From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 4B07D5A0272 for ; Thu, 21 Dec 2023 08:02:43 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1703142160; bh=U5g0JRHRQcLgHcZw3XdRzB5kelUOEG1MkO5QQZbtRPg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ETSHUjsdOnSnEz7XFes4E7xiSm811dGPCcu52pFLr8LG/cq+eDFjvtILx6pz0vhWo EZdKL6iDn9UTEzgzNzjfsw72e84htruNDLLPWJ/dp+CPxPw5yV8coAqg6T8pywRtWh i9P8qK1szJ7g4H3oRz44PFirDNNorC/FqxyZUSlIycYKXgmqfP+ryhtu0SDunpnHCZ tbGkEt6IvYwQtVyBz7CJCUf67R8RwB7W/iRjsLAuwznG1o1PW2x1KVcV3FUyaYtlMp luIgVjK8SaJ5MmXW8PC0SdLXlqaV+iADZKZw5QlwoppCnxWKp5CctX0j7aW/RT5MEi +saBu/VgXVC6g== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4SwhFr71Hkz4xPf; Thu, 21 Dec 2023 18:02:40 +1100 (AEDT) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH v3 03/15] tcp, flow: Maintain host side flow information Date: Thu, 21 Dec 2023 18:02:25 +1100 Message-ID: <20231221070237.1422557-4-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231221070237.1422557-1-david@gibson.dropbear.id.au> References: <20231221070237.1422557-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: J7ZHXLDMRP2E3FQ4TAJAQYI5C5ZSRGC7 X-Message-ID-Hash: J7ZHXLDMRP2E3FQ4TAJAQYI5C5ZSRGC7 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: We now maintain a struct flowside describing each TCP connection as it appears to the guest. We don't yet store the same information for the connections as they appear to the host. Rather, that information is implicit in the state of the host side socket. For future generalisations of flow/connection tracking, we're going to need to use this information more heavily, so properly populate the other flowside in each flow table entry with this information. This does require an additional getsockname() call for each new connection. We hope to optimise that away for at least some cases in future. Signed-off-by: David Gibson --- flow.c | 41 +++++++++++++++++++++++++++++++++++++++++ flow.h | 3 +++ tcp.c | 36 ++++++++++++++++++++++++++++++------ util.h | 18 ++++++++++++++++++ 4 files changed, 92 insertions(+), 6 deletions(-) diff --git a/flow.c b/flow.c index 421e6b5..b9c4a18 100644 --- a/flow.c +++ b/flow.c @@ -8,6 +8,7 @@ #include #include #include +#include #include "util.h" #include "passt.h" @@ -49,6 +50,46 @@ void flow_log_(const struct flow_common *f, int pri, const char *fmt, ...) logmsg(pri, "Flow %u (%s): %s", flow_idx(f), FLOW_TYPE(f), msg); } +/** flowside_from_sock - Initialize flowside to match an existing socket + * @fside: flowside to initialize + * @pif: pif id of this flowside + * @s: socket + * @fsa: Local addr of @s as sockaddr_in or sockaddr_in6, or NULL + * @esa: Remote addr of @s as sockaddr_in or sockaddr_in6, or NULL + * + * If NULL is passed for either @fsa/@esa, we use getsockname()/getpeername() to + * obtain the information from the @s. + * + * #syscalls getsockname getpeername + */ +int flowside_from_sock(struct flowside *fside, uint8_t pif, int s, + const void *fsa, const void *esa) +{ + struct sockaddr_storage sa; + + fside->pif = pif; + + if (!fsa) { + socklen_t sl = sizeof(sa); + if (getsockname(s, (struct sockaddr *)&sa, &sl) < 0) + return -errno; + fsa = &sa; + } + inany_from_sockaddr(&fside->faddr, &fside->fport, + (const struct sockaddr *)fsa); + + if (!esa) { + socklen_t sl = sizeof(sa); + if (getpeername(s, (struct sockaddr *)&sa, &sl) < 0) + return -errno; + esa = &sa; + } + inany_from_sockaddr(&fside->eaddr, &fside->eport, + (const struct sockaddr *)esa); + + return 0; +} + /** * DOC: Theory of Operation - allocation and freeing of flow entries * diff --git a/flow.h b/flow.h index e7126e4..37885b2 