iptables netfilter copying the packet

Question

I was wondering if there is a way to copy a packet using iptables/netfilter, change it and deliver both to the application.

Basically, I want to capture a packet from a flow and redirect it to some queue, then I want to copy it, issue the verdict for it(I know how to do this part in C),then I need to change something in the copied version, AND issue the verdict for that "modified" packet too.

Basically I want the app to receive both the unmodified and the modified version.

Is this possible? Thanks in advance for any help.

Answer 1

Your mission can be achieved with libipq library. The tutorial in following like focus on copying & modifying a packet in userspace.

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.205.2605&rep=rep1&type=pdf

You need to know C to work on it. Alternatively "Scapy" - a python based packet maipulation tool can be used.

#include <linux/netfilter.h>
#include <libipq.h>

/*
 * Used to open packet ; Insert a iptables rule to get packet here
 * iptables -I 1 [INPUT|OUTPUT|FORWARD] <packet header match> -j QUEUE
 */

#include <linux/netfilter.h>
#include <libipq.h>
#include <stdio.h>
#define BUFSIZE 2048
static void die(struct ipq_handle *h)
{    
    ipq_destroy_handle(h);
    exit(1);
}
int main(int argc, char **argv)
{
    int status;
    unsigned char buf[BUFSIZE];
    struct ipq_handle *h;
        h = ipq_create_handle(0, NFPROTO_IPV4);
    if (!h)
        die(h);
            status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE);
    if (status < 0)
        die(h);
    do{
        status = ipq_read(h, buf, BUFSIZE, 0);
        if (status < 0)
            die(h);
        if (ipq_message_type(buf) == IPQM_PACKET){
            ipq_packet_msg_t *m = ipq_get_packet(buf);
            status = ipq_set_verdict(h, m->packet_id, NF_ACCEPT, 0, NULL);        

        }                    

    } while (1);
        ipq_destroy_handle(h);
    return 0;
}