概述
ip_fragment函数用于判断是否进行分片，在没有设置DF标记的情况下进入分片，如果设置了DF标记，则继续判断，如果不允许DF分片或者收到的最大分片大于MTU大小，则回复ICMP，释放skb，其余情况仍然需要走分片；
ip_do_fragment是详细的分片流程，整个过程分为快速分片和慢速分片两种，如果存在分片列表frag_list，并且通过检查，则走快速路径，复制每个分片的ip头等信息之后，发送出去；如果不存在分片列表，或者分片列表检查失败，则走慢速路径，慢速路径会根据MTU大小，对整个数据进行重新划分，分配skb，进行数据拷贝，设置ip头等信息，然后发送出去；
源码分析
1 static int ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, 2 unsigned int mtu, 3 int (*output)(struct net *, struct sock *, struct sk_buff *)) 4 { 5 struct iphdr *iph = ip_hdr(skb); 6 7 /* 如果没有DF标记，则进行分片 */ 8 if ((iph->frag_off & htons(IP_DF)) == 0) 9 return ip_do_fragment(net, sk, skb, output); 10 11 /* 有DF标记则继续判断 */ 12 13 /* 不允许本地分片 || 分片最大长度>MTU */ 14 if (unlikely(!skb->ignore_df || 15 (IPCB(skb)->frag_max_size && 16 IPCB(skb)->frag_max_size > mtu))) { 17 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS); 18 /* ICMP错误 */ 19 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, 20 htonl(mtu)); 21 /* 释放skb */ 22 kfree_skb(skb); 23 return -EMSGSIZE; 24 } 25 26 /* 其他情况，继续分片 */ 27 return ip_do_fragment(net, sk, skb, output); 28 }
1 int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, 2 int (*output)(struct net *, struct sock *, struct sk_buff *)) 3 { 4 struct iphdr *iph; 5 int ptr; 6 struct sk_buff *skb2; 7 unsigned int mtu, hlen, left, len, ll_rs; 8 int offset; 9 __be16 not_last_frag; 10 struct rtable *rt = skb_rtable(skb); 11 int err = 0; 12 13 /* for offloaded checksums cleanup checksum before fragmentation */ 14 /* PARTIAL类型需要清除校验和 */ 15 if (skb->ip_summed == CHECKSUM_PARTIAL && 16 (err = skb_checksum_help(skb))) 17 goto fail; 18 19 /* 20 * Point into the IP datagram header. 21 */ 22 23 iph = ip_hdr(skb); 24 25 /* 获取mtu */ 26 mtu = ip_skb_dst_mtu(sk, skb); 27 28 /* 接收到的最大分片长度 < mtu，则将mtu设置为该值 */ 29 if (IPCB(skb)->frag_max_size && IPCB(skb)->frag_max_size < mtu) 30 mtu = IPCB(skb)->frag_max_size; 31 32 /* 33 * Setup starting values. 34 */ 35 36 hlen = iph->ihl * 4; 37 mtu = mtu - hlen; /* Size of data space */ 38 IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE; 39 40 /* When frag_list is given, use it. First, check its validity: 41 * some transformers could create wrong frag_list or break existing 42 * one, it is not prohibited. In this case fall back to copying. 43 * 44 * LATER: this step can be merged to real generation of fragments, 45 * we can switch to copy when see the first bad fragment. 