繼續(xù)上篇，上次講到了分片隊(duì)列的查找操作，剩下的就是分片隊(duì)列插入和重組兩個(gè)部分了，這個(gè)也是分片重組的關(guān)鍵部分。

將收到的分片插入到分片隊(duì)列是由函數(shù)inet_frag_queue()函數(shù)完成，這個(gè)函數(shù)比較長(zhǎng)，多看幾遍就好了 :-)

/* Add new segment to existing queue. */ /* 添加一個(gè)新的片段到分片隊(duì)列里面 */ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) {struct sk_buff *prev, *next;struct net_device *dev;int flags, offset;int ihl, end;int err = -ENOENT;u8 ecn;/* last_in標(biāo)志位已經(jīng)置位，這時(shí)候再收到報(bào)文就不用處理了，* 一種情況是重組已經(jīng)完成，這時(shí)候又收到了報(bào)文，可能是重傳* 當(dāng)然，分片隊(duì)列被垃圾回收定時(shí)器回收的時(shí)候也會(huì)設(shè)置這個(gè)標(biāo)志位，* 表示已廢棄。*/if (qp->q.last_in & INET_FRAG_COMPLETE)goto err;/* 下面這段描述摘自 http://blog.chinaunix.net/uid-23629988-id-3047513.html* 關(guān)于ip_frag_too_far這個(gè)函數(shù)我還沒(méi)有分析清楚，日后搞明白了補(bǔ)上，:-)* 歡迎懂得大神講一下* 1. IPCB(skb)->flags只有在本機(jī)發(fā)送IPv4分片時(shí)被置位，那么這里的檢查應(yīng)該是* 預(yù)防收到本機(jī)自己發(fā)出的IP分片。* 2. 關(guān)于ip_frag_too_far：該函數(shù)主要保證了來(lái)自同一個(gè)peer（相同的源地址）不* 會(huì)占用過(guò)多的IP分片隊(duì)列。* 3. 前面兩個(gè)條件為真時(shí)，調(diào)用ip_frag_reinit，重新初始化該隊(duì)列。出錯(cuò)，那么只* 好kill掉這個(gè)隊(duì)列了。* */if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&unlikely(ip_frag_too_far(qp)) &&unlikely(err = ip_frag_reinit(qp))) {ipq_kill(qp);goto err;}/* 獲取ip頭里面的ecn標(biāo)志位 */ecn = ip4_frag_ecn(ip_hdr(skb)->tos);offset = ntohs(ip_hdr(skb)->frag_off);/* 分片標(biāo)志位 */flags = offset & ~IP_OFFSET;offset &= IP_OFFSET;/* 得到片偏移位置，相對(duì)于原始未分片報(bào)文，單位為8字節(jié) */offset <<= 3; /* offset is in 8-byte chunks */ihl = ip_hdrlen(skb);/* Determine the position of this fragment. *//* skb的長(zhǎng)度減去IP頭就剩下數(shù)據(jù)部分長(zhǎng)度，這個(gè)長(zhǎng)度加上片偏移的長(zhǎng)度* 就得到了這段報(bào)文相對(duì)于原始報(bào)文的尾偏移*/end = offset + skb->len - ihl;err = -EINVAL;/* Is this the final fragment? *//* 如果是最后的一片 */if ((flags & IP_MF) == 0) {/* If we already have some bits beyond end* or have different end, the segment is corrupted.*//* * 既然是最后一片，尾偏移肯定要大于或者等于當(dāng)前分片隊(duì)列的長(zhǎng)度，不是的話就錯(cuò)了* * 如果已經(jīng)收到過(guò)最后分片(分片重傳)并且長(zhǎng)度和當(dāng)前skb所指向的尾偏移不一致，* 出錯(cuò)了*/if (end < qp->q.len ||((qp->q.last_in & INET_FRAG_LAST_IN) && end != qp->q.len))goto err;/* 一切正常，設(shè)置last_in 標(biāo)志位，同時(shí)將分片隊(duì)列長(zhǎng)度設(shè)置上 * 只有收到了最后一個(gè)分片報(bào)文才能夠得知完整的報(bào)文長(zhǎng)度*/qp->q.last_in |= INET_FRAG_LAST_IN;qp->q.len = end;} else {/* 如果不是最后一片，并且長(zhǎng)度不是的倍數(shù)，就截取數(shù)據(jù)到的8倍數(shù)，* 因?yàn)閿?shù)據(jù)被截取了，校驗(yàn)和也失效了，這里重置校驗(yàn)和*/if (end&7) {end &= ~7;if (skb->ip_summed != CHECKSUM_UNNECESSARY)skb->ip_summed = CHECKSUM_NONE;}if (end > qp->q.len) {/* 數(shù)據(jù)的尾部超出分片隊(duì)列總長(zhǎng)，如果已經(jīng)收到了最后的分片，說(shuō)明出錯(cuò)了，直接報(bào)錯(cuò)。