数据包在L4被挂入接收队列过程

2090阅读　0评论2013-12-07　liubangbo
分类：LINUX

在前一篇博文中，分析了数据包在IP层接收过程，如果是发给本机，最终数据包会送给L4来处理。下面以UDP协议为例来分析L4的处理过程：
1. udp_rcv是封装函数，直接调用__udp4_lib_rcv函数来处理，那么我们来看看这个函数：

点击(此处)折叠或打开

  1. /*
  2.  *    All we need to do is get the socket, and then do a checksum.
  3.  */

  5. int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
  6.          int is_udplite)
  7. {
  8.     struct sock *sk;  //这个结构体很重要，它和socket结构体相关联，也就是说根据一个就可以得到另一个
  9.     struct udphdr *uh = skb->h.uh; //从skb结构体中取得源端口号和目的端口号
  10.     unsigned short ulen;
  11.     struct rtable *rt = (struct rtable*)skb->dst;
  12.     __be32 saddr = skb->nh.iph->saddr;  //从skb结构体中取得源IP地址和目的IP地址
  13.     __be32 daddr = skb->nh.iph->daddr;

  15.     /*
  16.      * Validate the packet.
  17.      */
  18.     if (!pskb_may_pull(skb, sizeof(struct udphdr)))
  19.         goto drop;        /* No space for header. */

  21.     ulen = ntohs(uh->len);
  22.     if (ulen > skb->len)
  23.         goto short_packet;

  25.     if(! is_udplite ) {        /* UDP validates ulen. */

  27.         if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
  28.             goto short_packet;
  29.         uh = skb->h.uh;

  31.         udp4_csum_init(skb, uh);

  33.     } else     {            /* UDP-Lite validates cscov. */
  34.         if (udplite4_csum_init(skb, uh))
  35.             goto csum_error;
  36.     }

  38.     if(rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))  //如果是L3广播或组播报文，进入相应的处理
  39.         return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);

  41.     sk = __udp4_lib_lookup(saddr, uh->source, daddr, uh->dest,
  42.              skb->dev->ifindex, udptable );        //这是这个函数所做的主要工作之一:根据目的端口号，找到应用层创建的socket

  44.     if (sk != NULL) {
  45.         int ret = udp_queue_rcv_skb(sk, skb);    //如果找到这个socket，就把skb挂入到此socket的接收队列中
  46.         sock_put(sk);

  48.         /* a return value > 0 means to resubmit the input, but
  49.          * it wants the return to be -protocol, or 0
  50.          */
  51.         if (ret > 0)       //在这里这个数据包从网卡芯片往协议栈送的过程就算结束了
  52.             return -ret;
  53.         return 0;
  54.     }

  56.     if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
  57.         goto drop;
  58.     nf_reset(skb);

  60.     /* No socket. Drop packet silently, if checksum is wrong */
  61.     if (udp_lib_checksum_complete(skb))
  62.         goto csum_error;

  64.     UDP_INC_STATS_BH(UDP_MIB_NOPORTS, is_udplite);
  65.     icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);   //如果挂入失败的话，就给源主机发送目标不可达ICMP报文

  67.     /*
  68.      * Hmm. We got an UDP packet to a port to which we
  69.      * don't wanna listen. Ignore it.
  70.      */
  71.     kfree_skb(skb);  //释放掉，此skb，over...
  72.     return(0);

  74. short_packet:
  75.     LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
  76.          is_udplite? "-Lite" : "",
  77.          NIPQUAD(saddr),
  78.          ntohs(uh->source),
  79.          ulen,
  80.          skb->len,
  81.          NIPQUAD(daddr),
  82.          ntohs(uh->dest));
  83.     goto drop;

  85. csum_error:
  86.     /*
  87.      * RFC1122: OK. Discards the bad packet silently (as far as
  88.      * the network is concerned, anyway) as per 4.1.3.4 (MUST).
  89.      */
  90.     LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
  91.          is_udplite? "-Lite" : "",
  92.          NIPQUAD(saddr),
  93.          ntohs(uh->source),
  94.          NIPQUAD(daddr),
  95.          ntohs(uh->dest),
  96.          ulen);
  97. drop:
  98.     UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
  99.     kfree_skb(skb);
  100.     return(0);
  101. }
   一百多行啊，呵呵！
    函数的注释，正确的归纳了这个函数的处理过程：取得相应的socket, 做一些检查。其实还应该加一句，把skb挂入socket的接收队列中。
2. 从上面的代码可以看出，此过程比较简单。分析一下根据端口号找socket的过程和将skb挂入socket接收队列的过程：
  

