数据包在L4被挂入接收队列过程

在前一篇博文中，分析了数据包在IP层接收过程，如果是发给本机，最终数据包会送给L4来处理。下面以UDP协议为例来分析L4的处理过程：
1. udp_rcv是封装函数，直接调用__udp4_lib_rcv函数来处理，那么我们来看看这个函数：

点击(此处)折叠或打开

1. /*
   
2.  *    All we need to do is get the socket, and then do a checksum.
   
3.  */
   
4. 
   
5. int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
   
6.          int is_udplite)
   
7. {
   
8.     struct sock *sk;  //这个结构体很重要，它和socket结构体相关联，也就是说根据一个就可以得到另一个
   
9.     struct udphdr *uh = skb->h.uh; //从skb结构体中取得源端口号和目的端口号
   
10.     unsigned short ulen;
    
11.     struct rtable *rt = (struct rtable*)skb->dst;
    
12.     __be32 saddr = skb->nh.iph->saddr;  //从skb结构体中取得源IP地址和目的IP地址
    
13.     __be32 daddr = skb->nh.iph->daddr;
    
14. 
    
15.     /*
    
16.      * Validate the packet.
    
17.      */
    
18.     if (!pskb_may_pull(skb, sizeof(struct udphdr)))
    
19.         goto drop;        /* No space for header. */
    
20. 
    
21.     ulen = ntohs(uh->len);
    
22.     if (ulen > skb->len)
    
23.         goto short_packet;
    
24. 
    
25.     if(! is_udplite ) {        /* UDP validates ulen. */
    
26. 
    
27.         if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
    
28.             goto short_packet;
    
29.         uh = skb->h.uh;
    
30. 
    
31.         udp4_csum_init(skb, uh);
    
32. 
    
33.     } else     {            /* UDP-Lite validates cscov. */
    
34.         if (udplite4_csum_init(skb, uh))
    
35.             goto csum_error;
    
36.     }
    
37. 
    
38.     if(rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))  //如果是L3广播或组播报文，进入相应的处理
    
39.         return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
    
40. 
    
41.     sk = __udp4_lib_lookup(saddr, uh->source, daddr, uh->dest,
    
42.              skb->dev->ifindex, udptable );        //这是这个函数所做的主要工作之一:根据目的端口号，找到应用层创建的socket
    
43. 
    
44.     if (sk != NULL) {
    
45.         int ret = udp_queue_rcv_skb(sk, skb);    //如果找到这个socket，就把skb挂入到此socket的接收队列中
    
46.         sock_put(sk);
    
47. 
    
48.         /* a return value > 0 means to resubmit the input, but
    
49.          * it wants the return to be -protocol, or 0
    
50.          */
    
51.         if (ret > 0)       //在这里这个数据包从网卡芯片往协议栈送的过程就算结束了
    
52.             return -ret;
    
53.         return 0;
    
54.     }
    
55. 
    
56.     if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
    
57.         goto drop;
    
58.     nf_reset(skb);
    
59. 
    
60.     /* No socket. Drop packet silently, if checksum is wrong */
    
61.     if (udp_lib_checksum_complete(skb))
    
62.         goto csum_error;
    
63. 
    
64.     UDP_INC_STATS_BH(UDP_MIB_NOPORTS, is_udplite);
    
65.     icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);   //如果挂入失败的话，就给源主机发送目标不可达ICMP报文
    
66. 
    
67.     /*
    
68.      * Hmm. We got an UDP packet to a port to which we
    
69.      * don't wanna listen. Ignore it.
    
70.      */
    
71.     kfree_skb(skb);  //释放掉，此skb，over...
    
72.     return(0);
    
73. 
    
74. short_packet:
    
75.     LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
    
76.          is_udplite? "-Lite" : "",
    
77.          NIPQUAD(saddr),
    
78.          ntohs(uh->source),
    
79.          ulen,
    
80.          skb->len,
    
81.          NIPQUAD(daddr),
    
82.          ntohs(uh->dest));
    
83.     goto drop;
    
84. 
    
85. csum_error:
    
86.     /*
    
87.      * RFC1122: OK. Discards the bad packet silently (as far as
    
88.      * the network is concerned, anyway) as per 4.1.3.4 (MUST).
    