不是的話更新隊(duì)列長(zhǎng)度就好。*//* Some bits beyond end -> corruption. */if (qp->q.last_in & INET_FRAG_LAST_IN)goto err;qp->q.len = end;}}/* 說(shuō)明長(zhǎng)度為空，丟棄 */if (end == offset)goto err;err = -ENOMEM;/* 去掉IP頭部 */if (pskb_pull(skb, ihl) == NULL)goto err;/* 只保留數(shù)據(jù)部分 */err = pskb_trim_rcsum(skb, end - offset);if (err)goto err;/* Find out which fragments are in front and at the back of us* in the chain of fragments so far. We must know where to put* this fragment, right?*//* 如果是第一個(gè)分片報(bào)文則直接插入 * 如果上一個(gè)報(bào)文的偏移值小于當(dāng)前偏移值則放在該報(bào)文后面即可*/ prev = qp->q.fragments_tail;if (!prev || FRAG_CB(prev)->offset < offset) {next = NULL;goto found;}/* 亂序到達(dá)的話找到它下面一個(gè)報(bào)文即可* 這里是遍歷分片列表，找到當(dāng)前報(bào)文的后一個(gè)*/prev = NULL;for (next = qp->q.fragments; next != NULL; next = next->next) {if (FRAG_CB(next)->offset >= offset)break; /* bingo! */prev = next;}found:/* We found where to put this one. Check for overlap with* preceding fragment, and, if needed, align things so that* any overlaps are eliminated.* 這時(shí)候已經(jīng)找到在分片隊(duì)列中的位置，需要和前后報(bào)文檢查看看是否有* 數(shù)據(jù)重疊。*/if (prev) {/* i等于與上個(gè)報(bào)文重疊部分?jǐn)?shù)據(jù)長(zhǎng)度，如果完全落在上個(gè)報(bào)文內(nèi)部則報(bào)錯(cuò) */int i = (FRAG_CB(prev)->offset + prev->len) - offset;if (i > 0) {/* 重疊的部分直接丟棄，end <= offset說(shuō)明完全重疊 */offset += i;err = -EINVAL;if (end <= offset)goto err;err = -ENOMEM;/* 去掉重疊部分 */if (!pskb_pull(skb, i))goto err;/* 數(shù)據(jù)有變更，重置校驗(yàn)和 */if (skb->ip_summed != CHECKSUM_UNNECESSARY)skb->ip_summed = CHECKSUM_NONE;}}err = -ENOMEM;while (next && FRAG_CB(next)->offset < end) {/* 與后面緊鄰的報(bào)文重疊部分?jǐn)?shù)據(jù)長(zhǎng)度 */int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes *//* 如果重疊長(zhǎng)度小于后面skb的長(zhǎng)度，那么只需要將next skb* 的長(zhǎng)度減去重疊部分即可，同時(shí)更新偏移值和校驗(yàn)和*/if (i < next->len) {/* Eat head of the next overlapped fragment* and leave the loop. The next ones cannot overlap.*/if (!pskb_pull(next, i))goto err;FRAG_CB(next)->offset += i;qp->q.meat -= i;if (next->ip_summed != CHECKSUM_UNNECESSARY)next->ip_summed = CHECKSUM_NONE;break;} else {/* 走到這說(shuō)明重疊長(zhǎng)度大于next的長(zhǎng)度，這時(shí)候next可以直接從隊(duì)列中* 摘掉了。