IP输出 之 分片ip_fragment、ip_do_fragment

概述

ip_fragment函数用于判断是否进行分片，在没有设置DF标记的情况下进入分片，如果设置了DF标记，则继续判断，如果不允许DF分片或者收到的最大分片大于MTU大小，则回复ICMP，释放skb，其余情况仍然需要走分片；

ip_do_fragment是详细的分片流程，整个过程分为快速分片和慢速分片两种，如果存在分片列表frag_list，并且通过检查，则走快速路径，复制每个分片的ip头等信息之后，发送出去；如果不存在分片列表，或者分片列表检查失败，则走慢速路径，慢速路径会根据MTU大小，对整个数据进行重新划分，分配skb，进行数据拷贝，设置ip头等信息，然后发送出去；

源码分析

static int ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
               unsigned int mtu,
               int (*output)(struct net *, struct sock *, struct sk_buff *))
{
    struct iphdr *iph = ip_hdr(skb);

    /* 如果没有DF标记，则进行分片 */
    if ((iph->frag_off & htons(IP_DF)) == 0)
        return ip_do_fragment(net, sk, skb, output);
    
    /* 有DF标记则继续判断 */

    /* 不允许本地分片 || 分片最大长度>MTU */
    if (unlikely(!skb->ignore_df ||
             (IPCB(skb)->frag_max_size &&
              IPCB(skb)->frag_max_size > mtu))) {
        IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
        /* ICMP错误 */
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
              htonl(mtu));
        /* 释放skb */
        kfree_skb(skb);
        return -EMSGSIZE;
    }

    /* 其他情况，继续分片 */
    return ip_do_fragment(net, sk, skb, output);
}

int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
           int (*output)(struct net *, struct sock *, struct sk_buff *))
{
    struct iphdr *iph;
    int ptr;
    struct sk_buff *skb2;
    unsigned int mtu, hlen, left, len, ll_rs;
    int offset;
    __be16 not_last_frag;
    struct rtable *rt = skb_rtable(skb);
    int err = 0;

    /* for offloaded checksums cleanup checksum before fragmentation */
    /* PARTIAL类型需要清除校验和 */
    if (skb->ip_summed == CHECKSUM_PARTIAL &&
        (err = skb_checksum_help(skb)))
        goto fail;

    /*
     *    Point into the IP datagram header.
     */

    iph = ip_hdr(skb);

    /* 获取mtu */
    mtu = ip_skb_dst_mtu(sk, skb);

    /* 接收到的最大分片长度 < mtu，则将mtu设置为该值 */
    if (IPCB(skb)->frag_max_size && IPCB(skb)->frag_max_size < mtu)
        mtu = IPCB(skb)->frag_max_size;

    /*
     *    Setup starting values.
     */

    hlen = iph->ihl * 4;
    mtu = mtu - hlen;    /* Size of data space */
    IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;

    /* When frag_list is given, use it. First, check its validity:
     * some transformers could create wrong frag_list or break existing
     * one, it is not prohibited. In this case fall back to copying.
     *
     * LATER: this step can be merged to real generation of fragments,
     * we can switch to copy when see the first bad fragment.
     */
    /* 有分片列表 */
    if (skb_has_frag_list(skb)) {
        struct sk_buff *frag, *frag2;

        /* 线性区域和分页区的数据长度 */
        unsigned int first_len = skb_pagelen(skb);

        /* 以下情况，进入慢路处理 */
        if (first_len - hlen > mtu || /* 分片长度>MTU */
            ((first_len - hlen) & 7) || /* 没有8字节对齐 */
            ip_is_fragment(iph) || /* 是一个分片 */
            skb_cloned(skb)) /* 是克隆的 */
            goto slow_path;

        /* 遍历分片列表 */
        skb_walk_frags(skb, frag) {
            /* Correct geometry. */
            /* 以下情况，恢复状态，进入慢速路径 */
            if (frag->len > mtu || /* 分片长度>mtu */
                ((frag->len & 7) && frag->next) || /* 除最后一个分片外，其余有非8字节对齐的 */
                skb_headroom(frag) < hlen) /* 头部长度过小 */
                goto slow_path_clean;

            /* Partially cloned skb? */
            /* 克隆的，恢复状态，进入慢速路径 */    
            if (skb_shared(frag))
                goto slow_path_clean;

            BUG_ON(frag->sk);

            /* 分片关联控制块 */
            if (skb->sk) {
                frag->sk = skb->sk;
                frag->destructor = sock_wfree;
            }

            /* 第一个skb的长度去掉当前分片的长度 */
            skb->truesize -= frag->truesize;
        }

        /* Everything is OK. Generate! */

        /* 现在分片没问题了，设置分片信息 */
        err = 0;
        offset = 0;
        frag = skb_shinfo(skb)->frag_list;
        skb_frag_list_init(skb);
        skb->data_len = first_len - skb_headlen(skb);
        skb->len = first_len;
        iph->tot_len = htons(first_len);
        iph->frag_off = htons(IP_MF);
        ip_send_check(iph);

