VBoxNetFlt-linux.c revision bad918bbc587b87deb80ad29dafb6f837b0c538e
/* $Id$ */
/** @file
* VBoxNetFlt - Network Filter Driver (Host), Linux Specific Code.
*/
/*
* Copyright (C) 2006-2008 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#define LOG_GROUP LOG_GROUP_NET_FLT_DRV
#define VBOXNETFLT_LINUX_NO_XMIT_QUEUE
#include "the-linux-kernel.h"
#include "version-generated.h"
#include "product-generated.h"
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/rtnetlink.h>
#include <linux/miscdevice.h>
#include <VBox/intnetinline.h>
#include <VBox/pdmnetinline.h>
#include <iprt/spinlock.h>
#include <iprt/semaphore.h>
#include <iprt/initterm.h>
#define VBOXNETFLT_OS_SPECFIC 1
#include "../VBoxNetFltInternal.h"
/*
* Uncomment the following line to enable qdisc support.
*/
//#define VBOXNETFLT_WITH_QDISC
#ifdef VBOXNETFLT_WITH_QDISC
#include <net/pkt_sched.h>
#endif /* VBOXNETFLT_WITH_QDISC */
/*******************************************************************************
* Defined Constants And Macros *
*******************************************************************************/
#ifndef VBOXNETFLT_LINUX_NO_XMIT_QUEUE
#endif
#else
#endif
#else
# define CHECKSUM_PARTIAL CHECKSUM_HW
# else
# else
# endif
# endif
#endif
#ifndef NET_IP_ALIGN
# define NET_IP_ALIGN 2
#endif
#if 0
/** Create scatter / gather segments for fragments. When not used, we will
* linearize the socket buffer before creating the internal networking SG. */
# define VBOXNETFLT_SG_SUPPORT 1
#endif
/** Indicates that the linux kernel may send us GSO frames. */
# define VBOXNETFLT_WITH_GSO 1
/** This enables or disables the transmitting of GSO frame from the internal
* network and to the host. */
# define VBOXNETFLT_WITH_GSO_XMIT_HOST 1
# if 0 /** @todo This is currently disable because it causes performance loss of 5-10%. */
/** This enables or disables the transmitting of GSO frame from the internal
* network and to the wire. */
# define VBOXNETFLT_WITH_GSO_XMIT_WIRE 1
# endif
/** This enables or disables the forwarding/flooding of GSO frame from the host
* to the internal network. */
# define VBOXNETFLT_WITH_GSO_RECV 1
#endif
/** This enables or disables handling of GSO frames coming from the wire (GRO). */
# define VBOXNETFLT_WITH_GRO 1
#endif
/*
* GRO support was backported to RHEL 5.4
*/
#ifdef RHEL_RELEASE_CODE
# define VBOXNETFLT_WITH_GRO 1
# endif
#endif
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
static int VBoxNetFltLinuxInit(void);
static void VBoxNetFltLinuxUnload(void);
/*******************************************************************************
* Global Variables *
*******************************************************************************/
/**
* The (common) global data.
*/
static VBOXNETFLTGLOBALS g_VBoxNetFltGlobals;
MODULE_LICENSE("GPL");
#ifdef MODULE_VERSION
#endif
{
unsigned flags;
IFF_RUNNING)) |
IFF_ALLMULTI));
flags |= IFF_RUNNING;
return flags;
}
#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 12) */
#ifdef VBOXNETFLT_WITH_QDISC
//#define QDISC_LOG(x) printk x
#define QDISC_LOG(x) do { } while (0)
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
#else
#endif
#else
#endif
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
struct VBoxNetQDiscPriv
{
/** Pointer to the single child qdisc. */
/*
* Technically it is possible to have different qdiscs for different TX
* queues so we have to save them all.
*/
/** Pointer to the array of saved qdiscs. */
/** Pointer to the net filter instance. */
};
typedef struct VBoxNetQDiscPriv *PVBOXNETQDISCPRIV;
//#define VBOXNETFLT_QDISC_ENQUEUE
{
int rc;
#ifdef VBOXNETFLT_QDISC_ENQUEUE
{
if ( pEtherHdr
&& VALID_PTR(pSwitchPort)
&& cbHdrs >= 6)
{
/** @todo consider reference counting, etc. */
INTNETSWDECISION enmDecision = pSwitchPort->pfnPreRecv(pSwitchPort, pEtherHdr, cbHdrs, INTNETTRUNKDIR_HOST);
if (enmDecision == INTNETSWDECISION_INTNET)
{
return NET_XMIT_SUCCESS;
}
}
}
#endif /* VBOXNETFLT_QDISC_ENQUEUE */
if (rc == NET_XMIT_SUCCESS)
{
}
else
return rc;
}
{
#ifdef VBOXNETFLT_QDISC_ENQUEUE
#else /* VBOXNETFLT_QDISC_ENQUEUE */
{
break;
if ( !pEtherHdr
|| !VALID_PTR(pSwitchPort)
|| cbHdrs < 6)
break;
/** @todo consider reference counting, etc. */
if (enmDecision != INTNETSWDECISION_INTNET)
break;
QDISC_LOG(("VBoxNetFlt: Packet for %02x:%02x:%02x:%02x:%02x:%02x dropped\n",
}
return pSkb;
#endif /* VBOXNETFLT_QDISC_ENQUEUE */
}
{
int rc;
if (rc == 0)
{
}
return rc;
}
#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29) */
{
return 0;
}
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
{
return -ENOMEM;
TC_H_MIN(1)));
{
return -ENOMEM;
}
return 0;
}
{
}
{
{
int i;
for (i = 0; i < QDISC_SAVED_NUM(pDev); i++)
}
}
{
pNew = &noop_qdisc;
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20) */
qdisc_reset(*ppOld);
return 0;
}
{
}
{
return 1;
}
{
}
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
{
return -ENOSYS;
}
{
return -ENOSYS;
}
{
return;
}
}
}
{
return NULL;
}
{
if (cl != 1)
return -ENOENT;
return 0;
}
static struct Qdisc_class_ops g_VBoxNetFltClassOps =
{
};
static struct Qdisc_ops g_VBoxNetFltQDiscOps = {
.id = "vboxnetflt",
.priv_size = sizeof(struct VBoxNetQDiscPriv),
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29) */
.owner = THIS_MODULE
};
/*
* If our qdisc is already attached to the device (that means the user
* installed it from command line with 'tc' command) we simply update
* the pointer to vboxnetflt instance in qdisc's private structure.
