In my assignment I am writing in kernel space (I’m writing a simple FW) and need that if the client sends a file with the word GROOVY I need to block it.
My first idea was to check each packet if it contains the word GROOVY if not, great. Otherwise I will drop it.

The problem with this solution is maybe the file is quite big and will be split into a few packets. If so there is a chance no packet would have the word GROOVY but the file does contain the word.

I tried finding a solution but didn’t find one. I thought maybe writing a function that will build the file in the FW and if the final file does not contain the word GROOVY I will forward it.

Is there a better solution? is the idea feasible and do-able?

The assignment is to block a specific CVE.