Enabling NETFILTER and iptables command

[cox85]

I want to create a netfilter kernel module and I am new in android
world.
I have downloaded android kernel and I have make my own kernel, but I
can't found in ADB shell iptables command.
I use android goldfish because i have only the emulator
What I have to do to enabling iptables command?
Antonio Conforti

[Brad Davis]

Android is (simply) a Linux kernel, some (not all) modified BSD
userspace, and the Android Java system. If you want Linux userspace
you will need to add Linux userspace programs to your build.

[cox85]

Thanks for the answer. But my kernel still not support iptables. I
have recompiled the kernel, with, command make menuconfig, adding

general setup->"kernel-> user space relay support (formerly relayfs) "

What I have to modify to enable iptables?

[Brad Davis]

In the kernel you need to enable Netfilter and all the IP Tables stuff
under that (you should look at the configuration of a kernel that
supports iptables). Then you need to port the userspace program
iptables (including the libraries that aren't part of Android).

If you don't know what you are doing, you should practice first on a
standard Linux distribution where you have the full support of the OS
to debug your hacks. Android isn't made to learn kernel hacking on.

[cox85]

Thanks Brad. I am doing the thesis on Android kernel.
I have already created a Netfilter module for Linux Kernel, but in
Android is a little more complex.
I have downloaded iptables source from android kernel source, but how
can i compile it?
I have to create only a Makefile?And I have to compile with static
mode?
Where I have to put my userspace program iptables?

> > > > Antonio Conforti- Hide quoted text -
>
> - Show quoted text -

[Alpha Jin]

I don't think so, Once you opened the netfilter & iptables config in kernel. The iptables would be complied.

2010/10/19 cox85 <cox...@gmail.com>

--
unsubscribe: android-kerne...@googlegroups.com
website: http://groups.google.com/group/android-kernel

--
Best regards,
Alpha

[billmeteor chen]

How to opened the netfilter & iptables config in kernel?

Does it need download anything or not?

On 10月19日, 上午11時25分, Alpha Jin <alphali...@gmail.com> wrote:
> I don't think so, Once you opened the netfilter & iptables config in kernel.
> The iptables would be complied.
>

> 2010/10/19 cox85 <cox1...@gmail.com>

> > unsubscribe: android-kerne...@googlegroups.com<android-kernel%2Bunsu...@go-oglegroups.com>

> > website:http://groups.google.com/group/android-kernel
>
> --
> Best regards,

> Alpha- 隱藏被引用文字 -
>
> - 顯示被引用文字 -

[Brad Davis]

Use the standard Linux "make menuconfig" to set kernel compile-time
options. As long as you have the git kernel tree you will have all
the standard Linux kernel sources and "make" tools.

> > > unsubscribe: android-kerne...@googlegroups.com<android-kernel%2Bunsubscr...@go-oglegroups.com>

[Brad Davis]

If you have the Android kernel tree from "git" you can use the "make
menuconfig" command to set the kernel compile-time parameters
(including netfilter and iptables). Android uses a slightly modified
Unix file tree structure where /system is prepended to the standard
Unix tree structure. Most of the userspace C/C++ programs are in /
system/{bin,lib,xbin}. (While there is /system/usr, there is not a
system/usr/{bin,sbin}).

Your userspace executables should be built like the other userspace
executables (they can be dynamically linked against the libraries in
the build tree).

Your executables should probably go in /system/bin, libraries in /
system/lib. These directories are protected from writing by normal
Android applications.

[Antonio Conforti]

How I Have to write my Makefile? In the folder of iptables source
there is a file called Android.mk and other files.
How can I compile my source? I need more detail
Thanks
Antonio Conforti

[Antonio Conforti]

I have download android-NDK and I have compile my iptables by this
command:
./ndk-build in the folder of iptables where there is the file
Android.mk.
Now I get an error: extensions/initext.c:1:25: error: gen_initext.c:
No such file or directory

what does it mean?
Antonio Conforti

[Hamilton Vera]

