框架如下
PING程序
A.使用的SOCKET接口
1. socket
2. sendto
3. recvfrom
B.PING地址:127.0.0.1
TCP/IP协议栈:
1. IP层
2. ICMP层
很可惜,在这次学习中没能深入路由表的检索中~,感觉还需努力哈~ 希望大家推荐一些路由算法的资料或者书籍 T ^T 不要太深~ 够PING使用就行了~
选择PING本机是因为能了解收发的过程,同时也除去了对网卡硬件的了解的限制,在最小程度下了解TCP/IP协议栈的基本工作原理
在文中有对TCP/IP协议栈理解不足和错误的地方,请大家一定要拍砖指正 = 3= 万分感谢
好~ = 3=)/ 首先来看看PING程序
下面这段PING程序来自网上,感谢这位梁生的无偿奉献 = 3=)/
我稍微做了一下修改,可能不大美观和严谨,C语言编程功夫还需提高啊
|
/***********************************************************
* 作者:梁俊辉 *
* 时间:2001年10月 *
* 名称：myping.c *
* 说明:本程序用于演示ping命令的实现原理 *
***********************************************************/
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netdb.h>
#include <setjmp.h>
#include <errno.h>
#define PACKET_SIZE 4096
#define MAX_WAIT_TIME 5
#define MAX_NO_PACKETS 3
char sendpacket[PACKET_SIZE];
char recvpacket[PACKET_SIZE];
int sockfd,datalen=56;
int nsend=0,nreceived=0;
struct sockaddr_in dest_addr;
pid_t pid;
struct sockaddr_in from;
void statistics(int signo);
unsigned short cal_chksum(unsigned short *addr,int len);
int pack(int pack_no);
void send_packet(void);
void recv_packet(void);
int unpack(char *buf,int len);
void tv_sub(struct timeval *out,struct timeval *in);
void statistics(int signo)
{
printf("\n--------------------PING statistics-------------------\n");
printf("%d packets transmitted, %d received , %%%d lost\n",nsend,nreceived,(nsend-nreceived)/nsend*100);
close(sockfd);
exit(1);
}
/*校验和算法*/
unsigned short cal_chksum(unsigned short *addr,int len)
{
int nleft=len;
int sum=0;
unsigned short *w=addr;
unsigned short answer=0;
/*把ICMP报头二进制数据以2字节为单位累加起来*/
while(nleft>1)
{
sum+=*w++;
nleft-=2;
}
/*若ICMP报头为奇数个字节，会剩下最后一字节。把最后一个字节视为一个2字节数据的高字节，这个2字节数据的低字节为0，继续累加*/
if( nleft==1)
{
*(unsigned char *)(&answer)=*(unsigned char *)w;
sum+=answer;
}
sum=(sum>>16)+(sum&0xffff);
sum+=(sum>>16);
answer=~sum;
return answer;
}
/*设置ICMP报头*/
int pack(int pack_no)
{
int i,packsize;
struct icmp *icmp;
struct timeval * tval;
//将sendpacket强制转换成icmp结构
icmp = (struct icmp*)sendpacket;
icmp->icmp_type = ICMP_ECHO; //设置ICMP报文类型
icmp->icmp_code = 0;
icmp->icmp_cksum = 0;
icmp->icmp_seq = pack_no;
icmp->icmp_id = pid;
packsize = 8 + datalen;
tval = (struct timeval *)icmp->icmp_data;
gettimeofday(tval,NULL);
icmp->icmp_cksum = cal_chksum( (unsigned short *)icmp,packsize); /*校验算法*/
return packsize;
}
/*发送三个ICMP报文*/
void send_packet()
{
int packetsize;
while( nsend < MAX_NO_PACKETS)
{
nsend++;
packetsize = pack(nsend); /*设置ICMP报头*/
//int sendto ( SOCKET s , const char FAR *buf , int len , int flags , const struct sockaddr FAR *to , int token );
//[参数]
//s - 指向用Socket函数生成的Socket
//buf - 接受数据的缓冲区(数组)的指针
//len - 缓冲区的大小
//flag - 调用方式(MSG_DONTROUTE , MSG_OOB)
//to - 指向发送方SOCKET地址的指针
//token - 发送方SOCKET地址的大小
if( sendto(sockfd,sendpacket,packetsize,0,(struct sockaddr *)&dest_addr,sizeof(dest_addr) )<0 )
{
perror("sendto error");
continue;
}
sleep(1); /*每隔一秒发送一个ICMP报文*/
}
}
/*接收所有ICMP报文*/
void recv_packet()
{
int n,fromlen;
extern int errno;
signal(SIGALRM,statistics);
fromlen=sizeof(from);
while( nreceived<nsend)
{
alarm(MAX_WAIT_TIME);
//recvfrom()返回读入的字节数
