TCP握手分为三个阶段，在握手开始之前，通信双方的套接字状态均为“TCP_CLOSE”，以下是这三个阶段：
（1）客户端发送一个标志位中SYN位为1的报文给服务端，并设套接字状态为“TCP_SYNSENT”
（2）服务端接到SYN报文，设套接字状态为“TCP_SYNRCV”，并回送一个SYN+ACK位均为1的报文
（3）客户端接到SYN+ACK报文，回送一个ACK位为1的报文，设套接字状态为“TCP_ESTABLISHED”，服务端接到ACK报文后，同样设置为“TCP_ESTABLISHED”
第一阶段
第一阶段客户端通过调用connect函数完成，connect实际上调用了内核中的__sys_connect函数。
以下代码是有关__sys_connect函数在文件net/scoket.c中的系统调用定义，由此可以看出，__sys_connect函数就是connect在内核中的实现。
SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
int, addrlen)
{
return __sys_connect(fd, uservaddr, addrlen);
}从__sys_connect函数开始进入三次握手的第一阶段，以下是部分代码：
int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
{
...
sock = sockfd_lookup_light(fd, &err, &fput_needed);
...
err = move_addr_to_kernel(uservaddr, addrlen, &address);
...
err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
sock->file->f_flags);
...
}代码中的sock->ops->connect即是tcp_v4_connect函数，现在转到tcp_v4_connect函数：1 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
2 {
3 struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
4 struct inet_sock *inet = inet_sk(sk);
5 struct tcp_sock *tp = tcp_sk(sk);
6 __be16 orig_sport, orig_dport;
7 __be32 daddr, nexthop;
8 struct flowi4 *fl4;
9 struct rtable *rt;
10 int err;
11 struct ip_options_rcu *inet_opt;
12 struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
13
14 if (addr_len < sizeof(struct sockaddr_in))
15 return -EINVAL;
16
17 if (usin->sin_family != AF_INET)
18 return -EAFNOSUPPORT;
19
20 nexthop = daddr = usin->sin_addr.s_addr;
21 inet_opt = rcu_dereference_protected(inet->inet_opt,
22 lockdep_sock_is_held(sk));
23 if (inet_opt && inet_opt->opt.srr) {
24 if (!daddr)
25 return -EINVAL;
26 nexthop = inet_opt->opt.faddr;
27 }
28
29 orig_sport = inet->inet_sport;
30 orig_dport = usin->sin_port;
31 fl4 = &inet->cork.fl.u.ip4;
32 rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
33 RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
34 IPPROTO_TCP,
35 orig_sport, orig_dport, sk);
36 if (IS_ERR(rt)) {
37 err = PTR_ERR(rt);
38 if (err == -ENETUNREACH)
39 IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
40 return err;
41 }
42
43 if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
44 ip_rt_put(rt);
45 return -ENETUNREACH;
46 }
47
48 if (!inet_opt || !inet_opt->opt.srr)
49 daddr = fl4->daddr;
50
51 if (!inet->inet_saddr)
52 inet->inet_saddr = fl4->saddr;
53 sk_rcv_saddr_set(sk, inet->inet_saddr);
54
55 if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
56 /* Reset inherited state */
57 tp->rx_opt.ts_recent = 0;
58 tp->rx_opt.ts_recent_stamp = 0;
59 if (likely(!tp->repair))
60 tp->write_seq = 0;
61 }
62
63 inet->inet_dport = usin->sin_port;
64 sk_daddr_set(sk, daddr);
65
66 inet_csk(sk)->icsk_ext_hdr_len = 0;
67 if (inet_opt)
68 inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
69
70 tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
71
72 /* Socket identity is still unknown (sport may be zero).
73 * However we set state to SYN-SENT and not releasing socket
74 * lock select source port, enter ourselves into the hash tables and
75 * complete initialization after this.
