Linux tc filter_classify分类器链匹配与action执行TCTraffic Control分类器链的核心入口是filter_classify函数它遍历挂在qdisc或clas上的filter链逐一调用每个filter的classify回调进行匹配判决。filter_classify定义在net/sched/cls_api.c中int filter_classify(struct tcf_proto *tp, struct sk_buff *skb,const struct tcf_walker *arg,struct tcf_result *res){int ret TC_ACT_UNSPEC;for (; tp; tp rcu_dereference_bh(tp-next)) {struct tcf_proto_ops *ops rcu_dereference_bh(tp-ops);if (tc_skip_classify(tp, skb))continue;ret ops-classify(skb, tp, res);switch (TC_ACT_EXT_CMP(ret, TC_ACT_JUMP)) {case TC_ACT_JUMP:tp tcf_chain_jump(tp, res, ret);if (IS_ERR(tp))return PTR_ERR(tp);continue;case TC_ACT_STOLEN:case TC_ACT_TRAP:__qdisc_drop(skb, to_free);return ret;case TC_ACT_SHOT:return ret;case TC_ACT_REDIRECT:return ret;}if (ret ! TC_ACT_UNSPEC) {break;}}return ret;}每个tptcf_proto代表一个协议类型的分类器实例通过tp-next串联成单向链表。ops-classify是具体分类器u32、cls_flower、fw等注册的回调。以最常用的u32分类器为例其classify回调为u32_classifystatic int u32_classify(struct sk_buff *skb, const struct tcf_proto *tp,struct tcf_result *res){struct tc_u_common *tp_c tp-data;struct tc_u_knode *ht;struct tc_u32_sel *sel;int ret TC_ACT_SHOT;u32 key, mask;int off;ht u32_lookup_ht(tp_c, tp_c-h_ht);if (!ht)return TC_ACT_SHOT;while (ht) {struct tc_u_knode *n;for (n ht-next; n; n n-next) {sel n-sel;off skb_network_offset(skb) n-off;for (int i 0; i sel-nkeys; i) {key skb_header_pointer(skb, off sel-keys[i].off,sizeof(u32), sel-keys[i]) ?*(u32 *)(skb-data off sel-keys[i].off) : 0;mask sel-keys[i].mask;if ((key mask) ! sel-keys[i].val)goto skip;}if (n-similar)goto emulate;*res n-res;ret n-res.classid ? TC_ACT_UNSPEC : n-act;if (n-tp) {ret filter_classify(rcu_dereference_bh(n-tp), skb, NULL, res);if (ret ! TC_ACT_UNSPEC)return ret;continue;}if (ret TC_ACT_UNSPEC)continue;return ret;skip:continue;}ht u32_lookup_ht(tp_c, ht-ref);}return ret;}匹配成功后如果有action关联执行流程进入tcf_action_execint tcf_action_exec(struct sk_buff *skb, struct tc_action **act,int nr_actions, struct tcf_result *res){int ret;for (int i 0; i nr_actions; i) {const struct tc_action_ops *ops act[i]-ops;ret ops-act(skb, act[i], res);switch (TC_ACT_EXT_CMP(ret, TC_ACT_JUMP)) {case TC_ACT_JUMP:if (res NULL || !tcf_action_jump(act[i], res, ret, i))return TC_ACT_SHOT;i res-tcfa_jump_index;continue;case TC_ACT_STOLEN:case TC_ACT_TRAP:case TC_ACT_SHOT:case TC_ACT_REDIRECT:return ret;case TC_ACT_PIPE:continue;case TC_ACT_UNSPEC:return ret;default:return ret;}}return ret;}tcf_action_exec遍历actions数组依次执行。核心动作包括TC_ACT_PIPE继续下一条action、TC_ACT_STOLENskb已被消费、TC_ACT_SHOT丢弃、TC_ACT_REDIRECT重定向。JUMP动作允许在action链内跳转到指定索引配合TC_ACT_JUMP宏#define TC_ACT_JUMP 0x10000000当classify返回TC_ACT_UNSPEC且未查找classid时调用者如sch_handle_ingress需要决定skb的最终流向。在ingress路径中如果filter未命中则按正常RX路径继续在egress路径中filter未命中则直接发送。整个流程的调用栈在ingress侧为__netif_receive_skb_core- sch_handle_ingress- tcf_classify_ingress- filter_classify- u32_classify / cls_flower_classify (etc.)- tcf_action_exec- act-ops-act (e.g. tcf_gact_act, tcf_mirred_act)filter链支持共享块shared block通过tcf_block结构体组织多个chain。每个chain包含filter链的头指针chain之间通过jump指令跳转实现多级分类流水线。block的lookup使用tcf_block_lookupstruct tcf_chain *tcf_block_lookup(struct tcf_block *block, u32 chain_index){if (chain_index block-chain_max)return NULL;return rcu_dereference_bh(block-chain[chain_index]);}各个分类器通过rtnetlink接口进行配置用户态通过tc命令添加filter时内核在tcf_proto_create中分配tp实例并注册到chain的filter链表头部。replace操作调用tcf_proto_replace将新实例原子替换旧实例保证RCU安全。delete操作则通过tcf_proto_destroy进行引用计数递减和最终释放。