上一篇分析报文接收,IP层提交本地处理的流程,本篇分析报文转发场景的处理过程,在ip_rcv_finish函数中,会根据IP地址决定是提交给本机处理,还是报文转发,报文转发的入口函数为ip_forward,本篇将从ip_forward函数入手分析转发过程。
1、ip_forward函数
int ip_forward(struct sk_buff *skb) { u32 mtu; struct iphdr *iph; /* Our header */ struct rtable *rt; /* Route we use */ struct ip_options *opt = &(IPCB(skb)->opt); /* that should never happen */ if (skb->pkt_type != PACKET_HOST) //不允许处理非本host的报文,即报文目的mac是本机 goto drop; if (unlikely(skb->sk)) goto drop; if (skb_warn_if_lro(skb)) //报文为非线性,gso_size不为零,但是gso_type为零,丢弃此类报文 goto drop; if (!xfrm4_policy_check(NULL, XFRM_POLICY_FWD, skb)) //ipset安全规则检测 goto drop; if (IPCB(skb)->opt.router_alert && ip_call_ra_chain(skb)) return NET_RX_SUCCESS; skb_forward_csum(skb); /* * According to the RFC, we must first decrease the TTL field. If * that reaches zero, we must reply an ICMP control message telling * that the packet's lifetime expired. */ if (ip_hdr(skb)->ttl <= 1) //ttl减到0 ,丢弃报文 goto too_many_hops; if (!xfrm4_route_forward(skb)) //ipset路由安全规则检测,得到路由信息 goto drop; rt = skb_rtable(skb); //得到路由表项 if (opt->is_strictroute && rt->rt_uses_gateway) goto sr_failed; IPCB(skb)->flags |= IPSKB_FORWARDED; //flag中田间forward标记, mtu = ip_dst_mtu_maybe_forward(&rt->dst, true); if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, mtu)) { IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS); icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, //报文长度超过mtu且不允许ip分片,发送icmp消息给发送者 htonl(mtu)); goto drop; } /* We are about to mangle packet. Copy it! */ if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+rt->dst.header_len)) //扩展报文,以填充mac头 goto drop; iph = ip_hdr(skb); /* Decrease ttl after skb cow done */ ip_decrease_ttl(iph); //ip头的ttl减一 /* * We now generate an ICMP HOST REDIRECT giving the route * we calculated. */ if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr && !skb_sec_path(skb)) ip_rt_send_redirect(skb); //通知发送端,路由重定向 skb->priority = rt_tos2priority(iph->tos); //根据tos值计算priority值 return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, NULL, skb, skb->dev, rt->dst.dev, ip_forward_finish); //调用netfilter,实现iptables功能,通过后调用ip_forward_finish sr_failed: /* * Strict routing permits no gatewaying */ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_SR_FAILED, 0); goto drop; too_many_hops: /* Tell the sender its packet died... */ IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_INHDRERRORS); icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0); drop: kfree_skb(skb); return NET_RX_DROP; }2、ip_forward_finish函数
static int ip_forward_finish(struct sock *sk, struct sk_buff *skb) { struct ip_options *opt = &(IPCB(skb)->opt); IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); //报文统计 IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); if (unlikely(opt->optlen)) ip_forward_options(skb); skb_sender_cpu_clear(skb); return dst_output_sk(sk, skb); //此时会进入xfrm4_outpot处理,最终会调用ip_output }ip_forward流程中主要功能包括:根据报文信息得到路由、ipset安全检测、转发的基本逻辑(ttl减少、mtu判断等),ipset安全检测,后续统一分偶析,本篇不再涉及,ip_output之前已经有分析,不再赘述。