From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 2D5545A005B for ; Fri, 14 Jun 2024 08:14:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1718345632; bh=Dna+aXyxADq/svpZCdzFqtYu9R8/UgL6a5hlzYTePkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bi6WjjQkgZ1TWHcm8wt0Plod7Om4n5K6dOabAsOLf7drFaqgHpwD/dWTR48br6a4U QRLhopEmNTZw8p20ZJtyN6adSnU8EoZCgJkI8ArUNe9wauVjtQ206abQyc/R3w6D7h H2C+1YXagUNzKZhrxoQ1C3GNPzD0vOJAnFrzTd0YeVMnHGL15kDWcfsTj4VQRcO13a AMoZ6xWLogJiTSo8OkVCOAfOL+D4CjaPE90nXgpE2avtJ9mksfhv2T0oYMIPfN9pOi /7g8Ls/PdgZSffAolAkhbMySv+0wB6REBkxJpI72aD8NXlagCe1STtOhMuB2lfhq1N ggYt81VjiPMFg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4W0prJ36wDz4x10; Fri, 14 Jun 2024 16:13:52 +1000 (AEST) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH v6 19/26] udp: Create flow table entries for UDP Date: Fri, 14 Jun 2024 16:13:41 +1000 Message-ID: <20240614061348.3814736-20-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240614061348.3814736-1-david@gibson.dropbear.id.au> References: <20240614061348.3814736-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: H6GRVWFK3HR2265W5FRKLNKGRHN7E74I X-Message-ID-Hash: H6GRVWFK3HR2265W5FRKLNKGRHN7E74I X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: jmaloy@redhat.com, David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Currently UDP only has a very rudimentary (and buggy) form of connection tracking implemented with per-port flags. Make a start on converting this to more robust tracking via the flow table. Start matching UDP packets to flow table entries, creating them when necessary. We also add a timer so that the flows will expire. For now don't actually use the information in the flow table, that will come later. Signed-off-by: David Gibson --- Makefile | 2 +- flow.c | 31 +++++++ flow.h | 4 + flow_table.h | 2 + udp.c | 228 ++++++++++++++++++++++++++++++++++++++++++++++++--- udp_flow.h | 25 ++++++ 6 files changed, 278 insertions(+), 14 deletions(-) create mode 100644 udp_flow.h diff --git a/Makefile b/Makefile index 09fc461d..92cbd5a6 100644 --- a/Makefile +++ b/Makefile @@ -57,7 +57,7 @@ PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h flow.h fwd.h \ flow_table.h icmp.h icmp_flow.h inany.h iov.h ip.h isolation.h \ lineread.h log.h ndp.h netlink.h packet.h passt.h pasta.h pcap.h pif.h \ siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h tcp_internal.h tcp_splice.h \ - udp.h util.h + udp.h udp_flow.h util.h HEADERS = $(PASST_HEADERS) seccomp.h C := \#include \nstruct tcp_info x = { .tcpi_snd_wnd = 0 }; diff --git a/flow.c b/flow.c index cf799082..c3d54f6e 100644 --- a/flow.c +++ b/flow.c @@ -35,6 +35,7 @@ const char *flow_type_str[] = { [FLOW_TCP_SPLICE] = "TCP connection (spliced)", [FLOW_PING4] = "ICMP ping sequence", [FLOW_PING6] = "ICMPv6 ping sequence", + [FLOW_UDP] = "UDP flow", }; static_assert(ARRAY_SIZE(flow_type_str) == FLOW_NUM_TYPES, "flow_type_str[] doesn't match enum flow_type"); @@ -44,6 +45,7 @@ const uint8_t flow_proto[] = { [FLOW_TCP_SPLICE] = IPPROTO_TCP, [FLOW_PING4] = IPPROTO_ICMP, [FLOW_PING6] = IPPROTO_ICMPV6, + [FLOW_UDP] = IPPROTO_UDP, }; static_assert(ARRAY_SIZE(flow_proto) == FLOW_NUM_TYPES, "flow_proto[] doesn't match enum flow_type"); @@ -641,6 +643,31 @@ flow_sidx_t flow_lookup_af(const struct ctx *c, return flowside_lookup(c, proto, pif, &fside); } +/** + * flow_lookup_sa() - Look up a flow given and endpoint socket address + * @c: Execution context + * @proto: Protocol of the flow (IP L4 protocol