* Otherwise we need to take some additional steps:
* - Create our qdisc;
* - Save all references to qdiscs;
* - Replace our child with the first qdisc reference;
* - Replace all references so they point to our qdisc.
*/
{
int i;
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
{
/* The existing qdisc is different from ours, let's create new one. */
if (!pNew)
return; // TODO: Error?
if (!try_module_get(THIS_MODULE))
{
/*
* This may cause a memory leak but calling qdisc_destroy()
* is not an option as it will call module_put().
*/
return;
}
/*
* There is no need in deactivating the device or acquiring any locks
* prior changing qdiscs since we do not destroy the old qdisc.
* Atomic replacement of pointers is enough.
*/
/*
* No need to change reference counters here as we merely move
* the pointer and the reference counter of the newly allocated
* qdisc is already 1.
*/
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
for (i = 0; i < pDev->num_tx_queues; i++)
{
if (i)
}
/* Newer kernels store root qdisc in netdev structure as well. */
# endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
}
else
{
/* We already have vboxnetflt qdisc, let's use it. */
}
}
{
int i;
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
if (!pDev)
{
printk("VBoxNetFlt: Failed to detach qdisc, invalid device pointer: %p\n",
pDev);
return; // TODO: Consider returing an error
}
{
/* Looks like the user has replaced our qdisc manually. */
printk("VBoxNetFlt: Failed to detach qdisc, wrong qdisc: %s\n",
return; // TODO: Consider returing an error
}
QDISC_LOG(("vboxNetFltLinuxQdiscRemove: refcnt=%d num_tx_queues=%d\n",
/* Play it safe, make sure the qdisc is not being used. */
{
yield();
}
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
for (i = 0; i < pDev->num_tx_queues; i++)
{
{
yield();
}
}
/* Newer kernels store root qdisc in netdev structure as well. */
yield();
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32) */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
/*
* At this point all references to our qdisc should be gone
* unless the user had installed it manually.
*/
}
#endif /* VBOXNETFLT_WITH_QDISC */
/**
* Initialize module.
*
* @returns appropriate status code.
*/
static int __init VBoxNetFltLinuxInit(void)
{
int rc;
/*
* Initialize IPRT.
*/
if (RT_SUCCESS(rc))
{
Log(("VBoxNetFltLinuxInit\n"));
/*
* Initialize the globals and connect to the support driver.
*
* This will call back vboxNetFltOsOpenSupDrv (and maybe vboxNetFltOsCloseSupDrv)
* for establishing the connect to the support driver.
*/
if (RT_SUCCESS(rc))
{
#ifdef VBOXNETFLT_WITH_QDISC
/*memcpy(&g_VBoxNetFltQDiscOps, &pfifo_qdisc_ops, sizeof(g_VBoxNetFltQDiscOps));
strcpy(g_VBoxNetFltQDiscOps.id, "vboxnetflt");
g_VBoxNetFltQDiscOps.owner = THIS_MODULE;*/
if (rc)
{
return rc;
}
#endif /* VBOXNETFLT_WITH_QDISC */
LogRel(("VBoxNetFlt: Successfully started.\n"));
return 0;
}
RTR0Term();
}
else
return -RTErrConvertToErrno(rc);
}
/**
* Unload the module.
*
* @todo We have to prevent this if we're busy!
*/
static void __exit VBoxNetFltLinuxUnload(void)
{
int rc;
Log(("VBoxNetFltLinuxUnload\n"));
#ifdef VBOXNETFLT_WITH_QDISC
#endif /* VBOXNETFLT_WITH_QDISC */
/*
* Undo the work done during start (in reverse order).
*/
RTR0Term();
Log(("VBoxNetFltLinuxUnload - done\n"));
}
/**
* Experiment where we filter trafic from the host to the internal network
* before it reaches the NIC driver.
*
* The current code uses a very ugly hack and only works on kernels using the
* net_device_ops (>= 2.6.29). It has been shown to give us a
* performance boost of 60-100% though. So, we have to find some less hacky way
* of getting this job done eventually.
*
* #define VBOXNETFLT_WITH_FILTER_HOST2GUEST_SKBS_EXPERIMENT
*/
/**
* The overridden net_device_ops of the device we're attached to.
*
* Requires Linux 2.6.29 or later.
