TCP层close系统调用的实现分析

在调用close系统调用关闭套接字时，如果套接字引用计数已经归零，则需继续向上层调用其close实现，tcp为tcp_close；本文仅介绍tcp部分，前置部分请参考本博关于close系统调用的文章；

void tcp_close(struct sock *sk, long timeout)
{
    struct sk_buff *skb;
    int data_was_unread = 0;
    int state;

    lock_sock(sk);
    sk->sk_shutdown = SHUTDOWN_MASK;

    /* LISTEN状态处理 */
    if (sk->sk_state == TCP_LISTEN) {
        /* 设置close状态 */
        tcp_set_state(sk, TCP_CLOSE);

        /* Special case. */
        /* 清理完成连接队列 */
        inet_csk_listen_stop(sk);

        goto adjudge_to_death;
    }

    /*  We need to flush the recv. buffs.  We do this only on the
     *  descriptor close, not protocol-sourced closes, because the
     *  reader process may not have drained the data yet!
     */
    /* 删除接收队列中用户进程未读取的skb */
    while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
        u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;

        /* 减去fin的一个序号长度 */
        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
            len--;
        data_was_unread += len;
        __kfree_skb(skb);
    }

    sk_mem_reclaim(sk);

    /* If socket has been already reset (e.g. in tcp_reset()) - kill it. */
    /* CLOSE状态 */
    if (sk->sk_state == TCP_CLOSE)
        goto adjudge_to_death;

    /* As outlined in RFC 2525, section 2.17, we send a RST here because
     * data was lost. To witness the awful effects of the old behavior of
     * always doing a FIN, run an older 2.1.x kernel or 2.0.x, start a bulk
     * GET in an FTP client, suspend the process, wait for the client to
     * advertise a zero window, then kill -9 the FTP client, wheee...
     * Note: timeout is always zero in such a case.
     */
    /* 修复状态，断开连接 */
    if (unlikely(tcp_sk(sk)->repair)) {
        sk->sk_prot->disconnect(sk, 0);
    } 
    /* 用户进程有数据未读 */
    else if (data_was_unread) {
        /* Unread data was tossed, zap the connection. */
        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONCLOSE);

        /* 设置为close */
        tcp_set_state(sk, TCP_CLOSE);

        /* 发送rst */
        tcp_send_active_reset(sk, sk->sk_allocation);
    } 
    /* lingertime==0，断开连接 */
    else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
        /* Check zero linger _after_ checking for unread data. */
        sk->sk_prot->disconnect(sk, 0);
        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONDATA);
    } 
    /* 关闭状态转移 */
    else if (tcp_close_state(sk)) {
        /* We FIN if the application ate all the data before
         * zapping the connection.
         */

        /* RED-PEN. Formally speaking, we have broken TCP state
         * machine. State transitions:
         *
         * TCP_ESTABLISHED -> TCP_FIN_WAIT1
         * TCP_SYN_RECV    -> TCP_FIN_WAIT1 (forget it, it's impossible)
         * TCP_CLOSE_WAIT -> TCP_LAST_ACK
         *
         * are legal only when FIN has been sent (i.e. in window),
         * rather than queued out of window. Purists blame.
         *
         * F.e. "RFC state" is ESTABLISHED,
         * if Linux state is FIN-WAIT-1, but FIN is still not sent.
         *
         * The visible declinations are that sometimes
         * we enter time-wait state, when it is not required really
         * (harmless), do not send active resets, when they are
         * required by specs (TCP_ESTABLISHED, TCP_CLOSE_WAIT, when
         * they look as CLOSING or LAST_ACK for Linux)
         * Probably, I missed some more holelets.
         *                         --ANK
         * XXX (TFO) - To start off we don't support SYN+ACK+FIN
         * in a single packet! (May consider it later but will
         * probably need API support or TCP_CORK SYN-ACK until
         * data is written and socket is closed.)
         */
        /* 发送fin */
        tcp_send_fin(sk);
    }

    /* 等待关闭，状态为FIN_WAIT_1 CLOSING LAST_ACK或sk_lingertime超时 */
    sk_stream_wait_close(sk, timeout);

adjudge_to_death:
    state = sk->sk_state;
    sock_hold(sk);

    /* 设置为DEAD状态 */
    sock_orphan(sk);

    /* It is the last release_sock in its life. It will remove backlog. */
    /* 删除控制块的backlog、cb */
    release_sock(sk);


    /* Now socket is owned by kernel and we acquire BH lock
       to finish close. No need to check for user refs.
     */
    local_bh_disable();
    bh_lock_sock(sk);
    WARN_ON(sock_owned_by_user(sk));

    /* 增加孤儿计数 */
    percpu_counter_inc(sk->sk_prot->orphan_count);

    /* Have we already been destroyed by a softirq or backlog? */
    /* 被软中断或者backlog销毁了????? */
    if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
        goto out;

    /*    This is a (useful) BSD violating of the RFC. There is a
     *    problem with TCP as specified in that the other end could
     *    keep a socket open forever with no application left this end.
     *    We use a 1 minute timeout (about the same as BSD) then kill
     *    our end. If they send after that then tough - BUT: long enough
     *    that we won't make the old 4*rto = almost no time - whoops
     *    reset mistake.
     *
     *    Nope, it was not mistake. It is really desired behaviour
     *    f.e. on http servers, when such sockets are useless, but
     *    consume significant resources. Let's do it with special
     *    linger2    option.                    --ANK
     */

    if (sk->sk_state == TCP_FIN_WAIT2) {
        struct tcp_sock *tp = tcp_sk(sk);
        /* linger2小于0，无需等待 */
        if (tp->linger2 < 0) {

            /* 转到CLOSE */
            tcp_set_state(sk, TCP_CLOSE);
            /* 发送rst */
            tcp_send_active_reset(sk, GFP_ATOMIC);
            __NET_INC_STATS(sock_net(sk),
                    LINUX_MIB_TCPABORTONLINGER);
        } else {

            /* 获取FIN_WAIT_2超时时间 */
            const int tmo = tcp_fin_time(sk);

            /* FIN_WAIT_2超时时间> timewait时间，加FIN_WAIT_2定时器 */
            if (tmo > TCP_TIMEWAIT_LEN) {
                inet_csk_reset_keepalive_timer(sk,
                        tmo - TCP_TIMEWAIT_LEN);
            } 
            /* 小于TIME_WAIT时间，则进入TIME_WAIT */
            else {
                tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
                goto out;
            }
        }
    }

    /* 未处于CLOSE */
    if (sk->sk_state != TCP_CLOSE) {
        sk_mem_reclaim(sk);

        /* 孤儿数量过多，或者socket内存过多 */
        if (tcp_check_oom(sk, 0)) {
            /* 进入CLOSE */
            tcp_set_state(sk, TCP_CLOSE);
            /* 发送rst */
            tcp_send_active_reset(sk, GFP_ATOMIC);
            __NET_INC_STATS(sock_net(sk),
                    LINUX_MIB_TCPABORTONMEMORY);
        }
    }

    /* 处于CLOSE */
    if (sk->sk_state == TCP_CLOSE) {
        struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
        /* We could get here with a non-NULL req if the socket is
         * aborted (e.g., closed with unread data) before 3WHS
         * finishes.
         */
        if (req)
            reqsk_fastopen_remove(sk, req, false);

        /* 销毁控制块 */
        inet_csk_destroy_sock(sk);
    }
    /* Otherwise, socket is reprieved until protocol close. */

out:
    bh_unlock_sock(sk);
    local_bh_enable();
    sock_put(sk);
}