if( (n = recvfrom(sockfd,recvpacket,sizeof(recvpacket),0,(struct sockaddr *)&from,&fromlen)) <0)
{
if(errno==EINTR)
continue;
perror("recvfrom error");
continue;
}
//解读收到的icmp包
if(unpack(recvpacket,n) == -1)
continue;
nreceived++;
}
}
/*剥去ICMP报头*/
int unpack(char *buf,int len)
{
int i,iphdrlen;
struct ip *ip;
struct icmp *icmp;
ip = (struct ip *)buf;
iphdrlen = ip->ip_hl << 2; /*求ip报头长度,即ip报头的长度标志乘4*/
icmp = (struct icmp *)(buf+iphdrlen); /*越过ip报头,指向ICMP报头*/
len -= iphdrlen; /*ICMP报头及ICMP数据报的总长度*/
if( len < 8) /*小于ICMP报头长度则不合理*/
{
printf("ICMP packets\'s length is less than 8\n");
return -1;
}
/*确保所接收的是自己发的ICMP的回应*/
if( (icmp->icmp_type == ICMP_ECHOREPLY) && (icmp->icmp_id == pid) )
{
/*显示相关信息*/
printf("%d byte from %s: icmp_seq=%u ttl=%d \n",
len,
inet_ntoa(from.sin_addr),
icmp->icmp_seq,
ip->ip_ttl
);
}
else
return -1;
}
int main(int argc,char *argv[])
{
struct hostent *host;
struct protoent *protocol;
unsigned long int inaddr = 0;
int waittime=MAX_WAIT_TIME;
int size=50*1024;
//检测参数是否过少
if(argc<2)
{
printf("usage:%s hostname/IP address\n",argv[0]);
exit(1);
}
//getprotobyname()返回对应于给定协议名的包含名字和协议号的protoent结构指针
//结构的成员有：
//成员 用途
//p_name 正规的协议名。
//p_aliases 一个以空指针结尾的可选协议名队列。
//p_proto 以主机字节顺序排列的协议号
if( (protocol=getprotobyname("icmp") )==NULL)
{
perror("getprotobyname");
exit(1);
}
/*生成使用ICMP的原始套接字,这种套接字只有root用户才能生成*/
if( (sockfd = socket(AF_INET,SOCK_RAW,protocol->p_proto) ) < 0)
{
perror("socket error");
exit(1);
}
/* 回收root权限,设置当前用户权限*/
setuid(getuid());
//初始化dest_addr
bzero(&dest_addr,sizeof(dest_addr));
//设置协议家族类型为 AF_INET
dest_addr.sin_family = AF_INET;
/*判断是主机名还是ip地址*/
if( inaddr = inet_addr(argv[1]) == INADDR_NONE)
{
//通过dns取得ip地址
if((host = gethostbyname(argv[1]) )==NULL) /*是主机名*/
{
perror("gethostbyname error");
exit(1);
}
memcpy( (char *)&dest_addr.sin_addr,host->h_addr,host->h_length);
}
else
{ /*是ip地址*/
inaddr = inet_addr(argv[1]);
memcpy( (char *)&dest_addr.sin_addr,(char *)&inaddr,sizeof(inaddr));
}
/*获取main的进程id,用于设置ICMP的标志符*/
pid=getpid();
printf("PING %s(%s): %d bytes data in ICMP packets.\n",argv[1],inet_ntoa(dest_addr.sin_addr),datalen);
send_packet(); /*发送所有ICMP报文*/
recv_packet(); /*接收所有ICMP报文*/
statistics(SIGALRM); /*进行统计*/
return 0;
}
|
PING的流程在上面已经有详细的注释了,我就不说了
PING程序的主要流程分为3个步骤
1. 建立一个socket结构 ->socket
2. 用这个socket发送ICMP包 ->sendto
3. 用这个socket接收ICMP包 ->recvfrom
由于是PING本机,所以在TCP/IP协议栈中会有4个部分的内容
1. 建立socket
2. 通过socket发送ICMP包
3. 本机收到ICMP包后发送应答
4. 通过socket接收ICMP包
下面我们就来进入TCP/IP协议栈来看看这3个系统调用如何为我们的PING程序服务的
首先是第1部分,建立一个socket结构
sockfd = socket(AF_INET,SOCK_RAW,protocol->p_proto)
这个函数会执行系统调用sys_socketcall
sys_socketcall在/net/socket.c中
|
asmlinkage long sys_socketcall(int call, unsigned long __user *args)
{
unsigned long a[6];
unsigned long a0, a1;
int err;
//检测参数的数量是否合理
if (call < 1 || call > SYS_RECVMSG)
return -EINVAL;
/* copy_from_user should be SMP safe. */
//从用户空间拷贝参数到内核空间,复制在a[]数组里
if (copy_from_user(a, args, nargs[call]))
return -EFAULT;
//取得所要判断的跳跃类型
err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
if (err)
return err;
a0 = a[0];
a1 = a[1];
switch (call) {
case SYS_SOCKET:
err = sys_socket(a0, a1, a[2]);
break;
.........................