*/struct sk_buff *free_it = next;/* Old fragment is completely overridden with* new one drop it.*/next = next->next;if (prev)prev->next = next;elseqp->q.fragments = next;qp->q.meat -= free_it->len;/* 從分片隊(duì)列釋放該skb */frag_kfree_skb(qp->q.net, free_it);}}/* 設(shè)置該skb的控制信息，即偏移值 */FRAG_CB(skb)->offset = offset;/* Insert this fragment in the chain of fragments. *//* 插入報(bào)文，如果是最后一片則設(shè)置fragments_tail指針指向最后一片 */skb->next = next;if (!next)qp->q.fragments_tail = skb;if (prev)prev->next = skb;elseqp->q.fragments = skb;dev = skb->dev;if (dev) {/* 記錄設(shè)備的索引同時(shí)清空skb的dev指針 */ qp->iif = dev->ifindex;skb->dev = NULL;}/* 更新隊(duì)列的接收時(shí)間戳 * 更新隊(duì)列當(dāng)前收到長(zhǎng)度和，注意meat和len區(qū)別，前者保存當(dāng)前已接受部分?jǐn)?shù)據(jù)長(zhǎng)度，* 后者表示目前已知分片最大長(zhǎng)度，當(dāng)收到最后一個(gè)分片MF=0,就能夠得到原始報(bào)文長(zhǎng)度*/qp->q.stamp = skb->tstamp;qp->q.meat += skb->len;qp->ecn |= ecn;/* 增加分片內(nèi)存所占空間 */atomic_add(skb->truesize, &qp->q.net->mem);/* 設(shè)置標(biāo)志位 */if (offset == 0)qp->q.last_in |= INET_FRAG_FIRST_IN;if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&qp->q.meat == qp->q.len)/* 如果報(bào)文已經(jīng)收集齊，則調(diào)用ip_frag_reasm() 進(jìn)行重組操作 */ return ip_frag_reasm(qp, prev, dev);write_lock(&ip4_frags.lock);/* 移到lru末尾 */list_move_tail(&qp->q.lru_list, &qp->q.net->lru_list);write_unlock(&ip4_frags.lock);/* 分片還在繼續(xù)，返回EINPROGRESS */return -EINPROGRESS;err:kfree_skb(skb);return err; }

如果分片報(bào)文的集齊了就會(huì)調(diào)用ip_frag_rasm來(lái)重組，來(lái)看下：

/* Add new segment to existing queue. */ /* 添加一個(gè)新的片段到分片隊(duì)列里面 */ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) {struct sk_buff *prev, *next;struct net_device *dev;int flags, offset;int ihl, end;int err = -ENOENT;u8 ecn;/* last_in標(biāo)志位已經(jīng)置位，這時(shí)候再收到報(bào)文就不用處理了，* 一種情況是重組已經(jīng)完成，這時(shí)候又收到了報(bào)文，可能是重傳* 當(dāng)然，分片隊(duì)列被垃圾回收定時(shí)器回收的時(shí)候也會(huì)設(shè)置這個(gè)標(biāo)志位，* 表示已廢棄。*/if (qp->q.last_in & INET_FRAG_COMPLETE)goto err;/* 下面這段描述摘自 http://blog.chinaunix.net/uid-23629988-id-3047513.html* 關(guān)于ip_frag_too_far這個(gè)函數(shù)我還沒(méi)有分析清楚，日后搞明白了補(bǔ)上，:-)* 歡迎懂得大神講一下* 1. IPCB(skb)->flags只有在本機(jī)發(fā)送IPv4分片時(shí)被置位，那么這里的檢查應(yīng)該是* 預(yù)防收到本機(jī)自己發(fā)出的IP分片。* 2. 關(guān)于ip_frag_too_far：該函數(shù)主要保證了來(lái)自同一個(gè)peer（相同的源地址）不* 會(huì)占用過(guò)多的IP分片隊(duì)列。