passt: New design and implementation with native Layer 4 sockets
This is a reimplementation, partially building on the earlier draft,
that uses L4 sockets (SOCK_DGRAM, SOCK_STREAM) instead of SOCK_RAW,
providing L4-L2 translation functionality without requiring any
security capability.
Conceptually, this follows the design presented at:
https://gitlab.com/abologna/kubevirt-and-kvm/-/blob/master/Networking.md
The most significant novelty here comes from TCP and UDP translation
layers. In particular, the TCP state and translation logic follows
the intent of being minimalistic, without reimplementing a full TCP
stack in either direction, and synchronising as much as possible the
TCP dynamic and flows between guest and host kernel.
Another important introduction concerns addressing, port translation
and forwarding. The Layer 4 implementations now attempt to bind on
all unbound ports, in order to forward connections in a transparent
way.
While at it:
- the qemu 'tap' back-end can't be used as-is by qrap anymore,
because of explicit checks now introduced in qemu to ensure that
the corresponding file descriptor is actually a tap device. For
this reason, qrap now operates on a 'socket' back-end type,
accounting for and building the additional header reporting
frame length
- provide a demo script that sets up namespaces, addresses and
routes, and starts the daemon. A virtual machine started in the
network namespace, wrapped by qrap, will now directly interface
with passt and communicate using Layer 4 sockets provided by the
host kernel.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2021-02-16 06:25:09 +00:00
|
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
|
2020-07-20 14:41:49 +00:00
|
|
|
/* PASST - Plug A Simple Socket Transport
|
2020-07-17 23:02:39 +00:00
|
|
|
*
|
2021-08-19 17:48:59 +00:00
|
|
|
* qrap.c - qemu wrapper connecting UNIX domain socket to file descriptor
|
2020-07-17 23:02:39 +00:00
|
|
|
*
|
passt: New design and implementation with native Layer 4 sockets
This is a reimplementation, partially building on the earlier draft,
that uses L4 sockets (SOCK_DGRAM, SOCK_STREAM) instead of SOCK_RAW,
providing L4-L2 translation functionality without requiring any
security capability.
Conceptually, this follows the design presented at:
https://gitlab.com/abologna/kubevirt-and-kvm/-/blob/master/Networking.md
The most significant novelty here comes from TCP and UDP translation
layers. In particular, the TCP state and translation logic follows
the intent of being minimalistic, without reimplementing a full TCP
stack in either direction, and synchronising as much as possible the
TCP dynamic and flows between guest and host kernel.
Another important introduction concerns addressing, port translation
and forwarding. The Layer 4 implementations now attempt to bind on
all unbound ports, in order to forward connections in a transparent
way.
While at it:
- the qemu 'tap' back-end can't be used as-is by qrap anymore,
because of explicit checks now introduced in qemu to ensure that
the corresponding file descriptor is actually a tap device. For
this reason, qrap now operates on a 'socket' back-end type,
accounting for and building the additional header reporting
frame length
- provide a demo script that sets up namespaces, addresses and
routes, and starts the daemon. A virtual machine started in the
network namespace, wrapped by qrap, will now directly interface
with passt and communicate using Layer 4 sockets provided by the
