Hi,
Is there any mechanism which would allow additional options to NFQUEUE
target to instruct the kernel what to do:
--action-no-listener NF_ACCEPT|NF_DROP|CONTINUE (with NF_DROP being
the default)
--action-backlog-overflow NF_ACCEPT|NF_DROP|CONTINUE (with NF_DROP
being the default)
Where CONTINUE would in effect ignore the existence of the "-j NFQUEUE"
rule in the chain and continue to the next rule. I guess this is
possible if the packet never made it to user-space.
Would there be any objections to providing a patch to kernel and
userspace tooling to provide this configurable behavior ? Is it
obviously useful to others ?
I am writing a non-critical userspace tool to fire Wake-on-LAN magic
packets, if incoming TCP SYN "-p tcp --syn" is matched (and presumably
forwarded). The SYN packet is always allowed to pass but the userspace
tools then goes into monitoring mode in the period after each SYN
packet, it looks for either a valid IPv4 or IPv6 neighbour entry
(/sbin/ip neigh) and/or Echo Reply. As well as periodically monitoring
the last known MAC address for each destination IP/IP6 to auto-learn.
This is not a critical application, I am looking for a minimal CPU
overhead on the router and a best-effort service. It should never be
the cause of a failure (to connect i.e. pass SYN packets) should it
crash / not be running.
Your comments appreciated,
Darryl
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