100644 --- a/flow.h +++ b/flow.h @@ -65,6 +65,9 @@ static inline void flowside_from_af(struct flowside *fside, uint8_t pif, int af, fside->eport = eport; } +int flowside_from_sock(struct flowside *fside, uint8_t pif, int s, + const void *fsa, const void *esa); + /** flowside_complete - Check if flowside is fully initialized * @fside: flowside to check */ diff --git a/tcp.c b/tcp.c index 7ef20b1..18ab3ac 100644 --- a/tcp.c +++ b/tcp.c @@ -395,6 +395,7 @@ struct tcp6_l2_head { /* For MSS6 macro: keep in sync with tcp6_l2_buf_t */ #define OPT_TS 8 #define TAPFSIDE(conn) (&(conn)->f.side[TAPSIDE]) +#define SOCKFSIDE(conn) (&(conn)->f.side[SOCKSIDE]) #define CONN_V4(conn) (!!inany_v4(&TAPFSIDE(conn)->faddr)) #define CONN_V6(conn) (!CONN_V4(conn)) @@ -2014,6 +2015,14 @@ static void tcp_conn_from_tap(struct ctx *c, conn_event(c, conn, TAP_SYN_ACK_SENT); } + if (flowside_from_sock(SOCKFSIDE(conn), PIF_HOST, s, NULL, sa) < 0) { + err("tcp: Failed to get local name for outgoing connection"); + tcp_rst(c, conn); + return; + } + + ASSERT(flowside_complete(SOCKFSIDE(conn))); + tcp_epoll_ctl(c, conn); return; @@ -2653,8 +2662,10 @@ static void tcp_snat_inbound(const struct ctx *c, union inany_addr *addr) * @s: Accepted socket * @sa: Peer socket address (from accept()) * @now: Current timestamp + * + * Return: true if able to create a tap connection, false otherwise */ -static void tcp_tap_conn_from_sock(struct ctx *c, +static bool tcp_tap_conn_from_sock(struct ctx *c, union tcp_listen_epoll_ref ref, struct tcp_tap_conn *conn, int s, const struct sockaddr *sa, @@ -2666,8 +2677,16 @@ static void tcp_tap_conn_from_sock(struct ctx *c, conn->ws_to_tap = conn->ws_from_tap = 0; conn_event(c, conn, SOCK_ACCEPTED); - TAPFSIDE(conn)->pif = PIF_HOST; - inany_from_sockaddr(&TAPFSIDE(conn)->faddr, &TAPFSIDE(conn)->fport, sa); + if (flowside_from_sock(SOCKFSIDE(conn), PIF_HOST, s, NULL, sa) < 0) { + err("tcp: Failed to get local name, connection dropped"); + return false; + } + + ASSERT(flowside_complete(SOCKFSIDE(conn))); + + TAPFSIDE(conn)->pif = PIF_TAP; + TAPFSIDE(conn)->faddr = SOCKFSIDE(conn)->eaddr; + TAPFSIDE(conn)->fport = SOCKFSIDE(conn)->eport; tcp_snat_inbound(c, &TAPFSIDE(conn)->faddr); if (CONN_V4(conn)) { @@ -2693,6 +2712,8 @@ static void tcp_tap_conn_from_sock(struct ctx *c, conn_flag(c, conn, ACK_FROM_TAP_DUE); tcp_get_sndbuf(conn); + + return true; } /** @@ -2721,11 +2742,14 @@ void tcp_listen_handler(struct ctx *c, union epoll_ref ref, s, (struct sockaddr *)&sa)) return; - tcp_tap_conn_from_sock(c, ref.tcp_listen, &flow->tcp, s, - (struct sockaddr *)&sa, now); - return; + if (tcp_tap_conn_from_sock(c, ref.tcp_listen, &flow->tcp, s, + (struct sockaddr *)&sa, now)) + return; cancel: + /* Failed to create the connection */ + if (s >= 0) + close(s); flow_alloc_cancel(flow); } diff --git a/util.h b/util.h index d2320f8..13d7353 100644 --- a/util.h +++ b/util.h @@ -298,4 +298,22 @@ static inline int wrap_accept4(int sockfd, struct sockaddr *addr, #define accept4(s, addr, addrlen, flags) \ wrap_accept4((s), (addr), (addrlen), (flags)) +static inline int wrap_getsockname(int sockfd, struct sockaddr *addr, + socklen_t *addrlen) +{ + sa_init(addr, addrlen); + return getsockname(sockfd, addr, addrlen); +} +#define getsockname(s, addr, addrlen) \ + wrap_getsockname((s), (addr), (addrlen)) + +static inline int wrap_getpeername(int sockfd, struct sockaddr *addr, + socklen_t *addrlen) +{ + sa_init(addr, addrlen); + return getpeername(sockfd, addr, addrlen); +} +#define getpeername(s, addr, addrlen) \ + wrap_getpeername((s), (addr), (addrlen)) + #endif /* UTIL_H */ -- 2.43.0