You are missing gen_initext.c file, something like this:

extern void ipt_ah_init(void);
extern void ipt_addrtype_init(void);
extern void ipt_comment_init(void);
extern void ipt_2connmark_init(void);
extern void ipt_conntrack_init(void);
extern void ipt_2dscp_init(void);
extern void ipt_2ecn_init(void);
extern void ipt_esp_init(void);
extern void ipt_hashlimit_init(void);
extern void ipt_helper_init(void);
extern void ipt_icmp_init(void);
extern void ipt_iprange_init(void);
extern void ipt_length_init(void);
extern void ipt_limit_init(void);
extern void ipt_mac_init(void);
extern void ipt_multiport_init(void);
extern void ipt_owner_init(void);
extern void ipt_physdev_init(void);
extern void ipt_pkttype_init(void);
extern void ipt_policy_init(void);
extern void ipt_realm_init(void);
extern void ipt_sctp_init(void);
extern void ipt_standard_init(void);
extern void ipt_state_init(void);
extern void ipt_tcp_init(void);
extern void ipt_2tcpmss_init(void);
extern void ipt_2tos_init(void);
extern void ipt_2ttl_init(void);
extern void ipt_udp_init(void);
extern void ipt_unclean_init(void);
extern void ipt_CLASSIFY_init(void);
extern void ipt_CONNMARK_init(void);
extern void ipt_DNAT_init(void);
extern void ipt_LOG_init(void);
extern void ipt_MASQUERADE_init(void);
extern void ipt_MIRROR_init(void);
extern void ipt_NETMAP_init(void);
extern void ipt_NFQUEUE_init(void);
extern void ipt_NOTRACK_init(void);
extern void ipt_REDIRECT_init(void);
extern void ipt_REJECT_init(void);
extern void ipt_SAME_init(void);
extern void ipt_SNAT_init(void);
extern void ipt_ULOG_init(void);
void init_extensions(void) {
ipt_ah_init();
ipt_addrtype_init();
ipt_comment_init();
ipt_2connmark_init();
ipt_conntrack_init();
ipt_2dscp_init();
ipt_2ecn_init();
ipt_esp_init();
ipt_hashlimit_init();
ipt_helper_init();
ipt_icmp_init(); ipt_iprange_init();
ipt_length_init();
ipt_limit_init();
ipt_mac_init();
ipt_multiport_init();
ipt_owner_init();
ipt_physdev_init();
ipt_pkttype_init();
ipt_policy_init();
ipt_realm_init();
ipt_sctp_init();
ipt_standard_init();
ipt_state_init();
ipt_tcp_init();
ipt_2tcpmss_init();
ipt_2tos_init();
ipt_2ttl_init();
ipt_udp_init();
ipt_unclean_init();
ipt_CLASSIFY_init();
ipt_CONNMARK_init();
ipt_DNAT_init();
ipt_LOG_init();
ipt_MASQUERADE_init();
ipt_MIRROR_init();
ipt_NETMAP_init();
ipt_NFQUEUE_init();
ipt_NOTRACK_init();
ipt_REDIRECT_init();
ipt_REJECT_init();
ipt_SAME_init();
ipt_SNAT_init();
ipt_ULOG_init();
}

> --
> unsubscribe: android-kerne...@googlegroups.com
> website: http://groups.google.com/group/android-kernel

--
Hamilton Vera
int Administrator (char Network[],char ComputationalSystems[])
http://hvera.wordpress.com

[Hamilton Vera]

Iptables is just a front end to manipulate netfilter rules.

You can enable netfilter in the kernel

│

│
│ Symbol: NETFILTER [=y]

│
│ Prompt: Network packet filtering framework (Netfilter)

│
│ Defined at net/Kconfig:69

│
│ Depends on: NET

│
│ Location:

│
│ -> Networking support (NET [=y])

│
│ -> Networking options

│
│

Android uses Android.mk files instead of Makefile, but the compilation
process itself is the same. In my environment the iptables binary is
built under /system/bin/iptables, check in you FS for this file.

[]'s

Hamilton Vera

[Antonio Conforti]

My goldfish kernel hasn't iptables inside. I try to make new kernel by
make menuconfig , but nothing.
I have to compile my iptables and then load this program.
I try to create a file gen_initext.c but i get another error.

