Docker網(wǎng)絡(luò)基礎(chǔ) - Linux網(wǎng)橋工作原理與實(shí)現(xiàn)

[root@vagrant]# brctl addbr br0

[root@vagrant]# brctl showbridge name     bridge id               STP enabled     interfacesbr0             8000.000000000000       nodocker0         8000.000000000000       no

int br_add_bridge(char *name){    struct net_bridge *br;
    if ((br = new_nb(name)) == NULL) // 創(chuàng)建一個網(wǎng)橋設(shè)備對象        return -ENOMEM;
    if (__dev_get_by_name(name) != NULL) { // 設(shè)備名是否已經(jīng)注冊過?        kfree(br);        return -EEXIST; // 返回錯誤, 不能重復(fù)注冊相同名字的設(shè)備    }
    // 添加到網(wǎng)橋列表中    br->next = bridge_list;    bridge_list = br;    ...    register_netdev(&br->dev); // 把網(wǎng)橋注冊到網(wǎng)絡(luò)設(shè)備中
    return 0;}

struct net_bridge{    struct net_bridge           *next;               // 連接內(nèi)核中所有的網(wǎng)橋?qū)ο?/span>    rwlock_t                    lock;                // 鎖    struct net_bridge_port      *port_list;          // 網(wǎng)橋端口列表    struct net_device           dev;                 // 網(wǎng)橋設(shè)備信息    struct net_device_stats     statistics;          // 信息統(tǒng)計    rwlock_t                    hash_lock;           // 用于鎖定CAM表    struct net_bridge_fdb_entry *hash[BR_HASH_SIZE]; // CAM表    struct timer_list           tick;
    /* STP */    ...};

struct net_bridge_port{    struct net_bridge_port  *next;   // 指向下一個端口    struct net_bridge       *br;     // 所屬網(wǎng)橋設(shè)備對象    struct net_device       *dev;    // 網(wǎng)絡(luò)接口設(shè)備對象    int                     port_no; // 端口號
    /* STP */    ...};

struct net_bridge_fdb_entry{    struct net_bridge_fdb_entry *next_hash;    struct net_bridge_fdb_entry **pprev_hash;    atomic_t                    use_count;    mac_addr                    addr;  // 網(wǎng)絡(luò)接口設(shè)備MAC地址    struct net_bridge_port      *dst;  // 網(wǎng)橋端口    ...};

[root@vagrant]# brctl addif br0 eth0

int br_add_if(struct net_bridge *br, struct net_device *dev){    struct net_bridge_port *p;    ...    write_lock_bh(&br->lock);
    // 創(chuàng)建一個新的網(wǎng)橋端口對象, 并添加到網(wǎng)橋的port_list鏈表中    if ((p = new_nbp(br, dev)) == NULL) {         write_unlock_bh(&br->lock);        dev_put(dev);        return -EXFULL;    }
    // 設(shè)置網(wǎng)絡(luò)接口設(shè)備為混雜模式    dev_set_promiscuity(dev, 1);    ...    // 添加到網(wǎng)絡(luò)接口MAC地址與網(wǎng)橋端口對應(yīng)的哈希表中    br_fdb_insert(br, p, dev->dev_addr, 1);    ...    write_unlock_bh(&br->lock);
    return 0;}

static int __inline__handle_bridge(struct sk_buff *skb, struct packet_type *pt_prev){    int ret = NET_RX_DROP;    ...    br_handle_frame_hook(skb);    return ret;}

void br_handle_frame(struct sk_buff *skb){    struct net_bridge *br;
    br = skb->dev->br_port->br; // 獲取設(shè)備連接的網(wǎng)橋?qū)ο?/span>
    read_lock(&br->lock);   // 對網(wǎng)橋上鎖    __br_handle_frame(skb); // 調(diào)用__br_handle_frame()函數(shù)處理數(shù)據(jù)包    read_unlock(&br->lock);}

static void __br_handle_frame(struct sk_buff *skb){    struct net_bridge *br;    unsigned char *dest;    struct net_bridge_fdb_entry *dst;    struct net_bridge_port *p;    int passedup;
    dest = skb->mac.ethernet->h_dest; // 目標(biāo)MAC地址    p = skb->dev->br_port;            // 網(wǎng)絡(luò)接口綁定的端口    br = p->br;    passedup = 0;    ...    // 將學(xué)習(xí)到的MAC地址插入到網(wǎng)橋的hash表中    if (p->state == BR_STATE_LEARNING || p->state == BR_STATE_FORWARDING)        br_fdb_insert(br, p, skb->mac.ethernet->h_source, 0);    ...    if (dest[0] & 1) {        // 如果是一個廣播包        br_flood(br, skb, 1); // 把數(shù)據(jù)包發(fā)送給連接到網(wǎng)橋上的所有網(wǎng)絡(luò)接口        if (!passedup)            br_pass_frame_up(br, skb);        else            kfree_skb(skb);        return;    }
    dst = br_fdb_get(br, dest);    // 獲取目標(biāo)MAC地址對應(yīng)的網(wǎng)橋端口    ...    if (dst != NULL) {             // 如果目標(biāo)MAC地址對應(yīng)的網(wǎng)橋端口存在        br_forward(dst->dst, skb); // 那么只將數(shù)據(jù)包轉(zhuǎn)發(fā)給此端口        br_fdb_put(dst);        return;    }
    br_flood(br, skb, 0); // 否則發(fā)送給連接到此網(wǎng)橋上的所有網(wǎng)絡(luò)接口    return;    ...}

static void __br_forward(struct net_bridge_port *to, struct sk_buff *skb){    skb->dev = to->dev;    dev_queue_xmit(skb);}
void br_forward(struct net_bridge_port *to, struct sk_buff *skb){    if (should_forward(to, skb)) { // 端口是否能夠接收數(shù)據(jù)?        __br_forward(to, skb);        return;    }    kfree_skb(skb);}

void br_flood(struct net_bridge *br, struct sk_buff *skb, int clone){    struct net_bridge_port *p;    struct net_bridge_port *prev;    ...    prev = NULL;
    p = br->port_list;    while (p != NULL) {              // 遍歷綁定到網(wǎng)橋的所有網(wǎng)絡(luò)接口設(shè)備        if (should_forward(p, skb)) { // 端口是否能夠接收數(shù)據(jù)包?            if (prev != NULL) {                struct sk_buff *skb2;
                // 克隆一個數(shù)據(jù)包                if ((skb2 = skb_clone(skb, GFP_ATOMIC)) == NULL) {                     br->statistics.tx_dropped++;                    kfree_skb(skb);                    return;                }
                __br_forward(prev, skb2); // 把數(shù)據(jù)包發(fā)送給設(shè)備            }
            prev = p;        }
        p = p->next;    }
    if (prev != NULL) {        __br_forward(prev, skb);        return;    }
    kfree_skb(skb);}