7.6 TIME_WAIT状态处理
TCP在以下情况下可能会进入TIME_WAIT状态：
（1）在TCP_FIN_WAIT2状态时调用close系统调用时；
（2）TCP_FIN_WAIT2收到对端的FIN时（一定会进入TIME_WAIT状态）；
（3）成为orphan sock并且在TCP_FIN_WAIT1状态下收到ACK时；
（4）TCP_CLOSING状态下收到ACK时（一定会进入TIME_WAIT状态）；
（5）FIN_WAIT2定时器超时时。
处于TIME_WAIT状态的TCP连接会保持2MSL（Maximum Segment Lifetime）时间，即2倍的最大生存时间。在这段时间内，相同源|目的IP和源|目的端口的TCP连接无法建立。这样做的目的主要有两个：1）禁止旧连接的报文危害新连接；2）收到对端重传的FIN时回应ACK，使对端尽快释放连接资源。
进入TIME_WAIT状态的函数为tcp_time_wait：
266 void tcp_time_wait(struct sock *sk, int state, int timeo)
267 {
268 struct inet_timewait_sock *tw = NULL;
269 const struct inet_connection_sock *icsk = inet_csk(sk);
270 const struct tcp_sock *tp = tcp_sk(sk);
271 bool recycle_ok = false;
272
273 if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp) //设置了快速回收tw sock并且开启了时间戳
274 recycle_ok = tcp_remember_stamp(sk);//记录时间戳信息到对端IP地址对应的信息管理块中；如果找到信息管理块，则recycle_ok为1
275
276 if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets) //正在使用的tw sock的数量未超过限制
277 tw = inet_twsk_alloc(sk, state); //申请tw sock
278
279 if (tw != NULL) {
280 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
281 const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1); //rto = 3.5 * icsk->icsk_rto
282 struct inet_sock *inet = inet_sk(sk);
283 //将socket中的信息记录到tw sock中
284 tw->tw_transparent = inet->transparent;
285 tw->tw_rcv_wscale = tp->rx_opt.rcv_wscale;
286 tcptw->tw_rcv_nxt = tp->rcv_nxt;
287 tcptw->tw_snd_nxt = tp->snd_nxt;
288 tcptw->tw_rcv_wnd = tcp_receive_window(tp);
289 tcptw->tw_ts_recent = tp->rx_opt.ts_recent;
290 tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
291 tcptw->tw_ts_offset = tp->tsoffset;
...
327 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo); //将tw sock放入ESTABLESHED hash表中，将sk从hash表中移除
328
329 /* Get the TIME_WAIT timeout firing. */
330 if (timeo < rto)
331 timeo = rto;
332
333 if (recycle_ok) { //可以快速回收
334 tw->tw_timeout = rto; //设置较短的超时时间
335 } else {
336 tw->tw_timeout = TCP_TIMEWAIT_LEN;
337 if (state == TCP_TIME_WAIT)
338 timeo = TCP_TIMEWAIT_LEN;
339 }
340
341 inet_twsk_schedule(tw, &tcp_death_row, timeo,
342 TCP_TIMEWAIT_LEN); //启动TIME WAIT定时器
343 inet_twsk_put(tw);
344 } else {
345 /* Sorry, if we're out of memory, just CLOSE this
346 * socket up. We've got bigger problems than
347 * non-graceful socket closings.
348 */
349 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
350 }
351
352 tcp_update_metrics(sk); //更新管理信息，如果没有则创建
353 tcp_done(sk); //关闭TCP控制块
354 }
进入TIME_WAIT状态后，TCP生成了一个tw sock代替socket存放在hash表中，如果这时应用进程调用close系统调用则socket结构体就可以释放。tw sock占用空间比socket小，从而能节约内存空间。在tw socket超时前如果有之前连接的数据到来
，则会匹配到tw sock，在TCPv4入口函数tcp_v4_rcv中会做如下处理：
1961 int tcp_v4_rcv(struct sk_buff *skb)
1962 {
1963 const struct iphdr *iph;
1964 const struct tcphdr *th;
1965 struct sock *sk;
1966 int ret;
1967 struct net *net = dev_net(skb->dev);
...
2002 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
2003 if (!sk)
2004 goto no_tcp_socket;
2005
2006 process:
2007 if (sk->sk_state == TCP_TIME_WAIT)
2008 goto do_time_wait;
...
