If you’re looking for general information about how to use libnetfilter_queue for Linux, please refer here.
First, you’ll need to check if your Android system kernel is compiled with support for libentfilter_queue. Follow the following steps,
- Connect your android device to your computer.
- Enter command “adb pull /proc/config.gz” to get the config.gz file from your android device.
- Extract config.gz file, you’ll get a file named config. This is actually your Android Linux kernel build configuration file.
- Search for CONFIG_NETFILTER_ADVANCED, CONFIG_NETFITLER_NETLINK and CONFIG_NETFILTER_NETLINK_QUEUE in config file, make sure they’re not commented out.
If your Android build is not compiled with these features, you’ll need to compile customized kernel build to use libnetfilter_queue.
Next you’ll need to root your Android device. This is not the focus of this post, so it’s not covered here. But you can find lots of information online.
Thirdly, make sure your phone has iptables program. iptables program is used to configure the kernel packet filter table. Follow the command below to check,
If the terminal doens’t complain about program not found, then you have iptables installed. If you don’t have iptables installed on your Android device, you may consider install busybox, or compile your own iptables program. I checked out the Android source code tree, it includes iptables in the external folder. So it should be doable to build on your own.
1. Build the Libraries and Test Executable
libnetfilter_queue depends on libnfnetlink, so we’ll need to download both libraries from here and here. After downloading, extract the libraries to your Android project jni folder.
Copy the nfqnl_test.c file from libnetfilter_queue-1.0.0/utils/ folder to jni folder. And create a Android.mk file with the content below,
Then issue “ndk-build” command to build the libraries and executable nfqnltest.
Note that you’ll probably encounter an error “undefined reference to __fswab64”. This is an known issue as indicated here. Just apply the patch (or change according to the patch) to your NDK header file (platforms/android-9/arch-arm/usr/include/linux/byteorder/swab.h, replace “android-9” in the path with your targeted android version). It will resolve the build error.
2. Running the Code on Android
Follow the command below to copy and executable to your Android device and run it,
- adb shell
- mkdir /data/data/nfqnltest
- chmod 777 /data/data/nfqnltest
- Open another terminal. Go to libs/<armeabi*> folder of your Android project. Issue command “adb push nfqnltest /data/data/nfqnltest/”
- Switch back to first terminal, “cd /data/data/nfqnltest”
To configure iptables rules, you can open a new terminal, then follow the command below,
iptables -A OUTPUT -p tcp -j NFQUEUE –queue-num 0
Then in terminal you’re running nfqnltest, you can see the program outputs. If you open browser app on your phone, and try to open google.com. You’ll see some packet information displayed,
hw_protocol=0x0000 hook=3 id=0 outdev=12 payload_len=288
hw_protocol=0x0000 hook=3 id=1 outdev=12 payload_len=869
With libnetfilter_queue, you can do a lot of interesting stuff, like user space NATing, packet sniffing/capturing etc.