23 static inline bool qemu_can_skip_netfilter(NetFilterState *nf)
24 {
25     return !nf->on;
26 }
27 
28 ssize_t qemu_netfilter_receive(NetFilterState *nf,
29                                NetFilterDirection direction,
30                                NetClientState *sender,
31                                unsigned flags,
32                                const struct iovec *iov,
33                                int iovcnt,
34                                NetPacketSent *sent_cb)
35 {
36     if (qemu_can_skip_netfilter(nf)) {
37         return 0;
38     }
39     if (nf->direction == direction ||
40         nf->direction == NET_FILTER_DIRECTION_ALL) {
41         return NETFILTER_GET_CLASS(OBJECT(nf))->receive_iov(
42                                    nf, sender, flags, iov, iovcnt, sent_cb);
43     }
44 
45     return 0;
46 }
47 
48 static NetFilterState *netfilter_next(NetFilterState *nf,
49                                       NetFilterDirection dir)
50 {
51     NetFilterState *next;
52 
53     if (dir == NET_FILTER_DIRECTION_TX) {
54         /* forward walk through filters */
55         next = QTAILQ_NEXT(nf, next);
56     } else {
57         /* reverse order */
58         next = QTAILQ_PREV(nf, next);
59     }
60 
61     return next;
62 }
63 
64 ssize_t qemu_netfilter_pass_to_next(NetClientState *sender,
65                                     unsigned flags,
66                                     const struct iovec *iov,
67                                     int iovcnt,
68                                     void *opaque)
69 {
70     int ret = 0;
71     int direction;
72     NetFilterState *nf = opaque;
73     NetFilterState *next = NULL;
74 
75     if (!sender || !sender->peer) {
76         /* no receiver, or sender been deleted, no need to pass it further */
77         goto out;
78     }
79 
80     if (nf->direction == NET_FILTER_DIRECTION_ALL) {
81         if (sender == nf->netdev) {
82             /* This packet is sent by netdev itself */
83             direction = NET_FILTER_DIRECTION_TX;
84         } else {
85             direction = NET_FILTER_DIRECTION_RX;
86         }
87     } else {
88         direction = nf->direction;
89     }
90 
91     next = netfilter_next(nf, direction);
92     while (next) {
93         /*
94          * if qemu_netfilter_pass_to_next been called, means that
95          * the packet has been hold by filter and has already retured size
96          * to the sender, so sent_cb shouldn't be called later, just
97          * pass NULL to next.
98          */
99         ret = qemu_netfilter_receive(next, direction, sender, flags, iov,
100                                      iovcnt, NULL);
101         if (ret) {
102             return ret;
103         }
104         next = netfilter_next(next, direction);
105     }
106 
107     /*
108      * We have gone through all filters, pass it to receiver.
109      * Do the valid check again incase sender or receiver been
110      * deleted while we go through filters.