*
* This is a very dirty hack that was create to explore how much we can improve
* the host to guest transfers by not CC'ing the NIC.
*/
typedef struct VBoxNetDeviceOpsOverride
{
/** Our overridden ops. */
struct net_device_ops Ops;
/** Magic word. */
/** Pointer to the original ops. */
struct net_device_ops const *pOrgOps;
/** Pointer to the net filter instance. */
/** The number of filtered packages. */
/** The total number of packets */
/** VBOXNETDEVICEOPSOVERRIDE::u32Magic value. */
/**
* ndo_start_xmit wrapper that drops packets that shouldn't go to the wire
* because they belong on the internal network.
*
* @returns NETDEV_TX_XXX.
* @param pSkb The socket buffer to transmit.
* @param pDev The net device.
*/
{
/*
* Validate the override structure.
*
* Note! We're racing vboxNetFltLinuxUnhookDev here. If this was supposed
* to be production quality code, we would have to be much more
* careful here and avoid the race.
*/
{
return NETDEV_TX_OK;
}
/*
* Do the filtering base on the defaul OUI of our virtual NICs
*
* Note! In a real solution, we would ask the switch whether the
* destination MAC is 100% to be on the internal network and then
* drop it.
*/
if ( pEtherHdr
&& VALID_PTR(pSwitchPort)
&& cbHdrs >= 6)
{
/** @todo consider reference counting, etc. */
if (enmDecision == INTNETSWDECISION_INTNET)
{
return NETDEV_TX_OK;
}
}
}
/**
* Hooks the device ndo_start_xmit operation of the device.
*
* @param pThis The net filter instance.
* @param pDev The net device.
*/
{
if (!pOverride)
return;
}
/**
* Undos what vboxNetFltLinuxHookDev did.
*
* @param pThis The net filter instance.
* @param pDev The net device. Can be NULL, in which case
* we'll try retrieve it from @a pThis.
*/
{
if (!pDev)
{
)
{
}
else
}
else
if (pOverride)
{
}
}
#endif /* VBOXNETFLT_WITH_FILTER_HOST2GUEST_SKBS_EXPERIMENT */
/**
* Reads and retains the host interface handle.
*
* @returns The handle, NULL if detached.
* @param pThis
*/
{
#if 0
Log(("vboxNetFltLinuxRetainNetDev\n"));
/*
* Be careful here to avoid problems racing the detached callback.
*/
{
if (pDev)
{
Log(("vboxNetFltLinuxRetainNetDev: Device %p(%s) retained. ref=%d\n", pDev, pDev->name, atomic_read(&pDev->refcnt)));
}
}
Log(("vboxNetFltLinuxRetainNetDev - done\n"));
return pDev;
#else
#endif
}
/**
* Release the host interface handle previously retained
* by vboxNetFltLinuxRetainNetDev.
*
* @param pThis The instance.
* @param pDev The vboxNetFltLinuxRetainNetDev
* return value, NULL is fine.
*/
{
#if 0
Log(("vboxNetFltLinuxReleaseNetDev\n"));
if (pDev)
{
Log(("vboxNetFltLinuxReleaseNetDev: Device %p(%s) released. ref=%d\n", pDev, pDev->name, atomic_read(&pDev->refcnt)));
}
Log(("vboxNetFltLinuxReleaseNetDev - done\n"));
#endif
}
/**
* Checks whether this is an mbuf created by vboxNetFltLinuxMBufFromSG,
* i.e. a buffer which we're pushing and should be ignored by the filter callbacks.
*
* @returns true / false accordingly.
* @param pBuf The sk_buff.
*/
{
}
/**
* Internal worker that create a linux sk_buff for a
* (scatter/)gather list.
*
* @returns Pointer to the sk_buff.
* @param pThis The instance.
* @param pSG The (scatter/)gather list.
* @param fDstWire Set if the destination is the wire.
*/
static struct sk_buff *vboxNetFltLinuxSkBufFromSG(PVBOXNETFLTINS pThis, PINTNETSG pSG, bool fDstWire)
{
struct net_device *pDev;
unsigned fGsoType = 0;
{
LogRel(("VBoxNetFlt: Dropped empty packet coming from internal network.\n"));
return NULL;
}
/** @todo We should use fragments mapping the SG buffers with large packets.
* 256 bytes seems to be the a threshold used a lot for this. It
* requires some nasty work on the intnet side though... */
/*
* Allocate a packet and copy over the data.
*/
if (RT_UNLIKELY(!pPkt))
{
return NULL;
}
/* Align IP header on 16-byte boundary: 2 + 14 (ethernet hdr size). */
/* Copy the segments. */
#if defined(VBOXNETFLT_WITH_GSO_XMIT_WIRE) || defined(VBOXNETFLT_WITH_GSO_XMIT_HOST)
/*
* Setup GSO if used by this packet.
*/
{
default:
AssertMsgFailed(("%u (%s)\n", pSG->GsoCtx.u8Type, PDMNetGsoTypeName((PDMNETWORKGSOTYPE)pSG->GsoCtx.u8Type) ));
/* fall thru */
fGsoType = 0;
break;
break;
break;
break;
}
if (fGsoType)
{
/*
* We need to set checksum fields even if the packet goes to the host
* directly as it may be immediately forwared by IP layer @bugref{5020}.
*/
else
# else
else
# endif
if (!fDstWire)
}
#endif /* VBOXNETFLT_WITH_GSO_XMIT_WIRE || VBOXNETFLT_WITH_GSO_XMIT_HOST */
/*
* Finish up the socket buffer.