76 */
77 tcp_set_state(sk, TCP_SYN_SENT);
78 err = inet_hash_connect(tcp_death_row, sk);
79 if (err)
80 goto failure;
81
82 sk_set_txhash(sk);
83
84 rt = ip_route_newports(fl4, rt, orig_sport, orig_dport,
85 inet->inet_sport, inet->inet_dport, sk);
86 if (IS_ERR(rt)) {
87 err = PTR_ERR(rt);
88 rt = NULL;
89 goto failure;
90 }
91 /* OK, now commit destination to socket. */
92 sk->sk_gso_type = SKB_GSO_TCPV4;
93 sk_setup_caps(sk, &rt->dst);
94 rt = NULL;
95
96 if (likely(!tp->repair)) {
97 if (!tp->write_seq)
98 tp->write_seq = secure_tcp_seq(inet->inet_saddr,
99 inet->inet_daddr,
100 inet->inet_sport,
101 usin->sin_port);
102 tp->tsoffset = secure_tcp_ts_off(sock_net(sk),
103 inet->inet_saddr,
104 inet->inet_daddr);
105 }
106
107 inet->inet_id = tp->write_seq ^ jiffies;
108
109 if (tcp_fastopen_defer_connect(sk, &err))
110 return err;
111 if (err)
112 goto failure;
113
114 err = tcp_connect(sk);
115
116 if (err)
117 goto failure;
118
119 return 0;
120
121 failure:
122 /*
123 * This unhashes the socket and releases the local port,
124 * if necessary.
125 */
126 tcp_set_state(sk, TCP_CLOSE);
127 ip_rt_put(rt);
128 sk->sk_route_caps = 0;
129 inet->inet_dport = 0;
130 return err;
131 }在tcp_v4_connect函数中为套接字填充一些变量，将套接字的状态修改为“TCP_SYNSENT”，然后进入tcp_connect函数。
1 int tcp_connect(struct sock *sk)
2 {
3 struct tcp_sock *tp = tcp_sk(sk);
4 struct sk_buff *buff;
5 int err;
6
7 tcp_call_bpf(sk, BPF_SOCK_OPS_TCP_CONNECT_CB, 0, NULL);
8
9 if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
10 return -EHOSTUNREACH; /* Routing failure or similar. */
11
12 tcp_connect_init(sk);
13
14 if (unlikely(tp->repair)) {
15 tcp_finish_connect(sk, NULL);
16 return 0;
17 }
18
19 buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation, true);
20 if (unlikely(!buff))
21 return -ENOBUFS;
22
23 tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
24 tcp_mstamp_refresh(tp);
25 tp->retrans_stamp = tcp_time_stamp(tp);
26 tcp_connect_queue_skb(sk, buff);
27 tcp_ecn_send_syn(sk, buff);
28 tcp_rbtree_insert(&sk->tcp_rtx_queue, buff);
29
30 /* Send off SYN; include data in Fast Open. */
31 err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
32 tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
33
39 ...47
48 /* Timer for repeating the SYN until an answer. */
49 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
50 inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
51 return 0;
52 }通过调用tcp_transmit_skb函数构造SYN报文并发送出去，并设立一个定时器。
这一阶段函数的调用栈：
__sys_connect -> inet_stream_connect -> __inet_stream_connect -> tcp_v4_connect -> tcp_connect -> tcp_transmit_skb
第二阶段
这一阶段从中通过tcp_v4_rcv函数从ip层接收数据开始，以下是tcp_v4_rcv的部分代码：
1 int tcp_v4_rcv(struct sk_buff *skb)
2 {
3 ...
4
5 if (sk->sk_state == TCP_LISTEN) {
6 ret = tcp_v4_do_rcv(sk, skb);
7 goto put_and_return;
8 }
9
10 ...
11
12 put_and_return:
13 if (refcounted)
14 sock_put(sk);
15
16 return ret;
17 ...
18 }由于当前套接字状态为“TCP_LISTEN”，进入tcp_v4_do_rcv函数执行
1 int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
2 {
3 ...
4
5 if (sk->sk_state == TCP_LISTEN) {
6
7 if (tcp_rcv_state_process(sk, skb)) {
8 rsk = sk;
9 goto reset;
10 }
11 return 0;
12 ...
