移植 iptables到arm linux

Question

、编译内核，支持netfilter

在宿主机上进入Linux内核目录，配置所需的内核模块：

[root@localhost ~]# cd /root/kernel-2410/kernel-2410s/
＃make menuconfig

选中如下内核选项：

General setup --->

Sysctl support （在ROMFS文件系统中/proc/sys/net/ipv4/出现ip_forward）
Networking options --->

Network packet filtering (replaces ipchains)
IP: Netfilter Configuration --->（全部选择即可）
2、编译生成iptables命令
[root@localhost ~]# cd /root/iiptables-1.2.11
[root@localhost iptables-1.2.11]# make KERNEL_DIR=/root/kernel-2410/kernel-2410s/
--------------------
正常
--------------------
[root@localhost iptables-1.2.11]# make NO_SHARED_LIBS=1
Extensions found:
/opt/host/armv4l/bin/armv4l-unknown-linux-gcc -O2 -Wall -Wunused -I/usr/src/linux/include -Iinclude/ -DIPTABLES_VERSION=\"1.2.11\" -DNO_SHARED_LIBS=1 -D_UNKNOWN_KERNEL_POINTER_SIZE -D_INIT=ipt_conntrack_init -c -o extensions/libipt_conntrack.o extensions/libipt_conntrack.c
In file included from extensions/libipt_conntrack.c:15:
extensions/../include/linux/netfilter_ipv4/ipt_conntrack.h:29: `IP_CT_DIR_MAX' undeclared here (not in a function)
extensions/../include/linux/netfilter_ipv4/ipt_conntrack.h:30: `IP_CT_DIR_MAX' undeclared here (not in a function)
extensions/../include/linux/netfilter_ipv4/ipt_conntrack.h:30: `IP_CT_DIR_MAX' undeclared here (not in a function)
extensions/libipt_conntrack.c: In function `parse_status':
extensions/libipt_conntrack.c:110: `IPS_EXPECTED' undeclared (first use in this function)
extensions/libipt_conntrack.c:110: (Each undeclared identifier is reported only once
extensions/libipt_conntrack.c:110: for each function it appears in.)
extensions/libipt_conntrack.c:112: `IPS_SEEN_REPLY' undeclared (first use in this function)
extensions/libipt_conntrack.c:114: `IPS_ASSURED' undeclared (first use in this function)
extensions/libipt_conntrack.c: In function `parse':
extensions/libipt_conntrack.c:229: `IP_CT_DIR_ORIGINAL' undeclared (first use in this function)
extensions/libipt_conntrack.c:286: `IP_CT_DIR_REPLY' undeclared (first use in this function)
extensions/libipt_conntrack.c: In function `print_status':
extensions/libipt_conntrack.c:395: `IPS_EXPECTED' undeclared (first use in this function)
extensions/libipt_conntrack.c:399: `IPS_SEEN_REPLY' undeclared (first use in this function)
extensions/libipt_conntrack.c:403: `IPS_ASSURED' undeclared (first use in this function)
extensions/libipt_conntrack.c: In function `matchinfo_print':
extensions/libipt_conntrack.c:457: `IP_CT_DIR_ORIGINAL' undeclared (first use in this function)
extensions/libipt_conntrack.c:477: `IP_CT_DIR_REPLY' undeclared (first use in this function)
make: *** [extensions/libipt_conntrack.o] 错误 1
[root@localhost iptables-1.2.11]#

谁移植过iptables,大家指点指点,谢谢！

Answer 1

可能是内核与iptables版本不匹配引起的，
也有可能是内核中相关的CONNTRACK支持没有打开-

Answer 2

parse_status 你可以看看这个函数中 调用的函数 定义在哪些文件里面， 在把相关的文件加进来看看行不行