Merge lp:~hipl-core/hipl/android-hipfw into lp:hipl

[Pupu Toivonen]

Bring hipfw support to Android.

Fixes Bug #1313729

hipfw would not compile for Android previously mostly due to missing
dependencies. The prepare_android_toolchain.sh script now downloads
and compiles libmnl, libnfnetlink and libnetfilter_queue in addition
to OpenSSL. A couple of patches were needed to remove definitions that
were already somewhere in Bionic, and to add definitions that were missing.

Android has supported Position Independent Executables (PIE) since 4.1
and enforces them by default since around 4.4.2. Trying to run a
non-PIE executable on a recent version of Android should result in
"error: only position independent executables (PIE) are supported."
The script now gives two ./configure -lines from which the user
should choose depending on their target device.

configure.ac and documentation has been updated for hipfw support.

hipfw/helpers.c uses the function WEXITSTATUS from <sys/wait.h> which
seems to have been included indirectly on Linux, but not on Android.

LSI support has been tested on Android 4.4.4, kernel version 3.4.0
with the features listed in installation instructions, on a Nexus 5,
and seems to work just fine.

Feedback from previous merge proposal was taken into account;
commands to compile for Android are now simpler and make better
use of Autotools.

[Miika Komu (miika-iki)]

Seems good otherwise, but why are the patches embedded inside the script? I'd suggest separating them to patches/android, but perhaps you have a good reason for this.

review: Needs Information

[René Hummen (rene-hummen)]

I agree with Miika that the patches should be separated from 'tools/prepare_android_toolchain.sh'. Probably, you could even download them in your script. We then would not need to include external code in our repository.

In addition, please see my two diff comments.

review: Needs Fixing

[Pupu Toivonen (scolphoy)]

On 31.08.2014, at 21:01, Diego Biurrun <email address hidden> wrote:

> review needs-changes
>
> On Thu, Aug 28, 2014 at 08:14:21PM -0000, Juhani Toivonen wrote:
>> --- INSTALL 2014-03-27 21:25:22 +0000
>> +++ INSTALL 2014-08-28 20:13:36 +0000
>> @@ -115,29 +115,47 @@
>>
>> 5. In the HIPL source tree, run:
>> - ./configure --enable-android --disable-firewall --host=arm-linux \
>> - --prefix=/usr --sysconfdir=/etc \
>> - CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc \
>> - CFLAGS="-std=c99 -mbionic -fPIC -fno-exceptions \
>> - --sysroot=${ANDROID_SYSROOT}" \
>> + ./configure --enable-android --host=arm-linux \
>> + --prefix=/usr --sysconfdir=/etc \
>> + CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc \
>> + CFLAGS="-std=c99 -mbionic -fPIC -pie -fno-exceptions \
>> + --sysroot=${ANDROID_SYSROOT}" \
>> LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,\
>> --L${ANDROID_SYSROOT}/usr/lib" \
>> +-L${ANDROID_SYSROOT}/usr/lib" \
>> LIBS="-lc -lm -lgcc -lcrypto"
>
> If you prettyprint this, don't leave out the LDFLAGS line.

The LDFLAGS line is like that by intention.

It’s too long to fit into 80 characters, and it doesn’t work if there’s whitespace inside it. Like that, at least copying and pasting the line into terminal works.

To how I see, my options are:
a) Leave it like that. It’s a small eyesore but it works.
b) Ignore the instruction that lines longer than 80 characters should be divided.
c) Make the line pretty like the others and instruct user to remove whitespace from within LDFLAGS before executing.
d) For consistency, not pretty print the command at all because of that one part.

>
>> --- hipfw/helpers.c 2012-05-12 06:54:33 +0000
>> +++ hipfw/helpers.c 2014-08-28 20:13:36 +0000
>> @@ -35,6 +35,7 @@
>> #include <stdarg.h>
>> #include <arpa/inet.h>
>> #include <netinet/in.h>
>> +#include <sys/wait.h>
>>
>> #include "libcore/debug.h"
>> #include "helpers.h"
>
> I suggest pushing such fixes directly, independent of this patch set.

Ok, will do.