*/
if (fDstWire)
{
/* Restore ethernet header back. */
}
return pPkt;
}
/**
* Initializes a SG list from an sk_buff.
*
* @returns Number of segments.
* @param pThis The instance.
* @param pBuf The sk_buff.
* @param pSG The SG.
* @param pvFrame The frame pointer, optional.
* @param cSegs The number of segments allocated for the SG.
* This should match the number in the mbuf exactly!
* @param fSrc The source of the frame.
* @param pGso Pointer to the GSO context if it's a GSO
* internal network frame. NULL if regular frame.
*/
DECLINLINE(void) vboxNetFltLinuxSkBufToSG(PVBOXNETFLTINS pThis, struct sk_buff *pBuf, PINTNETSG pSG,
{
int i;
if (!pGsoCtx)
else
#ifdef VBOXNETFLT_SG_SUPPORT
{
}
++i;
#else
i = 1;
#endif
#ifdef PADD_RUNT_FRAMES_FROM_HOST
/*
* Add a trailer if the frame is too small.
*
* Since we're getting to the packet before it is framed, it has not
* yet been padded. The current solution is to add a segment pointing
* to a buffer containing all zeros and pray that works for all frames...
*/
{
AssertReturnVoid(i < cSegs);
}
#endif
Log4(("vboxNetFltLinuxSkBufToSG: allocated=%d, segments=%d frags=%d next=%p frag_list=%p pkt_type=%x fSrc=%x\n",
pSG->cSegsAlloc, pSG->cSegsUsed, skb_shinfo(pBuf)->nr_frags, pBuf->next, skb_shinfo(pBuf)->frag_list, pBuf->pkt_type, fSrc));
Log4(("vboxNetFltLinuxSkBufToSG: #%d: cb=%d pv=%p\n",
}
/**
* Packet handler,
*
* @returns 0 or EJUSTRETURN.
* @param pThis The instance.
* @param pMBuf The mbuf.
* @param pvFrame The start of the frame, optional.
* @param fSrc Where the packet (allegedly) comes from, one INTNETTRUNKDIR_* value.
* @param eProtocol The protocol.
*/
struct net_device *pSkbDev,
struct packet_type *pPacketType,
struct net_device *pOrigDev)
#else
struct net_device *pSkbDev,
struct packet_type *pPacketType)
#endif
{
struct net_device *pDev;
LogFlow(("vboxNetFltLinuxPacketHandler: pBuf=%p pSkbDev=%p pPacketType=%p\n",
Log3(("vboxNetFltLinuxPacketHandler: skb len=%u data_len=%u truesize=%u next=%p nr_frags=%u gso_size=%u gso_seqs=%u gso_type=%x frag_list=%p pkt_type=%x\n",
pBuf->len, pBuf->data_len, pBuf->truesize, pBuf->next, skb_shinfo(pBuf)->nr_frags, skb_shinfo(pBuf)->gso_size, skb_shinfo(pBuf)->gso_segs, skb_shinfo(pBuf)->gso_type, skb_shinfo(pBuf)->frag_list, pBuf->pkt_type));
Log4(("vboxNetFltLinuxPacketHandler: packet dump follows:\n%.*Rhxd\n", pBuf->len-pBuf->data_len, skb_mac_header(pBuf)));
#else
Log3(("vboxNetFltLinuxPacketHandler: skb len=%u data_len=%u truesize=%u next=%p nr_frags=%u tso_size=%u tso_seqs=%u frag_list=%p pkt_type=%x\n",
pBuf->len, pBuf->data_len, pBuf->truesize, pBuf->next, skb_shinfo(pBuf)->nr_frags, skb_shinfo(pBuf)->tso_size, skb_shinfo(pBuf)->tso_segs, skb_shinfo(pBuf)->frag_list, pBuf->pkt_type));
#endif
/*
* Drop it immediately?
*/
if (!pBuf)
return 0;
{
return 0;
}
{
Log2(("vboxNetFltLinuxPacketHandler: got our own sk_buff, drop it.\n"));
return 0;
}
#ifndef VBOXNETFLT_SG_SUPPORT
{
/*
* Get rid of fragmented packets, they cause too much trouble.
*/
if (!pCopy)
{
LogRel(("VBoxNetFlt: Failed to allocate packet buffer, dropping the packet.\n"));
return 0;
}
Log3(("vboxNetFltLinuxPacketHandler: skb copy len=%u data_len=%u truesize=%u next=%p nr_frags=%u gso_size=%u gso_seqs=%u gso_type=%x frag_list=%p pkt_type=%x\n",
pBuf->len, pBuf->data_len, pBuf->truesize, pBuf->next, skb_shinfo(pBuf)->nr_frags, skb_shinfo(pBuf)->gso_size, skb_shinfo(pBuf)->gso_segs, skb_shinfo(pBuf)->gso_type, skb_shinfo(pBuf)->frag_list, pBuf->pkt_type));
Log4(("vboxNetFltLinuxPacketHandler: packet dump follows:\n%.*Rhxd\n", pBuf->len-pBuf->data_len, skb_mac_header(pBuf)));
# else
Log3(("vboxNetFltLinuxPacketHandler: skb copy len=%u data_len=%u truesize=%u next=%p nr_frags=%u tso_size=%u tso_seqs=%u frag_list=%p pkt_type=%x\n",
pBuf->len, pBuf->data_len, pBuf->truesize, pBuf->next, skb_shinfo(pBuf)->nr_frags, skb_shinfo(pBuf)->tso_size, skb_shinfo(pBuf)->tso_segs, skb_shinfo(pBuf)->frag_list, pBuf->pkt_type));
# endif
}
#endif
/* Forward it to the internal network. */
#else
/* Add the packet to transmit queue and schedule the bottom half. */
Log4(("vboxNetFltLinuxPacketHandler: scheduled work %p for sk_buff %p\n",
#endif
/* It does not really matter what we return, it is ignored by the kernel. */
return 0;
}
/**
* Calculate the number of INTNETSEG segments the socket buffer will need.