case SYS_SENDTO:
err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
(struct sockaddr __user *)a[4], a[5]);
break;
...............................
case SYS_RECVFROM:
err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
(struct sockaddr __user *)a[4],
(int __user *)a[5]);
break;
default:
err = -EINVAL;
break;
}
return err;
}
|
上面只列出了我们所用到的3个case
现在我们的目标是case SYS_SOCKET,也就是要创建一个socket了
sys_socket在/net/socket.c中
|
asmlinkage long sys_socket(int family, int type, int protocol)
{
int retval;
struct socket *sock;
//创建一个socket
retval = sock_create(family, type, protocol, &sock);
if (retval < 0)
goto out;
//将该socket映射到fd中
retval = sock_map_fd(sock);
if (retval < 0)
goto out_release;
out:
/* It may be already another descriptor 8) Not kernel problem. */
return retval;
out_release:
sock_release(sock);
return retval;
}
|
很简单的调用
sock_create在/net/socket.c中
|
int sock_create(int family, int type, int protocol, struct socket **res)
{
return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
}
|
继续,进入到__sock_create中
|
static int __sock_create(struct net *net, int family, int type, int protocol,
struct socket **res, int kern)
{
int err;
struct socket *sock;
const struct net_proto_family *pf;
/*
* Check protocol is in range
*/
//检测协议家族类型是否在范围之内
if (family < 0 || family >= NPROTO)
return -EAFNOSUPPORT;
//检测协议传输类型是否在范围之内
if (type < 0 || type >= SOCK_MAX)
return -EINVAL;
/* Compatibility.
This uglymoron is moved from INET layer to here to avoid
deadlock in module load.
*/
//检测协议家族类型是否为PF_INET
//检测协议传输类型是否为SOCK_PACKET
if (family == PF_INET && type == SOCK_PACKET)
{
static int warned;
if (!warned)
{
warned = 1;
printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
current->comm);
}
family = PF_PACKET;
}
err = security_socket_create(family, type, protocol, kern);
if (err)
return err;
/*
* Allocate the socket and allow the family to set things up. if
* the protocol is 0, the family is instructed to select an appropriate
* default.
*/
//分配一个socket
sock = sock_alloc();
//检测分配是否成功
if (!sock)
{
if (net_ratelimit())
printk(KERN_WARNING "socket: no more sockets\n");
return -ENFILE; /* Not exactly a match, but its the
closest posix thing */
}
//设置协议传输类型
sock->type = type;
#if defined(CONFIG_KMOD)
/* Attempt to load a protocol module if the find failed.
*
* 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
* requested real, full-featured networking support upon configuration.
* Otherwise module support will break!
*/
if (net_families[family] == NULL)
request_module("net-pf-%d", family);
#endif
rcu_read_lock();
//根据协议类型取得对应的协议家族结构
pf = rcu_dereference(net_families[family]);
err = -EAFNOSUPPORT;
//检测取得协议结构是否成功
if (!pf)
goto out_release;
/*
* We will call the ->create function, that possibly is in a loadable
* module, so we have to bump that loadable module refcnt first.
*/
//增加协议家族的使用计数器
if (!try_module_get(pf->owner))
goto out_release;
/* Now protected by module ref count */
rcu_read_unlock();
//运行协议家族结构中的对socket初始化函数
err = pf->create(net, sock, protocol);
//检测初始化是否成功
if (err < 0)
goto out_module_put;
/*
* Now to bump the refcnt of the [loadable] module that owns this
* socket at sock_release time we decrement its refcnt.