>> --- tools/prepare_android_toolchain.sh 2013-11-18 14:14:39 +0000
>> +++ tools/prepare_android_toolchain.sh 2014-08-28 20:13:36 +0000
>> @@ -91,17 +91,206 @@
>>
>> +patch_toolchain()
>> +{
>> +# ------------------------------ PATCH ------------------------------ #
>> +# ---- Add definition for __fswab64 needed by libnetfilter_queue ---- #
>> +# ---- https://code.google.com/p/android/issues/detail?id=14475 ---- #
>> +
>> +patch -N ${ANDROID_SYSROOT}/usr/include/linux/byteorder/swab.h << EOF
>> +--- swab.h 2011-02-02 13:43:37.711530000 +0000
>> ++++ platforms/android-9/arch-arm/usr/include/linux/byteorder/swab.h 2011-02-02 13:37:58.011530001 +0000
>> +@@ -64,9 +64,52 @@
>> + #define __swab64(x) __fswab64(x)
>> + #endif
>> +
>> ++
>> ++static __inline__ __attribute_const__ __u16 __fswab16(__u16 x)
>> ++{
>> ++ return __arch__swab16(x);
>...

[Diego Biurrun (diego-biurrun)]

On Sun, Aug 31, 2014 at 09:25:30PM +0300, Juhani Toivonen wrote:
> On 31.08.2014, at 21:01, Diego Biurrun <email address hidden> wrote:
> > On Thu, Aug 28, 2014 at 08:14:21PM -0000, Juhani Toivonen wrote:
> >> --- INSTALL 2014-03-27 21:25:22 +0000
> >> +++ INSTALL 2014-08-28 20:13:36 +0000
> >> @@ -115,29 +115,47 @@
> >>
> >> 5. In the HIPL source tree, run:
> >> - ./configure --enable-android --disable-firewall --host=arm-linux \
> >> - --prefix=/usr --sysconfdir=/etc \
> >> - CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc \
> >> - CFLAGS="-std=c99 -mbionic -fPIC -fno-exceptions \
> >> - --sysroot=${ANDROID_SYSROOT}" \
> >> + ./configure --enable-android --host=arm-linux \
> >> + --prefix=/usr --sysconfdir=/etc \
> >> + CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc \
> >> + CFLAGS="-std=c99 -mbionic -fPIC -pie -fno-exceptions \
> >> + --sysroot=${ANDROID_SYSROOT}" \
> >> LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,\
> >> --L${ANDROID_SYSROOT}/usr/lib" \
> >> +-L${ANDROID_SYSROOT}/usr/lib" \
> >> LIBS="-lc -lm -lgcc -lcrypto"
> >
> > If you prettyprint this, don't leave out the LDFLAGS line.
>
> The LDFLAGS line is like that by intention.
>
> It’s too long to fit into 80 characters, and it doesn’t work if there’s whitespace inside it. Like that, at least copying and pasting the line into terminal works.
>
> To how I see, my options are:
> a) Leave it like that. It’s a small eyesore but it works.
> b) Ignore the instruction that lines longer than 80 characters should be divided.
> c) Make the line pretty like the others and instruct user to remove whitespace from within LDFLAGS before executing.
> d) For consistency, not pretty print the command at all because of that one part.

b)

> > I fully agree with René, these inline patches are ugly.
>
> Fine, I’ll find a place to host them and have the script pull them in.

You don't need to. Adding the files to HIPL is not a problem, but why
have them inlined into the script?

Diego

[Pupu Toivonen (scolphoy)]

On 01.09.2014, at 00:10, Diego Biurrun <email address hidden> wrote:

>>> I fully agree with René, these inline patches are ugly.
>>
>> Fine, I’ll find a place to host them and have the script pull them in.
>
> You don't need to. Adding the files to HIPL is not a problem, but why
> have them inlined into the script?
>
> Diego
>

I have now fixed all the other parts except Rene’s suggestion to remove the CC, CFLAGS etc. from the configure command-line.
I haven’t figured out what goes wrong with that yet. I’m guessing the environment variables are not being resolved correctly when left to just the configure.ac

$ ./configure --enable-android --host=arm-linux --prefix=/usr --sysconfdir=/etc
. . .

$ make
make all-am
make[1]: Entering directory `/android/src/android-hipfw'
  CC libcore/builder.lo
libcore/builder.c: Assembler messages:
libcore/builder.c:144: Error: no such instruction: `rev %edx,%edx'
libcore/builder.c:133: Error: no such instruction: `rev16 %dx,%dx'
libcore/builder.c:137: Error: no such instruction: `rev16 %dx,%dx'
libcore/builder.c:148: Error: no such instruction: `rev %edx,%edx'
libcore/builder.c:410: Error: no such instruction: `rev16 %dx,%dx'
libcore/builder.c:410: Error: no such instruction: `rev16 %ax,%ax'
libcore/builder.c:166: Error: no such instruction: `rev16 %dx,%dx'
libcore/builder.c:172: Error: no such instruction: `rev16 %dx,%dx'
libcore/builder.c:424: Error: no such instruction: `rev16 %ax,%ax’
. . .