number) + * @pif: Interface of the flow + * @esa: Socket address of the endpoint + * @fport: Forwarding port number + * + * Return: sidx of the matching flow & side, FLOW_SIDX_NONE if not found + */ +flow_sidx_t flow_lookup_sa(const struct ctx *c, uint8_t proto, uint8_t pif, + const void *esa, in_port_t fport) +{ + struct flowside fside = { + .fport = fport, + }; + + inany_from_sockaddr(&fside.eaddr, &fside.eport, esa); + if (inany_v4(&fside.eaddr)) + fside.faddr = inany_any4; + else + fside.faddr = inany_any6; + return flowside_lookup(c, proto, pif, &fside); +} + /** * flow_defer_handler() - Handler for per-flow deferred and timed tasks * @c: Execution context @@ -720,6 +747,10 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) if (timer) closed = icmp_ping_timer(c, &flow->ping, now); break; + case FLOW_UDP: + if (timer) + closed = udp_flow_timer(c, &flow->udp, now); + break; default: /* Assume other flow types don't need any handling */ ; diff --git a/flow.h b/flow.h index 948f2ea9..b5ca2792 100644 --- a/flow.h +++ b/flow.h @@ -115,6 +115,8 @@ enum flow_type { FLOW_PING4, /* ICMPv6 echo requests from guest to host and matching replies back */ FLOW_PING6, + /* UDP packets with the matching unicast endpoints */ + FLOW_UDP, FLOW_NUM_TYPES, }; @@ -227,6 +229,8 @@ flow_sidx_t flow_lookup_af(const struct ctx *c, uint8_t proto, uint8_t pif, sa_family_t af, const void *eaddr, const void *faddr, in_port_t eport, in_port_t fport); +flow_sidx_t flow_lookup_sa(const struct ctx *c, uint8_t proto, uint8_t pif, + const void *esa, in_port_t fport); union flow; diff --git a/flow_table.h b/flow_table.h index 07c59041..6cf4f2b7 100644 --- a/flow_table.h +++ b/flow_table.h @@ -9,6 +9,7 @@ #include "tcp_conn.h" #include "icmp_flow.h" +#include "udp_flow.h" /** * struct flow_free_cluster - Information about a cluster of free entries @@ -35,6 +36,7 @@ union flow { struct tcp_tap_conn tcp; struct tcp_splice_conn tcp_splice; struct icmp_ping_flow ping; + struct udp_flow udp; }; /* Global Flow Table */ diff --git a/udp.c b/udp.c index e79ca938..cb6db5c5 100644 --- a/udp.c +++ b/udp.c @@ -15,10 +15,49 @@ /** * DOC: Theory of Operation * + * Flow Table + * ========== * - * For UDP, a reduced version of port-based connection tracking is implemented - * with two purposes: - * - binding ephemeral ports when they're used as source port by the guest, so + * UDP does not have connections, but to reliably forward reply packets back to + * the original requested, we must keep track of pseudo-connections. We do this + * via the generic flow table. + * + * - Finding an existing flow + * + * When we receive a datagram we attempt to match it to an existing flow: one + * with matching interface, addresses and ports (both forwarding and + * endpoint). For socket interfaces, we treat the forwarding address as the + * bound address of the receiving socket, which may be unspecified, rather + * than the datagram's actual destination address (which is awkward to + * determine for unbound sockets). + * + * - Creating a new flow + * + * If no matching flow exists, and the datagram comes either from the tap + * interface, or from a socket with the 'orig' flag set we create a new one. + * The initiating side records the interface, endpoint and forwarding + * addresses and ports of this first datagram. Again, we treat the forwarding + * address for sockets as the socket's bound address, regardless of the + * datagram's actual destination. + * + * The target side interface and