*/
//增加socket所使用的协议的使用计数器
if (!try_module_get(sock->ops->owner))
goto out_module_busy;
/*
* Now that we're done with the ->create function, the [loadable]
* module can have its refcnt decremented
*/
//减少协议家族使用计数器
module_put(pf->owner);
err = security_socket_post_create(sock, family, type, protocol, kern);
if (err)
goto out_sock_release;
//设置socket指针为初始化完成的socket
*res = sock;
return 0;
out_module_busy:
err = -EAFNOSUPPORT;
out_module_put:
sock->ops = NULL;
module_put(pf->owner);
out_sock_release:
sock_release(sock);
return err;
out_release:
rcu_read_unlock();
goto out_sock_release;
}
|
security_socket_create,关于security的内容我们都略过,一来减少框架的复杂度,二来我也不知道security主要做的是啥 哈哈 不过可以肯定的是不会妨碍TCP/IP协议栈的正常运行
首先是sock_alloc
sock_alloc在/net/socket.c中
|
static struct socket *sock_alloc(void)
{
struct inode *inode;
struct socket *sock;
inode = new_inode(sock_mnt->mnt_sb);
if (!inode)
return NULL;
sock = SOCKET_I(inode);
inode->i_mode = S_IFSOCK | S_IRWXUGO;
inode->i_uid = current->fsuid;
inode->i_gid = current->fsgid;
get_cpu_var(sockets_in_use)++;
put_cpu_var(sockets_in_use);
return sock;
}
|
主要是申请一个新的socket,并对他的文件属性进行初始化,socket是属于虚拟文件系统的一部分,我们暂时只要这一点就好了
回到__sock_create中,然后到
pf = rcu_dereference(net_families[family]);
net_families的初始化我们也不分析,因为涉及的面太广,为了紧扣PING,我们只需要知道得到了inet_family_ops这个结构就可以了,详细的初始化部分在/net/ipv4/af_inet.c中,大家有兴趣的可以看看
inet_family_ops的结构如下
|
static struct net_proto_family inet_family_ops = {
.family = PF_INET,
.create = inet_create,
.owner = THIS_MODULE,
};
|
紧接着我们就到了
err = pf->create(net, sock, protocol);
调用inet_family_ops的create函数
inet_create在/net/ipv4/af_inet.c中
|
static int inet_create(struct net *net, struct socket *sock, int protocol)
{
struct sock *sk;
struct list_head *p;
struct inet_protosw *answer;
struct inet_sock *inet;
struct proto *answer_prot;
unsigned char answer_flags;
char answer_no_check;
int try_loading_module = 0;
int err;
//检测socket的协议传输类型是否为RAW
//检测socket的协议传输类型是否为DGRAM
//第三个不知道检测的什么
if (sock->type != SOCK_RAW &&
sock->type != SOCK_DGRAM &&
!inet_ehash_secret)
build_ehash_secret();
//设置socket的状态为未连接
sock->state = SS_UNCONNECTED;
/* Look for the requested type/protocol pair. */
//初始化协议结构
answer = NULL;
lookup_protocol:
err = -ESOCKTNOSUPPORT;
rcu_read_lock();
//历遍协议族
list_for_each_rcu(p, &inetsw[sock->type])
{
//取得对应的协议的结构
answer = list_entry(p, struct inet_protosw, list);
/* Check the non-wild match. */
//检测需要的协议是否和当前历遍的协议相等
if (protocol == answer->protocol)
{
//检测需要的协议是否为IP协议
if (protocol != IPPROTO_IP)
//跳出循环
break;
}
else
{
/* Check for the two wild cases. */
//检测需要的协议是否为IP协议
if (IPPROTO_IP == protocol)
{
//设置需要的协议为当前历遍的协议
protocol = answer->protocol;
//跳出循环
break;
}
//检测当前历遍的协议是否为IP协议
if (IPPROTO_IP == answer->protocol)
//跳出循环
break;
}
err = -EPROTONOSUPPORT;
//设置协议结构为空
answer = NULL;
}
//检测取得协议是否为空
if (unlikely(answer == NULL))
{
if (try_loading_module < 2)
{
rcu_read_unlock();
/*
* Be more specific, e.g. net-pf-2-proto-132-type-1
