Tcp tracking

.gitignore

@@ -5,3 +5,5 @@ docs/book/
 \#*#
 .#*
 __pycache__
+.clang-format
+microkit-sdk-2.1.0/

examples/firewall/filters/tcp_filter.c

@@ -3,20 +3,21 @@
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
-#include <stdbool.h>
-#include <stdint.h>
-#include <os/sddf.h>
-#include <sddf/util/util.h>
-#include <sddf/util/printf.h>
-#include <sddf/network/queue.h>
-#include <sddf/network/config.h>
 #include <lions/firewall/checksum.h>
-#include <lions/firewall/config.h>
 #include <lions/firewall/common.h>
+#include <lions/firewall/config.h>
 #include <lions/firewall/filter.h>
 #include <lions/firewall/ip.h>
-#include <lions/firewall/tcp.h>
 #include <lions/firewall/queue.h>
+#include <lions/firewall/tcp.h>
+#include <lions/firewall/tcp_filter.h>
+#include <os/sddf.h>
+#include <sddf/network/config.h>
+#include <sddf/network/queue.h>
+#include <sddf/util/printf.h>
+#include <sddf/util/util.h>
+#include <stdbool.h>
+#include <stdint.h>
 
 __attribute__((__section__(".fw_filter_config"))) fw_filter_config_t filter_config;
 __attribute__((__section__(".net_client_config"))) net_client_config_t net_config;
@@ -29,11 +30,35 @@ fw_queue_t router_queue;
 /* Holds filtering rules and state */
 fw_filter_state_t filter_state;
 
-static void filter(void)
-{
+/* Current tick, used to track aging instances */
+// Courtney: This has not yet been implemented, i.e. the TCP filter does not yet
+// have access to the timer driver and thus does not receive ticks.
+uint64_t curr_tick = 0;
+
+// Helper fn to allocate the tracking instance slot
+static inline fw_filter_err_t fw_tcp_create_and_bind_instance(fw_filter_state_t *state, ipv4_hdr_t *ip_hdr,
+                                                              tcp_hdr_t *tcp_hdr, uint16_t rule_id,
+                                                              fw_tcp_instance_t **instance) {
+    uint32_t initial_seq = ntohl(tcp_hdr->seq);
+    fw_filter_err_t fw_err = fw_filter_add_instance(state, ip_hdr->src_ip, tcp_hdr->src_port, ip_hdr->dst_ip,
+                                                    tcp_hdr->dst_port, rule_id, initial_seq);
+    // If the slot was successfully created or already existed, link the pointer
+    if (fw_err == FILTER_ERR_OKAY || fw_err == FILTER_ERR_DUPLICATE) {
+        // Dummy id used,
+        uint16_t dummy_rule_id;
+        fw_tcp_filter_find_action(state, ip_hdr->src_ip, tcp_hdr->src_port, ip_hdr->dst_ip, tcp_hdr->dst_port,
+                                  &dummy_rule_id, instance);
+    }
+
+    return fw_err;
+}
+
+static void filter(void) {
     bool transmitted = false;
     bool returned = false;
     bool reprocess = true;
+    int enqueue_err;
+
     while (reprocess) {
         while (!net_queue_empty_active(&rx_queue)) {
             net_buff_desc_t buffer;
@@ -45,14 +70,18 @@ static void filter(void)
             tcp_hdr_t *tcp_hdr = (tcp_hdr_t *)(pkt_vaddr + transport_layer_offset(ip_hdr));
 
             uint16_t rule_id = 0;
-            fw_action_t action = fw_filter_find_action(&filter_state, ip_hdr->src_ip, tcp_hdr->src_port, ip_hdr->dst_ip,
-                                                       tcp_hdr->dst_port, &rule_id);
+            fw_tcp_instance_t *instance = NULL;
+            fw_action_t action = fw_tcp_filter_find_action(&filter_state, ip_hdr->src_ip, tcp_hdr->src_port,
+                                                           ip_hdr->dst_ip, tcp_hdr->dst_port, &rule_id, &instance);
 
             switch (action) {
             case FILTER_ACT_CONNECT: {
+                uint32_t initial_seq = ntohl(tcp_hdr->seq);
+
                 /* Add an established connection in shared memory for corresponding filter */
-                fw_filter_err_t fw_err = fw_filter_add_instance(&filter_state, ip_hdr->src_ip, tcp_hdr->src_port,
-                                                                ip_hdr->dst_ip, tcp_hdr->dst_port, rule_id);
+                fw_filter_err_t fw_err =
+                    fw_filter_add_instance(&filter_state, ip_hdr->src_ip, tcp_hdr->src_port, ip_hdr->dst_ip,
+                                           tcp_hdr->dst_port, rule_id, initial_seq);
 
                 if ((fw_err == FILTER_ERR_OKAY || fw_err == FILTER_ERR_DUPLICATE) && FW_DEBUG_OUTPUT) {
                     sddf_printf(
@@ -69,6 +98,7 @@ static void filter(void)
                                 filter_config.interface, rule_id, ipaddr_to_string(ip_hdr->src_ip, ip_addr_buf0),
                                 htons(tcp_hdr->src_port), ipaddr_to_string(ip_hdr->dst_ip, ip_addr_buf1),
                                 htons(tcp_hdr->dst_port), fw_filter_err_str[fw_err]);
+                    goto drop_packet;
                 }
             }
             case FILTER_ACT_ESTABLISHED:
@@ -79,10 +109,14 @@ static void filter(void)
                 tcp_hdr->check = 0;
 #endif
 
