Compiling iptables target extension with xtables addons

Compiling iptables target extension with xtables addons

Compiling iptables target extension can be done on couple of ways. One way which will be described in this post will be compiling with xtables-addons. From the website about xtables-addons:

Xtables-addons is set of additional extensions for the Xtables packet filter that is present in Linux kernel. Xtables-addons is successor of patch-o-matic(-ng). Likewise, it contains extensions that were not, or are not yet, accepted in the main kernel/iptables packages.

Also like patch-o-matic-ng it provides option for compiling extensions, but it doesnt need to compile kernel when doing it. First step in compiling extension with xtables-addons is to download tool from the given website. After downloading tool, two files must be written. One file is userspace plugin and one is kernel plugin. Userspace plugin is called when user using iptables is interacting with created extension. Userspace plugin provides help messages, rule validaton (rule parsing), rule save function etc. On the other side, kernel plugin interacts with packets, and in that interaction it gives verdicts for every packet. In this post it will be assumed that userspace and kernel plugins are already written. Usually the userspace plugin is named libxt_NOE and kernel plugin is named xt_NOE where NOE is name of the extension. These two files should be placed in extension directory in xtables-addons root directory. Next step is to open mconfig file and to add following line:

build_NOE=m

which says that following extension should be built. After following is done, two more steps are required before compiling. Both steps require adding one line in files located in extensions directory. Following line should be added to extensions/Kbuild file

obj-${build- NOE}  += xt_NOE.o

and the next one should be added to extensions/Mbuild file

obj-${build-NOE} += libxt_NOE.so

After those steps are completed, compiling is done with series of commands

$ ./configure
$ make
# make install 

There is a very good book which describes creating Netfilter modules and which can be freely obtained.

download file now