http://blog.csdn.net/zhangskd/article/details/17917401
本文主要分析:三次握手中最后一个ACK段到达时,服务器端的处理路径。
内核版本:3.6
Author:zhangskd @ csdn blog
创建新sock
协议族相关的操作函数,我们要看的是TCP/IPv4的实例ipv4_specific。
- const struct inet_connection_sock_af_ops ipv4_specific = {
- ...
- .conn_request = tcp_v4_conn_request, /* 处理SYN段 */
- .syn_recv_sock = tcp_v4_syn_recv_sock, /* 创建和初始化一个新的sock */
- ...
- };
三次握手完成以后,要为新的连接创建一个传输控制块,并初始化传输控制块。
一个TCP传输控制块是由多层组成的,包括:
tcp_sock
inet_connection_sock
inet_sock
sock
sock_common
所以,初始化要做的工作比较多。
- /* The three way handshake has completed - we got a valid synack -
- * now create the new socket.
- */
- struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb, struct request_sock *req,
- struct dst_entry *dst)
- {
- struct inet_request_sock *ireq;
- struct inet_sock *newinet;
- struct tcp_sock *newtp;
- struct sock *newsk;
- #ifdef CONFIG_TCP_MD5SIG
- struct tcp_md5sig_key *key;
- #endif
- struct ip_options_rcu *inet_opt;
- /* 如果全连接队列满了,那么返回NULL */
- if (sk_acceptq_is_full(sk))
- goto exit_overflow;
- /* 根据监听sock和req,为新连接创建一个传输控制块,并初始化 */
- newsk = tcp_create_openreq_child(sk, req, skb);
- if (! newsk)
- goto exit_nonewsk;
- newsk->sk_gso_type = SKB_GSO_TCPV4;
- inet_sk_rx_dst_set(newsk, skb); /* 保存接收路由缓存 */
- newtp = tcp_sk(newsk);
- newinet = inet_sk(newsk);
- ireq = inet_rsk(req);
- newinet->inet_daddr = ireq->rmt_addr; /* 目的IP */
- newinet->inet_rcv_saddr = ireq->loc_addr;
- newinet->inet_saddr = ireq->loc_addr; /* 源IP */
- inet_opt = ireq->opt;
- rcu_assign_pointer(newinet->inet_opt, inet_opt); /* IP选项 */
- ireq->opt = NULL;
- newinet->mc_index = inet_iif(skb);
- newinet->mc_ttl = ip_hdr(skb)->ttl;
- newinet->rcv_tos = ip_hdr(skb)->tos;
- inet_csk(newsk)->icsk_ext_hdr_len = 0;
- if (inet_opt)
- inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
- newinet->inet_id = newtp->write_seq ^ jiffies;
- if (! dst) {
- dst = inet_csk_route_child_sock(sk, newsk, req);
- if (! dst)
- goto put_and_exit;
- } else {
- /* syncookie case: see end of cookie_v4_check() */
- }
- sk_setup_caps(newsk, dst);
- tcp_mtup_init(newsk); /* MTU probe init */
- tcp_sync_mss(newsk, dst_mtu(dst));
- newtp->advmss = dst_metric_advmss(dst);
- if (tcp_sk(sk)->rx_opt.user_mss && tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
- newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
- tcp_initialize_rcv_mss(newsk);
- if (tcp_rsk(req)->snt_synack) /* 第一个RTT样本 */
- tcp_valid_rtt_meas(newsk, tcp_time_stamp - tcp_rsk(req)->snt_synack);
- newtp->total_retrans = req->retrans;
- #ifdef CONFIG_TCP_MD5SIG
- /* Copy over the MD5 key from the original socket */
- key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *) &newinet->inet_daddr, AF_INET);
- if (key != NULL) {
- /* We're using one, so create a matching key on the newsk structure.
- * If we fail to get memory, then we end up not copying the key across. Shucks.
