假定客户端执行主动打开，服务器执行被动打开，客户端发送syn包到服务器，服务器接收该包，进行建立连接请求的相关处理，即第一次握手；本文主要分析第一次握手中被动打开端的处理流程，主动打开端的处理请查阅本博客内另外的文章；
IPv4携带的TCP报文最终会进入到tcp_v4_do_rcv函数，服务器准备接收连接请求时，是处于LISTEN状态的，所以我们只关心这部分的相关处理；函数中LISTEN条件分支中，主要是对启用了syn cookies的检查，我们暂且不做分析；主要看tcp_rcv_state_process这个函数，syn连接请求最终会进入到该函数中进行处理；
1 int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) 2 { 3 struct sock *rsk; 4 5 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ 6 struct dst_entry *dst = sk->sk_rx_dst; 7 8 sock_rps_save_rxhash(sk, skb); 9 sk_mark_napi_id(sk, skb); 10 if (dst) { 11 if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif || 12 !dst->ops->check(dst, 0)) { 13 dst_release(dst); 14 sk->sk_rx_dst = NULL; 15 } 16 } 17 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len); 18 return 0; 19 } 20 21 if (tcp_checksum_complete(skb)) 22 goto csum_err; 23 24 /* LISTEN状态处理 */ 25 if (sk->sk_state == TCP_LISTEN) { 26 27 /* syn cookies检查 */ 28 struct sock *nsk = tcp_v4_cookie_check(sk, skb); 29 30 if (!nsk) 31 goto discard; 32 if (nsk != sk) { 33 if (tcp_child_process(sk, nsk, skb)) { 34 rsk = nsk; 35 goto reset; 36 } 37 return 0; 38 } 39 } else 40 sock_rps_save_rxhash(sk, skb); 41 42 /* ESTABLISHED and TIME_WAIT状态以外的其他状态处理 */ 43 if (tcp_rcv_state_process(sk, skb)) { 44 rsk = sk; 45 goto reset; 46 } 47 return 0; 48 49 reset: 50 tcp_v4_send_reset(rsk, skb); 51 discard: 52 kfree_skb(skb); 53 /* Be careful here. If this function gets more complicated and 54 * gcc suffers from register pressure on the x86, sk (in %ebx) 55 * might be destroyed here. This current version compiles correctly, 56 * but you have been warned. 57 */ 58 return 0; 59 60 csum_err: 61 TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS); 62 TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS); 63 goto discard; 64 }
tcp_rcv_state_process对syn包进行处理，不接收ack包，丢弃含有rst和fin的包，对于合格的syn请求包，则继续调用conn_request回调进行处理，TCPv4中对应的函数为tcp_v4_conn_request；
1 int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) 2 { 3 /* 省略了一些无关代码 */ 4 5 switch (sk->sk_state) { 6 case TCP_CLOSE: 7 goto discard; 8 9 case TCP_LISTEN: 10 /* 不接收ack */ 11 if (th->ack) 12 return 1; 13 14 /* 丢弃带有rst标记的包 */ 15 if (th->rst) 16 goto discard; 17 18 /* 处理syn请求包 */ 19 if (th->syn) { 20 /* 丢弃带有fin标志的包 */ 21 if (th->fin) 22 goto discard; 23 /* It is possible that we process SYN packets from backlog, 24 * so we need to make sure to disable BH right there. 25 */ 26 local_bh_disable(); 27 /* 进入连接请求处理 */ 28 acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0; 29 local_bh_enable(); 30 31 /* 连接失败 */ 32 if (!acceptable) 33 return 1; 34 35 /* 连接成功 */ 36 consume_skb(skb); 37 return 0; 38 } 39 goto discard; 40 } 41 /* 省略了一些无关代码 */ 42 }
