IP 层收发报文简要剖析6--ip_forward 报文转发

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106

//在函数ip_route_input_slow->ip_mkroute_input注册， /*  * IP数据包的转发是由ip_forward()处理，该函数在ip_rcv_finish()  * 通过输入路由缓存被调用。  */ int ip_forward(struct sk_buff *skb) {     u32 mtu;     struct iphdr *iph;  /* Our header */     struct rtable *rt;  /* Route we use */     struct ip_options *opt  = &(IPCB(skb)->opt);     struct net *net;       /* that should never happen */     if (skb->pkt_type != PACKET_HOST)         goto drop;       if (unlikely(skb->sk))         goto drop;       if (skb_warn_if_lro(skb))         goto drop;       if (!xfrm4_policy_check(NULL, XFRM_POLICY_FWD, skb))/*查找ipsec 策略路由*/         goto drop;       if (IPCB(skb)->opt.router_alert && ip_call_ra_chain(skb))//存在路由警告选项         return NET_RX_SUCCESS;       skb_forward_csum(skb);     net = dev_net(skb->dev);       /*      *  According to the RFC, we must first decrease the TTL field. If      *  that reaches zero, we must reply an ICMP control message telling      *  that the packet's lifetime expired.      */     if (ip_hdr(skb)->ttl <= 1)//ttl 减少了         goto too_many_hops;       if (!xfrm4_route_forward(skb))//ipsec 策略路由转发处理         goto drop;       rt = skb_rtable(skb);       if (opt->is_strictroute && rt->rt_uses_gateway)//如果数据包启用了严格路由处理，且下一跳不是网关         goto sr_failed;//发送ICMP_SR_FAILED icmp       IPCB(skb)->flags |= IPSKB_FORWARDED;     mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);     if (ip_exceeds_mtu(skb, mtu)) {         IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,               htonl(mtu));         goto drop;     }       /* We are about to mangle packet. Copy it! 确保空间足够*/     if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+rt->dst.header_len))         goto drop;     iph = ip_hdr(skb);       /* Decrease ttl after skb cow done */     ip_decrease_ttl(iph);       /*      *  We now generate an ICMP HOST REDIRECT giving the route      *  we calculated.      */     if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&         !skb_sec_path(skb))         ip_rt_send_redirect(skb);//数据报文输出路由存在重定向标志，且该数据报中不存在源路由选项，就发送重定向icmp报文       skb->priority = rt_tos2priority(iph->tos);       return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,                net, NULL, skb, skb->dev, rt->dst.dev,                ip_forward_finish);   sr_failed:     /*      *  Strict routing permits no gatewaying      */      icmp_send(skb, ICMP_DEST_UNREACH, ICMP_SR_FAILED, 0);      goto drop;   too_many_hops:     /* Tell the sender its packet died... */     __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);     icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0); drop:     kfree_skb(skb);     return NET_RX_DROP; } static int ip_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb) {     struct ip_options *opt  = &(IPCB(skb)->opt);       __IP_INC_STATS(net, IPSTATS_MIB_OUTFORWDATAGRAMS);     __IP_ADD_STATS(net, IPSTATS_MIB_OUTOCTETS, skb->len);       if (unlikely(opt->optlen))         ip_forward_options(skb);//IP数据报文选项 记录路由选项 时间戳等       return dst_output(net, sk, skb);//指向ip_output ip_mc_output }

 

ip_forward