Thanks

[Antonio Conforti]

This is the output:

antonio@debian:~/iptables/jni$ ls
Android.mk extensions ip6tables.8.in ip6tables-save.
8 iptables.c iptables-save.8
iptables.xslt NOTICE
CleanSpec.mk include ip6tables.c ip6tables-
save.c iptables-multi.c iptables-save.c
libipq Rules.make
COMMIT_NOTES INCOMPATIBILITIES ip6tables-restore.8 ip6tables-
standalone.c iptables-restore.8 iptables-standalone.c libiptc
COPYING INSTALL ip6tables-restore.c iptables.
8.in iptables-restore.c iptables-xml.c
MODULE_LICENSE_GPL
antonio@debian:~/iptables/jni$ ~/android-ndk-r4b/./ndk-build
Compile thumb : iptables <= /home/antonio/iptables/jni/iptables.c
Compile thumb : iptables <= /home/antonio/iptables/jni/iptables-
standalone.c
Compile thumb : iptc <= /home/antonio/iptables/jni/libiptc/libip4tc.c
StaticLibrary : libiptc.a
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_ah.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_addrtype.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_comment.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_2connmark.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_conntrack.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_2dscp.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_2ecn.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_esp.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_hashlimit.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_helper.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_icmp.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_iprange.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_length.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_limit.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_mac.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_multiport.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_owner.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_physdev.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_pkttype.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_policy.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_realm.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_sctp.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_standard.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_state.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_tcp.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_2tcpmss.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_2tos.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_2ttl.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_udp.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_unclean.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_CLASSIFY.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_CONNMARK.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_DNAT.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_LOG.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_MASQUERADE.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_MIRROR.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_NETMAP.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_NFQUEUE.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_NOTRACK.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_REDIRECT.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_REJECT.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_SAME.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_SNAT.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
libipt_ULOG.c
Compile thumb : ext <= /home/antonio/iptables/jni/extensions/
initext.c
make: *** No rule to make target `/home/antonio/iptables/obj/local/
armeabi/libc.a', needed by `/home/antonio/iptables/obj/local/armeabi/
libext.a'. Stop.

[Hamilton Vera]

First you have to focus on netfilter (kernel) then you focus on
compiling iptables.

Netfilter is standard in mainline kernel, please check it again, look
for something like;

./include/net/netfilter
./include/linux/netfilter
./net/ipv4/netfilter
./net/bridge/netfilter
./net/netfilter
./net/decnet/netfilter
./net/ipv6/netfilter

[Antonio Conforti]

ok. In my kernel source there are folder you have told me. Now what I
have to do?

I remember to you that I have downloaded my kernel in the follow mode:
git clone git://android.git.kernel.org/kernel/common.git kernel-common
cd kernel-common
git checkout origin/android-goldfish-2.6.29

then I have make it as:
make ARCH=arm CROSS_COMPILE=~/prebuilt/linux-x86/toolchain/arm-
eabi-4.4.0/bin/arm-eabi- menuconfig
make ARCH=arm CROSS_COMPILE=~/prebuilt/linux-x86/toolchain/arm-
eabi-4.4.0/bin/arm-eabi-

I have another question...I try to compile my iptables source out of
emulator.Is it correct?

[Hamilton Vera]

Hi there, so... to enable netfilter

cd <your kernel path>
make menuconfig

[*] Networking support --->

Networking options --->

[*] Network packet filtering framework (Netfilter) --->

And mark what you need and save the configuration

Finally compile it with make.

I don't know if compiling iptables out of the source is the best way
in your case.

I think that your problem with gen_initext.c is due to your kernel
lacking netfilter configuration, please give me a feedback.

Thanks!

[billmeteor chen]

I already download the platform/external/iptables.git, kernel/
common.git and platform/prebuilt.git from android kernel tree.

I want to enable iptable command on my HTC hero.

Whether it need to download the all kernel tree.

Can anyone tell me about that for detail?

> int Administrator (char Network[],char ComputationalSystems[])http://hvera.wordpress.com- 隱藏被引用文字 -
>
> - 顯示被引用文字 -

[Antonio Conforti]

Thanks Brad and Hamilton for your answers. I have lunched iptables.
But I have other doubts:
I have compiled my iptables source obtaining two folder(one called
libs and the second obj), so I take libs/armeabi/iptables file and put
it into data from ./adb tool. I tried to move iptables file from data
to /system/bin in the emulator or put this file directly from ./adb
push to /system/bin but it isn't possible!!!
How can I do it?
At this moment,If I want to launch iptables command I have to go into
data folder and write command like this:"./iptables -v"

On 19 Ott, 19:26, Brad Davis <bda...@cove-mtn.com> wrote:

[Hamilton Vera]

Probably /system is mounted as read only.