*
* @returns Segment count.
* @param pBuf The socket buffer.
*/
{
#ifdef VBOXNETFLT_SG_SUPPORT
#else
unsigned cSegs = 1;
#endif
#ifdef PADD_RUNT_FRAMES_FROM_HOST
/* vboxNetFltLinuxSkBufToSG adds a padding segment if it's a runt. */
cSegs++;
#endif
return cSegs;
}
/**
* Destroy the intnet scatter / gather buffer created by
* vboxNetFltLinuxSkBufToSG.
*/
{
#ifdef VBOXNETFLT_SG_SUPPORT
int i;
{
}
#endif
}
#ifdef LOG_ENABLED
/**
* Logging helper.
*/
{
static int iPacketNo = 1;
iPacketNo += iIncrement;
if (fEgress)
{
}
else
{
}
Log(("VBoxNetFlt: (int)%02x:%02x:%02x:%02x:%02x:%02x"
" %s (%s)%02x:%02x:%02x:%02x:%02x:%02x (%u bytes) packet #%u\n",
}
#else
# define vboxNetFltDumpPacket(a, b, c, d) do {} while (0)
#endif
#ifdef VBOXNETFLT_WITH_GSO_RECV
/**
* Worker for vboxNetFltLinuxForwardToIntNet that checks if we can forwards a
* GSO socket buffer without having to segment it.
*
* @returns true on success, false if needs segmenting.
* @param pThis The net filter instance.
* @param pSkb The GSO socket buffer.
* @param fSrc The source.
* @param pGsoCtx Where to return the GSO context on success.
*/
static bool vboxNetFltLinuxCanForwardAsGso(PVBOXNETFLTINS pThis, struct sk_buff *pSkb, uint32_t fSrc,
{
unsigned int cbTransport;
unsigned int offTransport;
unsigned int cbTransportHdr;
unsigned uProtocol;
union
{
} Buf;
/*
* Check the GSO properties of the socket buffer and make sure it fits.
*/
/** @todo Figure out how to handle SKB_GSO_TCP_ECN! */
if (RT_UNLIKELY( skb_shinfo(pSkb)->gso_type & ~(SKB_GSO_UDP | SKB_GSO_DODGY | SKB_GSO_TCPV6 | SKB_GSO_TCPV4) ))
{
return false;
}
{
Log5(("vboxNetFltLinuxCanForwardAsGso: gso_size=%#x skb_len=%#x (max=%#x)\n", skb_shinfo(pSkb)->gso_size, pSkb->len, VBOX_MAX_GSO_SIZE));
return false;
}
/*
* It is possible to receive GSO packets from wire if GRO is enabled.
*/
{
Log5(("vboxNetFltLinuxCanForwardAsGso: fSrc=wire\n"));
#ifdef VBOXNETFLT_WITH_GRO
/*
* The packet came from the wire and the driver has already consumed
* mac header. We need to restore it back.
*/
Log5(("vboxNetFltLinuxCanForwardAsGso: mac_len=%d data=%p mac_header=%p network_header=%p\n",
#else /* !VBOXNETFLT_WITH_GRO */
/* Older kernels didn't have GRO. */
return false;
#endif /* !VBOXNETFLT_WITH_GRO */
}
else
{
/*
* skb_gso_segment does the following. Do we need to do it as well?
*/
#else
#endif
}
/*
* Switch on the ethertype.