* (net-pf-PF_INET-proto-IPPROTO_SCTP-type-SOCK_STREAM)
*/
if (++try_loading_module == 1)
request_module("net-pf-%d-proto-%d-type-%d",
PF_INET, protocol, sock->type);
/*
* Fall back to generic, e.g. net-pf-2-proto-132
* (net-pf-PF_INET-proto-IPPROTO_SCTP)
*/
else
request_module("net-pf-%d-proto-%d",
PF_INET, protocol);
goto lookup_protocol;
}
else
goto out_rcu_unlock;
}
err = -EPERM;
if (answer->capability > 0 && !capable(answer->capability))
goto out_rcu_unlock;
err = -EAFNOSUPPORT;
if (!inet_netns_ok(net, protocol))
goto out_rcu_unlock;
//设置socket的协议次操作集为当前协议结构的操作集
sock->ops = answer->ops;
answer_prot = answer->prot;
answer_no_check = answer->no_check;
answer_flags = answer->flags;
rcu_read_unlock();
BUG_TRAP(answer_prot->slab != NULL);
err = -ENOBUFS;
//分配一个sock结构
sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot);
//检测分配是否成功
if (sk == NULL)
goto out;
err = 0;
sk->sk_no_check = answer_no_check;
if (INET_PROTOSW_REUSE & answer_flags)
sk->sk_reuse = 1;
//将sock结构强制转换成inet_sock结构
inet = inet_sk(sk);
inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
//检测协议传输类型是否为未处理
if (SOCK_RAW == sock->type)
{
//设置本地端口号为协议类型
inet->num = protocol;
//检测协议类型是否为未处理
if (IPPROTO_RAW == protocol)
inet->hdrincl = 1;
}
if (ipv4_config.no_pmtu_disc)
inet->pmtudisc = IP_PMTUDISC_DONT;
else
inet->pmtudisc = IP_PMTUDISC_WANT;
inet->id = 0;
//初始化sock
sock_init_data(sock, sk);
//设置sock的回收处理函数
sk->sk_destruct = inet_sock_destruct;
//设置sock的协议家族类型
sk->sk_family = PF_INET;
//设置sock的协议类型
sk->sk_protocol = protocol;
sk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
inet->uc_ttl = -1;
inet->mc_loop = 1;
inet->mc_ttl = 1;
inet->mc_index = 0;
inet->mc_list = NULL;
sk_refcnt_debug_inc(sk);
//检测本地端口号是否存在
if (inet->num)
{
/* It assumes that any protocol which allows
* the user to assign a number at socket
* creation time automatically
* shares.
*/
//设置对方端口号为本地端口号
inet->sport = htons(inet->num);
/* Add to protocol hash chains. */
sk->sk_prot->hash(sk);
}
//检测协议初始化函数是否存在
if (sk->sk_prot->init)
{
//执行协议初始化函数
err = sk->sk_prot->init(sk);
if (err)
sk_common_release(sk);
}
out:
return err;
out_rcu_unlock:
rcu_read_unlock();
goto out;
}
|
inetsw结构的注册不关心,我们看结果
answer就是其中的第二项
这里我们的protocol为IPPROTO_ICMP
answer->protocol为IPPROTO_IP
所以是进入了if (IPPROTO_IP == answer->protocol)后break跳出了循环
之后到inet_netns_ok
inet_netns_ok在/net/ipv4/af_inet.c中
|
static inline int inet_netns_ok(struct net *net, int protocol)
{
int hash;
struct net_protocol *ipprot;
if (net == &init_net)
return 1;
//取得哈希值
hash = protocol & (MAX_INET_PROTOS - 1);
//取得哈希值对应的协议
ipprot = rcu_dereference(inet_protos[hash]);
//检测协议是否为空
if (ipprot == NULL)
/* raw IP is OK */
return 1;
return ipprot->netns_ok;
}
|
由于在__sock_create中我们传入的net类型为init_net,所以这里是返回1,不会goto out_rcu_unlock结束的
继续在inet_create中向下走,来到了sk_alloc
sk_alloc在/net/core/sock.c中
|
struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
struct proto *prot)
{
struct sock *sk;
//分配一个sock结构