46 */ 47 /* 有分片列表 */ 48 if (skb_has_frag_list(skb)) { 49 struct sk_buff *frag, *frag2; 50 51 /* 线性区域和分页区的数据长度 */ 52 unsigned int first_len = skb_pagelen(skb); 53 54 /* 以下情况，进入慢路处理 */ 55 if (first_len - hlen > mtu || /* 分片长度>MTU */ 56 ((first_len - hlen) & 7) || /* 没有8字节对齐 */ 57 ip_is_fragment(iph) || /* 是一个分片 */ 58 skb_cloned(skb)) /* 是克隆的 */ 59 goto slow_path; 60 61 /* 遍历分片列表 */ 62 skb_walk_frags(skb, frag) { 63 /* Correct geometry. */ 64 /* 以下情况，恢复状态，进入慢速路径 */ 65 if (frag->len > mtu || /* 分片长度>mtu */ 66 ((frag->len & 7) && frag->next) || /* 除最后一个分片外，其余有非8字节对齐的 */ 67 skb_headroom(frag) < hlen) /* 头部长度过小 */ 68 goto slow_path_clean; 69 70 /* Partially cloned skb? */ 71 /* 克隆的，恢复状态，进入慢速路径 */ 72 if (skb_shared(frag)) 73 goto slow_path_clean; 74 75 BUG_ON(frag->sk); 76 77 /* 分片关联控制块 */ 78 if (skb->sk) { 79 frag->sk = skb->sk; 80 frag->destructor = sock_wfree; 81 } 82 83 /* 第一个skb的长度去掉当前分片的长度 */ 84 skb->truesize -= frag->truesize; 85 } 86 87 /* Everything is OK. Generate! */ 88 89 /* 现在分片没问题了，设置分片信息 */ 90 err = 0; 91 offset = 0; 92 frag = skb_shinfo(skb)->frag_list; 93 skb_frag_list_init(skb); 94 skb->data_len = first_len - skb_headlen(skb); 95 skb->len = first_len; 96 iph->tot_len = htons(first_len); 97 iph->frag_off = htons(IP_MF); 98 ip_send_check(iph); 99 100 /* 循环设置分片信息，并发送 */ 101 for (;;) { 102 /* Prepare header of the next frame, 103 * before previous one went down. */ 104 /* 为每一片都拷贝ip头，设置偏移信息 */ 105 if (frag) { 106 frag->ip_summed = CHECKSUM_NONE; 107 skb_reset_transport_header(frag); 108 __skb_push(frag, hlen); 109 skb_reset_network_header(frag); 110 memcpy(skb_network_header(frag), iph, hlen); 111 iph = ip_hdr(frag); 112 iph->tot_len = htons(frag->len); 113 ip_copy_metadata(frag, skb); 114 if (offset == 0) 115 ip_options_fragment(frag); 116 offset += skb->len - hlen; 117 iph->frag_off = htons(offset>>3); 118 if (frag->next) 119 iph->frag_off |= htons(IP_MF); 120 /* Ready, complete checksum */ 121 ip_send_check(iph); 122 } 123 124 /* 调用发送回调 */ 125 err = output(net, sk, skb); 126 127 if (!err) 128 IP_INC_STATS(net, IPSTATS_MIB_FRAGCREATES); 129 if (err || !frag) 130 break; 131 132 skb = frag; 133 frag = skb->next; 134 skb->next = NULL; 135 } 136 137 if (err == 0) { 138 IP_INC_STATS(net, IPSTATS_MIB_FRAGOKS); 139 return 0; 140 } 141 142 /* 出错，释放分片 */ 143 while (frag) { 144 skb = frag->next; 145 kfree_skb(frag); 146 frag = skb; 147 } 148 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS); 149 return err; 150 151 slow_path_clean: 152 /* 将分片恢复原状态 */ 153 skb_walk_frags(skb, frag2) { 154 if (frag2 == frag) 155 break; 156 frag2->sk = NULL; 157 frag2->destructor = NULL; 158 skb->truesize += frag2->truesize; 159 } 160 } 161 162 slow_path: 163 /* 慢速分片路径 */ 164 165 166 iph = ip_hdr(skb); 167 168 /* 除去首部的剩余空间 */ 169 left = skb->len - hlen; /* Space per frame */ 170 ptr = hlen; /* Where to start from */ 171 172 /* 二层头部空间 */ 173 ll_rs = LL_RESERVED_SPACE(rt->dst.dev); 174 175 /* 176 * Fragment the datagram. 