tcp_v4_conn_request函数对传入包的路由类型进行检查，如果是发往广播或者组播的，则丢弃该包，合法包进入tcp_conn_request函数继续进行请求处理，其中参数传入了请求控制块操作函数结构指针；
1 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb) 2 { 3 /* Never answer to SYNs send to broadcast or multicast */ 4 if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) 5 goto drop; 6 7 return tcp_conn_request(&tcp_request_sock_ops, 8 &tcp_request_sock_ipv4_ops, sk, skb); 9 10 drop: 11 tcp_listendrop(sk); 12 return 0; 13 }
tcp_conn_request函数为syn请求的核心处理流程，我们暂且忽略其中的syn cookies和fastopen相关流程，其核心功能为分析请求参数，新建连接请求控制块，注意，新建请求控制操作中会将连接状态更新为TCP_NEW_SYN_RECV ，并初始化相关成员，初始化完毕之后，加入到半连接队列accept queue中，然后恢复syn+ack包给客户端；
1 int tcp_conn_request(struct request_sock_ops *rsk_ops, 2 const struct tcp_request_sock_ops *af_ops, 3 struct sock *sk, struct sk_buff *skb) 4 { 5 struct tcp_fastopen_cookie foc = { .len = -1 }; 6 __u32 isn = TCP_SKB_CB(skb)->tcp_tw_isn; 7 struct tcp_options_received tmp_opt; 8 struct tcp_sock *tp = tcp_sk(sk); 9 struct net *net = sock_net(sk); 10 struct sock *fastopen_sk = NULL; 11 struct dst_entry *dst = NULL; 12 struct request_sock *req; 13 bool want_cookie = false; 14 struct flowi fl; 15 16 /* TW buckets are converted to open requests without 17 * limitations, they conserve resources and peer is 18 * evidently real one. 19 */ 20 if ((net->ipv4.sysctl_tcp_syncookies == 2 || 21 inet_csk_reqsk_queue_is_full(sk)) && !isn) { 22 want_cookie = tcp_syn_flood_action(sk, skb, rsk_ops->slab_name); 23 if (!want_cookie) 24 goto drop; 25 } 26 27 /* 如果连接队列长度已达到上限，丢包 */ 28 if (sk_acceptq_is_full(sk)) { 29 NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS); 30 goto drop; 31 } 32 33 /* 34 分配请求控制块，请求控制块的操作指向rsk_ops ， 35 注意: 这个函数将连接状态更新为TCP_NEW_SYN_RECV 36 */ 37 req = inet_reqsk_alloc(rsk_ops, sk, !want_cookie); 38 if (!req) 39 goto drop; 40 41 /* 初始化特定操作函数 */ 42 tcp_rsk(req)->af_specific = af_ops; 43 tcp_rsk(req)->ts_off = 0; 44 45 /* 情况保存tcp选项的相关字段 */ 46 tcp_clear_options(&tmp_opt); 47 48 /* 初始化最大mss */ 49 tmp_opt.mss_clamp = af_ops->mss_clamp; 50 /* 初始化用户定义mss */ 51 tmp_opt.user_mss = tp->rx_opt.user_mss; 52 53 /* 解析tcp选项，其中会取user_mss和对端通告mss的较小值记录到mss_clamp中 */ 54 tcp_parse_options(skb, &tmp_opt, 0, want_cookie ? NULL : &foc); 55 56 if (want_cookie && !tmp_opt.saw_tstamp) 57 tcp_clear_options(&tmp_opt); 58 59 /* 记录是否在syn中有时间戳选项 */ 60 tmp_opt.tstamp_ok = tmp_opt.saw_tstamp; 61 62 /* 使用对端信息对请求控制块做初始化 */ 63 tcp_openreq_init(req, &tmp_opt, skb, sk); 64 65 /* 不做源地址检查?? */ 66 inet_rsk(req)->no_srccheck = inet_sk(sk)->transparent; 67 68 /* Note: tcp_v6_init_req() might override ir_iif for link locals */ 69 inet_rsk(req)->ir_iif = inet_request_bound_dev_if(sk, skb); 70 