sk = sk_prot_alloc(prot, priority | __GFP_ZERO, family);
//检测分配是否成功
if (sk)
{
//设置协议家族类型
sk->sk_family = family;
/*
* See comment in struct sock definition to understand
* why we need sk_prot_creator -acme
*/
//设置协议主操作集
sk->sk_prot = sk->sk_prot_creator = prot;
sock_lock_init(sk);
sock_net_set(sk, get_net(net));
}
return sk;
}
|
sk_prot_alloc在协议结构的高速缓存中分配一个sock结构,分配成功后进行一些简单的初始化操作便退出了
继续向下走,到sock_init_data
sock_init_data在/net/core/sock.c中
|
void sock_init_data(struct socket *sock, struct sock *sk)
{
//初始化skb接收队列
skb_queue_head_init(&sk->sk_receive_queue);
//初始化skb发送队列
skb_queue_head_init(&sk->sk_write_queue);
//初始化skb错误队列
skb_queue_head_init(&sk->sk_error_queue);
#ifdef CONFIG_NET_DMA
skb_queue_head_init(&sk->sk_async_wait_queue);
#endif
sk->sk_send_head = NULL;
init_timer(&sk->sk_timer);
sk->sk_allocation = GFP_KERNEL;
sk->sk_rcvbuf = sysctl_rmem_default;
sk->sk_sndbuf = sysctl_wmem_default;
sk->sk_state = TCP_CLOSE;
//连接socket到sock
sk->sk_socket = sock;
sock_set_flag(sk, SOCK_ZAPPED);
//检测socket是否存在
if (sock)
{
//设置sock的协议传输类型
sk->sk_type = sock->type;
//设置sock的等待队列
sk->sk_sleep = &sock->wait;
//连接sock到socket
sock->sk = sk;
}
else
//设置sock的等待队列为空
sk->sk_sleep = NULL;
rwlock_init(&sk->sk_dst_lock);
rwlock_init(&sk->sk_callback_lock);
lockdep_set_class_and_name(&sk->sk_callback_lock,
af_callback_keys + sk->sk_family,
af_family_clock_key_strings[sk->sk_family]);
//设置sock的状态改变处理函数
sk->sk_state_change = sock_def_wakeup;
//设置sock的数据准备处理函数
sk->sk_data_ready = sock_def_readable;
sk->sk_write_space = sock_def_write_space;
//设置sock的错误处理函数
sk->sk_error_report = sock_def_error_report;
//设置sock的回收处理函数
sk->sk_destruct = sock_def_destruct;
//发送数据的缓冲页面
sk->sk_sndmsg_page = NULL;
//发送数据的缓冲页面偏移值
sk->sk_sndmsg_off = 0;
sk->sk_peercred.pid = 0;
sk->sk_peercred.uid = -1;
sk->sk_peercred.gid = -1;
sk->sk_write_pending = 0;
sk->sk_rcvlowat = 1;
sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
sk->sk_stamp = ktime_set(-1L, 0);
atomic_set(&sk->sk_refcnt, 1);
atomic_set(&sk->sk_drops, 0);
}
|
这是个大家伙,负责sock结构的详细初始化
初始化完成后继续inet_create的执行
由于之前设置了inet->num为协议号,这里会执行sk->sk_prot->hash
在进入这个函数之前让我们先来看一下目前sock的结构
sk_prot为一个宏 #define sk_prot __sk_common.skc_prot
指向了raw_prot,所以sk->sk_prot->hash就是执行了raw_hash_sk
raw_hash_sk在/net/ipv4/raw.c中
|
void raw_hash_sk(struct sock *sk)
{
struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
struct hlist_head *head;
head = &h->ht[inet_sk(sk)->num & (RAW_HTABLE_SIZE - 1)];
write_lock_bh(&h->lock);
sk_add_node(sk, head);
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
write_unlock_bh(&h->lock);
}
|
主要是将raw_prot连接到了socket的队列中,如下图
因为raw_prot是有raw_init这个函数的,所以我们进入到sk->sk_prot->init
raw_init在/net/ipv4/raw.c中
|
static int raw_init(struct sock *sk)
{
//把sock结构强制转换为raw_sock结构
struct raw_sock *rp = raw_sk(sk);
//检测端口号是否为ICMP
if (inet_sk(sk)->num == IPPROTO_ICMP)
//清空icmp_filter结构
memset(&rp->filter, 0, sizeof(rp->filter));
return 0;
}
|
结构图如下
为什么能一直这样强制转换下去,就不怕结构超界么?