- */
- tcp_md5_do_add(newsk, (union tcp_md5_addr *) &newinet->inet_daddr, AF_INET,
- key->key, key->keylen, GFP_ATOMIC);
- sk_nocaps_add(newsk, NETIF_F_GSO_MASK);
- }
- #endif
- /* 把newsk链入使用端口的哈希链表中,更新端口的统计信息 */
- if (__inet_inherit_port(sk, newsk) < 0)
- goto put_and_eixt;
- /* 把newsk链入ESTABLISHED状态的哈希表中 */
- __inet_hash_nolisten(newsk, NULL);
- return newsk;
- exit_overflow:
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
- exit_nonewsk:
- dst_release(dst);
- exit:
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
- return NULL;
- put_and_exit:
- tcp_clear_xmit_timers(newsk);
- tcp_cleanup_congestion_control(newsk);
- bh_unlock_sock(newsk);
- sock_put(newsk);
- goto exit;
- }
根据监听传输控制块sock、连接请求块req,为新的连接创建一个传输控制块sock。
初始化此传输控制块对应的inet_sock、inet_connection_sock、tcp_sock结构中的变量。
- struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
- {
- /* 克隆一个传输控制块,并对新的传输控制块上锁 */
- struct sock *newsk = inet_csk_clone_lock(sk, req, GFP_ATOMIC);
- if (newsk != NULL) {
- cosnt struct inet_request_sock *ireq = inet_rsk(req);
- struct tcp_request_sock *treq = tcp_rsk(req);
- struct inet_connection_sock *newicsk = inet_csk(newsk);
- struct tcp_sock *newtp = tcp_sk(newsk);
- struct tcp_sock *oldtp = tcp_sk(sk);
- struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
- /* 由于TCPCT选项已被废弃,此处不做分析 */
- if (oldcvp != NULL) { ... }
- /* Now setup tcp_sock,初始化tcp_sock实例 */
- newtp->pred_flags = 0;
- /* 接收序号、发送序号相关变量初始化 */
- newtp->rcv_wup = newtp->copied_seq = newtp->rcv_nxt = treq->rcv_isn + 1;
- newtp->snd_sml = newtp->snd_una = newtp->snd_nxt = newtp->snd_up
- = treq->snt_isn + 1 + tcp_s_data_size(oldtp);
- tcp_prequeue_init(newtp); /* prequeue队列初始化 */
- INIT_LIST_HEAD(&newtp->tsq_node);
- tcp_init_wl(newtp, treq->rcv_isn); /* 上次更新发送窗口的ACK段序号 */
- /* 时延相关变量初始化 */
- newtp->srtt = 0;
- newtp->mdev = TCP_TIMEOUT_INIT;
- newicsk->icsk_rto = TCP_TIMEOUT_INIT;
- /* 拥塞控制相关变量初始化 */
- newtp->packets_out = 0;
- newtp->retrans_out = 0;
- newtp->sacked_out = 0;
- newtp->fackets_out = 0;
- newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
- tcp_enable_early_retrans(newtp);
- newtp->snd_cwnd = TCP_INIT_CWND;
- newtp->snd_cwnd_cnt = 0;
- newtp->bytes_acked = 0;
- newtp->frto_counter = 0;
- newtp->frto_highmark = 0;
- /* 如果拥塞控制算法不为Reno,则把使用的拥塞控制算法模块引用计数加1。
- * 如果该模块还没插入内核,则使用Reno。
- */
- if (newicsk->icsk_ca_ops != &tcp_init_congestion_ops &&
- ! try_module_get(newicsk->icsk_ca_ops->owner))
- newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
- tcp_set_ca_state(newsk, TCP_CA_Open);
- tcp_init_xmit_timers(newsk); /* 初始化几个定时器 */
- skb_queue_head_init(&newtp->out_of_order_queue);
- newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1 + tcp_s_data_size(oldtp);
- /* TCP选项相关 */
- newtp->rx_opt.saw_tstamp = 0;
- newtp->rx_opt.dsack = 0;
- newtp->rx_opt.num_sacks = 0;
- newtp->urg_data = 0;
- /* 如果用户设置了SO_KEEPALIVE选项 */
- if (sock_flag(newsk, SOCK_KEEPOPEN))
- inet_csk_reset_keepalive_timer(newsk, keepalive_time_when(newtp));
- newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
- if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
- if (sysctl_tcp_fack)
- tcp_enable_fack(newtp);
- }
- newtp->window_clamp = req->window_clamp;
- newtp->rcv_ssthresh = req->rcv_wnd;