* 3. 前面兩個(gè)條件為真時(shí)，調(diào)用ip_frag_reinit，重新初始化該隊(duì)列。出錯(cuò)，那么只* 好kill掉這個(gè)隊(duì)列了。* */if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&unlikely(ip_frag_too_far(qp)) &&unlikely(err = ip_frag_reinit(qp))) {ipq_kill(qp);goto err;}/* 獲取ip頭里面的ecn標(biāo)志位 */ecn = ip4_frag_ecn(ip_hdr(skb)->tos);offset = ntohs(ip_hdr(skb)->frag_off);/* 分片標(biāo)志位 */flags = offset & ~IP_OFFSET;offset &= IP_OFFSET;/* 得到片偏移位置，相對(duì)于原始未分片報(bào)文，單位為8字節(jié) */offset <<= 3; /* offset is in 8-byte chunks */ihl = ip_hdrlen(skb);/* Determine the position of this fragment. *//* skb的長(zhǎng)度減去IP頭就剩下數(shù)據(jù)部分長(zhǎng)度，這個(gè)長(zhǎng)度加上片偏移的長(zhǎng)度* 就得到了這段報(bào)文相對(duì)于原始報(bào)文的尾偏移*/end = offset + skb->len - ihl;err = -EINVAL;/* Is this the final fragment? *//* 如果是最后的一片 */if ((flags & IP_MF) == 0) {/* If we already have some bits beyond end* or have different end, the segment is corrupted.*//* * 既然是最后一片，尾偏移肯定要大于或者等于當(dāng)前分片隊(duì)列的長(zhǎng)度，不是的話就錯(cuò)了* * 如果已經(jīng)收到過(guò)最后分片(分片重傳)并且長(zhǎng)度和當(dāng)前skb所指向的尾偏移不一致，* 出錯(cuò)了*/if (end < qp->q.len ||((qp->q.last_in & INET_FRAG_LAST_IN) && end != qp->q.len))goto err;/* 一切正常，設(shè)置last_in 標(biāo)志位，同時(shí)將分片隊(duì)列長(zhǎng)度設(shè)置上 * 只有收到了最后一個(gè)分片報(bào)文才能夠得知完整的報(bào)文長(zhǎng)度*/qp->q.last_in |= INET_FRAG_LAST_IN;qp->q.len = end;} else {/* 如果不是最后一片，并且長(zhǎng)度不是的倍數(shù)，就截取數(shù)據(jù)到的8倍數(shù)，* 因?yàn)閿?shù)據(jù)被截取了，校驗(yàn)和也失效了，這里重置校驗(yàn)和*/if (end&7) {end &= ~7;if (skb->ip_summed != CHECKSUM_UNNECESSARY)skb->ip_summed = CHECKSUM_NONE;}if (end > qp->q.len) {/* 數(shù)據(jù)的尾部超出分片隊(duì)列總長(zhǎng)，如果已經(jīng)收到了最后的分片，說(shuō)明出錯(cuò)了，直接報(bào)錯(cuò)。不是的話更新隊(duì)列長(zhǎng)度就好。*//* Some bits beyond end -> corruption. */if (qp->q.last_in & INET_FRAG_LAST_IN)goto err;qp->q.len = end;}}/* 說(shuō)明長(zhǎng)度為空，丟棄 */if (end == offset)goto err;err = -ENOMEM;/* 去掉IP頭部 */if (pskb_pull(skb, ihl) == NULL)goto err;/* 只保留數(shù)據(jù)部分 */err = pskb_trim_rcsum(skb, end - offset);if (err)goto err;/* Find out which fragments are in front and at the back of us* in the chain of fragments so far. We must know where to put* this fragment, right?