addresses are assigned by the general code in + * fwd.c. When the target is a socket interface, the target forwarding + * address may be left unspecified - in this case, the kernel will determine + * the source address when we send the datagram. + * + * - Flow expiry + * + * Every time a datagram is received that matches a flow (or creates a new + * one), we update the flow's timestamp to the current time. Periodically we + * scan flows and those which are older than UDP_CONN_TIMEOUT (180s) are + * removed. + * + * Port Tracking + * ============= + * + * For datagrams not handled by the flow table, a reduced version of port-based + * connection tracking is implemented with two purposes: + * - binding ephemeral ports when they're used as source port by the guest, so * that replies on those ports can be forwarded back to the guest, with a * fixed timeout for this binding * - packets received from the local host get their source changed to a local @@ -121,6 +160,7 @@ #include "tap.h" #include "pcap.h" #include "log.h" +#include "flow_table.h" #define UDP_CONN_TIMEOUT 180 /* s, timeout for ephemeral or local bind */ #define UDP_MAX_FRAMES 32 /* max # of frames to receive at once */ @@ -199,6 +239,7 @@ static struct ethhdr udp6_eth_hdr; * @taph: Tap backend specific header * @s_in: Source socket address, filled in by recvmmsg() * @splicesrc: Source port for splicing, or -1 if not spliceable + * @tosidx: sidx for the destination side of this datagram's flow */ static struct udp_meta_t { struct ipv6hdr ip6h; @@ -207,6 +248,7 @@ static struct udp_meta_t { union sockaddr_inany s_in; int splicesrc; + flow_sidx_t tosidx; } #ifdef __AVX2__ __attribute__ ((aligned(32))) @@ -253,6 +295,17 @@ static struct sockaddr_in6 udp6_localname = { static struct mmsghdr udp4_mh_splice [UDP_MAX_FRAMES]; static struct mmsghdr udp6_mh_splice [UDP_MAX_FRAMES]; +struct udp_flow *udp_at_sidx(flow_sidx_t sidx) +{ + union flow *flow = flow_at_sidx(sidx); + + if (!flow) + return NULL; + + ASSERT(flow->f.type == FLOW_UDP); + return &flow->udp; +} + /** * udp_portmap_clear() - Clear UDP port map before configuration */ @@ -492,6 +545,67 @@ static int udp_mmh_splice_port(union udp_epoll_ref uref, return -1; } +/** + * udp_flow_from_sock() - Find or create UDP flow for datagrams from socket + * @c: Execution context + * @uref: UDP epoll reference of the originating socket + * @meta: Metadata buffer for the datagram + * + * Return: sidx for the destination side of the flow for this packet, or + * FLOW_SIDX_NONE if we couldn't find or create a flow. + */ +flow_sidx_t udp_flow_from_sock(const struct ctx *c, union udp_epoll_ref uref, + struct udp_meta_t *meta) +{ + char sstr[INANY_ADDRSTRLEN]; + const struct flowside *ini; + struct udp_flow *uflow; + union flow *flow; + flow_sidx_t sidx; + + sidx = flow_lookup_sa(c, IPPROTO_UDP, uref.pif, &meta->s_in, uref.port); + if ((flow = flow_at_sidx(sidx))) + return FLOW_SIDX(flow, !sidx.side); + + if (!uref.orig) + return FLOW_SIDX_NONE; + + if (!