- newtp->rcv_wnd = req->rcv_wnd;
- newtp->rx_opt.wscale_ok = ireq->wscale_ok;
- if (newtp->rx_opt.wscale_ok) {
- newtp->rx_opt.snd_wscale = ireq->snd_wscale;
- newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
- } else {
- newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
- newtp->window_clamp = min(newtp->window_clamp, 65535U);
- }
- newtp->snd_wnd = (ntohs(tcp_hdr(skb)->window) << newtp->rx_opt.snd_wscale);
- newtp->max_window = newtp->snd_wnd;
- if (newtp->rx_opt.tstamp_ok) {
- newtp->rx_opt.ts_recent = req->ts_recent;
- newtp->rx_opt.ts_recent_stamp = get_seconds();
- newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
- } else {
- newtp->rx_opt.ts_recent_stamp = 0;
- newtp->tcp_header_len = sizeof(struct tcphdr);
- }
- #ifdef CONFIG_TCP_MD5SIG
- newtp->md5sig_info = NULL;
- if (newtp->af_specific->md5_lookup(sk, newsk))
- newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
- #endif
- if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
- newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
- newtp->rx_opt.mss_clamp = req->mss;
- TCP_ECN_openreq_child(newtp, req);
- TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
- }
- return newsk;
- }
克隆一个传输控制块,并对新的传输控制块上锁。
- /* inet_csk_clone_lock - clone an inet socket, and lock its clone.
- * @sk: the socket to clone
- * @req: request_sock
- * @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
- *
- * Caller must unlock socket even in error path (bh_unlock_sock(newsk))
- */
- struct sock *inet_csk_clone_lock(cons struct sock *sk, const struct request_sock *req, const gfp_t priority)
- {
- struct sock *newsk = sk_clone_lock(sk, priority); /* 从缓存中分配一个sock,并克隆sk */
- if (newsk != NULL) {
- struct inet_connection_sock *newicsk = inet_csk(newsk);
- newsk->sk_state = TCP_SYN_RECV; /* 新sock的状态为SYN_RECV */
- newicsk->icsk_bind_hash = NULL; /* 端口绑定的哈希桶 */
- inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port; /* 目的端口 */
- inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port); /* 源端口 */
- inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port; /* 源端口 */
- newsk->sk_write_space = sk_stream_write_space; /* write_space callback */
- newicsk->icsk_retransmits = 0;
- newicsk->icsk_backoff = 0;
- newicsk->icsk_probes_out = 0;
- memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue));
- security_inet_csk_clone(newsk, req);
- }
- return newsk;
- }
把newsk链入使用端口的哈希链表中,更新端口的统计信息。
- int __inet_inherit_port(struct sock *sk, struct sock *child)
- {
- struct inet_hashinfo *table = sk->sk_prot->h.hashinfo; /* 指向tcp_hashinfo */
- unsigned short port = inet_sk(child)->inet_num; /* 端口 */
- const int bhash = inet_bhashfn(sock_net(sk), port, table->bhash_size); /* 哈希值 */
- struct inet_bind_hashbucket *head = &table->bhash[bhash]; /* 哈希桶 */
- struct inet_bind_bucket *tb; /* 端口实例 */
- spin_lock(&head->lock); /* 对哈希桶上锁 */
- tb = inet_csk(sk)->icsk_bind_hash;
- if (tb->port != port) {
- /* NOTE: using tproxy and redirecting skbs to a proxy on a different listener port
- * breaks the assumption that the listener socket's icsk_bind_hash is the same
- * as that of the child socket. We have to look up or create a new bind bucket for
- * the child here.
