IP 层收发报文简要剖析6--ip_forward 报文转发

深碍√TFBOYSˉ_ 2021-10-25 14:30 361阅读 0赞

//在函数ip_route_input_slow->ip_mkroute_input注册，
    /*
     * IP数据包的转发是由ip_forward()处理，该函数在ip_rcv_finish()
     * 通过输入路由缓存被调用。
     */
    int ip_forward(struct sk_buff *skb)
    {
    	u32 mtu;
    	struct iphdr *iph;	/* Our header */
    	struct rtable *rt;	/* Route we use */
    	struct ip_options *opt	= &(IPCB(skb)->opt);
    	struct net *net;
    
    	/* that should never happen */
    	if (skb->pkt_type != PACKET_HOST)
    		goto drop;
    
    	if (unlikely(skb->sk))
    		goto drop;
    
    	if (skb_warn_if_lro(skb))
    		goto drop;
    
    	if (!xfrm4_policy_check(NULL, XFRM_POLICY_FWD, skb))/*查找ipsec 策略路由*/
    		goto drop;
    
    	if (IPCB(skb)->opt.router_alert && ip_call_ra_chain(skb))//存在路由警告选项
    		return NET_RX_SUCCESS;
    
    	skb_forward_csum(skb);
    	net = dev_net(skb->dev);
    
    	/*
    	 *	According to the RFC, we must first decrease the TTL field. If
    	 *	that reaches zero, we must reply an ICMP control message telling
    	 *	that the packet's lifetime expired.
    	 */
    	if (ip_hdr(skb)->ttl <= 1)//ttl 减少了
    		goto too_many_hops;
    
    	if (!xfrm4_route_forward(skb))//ipsec 策略路由转发处理
    		goto drop;
    
    	rt = skb_rtable(skb);
    
    	if (opt->is_strictroute && rt->rt_uses_gateway)//如果数据包启用了严格路由处理，且下一跳不是网关
    		goto sr_failed;//发送ICMP_SR_FAILED icmp
    
    	IPCB(skb)->flags |= IPSKB_FORWARDED;
    	mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
    	if (ip_exceeds_mtu(skb, mtu)) {
    		IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
    		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
    			  htonl(mtu));
    		goto drop;
    	}
    
    	/* We are about to mangle packet. Copy it! 确保空间足够*/
    	if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+rt->dst.header_len))
    		goto drop;
    	iph = ip_hdr(skb);
    
    	/* Decrease ttl after skb cow done */
    	ip_decrease_ttl(iph);
    
    	/*
    	 *	We now generate an ICMP HOST REDIRECT giving the route
    	 *	we calculated.
    	 */
    	if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
    	    !skb_sec_path(skb))
    		ip_rt_send_redirect(skb);//数据报文输出路由存在重定向标志，且该数据报中不存在源路由选项，就发送重定向icmp报文
    
    	skb->priority = rt_tos2priority(iph->tos);
    
    	return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,
    		       net, NULL, skb, skb->dev, rt->dst.dev,
    		       ip_forward_finish);
    
    sr_failed:
    	/*
    	 *	Strict routing permits no gatewaying
    	 */
    	 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_SR_FAILED, 0);
    	 goto drop;
    
    too_many_hops:
    	/* Tell the sender its packet died... */
    	__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
    	icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
    drop:
    	kfree_skb(skb);
    	return NET_RX_DROP;
    }
    static int ip_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
    {
    	struct ip_options *opt	= &(IPCB(skb)->opt);
    
    	__IP_INC_STATS(net, IPSTATS_MIB_OUTFORWDATAGRAMS);
    	__IP_ADD_STATS(net, IPSTATS_MIB_OUTOCTETS, skb->len);
    
    	if (unlikely(opt->optlen))
    		ip_forward_options(skb);//IP数据报文选项 记录路由选项 时间戳等
    
    	return dst_output(net, sk, skb);//指向ip_output ip_mc_output
    }

ip\_forward

转载于:https://www.cnblogs.com/codestack/p/9266122.html