tcp_v4_rcv函数为TCP的总入口，数据包从IP层传递上来，进入该函数；其协议操作函数结构如下所示，其中handler即为IP层向TCP传递数据包的回调函数，设置为tcp_v4_rcv；
1 static struct net_protocol tcp_protocol = { 2 .early_demux = tcp_v4_early_demux, 3 .early_demux_handler = tcp_v4_early_demux, 4 .handler = tcp_v4_rcv, 5 .err_handler = tcp_v4_err, 6 .no_policy = 1, 7 .netns_ok = 1, 8 .icmp_strict_tag_validation = 1, 9 };
在IP层处理本地数据包时，会获取到上述结构的实例，并且调用实例的handler回调，也就是调用了tcp_v4_rcv；
1 static int ip_local_deliver_finish(struct net *net, struct sock *sk, struct sk_buff *skb) 2 { 3 /* 获取协议处理结构 */ 4 ipprot = rcu_dereference(inet_protos[protocol]); 5 if (ipprot) { 6 int ret; 7 8 /* 协议上层收包处理函数 */ 9 ret = ipprot->handler(skb); 10 if (ret < 0) { 11 protocol = -ret; 12 goto resubmit; 13 } 14 __IP_INC_STATS(net, IPSTATS_MIB_INDELIVERS); 15 } 16 }
tcp_v4_rcv函数只要做以下几个工作：(1) 设置TCP_CB (2) 查找控制块 (3)根据控制块状态做不同处理，包括TCP_TIME_WAIT状态处理，TCP_NEW_SYN_RECV状态处理，TCP_LISTEN状态处理 (4) 接收TCP段；
1 int tcp_v4_rcv(struct sk_buff *skb) 2 { 3 struct net *net = dev_net(skb->dev); 4 const struct iphdr *iph; 5 const struct tcphdr *th; 6 bool refcounted; 7 struct sock *sk; 8 int ret; 9 10 /* 非本机 */ 11 if (skb->pkt_type != PACKET_HOST) 12 goto discard_it; 13 14 /* Count it even if it's bad */ 15 __TCP_INC_STATS(net, TCP_MIB_INSEGS); 16 17 /* 检查头部数据，若不满足，则拷贝分片 */ 18 if (!pskb_may_pull(skb, sizeof(struct tcphdr))) 19 goto discard_it; 20 21 /* 取tcp头 */ 22 th = (const struct tcphdr *)skb->data; 23 24 /* 长度过小 */ 25 if (unlikely(th->doff < sizeof(struct tcphdr) / 4)) 26 goto bad_packet; 27 28 /* 检查头部数据，若不满足，则拷贝分片 */ 29 if (!pskb_may_pull(skb, th->doff * 4)) 30 goto discard_it; 31 32 /* An explanation is required here, I think. 33 * Packet length and doff are validated by header prediction, 34 * provided case of th->doff==0 is eliminated. 35 * So, we defer the checks. */ 36 37 if (skb_checksum_init(skb, IPPROTO_TCP, inet_compute_pseudo)) 38 goto csum_error; 39 40 /* 取tcp头 */ 41 th = (const struct tcphdr *)skb->data; 42 /* 取ip头 */ 43 iph = ip_hdr(skb); 44 /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB() 45 * barrier() makes sure compiler wont play fool^Waliasing games. 46 */ 47 /* 移动ipcb */ 48 memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb), 49 sizeof(struct inet_skb_parm)); 50 barrier(); 51 52 /* 获取开始序号*/ 53 TCP_SKB_CB(skb)->seq = ntohl(th->seq); 54 /* 获取结束序号，syn与fin各占1 */ 55 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin + 56 skb->len - th->doff * 4); 57 /* 获取确认序号 */ 58 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq); 59 /* 获取标记字节，tcp首部第14个字节 */ 60 TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th); 61 TCP_SKB_CB(skb)->tcp_tw_isn = 0; 62 /* 获取ip头的服务字段 */ 63 TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph); 64 TCP_SKB_CB(skb)->sacked = 0; 65 66 lookup: 67 /* 查找控制块 */ 68 sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source, 69 th->dest, &refcounted); 70 if (!sk) 71 goto no_tcp_socket; 72 73 process: 74 75 /* TIME_WAIT转过去处理 */ 76 if (sk->sk_state == TCP_TIME_WAIT) 77 goto do_time_wait; 78 79 /* TCP_NEW_SYN_RECV状态处理 */ 80 if (sk->sk_state == TCP_NEW_SYN_RECV) { 81 struct request_sock *req = inet_reqsk(sk); 82 struct sock *nsk; 83 84 /* 获取控制块 */ 85 sk = req->rsk_listener; 86 if (unlikely(tcp_v4_inbound_md5_hash(sk, skb))) { 87 sk_drops_add(sk, skb); 88 reqsk_put(req); 89 goto discard_it; 90 } 91 92 /* 不是listen状态 */ 93 if (unlikely(sk->sk_state != TCP_LISTEN)) { 94 /* 从连接队列移除控制块 */ 95 inet_csk_reqsk_queue_drop_and_put(sk, req); 96 97 /* 根据skb参数重新查找控制块 */ 98 goto lookup; 99 } 100 /* We own a reference on the listener, increase it again 101 * as we might lose