- */
- struct hlist_node *node;
- inet_bind_bucket_for_each(tb, node, &head->chain) {
- if (net_eq(ib_net(tb), sock_net(sk)) && tb->port == port)
- break;
- }
- if (! node) {
- /* 申请和初始化一个inet_bind_bucket */
- tb = inet_bind_bucket_create(table->bind_bucket_cachep, sock_net(sk), head, port);
- if (! tb) {
- spin_unlock(&head->lock);
- return -ENOMEM;
- }
- }
- }
- inet_bind_hash(child, tb, port); /* 把child链入该端口的哈希链表中,更新相关变量 */
- spin_unlock(&head->lock);
- return 0;
- }
- void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb, const unsigned short snum)
- {
- struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; /* 指向tcp_hashinfo */
- atomic_inc(&hashinfo->bsockets); /* 增加总的绑定次数 */
- inet_sk(sk)->inet_num = snum; /* 保存绑定的端口 */
- sk_add_bind_node(sk, &tb->owners); /* 把此sock链入tb->owners哈希链表中 */
- tb->num_owners++; /* 增加端口绑定次数 */
- inet_csk(sk)->icsk_bind_hash = tb; /* 把此tb作为icsk成员icsk_bind_hash */
- }
把newsk链入ESTABLISHED状态的哈希表中。
- int __inet_hash_nolisten(struct sock *sk, struct inet_timewait_sock *tw)
- {
- struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
- struct hlist_nulls_head *list;
- spinlock_t *lock;
- struct inet_ehash_bucket *head;
- int twrefcnt = 0;
- WARN_ON(! sk_unhashed(sk)); /* 要求sk不能已经链入哈希链表中 */
- sk->sk_hash = inet_sk_ehashfn(sk); /* 连接的哈希值 */
- head = inet_ehash_bucket(hashinfo, sk->sk_hash); /* 哈希桶 */
- list = &head->chain;
- lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
- spin_lock(lock);
- __sk_nulls_add_node_rcu(sk, list); /* 把sk链入到哈希链表中 */
- if (tw) {
- WARN_ON(sk->sk_hash != tw->tw_hash);
- twrefcnt = inet_twsk_unhash(tw);
- }
- spin_unlock(lock);
- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
- return twrefcnt;
- }
- static inline int inet_sk_ehashfn(const struct sock *sk)
- {
- const struct inet_sock *inet = inet_sk(sk);
- const __be32 laddr = inet->inet_rcv_saddr;
- const __u16 lport = inet->inet_num;
- const __be32 faddr = inet->inet_daddr;
- const __be16 fport = inet->inet_dport;
- struct net *net = sock_net(sk);
- return inet_ehashfn(net, laddr, lport, faddr, fport);
- }
唤醒监听进程
调用tcp_child_process()来做最后的处理:
1. tcp_ack()处理接收到的ACK,更新child的状态为ESTABLISHED。
唤醒child上的等待进程,初始化子传输控制块的一些字段。
2. 唤醒监听sock上的等待进程,以便监听进程执行accept()。
3. 如果child被用户进程占用,则先把ACK段添加到backlog队列中。
- /* Queue segment on the new socket if the new socket is active,
- * otherwise we just shortcircuit this and continue with the new socket.
- */
- int tcp_child_process(struct sock *parent, struct sock *child, sk_buff *skb)
- {
- int ret = 0;
- int state = child->sk_state;
- /* child没被用户进程占用 */
- if (! sock_owned_by_user(child)) {
- /* 调用tcp_ack()处理接收的ACK,设置新状态ESTABLISHED,唤醒child上的等待进程,
- * 初始化child的一些字段。
- */
- ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb), skb->len);
- /* Wakeup parent, send SIGIO.
