Tunnel µå¶óÀ̹ö Á¦ÀÛÀÚµéÀº 2.4 Ä¿³Î¿¡ ´ëÇØ¼´Â ´ÙÀ½¿¡ º¸ÀÌ´Â ´Ü¼øÇÑ µÎ°³ÀÇ ±ÔÄ¢À» µû¸£±â ¹Ù¶õ´Ù.
ÆÐŶÀ» ÀνÄÇÒ ¼ö ¾øµµ·Ï ÇÏ·Á¸é skb->nfct¸¦ ¸±¸®Áî ÇØ¾ßÇÑ´Ù(Áï, decapsulating/encapsulating). ¸¸ÀÏ ÆÐŶÀ» *new* skb·Î °¨½ÎÁö ¾ÊÀ¸·Á¸é ¸±¸®Á ÇÏÁö ¾Ê¾Æµµ µÇÁö¸¸, ÀûÀýÇÑ °÷¿¡¼ ¼öÇàÇϰíÀÚ ÇÑ´Ù¸é, ¹Ýµå½Ã ¸±¸®Áî ÇØ¾ß ÇÑ´Ù.
±×·¸Áö ¾ÊÀº °æ¿ì´Â, NAT ÄÚµå´Â ÆÐŶÀ» ¸Í±ÛÇϱâ À§ÇØ °ú°ÅÀÇ connection tracking Á¤º¸¸¦ ÀÌ¿ëÇÒ °ÍÀ̰í, ÀÌ·Î ÀÎÇØ ¼ø¼°¡ ¾û¸ÁÀÌ µÉ °ÍÀÌ´Ù.
encapsulated ÆÐŶÀº ¹Ýµå½Ã LOCAL_OUT ÈÅÀ» Åë°úÇϵµ·Ï ÇØ¾ßÇϸç, decapsulated ÆÐŶÀº PRE_ROUTING ÈÅÀ» Åë°úÇØ¾ß¸¸ ÇÑ´Ù. À̸¦ ¼öÇàÇϱâ À§ÇØ ´ëºÎºÐÀÇ tunnelÀº ip_rcv()¸¦ »ç¿ëÇÑ´Ù.
±×·¸Áö ¾ÊÀº °æ¿ì´Â, »ç¿ëÀÚµéÀÌ tunnelÀ» ÀÌ¿ëÇÏ¿© ¿øÇÏ´Â ´ë·Î ÇÊÅ͸µÇÒ ¼ö ¾øÀ» °ÍÀÌ´Ù.
ù ¹øÂ°¸¦ ¼öÇàÇϴ ǥÁØ ¹æ¹ýÀº ÆÐŶÀ» wrapÇϰųª unwrapÇϱâ Àü¿¡ ´ÙÀ½°ú À¯»çÇÑ Äڵ带 »ðÀÔÇÏ´Â °ÍÀÌ´Ù.
/* Tell the netfilter framework that this packet is not the same as the one before! */ #ifdef CONFIG_NETFILTER nf_conntrack_put(skb->nfct); skb->nfct = NULL; #ifdef CONFIG_NETFILTER_DEBUG skb->nf_debug = 0; #endif #endif |
µÎ ¹øÂ°¸¦ ¼öÇàÇϱâ À§ÇØ ÇÊ¿ä·Î ÇÏ´Â °ÍÀº »õ·ÎÀÌ encapsulatedµÈ ÆÐŶÀÌ ``ip_send()''·Î µé¾î°¡´Â À§Ä¡¸¦ ã¾Æ³»°í, À̸¦ ´ÙÀ½°ú °°Àº °ÍÀ¸·Î ´ëüÇÏ´Â °ÍÀÌ´Ù.
/* Send "new" packet from local host */ NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev, ip_send); |
´ÙÀ½¿¡ º¸ÀÎ ·êÀÌ ÀǹÌÇÏ´Â °ÍÀº tunnel ¹Ú½º¿¡ ÆÐŶ ÇÊÅ͸µ ·êÀ» Àû¿ëÇϰíÀÚ ÇÏ´Â »ç¶÷ÀÌ tunnel µÇ°í ÀÖ´Â ÆÐŶ¿¡ ´ëÇØ ´ÙÀ½°ú °°Àº ÀýÂ÷¸¦ º¸°Ô µÉ °ÍÀÌ´Ù.
FORWARD hook : normal packet (from eth0 -> tunl0)
LOCAL_OUT hook : encapsulated packet (to eth1)
LOCAL_IN hook: encapsulated reply packet (from eth1)
FORWARD hook: reply packet (from eth1 -> eth0).