2073 do_time_wait:
2074 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
2075 inet_twsk_put(inet_twsk(sk));
2076 goto discard_it;
2077 }
2078
2079 if (skb->len < (th->doff << 2)) { //长度异常
2080 inet_twsk_put(inet_twsk(sk));
2081 goto bad_packet;
2082 }
2083 if (tcp_checksum_complete(skb)) { //检验和异常
2084 inet_twsk_put(inet_twsk(sk));
2085 goto csum_error;
2086 }
2087 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
2088 case TCP_TW_SYN: {//有SYN请求到来
2089 struct sock *sk2 = inet_lookup_listener(dev_net(skb->dev),
2090 &tcp_hashinfo,
2091 iph->saddr, th->source,
2092 iph->daddr, th->dest,
2093 inet_iif(skb));//查询listening socket
2094 if (sk2) {
2095 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);//删除TIME_WAIT定时器
2096 inet_twsk_put(inet_twsk(sk));//释放tw sock
2097 sk = sk2;
2098 goto process;//进入正常处理流程
2099 }
2100 /* Fall through to ACK */
2101 }
2102 case TCP_TW_ACK://发送ACK
2103 tcp_v4_timewait_ack(sk, skb);
2104 break;
2105 case TCP_TW_RST://发送RST
2106 goto no_tcp_socket;
2107 case TCP_TW_SUCCESS:;//不做任何处理
2108 }
2109 goto discard_it;
2110 } tcp_timewait_state_process函数：
91 enum tcp_tw_status
92 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
93 const struct tcphdr *th)
94 {
95 struct tcp_options_received tmp_opt;
96 struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
97 bool paws_reject = false;
98
99 tmp_opt.saw_tstamp = 0;
100 if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) { //TCP头中有选项且旧连接开启了时间戳选项
101 tcp_parse_options(skb, &tmp_opt, 0, NULL);//解析选项
102
103 if (tmp_opt.saw_tstamp) {
104 tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset;
105 tmp_opt.ts_recent = tcptw->tw_ts_recent;
106 tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
107 paws_reject = tcp_paws_reject(&tmp_opt, th->rst);//检查是否发生了时间戳回绕
108 }
109 }
110
111 if (tw->tw_substate == TCP_FIN_WAIT2) { //当前tw连接是在TCP_FIN_WAIT2状态下被强制进入time wait的，当时的sock已经是orphan sock
112 /* Just repeat all the checks of tcp_rcv_state_process() */
113
114 /* Out of window, send ACK */
115 if (paws_reject || //发生了回绕，是旧包
116 !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
117 tcptw->tw_rcv_nxt,
118 tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))//数据在窗口之外
119 return TCP_TW_ACK;//发送ACK
120
121 if (th->rst)
122 goto kill;//删除TIME_WAIT定时器,释放tw sock
123
124 if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt)) //是SYN包且序列号比旧连接中要接收的下一个序列号大
125 goto kill_with_rst;//删除TIME_WAIT定时器,释放tw sock并发送RST
126
127 /* Dup ACK? */
128 if (!th->ack || //没有ACK标记
129 !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||//没有新数据
130 TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {//没有数据
131 inet_twsk_put(tw);
132 return TCP_TW_SUCCESS;
133 }
134
135 /* New data or FIN. If new data arrive after half-duplex close,
136 * reset.
137 */
138 if (!th->fin ||
139 TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
140 kill_with_rst:
141 inet_twsk_deschedule(tw, &tcp_death_row);
142 inet_twsk_put(tw);
143 return TCP_TW_RST;
144 }
145
146 /* FIN arrived, enter true time-wait state. */
147 tw->tw_substate = TCP_TIME_WAIT;
148 tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
149 if (tmp_opt.saw_tstamp) {
150 tcptw->tw_ts_recent_stamp = get_seconds();
151 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
152 }
153
154 if (tcp_death_row.sysctl_tw_recycle && //开启快速回收tw sock功能
155 tcptw->tw_ts_recent_stamp && //开启时间戳
156 tcp_tw_remember_stamp(tw))//将时间戳记录在管理信息块中
157 inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
158 TCP_TIMEWAIT_LEN); //使用短的超时时间
159 else
160 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
161 TCP_TIMEWAIT_LEN);
162 return TCP_TW_ACK;
163 }
164
165 /*
166 * Now real TIME-WAIT state.
167 *
168 * RFC 1122:
169 * "When a connection is [...] on TIME-WAIT state [...]
