ERROR: nfq_handle_packet(): failure

[wesmile8]

现象描述

使用/root/fakehttp-linux-x86_64/fakehttp -h www.speedtest.cn -e www.speedtest.cn -i pppoe-wan -d -w /root/fakehttp-linux-x86_64/fakehttp.log -s命令开启fakehttp，前几天正常使用，直到几天以后报错too many errors, exiting...，原因是ERROR: nfq_handle_packet(): failure太多

日志报错

2025-06-26 14:17:55 [src/mainfun.c:382] FakeHTTP version 0.9.18
2025-06-26 14:17:55 [src/mainfun.c:383] 
2025-06-26 14:17:55 [src/mainfun.c:384] FakeHTTP is free software licensed under the GPLv3.
2025-06-26 14:17:55 [src/mainfun.c:385] Distribution without the accompanying source code is not permitted.
2025-06-26 14:17:55 [src/mainfun.c:386] 
2025-06-26 14:17:55 [src/mainfun.c:387] Home page: https://github.com/MikeWang000000/FakeHTTP
2025-06-26 14:17:55 [src/mainfun.c:388] 
2025-06-26 14:17:55 [src/process.c:102] ERROR: execvp(): nft: No such file or directory
2025-06-26 14:17:55 [src/nfrules.c:051] WARNING: Falling back to iptables command, as nft command is not working.
2025-06-26 14:17:55 [src/mainfun.c:455] listening on pppoe-wan, netfilter queue number 512...
2025-06-26 18:32:21 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-06-28 21:20:45 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-06-29 00:32:11 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-06-29 13:08:35 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-06-30 13:12:46 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
......
2025-07-06 21:26:22 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-06 21:26:22 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-06 21:26:22 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-06 21:26:22 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-06 21:26:22 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-06 21:26:22 [src/nfqueue.c:238] too many errors, exiting...
2025-07-06 21:26:22 [src/mainfun.c:463]     at fh_nfq_loop()
2025-07-06 21:26:22 [src/mainfun.c:463]     at main()

软路由（istoreOS）内核模块与 iptables 扩展安装情况

root@Wesmile8:~/fakehttp-linux-x86_64# iptables --version
iptables v1.8.7 (legacy)

root@Wesmile8:~/fakehttp-linux-x86_64# uname -a
Linux Wesmile8 5.10.221 #0 SMP Wed May 14 02:37:27 2025 x86_64 GNU/Linux

root@Wesmile8:~/fakehttp-linux-x86_64# opkg list-installed | grep iptables
iptables-mod-conntrack-extra - 1.8.7-8
iptables-mod-extra - 1.8.7-8
iptables-mod-filter - 1.8.7-8
iptables-mod-fullconenat - 2022-02-13-6
iptables-mod-ipopt - 1.8.7-8
iptables-mod-iprange - 1.8.7-8
iptables-mod-nat-extra - 1.8.7-8
iptables-mod-nfqueue - 1.8.7-7
iptables-mod-socket - 1.8.7-8
iptables-mod-tproxy - 1.8.7-8
iptables-zz-legacy - 1.8.7-8
miniupnpd-iptables - 2.3.3-2

[MikeWang000000]

疑难杂症。

FakeHTTP 当前的逻辑是：在不断的循环处理中，如果连续出现 20 次错误，将直接退出，避免影响网络（下个循环若成功，会重置计数器）。

而 nfq_handle_packet() 函数并不会返回错误的原因，所以我们不知道内部哪里出了问题。并且它只是偶尔出现。

---

如果可能，关闭 -s 选项，将完整的情况记录到日志，或许可以看到报错之前进行了些什么处理（是否存在大量并发，或者在处理某种特定报文时才会触发等等）

---

另外，这个问题和 iptables 关联不大，需要的是以下的一些信息：

head -n-0 /etc/openwrt_release /etc/openwrt_version /proc/version /proc/net/netfilter/nfnetlink_queue
opkg info kernel
opkg info kmod-nfnetlink-queue

[wesmile8]

需要的信息

root@Wesmile8:~# head -n-0 /etc/openwrt_release /etc/openwrt_version /proc/version /proc/net/netfilter/nfnetlink_queue
==> /etc/openwrt_release <==
DISTRIB_ID='iStoreOS'
DISTRIB_RELEASE='22.03.7'
DISTRIB_REVISION='2025051615'
DISTRIB_TARGET='x86/64'
DISTRIB_ARCH='x86_64'
DISTRIB_DESCRIPTION='iStoreOS 22.03.7 2025051615'
DISTRIB_TAINTS='busybox'