- * 实例为sock_def_readable,唤醒调用accept()的进程。
- */
- if (state == TCP_SYN_RECV && child->sk_state != state)
- parent->sk_data_ready(parent, 0);
- } else { /* 如果child被用户进程占用,则先把skb添加到backlog队列中 */
- __sk_add_backlog(child, skb);
- }
- bh_unlock_sock(child);
- sock_put(child);
- return ret;
- }
把数据包添加到backlog队列中。
- static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
- {
- /* dont let skb not refcounted, we are going to leave rcu lock */
- skb_dst_force(skb);
- /* backlog队列为空时 */
- if (! sk->sk_backlog.tail)
- sk->sk_backlog.head = skb;
- else
- sk->sk_backlog.tail->next = skb;
- sk->sk_backlog.tail = skb;
- skb->next = NULL;
- }
子传输控制块调用tcp_ack()处理收到的ACK,把子传输控制块的状态从TCP_SYN_RECV更新为TCP_ESTABLISHED,
并唤醒子传输控制块上的等待进程,更新子传输控制块的一些字段。
- int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, const struct tcphdr *th, unsigned int len)
- {
- struct tcp_sock *tp = tcp_sk(sk);
- struct inet_connection_sock *icsk = inet_csk(sk);
- int queued = 0;
- tp->rx_opt.saw_tstamp = 0;
- switch(sk->sk_state) {
- ...
- }
- if (! tcp_validate_incoming(sk, skb, th, 0))
- return 0;
- /* step 5: check the ACK field */
- if (th->ack) {
- int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0; /* 进入ACK处理路径 */
- switch (sk->sk_state) {
- case TCP_SYN_RECV:
- if (acceptable) {
- tp->copied_seq = tp->rcv_nxt;
- smp_mb();
- /* 在这里,才从TCP_SYN_RECV变为TCP_ESTABLISHED */
- tcp_set_state(sk, TCP_ESTABLISHED);
- sk->sk_state_change(sk); /* 实例为sock_def_wakeup(),唤醒sk上的等待进程*/
- /* Note, that this wakeup is only for marginal crossed SYN case.
- * Passively Open sockets are not waked up, because sk->sk_sleep == NULL
- * and sk->sk_socket == NULL.
- */
- if (sk->sk_socket)
- sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
- tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
- tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
- tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
- if (tp->rx_opt.tstamp_ok)
- tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
- /* Make sure socket is routed, for correct metrics. */
- icsk->icsk_af_ops->rebuild_header(sk);
- tcp_init_metrics(sk); /* 根据路由缓存信息初始化控制块 */
- tcp_init_congestion_control(sk); /* 初始化拥塞控制算法 */
- /* Prevent spurious tcp_cwnd_restart() on first data packet. */
- tp->lsndtime = tcp_time_stamp;
- tcp_mtup_init(sk);
- tcp_initialize_rcv_mss(sk);
- tcp_init_buffer_space(sk);
- tcp_fast_path_on(tp);
- } else
- return 1;
- break;
- ...
- }
- } else
- goto discard;
- ...
- discard:
- __kfree_skb(skb);
- }
- return 0;
- }
- static void sock_def_wakeup(struct sock *sk)
- {
- struct socket_wq *wq;
- rcu_read_lock();
- wq = rcu_dereference(sk->sk_wq);
- if (wq_has_sleeper(wq)) /* 如果sock上有等待任务 */
- wake_up_interruptible_all(&wq->wait); /* 唤醒全部的等待任务 */
- rcu_read_unlock();
- }
- /* check if there are any waiting processes. */
- static inline bool wq_has_sleeper(struct socket_wq *wq)
- {
- smp_mb();
- return wq && waitqueue_active(&wq->wait);
- }
- static inline int waitqueue_active(wait_queue_head_t *q)
- {
- return ! list_empty(&q->task_list);
- }
- #define wake_up_interruptible_all(x) __wake_up(x, TASK_INTERRUPTIBLE, 0, NULL)
- void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr_exclusive, void *key)
- {
- unsigned long flags;
- spin_lock_irqsave(&q->lock, flags);
- __wake_up_common(q, mode, nr_exclusive, 0, key);
- spin_unlock_irqrestore(&q->lock, flags);
- }
- static void __wake_up_common(wait_queue_head_t *q, unsigned int mode, int nr_exclusive,
- int wake_flags, void *key)
- {
- wait_queue_t *curr, *next;
- list_for_each_entry_safe(curr, next, &q->task_list, task_list) {
- unsigned flags = curr->flags;
- if (curr->func(curr, mode, wake_flags, key) && (flags & WQ_FLAG_EXCLUSIVE) && !--nr_exclusive)
- break;
- }
- }