[Pupu Toivonen (scolphoy)]

On 01.09.2014, at 14:14, Juhani Toivonen <email address hidden> wrote:

> On 01.09.2014, at 00:10, Diego Biurrun <email address hidden> wrote:
>
>>>> I fully agree with René, these inline patches are ugly.
>>>
>>> Fine, I’ll find a place to host them and have the script pull them in.
>>
>> You don't need to. Adding the files to HIPL is not a problem, but why
>> have them inlined into the script?
>>
>> Diego
>>
>
> I have now fixed all the other parts except Rene’s suggestion to remove the CC, CFLAGS etc. from the configure command-line.
> I haven’t figured out what goes wrong with that yet. I’m guessing the environment variables are not being resolved correctly when left to just the configure.ac
>
>
> $ ./configure --enable-android --host=arm-linux --prefix=/usr --sysconfdir=/etc
> . . .
>
> $ make
> make all-am
> make[1]: Entering directory `/android/src/android-hipfw'
> CC libcore/builder.lo
> libcore/builder.c: Assembler messages:
> libcore/builder.c:144: Error: no such instruction: `rev %edx,%edx'
> libcore/builder.c:133: Error: no such instruction: `rev16 %dx,%dx'
> libcore/builder.c:137: Error: no such instruction: `rev16 %dx,%dx'
> libcore/builder.c:148: Error: no such instruction: `rev %edx,%edx'
> libcore/builder.c:410: Error: no such instruction: `rev16 %dx,%dx'
> libcore/builder.c:410: Error: no such instruction: `rev16 %ax,%ax'
> libcore/builder.c:166: Error: no such instruction: `rev16 %dx,%dx'
> libcore/builder.c:172: Error: no such instruction: `rev16 %dx,%dx'
> libcore/builder.c:424: Error: no such instruction: `rev16 %ax,%ax’
> . . .

Nevermind. It didn’t know which CC to use. Working on fixing it now.

[Miika Komu (miika-iki)]

Works for me!

review: Approve

[Miika Komu (miika-iki)]

I suggest to merge in this in one week unless somebody disapproves by then.

[lp:~hipl-core/hipl/android-hipfw]

6474. By Pupu Toivonen on 2014-09-23

Correct typos, remove old instructions, fix style a little.

6475. By Pupu Toivonen on 2014-10-01

Change path finding back the way it was

6476. By Pupu Toivonen on 2014-10-01

Add newlines to ends of patch-files.

6477. By Pupu Toivonen on 2014-10-01

Sync with trunk

=== modified file 'INSTALL'
--- INSTALL	2014-03-27 21:25:22 +0000
+++ INSTALL	2014-10-01 13:19:56 +0000
@@ -115,29 +115,41 @@
 4. Follow the instructions printed at the end of the script.
 
 5. In the HIPL source tree, run:
-   ./configure --enable-android --disable-firewall --host=arm-linux      \
-           --prefix=/usr --sysconfdir=/etc                               \
-           CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc         \
-           CFLAGS="-std=c99 -mbionic -fPIC -fno-exceptions               \
-                   --sysroot=${ANDROID_SYSROOT}"                         \
-           LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,\
--L${ANDROID_SYSROOT}/usr/lib"                                            \
-           LIBS="-lc -lm -lgcc -lcrypto"
+   export CC="${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc"
+   ./configure --enable-android --host=arm-linux                    \
+               --prefix=/usr    --sysconfdir=/etc
 
-It is important that there are no spaces after commas in LDFLAGS.
+For Android-versions older than 4.1, add '--disable-android-pie' to
+the configure line.
 
 You can then compile the source using 'make'.
 