*//* 如果是第一個(gè)分片報(bào)文則直接插入 * 如果上一個(gè)報(bào)文的偏移值小于當(dāng)前偏移值則放在該報(bào)文后面即可*/ prev = qp->q.fragments_tail;if (!prev || FRAG_CB(prev)->offset < offset) {next = NULL;goto found;}/* 亂序到達(dá)的話找到它下面一個(gè)報(bào)文即可* 這里是遍歷分片列表，找到當(dāng)前報(bào)文的后一個(gè)*/prev = NULL;for (next = qp->q.fragments; next != NULL; next = next->next) {if (FRAG_CB(next)->offset >= offset)break; /* bingo! */prev = next;}found:/* We found where to put this one. Check for overlap with* preceding fragment, and, if needed, align things so that* any overlaps are eliminated.* 這時(shí)候已經(jīng)找到在分片隊(duì)列中的位置，需要和前后報(bào)文檢查看看是否有* 數(shù)據(jù)重疊。*/if (prev) {/* i等于與上個(gè)報(bào)文重疊部分?jǐn)?shù)據(jù)長(zhǎng)度，如果完全落在上個(gè)報(bào)文內(nèi)部則報(bào)錯(cuò) */int i = (FRAG_CB(prev)->offset + prev->len) - offset;if (i > 0) {/* 重疊的部分直接丟棄，end <= offset說(shuō)明完全重疊 */offset += i;err = -EINVAL;if (end <= offset)goto err;err = -ENOMEM;/* 去掉重疊部分 */if (!pskb_pull(skb, i))goto err;/* 數(shù)據(jù)有變更，重置校驗(yàn)和 */if (skb->ip_summed != CHECKSUM_UNNECESSARY)skb->ip_summed = CHECKSUM_NONE;}}err = -ENOMEM;while (next && FRAG_CB(next)->offset < end) {/* 與后面緊鄰的報(bào)文重疊部分?jǐn)?shù)據(jù)長(zhǎng)度 */int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes *//* 如果重疊長(zhǎng)度小于后面skb的長(zhǎng)度，那么只需要將next skb* 的長(zhǎng)度減去重疊部分即可，同時(shí)更新偏移值和校驗(yàn)和*/if (i < next->len) {/* Eat head of the next overlapped fragment* and leave the loop. The next ones cannot overlap.*/if (!pskb_pull(next, i))goto err;FRAG_CB(next)->offset += i;qp->q.meat -= i;if (next->ip_summed != CHECKSUM_UNNECESSARY)next->ip_summed = CHECKSUM_NONE;break;} else {/* 走到這說(shuō)明重疊長(zhǎng)度大于next的長(zhǎng)度，這時(shí)候next可以直接從隊(duì)列中* 摘掉了。*/struct sk_buff *free_it = next;/* Old fragment is completely overridden with* new one drop it.*/next = next->next;if (prev)prev->next = next;elseqp->q.fragments = next;qp->q.meat -= free_it->len;/* 從分片隊(duì)列釋放該skb */frag_kfree_skb(qp->q.net, free_it);}}/* 設(shè)置該skb的控制信息，即偏移值 */FRAG_CB(skb)->offset = offset;/* Insert this fragment in the chain of fragments. *//* 插入報(bào)文，如果是最后一片則設(shè)置fragments_tail指針指向最后一片 */skb->next = next;if (!next)qp->q.fragments_tail = skb;if (prev)prev->next = skb;elseqp->q.fragments = skb;dev = skb->dev;if (dev) {/* 記錄設(shè)備的索引同時(shí)清空skb的dev指針 */ qp->iif = dev->ifindex;skb->dev = NULL;}/* 更新隊(duì)列的接收時(shí)間戳 * 更新隊(duì)列當(dāng)前收到長(zhǎng)度和，注意meat和len區(qū)別，前者保存當(dāng)前已接受部分?jǐn)?shù)據(jù)長(zhǎng)度，* 后者表示目前已知分片最大長(zhǎng)度，當(dāng)收到最后一個(gè)分片MF=0,就能夠得到原始報(bào)文長(zhǎng)度*/qp->q.stamp = skb->tstamp;qp->q.meat += skb->len;qp->ecn |= ecn;/* 增加分片內(nèi)存所占空間 */atomic_add(skb->truesize, &qp->q.net->mem);/* 設(shè)置標(biāo)志位 */if (offset == 0)qp->q.last_in |= INET_FRAG_FIRST_IN;if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&qp->q.meat == qp->q.len)/* 如果報(bào)文已經(jīng)收集齊，則調(diào)用ip_frag_reasm() 進(jìn)行重組操作 */ return ip_frag_reasm(qp, prev, dev);write_lock(&ip4_frags.lock);/* 移到lru末尾 */list_move_tail(&qp->q.lru_list, &qp->q.net->lru_list);write_unlock(&ip4_frags.lock);/* 分片還在繼續(xù)，返回EINPROGRESS */return -EINPROGRESS;err:kfree_skb(skb);return err; }/* Build a new IP datagram from all its fragments. */ /* 分片重組 */ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,struct net_device *dev) {struct net *net = container_of(qp->q.net, struct net, ipv4.frags);struct iphdr *iph;struct sk_buff *fp, *head = qp->q.fragments;int len;int ihlen;int err;u8 ecn;/* 重組之前首先將分片隊(duì)列從分片子系統(tǒng)隔離開(kāi) */ipq_kill(qp);/* 檢查ecn標(biāo)志位，0xff則丟棄該報(bào)文，之所以這么做是因?yàn)閞fc文檔建議這么做 */ecn = ip4_frag_ecn_table[qp->ecn];if (unlikely(ecn == 0xff)) {err = -EINVAL;goto out_fail;}/* Make the one we just received the head. *//* 這一步是將最后接收到的skb指針指向分片隊(duì)列的首部接收完最后一片后重組完成* 是要將skb傳遞給上層處理的。這一段代碼貌似復(fù)雜，多看幾遍就懂了，下面放上一個(gè)* 簡(jiǎn)要的圖。*/if (prev) {head = prev->next;fp = skb_clone(head, GFP_ATOMIC);if (!fp)goto out_nomem;fp->next = head->next;if (!fp->next)qp->q.fragments_tail = fp;prev->next = fp;/* skb_morph 作用基本和skb_clone一致，這里的作用是* 將剛收到的指針指向分片隊(duì)列首部，fragments就是分片* 首部。*/skb_morph(head, qp->q.fragments);head->next = qp->q.fragments->next;kfree_skb(qp->q.fragments);qp->q.fragments = head;}WARN_ON(head == NULL);WARN_ON(FRAG_CB(head)->offset != 0);/* Allocate a new buffer for the datagram. */ihlen = ip_hdrlen(head);len = ihlen + qp->q.len;/* ip報(bào)文最大65535字節(jié)，超過(guò)這個(gè)長(zhǎng)度就報(bào)錯(cuò) */err = -E2BIG;if (len > 65535)goto out_oversize;/* Head of list must not be cloned. */if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))goto out_nomem;/* If the first fragment is fragmented itself, we split* it to two chunks: the first with data and paged part* and the second, holding only fragments. *//**通常SKB數(shù)據(jù)區(qū)會(huì)由線性緩存和非線性緩存組成，超過(guò)MTU大小就要使用* 另外的skb來(lái)存儲(chǔ)，這個(gè)部分放在skb_shinfo(head)->frag_list里。