89.      */
    
90.     LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
    
91.          is_udplite? "-Lite" : "",
    
92.          NIPQUAD(saddr),
    
93.          ntohs(uh->source),
    
94.          NIPQUAD(daddr),
    
95.          ntohs(uh->dest),
    
96.          ulen);
    
97. drop:
    
98.     UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
    
99.     kfree_skb(skb);
    
100.     return(0);
     
101. }

   一百多行啊，呵呵！
    函数的注释，正确的归纳了这个函数的处理过程：取得相应的socket, 做一些检查。其实还应该加一句，把skb挂入socket的接收队列中。
2. 从上面的代码可以看出，此过程比较简单。分析一下根据端口号找socket的过程和将skb挂入socket接收队列的过程：
  

点击(此处)折叠或打开

1. /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
   
2.  * harder than this. -DaveM
   
3.  */
   
4. static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
   
5.                  __be32 daddr, __be16 dport,
   
6.                  int dif, struct hlist_head udptable[])
   
7. {
   
8.     struct sock *sk, *result = NULL;
   
9.     struct hlist_node *node;
   
10.     unsigned short hnum = ntohs(dport);
    
11.     int badness = -1;
    
12. 
    
13.     read_lock(&udp_hash_lock);  //这个过程得加锁
    
14.     sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {    //udptable这个哈希数组在bind绑定端口号的时候已经构建好了，在这里就是用端口号来
15.                                                                         //从hlist链表中取得sock结构
    
16.         struct inet_sock *inet = inet_sk(sk);
    
17. 
    
18.         if (sk->sk_hash == hnum && !ipv6_only_sock(sk)) {   //找到了bind了相同端口号的socket
    
19.             int score = (sk->sk_family == PF_INET ? 1 : 0);
    
20.             if (inet->rcv_saddr) {              //在bind的时候绑定了自己本身的IP地址，判断对端发送数据包中的目的IP地址是否和自己匹配
    
21.                 if (inet->rcv_saddr != daddr)
    
22.                     continue;
    
23.                 score+=2;
    
24.             }
    
25.             if (inet->daddr) {            
    
26.                 if (inet->daddr != saddr)  //看socket端的目的地址和数据包的源地址
    
27.                     continue;
    
28.                 score+=2;
    
29.             }
    
30.             if (inet->dport) {            
    
31.                 if (inet->dport != sport)  //看socket端的目的端口和数据包的源端口
    
32.                     continue;
    
33.                 score+=2;
    
34.             }
    
35.             if (sk->sk_bound_dev_if) {     //看绑定的接口 ？
    
36.                 if (sk->sk_bound_dev_if != dif)
    
37.                     continue;
    
38.                 score+=2;
    
39.             }
    
40.             if(score == 9) {
    
41.                 result = sk;
    
42.                 break;
    
43.             } else if(score > badness) {
    
44.                 result = sk;
    
45.                 badness = score;
    
46.             }
    
47.         }
    
48.     }
    
49.     if (result)
    
50.         sock_hold(result);
    
51.     read_unlock(&udp_hash_lock);
    
52.     return result;
    
53. }

  从上面的代码中我们看到通过数据包的目的端口号，从udp_hash中找到bind相同端口号的socket，然后从中找到一个最佳的socket(score来计分，呵呵)，如果分值一样就取得最后bind的socket。现在我们知道了，可以建立多个socket
来bind相同的端口号(但是得用setsockopt设置socket属性为SO_REUSEADDR,否则会bind失败)，如果这些socket属性一样(score分值一样)，那么只有最后bind的socket有效，也就是说接收到的数据包会传给这个socket，其他socket接收不到skb。

点击(此处)折叠或打开

1. int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
   
2. {
   
3.     struct udp_sock *up = udp_sk(sk);
   
4.     int rc;
   
5. 
   
6.     /*
   
7.      *    Charge it to the socket, dropping if the queue is full.
   
8.      */
   
9.     if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
   
10.         goto drop;
    
11.     nf_reset(skb);
    
12. 
    
13.     if (up->encap_type) {
    
14.         /*
    
15.          * This is an encapsulation socket, so let's see if this is
    
16.          * an encapsulated packet.
    
17.          * If it's a keepalive packet, then just eat it.
    
18.          * If it's an encapsulateed packet, then pass it to the
    
19.          * IPsec xfrm input and return the response
    
20.          * appropriately. Otherwise, just fall through and
    
21.          * pass this up the UDP socket.
    
22.          */
    
23.         int ret;
    
24. 
    
25.         ret = udp_encap_rcv(sk, skb);
    
26.         if (ret == 0) {
    
27.             /* Eat the packet .. */
    
28.             kfree_skb(skb);
    
29.             return 0;
    
30.         }
    
31.         if (ret < 0) {
    
32.             /* process the ESP packet */
    
33.             ret = xfrm4_rcv_encap(skb, up->encap_type);
    
34.             UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
    
35.             return -ret;
    
36.         }
    
37.         /* FALLTHROUGH -- it's a UDP Packet */
    
38.     }
    
39. 
    