-Currently to install HIP you need to run the following commands on your device:
-mount -o remount,rw /
-mount -o remount,rw /system
-mkdir -p /var/lock
-mkdir    /etc/hip
-ln -s /system/lib/libcrypto.so /system/lib/libcrypto.so.1.0.0
-
-Then copy (adb push) the config files hipd.conf and relay.conf /etc/hip and
-the binaries hipd and hipconf to /system/xbin in your device. You should then be
-able to run hipd and hipconf normally.
+Currently to install HIP you need to run the following commands on the computer:
+adb root
+adb shell mount -o remount,rw /
+adb shell mount -o remount,rw /system
+adb shell mkdir -p /var/lock
+adb shell mkdir    /etc/hip
+adb shell ln -s /system/lib/libcrypto.so /system/lib/libcrypto.so.1.0.0
+
+Then using 'adb push' on your computer
+- Copy hipd/hipd.conf, hipd/relay.conf and hipfw/hipfw.conf to /etc/hip/
+- Copy hipd/hipd, hipfw/hipfw and tools/hipconf to /system/xbin
+- Copy all libmnl.* , libnfnetlink.* and libnetfilter_queue.* from
+  the toolchain's sysroot/usr/lib/ to /system/lib/ on the device.
+  This is usually $HOME/android_tools/toolchain/sysroot/usr/lib/
+  DO NOT copy all the files under that directory, they do not all
+  work on your device. Commands:
+
+adb push hipd/hipd        /system/xbin
+adb push hipfw/hipfw      /system/xbin
+adb push tools/hipconf    /system/xbin
+adb push hipd/hipd.conf   /etc/hip
+adb push hipd/relay.conf  /etc/hip
+adb push hipfw/hipfw.conf /etc/hip
+for file in ${ANDROID_SYSROOT}/usr/lib/lib{netfilter_queue,nfnetlink,mnl}.*; do
+  adb push $file /system/lib;
+done
 
 You need to run hipd with the -a flag.
 The /var/lock directory does not survive reboot, it needs to be

=== modified file 'configure.ac'
--- configure.ac	2013-11-01 06:40:17 +0000
+++ configure.ac	2014-10-01 13:19:56 +0000
@@ -139,6 +139,20 @@
 fi
 AM_CONDITIONAL(HIP_ANDROID, test x"$ac_cv_use_android" = x"yes")
 
+AC_ARG_ENABLE(android-pie,
+               AS_HELP_STRING([--disable-android-pie],
+                              [Don't compile as PIE (Position Independent Executable)]),
+               [ac_cv_use_android_pie=$enableval],
+               [ac_cv_use_android_pie=yes])
+AC_CACHE_CHECK([whether to build as PIE],
+               [ac_cv_use_android_pie],
+               [ac_cv_use_android_pie=yes])
+if test x"$ac_cv_use_android" = x"yes"; then
+    if test x"$ac_cv_use_android_pie" = x"yes"; then
+        AC_SUBST(AM_CFLAGS, "$AM_CFLAGS -pie")
+    fi
+fi
+
 AC_ARG_ENABLE(firewall,
                AS_HELP_STRING([--disable-firewall],
                               [HIP firewall daemon (default is YES)]),

=== modified file 'doc/HOWTO.xml.in'
--- doc/HOWTO.xml.in	2013-11-01 08:28:46 +0000
+++ doc/HOWTO.xml.in	2014-10-01 13:19:56 +0000
@@ -280,15 +280,12 @@
       steps to compile for Android are almost similar to normal Linux builds.
       You start with autoreconf --install; then you run the configure script:
       <programlisting>
-./configure --enable-android --disable-firewall --host=arm-linux   \
-            --prefix=/usr --sysconfdir=/etc                        \
-            CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc  \
-            CFLAGS="-std=c99 -mbionic -fPIC -fno-exceptions        \
-                   --sysroot=${ANDROID_SYSROOT}"                   \
-            LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,-L${ANDROID_SYSROOT}/usr/lib"                           \
-            LIBS="-lc -lm -lgcc -lcrypto"                          \
+CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc
+./configure --enable-android --host=arm-linux                      \
+            --prefix=/usr    --sysconfdir=/etc            
       </programlisting>
-      and run 'make'.
+      and run 'make'. If you are building for an Android version older than 4.1,
+      add '--disable-android-pie' to the configure line.
     </para>
     <para>
       After the build process completes, open a root privileged shell session on
@@ -305,10 +302,16 @@
       Afterwards, you can return to your normal terminal and push hipd, hipconf
       and the configuration in:
       <programlisting>
-adb push tools/hipconf  /system/xbin
-adb push hipd/hipd      /system/xbin
-adb push hipd/hipd.conf  /etc/hip
-adb push hipd/relay.conf /etc/hip
+adb push hipd/hipd        /system/xbin
+adb push hipfw/hipfw      /system/xbin
+adb push tools/hipconf    /system/xbin
+adb push hipd/hipd.conf   /etc/hip
+adb push hipd/relay.conf  /etc/hip
+adb push hipfw/hipfw.conf /etc/hip
+
+for file in ${ANDROID_SYSROOT}/usr/lib/lib{netfilter_queue,nfnetlink,mnl}.*; do
+  adb push $file /system/lib ;
+done
       </programlisting>
     </para>
     <para>
@@ -316,7 +319,10 @@
       supports the same parameters as the normal Linux version does,
       i.e. '-k' kills an already running instance and '-b' starts hipd in the
       background. By e.g. running 'hipd -ab' and configuring hosts in /etc/hosts
-      you should be able to use HIP on any program that supports IPv6.
+      you should be able to use HIP on any program that supports IPv6. If you
+      compiled all the required features into the kernel, instead of as modules,
+      then the '-m' flag makes hipd ignore the fact that loading those modules 
+      fails. hipfw supports the same flags as on Linux.
     </para>
     <para>
       As the root file system on Android typically resides on a ramdisk,