host kernel.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2021-02-16 06:25:09 +00:00
|
|
|
* Copyright (c) 2020-2021 Red Hat GmbH
|
2020-07-17 23:02:39 +00:00
|
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
*
|
|
|
|
* TODO: Implement this functionality directly in qemu: we have TCP and UDP
|
|
|
|
* socket back-ends already.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <stdio.h>
|
2020-07-20 14:41:49 +00:00
|
|
|
#include <stdint.h>
|
2020-07-17 23:02:39 +00:00
|
|
|
#include <stdlib.h>
|
2021-05-21 09:14:52 +00:00
|
|
|
#include <string.h>
|
2020-07-17 23:02:39 +00:00
|
|
|
#include <unistd.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <errno.h>
|
2021-05-10 10:38:50 +00:00
|
|
|
#include <linux/limits.h>
|
|
|
|
#include <limits.h>
|
2021-05-21 09:14:52 +00:00
|
|
|
#include <fcntl.h>
|
|
|
|
#include <net/if_arp.h>
|
2021-08-12 13:42:43 +00:00
|
|
|
#include <netinet/in.h>
|
2021-10-21 02:26:08 +00:00
|
|
|
#include <netinet/if_ether.h>
|
2022-06-16 13:00:06 +00:00
|
|
|
#include <time.h>
|
2021-10-21 02:26:08 +00:00
|
|
|
|
2021-05-21 09:14:52 +00:00
|
|
|
#include "util.h"
|
2021-07-17 06:28:38 +00:00
|
|
|
#include "passt.h"
|
2021-05-21 09:14:52 +00:00
|
|
|
#include "arp.h"
|
2021-05-12 06:35:36 +00:00
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
static char *qemu_names[] = {
|
|
|
|
"kvm",
|
|
|
|
"qemu-kvm",
|
|
|
|
#ifdef ARCH
|
2021-10-21 10:09:25 +00:00
|
|
|
( "qemu-system-" ARCH ),
|
2021-05-10 10:38:50 +00:00
|
|
|
#endif
|
2021-05-10 12:00:30 +00:00
|
|
|
"/usr/libexec/qemu-kvm",
|
2021-05-10 10:38:50 +00:00
|
|
|
NULL,
|
|
|
|
};
|
|
|
|
|
2021-07-17 06:28:38 +00:00
|
|
|
/**
|
|
|
|
* struct drop_arg - Drop matching arguments on command line
|
|
|
|
* @name: Option name
|
|
|
|
* @val: Substring in option value, NULL matches any value
|
|
|
|
*/
|
2021-05-12 06:35:36 +00:00
|
|
|
static const struct drop_arg {
|
|
|
|
char *name;
|
|
|
|
char *val;
|
|
|
|
} drop_args[] = {
|
|
|
|
{ "-netdev", NULL },
|
|
|
|
{ "-net", NULL },
|
|
|
|
{ "-device", "virtio-net-pci," },
|
|
|
|
{ "-device", "virtio-net-ccw," },
|
|
|
|
{ "-device", "e1000," },
|
2021-05-21 09:14:48 +00:00
|
|
|
{ "-device", "e1000e," },
|
2021-05-12 06:35:36 +00:00
|
|
|
{ "-device", "rtl8139," },
|
|
|
|
{ 0 },
|
|
|
|
};
|
|
|
|
|
2021-07-17 06:28:38 +00:00
|
|
|
/**
|
|
|
|
* struct pci_dev - PCI devices to add on command line depending on machine name
|
|
|
|
* @mach: Machine name
|
|
|
|
* @name: Device ("-device") name to insert
|
|
|
|
* @template: Prefix for device specification (first part of address)
|
|
|
|
* @template_post: Suffix for device specification (last part of address)
|
|
|
|
* @first: First usable PCI address
|
|
|
|
* @last: Last usable PCI address
|
|
|
|
*/
|
2021-05-12 06:35:36 +00:00
|
|
|
static const struct pci_dev {
|
|
|
|
char *mach;
|
|
|
|
char *name;
|
|
|
|
char *template;
|
|
|
|
char *template_post;
|
|
|
|
int first;
|
|
|
|
int last;
|
|
|
|
} pci_devs[] = {
|
|
|
|
{ "pc-q35", "virtio-net-pci",
|
2021-07-17 06:28:38 +00:00
|
|
|
"bus=pci.", ",addr=0x0", 3, /* 2: hotplug bus */ 16 },
|
2021-05-12 06:35:36 +00:00
|
|
|
{ "pc-", "virtio-net-pci",
|
|
|
|
"bus=pci.0,addr=0x", "", 2, /* 1: ISA bridge */ 16 },
|
|
|
|
{ "s390-ccw", "virtio-net-ccw",
|
|
|
|
"devno=fe.0.", "", 1, 16 },
|
|
|
|
{ 0 },
|
|
|
|
};
|
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
#define DEFAULT_FD 5
|
|
|
|
|
2020-07-17 23:02:39 +00:00