40.     /*
    
41.      *     UDP-Lite specific tests, ignored on UDP sockets
    
42.      */
    
43.     if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    
44. 
    
45.         /*
    
46.          * MIB statistics other than incrementing the error count are
    
47.          * disabled for the following two types of errors: these depend
    
48.          * on the application settings, not on the functioning of the
    
49.          * protocol stack as such.
    
50.          *
    
51.          * RFC 3828 here recommends (sec 3.3): "There should also be a
    
52.          * way ... to ... at least let the receiving application block
    
53.          * delivery of packets with coverage values less than a value
    
54.          * provided by the application."
    
55.          */
    
56.         if (up->pcrlen == 0) { /* full coverage was set */
    
57.             LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
    
58.                 "%d while full coverage %d requested\n",
    
59.                 UDP_SKB_CB(skb)->cscov, skb->len);
    
60.             goto drop;
    
61.         }
    
62.         /* The next case involves violating the min. coverage requested
    
63.          * by the receiver. This is subtle: if receiver wants x and x is
    
64.          * greater than the buffersize/MTU then receiver will complain
    
65.          * that it wants x while sender emits packets of smaller size y.
    
66.          * Therefore the above ...()->partial_cov statement is essential.
    
67.          */
    
68.         if (UDP_SKB_CB(skb)->cscov < up->pcrlen) {
    
69.             LIMIT_NETDEBUG(KERN_WARNING
    
70.                 "UDPLITE: coverage %d too small, need min %d\n",
    
71.                 UDP_SKB_CB(skb)->cscov, up->pcrlen);
    
72.             goto drop;
    
73.         }
    
74.     }
    
75. 
    
76.     if (sk->sk_filter && skb->ip_summed != CHECKSUM_UNNECESSARY) {
    
77.         if (__udp_lib_checksum_complete(skb))
    
78.             goto drop;
    
79.         skb->ip_summed = CHECKSUM_UNNECESSARY;
    
80.     }
    
81. 
    
82.     if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {    //在这里挂入的，这个函数里面有文章...
    
83.         /* Note that an ENOMEM error is charged twice */
    
84.         if (rc == -ENOMEM)
    
85.             UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, up->pcflag);
    
86.         goto drop;
    
87.     }
    
88. 
    
89.     UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
    
90.     return 0;
    
91. 
    
92. drop:
    
93.     UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);
    
94.     kfree_skb(skb);
    
95.     return -1;
    
96. }

点击(此处)折叠或打开

1. int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
   
2. {
   
3.     int err = 0;
   
4.     int skb_len;
   
5. 
   
6.     /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
   
7.      number of warnings when compiling with -W --ANK
   
8.      */
   
9.     if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=   //sk_rmem_alloc是对接收的skb大小的累加和，当接收到skb时，sk_rmem_alloc增加，当从队列中取出并释放skb时，sk_rmem_alloc减少
10.      (unsigned)sk->sk_rcvbuf) {                              //sk_rcvbuf 这个是接收缓冲区的大小，我们可以通过setsockopt进行设置。我们看到当从接收队列取包的速度小于接收到包的时候，我们
11.                                                              //适当增加sk_rcvbuf这个缓冲区的大小就一定程度上减少丢包。
    
12.                                                             
    
13.         err = -ENOMEM;
    
14.         goto out;
    
15.     }
    
16. 
    
17.     err = sk_filter(sk, skb);
    
18.     if (err)
    
19.         goto out;
    
20. 
    
21.     skb->dev = NULL;
    
22.     skb_set_owner_r(skb, sk); //这个函数是对sk_rmem_alloc字段的操作
    
23. 
    
24.     /* Cache the SKB length before we tack it onto the receive
    
25.      * queue. Once it is added it no longer belongs to us and
    
26.      * may be freed by other threads of control pulling packets
    
27.      * from the queue.
    
28.      */
    
29.     skb_len = skb->len;
    
30. 
    
31.     skb_queue_tail(&sk->sk_receive_queue, skb);    //把skb挂入到sk_receive_queue中
    
32. 
    
33.     if (!sock_flag(sk, SOCK_DEAD))
    
34.         sk->sk_data_ready(sk, skb_len);
    
35. out:
    
36.     return err;
    
37. }

点击(此处)折叠或打开

1. static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
   
2. {
   
3.     skb->sk = sk;
   
4.     skb->destructor = sock_rfree;
   
5.     atomic_add(skb->truesize, &sk->sk_rmem_alloc); //还是个原子操作
   
6. }
   
7. 
   
8. 
   
9. 
   
10. void sock_rfree(struct sk_buff *skb)  //这个是在free skb的时候调用的
    
11. {
    
12.     struct sock *sk = skb->sk;
    
13. 
    
14.     atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
    
15. }