*/
{
uint16_t const *puEtherType = skb_header_pointer(pSkb, sizeof(RTNETETHERHDR) + sizeof(uint16_t), sizeof(uint16_t), &Buf);
if (puEtherType)
}
switch (uEtherType)
{
case RT_H2N_U16_C(RTNET_ETHERTYPE_IPV4):
{
unsigned int cbHdr;
if (RT_UNLIKELY(!pIPv4))
{
Log5(("vboxNetFltLinuxCanForwardAsGso: failed to access IPv4 hdr\n"));
return false;
}
|| cbHdr > cbTransport ))
{
Log5(("vboxNetFltLinuxCanForwardAsGso: invalid IPv4 lengths: ip_hl=%u ip_len=%u\n", pIPv4->ip_hl, RT_N2H_U16(pIPv4->ip_len)));
return false;
}
cbTransport -= cbHdr;
if (uProtocol == RTNETIPV4_PROT_TCP)
else if (uProtocol == RTNETIPV4_PROT_UDP)
else /** @todo IPv6: 4to6 tunneling */
break;
}
case RT_H2N_U16_C(RTNET_ETHERTYPE_IPV6):
{
if (RT_UNLIKELY(!pIPv6))
{
Log5(("vboxNetFltLinuxCanForwardAsGso: failed to access IPv6 hdr\n"));
return false;
}
/** @todo IPv6: Dig our way out of the other headers. */
if (uProtocol == RTNETIPV4_PROT_TCP)
else if (uProtocol == RTNETIPV4_PROT_UDP)
else
break;
}
default:
return false;
}
if (enmGsoType == PDMNETWORKGSOTYPE_INVALID)
{
return false;
}
{
Log5(("vboxNetFltLinuxCanForwardAsGso: Bad transport length; off=%#x + cb=%#x => %#x; skb_len=%#x (%s)\n",
return false;
}
/*
*/
if (uProtocol == RTNETIPV4_PROT_TCP)
{
if (RT_UNLIKELY(!pTcp))
{
Log5(("vboxNetFltLinuxCanForwardAsGso: failed to access TCP hdr\n"));
return false;
}
{
Log5(("vboxNetFltLinuxCanForwardAsGso: No space for TCP header; off=%#x cb=%#x skb_len=%#x\n", offTransport, cbTransportHdr, pSkb->len));
return false;
}
}
else
{
cbTransportHdr = sizeof(RTNETUDP);
{
Log5(("vboxNetFltLinuxCanForwardAsGso: No space for UDP header; off=%#x skb_len=%#x\n", offTransport, pSkb->len));
return false;
}
}
/*
* We're good, init the GSO context.
*/
return true;
}
/**
* Forward the socket buffer as a GSO internal network frame.
*
* @returns IPRT status code.
* @param pThis The net filter instance.
* @param pSkb The GSO socket buffer.
* @param fSrc The source.
* @param pGsoCtx Where to return the GSO context on success.
*/
static int vboxNetFltLinuxForwardAsGso(PVBOXNETFLTINS pThis, struct sk_buff *pSkb, uint32_t fSrc, PCPDMNETWORKGSO pGsoCtx)
{
int rc;
{
{
rc = VINF_SUCCESS;
}
else
{
Log(("VBoxNetFlt: Dropping the sk_buff (failure case).\n"));
rc = VERR_NO_MEMORY;
}
}
else
{
}
Log4(("VBoxNetFlt: Dropping the sk_buff.\n"));
return rc;
}
#endif /* VBOXNETFLT_WITH_GSO_RECV */
/**
* Worker for vboxNetFltLinuxForwardToIntNet.
*
* @returns VINF_SUCCESS or VERR_NO_MEMORY.
* @param pThis The net filter instance.
* @param pBuf The socket buffer.
* @param fSrc The source.
*/
{
int rc;
{
{
if (fSrc & INTNETTRUNKDIR_WIRE)
{
/*
* The packet came from wire, ethernet header was removed by device driver.
* Restore it.
*/
}
rc = VINF_SUCCESS;
}
else
{
Log(("VBoxNetFlt: Failed to allocate SG buffer.\n"));
rc = VERR_NO_MEMORY;
}
}
else
{
}
Log4(("VBoxNetFlt: Dropping the sk_buff.\n"));
return rc;
}
/**
*
* @param pBuf The socket buffer. This is consumed by this function.
*/
{
#ifdef VBOXNETFLT_WITH_GSO
if (skb_is_gso(pBuf))
{
Log3(("vboxNetFltLinuxForwardToIntNet: skb len=%u data_len=%u truesize=%u next=%p nr_frags=%u gso_size=%u gso_seqs=%u gso_type=%x frag_list=%p pkt_type=%x ip_summed=%d\n",
pBuf->len, pBuf->data_len, pBuf->truesize, pBuf->next, skb_shinfo(pBuf)->nr_frags, skb_shinfo(pBuf)->gso_size, skb_shinfo(pBuf)->gso_segs, skb_shinfo(pBuf)->gso_type, skb_shinfo(pBuf)->frag_list, pBuf->pkt_type, pBuf->ip_summed));
# ifdef VBOXNETFLT_WITH_GSO_RECV
else
# endif
{
/* Need to segment the packet */
{
return;
}
{
Log3(("vboxNetFltLinuxForwardToIntNet: segment len=%u data_len=%u truesize=%u next=%p nr_frags=%u gso_size=%u gso_seqs=%u gso_type=%x frag_list=%p pkt_type=%x\n",
pSegment->len, pSegment->data_len, pSegment->truesize, pSegment->next, skb_shinfo(pSegment)->nr_frags, skb_shinfo(pSegment)->gso_size, skb_shinfo(pSegment)->gso_segs, skb_shinfo(pSegment)->gso_type, skb_shinfo(pSegment)->frag_list, pSegment->pkt_type));
}
}
}
else
#endif /* VBOXNETFLT_WITH_GSO */
{
{
/*
* Try to work around the problem with CentOS 4.7 and 5.2 (2.6.9
* and 2.6.18 kernels), they pass wrong 'h' pointer down. We take IP
* header length from the header itself and reconstruct 'h' pointer
* to TCP (or whatever) header.
*/
#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) */
if (VBOX_SKB_CHECKSUM_HELP(pBuf))
{
LogRel(("VBoxNetFlt: Failed to compute checksum, dropping the packet.\n"));
return;
}
/* Restore the original (wrong) pointer. */
#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) */
}
}
}
#ifndef VBOXNETFLT_LINUX_NO_XMIT_QUEUE
/**
* Work queue handler that forwards the socket buffers queued by
* vboxNetFltLinuxPacketHandler to the internal network.
*
* @param pWork The work queue.