其实这是一早有预谋的,在raw_prot中有一个成员为
.obj_size = sizeof(struct raw_sock)
而在协议中分配空间的时候就已经分配了raw_sock所需要的空间,我们一直在用他的一部分而已
好, 到这里inet_create就完成了,一路返回到sys_socket中
执行最后一步,把初始化好的socket结构映射到一个文件描述符中,并返回这个文件描述符
这样,我们的ping程序的sockfd就拿到了一个按要求初始化好的socket结构索引号了
在之后的sendto和recvfrom操作中就能够使用这个索引号进行发送和接收了
然后到第2部分,发送初始化好的icmp结构
sendto(sockfd,sendpacket,packetsize,0,(struct sockaddr *)&dest_addr,sizeof(dest_addr)
继续来到系统调用sys_socketcall中
这次我们的目标是case SYS_SENDTO
sys_sendto在/net/socket.c中
|
asmlinkage long sys_sendto(int fd, void __user *buff, size_t len,
unsigned flags, struct sockaddr __user *addr,
int addr_len)
{
struct socket *sock;
char address[MAX_SOCK_ADDR];
int err;
struct msghdr msg;
struct iovec iov;
int fput_needed;
//从文件描述符中返回socket
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock)
goto out;
//取得需要发送数据的起始地址
iov.iov_base = buff;
//取得需要发送数据的数据长度
iov.iov_len = len;
msg.msg_name = NULL;
//连接iov到msg
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_control = NULL;
msg.msg_controllen = 0;
msg.msg_namelen = 0;
//是否有地址参数
if (addr)
{
//从用户数据转换为内核数据
err = move_addr_to_kernel(addr, addr_len, address);
if (err < 0)
goto out_put;
//设置地址
msg.msg_name = address;
//设置地址长度
msg.msg_namelen = addr_len;
}
if (sock->file->f_flags & O_NONBLOCK)
flags |= MSG_DONTWAIT;
msg.msg_flags = flags;
err = sock_sendmsg(sock, &msg, len);
out_put:
fput_light(sock->file, fput_needed);
out:
return err;
}
|
初始化好的msg结构如下
在iovec结构中保存了我们要发送数据的首地址和大小
然后进入到sock_sendmsg
sock_sendmsg在/net/socket.c中
|
int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
{
struct kiocb iocb;
struct sock_iocb siocb;
int ret;
init_sync_kiocb(&iocb, NULL);
iocb.private = &siocb;
ret = __sock_sendmsg(&iocb, sock, msg, size);
if (-EIOCBQUEUED == ret)
ret = wait_on_sync_kiocb(&iocb);
return ret;
}
|
我不大明白kiocb的用处,google也不是说得很清楚,大概就是说关于文件同步操作方面上的,请明白的同学们指教一下 = 3=)/ 感谢 这里就不把kiocb的结构画进来了
然后进入到__sock_sendmsg
__sock_sendmsg在/net/socket.c中
|
static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
struct msghdr *msg, size_t size)
{
struct sock_iocb *si = kiocb_to_siocb(iocb);
int err;
//连接socket
si->sock = sock;
si->scm = NULL;
//连接msg
si->msg = msg;
//设置需要拷贝的数据大小
si->size = size;
err = security_socket_sendmsg(sock, msg, size);
if (err)
return err;
return sock->ops->sendmsg(iocb, sock, msg, size);
}
|
连接完成后的结构图如下
sock->ops->sendmsg调用的为inet_sockraw_ops中的sendmsg操作,也就是inet_sendmsg函数
inet_sendmsg在/net/ipv4/af_inet.c中
|
int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
size_t size)
{
struct sock *sk = sock->sk;
/* We may need to bind the socket. */
//检测端口号是否存在
if (!inet_sk(sk)->num && inet_autobind(sk))
return -EAGAIN;
return sk->sk_prot->sendmsg(iocb, sk, msg, size);
}
|
我们在之前已经设置了端口号,所以这里直接来到了sk->sk_prot->sendmsg
sk->sk_prot->sendmsg调用的是raw_prot中的sendmsg操作,也就是raw_setsockopt函数
raw_setsockopt在/net/ipv4/raw.c中
|
static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
size_t len)
{
struct inet_sock *inet = inet_sk(sk);
struct ipcm_cookie ipc;
struct rtable *rt = NULL;
int free = 0;
__be32 daddr;
__be32 saddr;
u8 tos;
int err;
err = -EMSGSIZE;
//检测数据的长度是否过长
if (len > 0xFFFF)
goto out;
/*
* Check the flags.
*/
err = -EOPNOTSUPP;
if (msg->msg_flags & MSG_OOB) /* Mirror BSD error message */
goto out; /* compatibility */
/*
* Get and verify the address.
