IP輸出 之 分片ip_fragment、ip_do_fragment

概述

ip_fragment函數用於判斷是否進行分片，在沒有設置DF標記的情況下進入分片，如果設置了DF標記，則繼續判斷，如果不允許DF分片或者收到的最大分片大於MTU大小，則回復ICMP，釋放skb，其余情況仍然需要走分片；

ip_do_fragment是詳細的分片流程，整個過程分為快速分片和慢速分片兩種，如果存在分片列表frag_list，並且通過檢查，則走快速路徑，復制每個分片的ip頭等信息之后，發送出去；如果不存在分片列表，或者分片列表檢查失敗，則走慢速路徑，慢速路徑會根據MTU大小，對整個數據進行重新划分，分配skb，進行數據拷貝，設置ip頭等信息，然后發送出去；

源碼分析

static int ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
               unsigned int mtu,
               int (*output)(struct net *, struct sock *, struct sk_buff *))
{
    struct iphdr *iph = ip_hdr(skb);

    /* 如果沒有DF標記，則進行分片 */
    if ((iph->frag_off & htons(IP_DF)) == 0)
        return ip_do_fragment(net, sk, skb, output);
    
    /* 有DF標記則繼續判斷 */

    /* 不允許本地分片 || 分片最大長度>MTU */
    if (unlikely(!skb->ignore_df ||
             (IPCB(skb)->frag_max_size &&
              IPCB(skb)->frag_max_size > mtu))) {
        IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
        /* ICMP錯誤 */
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
              htonl(mtu));
        /* 釋放skb */
        kfree_skb(skb);
        return -EMSGSIZE;
    }

    /* 其他情況，繼續分片 */
    return ip_do_fragment(net, sk, skb, output);
}

 

int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
           int (*output)(struct net *, struct sock *, struct sk_buff *))
{
    struct iphdr *iph;
    int ptr;
    struct sk_buff *skb2;
    unsigned int mtu, hlen, left, len, ll_rs;
    int offset;
    __be16 not_last_frag;
    struct rtable *rt = skb_rtable(skb);
    int err = 0;

    /* for offloaded checksums cleanup checksum before fragmentation */
    /* PARTIAL類型需要清除校驗和 */
    if (skb->ip_summed == CHECKSUM_PARTIAL &&
        (err = skb_checksum_help(skb)))
        goto fail;

    /*
     *    Point into the IP datagram header.
     */

    iph = ip_hdr(skb);

    /* 獲取mtu */
    mtu = ip_skb_dst_mtu(sk, skb);

    /* 接收到的最大分片長度 < mtu，則將mtu設置為該值 */
    if (IPCB(skb)->frag_max_size && IPCB(skb)->frag_max_size < mtu)
        mtu = IPCB(skb)->frag_max_size;

    /*
     *    Setup starting values.
     */

    hlen = iph->ihl * 4;
    mtu = mtu - hlen;    /* Size of data space */
    IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;

    /* When frag_list is given, use it. First, check its validity:
     * some transformers could create wrong frag_list or break existing
     * one, it is not prohibited. In this case fall back to copying.
     *
     * LATER: this step can be merged to real generation of fragments,
     * we can switch to copy when see the first bad fragment.
     */
    /* 有分片列表 */
    if (skb_has_frag_list(skb)) {
        struct sk_buff *frag, *frag2;

        /* 線性區域和分頁區的數據長度 */
        unsigned int first_len = skb_pagelen(skb);

        /* 以下情況，進入慢路處理 */
        if (first_len - hlen > mtu || /* 分片長度>MTU */
            ((first_len - hlen) & 7) || /* 沒有8字節對齊 */
            ip_is_fragment(iph) || /* 是一個分片 */
            skb_cloned(skb)) /* 是克隆的 */
            goto slow_path;

        /* 遍歷分片列表 */
        skb_walk_frags(skb, frag) {
            /* Correct geometry. */
            /* 以下情況，恢復狀態，進入慢速路徑 */
            if (frag->len > mtu || /* 分片長度>mtu */
                ((frag->len & 7) && frag->next) || /* 除最后一個分片外，其余有非8字節對齊的 */
                skb_headroom(frag) < hlen) /* 頭部長度過小 */
                goto slow_path_clean;

            /* Partially cloned skb? */
            /* 克隆的，恢復狀態，進入慢速路徑 */    
            if (skb_shared(frag))
                goto slow_path_clean;

            BUG_ON(frag->sk);

            /* 分片關聯控制塊 */
            if (skb->sk) {
                frag->sk = skb->sk;
                frag->destructor = sock_wfree;
            }

            /* 第一個skb的長度去掉當前分片的長度 */
            skb->truesize -= frag->truesize;
        }

        /* Everything is OK. Generate! */

        /* 現在分片沒問題了，設置分片信息 */
        err = 0;
        offset = 0;
        frag = skb_shinfo(skb)->frag_list;
        skb_frag_list_init(skb);
        skb->data_len = first_len - skb_headlen(skb);
        skb->len = first_len;
        iph->tot_len = htons(first_len);
        iph->frag_off = htons(IP_MF);
        ip_send_check(iph);