|
|
|
/**
|
|
|
|
* usage() - Print usage and exit
|
|
|
|
* @name: Executable name
|
|
|
|
*/
|
|
|
|
void usage(const char *name)
|
|
|
|
{
|
2021-08-19 17:48:59 +00:00
|
|
|
fprintf(stderr, "Usage: %s [FDNUM QEMU_CMD] [QEMU_ARG]...\n", name);
|
2021-05-10 10:38:50 +00:00
|
|
|
fprintf(stderr, "\n");
|
|
|
|
fprintf(stderr, "If first and second arguments aren't a socket number\n"
|
|
|
|
"and a path, %s will try to locate a qemu binary\n"
|
|
|
|
"and directly patch the command line\n", name);
|
2020-07-17 23:02:39 +00:00
|
|
|
|
|
|
|
exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* main() - Entry point and main loop
|
|
|
|
* @argc: Argument count
|
|
|
|
* @argv: File descriptor number, then qemu with arguments
|
|
|
|
*
|
|
|
|
* Return: 0 once interrupted, non-zero on failure
|
|
|
|
*/
|
|
|
|
int main(int argc, char **argv)
|
|
|
|
{
|
2022-01-30 01:59:12 +00:00
|
|
|
struct timeval tv = { .tv_sec = 0, .tv_usec = (long)(500 * 1000) };
|
2022-06-16 13:00:06 +00:00
|
|
|
int i, s, qemu_argc = 0, addr_map = 0, has_dev = 0, retry_on_reset;
|
2021-07-17 06:28:38 +00:00
|
|
|
char *qemu_argv[ARG_MAX], dev_str[ARG_MAX];
|
2020-07-17 23:02:39 +00:00
|
|
|
struct sockaddr_un addr = {
|
|
|
|
.sun_family = AF_UNIX,
|
|
|
|
};
|
2021-05-12 06:35:36 +00:00
|
|
|
const struct pci_dev *dev = NULL;
|
2020-07-17 23:02:39 +00:00
|
|
|
long fd;
|
2021-05-21 09:14:52 +00:00
|
|
|
struct {
|
|
|
|
uint32_t vnet_len;
|
|
|
|
struct ethhdr eh;
|
|
|
|
struct arphdr ah;
|
|
|
|
struct arpmsg am;
|
|
|
|
} probe = {
|
2021-10-21 07:41:13 +00:00
|
|
|
.vnet_len = htonl(42),
|
2021-05-21 09:14:52 +00:00
|
|
|
{
|
|
|
|
.h_dest = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
|
|
|
|
.h_source = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
|
|
|
|
.h_proto = htons(ETH_P_ARP),
|
|
|
|
},
|
|
|
|
{ .ar_hrd = htons(ARPHRD_ETHER),
|
|
|
|
.ar_pro = htons(ETH_P_IP),
|
|
|
|
.ar_hln = ETH_ALEN,
|
|
|
|
.ar_pln = 4,
|
|
|
|
.ar_op = htons(ARPOP_REQUEST),
|
|
|
|
},
|
|
|
|
{
|
|
|
|
.sha = { 0 }, .sip = { 0 }, .tha = { 0 }, .tip = { 0 },
|
|
|
|
},
|
|
|
|
};
|
|
|
|
char probe_r;
|
2020-07-17 23:02:39 +00:00
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
if (argc >= 3) {
|
2021-07-17 06:28:38 +00:00
|
|
|
errno = 0;
|
2021-05-10 10:38:50 +00:00
|
|
|
fd = strtol(argv[1], NULL, 0);
|
|
|
|
if (fd >= 3 && fd < INT_MAX && !errno) {
|
2021-05-21 09:14:49 +00:00
|
|
|
char env_path[ARG_MAX + 1], *p, command[ARG_MAX];
|
2021-05-10 10:38:50 +00:00
|
|
|
|
|
|
|
strncpy(env_path, getenv("PATH"), ARG_MAX);
|
|
|
|
p = strtok(env_path, ":");
|
|
|
|
while (p) {
|
|
|
|
snprintf(command, ARG_MAX, "%s/%s", p, argv[2]);
|
|
|
|
if (!access(command, X_OK))
|
|
|
|
goto valid_args;
|
|
|
|
|
|
|
|
p = strtok(NULL, ":");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
fd = DEFAULT_FD;
|
2021-05-12 06:35:36 +00:00
|
|
|
|
|
|
|
for (i = 1; i < argc - 1; i++) {
|
|
|
|
if (strcmp(argv[i], "-machine"))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
for (dev = pci_devs; dev->mach; dev++) {
|
|
|
|
if (strstr(argv[i + 1], dev->mach) == argv[i + 1])
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!dev || !dev->mach)
|
|
|
|
dev = pci_devs;
|
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
for (qemu_argc = 1, i = 1; i < argc; i++) {
|
2021-05-12 06:35:36 +00:00
|
|
|
const struct drop_arg *a;
|
|
|
|
|
|
|
|
for (a = drop_args; a->name; a++) {
|
|
|
|
if (!strcmp(argv[i], a->name)) {
|
|
|
|
if (!a->val)