=== added directory 'patches/android'
=== added directory 'patches/android/libnetfilter_queue'
=== added file 'patches/android/libnetfilter_queue/tcp.c.patch'
--- patches/android/libnetfilter_queue/tcp.c.patch	1970-01-01 00:00:00 +0000
+++ patches/android/libnetfilter_queue/tcp.c.patch	2014-10-01 13:19:56 +0000
@@ -0,0 +1,18 @@
+--- a/src/extra/tcp.c	2014-04-14 06:09:08.933915830 -0700
++++ b/src/extra/tcp.c	2014-04-14 06:09:48.305916775 -0700
+@@ -109,16 +109,6 @@
+ }
+ EXPORT_SYMBOL(nfq_tcp_compute_checksum_ipv6);
+
+-/*
+- *	The union cast uses a gcc extension to avoid aliasing problems
+- *  (union is compatible to any of its members)
+- *  This means this part of the code is -fstrict-aliasing safe now.
+- */
+-union tcp_word_hdr {
+-	struct tcphdr hdr;
+-	uint32_t  words[5];
+-};
+-
+ #define tcp_flag_word(tp) ( ((union tcp_word_hdr *)(tp))->words[3])
+ 

=== added directory 'patches/android/ndk'
=== added file 'patches/android/ndk/ip.h.patch'
--- patches/android/ndk/ip.h.patch	1970-01-01 00:00:00 +0000
+++ patches/android/ndk/ip.h.patch	2014-10-01 13:19:56 +0000
@@ -0,0 +1,21 @@
+--- old/netinet/ip.h	2014-04-30 22:30:15.572177205 -0700
++++ new/netinet/ip.h	2014-04-30 22:31:51.096180484 -0700
+@@ -80,6 +80,8 @@
+ /*
+  * Definitions for IP type of service (ip_tos)
+  */
++#define	IPTOS_TOS_MASK  	0x1E
++#define	IPTOS_TOS(tos)      ((tos) & IPTOS_TOS_MASK)
+ #define	IPTOS_LOWDELAY		0x10
+ #define	IPTOS_THROUGHPUT	0x08
+ #define	IPTOS_RELIABILITY	0x04
+@@ -93,6 +95,8 @@
+ /*
+  * Definitions for IP precedence (also in ip_tos) (hopefully unused)
+  */
++#define	IPTOS_PREC_MASK 		0xe0
++#define	IPTOS_PREC(tos) 		((tos) & IPTOS_PREC_MASK)
+ #define	IPTOS_PREC_NETCONTROL		0xe0
+ #define	IPTOS_PREC_INTERNETCONTROL	0xc0
+ #define	IPTOS_PREC_CRITIC_ECP		0xa0
+ 

=== added file 'patches/android/ndk/ip_icmp.h.patch'
--- patches/android/ndk/ip_icmp.h.patch	1970-01-01 00:00:00 +0000
+++ patches/android/ndk/ip_icmp.h.patch	2014-10-01 13:19:56 +0000
@@ -0,0 +1,33 @@
+--- old/netinet/ip_icmp.h	2014-04-30 21:35:23.976064195 -0700
++++ new/netinet/ip_icmp.h	2014-04-30 21:52:21.520099130 -0700
+@@ -119,6 +119,29 @@
+ #define	icmp_data	  icmp_dun.id_data
+ };
+ 
++
++struct icmphdr
++{
++  u_int8_t type;                /* message type */
++  u_int8_t code;                /* type sub-code */
++  u_int16_t checksum;
++  union
++  {
++    struct
++    {
++      u_int16_t id;
++      u_int16_t sequence;
++    } echo;                     /* echo datagram */
++    u_int32_t   gateway;        /* gateway address */
++    struct
++    {
++      u_int16_t __unused;
++      u_int16_t mtu;
++    } frag;                     /* path mtu discovery */
++  } un;
++};
++
++
+ /*
+  * For IPv6 transition related ICMP errors.
+  */
+  