*/
# else
static void vboxNetFltLinuxXmitTask(void *pWork)
# endif
{
/*
* Active? Retain the instance and increment the busy counter.
*/
{
}
else
{
/** @todo Shouldn't we just drop the packets here? There is little point in
* making them accumulate when the VM is paused and it'll only waste
* kernel memory anyway... Hmm. maybe wait a short while (2-5 secs)
* before start draining the packets (goes for the intnet ring buf
* too)? */
}
}
#endif /* !VBOXNETFLT_LINUX_NO_XMIT_QUEUE */
/**
* Reports the GSO capabilites of the hardware NIC.
*
* @param pThis The net filter instance. The caller hold a
* reference to this.
*/
{
{
struct net_device *pDev;
unsigned int fFeatures;
if (pDev)
else
fFeatures = 0;
if (pThis->pSwitchPort)
{
uint32_t fGsoCapabilites = 0;
if (fFeatures & NETIF_F_TSO)
if (fFeatures & NETIF_F_TSO6)
# if 0 /** @todo GSO: Test UDP offloading (UFO) on linux. */
if (fFeatures & NETIF_F_UFO)
if (fFeatures & NETIF_F_UFO)
# endif
pThis->pSwitchPort->pfnReportGsoCapabilities(pThis->pSwitchPort, fGsoCapabilites, INTNETTRUNKDIR_WIRE);
}
}
#endif /* VBOXNETFLT_WITH_GSO_XMIT_WIRE */
}
/**
* Helper that determins whether the host (ignoreing us) is operating the
* interface in promiscuous mode or not.
*/
{
bool fRc = false;
if (pDev)
{
LogFlow(("vboxNetFltPortOsIsPromiscuous: returns %d, pDev->promiscuity=%d, fPromiscuousSet=%d\n",
}
return fRc;
}
/**
* Internal worker for vboxNetFltLinuxNotifierCallback.
*
* @returns VBox status code.
* @param pThis The instance.
* @param fRediscovery If set we're doing a rediscovery attempt, so, don't
* flood the release log.
*/
{
/*
* Retain and store the device.
*/
Log(("vboxNetFltLinuxAttachToInterface: Device %p(%s) retained. ref=%d\n", pDev, pDev->name, atomic_read(&pDev->refcnt)));
Log(("vboxNetFltLinuxAttachToInterface: Got pDev=%p pThis=%p pThis->u.s.pDev=%p\n", pDev, pThis, ASMAtomicUoReadPtrT(&pThis->u.s.pDev, struct net_device *)));
/* Get the mac address while we still have a valid net_device reference. */
/*
* Install a packet filter for this device with a protocol wildcard (ETH_P_ALL).
*/
#endif
#ifdef VBOXNETFLT_WITH_QDISC
#endif /* VBOXNETFLT_WITH_QDISC */
/*
* Set indicators that require the spinlock. Be abit paranoid about racing
* the device notification handle.
*/
if (pDev)
{
}
/*
* If the above succeeded report GSO capabilites, if not undo and
* release the device.
*/
if (!pDev)
{
{
pThis->pSwitchPort->pfnReportPromiscuousMode(pThis->pSwitchPort, vboxNetFltLinuxPromiscuous(pThis));
pThis->pSwitchPort->pfnReportNoPreemptDsts(pThis->pSwitchPort, INTNETTRUNKDIR_WIRE | INTNETTRUNKDIR_HOST);
}
}
else
{
#endif
#ifdef VBOXNETFLT_WITH_QDISC
#endif /* VBOXNETFLT_WITH_QDISC */
Log(("vboxNetFltLinuxAttachToInterface: Device %p(%s) released. ref=%d\n", pDev, pDev->name, atomic_read(&pDev->refcnt)));
}
LogRel(("VBoxNetFlt: attached to '%s' / %.*Rhxs\n", pThis->szName, sizeof(pThis->u.s.MacAddr), &pThis->u.s.MacAddr));
return VINF_SUCCESS;
}
{
#endif
#ifdef VBOXNETFLT_WITH_QDISC
#endif /* VBOXNETFLT_WITH_QDISC */
#ifndef VBOXNETFLT_LINUX_NO_XMIT_QUEUE
#endif
Log(("vboxNetFltLinuxUnregisterDevice: this=%p: Packet handler removed, xmit queue purged.\n", pThis));
Log(("vboxNetFltLinuxUnregisterDevice: Device %p(%s) released. ref=%d\n", pDev, pDev->name, atomic_read(&pDev->refcnt)));
return NOTIFY_OK;
}
{
/* Check if we are not suspended and promiscuous mode has not been set. */
{
/* Note that there is no need for locking as the kernel got hold of the lock already. */
Log(("vboxNetFltLinuxDeviceIsUp: enabled promiscuous mode on %s (%d)\n", pThis->szName, pDev->promiscuity));
}
else
Log(("vboxNetFltLinuxDeviceIsUp: no need to enable promiscuous mode on %s (%d)\n", pThis->szName, pDev->promiscuity));
return NOTIFY_OK;
}
{
/* Undo promiscuous mode if we has set it. */
{
/* Note that there is no need for locking as the kernel got hold of the lock already. */
Log(("vboxNetFltLinuxDeviceGoingDown: disabled promiscuous mode on %s (%d)\n", pThis->szName, pDev->promiscuity));
}
else
Log(("vboxNetFltLinuxDeviceGoingDown: no need to disable promiscuous mode on %s (%d)\n", pThis->szName, pDev->promiscuity));
return NOTIFY_OK;
}
#ifdef LOG_ENABLED
/** Stringify the NETDEV_XXX constants. */
static const char *vboxNetFltLinuxGetNetDevEventName(unsigned long ulEventType)
{
const char *pszEvent = "NETDRV_<unknown>";
switch (ulEventType)
{
# ifdef NETDEV_FEAT_CHANGE
# endif
}
return pszEvent;
}
#endif /* LOG_ENABLED */
/**
* Callback for listening to netdevice events.