(flow = flow_alloc())) { + char sastr[SOCKADDR_STRLEN]; + + debug("Couldn't allocate flow for UDP datagram from %s %s", + pif_name(uref.pif), + sockaddr_ntop(&meta->s_in, sastr, sizeof(sastr))); + return FLOW_SIDX_NONE; + } + + ini = flow_initiate_sa(flow, uref.pif, &meta->s_in, uref.port); + + if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0) { + flow_dbg(flow, "Invalid endpoint on UDP recv()"); + /* Invalid endpoint */ + goto cancel; + } + + if (!flow_target(c, flow, IPPROTO_UDP)) + goto cancel; + + uflow = FLOW_SET_TYPE(flow, FLOW_UDP, udp); + flow_hash_insert(c, FLOW_SIDX(uflow, INISIDE)); + flow_hash_insert(c, FLOW_SIDX(uflow, TGTSIDE)); + FLOW_ACTIVATE(uflow); + + return FLOW_SIDX(uflow, TGTSIDE); + +cancel: + flow_dbg(flow, "Couldn't create UDP flow for %s [%s]:%hu -> ?:%hu", + pif_name(uref.pif), + inany_ntop(&ini->eaddr, sstr, sizeof(sstr)), + ini->eport, ini->fport); + flow_alloc_cancel(flow); + return FLOW_SIDX_NONE; +} + /** * udp_splice_send() - Send datagrams from socket to socket * @c: Execution context @@ -536,6 +650,7 @@ static unsigned udp_splice_send(const struct ctx *c, size_t start, size_t n, break; udp_meta[i].splicesrc = udp_mmh_splice_port(uref, &mmh_recv[i]); + udp_meta[i].tosidx = udp_flow_from_sock(c, uref, &udp_meta[i]); } while (udp_meta[i].splicesrc == src); if (uref.pif == PIF_SPLICE) { @@ -758,6 +873,7 @@ static unsigned udp_tap_send(const struct ctx *c, size_t start, size_t n, break; udp_meta[i].splicesrc = udp_mmh_splice_port(uref, &mmh_recv[i]); + udp_meta[i].tosidx = udp_flow_from_sock(c, uref, &udp_meta[i]); } while (udp_meta[i].splicesrc == -1); tap_send_frames(c, &tap_iov[start][0], UDP_NUM_IOVS, i - start); @@ -786,8 +902,8 @@ void udp_buf_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t eve */ ssize_t n = (c->mode == MODE_PASTA ? 1 : UDP_MAX_FRAMES); in_port_t dstport = ref.udp.port; - bool v6 = ref.udp.v6; struct mmsghdr *mmh_recv; + bool v6 = ref.udp.v6; int i, m; if (c->no_udp || !(events & EPOLLIN)) @@ -797,6 +913,8 @@ void udp_buf_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t eve dstport += c->udp.fwd_out.f.delta[dstport]; else if (ref.udp.pif == PIF_HOST) dstport += c->udp.fwd_in.f.delta[dstport]; + else + ASSERT(0); if (v6) mmh_recv = udp6_l2_mh_sock; @@ -809,12 +927,13 @@ void udp_buf_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t eve /* We divide things into batches based on how we need to send them, * determined by udp_meta[i].splicesrc. To avoid either two passes - * through the array, or recalculating splicesrc for a single entry, we - * have to populate it one entry *ahead* of the loop counter (if - * present). So we fill in entry 0 before the loop, then udp_*_send() - * populate one entry past where they consume. + * through the array, or recalculating splicesrc and tosidx for a single + * entry, we have to populate them one entry *ahead* of the loop counter + * (if present). So we fill in entry 0 before the loop, then + * udp_*_send() populate one entry past where they consume. */ udp_meta[0].splicesrc = udp_mmh_splice_port(ref.udp, mmh_recv); + udp_meta[0].tosidx = udp_flow_from_sock(c, ref.udp, &udp_meta[0]); for (i = 0; i < n; i += m) { if (udp_meta[i].splicesrc >= 0) m = udp_splice_send(c, i, n, dstport, ref.udp, now); @@ -823,6 +942,74 @@ void udp_buf_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t eve } } +/** + * udp_flow_from_tap() - Find or create UDP flow for tap packets + * @c: Execution context + * @pif: pif on which the packet is arriving + * @af: Address family, AF_INET or AF_INET6 + * @saddr: Source address on guest side + * @daddr: Destination address guest side + * @srcport: Source port on guest side + * @dstport: Destination port on guest side + * + * Return: sidx for the destination side of the flow for this packet, or + * FLOW_SIDX_NONE if we couldn't find or create a flow. + */ +flow_sidx_t udp_flow_from_tap(const struct ctx *c, + uint8_t pif, sa_family_t af, + const void *saddr, const void *daddr, + in_port_t srcport, in_port_t dstport) +{ + const struct flowside *ini; + struct udp_flow *uflow; + union flow *flow; + flow_sidx_t sidx; + + ASSERT(pif == PIF_TAP); + + sidx = flow_lookup_af(c, IPPROTO_UDP, pif, af, saddr, daddr, + srcport, dstport); + if ((flow = flow_at_sidx(sidx))) + return FLOW_SIDX(flow, !sidx.side); + + if (!