=== added file 'patches/android/ndk/swab.h.patch'
--- patches/android/ndk/swab.h.patch	1970-01-01 00:00:00 +0000
+++ patches/android/ndk/swab.h.patch	2014-10-01 13:19:56 +0000
@@ -0,0 +1,60 @@
+--- swab.h	2011-02-02 13:43:37.711530000 +0000
++++ platforms/android-9/arch-arm/usr/include/linux/byteorder/swab.h	2011-02-02 13:37:58.011530001 +0000
+@@ -64,9 +64,52 @@
+ #define __swab64(x) __fswab64(x)
+ #endif
+ 
++
++static __inline__ __attribute_const__ __u16 __fswab16(__u16 x)
++{
++	return __arch__swab16(x);
++}
++static __inline__ __u16 __swab16p(__u16 *x)
++{
++	return __arch__swab16p(x);
++}
++static __inline__ void __swab16s(__u16 *addr)
++{
++	__arch__swab16s(addr);
++}
++
++static __inline__ __attribute_const__ __u32 __fswab32(__u32 x)
++{
++	return __arch__swab32(x);
++}
++static __inline__ __u32 __swab32p(__u32 *x)
++{
++	return __arch__swab32p(x);
++}
++static __inline__ void __swab32s(__u32 *addr)
++{
++	__arch__swab32s(addr);
++}
++
+ #ifdef __BYTEORDER_HAS_U64__
+-#ifdef __SWAB_64_THRU_32__
+-#else
+-#endif
+-#endif
++static __inline__ __attribute_const__ __u64 __fswab64(__u64 x)
++{
++# ifdef __SWAB_64_THRU_32__
++	__u32 h = x >> 32;
++        __u32 l = x & ((1ULL<<32)-1);
++        return (((__u64)__swab32(l)) << 32) | ((__u64)(__swab32(h)));
++# else
++	return __arch__swab64(x);
++# endif
++}
++static __inline__ __u64 __swab64p(__u64 *x)
++{
++	return __arch__swab64p(x);
++}
++static __inline__ void __swab64s(__u64 *addr)
++{
++	__arch__swab64s(addr);
++}
++#endif /* __BYTEORDER_HAS_U64__ */
++
+ #endif
+ 

=== modified file 'tools/prepare_android_toolchain.sh'
--- tools/prepare_android_toolchain.sh	2013-11-18 14:14:39 +0000
+++ tools/prepare_android_toolchain.sh	2014-10-01 13:19:56 +0000
@@ -1,14 +1,18 @@
 #!/bin/bash
-
 # Script is for building an Android cross-compilation environment on linux.
 
 # If you want to change the install folder, do it here.
 TOOLCHAIN_INSTALL_FOLDER=${HOME}/android_tools
-OPENSSL_VERSION='1.0.1e'
 NDK_VERSION=r9
 SYSTEM=linux-x86_64
 
+OPENSSL_VERSION='1.0.1g'
+LIBMNL_VERSION='1.0.3'
+LIBNFNETLINK_VERSION='1.0.1'
+LIBNFQUEUE_VERSION='1.0.2'
+
 # These are for the script's internals
+PATCHES_DIR=$(dirname $(readlink -f ${0}))/../patches/android
 NDK_PACKAGE=android-ndk-${NDK_VERSION}-${SYSTEM}
 NDK_ROOT=${TOOLCHAIN_INSTALL_FOLDER}/android-ndk-${NDK_VERSION}
 ANDROID_TOOLCHAIN=${TOOLCHAIN_INSTALL_FOLDER}/toolchain
@@ -43,40 +47,36 @@
     fi
 }
 
-get_android_ndk()
+get_package()
 {
-    # If NDK is not found, download and install
-    if [ ! -d ${NDK_ROOT} ]; then
-        echo "Android NDK not found."
-        if [ ! -f ${NDK_PACKAGE}.tar.bz2 ]; then
-            echo "Android NDK package not found, downloading.."
-            wget http://dl.google.com/android/ndk/${NDK_PACKAGE}.tar.bz2
+    PACKAGENAME=$1
+    URI=$2
+    FILENAME=$(basename $2)
+    TARGET=$3
+
+    if [ ! -d ${TARGET} ]; then
+        echo "$PACKAGENAME not found."
+        if [ ! -f ${FILENAME} ]; then
+            echo "$PACKAGENAME package not found, downloading.."
+            wget $URI
         else
-            echo "Android NDK package found, using that."
+            echo "$PACKAGENAME package found, using that."
         fi
-        echo "Extracting Android NDK.."
-        tar xf ${NDK_PACKAGE}.tar.bz2
+        echo "Extracting $PACKAGENAME.."
+        tar xf $FILENAME
     else
-    echo "Android NDK found, using that."
+    echo "$PACKAGENAME found, using that."
     fi
 }
 