*
* This works the rediscovery, clean up on unregistration, promiscuity on
*
* @returns NOTIFY_OK
* @param self Pointer to our notifier registration block.
* @param ulEventType The event.
* @param ptr Event specific, but it is usually the device it
* relates to.
*/
static int vboxNetFltLinuxNotifierCallback(struct notifier_block *self, unsigned long ulEventType, void *ptr)
{
vboxNetFltLinuxGetNetDevEventName(ulEventType), ulEventType, pDev->name, pDev, pThis, ASMAtomicUoReadPtrT(&pThis->u.s.pDev, struct net_device *)));
if ( ulEventType == NETDEV_REGISTER
{
}
else
{
{
switch (ulEventType)
{
case NETDEV_UNREGISTER:
break;
case NETDEV_UP:
break;
case NETDEV_GOING_DOWN:
break;
case NETDEV_CHANGENAME:
break;
#ifdef NETDEV_FEAT_CHANGE
case NETDEV_FEAT_CHANGE:
break;
#endif
}
}
}
return rc;
}
{
}
{
struct net_device * pDev;
int err;
int rc = VINF_SUCCESS;
if (pDev)
{
/*
* Create a sk_buff for the gather list and push it onto the wire.
*/
if (fDst & INTNETTRUNKDIR_WIRE)
{
if (pBuf)
{
if (err)
}
else
rc = VERR_NO_MEMORY;
}
/*
* Create a sk_buff for the gather list and push it onto the host stack.
*/
if (fDst & INTNETTRUNKDIR_HOST)
{
if (pBuf)
{
if (err)
}
else
rc = VERR_NO_MEMORY;
}
}
return rc;
}
{
struct net_device * pDev;
LogFlow(("vboxNetFltPortOsSetActive: pThis=%p (%s), fActive=%s, fDisablePromiscuous=%s\n",
if (pThis->fDisablePromiscuous)
return;
if (pDev)
{
/*
* This api is a bit weird, the best reference is the code.
*
* Also, we have a bit or race conditions wrt the maintance of
* host the interface promiscuity for vboxNetFltPortOsIsPromiscuous.
*/
#ifdef LOG_ENABLED
#endif
if (fActive)
{
rtnl_lock();
rtnl_unlock();
pThis->u.s.fPromiscuousSet = true;
Log(("vboxNetFltPortOsSetActive: enabled promiscuous mode on %s (%d)\n", pThis->szName, pDev->promiscuity));
}
else
{
if (pThis->u.s.fPromiscuousSet)
{
rtnl_lock();
rtnl_unlock();
Log(("vboxNetFltPortOsSetActive: disabled promiscuous mode on %s (%d)\n", pThis->szName, pDev->promiscuity));
}
pThis->u.s.fPromiscuousSet = false;
#ifdef LOG_ENABLED
#endif
}
}
}
{
/* Nothing to do here. */
return VINF_SUCCESS;
}
{
/*
* Report the GSO capabilities of the host and device (if connected).
* Note! No need to mark ourselves busy here.
*/
/** @todo duplicate work here now? Attach */
#if defined(VBOXNETFLT_WITH_GSO_XMIT_HOST)
0
# if 0 /** @todo GSO: Test UDP offloading (UFO) on linux. */
# endif
#endif
return VINF_SUCCESS;
}
{
struct net_device *pDev;
bool fRegistered;
#endif
#ifdef VBOXNETFLT_WITH_QDISC
#endif /* VBOXNETFLT_WITH_QDISC */
/** @todo This code may race vboxNetFltLinuxUnregisterDevice (very very
* unlikely, but none the less). Since it doesn't actually update the
* state (just reads it), it is likely to panic in some interesting
* ways. */
if (fRegistered)
{
#ifndef VBOXNETFLT_LINUX_NO_XMIT_QUEUE
#endif
Log(("vboxNetFltOsDeleteInstance: Device %p(%s) released. ref=%d\n", pDev, pDev->name, atomic_read(&pDev->refcnt)));
}
}
{
int err;
if (err)
return VERR_INTNET_FLT_IF_FAILED;
if (!pThis->u.s.fRegistered)
{
return VERR_INTNET_FLT_IF_NOT_FOUND;
}
if ( pThis->fDisconnectedFromHost
|| !try_module_get(THIS_MODULE))
return VERR_INTNET_FLT_IF_FAILED;
return VINF_SUCCESS;
}
{
/*
* Init the linux specific members.
*/
pThis->u.s.fRegistered = false;
pThis->u.s.fPromiscuousSet = false;
#ifndef VBOXNETFLT_LINUX_NO_XMIT_QUEUE
# else
# endif
#endif
return VINF_SUCCESS;
}
{
}
{
/* Nothing to do */
return VINF_SUCCESS;
}
{
/* Nothing to do */
return VINF_SUCCESS;
}