it too soon. 102 */ 103 sock_hold(sk); 104 refcounted = true; 105 106 /* 处理第三次握手ack，成功返回新控制块 */ 107 nsk = tcp_check_req(sk, skb, req, false); 108 109 /* 失败 */ 110 if (!nsk) { 111 reqsk_put(req); 112 goto discard_and_relse; 113 } 114 115 /* 未新建控制块，进一步处理 */ 116 if (nsk == sk) { 117 reqsk_put(req); 118 } 119 /* 有新建控制块，进行初始化等 */ 120 else if (tcp_child_process(sk, nsk, skb)) { 121 /* 失败发送rst */ 122 tcp_v4_send_reset(nsk, skb); 123 goto discard_and_relse; 124 } else { 125 sock_put(sk); 126 return 0; 127 } 128 } 129 130 /* TIME_WAIT和TCP_NEW_SYN_RECV以外的状态 */ 131 132 /* ttl错误 */ 133 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { 134 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP); 135 goto discard_and_relse; 136 } 137 138 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) 139 goto discard_and_relse; 140 141 if (tcp_v4_inbound_md5_hash(sk, skb)) 142 goto discard_and_relse; 143 144 /* 初始化nf成员 */ 145 nf_reset(skb); 146 147 /* tcp过滤 */ 148 if (tcp_filter(sk, skb)) 149 goto discard_and_relse; 150 151 /* 取tcp和ip头 */ 152 th = (const struct tcphdr *)skb->data; 153 iph = ip_hdr(skb); 154 155 /* 清空设备 */ 156 skb->dev = NULL; 157 158 /* LISTEN状态处理 */ 159 if (sk->sk_state == TCP_LISTEN) { 160 ret = tcp_v4_do_rcv(sk, skb); 161 goto put_and_return; 162 } 163 164 /* TIME_WAIT和TCP_NEW_SYN_RECV和LISTEN以外的状态 */ 165 166 /* 记录cpu */ 167 sk_incoming_cpu_update(sk); 168 169 bh_lock_sock_nested(sk); 170 171 /* 分段统计 */ 172 tcp_segs_in(tcp_sk(sk), skb); 173 ret = 0; 174 175 /* 未被用户锁定 */ 176 if (!sock_owned_by_user(sk)) { 177 /* 未能加入到prequeue */ 178 if (!tcp_prequeue(sk, skb)) 179 /* 进入tcpv4处理 */ 180 ret = tcp_v4_do_rcv(sk, skb); 181 } 182 /* 已经被用户锁定，加入到backlog */ 183 else if (tcp_add_backlog(sk, skb)) { 184 goto discard_and_relse; 185 } 186 bh_unlock_sock(sk); 187 188 put_and_return: 189 /* 减少引用计数 */ 190 if (refcounted) 191 sock_put(sk); 192 193 return ret; 194 195 no_tcp_socket: 196 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) 197 goto discard_it; 198 199 if (tcp_checksum_complete(skb)) { 200 csum_error: 201 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS); 202 bad_packet: 203 __TCP_INC_STATS(net, TCP_MIB_INERRS); 204 } else { 205 /* 发送rst */ 206 tcp_v4_send_reset(NULL, skb); 207 } 208 209 discard_it: 210 /* Discard frame. */ 211 kfree_skb(skb); 212 return 0; 213 214 discard_and_relse: 215 sk_drops_add(sk, skb); 216 if (refcounted) 217 sock_put(sk); 218 goto discard_it; 219 220 do_time_wait: 221 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) { 222 inet_twsk_put(inet_twsk(sk)); 223 goto discard_it; 224 } 225 226 /* 校验和错误 */ 227 if (tcp_checksum_complete(skb)) { 228 inet_twsk_put(inet_twsk(sk)); 229 goto csum_error; 230 } 231 232 /* TIME_WAIT入包处理 */ 233 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) { 234 235 /* 收到syn */ 236 case TCP_TW_SYN: { 237 /* 查找监听控制块 */ 238 struct sock *sk2 = inet_lookup_listener(dev_net(skb->dev), 239 &tcp_hashinfo, skb, 240 __tcp_hdrlen(th), 241 iph->saddr, th->source, 242 iph->daddr, th->dest, 243 inet_iif(skb)); 244 245 /* 找到 */ 246 if (sk2) { 247 /* 删除tw控制块 */ 248 inet_twsk_deschedule_put(inet_twsk(sk)); 249 /* 记录监听控制块 */ 250 sk = sk2; 251 refcounted = false; 252 253 /* 进行新请求的处理 */ 254 goto process; 255 } 256 /* Fall through to ACK */ 257 } 258 259 /* 发送ack */ 260 case TCP_TW_ACK: 261 tcp_v4_timewait_ack(sk, skb); 262 break; 263 /* 发送rst */ 264 case TCP_TW_RST: 265 tcp_v4_send_reset(sk, skb); 266 /* 删除tw控制块 */ 267 inet_twsk_deschedule_put(inet_twsk(sk)); 268 goto discard_it; 269 /* 成功*/ 270 case TCP_TW_SUCCESS:; 271 } 272 goto discard_it; 273 }