        /* 循环设置分片信息，并发送 */
        for (;;) {
            /* Prepare header of the next frame,
             * before previous one went down. */
             /* 为每一片都拷贝ip头，设置偏移信息 */
            if (frag) {
                frag->ip_summed = CHECKSUM_NONE;
                skb_reset_transport_header(frag);
                __skb_push(frag, hlen);
                skb_reset_network_header(frag);
                memcpy(skb_network_header(frag), iph, hlen);
                iph = ip_hdr(frag);
                iph->tot_len = htons(frag->len);
                ip_copy_metadata(frag, skb);
                if (offset == 0)
                    ip_options_fragment(frag);
                offset += skb->len - hlen;
                iph->frag_off = htons(offset>>3);
                if (frag->next)
                    iph->frag_off |= htons(IP_MF);
                /* Ready, complete checksum */
                ip_send_check(iph);
            }

            /* 调用发送回调 */
            err = output(net, sk, skb);

            if (!err)
                IP_INC_STATS(net, IPSTATS_MIB_FRAGCREATES);
            if (err || !frag)
                break;

            skb = frag;
            frag = skb->next;
            skb->next = NULL;
        }

        if (err == 0) {
            IP_INC_STATS(net, IPSTATS_MIB_FRAGOKS);
            return 0;
        }

        /* 出错，释放分片 */
        while (frag) {
            skb = frag->next;
            kfree_skb(frag);
            frag = skb;
        }
        IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
        return err;

slow_path_clean:
        /* 将分片恢复原状态 */
        skb_walk_frags(skb, frag2) {
            if (frag2 == frag)
                break;
            frag2->sk = NULL;
            frag2->destructor = NULL;
            skb->truesize += frag2->truesize;
        }
    }

slow_path:
    /* 慢速分片路径 */


    iph = ip_hdr(skb);

    /* 除去首部的剩余空间 */
    left = skb->len - hlen;        /* Space per frame */
    ptr = hlen;        /* Where to start from */

    /* 二层头部空间 */
    ll_rs = LL_RESERVED_SPACE(rt->dst.dev);

    /*
     *    Fragment the datagram.
     */

    /* 初始化mf和offset */
    offset = (ntohs(iph->frag_off) & IP_OFFSET) << 3;
    not_last_frag = iph->frag_off & htons(IP_MF);

    /*
     *    Keep copying data until we run out.
     */

    /* 开始分片了 */
    while (left > 0) {
        /* len初始为剩余长度 */
        len = left;
        /* IF: it doesn't fit, use 'mtu' - the data space left */
        /* 根据mtu确认长度 */
        if (len > mtu)
            len = mtu;
        /* IF: we are not sending up to and including the packet end
           then align the next start on an eight byte boundary */
        /* 除最后分片外，其余8字节对齐 */
        if (len < left)    {
            len &= ~7;
        }

        /* Allocate buffer */
        /* 分配skb */
        skb2 = alloc_skb(len + hlen + ll_rs, GFP_ATOMIC);
        if (!skb2) {
            err = -ENOMEM;
            goto fail;
        }

        /*
         *    Set up data on packet
         */

        /* 拷贝元数据 */
        ip_copy_metadata(skb2, skb);

        /* 预留空间，设置头部偏移 */
        skb_reserve(skb2, ll_rs);
        skb_put(skb2, len + hlen);
        skb_reset_network_header(skb2);
        skb2->transport_header = skb2->network_header + hlen;

        /*
         *    Charge the memory for the fragment to any owner
         *    it might possess
         */
        /* 关联sk */
        if (skb->sk)
            skb_set_owner_w(skb2, skb->sk);

        /*
         *    Copy the packet header into the new buffer.
         */

        /* 拷贝头部 */
        skb_copy_from_linear_data(skb, skb_network_header(skb2), hlen);

        /*
         *    Copy a block of the IP datagram.
         */
        /* 拷贝数据 */
        if (skb_copy_bits(skb, ptr, skb_transport_header(skb2), len))
            BUG();
        left -= len;

        /*
         *    Fill in the new header fields.
         */
        iph = ip_hdr(skb2);

        /* 设置偏移 *//
        iph->frag_off = htons((offset >> 3));

        /* 转发的数据包，带有FRAG_PMTU标记，则打上DF */
        if (IPCB(skb)->flags & IPSKB_FRAG_PMTU)
            iph->frag_off |= htons(IP_DF);

        /* ANK: dirty, but effective trick. Upgrade options only if
         * the segment to be fragmented was THE FIRST (otherwise,
         * options are already fixed) and make it ONCE
         * on the initial skb, so that all the following fragments
         * will inherit fixed options.
         */
        /* 第一个分片包含ip选项 */
        if (offset == 0)
            ip_options_fragment(skb);

        /*
         *    Added AC : If we are fragmenting a fragment that's not the
         *           last fragment then keep MF on each bit
         */
        /* 不是最后分片需要设定MF标记 */
        if (left > 0 || not_last_frag)
            iph->frag_off |= htons(IP_MF);

        /* 指针和偏移更新 */
        ptr += len;
        offset += len;

        /*
         *    Put this fragment into the sending queue.
         */
        /* 设置数据长度 */
        iph->tot_len = htons(len + hlen);

        /* 校验和 */
        ip_send_check(iph);

        /* 发送分片 */
        err = output(net, sk, skb2);
        if (err)
            goto fail;

        IP_INC_STATS(net, IPSTATS_MIB_FRAGCREATES);
    }

    /* 分片完成并发送，释放skb */
    consume_skb(skb);
    IP_INC_STATS(net, IPSTATS_MIB_FRAGOKS);
    return err;

fail:

    /* 出错，释放skb */
    kfree_skb(skb);
    IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
    return err;
}