iptables libipq: DNS payload inspection (II)

    use IPTables::IPv4::IPQueue qw(:constants);
    use NetPacket::IP qw(:ALL);
    use NetPacket::UDP qw(:ALL);
    use Net::DNS::Packet;

    my $ipq = new IPTables::IPv4::IPQueue
        (copy_mode => IPQ_COPY_PACKET, copy_range => 1500);

    while (1) {   
        my $msg = $ipq->get_message;
        my $ip = NetPacket::IP->decode($msg->payload);
        my $udp = NetPacket::UDP->decode($ip->{data});
        my $dns = Net::DNS::Packet->new(\$udp->{data});
        eval { $dns->string };

        if ($@) {
            $ipq->set_verdict($msg->packet_id, NF_DROP);
        } else {
            $ipq->set_verdict($msg->packet_id, NF_ACCEPT);
        }
    }