after changing the TCP payload, and the length is different, the program is abnormal:

iptables rule in test server:

iptables -A OUTPUT -p TCP -d [test client ip] -j NFQUEUE --queue-num 1

if the length is shorter after changed:
client can receive the modified payload, but the client send a RST connection to server while closing socket

if the length is longer:
client can receive the modified payload, but the server repeatedly to send the packet for several times, and the length looks like not changed via get_payload_len()

if the length is same, just replace content, all behave correctly

could you please help me? thanks, below is the test code:

from netfilterqueue import NetfilterQueue
from scapy.layers.inet import IP,TCP
from scapy.packet import Packet,Raw

def print_and_accept(pkt):
    msg = IP(pkt.get_payload())
    try:
        if msg.haslayer(TCP) and msg.haslayer(Raw):
            print msg[IP].show()
            print pkt.get_payload_len()
            _Data = 'for the hook test'
            msg[TCP].remove_payload()
            msg[TCP].add_payload(_Data)
            #msg[Raw].load = _Data
            #print msg[IP].show()
            msg[IP].len = len(msg)
            del msg[IP].chksum
            del msg[TCP].chksum
            msg = msg.__class__(str(msg))
            pkt.set_payload(str(msg))
            #new_msg = IP(pkt.get_payload())
            #print new_msg[TCP].payload
            #print new_msg[IP].show()
            print msg[IP].show()
            print pkt.get_payload_len()
            pkt.accept()
        else:
            pkt.accept()
    except Exception, err:
        print err
        pkt.accept()

nfqueue = NetfilterQueue()
nfqueue.bind(1, print_and_accept)
try:
    nfqueue.run()
except KeyboardInterrupt:
    print('')