|
|
|
|
break;
|
|
|
|
|
|
|
|
if (i + 1 < argc &&
|
|
|
|
strstr(argv[i + 1], a->val) == argv[i + 1])
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (a->name) {
|
|
|
|
i++;
|
|
|
|
continue;
|
2021-05-10 10:38:50 +00:00
|
|
|
}
|
2020-07-17 23:02:39 +00:00
|
|
|
|
2021-05-12 06:35:36 +00:00
|
|
|
if (!strcmp(argv[i], "-device") && i + 1 < argc) {
|
|
|
|
char *p;
|
|
|
|
|
|
|
|
has_dev = 1;
|
|
|
|
|
|
|
|
if ((p = strstr(argv[i + 1], dev->template))) {
|
2021-10-21 07:41:13 +00:00
|
|
|
long n;
|
|
|
|
|
2021-05-12 06:35:36 +00:00
|
|
|
n = strtol(p + strlen(dev->template), NULL, 16);
|
|
|
|
if (!errno)
|
|
|
|
addr_map |= (1 << n);
|
|
|
|
}
|
|
|
|
}
|
2020-07-17 23:02:39 +00:00
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
qemu_argv[qemu_argc++] = argv[i];
|
|
|
|
}
|
|
|
|
|
2021-05-12 06:35:36 +00:00
|
|
|
for (i = dev->first; i < dev->last; i++) {
|
|
|
|
if (!(addr_map & (1 << i)))
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (i == dev->last) {
|
|
|
|
fprintf(stderr, "Couldn't find free address for device\n");
|
|
|
|
usage(argv[0]);
|
|
|
|
}
|
2021-05-10 10:38:50 +00:00
|
|
|
|
2021-05-12 06:35:36 +00:00
|
|
|
if (has_dev) {
|
|
|
|
qemu_argv[qemu_argc++] = "-device";
|
2021-09-09 13:32:24 +00:00
|
|
|
snprintf(dev_str, ARG_MAX, "%s,%s%x%s,netdev=hostnet0,x-txburst=4096",
|
2021-05-12 06:35:36 +00:00
|
|
|
dev->name, dev->template, i, dev->template_post);
|
|
|
|
qemu_argv[qemu_argc++] = dev_str;
|
2021-05-11 15:08:15 +00:00
|
|
|
}
|
2021-05-10 10:38:50 +00:00
|
|
|
|
2021-05-12 06:35:36 +00:00
|
|
|
qemu_argv[qemu_argc++] = "-netdev";
|
|
|
|
qemu_argv[qemu_argc++] = "socket,fd=" STR(DEFAULT_FD) ",id=hostnet0";
|
|
|
|
qemu_argv[qemu_argc] = NULL;
|
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
valid_args:
|
2021-05-21 09:14:52 +00:00
|
|
|
for (i = 1; i < UNIX_SOCK_MAX; i++) {
|
2022-06-27 13:05:45 +00:00
|
|
|
retry_on_reset = 50;
|
2022-06-16 13:00:06 +00:00
|
|
|
|
|
|
|
retry:
|
2021-05-21 09:14:52 +00:00
|
|
|
s = socket(AF_UNIX, SOCK_STREAM, 0);
|
|
|
|
if (s < 0) {
|
|
|
|
perror("socket");
|
|
|
|
exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
|
2022-04-05 09:51:47 +00:00
|
|
|
if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)))
|
|
|
|
perror("setsockopt SO_RCVTIMEO");
|
|
|
|
if (setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)))
|
|
|
|
perror("setsockopt SO_SNDTIMEO");
|
|
|
|
|
2021-05-21 09:14:52 +00:00
|
|
|
snprintf(addr.sun_path, UNIX_PATH_MAX, UNIX_SOCK_PATH, i);
|
2021-07-17 06:28:38 +00:00
|
|
|
if (connect(s, (const struct sockaddr *)&addr, sizeof(addr)))
|
|
|
|
perror("connect");
|
|
|
|
else if (send(s, &probe, sizeof(probe), 0) != sizeof(probe))
|
|
|
|
perror("send");
|
|
|
|
else if (recv(s, &probe_r, 1, MSG_PEEK) <= 0)
|
|
|
|
perror("recv");
|
|
|
|
else
|
2021-05-21 09:14:52 +00:00
|
|
|
break;
|
|
|
|
|
2022-06-16 13:00:06 +00:00
|
|
|
/* FIXME: in a KubeVirt environment, libvirtd invokes qrap three
|
|
|
|
* times in a strict sequence when a virtual machine needs to
|
|
|
|
* be started, namely, when:
|
|
|
|
* - the domain XML is saved
|
|
|
|
* - the domain is started (for "probing")
|
|
|
|
* - the virtual machine is started for real
|
|
|
|
* and it often happens that the qemu process is still running
|
|
|
|
* when qrap is invoked again, so passt will refuse the new
|
|
|
|
* connection because the previous one is still active. This
|
|
|
|
* overlap seems to be anywhere between 0 and 3ms.