==> /etc/openwrt_version <==
2025051615

==> /proc/version <==
Linux version 5.10.221 (build@buildserver) (x86_64-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 2023070614) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Wed May 14 02:37:27 2025

==> /proc/net/netfilter/nfnetlink_queue <==
  512   8840     0 2 65531     0     0    15528  1

root@Wesmile8:~# opkg info kernel
Package: kernel
Version: 5.10.221-1-bb372724df40051c0f132fa20fc778d0
Depends: libc
Status: install hold installed
Architecture: x86_64
Installed-Time: 1747190247

root@Wesmile8:~# opkg info kmod-nfnetlink-queue
Package: kmod-nfnetlink-queue
Version: 5.10.221-1
Depends: kernel (= 5.10.221-1-bb372724df40051c0f132fa20fc778d0), kmod-nfnetlink
Status: install ok installed
Architecture: x86_64
Installed-Time: 1750080723

详细错误日志

这种错误是突然出现的，前后并没有什么其他提示，但我发现当我从家里nas下载文件到本地的时候就会出现这种错误，而且传输文件过程本身不会出错或者中断，只是会在日志显示一行ERROR: nfq_handle_packet(): failure

2025-07-08 02:45:45 [src/rawsend.c:496] 183.227.141.106:1649 ===SYN===> 171.213.143.254:51413
2025-07-08 02:45:45 [src/rawsend.c:449] 183.227.141.106:1649 <===FAKE(*)=== 192.168.2.189:51413
2025-07-08 02:45:45 [src/rawsend.c:475] 183.227.141.106:1649 <===SYN-ACK=== 192.168.2.189:51413
2025-07-08 02:45:45 [src/rawsend.c:496] 113.140.11.125:51097 ===SYN===> 171.213.143.254:6881
2025-07-08 02:45:45 [src/rawsend.c:496] 114.25.102.23:57439 ===SYN===> 171.213.143.254:2223
2025-07-08 02:45:45 [src/rawsend.c:496] 36.237.192.105:5457 ===SYN===> 171.213.143.254:2221
2025-07-08 02:45:45 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-08 02:45:45 [src/rawsend.c:496] 117.135.87.39:8894 ===SYN===> 171.213.143.254:6881
2025-07-08 02:45:45 [src/rawsend.c:496] 122.97.102.169:48243 ===SYN===> 171.213.143.254:51413
2025-07-08 02:45:45 [src/rawsend.c:449] 122.97.102.169:48243 <===FAKE(*)=== 192.168.2.189:51413
2025-07-08 02:45:45 [src/rawsend.c:475] 122.97.102.169:48243 <===SYN-ACK=== 192.168.2.189:51413

2025-07-08 03:53:55 [src/rawsend.c:449] 117.175.49.113:7972 <===FAKE(*)=== 192.168.2.189:51413
2025-07-08 03:53:55 [src/rawsend.c:475] 117.175.49.113:7972 <===SYN-ACK=== 192.168.2.189:51413
2025-07-08 03:53:55 [src/rawsend.c:496] 140.224.125.137:14308 ===SYN===> 171.213.143.254:6881
2025-07-08 03:53:55 [src/rawsend.c:496] 183.132.78.43:50285 ===SYN===> 171.213.143.254:51413
2025-07-08 03:53:55 [src/nfqueue.c:264] ERROR: nfq_handle_packet(): failure
2025-07-08 03:53:55 [src/rawsend.c:496] 120.85.184.226:7702 ===SYN===> 171.213.143.254:6881
2025-07-08 03:53:55 [src/rawsend.c:496] 119.98.56.104:25370 ===SYN===> 171.213.143.254:51413
2025-07-08 03:53:55 [src/rawsend.c:449] 119.98.56.104:25370 <===FAKE(*)=== 192.168.2.189:51413
2025-07-08 03:53:55 [src/rawsend.c:475] 119.98.56.104:25370 <===SYN-ACK=== 192.168.2.189:51413

[MikeWang000000]

传输文件过程本身不会出错或者中断，只是会在日志显示一行ERROR: nfq_handle_packet(): failure

FakeHTTP 只在 TCP 握手时处理，后续传输是直接进行的，不通过 FakeHTTP，因此不用担心中途中断。

---

从日志上看，似乎都是在处理 SYN 包之后，出现错误。

---

nfq_handle_packet() 函数是 libnetfilter_queue 提供，因此我需要对这个库进行一些修改，在日志中打出具体的错误。

还请稍等我完成这些修改，之后我会提供一个临时的版本用于分析。