Can NFQUEUE accept/continue when there is no userspace listener registered ?

[Darryl Miles <darryl-mailinglists@netbauds.net>]

Hi,

Is there any mechanism which would allow additional options to NFQUEUE 
target to instruct the kernel what to do:

  --action-no-listener NF_ACCEPT|NF_DROP|CONTINUE  (with NF_DROP being 
the default)
  --action-backlog-overflow NF_ACCEPT|NF_DROP|CONTINUE   (with NF_DROP 
being the default)

Where CONTINUE would in effect ignore the existence of the "-j NFQUEUE" 
rule in the chain and continue to the next rule.  I guess this is 
possible if the packet never made it to user-space.


Would there be any objections to providing a patch to kernel and 
userspace tooling to provide this configurable behavior ?   Is it 
obviously useful to others ?


I am writing a non-critical userspace tool to fire Wake-on-LAN magic 
packets, if incoming TCP SYN "-p tcp --syn" is matched (and presumably 
forwarded).  The SYN packet is always allowed to pass but the userspace 
tools then goes into monitoring mode in the period after each SYN 
packet, it looks for either a valid IPv4 or IPv6 neighbour entry 
(/sbin/ip neigh) and/or Echo Reply.  As well as periodically monitoring 
the last known MAC address for each destination IP/IP6 to auto-learn.

This is not a critical application, I am looking for a minimal CPU 
overhead on the router and a best-effort service.  It should never be 
the cause of a failure (to connect i.e. pass SYN packets) should it 
crash / not be running.


Your comments appreciated,

Darryl