|
|
|
|
*
|
2022-06-27 10:11:07 +00:00
|
|
|
* If we get a connection reset, retry a few times, to allow for
|
|
|
|
* the previous qemu instance to terminate and, in turn, for the
|
|
|
|
* connection to passt to be closed.
|
2022-06-16 13:00:06 +00:00
|
|
|
*
|
|
|
|
* This should be fixed in libvirt instead. It probably makes
|
|
|
|
* sense to check this behaviour once native libvirt support is
|
|
|
|
* there, and this implies native qemu support too, so at that
|
|
|
|
* point qrap will have no reason to exist anymore -- that is,
|
|
|
|
* this FIXME will probably remain until the tool itself is
|
|
|
|
* obsoleted.
|
|
|
|
*/
|
|
|
|
if (retry_on_reset && errno == ECONNRESET) {
|
2022-06-27 10:11:07 +00:00
|
|
|
retry_on_reset--;
|
|
|
|
usleep(50 * 1000);
|
2022-06-16 13:00:06 +00:00
|
|
|
goto retry;
|
|
|
|
}
|
|
|
|
|
2021-07-17 06:28:38 +00:00
|
|
|
fprintf(stderr, "Probe of %s failed\n", addr.sun_path);
|
2021-05-21 09:14:52 +00:00
|
|
|
|
|
|
|
close(s);
|
2020-07-17 23:02:39 +00:00
|
|
|
}
|
|
|
|
|
2021-05-21 09:14:52 +00:00
|
|
|
if (i == UNIX_SOCK_MAX) {
|
2020-07-17 23:02:39 +00:00
|
|
|
perror("connect");
|
|
|
|
exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
|
2021-07-17 06:28:38 +00:00
|
|
|
tv.tv_usec = 0;
|
2022-04-05 05:10:30 +00:00
|
|
|
if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)))
|
|
|
|
perror("setsockopt, SO_RCVTIMEO reset");
|
|
|
|
if (setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)))
|
|
|
|
perror("setsockopt, SO_SNDTIMEO reset");
|
|
|
|
|
2021-07-17 06:28:38 +00:00
|
|
|
fprintf(stderr, "Connected to %s\n", addr.sun_path);
|
|
|
|
|
2020-07-17 23:02:39 +00:00
|
|
|
if (dup2(s, (int)fd) < 0) {
|
|
|
|
perror("dup");
|
|
|
|
exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
|
|
|
|
close(s);
|
|
|
|
|
2021-05-10 10:38:50 +00:00
|
|
|
if (qemu_argc) {
|
2021-05-10 12:00:30 +00:00
|
|
|
char **name;
|
2021-05-10 10:38:50 +00:00
|
|
|
|
2021-05-10 12:00:30 +00:00
|
|
|
for (name = qemu_names; *name; name++) {
|
|
|
|
qemu_argv[0] = *name;
|
|
|
|
execvp(*name, qemu_argv);
|
2021-05-10 10:38:50 +00:00
|
|
|
if (errno != ENOENT) {
|
|
|
|
perror("execvp");
|
|
|
|
usage(argv[0]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (errno == ENOENT)
|
|
|
|
fprintf(stderr, "Couldn't find qemu command\n");
|
|
|
|
} else {
|
|
|
|
execvp(argv[2], argv + 2);
|
|
|
|
}
|
|
|
|
|
2020-07-17 23:02:39 +00:00
|
|
|
perror("execvp");
|
|
|
|
|
|
|
|
return EXIT_FAILURE;
|
|
|
|
}
|