Re: using ip_queue in kernel space

[Jon Webb <jon_webb@binary-one.com>]

Unit Zero wrote:

>I've been curious for a while about the viability of using ip_queue from 
>a kernel module, without any userland side. It seems that ip_queue is 
>really only used for deferring the verdict on packets to a userspace 
>program, but if I simply install a queue handler in the module init 
>entrypoint and then install a netfilter hook that returns a QUEUE verdict 
>on packets I want, and then do whatever in my queue handler, (kick off 
>timer tasks to issue verdicts or some other such thing) will this work? 
>
>  
>
Of course, there are kernel level calls for getting packets out and 
reinjecting them... They can be called from a kernel module. I tried to 
do this once, and it worked ok, except that I needed access to the 
kernel routing table flags to decide what to do with the packets, and I 
could only get at those from userspace (ironically), so I had to abandon 
that implementation.

- Jon Webb