如何利用NFQUEUE实现TCP报文的手动重传？

Absolutely, you can use NetFilterQueue (NFQUEUE) to pull off manual TCP packet retransmissions—but your current approach with NF_REPEAT is misunderstanding how that verdict actually behaves. Let’s break this down and fix your workflow, plus cover alternative options if NFQUEUE isn’t the best fit for your use case.

Why your NF_REPEAT approach isn’t working #

NF_REPEAT doesn’t send the packet to the network and queue a copy for reprocessing. Instead, it tells Netfilter to re-run the entire hook pipeline for the same packet instance. That means your original packet isn’t transmitted—it just loops back through your iptables rules and queue handler again. No new packet hits the wire, so you don’t get the retransmit you’re expecting.

The correct NFQUEUE-based workflow for manual retransmissions #

To actually send a duplicate packet (your retransmit), you need to:

1. Capture the target packet via NFQUEUE as you’re already doing.
2. Create an exact copy of the packet, preserving critical TCP fields like sequence number, acknowledgment number, flags, and payload. You’ll need to recalculate the IP and TCP checksums (since modifying or copying the packet can invalidate these).
3. Send the copy directly to the network using a raw socket (tools like Scapy make this trivial).
4. Decide what to do with the original packet: Use NF_ACCEPT to let it follow its normal path, or NF_DROP if you want your manual retransmit to replace the original.

Quick example (Python + NetfilterQueue + Scapy) #

Here’s a simplified snippet to illustrate the flow:

from netfilterqueue import NetfilterQueue
import scapy.all as scapy

def need_retransmit(packet):
    # Add your logic here to identify the packet to retransmit
    # e.g., check TCP sequence number, payload content, etc.
    return packet.haslayer(scapy.TCP) and packet[scapy.TCP].seq == 123456

def handle_packet(nf_pkt):
    scapy_pkt = scapy.IP(nf_pkt.get_payload())
    
    if need_retransmit(scapy_pkt):
        # Create an exact copy of the packet
        retrans_pkt = scapy.IP(
            src=scapy_pkt[scapy.IP].src,
            dst=scapy_pkt[scapy.IP].dst
        ) / scapy.TCP(
            sport=scapy_pkt[scapy.TCP].sport,
            dport=scapy_pkt[scapy.TCP].dport,
            seq=scapy_pkt[scapy.TCP].seq,
            ack=scapy_pkt[scapy.TCP].ack,
            flags=scapy_pkt[scapy.TCP].flags,
            window=scapy_pkt[scapy.TCP].window,
            options=scapy_pkt[scapy.TCP].options
        ) / scapy_pkt[scapy.TCP].payload
        
        # Recalculate checksums (Scapy does this automatically when we rebuild the packet)
        del retrans_pkt[scapy.IP].chksum
        del retrans_pkt[scapy.TCP].chksum
        retrans_pkt = retrans_pkt.__class__(bytes(retrans_pkt))
        
        # Send the retransmit packet
        scapy.send(retrans_pkt, verbose=0)
        
        # Let the original packet proceed (or use nf_pkt.drop() to replace it)
        nf_pkt.accept()
    else:
        nf_pkt.accept()

# Bind to queue 1 (match your iptables rule, e.g., iptables -A OUTPUT -p tcp -j NFQUEUE --queue-num 1)
nfqueue = NetfilterQueue()
nfqueue.bind(1, handle_packet)

try:
    nfqueue.run()
except KeyboardInterrupt:
    print("\nStopping...")
finally:
    nfqueue.unbind()

Alternative approaches if NFQUEUE isn’t ideal #

If you run into limitations with NFQUEUE (like performance for high-throughput traffic), consider these options:

• Raw Sockets: Skip NFQUEUE entirely and use raw sockets to capture and inject TCP packets directly. This gives you full control but requires manual handling of IP/TCP headers and checksums. You’ll need CAP_NET_RAW privileges.
• eBPF: A modern, high-performance alternative. eBPF programs run in the kernel, so they can capture and duplicate packets with minimal overhead. The learning curve is steeper, but it’s perfect for scalable, low-latency use cases.
• tc + netem: If you’re simulating network conditions (rather than triggering targeted retransmits), Linux Traffic Control’s netem module can mimic packet loss (which triggers natural TCP retransmits) or inject duplicates. This is less precise but easier to set up for bulk testing.

Critical notes to avoid breaking TCP #

• Preserve TCP state: Manual retransmits must match the original packet’s sequence/acknowledgment numbers exactly. Mismatched numbers will cause the receiver to reject the packet or reset the connection.
• Checksum validation: Always recalculate IP and TCP checksums after copying or modifying packets—most network stacks will discard packets with invalid checksums.
• Permissions: Your program will need root access or the CAP_NET_ADMIN/CAP_NET_RAW capabilities to interact with NFQUEUE and raw sockets.

内容的提问来源于stack exchange，提问作者NIoSaT