点击(此处)折叠或打开

  1. /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  2.  * harder than this. -DaveM
  3.  */
  4. static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
  5.                  __be32 daddr, __be16 dport,
  6.                  int dif, struct hlist_head udptable[])
  7. {
  8.     struct sock *sk, *result = NULL;
  9.     struct hlist_node *node;
  10.     unsigned short hnum = ntohs(dport);
  11.     int badness = -1;

  13.     read_lock(&udp_hash_lock);  //这个过程得加锁
  14.     sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {    //udptable这个哈希数组在bind绑定端口号的时候已经构建好了，在这里就是用端口号来
  15.                                                                         //从hlist链表中取得sock结构
  16.         struct inet_sock *inet = inet_sk(sk);

  18.         if (sk->sk_hash == hnum && !ipv6_only_sock(sk)) {   //找到了bind了相同端口号的socket
  19.             int score = (sk->sk_family == PF_INET ? 1 : 0);
  20.             if (inet->rcv_saddr) {              //在bind的时候绑定了自己本身的IP地址，判断对端发送数据包中的目的IP地址是否和自己匹配
  21.                 if (inet->rcv_saddr != daddr)
  22.                     continue;
  23.                 score+=2;
  24.             }
  25.             if (inet->daddr) {            
  26.                 if (inet->daddr != saddr)  //看socket端的目的地址和数据包的源地址
  27.                     continue;
  28.                 score+=2;
  29.             }
  30.             if (inet->dport) {            
  31.                 if (inet->dport != sport)  //看socket端的目的端口和数据包的源端口
  32.                     continue;
  33.                 score+=2;
  34.             }
  35.             if (sk->sk_bound_dev_if) {     //看绑定的接口 ？
  36.                 if (sk->sk_bound_dev_if != dif)
  37.                     continue;
  38.                 score+=2;
  39.             }
  40.             if(score == 9) {
  41.                 result = sk;
  42.                 break;
  43.             } else if(score > badness) {
  44.                 result = sk;
  45.                 badness = score;
  46.             }
  47.         }
  48.     }
  49.     if (result)
  50.         sock_hold(result);
  51.     read_unlock(&udp_hash_lock);
  52.     return result;
  53. }
  从上面的代码中我们看到通过数据包的目的端口号，从udp_hash中找到bind相同端口号的socket，然后从中找到一个最佳的socket(score来计分，呵呵)，如果分值一样就取得最后bind的socket。现在我们知道了，可以建立多个socket
来bind相同的端口号(但是得用setsockopt设置socket属性为SO_REUSEADDR,否则会bind失败)，如果这些socket属性一样(score分值一样)，那么只有最后bind的socket有效，也就是说接收到的数据包会传给这个socket，其他socket接收不到skb。

点击(此处)折叠或打开

  1. int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
  2. {
  3.     struct udp_sock *up = udp_sk(sk);
  4.     int rc;

  6.     /*
  7.      *    Charge it to the socket, dropping if the queue is full.
  8.      */
  9.     if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
  10.         goto drop;
  11.     nf_reset(skb);

  13.     if (up->encap_type) {
  14.         /*
  15.          * This is an encapsulation socket, so let's see if this is
  16.          * an encapsulated packet.
  17.          * If it's a keepalive packet, then just eat it.
  18.          * If it's an encapsulateed packet, then pass it to the
  19.          * IPsec xfrm input and return the response
  20.          * appropriately. Otherwise, just fall through and
  21.          * pass this up the UDP socket.
  22.          */
  23.         int ret;

  25.         ret = udp_encap_rcv(sk, skb);
  26.         if (ret == 0) {
  27.             /* Eat the packet .. */
  28.             kfree_skb(skb);
  29.             return 0;
  30.         }
  31.         if (ret < 0) {
  32.             /* process the ESP packet */
  33.             ret = xfrm4_rcv_encap(skb, up->encap_type);
  34.             UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
  35.             return -ret;
  36.         }
  37.         /* FALLTHROUGH -- it's a UDP Packet */
  38.     }

  40.     /*
  41.      *     UDP-Lite specific tests, ignored on UDP sockets
  42.      */
  43.     if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {

  45.         /*
  46.          * MIB statistics other than incrementing the error count are
  47.          * disabled for the following two types of errors: these depend
  48.          * on the application settings, not on the functioning of the
  49.          * protocol stack as such.
  50.          *
  51.          * RFC 3828 here recommends (sec 3.3): "There should also be a
  52.          * way ... to ... at least let the receiving application block
  53.          * delivery of packets with coverage values less than a value
  54.          * provided by the application."
  55.          */
  56.         if (up->pcrlen == 0) { /* full coverage was set */
  57.             LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
  58.                 "%d while full coverage %d requested\n",
  59.                 UDP_SKB_CB(skb)->cscov, skb->len);
  60.             goto drop;
  61.         }
  62.         /* The next case involves violating the min. coverage requested
  63.          * by the receiver. This is subtle: if receiver wants x and x is
  64.          * greater than the buffersize/MTU then receiver will complain
  65.          * that it wants x while sender emits packets of smaller size y.
  66.          * Therefore the above ...()->partial_cov statement is essential.
  67.          */
  68.         if (UDP_SKB_CB(skb)->cscov < up->pcrlen) {
  69.             LIMIT_NETDEBUG(KERN_WARNING
  70.                 "UDPLITE: coverage %d too small, need min %d\n",
  71.                 UDP_SKB_CB(skb)->cscov, up->pcrlen);
  72.             goto drop;
  73.         }
  74.     }

  76.     if (sk->sk_filter && skb->ip_summed != CHECKSUM_UNNECESSARY) {
  77.         if (__udp_lib_checksum_complete(skb))
  78.             goto drop;
  79.         skb->ip_summed = CHECKSUM_UNNECESSARY;
  80.     }

  82.     if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {    //在这里挂入的，这个函数里面有文章...
  83.         /* Note that an ENOMEM error is charged twice */
  84.         if (rc == -ENOMEM)
  85.             UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, up->pcflag);
  86.         goto drop;
  87.     }

  89.     UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
  90.     return 0;

  92. drop:
  93.     UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);
  94.     kfree_skb(skb);
  95.     return -1;
  96. }


点击(此处)折叠或打开

  1. int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
  2. {
  3.     int err = 0;
  4.     int skb_len;

  6.     /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
  7.      number of warnings when compiling with -W --ANK
  8.      */
  9.     if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=   //sk_rmem_alloc是对接收的skb大小的累加和，当接收到skb时，sk_rmem_alloc增加，当从队列中取出并释放skb时，sk_rmem_alloc减少
  10.      (unsigned)sk->sk_rcvbuf) {                              //sk_rcvbuf 这个是接收缓冲区的大小，我们可以通过setsockopt进行设置。我们看到当从接收队列取包的速度小于接收到包的时候，我们
  11.                                                              //适当增加sk_rcvbuf这个缓冲区的大小就一定程度上减少丢包。
  12.                                                             
  13.         err = -ENOMEM;
  14.         goto out;
  15.     }

  17.     err = sk_filter(sk, skb);
  18.     if (err)
  19.         goto out;

  21.     skb->dev = NULL;
  22.     skb_set_owner_r(skb, sk); //这个函数是对sk_rmem_alloc字段的操作

  24.     /* Cache the SKB length before we tack it onto the receive
  25.      * queue. Once it is added it no longer belongs to us and
  26.      * may be freed by other threads of control pulling packets
  27.      * from the queue.
  28.      */
  29.     skb_len = skb->len;

  31.     skb_queue_tail(&sk->sk_receive_queue, skb);    //把skb挂入到sk_receive_queue中

  33.     if (!sock_flag(sk, SOCK_DEAD))
  34.         sk->sk_data_ready(sk, skb_len);
  35. out:
  36.     return err;
  37. }


点击(此处)折叠或打开

  1. static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
  2. {
  3.     skb->sk = sk;
  4.     skb->destructor = sock_rfree;
  5.     atomic_add(skb->truesize, &sk->sk_rmem_alloc); //还是个原子操作
  6. }



  10. void sock_rfree(struct sk_buff *skb)  //这个是在free skb的时候调用的
  11. {
  12.     struct sock *sk = skb->sk;

  14.     atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
  15. }





上一篇：数据包在IP层接收流程简单分析
下一篇：socket创建过程