111      */
112     if (sender && sender->peer) {
113         qemu_net_queue_send_iov(sender->peer->incoming_queue,
114                                 sender, flags, iov, iovcnt, NULL);
115     }
116 
117 out:
118     /* no receiver, or sender been deleted */
119     return iov_size(iov, iovcnt);
120 }
121 
122 static char *netfilter_get_netdev_id(Object *obj, Error **errp)
123 {
124     NetFilterState *nf = NETFILTER(obj);
125 
126     return g_strdup(nf->netdev_id);
127 }
128 
129 static void netfilter_set_netdev_id(Object *obj, const char *str, Error **errp)
130 {
131     NetFilterState *nf = NETFILTER(obj);
132 
133     nf->netdev_id = g_strdup(str);
134 }
135 
136 static int netfilter_get_direction(Object *obj, Error **errp G_GNUC_UNUSED)
137 {
138     NetFilterState *nf = NETFILTER(obj);
139     return nf->direction;
140 }
141 
142 static void netfilter_set_direction(Object *obj, int direction, Error **errp)
143 {
144     NetFilterState *nf = NETFILTER(obj);
145     nf->direction = direction;
146 }
147 
148 static char *netfilter_get_status(Object *obj, Error **errp)
149 {
150     NetFilterState *nf = NETFILTER(obj);
151 
152     return nf->on ? g_strdup("on") : g_strdup("off");
153 }
154 
155 static void netfilter_set_status(Object *obj, const char *str, Error **errp)
156 {
157     NetFilterState *nf = NETFILTER(obj);
158     NetFilterClass *nfc = NETFILTER_GET_CLASS(obj);
159 
160     if (strcmp(str, "on") && strcmp(str, "off")) {
161         error_setg(errp, "Invalid value for netfilter status, "
162                          "should be 'on' or 'off'");
163         return;
164     }
165     if (nf->on == !strcmp(str, "on")) {
166         return;
167     }
168     nf->on = !nf->on;
169     if (nf->netdev && nfc->status_changed) {
170         nfc->status_changed(nf, errp);
171     }
172 }
173 
174 static char *netfilter_get_position(Object *obj, Error **errp)
175 {
176     NetFilterState *nf = NETFILTER(obj);
177 
178     return g_strdup(nf->position);
179 }
180 
181 static void netfilter_set_position(Object *obj, const char *str, Error **errp)
182 {
183     NetFilterState *nf = NETFILTER(obj);
184 
185     nf->position = g_strdup(str);
186 }
187 
188 static char *netfilter_get_insert(Object *obj, Error **errp)
189 {
190     NetFilterState *nf = NETFILTER(obj);
191 
192     return nf->insert_before_flag ? g_strdup("before") : g_strdup("behind");
193 }
194 
195 static void netfilter_set_insert(Object *obj, const char *str, Error **errp)
196 {
197     NetFilterState *nf = NETFILTER(obj);
198 
199     if (strcmp(str, "before") && strcmp(str, "behind")) {
200         error_setg(errp, "Invalid value for netfilter insert, "
201                          "should be 'before' or 'behind'");
202         return;
203     }
204 
205     nf->insert_before_flag = !strcmp(str, "before");
206 }
207 
208 static void netfilter_init(Object *obj)
209 {
210     NetFilterState *nf = NETFILTER(obj);
211 
212     nf->on = true;
213     nf->insert_before_flag = false;
214     nf->position = g_strdup("tail");
215 }
216 
217 static void netfilter_complete(UserCreatable *uc, Error **errp)
218 {
219     NetFilterState *nf = NETFILTER(uc);
220     NetFilterState *position = NULL;
221     NetClientState *ncs[MAX_QUEUE_NUM];
222     NetFilterClass *nfc = NETFILTER_GET_CLASS(uc);
223     int queues;
224     Error *local_err = NULL;
225 
226     if (!nf->netdev_id) {
227         error_setg(errp, "Parameter 'netdev' is required");
228         return;
229     }
230 
231     queues = qemu_find_net_clients_except(nf->netdev_id, ncs,
232                                           NET_CLIENT_DRIVER_NIC,
233                                           MAX_QUEUE_NUM);
234     if (queues < 1) {
235         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "netdev",
236                    "a network backend id");
237         return;
238     } else if (queues > 1) {
239         error_setg(errp, "multiqueue is not supported");
240         return;
241     }
242 
243     if (get_vhost_net(ncs[0])) {
244         error_setg(errp, "Vhost is not supported");
245         return;
246     }
247 
248     if (strcmp(nf->position, "head") && strcmp(nf->position, "tail")) {
249         Object *container;
250         Object *obj;
251         char *position_id;
252 