*/
//检测是否有目的地址
if (msg->msg_namelen)
{
//将地址数据格式化成sockaddr_in结构
struct sockaddr_in *usin = (struct sockaddr_in*)msg->msg_name;
err = -EINVAL;
//检测地址数据长度是否过小
if (msg->msg_namelen < sizeof(*usin))
goto out;
//检测协议家族类型是否为AF_INET
if (usin->sin_family != AF_INET)
{
static int complained;
if (!complained++)
printk(KERN_INFO "%s forgot to set AF_INET in "
"raw sendmsg. Fix it!\n",
current->comm);
err = -EAFNOSUPPORT;
//检测是否存在协议家族类型
if (usin->sin_family)
goto out;
}
//取得目的地址IP
daddr = usin->sin_addr.s_addr;
/* ANK: I did not forget to get protocol from port field.
* I just do not know, who uses this weirdness.
* IP_HDRINCL is much more convenient.
*/
}
else
{
err = -EDESTADDRREQ;
if (sk->sk_state != TCP_ESTABLISHED)
goto out;
daddr = inet->daddr;
}
ipc.addr = inet->saddr;
ipc.opt = NULL;
ipc.oif = sk->sk_bound_dev_if;
//检测是否有控制信息
if (msg->msg_controllen)
{
err = ip_cmsg_send(sock_net(sk), msg, &ipc);
if (err)
goto out;
if (ipc.opt)
free = 1;
}
saddr = ipc.addr;
ipc.addr = daddr;
//检测是否存在ip_options
if (!ipc.opt)
//无则设置为inet_sock中的ip_options
ipc.opt = inet->opt;
//检测是否存在ip_options
if (ipc.opt)
{
err = -EINVAL;
/* Linux does not mangle headers on raw sockets,
* so that IP options + IP_HDRINCL is non-sense.
*/
if (inet->hdrincl)
goto done;
if (ipc.opt->srr)
{
if (!daddr)
goto done;
daddr = ipc.opt->faddr;
}
}
//取得服务类型
tos = RT_CONN_FLAGS(sk);
if (msg->msg_flags & MSG_DONTROUTE)
tos |= RTO_ONLINK;
//检测是否为多播地址
if (ipv4_is_multicast(daddr))
{
if (!ipc.oif)
ipc.oif = inet->mc_index;
if (!saddr)
saddr = inet->mc_addr;
}
//进行路由表查询
{
struct flowi fl = { .oif = ipc.oif,
.mark = sk->sk_mark,
.nl_u = { .ip4_u =
{ .daddr = daddr,
.saddr = saddr,
.tos = tos } },
.proto = inet->hdrincl ? IPPROTO_RAW :
sk->sk_protocol,
};
if (!inet->hdrincl)
{
err = raw_probe_proto_opt(&fl, msg);
if (err)
goto done;
}
security_sk_classify_flow(sk, &fl);
err = ip_route_output_flow(sock_net(sk), &rt, &fl, sk, 1);
}
if (err)
goto done;
err = -EACCES;
if (rt->rt_flags & RTCF_BROADCAST && !sock_flag(sk, SOCK_BROADCAST))
goto done;
if (msg->msg_flags & MSG_CONFIRM)
goto do_confirm;
back_from_confirm:
if (inet->hdrincl)
{
err = raw_send_hdrinc(sk, msg->msg_iov, len,rt, msg->msg_flags);
}
else
{
if (!ipc.addr)
ipc.addr = rt->rt_dst;
lock_sock(sk);
//拷贝需要发送的数据到skb中
err = ip_append_data(sk, ip_generic_getfrag, msg->msg_iov, len, 0,
&ipc, rt, msg->msg_flags);
//检测拷贝是否成功
if (err)
//不成功则释放所有sock下发送队列中所有的skb
ip_flush_pending_frames(sk);
else if (!(msg->msg_flags & MSG_MORE))
//发送sk中的skb
err = ip_push_pending_frames(sk);
release_sock(sk);
}
done:
if (free)
kfree(ipc.opt);
ip_rt_put(rt);
out:
if (err < 0)
return err;
return len;
do_confirm:
dst_confirm(&rt->u.dst);
if (!(msg->msg_flags & MSG_PROBE) || len)
goto back_from_confirm;
err = 0;
goto done;
}
|
这里最关键的就是
err = ip_route_output_flow(sock_net(sk), &rt, &fl, sk, 1);
这是一个路由表查询函数
无能为力........
不过我根据DEBUG的信息把查询结果画了出来,分别为ipcm_cookie和rtable两个结构,其中最关键的为rtable中的dst_entry
rtable中的idev连接lo这个环回虚拟网卡设备
lo网卡的注册在/drivers/net/loopback.c中
由于牵涉到路由表的添加问题,我这里就不介绍他的注册了
现在回到raw_sendmsg,进入ip_append_data, ip_append_data负责将要发送的数据组装到sk_buff结构中