-get_openssl()
+install_sdk_platform_tools()
 {
-    # If OpenSSL sources are not found, download them
-    if [ ! -d openssl-${OPENSSL_VERSION} ]; then
-        echo "OpenSSL source not found."
-        if [ ! -f openssl-${OPENSSL_VERSION}.tar.gz ]; then
-            echo "OpenSSL source package not found, downloading.."
-            wget http://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz
-        else
-            echo "OpenSSL source package found, using that."
-        fi
-        echo "Extracting OpenSSL source.."
-        tar xf openssl-${OPENSSL_VERSION}.tar.gz
-    else
-        echo "OpenSSL source found, using that."
-    fi
+    cd ${TOOLCHAIN_INSTALL_FOLDER}/android-sdk-linux/
+        if [ ! -f platform-tools/adb ]; then
+        echo "Installing android platform tools"
+        tools/android update sdk --no-ui -t platform-tool
+    fi;
+    cd ..
 }
 
 build_ndk_toolchain()
@@ -91,17 +91,62 @@
     --install-dir=${ANDROID_TOOLCHAIN}
 }
 
+patch_toolchain()
+{
+
+# ---- Add definition for __fswab64 needed by libnetfilter_queue ---- #
+# ---- https://code.google.com/p/android/issues/detail?id=14475  ---- #
+patch -N ${ANDROID_SYSROOT}/usr/include/linux/byteorder/swab.h < ${PATCHES_DIR}/ndk/swab.h.patch
+
+# --------- Add some deprecated stuff back to netinet/ip.h ---------- #
+patch -N ${ANDROID_SYSROOT}/usr/include/netinet/ip.h < ${PATCHES_DIR}/ndk/ip.h.patch
+
+# --------- Add the icmphdr definition to netinet/ip_icmp.h --------- #
+patch -N ${ANDROID_SYSROOT}/usr/include/netinet/ip_icmp.h < ${PATCHES_DIR}/ndk/ip_icmp.h.patch
+
+}
+
+
 build_openssl()
 {
     # Configure and install OpenSSL in the toolchain
     cd ${TOOLCHAIN_INSTALL_FOLDER}/openssl-${OPENSSL_VERSION}
     ./config no-asm shared --prefix=${ANDROID_SYSROOT}/usr
     sed 's/-m64//g' -i Makefile    # The arm compiler doesn't support -m64
-    make install
-    cd ${TOOLCHAIN_INSTALL_FOLDER}
-}
-
-set_openssl_build_env_vars()
+    make
+    make install_sw
+    cd ${TOOLCHAIN_INSTALL_FOLDER}
+}
+
+build_libmnl()
+{
+    cd ${TOOLCHAIN_INSTALL_FOLDER}/libmnl-${LIBMNL_VERSION}
+    ./configure  --prefix=${ANDROID_SYSROOT}/usr --host=arm-linux CFLAGS="-mbionic -fPIC -fno-exceptions -I${ANDROID_SYSROOT}/usr/include" LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,-L${ANDROID_SYSROOT}/usr/lib"
+    make install
+    cd ${TOOLCHAIN_INSTALL_FOLDER}
+}
+
+build_libnfnetlink()
+{
+    cd ${TOOLCHAIN_INSTALL_FOLDER}/libnfnetlink-${LIBNFNETLINK_VERSION}
+    ./configure  --prefix=${ANDROID_SYSROOT}/usr --host=arm-linux CFLAGS="-mbionic -fPIC -fno-exceptions -I${ANDROID_SYSROOT}/usr/include" LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,-L${ANDROID_SYSROOT}/usr/lib"
+    make install
+    cd ${TOOLCHAIN_INSTALL_FOLDER}
+}
+
+build_libnetfilter_queue()
+{
+    cd ${TOOLCHAIN_INSTALL_FOLDER}/libnetfilter_queue-${LIBNFQUEUE_VERSION}
+
+    # --------  Remove duplicate definition for tcp_word_hdr  -------- #
+    patch -N src/extra/tcp.c < ${PATCHES_DIR}/libnetfilter_queue/tcp.c.patch
+
+    ./configure  --prefix=${ANDROID_SYSROOT}/usr --host=arm-linux CFLAGS="-mbionic -fPIC -fno-exceptions -I${ANDROID_SYSROOT}/usr/include" LDFLAGS="-Wl,-rpath-link=${ANDROID_SYSROOT}/usr/lib,-L${ANDROID_SYSROOT}/usr/lib"
+    make install
+    cd ${TOOLCHAIN_INSTALL_FOLDER}
+}
+
+set_build_env_vars()
 {
     export CC=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc
     export AR=${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-ar r
@@ -111,6 +156,7 @@
                   -DOPENSSL_N -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer   \
                   -Wall -fPIC"
     export PLATFORM="arm-linux"
+    export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:${ANDROID_SYSROOT}/usr/lib/pkgconfig
 }
 
