【Linux4.1.12源码分析】协议栈报文接收之IP层处理分析（ip_forward）

上一篇分析报文接收，IP层提交本地处理的流程，本篇分析报文转发场景的处理过程，在ip_rcv_finish函数中，会根据IP地址决定是提交给本机处理，还是报文转发，报文转发的入口函数为ip_forward，本篇将从ip_forward函数入手分析转发过程。

1、ip_forward函数

int ip_forward(struct sk_buff *skb)
{
	u32 mtu;
	struct iphdr *iph;	/* Our header */
	struct rtable *rt;	/* Route we use */
	struct ip_options *opt	= &(IPCB(skb)->opt);

	/* that should never happen */
	if (skb->pkt_type != PACKET_HOST)	//不允许处理非本host的报文，即报文目的mac是本机
		goto drop;

	if (unlikely(skb->sk))	
		goto drop;

	if (skb_warn_if_lro(skb))	//报文为非线性，gso_size不为零，但是gso_type为零，丢弃此类报文
		goto drop;

	if (!xfrm4_policy_check(NULL, XFRM_POLICY_FWD, skb))	//ipset安全规则检测
		goto drop;

	if (IPCB(skb)->opt.router_alert && ip_call_ra_chain(skb))
		return NET_RX_SUCCESS;

	skb_forward_csum(skb);

	/*
	 *	According to the RFC, we must first decrease the TTL field. If
	 *	that reaches zero, we must reply an ICMP control message telling
	 *	that the packet's lifetime expired.
	 */
	if (ip_hdr(skb)->ttl <= 1)	//ttl减到0 ，丢弃报文
		goto too_many_hops;

	if (!xfrm4_route_forward(skb))		//ipset路由安全规则检测，得到路由信息
		goto drop;

	rt = skb_rtable(skb);	//得到路由表项

	if (opt->is_strictroute && rt->rt_uses_gateway)
		goto sr_failed;

	IPCB(skb)->flags |= IPSKB_FORWARDED;	//flag中田间forward标记，
	mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
	if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, mtu)) {
		IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,	//报文长度超过mtu且不允许ip分片，发送icmp消息给发送者
			  htonl(mtu));
		goto drop;
	}

	/* We are about to mangle packet. Copy it! */
	if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+rt->dst.header_len))	//扩展报文，以填充mac头
		goto drop;
	iph = ip_hdr(skb);

	/* Decrease ttl after skb cow done */
	ip_decrease_ttl(iph);	//ip头的ttl减一

	/*
	 *	We now generate an ICMP HOST REDIRECT giving the route
	 *	we calculated.
	 */
	if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
	    !skb_sec_path(skb))
		ip_rt_send_redirect(skb);	//通知发送端，路由重定向

	skb->priority = rt_tos2priority(iph->tos);	//根据tos值计算priority值

	return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, NULL, skb,
		       skb->dev, rt->dst.dev, ip_forward_finish); //调用netfilter，实现iptables功能，通过后调用ip_forward_finish

sr_failed:
	/*
	 *	Strict routing permits no gatewaying
	 */
	 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_SR_FAILED, 0);
	 goto drop;

too_many_hops:
	/* Tell the sender its packet died... */
	IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_INHDRERRORS);
	icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
drop:
	kfree_skb(skb);
	return NET_RX_DROP;
}

2、ip_forward_finish函数

static int ip_forward_finish(struct sock *sk, struct sk_buff *skb)
{
	struct ip_options *opt	= &(IPCB(skb)->opt);

	IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);	//报文统计
	IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);

	if (unlikely(opt->optlen))
		ip_forward_options(skb);

	skb_sender_cpu_clear(skb);
	return dst_output_sk(sk, skb);	//此时会进入xfrm4_outpot处理，最终会调用ip_output
}

ip_forward流程中主要功能包括：根据报文信息得到路由、ipset安全检测、转发的基本逻辑（ttl减少、mtu判断等），ipset安全检测，后续统一分偶析，本篇不再涉及，ip_output之前已经有分析，不再赘述。