-                err = fw_enqueue(&router_queue, &buffer);
-                assert(!err);
+                enqueue_err = fw_enqueue(&router_queue, &buffer);
+                assert(!enqueue_err);
                 transmitted = true;
 
+                if (instance != NULL) {
+                    instance->timestamp = curr_tick;
+                }
+
                 if (FW_DEBUG_OUTPUT) {
                     if (action == FILTER_ACT_ALLOW || action == FILTER_ACT_CONNECT) {
                         sddf_printf(
@@ -104,9 +138,10 @@ static void filter(void)
             }
             case FILTER_ACT_DROP:
             default: {
+            drop_packet:
                 /* Return the buffer to the rx virtualiser */
-                err = net_enqueue_free(&rx_queue, buffer);
-                assert(!err);
+                enqueue_err = net_enqueue_free(&rx_queue, buffer);
+                assert(!enqueue_err);
                 returned = true;
 
                 if (FW_DEBUG_OUTPUT) {
@@ -119,6 +154,46 @@ static void filter(void)
                 break;
             }
             }
+
+            // Handle state transitions on packets that matched a tracking instances
+            if (instance != NULL) {
+                // Determine direction relative to the original connection initiator
+                bool is_forward = (instance->src_ip == ip_hdr->src_ip && instance->src_port == tcp_hdr->src_port);
+
+                uint32_t packet_seq = ntohl(tcp_hdr->seq);
+                uint8_t flags = tcp_hdr->flags;
+
+                // Payload length tracking calculations
+                uint16_t ip_hdr_len = ipv4_header_length(ip_hdr);
+                uint16_t tcp_hdr_len = (tcp_hdr->doff) * 4;
+                uint32_t payload_len = ntohs(ip_hdr->total_len) - ip_hdr_len - tcp_hdr_len;
+
+                if (is_forward) {
+                    uint32_t control_adjustment = ((flags & FW_TCP_SYN_BIT) || (flags & FW_TCP_FIN_BIT)) ? 1 : 0;
+                    instance->local_next_seq = packet_seq + payload_len + control_adjustment;
+                } else {
+                    uint32_t control_adjustment = ((flags & FW_TCP_SYN_BIT) || (flags & FW_TCP_FIN_BIT)) ? 1 : 0;
+                    instance->extern_next_seq = packet_seq + payload_len + control_adjustment;
+                }
+
+                fw_tcp_conn_state_t new_state = fw_tcp_next_state(instance->current_state, flags, is_forward);
+                if (new_state == TCP_INVALID) {
+                    /* Flag for deletion */
+                    action = FILTER_ACT_DROP;
+                } else {
+                    instance->current_state = new_state;
+                    if (new_state != TCP_NONE) {
+                        // Track historical telemetry data, we don't do it if none for debugging purposes
+                        if (is_forward) {
+                            instance->local.flags = flags;
+                            instance->local.seq = packet_seq;
+                        } else {
+                            instance->external.flags = flags;
+                            instance->external.seq = packet_seq;
+                        }
+                    }
+                }
+            }
         }
 
         net_request_signal_active(&rx_queue);
@@ -139,8 +214,7 @@ static void filter(void)
     }
 }
 
-microkit_msginfo protected(microkit_channel ch, microkit_msginfo msginfo)
-{
+microkit_msginfo protected(microkit_channel ch, microkit_msginfo msginfo) {
     switch (microkit_msginfo_get_label(msginfo)) {
     case FILTER_SET_DEFAULT_ACTION: {
         fw_action_t action = microkit_mr_get(FILTER_SET_DEFAULT_ARG_ACTION);
@@ -211,8 +285,7 @@ microkit_msginfo protected(microkit_channel ch, microkit_msginfo msginfo)
     return microkit_msginfo_new(0, 0);
 }
 
-void notified(microkit_channel ch)
-{
+void notified(microkit_channel ch) {
     if (ch == net_config.rx.id) {
         filter();
     } else {
@@ -221,8 +294,7 @@ void notified(microkit_channel ch)
     }
 }
 
-void init(void)
-{
+void init(void) {
     assert(net_config_check_magic((void *)&net_config));
 
     net_queue_init(&rx_queue, net_config.rx.free_queue.vaddr, net_config.rx.active_queue.vaddr,
@@ -236,4 +308,4 @@ void init(void)
                          filter_config.external_instances, filter_config.instances_capacity,
                          filter_config.initial_rules, filter_config.num_initial_rules,
                          filter_config.num_external_instances);
-}
+}