One quick workaround that you can use is to put your files into
/sdcard, ie /sdcard/iptables and export some parameters like:

export PATH /sdcard/iptables/
export LD_LIBRARY_PATH /sdcard/iptables/lib

Unfortunately, as far as I know, deal with emulator images is a crafty
job. But if you discover how to mount the images and edit the files
you can edit init.rc and change how android mounts /system;

[]'s

Hamilton Vera

[Antonio Conforti]

I change permission of /system from ro to rw as follow:
./adb shell
#su
#mount or #cat /proc/mounts
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
none /acct cgroup rw,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,cpu 0 0
/dev/block/mtdblock0 /system yaffs2 ro 0
0<-----------------------------------------------------/system folder
is read-only
/dev/block/mtdblock1 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock2 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block/vold/179:0 /mnt/sdcard vfat
rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-
ro 0 0
/dev/block/vold/179:0 /mnt/secure/asec vfat
rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-
ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,size=0k,mode=000 0 0

#mount -o rw,remount -t yaffs2 /dev/block/mtdblock0 /system
#mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
none /acct cgroup rw,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,cpu 0 0
/dev/block/mtdblock0 /system yaffs2 rw 0
0<------------------------------------------------------now /system
folder is read-write
/dev/block/mtdblock1 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock2 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block/vold/179:0 /mnt/sdcard vfat
rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-
ro 0 0
/dev/block/vold/179:0 /mnt/secure/asec vfat
rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-
ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,size=0k,mode=000 0 0

[Antonio Conforti]

Also modifing /system access I'm not able to mv iptables from /data
to /system(i take an error : cross-device link).
I don't understand if I have to put into emulator also objs folder and
lib folder, or is it sufficient only to put iptables file.
Another question is as follows.
to compile iptables via NDK-build, I had to create a folder "jni" and
move into it all the files of iptables.
Is this procedure correct?

On Oct 26, 9:22 pm, Antonio Conforti <cox1...@gmail.com> wrote:
> I change permission of /system from ro to rw as follow:
> ./adb shell
> #su
> #mount or #cat /proc/mounts
> rootfs / rootfs ro 0 0
> tmpfs /dev tmpfs rw,mode=755 0 0
> devpts /dev/pts devpts rw,mode=600 0 0
> proc /proc proc rw 0 0
> sysfs /sys sysfs rw 0 0
> none /acct cgroup rw,cpuacct 0 0
> tmpfs /mnt/asec tmpfs rw,mode=755,gid=1000 0 0
> none /dev/cpuctl cgroup rw,cpu 0 0
> /dev/block/mtdblock0 /system yaffs2 ro 0
> 0<-----------------------------------------------------/system folder
> is read-only
> /dev/block/mtdblock1 /data yaffs2 rw,nosuid,nodev 0 0
> /dev/block/mtdblock2 /cache yaffs2 rw,nosuid,nodev 0 0
> /dev/block/vold/179:0 /mnt/sdcard vfat

> rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allo­w_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors­=remount-

> ro 0 0
> /dev/block/vold/179:0 /mnt/secure/asec vfat

> rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allo­w_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors­=remount-

> ro 0 0
> tmpfs /mnt/sdcard/.android_secure tmpfs ro,size=0k,mode=000 0 0
>
> #mount -o rw,remount -t yaffs2 /dev/block/mtdblock0 /system
> #mount
> rootfs / rootfs ro 0 0
> tmpfs /dev tmpfs rw,mode=755 0 0
> devpts /dev/pts devpts rw,mode=600 0 0
> proc /proc proc rw 0 0
> sysfs /sys sysfs rw 0 0
> none /acct cgroup rw,cpuacct 0 0
> tmpfs /mnt/asec tmpfs rw,mode=755,gid=1000 0 0
> none /dev/cpuctl cgroup rw,cpu 0 0
> /dev/block/mtdblock0 /system yaffs2 rw 0
> 0<------------------------------------------------------now /system
> folder is read-write
> /dev/block/mtdblock1 /data yaffs2 rw,nosuid,nodev 0 0
> /dev/block/mtdblock2 /cache yaffs2 rw,nosuid,nodev 0 0
> /dev/block/vold/179:0 /mnt/sdcard vfat

> rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allo­w_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors­=remount-

> ro 0 0
> /dev/block/vold/179:0 /mnt/secure/asec vfat

> rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allo­w_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors­=remount-

> > int Administrator (char Network[],char ComputationalSystems[])http://hvera.wordpress.com- Hide quoted text -