        /* 循環設置分片信息，並發送 */
        for (;;) {
            /* Prepare header of the next frame,
             * before previous one went down. */
             /* 為每一片都拷貝ip頭，設置偏移信息 */
            if (frag) {
                frag->ip_summed = CHECKSUM_NONE;
                skb_reset_transport_header(frag);
                __skb_push(frag, hlen);
                skb_reset_network_header(frag);
                memcpy(skb_network_header(frag), iph, hlen);
                iph = ip_hdr(frag);
                iph->tot_len = htons(frag->len);
                ip_copy_metadata(frag, skb);
                if (offset == 0)
                    ip_options_fragment(frag);
                offset += skb->len - hlen;
                iph->frag_off = htons(offset>>3);
                if (frag->next)
                    iph->frag_off |= htons(IP_MF);
                /* Ready, complete checksum */
                ip_send_check(iph);
            }

            /* 調用發送回調 */
            err = output(net, sk, skb);

            if (!err)
                IP_INC_STATS(net, IPSTATS_MIB_FRAGCREATES);
            if (err || !frag)
                break;

            skb = frag;
            frag = skb->next;
            skb->next = NULL;
        }

        if (err == 0) {
            IP_INC_STATS(net, IPSTATS_MIB_FRAGOKS);
            return 0;
        }

        /* 出錯，釋放分片 */
        while (frag) {
            skb = frag->next;
            kfree_skb(frag);
            frag = skb;
        }
        IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
        return err;

slow_path_clean:
        /* 將分片恢復原狀態 */
        skb_walk_frags(skb, frag2) {
            if (frag2 == frag)
                break;
            frag2->sk = NULL;
            frag2->destructor = NULL;
            skb->truesize += frag2->truesize;
        }
    }

slow_path:
    /* 慢速分片路徑 */


    iph = ip_hdr(skb);

    /* 除去首部的剩余空間 */
    left = skb->len - hlen;        /* Space per frame */
    ptr = hlen;        /* Where to start from */

    /* 二層頭部空間 */
    ll_rs = LL_RESERVED_SPACE(rt->dst.dev);

    /*
     *    Fragment the datagram.
     */

    /* 初始化mf和offset */
    offset = (ntohs(iph->frag_off) & IP_OFFSET) << 3;
    not_last_frag = iph->frag_off & htons(IP_MF);

    /*
     *    Keep copying data until we run out.
     */

    /* 開始分片了 */
    while (left > 0) {
        /* len初始為剩余長度 */
        len = left;
        /* IF: it doesn't fit, use 'mtu' - the data space left */
        /* 根據mtu確認長度 */
        if (len > mtu)
            len = mtu;
        /* IF: we are not sending up to and including the packet end
           then align the next start on an eight byte boundary */
        /* 除最后分片外，其余8字節對齊 */
        if (len < left)    {
            len &= ~7;
        }

        /* Allocate buffer */
        /* 分配skb */
        skb2 = alloc_skb(len + hlen + ll_rs, GFP_ATOMIC);
        if (!skb2) {
            err = -ENOMEM;
            goto fail;
        }

        /*
         *    Set up data on packet
         */

        /* 拷貝元數據 */
        ip_copy_metadata(skb2, skb);

        /* 預留空間，設置頭部偏移 */
        skb_reserve(skb2, ll_rs);
        skb_put(skb2, len + hlen);
        skb_reset_network_header(skb2);
        skb2->transport_header = skb2->network_header + hlen;

        /*
         *    Charge the memory for the fragment to any owner
         *    it might possess
         */
        /* 關聯sk */
        if (skb->sk)
            skb_set_owner_w(skb2, skb->sk);

        /*
         *    Copy the packet header into the new buffer.
         */

        /* 拷貝頭部 */
        skb_copy_from_linear_data(skb, skb_network_header(skb2), hlen);

        /*
         *    Copy a block of the IP datagram.
         */
        /* 拷貝數據 */
        if (skb_copy_bits(skb, ptr, skb_transport_header(skb2), len))
            BUG();
        left -= len;

        /*
         *    Fill in the new header fields.
         */
        iph = ip_hdr(skb2);

        /* 設置偏移 *//
        iph->frag_off = htons((offset >> 3));

        /* 轉發的數據包，帶有FRAG_PMTU標記，則打上DF */
        if (IPCB(skb)->flags & IPSKB_FRAG_PMTU)
            iph->frag_off |= htons(IP_DF);

        /* ANK: dirty, but effective trick. Upgrade options only if
         * the segment to be fragmented was THE FIRST (otherwise,
         * options are already fixed) and make it ONCE
         * on the initial skb, so that all the following fragments
         * will inherit fixed options.
         */
        /* 第一個分片包含ip選項 */
        if (offset == 0)
            ip_options_fragment(skb);

        /*
         *    Added AC : If we are fragmenting a fragment that's not the
         *           last fragment then keep MF on each bit
         */
        /* 不是最后分片需要設定MF標記 */
        if (left > 0 || not_last_frag)
            iph->frag_off |= htons(IP_MF);

        /* 指針和偏移更新 */
        ptr += len;
        offset += len;

        /*
         *    Put this fragment into the sending queue.
         */
        /* 設置數據長度 */
        iph->tot_len = htons(len + hlen);

        /* 校驗和 */
        ip_send_check(iph);

        /* 發送分片 */
        err = output(net, sk, skb2);
        if (err)
            goto fail;

        IP_INC_STATS(net, IPSTATS_MIB_FRAGCREATES);
    }

    /* 分片完成並發送，釋放skb */
    consume_skb(skb);
    IP_INC_STATS(net, IPSTATS_MIB_FRAGOKS);
    return err;

fail:

    /* 出錯，釋放skb */
    kfree_skb(skb);
    IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
    return err;
}