170 * [a TCP] MAY accept a new SYN from the remote TCP to
171 * reopen the connection directly, if it:
172 *
173 * (1) assigns its initial sequence number for the new
174 * connection to be larger than the largest sequence
175 * number it used on the previous connection incarnation,
176 * and
177 *
178 * (2) returns to TIME-WAIT state if the SYN turns out
179 * to be an old duplicate".
180 */
181
182 if (!paws_reject && //没有发生时间戳回绕
183 (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt && //序列号是下一个要接收的序列号
184 (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {//没有数据或设置了RST标记位
185 /* In window segment, it may be only reset or bare ack. */
186
187 if (th->rst) {
188 /* This is TIME_WAIT assassination, in two flavors.
189 * Oh well... nobody has a sufficient solution to this
190 * protocol bug yet.
191 */
192 if (sysctl_tcp_rfc1337 == 0) { //不开启这个选项当RST到来时会立即回收tw sock，但这样做是有风险的
193 kill:
194 inet_twsk_deschedule(tw, &tcp_death_row); //删除time wait定时器
195 inet_twsk_put(tw);//释放tw sock
196 return TCP_TW_SUCCESS;
197 }
198 }
199 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
200 TCP_TIMEWAIT_LEN); //设置长的超时时间
201
202 if (tmp_opt.saw_tstamp) {
203 tcptw->tw_ts_recent = tmp_opt.rcv_tsval;
204 tcptw->tw_ts_recent_stamp = get_seconds();
205 }
206
207 inet_twsk_put(tw);
208 return TCP_TW_SUCCESS;
209 }
210
211 /* Out of window segment.
212
213 All the segments are ACKed immediately.
214
215 The only exception is new SYN. We accept it, if it is
216 not old duplicate and we are not in danger to be killed
217 by delayed old duplicates. RFC check is that it has
218 newer sequence number works at rates <40Mbit/sec.
219 However, if paws works, it is reliable AND even more,
220 we even may relax silly seq space cutoff.
221
222 RED-PEN: we violate main RFC requirement, if this SYN will appear
223 old duplicate (i.e. we receive RST in reply to SYN-ACK),
224 we must return socket to time-wait state. It is not good,
225 but not fatal yet.
226 */
227
228 if (th->syn && !th->rst && !th->ack && !paws_reject && //是SYN包、没有RST也没有ACK、没有回绕
229 (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
230 (tmp_opt.saw_tstamp && //新连接开启了时间戳
231 (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) { //没有回绕
232 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
233 if (isn == 0)
234 isn++;
235 TCP_SKB_CB(skb)->when = isn;
236 return TCP_TW_SYN; //允许新连接建立并替代tw sock，这时就依靠新旧序列号空间的不一致性来防止旧包对新连接的危害
237 }
238
239 if (paws_reject)
240 NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_PAWSESTABREJECTED);
241
242 if (!th->rst) {
243 /* In this case we must reset the TIMEWAIT timer.
244 *
245 * If it is ACKless SYN it may be both old duplicate
246 * and new good SYN with random sequence number <rcv_nxt.
247 * Do not reschedule in the last case.
248 */
249 if (paws_reject || th->ack) //是回绕包或ACK
250 inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
251 TCP_TIMEWAIT_LEN); //重新设置time wait定时器
252
253 /* Send ACK. Note, we do not put the bucket,
254 * it will be released by caller.
255 */
256 return TCP_TW_ACK;
257 }
258 inet_twsk_put(tw);
259 return TCP_TW_SUCCESS;
260 }
229：序列号大于旧连接中下一个要接收的序列号，这样旧连接的数据在新连接中就会被认为是旧包而丢弃 从代码中得知，有一些情况会导致TIME_WAIT状态的提前终结：
（1）处于孤儿sock的状态下对端有SYN或数据发送过来；
（2）收到RST且没有开启sysctl_tcp_rfc1337拒绝reset；
（3）收到新的SYN请求且允许建立新连接。
除了这些情况外，tw sock会一直保持到TIME_WAIT定时器超时。
在tw sock的生存时间内，TCP会处理与已经关闭连接的所有旧数据包，期望它们能够在新的连接建立之前全部消失在网络中。为什么关闭连接后TCP通信两端只有一端处于TIME_WAIT状态而另一端却可以快速释放连接？因为只要有一端处于TIME_WAIT状态则相四元组的连接就无法建立，所以另一端无需担心旧报文混入新连接中。