I've got an application where I need to inspect up to the first 2 data packets of a new HTTP connection before deciding whether to pass or alter the connection data (in particular, I need to see the initial HTML data and some servers will send HTTP headers in one packet and data in the next). I've setup a QUEUE target so that I can do this all in user space. It is easy enough to cache the contents of the first packet (if we need to inspect the second for this particular connection) and return NF_DROP. The question is how to best handle the case when we inspect the second packet and decide everything is fine so it is time to send the saved first packet and the current second. I'm planning on just NF_ACCEPTing the second packet, then using a PF_PACKET socket to re-inject the contents of the first packet. Is there a cleaner way to do this? I'll have to take care of various corner cases (ie. the packets get dropped or duplicated before reaching us). I'll let the clients deal with the out of order packet arrivals that we cause. thanks, --mike