71 /* 初始化控制块中的目的地址，源地址，ip选项 */ 72 af_ops->init_req(req, sk, skb); 73 74 if (security_inet_conn_request(sk, skb, req)) 75 goto drop_and_free; 76 77 /* 有时间戳选项，计算时间戳偏移?? */ 78 if (tmp_opt.tstamp_ok) 79 tcp_rsk(req)->ts_off = af_ops->init_ts_off(skb); 80 81 /* 不需要cookie，序号未初始化 */ 82 if (!want_cookie && !isn) { 83 /* Kill the following clause, if you dislike this way. */ 84 /* 未开启cookie && 队列剩余小于队列大小的一半&& 对端验证未通过 */ 85 if (!net->ipv4.sysctl_tcp_syncookies && 86 (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) < 87 (net->ipv4.sysctl_max_syn_backlog >> 2)) && 88 !tcp_peer_is_proven(req, dst)) { 89 /* Without syncookies last quarter of 90 * backlog is filled with destinations, 91 * proven to be alive. 92 * It means that we continue to communicate 93 * to destinations, already remembered 94 * to the moment of synflood. 95 */ 96 pr_drop_req(req, ntohs(tcp_hdr(skb)->source), 97 rsk_ops->family); 98 goto drop_and_release; 99 } 100 101 /* 根据源目的地址和端口初始化序号 */ 102 isn = af_ops->init_seq(skb); 103 } 104 105 /* 没有路由要查路由 */ 106 if (!dst) { 107 dst = af_ops->route_req(sk, &fl, req); 108 if (!dst) 109 goto drop_and_free; 110 } 111 112 /* ecn 相关*/ 113 tcp_ecn_create_request(req, skb, sk, dst); 114 115 /* syn cookies相关 */ 116 if (want_cookie) { 117 isn = cookie_init_sequence(af_ops, sk, skb, &req->mss); 118 req->cookie_ts = tmp_opt.tstamp_ok; 119 if (!tmp_opt.tstamp_ok) 120 inet_rsk(req)->ecn_ok = 0; 121 } 122 123 /* 初始化发送序号和hash */ 124 tcp_rsk(req)->snt_isn = isn; 125 tcp_rsk(req)->txhash = net_tx_rndhash(); 126 127 /* 窗口相关初始化todo */ 128 tcp_openreq_init_rwin(req, sk, dst); 129 130 if (!want_cookie) { 131 /* 记录syn包头 */ 132 tcp_reqsk_record_syn(sk, req, skb); 133 fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst); 134 } 135 136 /* fastopen相关 */ 137 if (fastopen_sk) { 138 af_ops->send_synack(fastopen_sk, dst, &fl, req, 139 &foc, TCP_SYNACK_FASTOPEN); 140 /* Add the child socket directly into the accept queue */ 141 inet_csk_reqsk_queue_add(sk, req, fastopen_sk); 142 sk->sk_data_ready(sk); 143 bh_unlock_sock(fastopen_sk); 144 sock_put(fastopen_sk); 145 } else { 146 /* 不是fastopen */ 147 tcp_rsk(req)->tfo_listener = false; 148 149 /* 加入ehash，启动请求重传定时器 */ 150 if (!want_cookie) 151 inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT); 152 153 /* 发送syn+ack */ 154 af_ops->send_synack(sk, dst, &fl, req, &foc, 155 !want_cookie ? TCP_SYNACK_NORMAL : 156 TCP_SYNACK_COOKIE); 157 if (want_cookie) { 158 reqsk_free(req); 159 return 0; 160 } 161 } 162 reqsk_put(req); 163 return 0; 164 165 drop_and_release: 166 dst_release(dst); 167 drop_and_free: 168 reqsk_free(req); 169 drop: 170 tcp_listendrop(sk); 171 return 0; 172 }