13 }tcp_rcv_state_process函数专门用来处理套接字状态的转换，先贴出一张状态转换图：
1 int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
2 {
3 ...
4
5 switch (sk->sk_state) {
6 case TCP_LISTEN:
7 if (th->ack)
8 return 1;
9
10 if (th->rst)
11 goto discard;
12
13 if (th->syn) {
14 if (th->fin)
15 goto discard;
16 /* It is possible that we process SYN packets from backlog,
17 * so we need to make sure to disable BH and RCU right there.
18 */
19 rcu_read_lock();
20 local_bh_disable();
21 acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0;
22 local_bh_enable();
23 rcu_read_unlock();
24
25 if (!acceptable)
26 return 1;
27 consume_skb(skb);
28 return 0;
29 }
30 goto discard;
31 ...
32 }这是tcp_rcv_state_process在“TCP_LISTEN”阶段执行的代码，核心在于22行的icsk->icsk_af_ops->conn_request，在此处一路执行tcp_v4_conn_request, tcp_conn_request。
以下是tcp_conn_request的部分代码：
1 if (fastopen_sk) {
2 af_ops->send_synack(fastopen_sk, dst, &fl, req,
3 &foc, TCP_SYNACK_FASTOPEN);
4 /* Add the child socket directly into the accept queue */
5 inet_csk_reqsk_queue_add(sk, req, fastopen_sk);
6 sk->sk_data_ready(sk);
7 bh_unlock_sock(fastopen_sk);
8 sock_put(fastopen_sk);
9 } else {
10 tcp_rsk(req)->tfo_listener = false;
11 if (!want_cookie)
12 inet_csk_reqsk_queue_hash_add(sk, req,
13 tcp_timeout_init((struct sock *)req));
14 af_ops->send_synack(sk, dst, &fl, req, &foc,
15 !want_cookie ? TCP_SYNACK_NORMAL :
16 TCP_SYNACK_COOKIE);
17 if (want_cookie) {
18 reqsk_free(req);
19 return 0;
20 }
21 }主要执行了send_synack函数，send_synack函数用于将SYN+ACK报文发送出去。
这一阶段函数的调用栈：
tcp_v4_rcv -> tcp_v4_do_rcv -> tcp_rcv_state_process -> tcp_v4_conn_request -> tcp_conn_request -> tcp_v4_send_synack
第三阶段
同上一阶段一样，从ip接收到报文后一路执行tcp_v4_rcv, tcp_v4_do_rcv,进入tcp_rcv_state_process函数：
1 int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
2 const struct tcphdr *th, unsigned int len)
3 {
4 ...
5 switch (sk->sk_state) {
6 case TCP_SYN_SENT:
7 //进入到synack报文的处理流程
8 queued = tcp_rcv_synsent_state_process(sk, skb, th, len);
9 if (queued >= 0)
10 return queued;
11
12 /* Do step6 onward by hand. */
13 tcp_urg(sk, skb, th);
14 __kfree_skb(skb);
15 tcp_data_snd_check(sk);
16 return 0;
17 }
18 ...
19 }在tcp_rcv_synsent_state_process函数中又调用了tcp_finish_connect函数，tcp_finish_connect函数做了三件事：
（1）将套接字状态设置为"TCP_ESTABLISHED"
（2）调用tcp_send_ack函数发送一个ACK包
（3）初始化一些参数
tcp_send_ack函数又调用tcp_transmit_skb将ACK报文从网络上发出去。
最后是服务端接收到ACK报文，依次执行tcp_v4_rcv,tcp_v4_do_rcv,tcp_rcv_state_process函数，将套接字的状态设置为"TCP_ESTABLISHED"，至此，三次握手过程结束。
这一阶段函数的调用栈：
tcp_v4_rcv -> tcp_v4_do_rcv -> tcp_rcv_synsent_state_process -> tcp_send_ack -> tcp_transmit_skb
tcp_v4_rcv -> tcp_rcv_state_process
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