177 */ 178 179 /* 初始化mf和offset */ 180 offset = (ntohs(iph->frag_off) & IP_OFFSET) << 3; 181 not_last_frag = iph->frag_off & htons(IP_MF); 182 183 /* 184 * Keep copying data until we run out. 185 */ 186 187 /* 开始分片了 */ 188 while (left > 0) { 189 /* len初始为剩余长度 */ 190 len = left; 191 /* IF: it doesn't fit, use 'mtu' - the data space left */ 192 /* 根据mtu确认长度 */ 193 if (len > mtu) 194 len = mtu; 195 /* IF: we are not sending up to and including the packet end 196 then align the next start on an eight byte boundary */ 197 /* 除最后分片外，其余8字节对齐 */ 198 if (len < left) { 199 len &= ~7; 200 } 201 202 /* Allocate buffer */ 203 /* 分配skb */ 204 skb2 = alloc_skb(len + hlen + ll_rs, GFP_ATOMIC); 205 if (!skb2) { 206 err = -ENOMEM; 207 goto fail; 208 } 209 210 /* 211 * Set up data on packet 212 */ 213 214 /* 拷贝元数据 */ 215 ip_copy_metadata(skb2, skb); 216 217 /* 预留空间，设置头部偏移 */ 218 skb_reserve(skb2, ll_rs); 219 skb_put(skb2, len + hlen); 220 skb_reset_network_header(skb2); 221 skb2->transport_header = skb2->network_header + hlen; 222 223 /* 224 * Charge the memory for the fragment to any owner 225 * it might possess 226 */ 227 /* 关联sk */ 228 if (skb->sk) 229 skb_set_owner_w(skb2, skb->sk); 230 231 /* 232 * Copy the packet header into the new buffer. 233 */ 234 235 /* 拷贝头部 */ 236 skb_copy_from_linear_data(skb, skb_network_header(skb2), hlen); 237 238 /* 239 * Copy a block of the IP datagram. 240 */ 241 /* 拷贝数据 */ 242 if (skb_copy_bits(skb, ptr, skb_transport_header(skb2), len)) 243 BUG(); 244 left -= len; 245 246 /* 247 * Fill in the new header fields. 248 */ 249 iph = ip_hdr(skb2); 250 251 /* 设置偏移 *// 252 iph->frag_off = htons((offset >> 3)); 253 254 /* 转发的数据包，带有FRAG_PMTU标记，则打上DF */ 255 if (IPCB(skb)->flags & IPSKB_FRAG_PMTU) 256 iph->frag_off |= htons(IP_DF); 257 258 /* ANK: dirty, but effective trick. Upgrade options only if 259 * the segment to be fragmented was THE FIRST (otherwise, 260 * options are already fixed) and make it ONCE 261 * on the initial skb, so that all the following fragments 262 * will inherit fixed options. 263 */ 264 /* 第一个分片包含ip选项 */ 265 if (offset == 0) 266 ip_options_fragment(skb); 267 268 /* 269 * Added AC : If we are fragmenting a fragment that's not the 270 * last fragment then keep MF on each bit 271 */ 272 /* 不是最后分片需要设定MF标记 */ 273 if (left > 0 || not_last_frag) 274 iph->frag_off |= htons(IP_MF); 275 276 /* 指针和偏移更新 */ 277 ptr += len; 278 offset += len; 279 280 /* 281 * Put this fragment into the sending queue. 282 */ 283 /* 设置数据长度 */ 284 iph->tot_len = htons(len + hlen); 285 286 /* 校验和 */ 287 ip_send_check(iph); 288 289 /* 发送分片 */ 290 err = output(net, sk, skb2); 291 if (err) 292 goto fail; 293 294 IP_INC_STATS(net, IPSTATS_MIB_FRAGCREATES); 295 } 296 297 /* 分片完成并发送，释放skb */ 298 consume_skb(skb); 299 IP_INC_STATS(net, IPSTATS_MIB_FRAGOKS); 300 return err; 301 302 fail: 303 304 /* 出错，释放skb */ 305 kfree_skb(skb); 306 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS); 307 return err; 308 }