浅析TCP协议报文生成过程

左手的ㄟ右手 2023-06-29 05:56 15阅读 0赞

# 背景 #

继上篇 :[图解Java服务端Socket建立原理][Java_Socket] 后,我们继续介绍 TCP协议报文的生成过程

# 报文与协议关系 #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg_size_16_color_FFFFFF_t_70]  
上图展示了osi七层与tcp/ip四层的对应关系,以及展示协议报文封装过程以及与tcp/ip四层的对应关系

## 报文内容 ##

![tcp协议包][tcp]  
报文格式与其tcp各层关系如上所示

# 主要的数据结构 #

sk\_bufff结构是Linux网络模块中最重要的数据结构之一，用以描述已接收或待发送的数据报文信息.  
sk\_buff负责描述数据报文,tcp/ip各层都是针对sk\_buff结构进行处理,并传递给下一层的.下图描述了发送报文的sk\_buff与其它相关数据结构的关系  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg_size_16_color_FFFFFF_t_70 1]  
struct sock是套接字在传输层的结构.  
报文的真正内容是在sk\_buff数据区  
sk\_buff是用来描述管理报文sk\_buff数据区

# TCP报文包的生成 #

![报文生成流程][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg_size_16_color_FFFFFF_t_70 2]

# TCP报文生成代码 #

## 传输层(tcp层) ##

网络数据包的发送过程起始于应用层的函数调用(如上图的send函数),随后会调用tcp\_sendmsg函数,如上图所示,层层调用到tcp\_transmit\_skb函数完成TCP协议处理,封闭tcp包头,最后调用这里最终调用的ip层的ip\_queue\_xmit方法

//tcp_sendmsg函数的主要逻辑是在tcp_sendmsg_locked函数
      int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
    {
        ...
        //得到当前mss长度和数据包最大长度
        mss_now = tcp_send_mss(sk, &size_goal, flags);
        ...
    	while (msg_data_left(msg)) {
        	...
        	//从tcp写入队列sk_write_queue中拿出最后一个struct sk_buff
        	skb = tcp_write_queue_tail(sk);
        	//copy<=0表示不能合并到之前skb做GSO,或者被设置了eor标记不能合并
        	if (copy <= 0 || !tcp_skb_can_collapse_to(skb)) {
        	    //在TCP的重传队列和发送队列都为空的情况下
        	    first_skb = tcp_rtx_and_write_queues_empty(sk);
        	    //重新分配skb结构
    		    skb = sk_stream_alloc_skb(sk,
    						  select_size(sk, sg, first_skb),
    						  sk->sk_allocation,
    						  first_skb);
    			// 加入发送队列
    			skb_entail(sk, skb);	
        	}
        }
        ...
        //发送,会调用__tcp_push_pending_frames方法,再调用tcp_write_xmit方法,再调tcp_transmit_skb
        tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        ...
    }
    static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
    			    gfp_t gfp_mask)
    {
       ...
       	th = (struct tcphdr *)skb->data;
       	//本例子中source端口内存值为0xd204,因为tcp是大端模式,实际值应该是0x04d2,即是10进制的1234，即为本服务器的端口
    	th->source		= inet->inet_sport;
    	//本例子desc为0x1c90,实际就是0x901c,即10进制的36892，刚好是客户端的端口
    	th->dest		= inet->inet_dport;
    	th->seq			= htonl(tcb->seq);
    	th->ack_seq		= htonl(tp->rcv_nxt);
    	*(((__be16 *)th) + 6)	= htons(((tcp_header_size >> 2) << 12) |
    					tcb->tcp_flags);
    	th->check		= 0;
    	th->urg_ptr		= 0;
       ...
       //这里最终调用的是ip_queue_xmit
        err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl);
    }

## 网络层(ip层) ##

tcp层最后会调用ip层的ip\_queue\_xmit方法,在这方法会,会对报文的ip包头进行设置,随后经层层调用经过邻居子系统后,再调用dev\_queue\_xmit函数,进入网络介质层

int ip_queue_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl)
    {
        ...
        //设置ip包头
        iph = ip_hdr(skb);
    	*((__be16 *)iph) = htons((4 << 12) | (5 << 8) | (inet->tos & 0xff));
    	if (ip_dont_fragment(sk, &rt->dst) && !skb->ignore_df)
    		iph->frag_off = htons(IP_DF);
    	else
    		iph->frag_off = 0;
    	iph->ttl      = ip_select_ttl(inet, &rt->dst);
    	iph->protocol = sk->sk_protocol;
    	ip_copy_addrs(iph, fl4);
    
    	/* Transport layer set skb->h.foo itself. */
    
    	if (inet_opt && inet_opt->opt.optlen) {
    		iph->ihl += inet_opt->opt.optlen >> 2;
    		ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
    	}
        ...
        //会调用:__ip_local_out
        res = ip_local_out(net, sk, skb);
        ...
    }
    int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
    {
        ...
        //截取数据包,对数据包干预
    	return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
    		       net, sk, skb, NULL, skb_dst(skb)->dev,
    		       dst_output);
    }
    static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
    {
        ...
        //获取下一跳
        nexthop = (__force u32) rt_nexthop(rt, ip_hdr(skb)->daddr);
        //获取邻居子系统
    	neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
    	...
        //通过邻居子系统输出,neigh_output调用了neigh_hh_output
        res = neigh_output(neigh, skb);
        ...
    }

作者: 吴炼钿

[Java_Socket]: https://blog.csdn.net/vipshop_fin_dev/article/details/102966081
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200110225042729.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg==,size_16,color_FFFFFF,t_70
[tcp]: https://img-blog.csdnimg.cn/20200110224727672.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200110230427241.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200111090039669.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3ZpcHNob3BfZmluX2Rldg==,size_16,color_FFFFFF,t_70