IP Networking

hi there

so, i was given an assignment: implement a linux system call that blocks all packets that are sent to a given IP (i have to do it without using iptables)

i'm really new to kernel programming btw (and i'm enjoying it a lot)

so, my syscall is called ip_block() and receives a regular IP string as it's only argument - eg: ip_block("200.225.123.34")

so what i did was: i implemented the ip_block syscall in "net/socket.c", and this syscall pretty much stores the IP passed as argument, the one i want to block packets i send to, for later use

then, i modified the already implemented syscall sendto(), as we know, the syscall that's called everytime a packet is sent.

this syscall receives as an argument a sockaddr struct, which stores the packet's socket address; it's fields are sa_family (a flag so we know which kind of address it stores) and an array of chars called sa_data, which is the address itself.

so, what I did was: everytime sendto() was called, i would check the packet's address, and if it matched the IP i had passed to my own syscall, it would just ignore the packet.

but what i have noticed is that all packet's sent from my computer are not IPv4 nor IPv6 packet's -- as I "debugged" the syscall sendto() and made it print on the screen all sent packet's sa_family field, I realized all packet's addresses "sa_family" flag were, instead of AF_INET or AF_INET6 (IPv4 and IPv6) were actually from family AF_NETLINK or AF_PACKET - which I can't extract the IP from, meaning i can't block them since i don't know if they're the ones i want to block!

I have done the same modification in syscall connect(), and it worked: most of the connections made through connect() were given a sockaddr struct as argument and it's sa_family flag were either AF_INET or AF_INET6, which I could easily extract the IP from and compare it with the one I had in my own structure - the one I wanted to block.

So, do you have any ideas of what i should do? as I've done some research I realized AF_NETLINK and AF_PACKET means the packet's are only exchanging data between userspace and kernelspace only, but clearly TCP/IP packets are being sent from my machine as well - where can I get their IP addresses?

Since it's an assignment, I can't just implement a syscall that goes like:

syscall ip_block(){ system("iptables etc. DROP"); }

since i was asked to filter these ip's using kernel programming...

any thoughts or ideas?

thanks in advance, and sorry if there are any language mistakes above - english is not my native language (brazilian here)

You need to write a kernel module which can hook some network call-back function.
Reading of Netilter hack related pdf would be good start for you