 print_instructions()
@@ -128,49 +174,63 @@
     echo "We also recommend adding them to ${HOME}/.bashrc"
     echo "so they will be ready for future builds."
     echo ""
-    echo "Then in HIPL root run: "\
-           ./configure        \
-           --enable-android   \
-           --disable-firewall \
-           --host=arm-linux   \
-           --prefix=/usr      \
-           --sysconfdir=/etc  \
-           CC=\${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc \
-                                                                  \
-           CFLAGS=\"-std=c99 -mbionic -fPIC -fno-exceptions       \
-                    --sysroot=\${ANDROID_SYSROOT}\"               \
-                                                                  \
-           LDFLAGS=\"-Wl,-rpath-link=\${ANDROID_SYSROOT}/usr/lib,-L\${ANDROID_SYSROOT}/usr/lib\" \
-                                                                  \
-           LIBS=\"-lc -lm -lgcc -lcrypto\"
+    echo "Then in HIPL root run:"
+
+    echo "For Android >= 4.1: "                                  \
+          ./configure --enable-android --host=arm-linux          \
+                      --prefix=/usr    --sysconfdir=/etc         \
+          CC="${ANDROID_TOOLCHAIN}/bin/arm-linux-androideabi-gcc"
+    echo ""
+    echo "For Android < 4.1, add --disable-android-pie"
 
     # It is important that there are no spaces after commas in LDFLAGS.
 }
 
 print_invocation_help()
 {
-    echo "Invocation: $0 [--auto-insert-bashrc]"
+    echo "Invocation: $0 [--auto-insert-bashrc|--install-sdk]"
     echo "--auto-insert-bashrc  adds the NDK toolchain paths to .bashrc automatically."
+    echo "--install-sdk         Downloads the Android SDK platform tools (adb, fastboot etc.)."
 }
 
-# Main script
+
+####################
+#   Main script
+####################
+make_install_folder
+cd ${TOOLCHAIN_INSTALL_FOLDER}
+
 if [ ! "${1}xxx" = "xxx" ]; then
     if [ "$1" = "--auto-insert-bashrc" ]; then
         insert_vars_to_bashrc
+    elif [ "$1" = "--install-sdk" ]; then
+        get_package "Android SDK" http://dl.google.com/android/android-sdk_r22.6.2-linux.tgz android-sdk-linux
+        install_sdk_platform_tools
+        echo "To add adb etc. to your path, run:"
+        echo "export PATH=${PATH}:${TOOLCHAIN_INSTALL_FOLDER}/android-sdk-linux/platform-tools"
+        exit
     else
         print_invocation_help
         exit
-    fi # if --auto-insert-bashrc
+    fi # if $1 known
 fi # if $1 defined
 
-make_install_folder
-cd ${TOOLCHAIN_INSTALL_FOLDER}
-
-get_android_ndk
+get_package "Android NDK" http://dl.google.com/android/ndk/${NDK_PACKAGE}.tar.bz2 ${NDK_ROOT}
 build_ndk_toolchain
-
-get_openssl
-set_openssl_build_env_vars
+patch_toolchain
+
+set_build_env_vars
+
+get_package "OpenSSL" http://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz openssl-${OPENSSL_VERSION}
 build_openssl
 
+get_package "libmnl" http://netfilter.org/projects/libmnl/files/libmnl-${LIBMNL_VERSION}.tar.bz2 libmnl-${LIBMNL_VERSION}
+build_libmnl
+
+get_package "libnfnetlink" http://netfilter.org/projects/libnfnetlink/files/libnfnetlink-${LIBNFNETLINK_VERSION}.tar.bz2 libnfnetlink-${LIBNFNETLINK_VERSION}
+build_libnfnetlink
+
+get_package "libnetfilter_queue" http://netfilter.org/projects/libnetfilter_queue/files/libnetfilter_queue-${LIBNFQUEUE_VERSION}.tar.bz2 libnetfilter_queue-${LIBNFQUEUE_VERSION}
+build_libnetfilter_queue
+
 print_instructions