injecting packets from QUEUE handler

[Mike Carlton <mikecarlton@gmail.com>]

I've got an application where I need to inspect up to the first 2 data
packets of a new HTTP connection before deciding whether to pass or
alter the connection data (in particular, I need to see the initial
HTML data and some servers will send HTTP headers in one packet and
data in the next).

I've setup a QUEUE target so that I can do this all in user space.  It
is easy enough to cache the contents of the first packet (if we need
to inspect the second for this particular connection) and return
NF_DROP.

The question is how to best handle the case when we inspect the second
packet and decide everything is fine so it is time to send the saved
first packet and the current second.

I'm planning on just NF_ACCEPTing the second packet, then using a
PF_PACKET socket to re-inject the contents of the first packet.

Is there a cleaner way to do this?  I'll have to take care of various
corner cases (ie. the packets get dropped or duplicated before
reaching us).  I'll let the clients deal with the out of order packet
arrivals that we cause.

thanks,
--mike