Drop skb or expand the outgoing skb

Question

When I capture outgoing packet in kernel by using kernel module, I am using kfree_skb() to drop that packet but it does not work and packet arrives its destination point. I check &skb->user is 1.

change_skb(struct sk_buff *skb) receive the original skb and create a new distinct copy (just copy its payload) and send the new skb. This works, I can see my new packet at the receiver side but I cannot drop the original so that I still see the original one at the receiver side.

Here is my code:

int my_pkt_handling(struct sk_buff *skb, struct net_device *dev, struct packet_type *pkt, struct net_device *org_dev) {

struct ethhdr *eth = eth_hdr(skb);
struct iphdr *iph = ip_hdr(skb);
unsigned char dst_addr[] = {0x00, 0x16, 0x41, 0xaa, 0xf8, 0xf0};
unsigned char src_addr[] = {0x00, 0x1f, 0xe2, 0x12, 0xb0, 0x34};

switch (skb->pkt_type) {
    case PACKET_OUTGOING:
        if ( memcmp(eth->h_dest, dst_addr, ETH_ALEN) == 0 && eth->h_proto == htons(ETH_P_IP) ) {                
            printk(KERN_ALERT"Outgoing| Interface: %4s Type: 0x%4x Src: %pI4 Dest: %pI4 Len: %d SizeOf: %lu User#: %d\n", 
                        skb->dev->name, ntohs(eth->h_proto), &iph->saddr, &iph->daddr, skb->len, sizeof(skb), atomic_read(&skb->users));
            change_skb(skb);
            kfree_skb(skb);
            return 0;
        }
        break;
    default:
        break;
}

return 0;

should you not be using skb_unlink() before calling kfree_skb() ? — askb

Nil Nil · Accepted Answer · 2015-01-23T22:48:12

From your function signature, its seems you are using dev_add_pack() API.

dev_add_pack() is not the correct API to drop a packet.

If you want to drop a packet you should use nf_register_hook() and return NF_DROP.

read more about netfilter in this link: http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-3.html

Drop skb or expand the outgoing skb

1 Answers