* 分片隊(duì)列重組完成后也是把原來(lái)的一個(gè)個(gè)分片放到skb_shinfo(head)->frag_list里，* 所以這里為了避免和head原有的frag_list弄混(如果head存在frag_list)，將head的數(shù)據(jù)分為* 兩個(gè)部分，head存儲(chǔ)線性和非線性數(shù)據(jù)區(qū)，clone指向head的原有frag_list，同時(shí)再將分片隊(duì)列* 里的skb掛到clone后，這樣后續(xù)的上層處理就非常簡(jiǎn)單。*/if (skb_has_frag_list(head)) {struct sk_buff *clone;int i, plen = 0;/* 創(chuàng)建一個(gè)線性數(shù)據(jù)區(qū)長(zhǎng)度為0的skb */if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)goto out_nomem;clone->next = head->next;head->next = clone;/* 繼承head的frag_list */skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;/* 將head的frag_list指針 重置 */skb_frag_list_init(head);for (i = 0; i < skb_shinfo(head)->nr_frags; i++)plen += skb_frag_size(&skb_shinfo(head)->frags[i]);clone->len = clone->data_len = head->data_len - plen;head->data_len -= clone->len;head->len -= clone->len;clone->csum = 0;clone->ip_summed = head->ip_summed;atomic_add(clone->truesize, &qp->q.net->mem);}/* 再將所有的分片掛到frag_list隊(duì)列上 */skb_shinfo(head)->frag_list = head->next;/* 指針指向傳輸層首部 */skb_push(head, head->data - skb_network_header(head));/* 處理校驗(yàn)和 */for (fp=head->next; fp; fp = fp->next) {head->data_len += fp->len;head->len += fp->len;if (head->ip_summed != fp->ip_summed)head->ip_summed = CHECKSUM_NONE;else if (head->ip_summed == CHECKSUM_COMPLETE)head->csum = csum_add(head->csum, fp->csum);head->truesize += fp->truesize;}/* 重組完成，從分片占用的系統(tǒng)內(nèi)存中減去重組后大小 */atomic_sub(head->truesize, &qp->q.net->mem);head->next = NULL;head->dev = dev;head->tstamp = qp->q.stamp;/* 重置IP頭 */iph = ip_hdr(head);iph->frag_off = 0;iph->tot_len = htons(len);iph->tos |= ecn;IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);qp->q.fragments = NULL;qp->q.fragments_tail = NULL;return 0;out_nomem:LIMIT_NETDEBUG(KERN_ERR pr_fmt("queue_glue: no memory for gluing queue %p\n"),qp);err = -ENOMEM;goto out_fail; out_oversize:if (net_ratelimit())pr_info("Oversized IP packet from %pI4\n", &qp->saddr); out_fail:IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);return err; }

下面貼一張圖，主要處理是將收到的分片指針指向分片隊(duì)列首部，因?yàn)橹亟M完成后就會(huì)把重組好的報(bào)文還給協(xié)議棧繼續(xù)處理，這時(shí)候分片skb指針將由原先的skb分片指向重組skb首部

IPv4分片重組就是以上這些內(nèi)容，代碼雖然很多但是邏輯不是很復(fù)雜，只要理解了分片隊(duì)列、垃圾回收隊(duì)列(lru隊(duì)列)的組織結(jié)構(gòu)再結(jié)合具體的代碼分析就能夠搞清了。第一篇博客給的那張關(guān)于分片隊(duì)列、哈希表的、lru表的邏輯圖其實(shí)就是整個(gè)重組子系統(tǒng)的縮影，多看看那個(gè)。?

總結(jié)

以上是生活随笔為你收集整理的tcp/ip 协议栈Linux源码分析三 IPv4分片报文重组分析三的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。