Re: libnetfilter_queue man page

[Pablo Neira Ayuso <pablo@netfilter.org>]

Julien DHERSIN wrote:
> But, I still have a question : I would like to add an extension in
> filtered IPv6
> multicast packets headers. Do you think, I can do this in the userspace
> using libnetfilter queue ? And, how precisely does it work ? Is it
> something like this :

Yes, you can process packets from userspace via libnetfilter_queue.

> 1. Activate the hook NF_IP6_LOCAL_OUT with an iptables rule

ip6tables -I OUTPUT -j NFQUEUE

> 2. Launch my software with libnetfilter_queue
> 3. Modify the header
> 4. Return the whole packet to netfilter

Correct.

> Do I have tocreate a specific kernel module ?

Not necessarily, you can do it from userspace, anyway this question also
depends on your needs.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris