不论是18版，还是37版，一开始都会从TCP的控制块中取出SACK选项的起始地址。
SACK选项的起始地址是保存在tcp_skb_cb结构的sacked项中的，那么这是在什么时候做的呢？
SACK块并不是总是合法的，非法的SACK块可能会引起处理错误，所以还需要进行SACK块的合法性检查。
本文主要内容：TCP首部中SACK选项的解析和地址的获取，SACK块的合法性检查。
Author：zhangskd @ csdn
SACK选项的地址
TCP_SKB_CB(skb)->sacked is initialized to offset corresponding to the start of the SACK option in the
TCP header for the segment received.
处理时机为：
tcp_rcv_established()，进入慢速路径时调用
| --> tcp_validate_incoming()
| --> tcp_fast_parse_options()
| --> tcp_parse_options()
在慢速路径中，有可能只带有TIMESTAMP选项，因此先用tcp_fast_parse_options()快速解析。
/* Fast parse options. This hopes to only see timestamps.
* If it is wrong it falls back on tcp_parse_options().
*/
static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th, struct tcp_sock *tp, u8 **hvpp)
{
/* In the spirit of fast parsing, compare doff directly to constant values.
* Because equality is used, short doff can be ignored here.
*/
if (th->doff == (sizeof(*th) / 4)) { /* 没有带选项 */
tp->rx_opt.saw_tstamp = 0;
return 0; } else if (tp->rx_opt.tstamp_ok &&
th->doff == ((sizeof(*th) + TCPOLEN_TSTAMP_ALIGNED) / 4)) { /* 只带有时间戳选项 */
if (tcp_parse_aligned_timestamp(tp, th))
return 1;
} /* 如果以上的快速解析失败，则进行全面解析 */
tcp_parse_options(skb, &tp->rx_opt, hvpp, 1); return 1;
}
static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
{
__be32 *ptr = (__be32 *) (th + 1); /* 指向选项部分 */ /* 如果选项部分的前4个字节分别为：0x 01 01 08 0A */
if (*ptr == htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
| (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP)) { tp->rx_opt.saw_tstamp = 1;
++ptr; tp->rx_opt.rcv_tsval = ntohl(*ptr); /* 提取接收包的时间戳*/
++ptr; tp->rx_opt.rcv_tsecr = ntohl(*ptr); /* 提取接收包的回显值*/
return 1;
} return 0;
}
在慢速路径中，如果tcp_fast_parse_options()失败，则调用tcp_parse_options()全面解析TCP选项。
/* Look for tcp options. Normally only called on SYN and SYNACK packets.
* But, this can also be called on packets in the established flow when the fast version
* below fails.
*/
void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx, u8 **hvpp, int estab)
{
unsigned char *ptr;
struct tcphdr *th = tcp_hdr(skb);
int length = (th->doff * 4) - sizeof(struct tcphdr); /* 选项总长度 */ ptr = (unsigned char *) (th + 1); /* 选项起始地址 */
opt_rx->saw_tstamp = 0; /* 此ACK有没有带时间戳接下来才知道 */ while (length > 0) {
int opcode = *ptr++; /* 选项kind */
int opsize; switch (opcode) {
case TCPOPT_EOL: /* 结束选项，不常见到 */
return; case TCPOPT_NOP: /* 填充选项 */
length--; /* 此选项只占一个字节 */
continue; default:
opsize = *ptr++; /* 此选项长度 */ if (opsize < 2) /* "silly options" */
return; /* 选项长度过小 */ if (opsize > length)
return; /* don't parse partial options */ switch (opcode) {
...
case TCPOPT_SACK_PERM:
if (opsize == TCPOLEN_SACK_PERM && th->syn &&
!estab && sysctl_tcp_sack) { opt_rx->sack_ok = 1; /* SYN包中显示支持SACK */
tcp_sack_reset(opt_rx); /* 清空dsack和num_sacks */
}
break; case TCPOPT_SACK:
if ((opsize >= (TCPOLEN_SACK_BASE + TCPOLEN_SACK_PERBLOCK)) &&
!((opsize - TCPOLEN_SACK_BASE) % TCPOLEN_SACK_PERBLOCK) &&
opt_rx->sack_ok) { /*保存SACK选项的起始地址偏移*/
TCP_SKB_CB(skb)->sacked = (ptr - 2) - (unsigned char *) th;
}
break;
...
}
}
}
}
/* TCP options */
#define TCPOPT_NOP 1 /* Padding */
#define TCPOPT_EOL 0 /* End of options */
#define TCPOPT_MSS 2 /* Segment size negotiating */
#define TCPOPT_WINDOW 3 /* Window Scaling */
#define TCPOPT_SACK_PERM 4 /* SACK Permitted */
#define TCPOPT_SACK 5 /* SACK Block */
#define TCPOPT_TIMESTAMP 8 /* Better RTT estimations/PAWS */ static inline void tcp_sack_reset(struct tcp_options_received *rx_opt)
{
rx_opt->dsack = 0;
rx_opt->num_sacks = 0;
} /* This is the max number of SACKS that we'll generate and process.
* It's safe to increase this, although since:
* size = TCPOLEN_SACK_BASE_ALIGNED(4) + n * TCPOLEN_SACK_PERBLOCK(8)
* only four options will fit in a standard TCP header
*/
#define TCP_NUM_SACKS 4 /* SACK块数最多为4 */
SACK块合法性检查
检查SACK块或者DSACK块是否合法。
2.6.24之前的版本没有检查SACK块的合法性，而某些非法的SACK块可能会触发空指针的引用。
在3.1版本之前有一个小bug，处理DSACK时会产生问题，修复非常简单：
@if (! after(end_seq, tp->snd_una))，把非去掉。
符合以下任一条件的SACK块是合法的：
1. sack块和dsack块：snd_una < start_seq < end_seq <= snd_nxt
2. dsack块：undo_marker <= start_seq < end_seq <= snd_una
3. dsack块：start_seq < undo_marker < end_seq <= snd_una 且 end_seq - start_seq <= max_window
/* SACK block range validation checks that the received SACK block fits to the
* expected sequence limits, i.e., it is between SND.UNA and SND.NXT.
*/
static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack, u32 start_seq, u32 end_seq)
{
/* Too far in future, or reversed (interpretation is ambiguous)
* end_seq超过了snd_nxt，或者start_seq >= end_seq，那么不合法
*/
if (after(end_seq, tp->snd_nxt) || ! before(start_seq, end_seq))
return 0; /* Nasty start_seq wrap-around check (see comments above) */
* start_seq超过了snd_nxt
*/
if (! before(start_seq, tp->snd_nxt))
return 0; /* In outstanding window? This is valid exit for D-SACKs too.
* start_seq == snd_una is non-sensical (see comments above)
*/
if (after(start_seq, tp->snd_una))
return 1; /* 合法 */ if (! is_dsack || ! tp->undo_marker)
return 0; /* Then it's D-SACK, and must reside below snd_una completely.
* 注意在3.1以前这里是：! after(end_seq, tp->snd_una)，是一个bug
*/
if (after(end_seq, tp->snd_una))
return 0; if (! before(start_seq, tp->undo_marker))
return 1; /* dsack块合法 */ /* Too old，DSACK块太旧了*/
if (! after(end_seq, tp->undo_marker))
return 0; /* Undo_marker boundary crossing */
return !before(start_seq, end_seq - tp->max_window);
}