253         if (!g_str_has_prefix(nf->position, "id=")) {
254             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "position",
255                        "'head', 'tail' or 'id=<id>'");
256             return;
257         }
258 
259         /* get the id from the string */
260         position_id = g_strndup(nf->position + 3, strlen(nf->position) - 3);
261 
262         /* Search for the position to insert before/behind */
263         container = object_get_objects_root();
264         obj = object_resolve_path_component(container, position_id);
265         if (!obj) {
266             error_setg(errp, "filter '%s' not found", position_id);
267             g_free(position_id);
268             return;
269         }
270 
271         position = NETFILTER(obj);
272 
273         if (position->netdev != ncs[0]) {
274             error_setg(errp, "filter '%s' belongs to a different netdev",
275                         position_id);
276             g_free(position_id);
277             return;
278         }
279 
280         g_free(position_id);
281     }
282 
283     nf->netdev = ncs[0];
284 
285     if (nfc->setup) {
286         nfc->setup(nf, &local_err);
287         if (local_err) {
288             error_propagate(errp, local_err);
289             return;
290         }
291     }
292 
293     if (position) {
294         if (nf->insert_before_flag) {
295             QTAILQ_INSERT_BEFORE(position, nf, next);
296         } else {
297             QTAILQ_INSERT_AFTER(&nf->netdev->filters, position, nf, next);
298         }
299     } else if (!strcmp(nf->position, "head")) {
300         QTAILQ_INSERT_HEAD(&nf->netdev->filters, nf, next);
301     } else if (!strcmp(nf->position, "tail")) {
302         QTAILQ_INSERT_TAIL(&nf->netdev->filters, nf, next);
303     }
304 }
305 
306 static void netfilter_finalize(Object *obj)
307 {
308     NetFilterState *nf = NETFILTER(obj);
309     NetFilterClass *nfc = NETFILTER_GET_CLASS(obj);
310 
311     if (nfc->cleanup) {
312         nfc->cleanup(nf);
313     }
314 
315     if (nf->netdev && !QTAILQ_EMPTY(&nf->netdev->filters) &&
316         QTAILQ_IN_USE(nf, next)) {
317         QTAILQ_REMOVE(&nf->netdev->filters, nf, next);
318     }
319     g_free(nf->netdev_id);
320     g_free(nf->position);
321 }
322 
323 static void default_handle_event(NetFilterState *nf, int event, Error **errp)
324 {
325     switch (event) {
326     case COLO_EVENT_CHECKPOINT:
327         break;
328     case COLO_EVENT_FAILOVER:
329         object_property_set_str(OBJECT(nf), "status", "off", errp);
330         break;
331     default:
332         break;
333     }
334 }
335 
336 static void netfilter_class_init(ObjectClass *oc, void *data)
337 {
338     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
339     NetFilterClass *nfc = NETFILTER_CLASS(oc);
340 
341     object_class_property_add_str(oc, "netdev",
342                                   netfilter_get_netdev_id, netfilter_set_netdev_id);
343     object_class_property_add_enum(oc, "queue", "NetFilterDirection",
344                                    &NetFilterDirection_lookup,
345                                    netfilter_get_direction, netfilter_set_direction);
346     object_class_property_add_str(oc, "status",
347                                   netfilter_get_status, netfilter_set_status);
348     object_class_property_add_str(oc, "position",
349                                   netfilter_get_position, netfilter_set_position);
350     object_class_property_add_str(oc, "insert",
351                                   netfilter_get_insert, netfilter_set_insert);
352 
353     ucc->complete = netfilter_complete;
354     nfc->handle_event = default_handle_event;
355 }
356 
357 static const TypeInfo netfilter_info = {
358     .name = TYPE_NETFILTER,
359     .parent = TYPE_OBJECT,
360     .abstract = true,
361     .class_size = sizeof(NetFilterClass),
362     .class_init = netfilter_class_init,
363     .instance_size = sizeof(NetFilterState),
364     .instance_init = netfilter_init,
365     .instance_finalize = netfilter_finalize,
366     .interfaces = (InterfaceInfo[]) {
367         { TYPE_USER_CREATABLE },
368         { }
369     }
370 };
371 
372 static void register_types(void)
373 {
374     type_register_static(&netfilter_info);
375 }
376 
377 type_init(register_types);
378