(flow = flow_alloc())) + return FLOW_SIDX_NONE; + + ini = flow_initiate_af(flow, PIF_TAP, af, + saddr, srcport, daddr, dstport); + + if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0 || + !inany_is_unicast(&ini->faddr) || ini->fport == 0) { + char sstr[INANY_ADDRSTRLEN], dstr[INANY_ADDRSTRLEN]; + + debug("Invalid UDP endpoint from %s: %s:%hu -> %s:%hu", + pif_name(pif), + inany_ntop(&ini->eaddr, sstr, sizeof(sstr)), ini->eport, + inany_ntop(&ini->faddr, dstr, sizeof(dstr)), ini->fport); + goto cancel; + } + + if (!flow_target(c, flow, IPPROTO_UDP)) + goto cancel; + + if (flow->f.pif[TGTSIDE] != PIF_HOST) { + flow_err(flow, "No support for forwarding UDP from %s to %s", + pif_name(flow->f.pif[INISIDE]), + pif_name(flow->f.pif[TGTSIDE])); + goto cancel; + } + + uflow = FLOW_SET_TYPE(flow, FLOW_UDP, udp); + flow_hash_insert(c, FLOW_SIDX(uflow, INISIDE)); + flow_hash_insert(c, FLOW_SIDX(uflow, TGTSIDE)); + FLOW_ACTIVATE(uflow); + return FLOW_SIDX(uflow, TGTSIDE); + +cancel: + flow_alloc_cancel(flow); + return FLOW_SIDX_NONE; +} + /** * udp_tap_handler() - Handle packets from tap * @c: Execution context @@ -847,15 +1034,13 @@ int udp_tap_handler(struct ctx *c, uint8_t pif, struct sockaddr_in6 s_in6; struct sockaddr_in s_in; const struct udphdr *uh; + struct udp_flow *uflow; struct sockaddr *sa; int i, s, count = 0; in_port_t src, dst; + flow_sidx_t sidx; socklen_t sl; - (void)c; - (void)saddr; - (void)pif; - uh = packet_get(p, idx, 0, sizeof(*uh), NULL); if (!uh) return 1; @@ -864,8 +1049,14 @@ int udp_tap_handler(struct ctx *c, uint8_t pif, * and destination, so we can just take those from the first message. */ src = ntohs(uh->source); - src += c->udp.fwd_in.rdelta[src]; dst = ntohs(uh->dest); + sidx = udp_flow_from_tap(c, pif, af, saddr, daddr, src, dst); + if ((uflow = udp_at_sidx(sidx))) + uflow->ts = now->tv_sec; + else + debug("UDP from tap without flow"); + + src += c->udp.fwd_in.rdelta[src]; if (af == AF_INET) { s_in = (struct sockaddr_in) { @@ -1211,6 +1402,17 @@ static int udp_port_rebind_outbound(void *arg) return 0; } +bool udp_flow_timer(const struct ctx *c, const struct udp_flow *uflow, + const struct timespec *now) +{ + if (now->tv_sec - uflow->ts <= UDP_CONN_TIMEOUT) + return false; + + flow_hash_remove(c, FLOW_SIDX(uflow, INISIDE)); + flow_hash_remove(c, FLOW_SIDX(uflow, TGTSIDE)); + return true; +} + /** * udp_timer() - Scan activity bitmaps for ports with associated timed events * @c: Execution context diff --git a/udp_flow.h b/udp_flow.h new file mode 100644 index 00000000..18af9ac4 --- /dev/null +++ b/udp_flow.h @@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later + * Copyright Red Hat + * Author: David Gibson + * + * UDP flow tracking data structures + */ +#ifndef UDP_FLOW_H +#define UDP_FLOW_H + +/** + * struct udp - Descriptor for a flow of UDP packets + * @f: Generic flow information + * @ts: Activity timestamp + */ +struct udp_flow { + /* Must be first element */ + struct flow_common f; + + time_t ts; +}; + +bool udp_flow_timer(const struct ctx *c, const struct udp_flow *uflow, + const struct timespec *now); + +#endif /* UDP_FLOW_H */ -- 2.45.2