[Android Software Development] Losik:
Tried this on ICS9, iptables -V = 1.4.x, transparent proxy

HTTP traffic is pushing through the App with no problems. But HTTPS traffic capturing seems like not working...

Saw some FIX ME! comments in the log, maybe that's the reason?...

Proxy listening on 127.0.0.1:8010

Proxy listening on 127.0.0.1:8009

Proxy listening on 127.0.0.1:8008

Finished loading session from /mnt/sdcard/Android/data/org.sandroproxy/cache

Done!

Loading cookies

Loading urls

Loading conversations

Loading session from /mnt/sdcard/Android/data/org.sandroproxy/cache

Using CA from file: /mnt/sdcard/Android/data/org.sandroproxy/cache/.keystoreca

CA cert exported to /mnt/sdcard/Android/data/org.sandroproxy/cache/.keystoreca_export.crt

Loading keys from /mnt/sdcard/Android/data/org.sandroproxy/cache/.keystoreca

Using /mnt/sdcard/Android/data/org.sandroproxy/cache for data storage

client cert file name is not valid so it will not be used:/mnt/sdcard/cert.p12

#attach sandroproxy to INPUT chain

iptables -A INPUT -j sandroproxy

- successful.

#attach sandroproxy to nat PREROUTING chain

iptables -t nat -A PREROUTING -j sandroproxy

- successful.

#attach sandrop_proc to nat OUTPUT chain

iptables -t nat -A OUTPUT -j sandrop_proc

- successful.

#redirect outbound port from 443 to 127.0.0.1:8010

iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 443 -j DNAT --to 127.0.0.1:8010

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#logging before redirection is made to /proc/kmsg

iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 443 -j LOG --log-level debug --log-prefix "[NewConnection]" --log-uid

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#redirect outbound port from 80 to 127.0.0.1:8009

iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#logging before redirection is made to /proc/kmsg

iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 80 -j LOG --log-level debug --log-prefix "[NewConnection]" --log-uid

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#create sandro_proc chain

iptables -t nat --new sandrop_proc

iptables: Chain already exists.

- failed!

Error executing superuser commands: length=4096; regionStart=0; regionLength=-1

#redirect outbound port from 80 to 127.0.0.1:8009

iptables -t nat -A sandrop_proc -m owner --uid-owner 10052 -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#logging before redirection is made to /proc/kmsg

iptables -t nat -A sandrop_proc -m owner --uid-owner 10052 -p tcp --dport 80 -j LOG --log-level debug --log-prefix "[NewConnection]" --log-uid

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#create sandro_proc chain

iptables -t nat --new sandrop_proc

- successful.

#list of iptables

iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere

all -- anywhere anywhere owner socket exists

sandroproxy all -- anywhere anywhere

Chain FORWARD (policy DROP)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere

all -- anywhere anywhere owner socket exists

Chain costly_shared (0 references)

target prot opt source destination

all -- anywhere anywhere owner socket exists

ACCEPT all -- anywhere anywhere

Chain sandroproxy (1 references)

target prot opt source destination

ACCEPT tcp -- anywhere anywhere tcp dpt:www

ACCEPT tcp -- anywhere anywhere tcp dpt:https

FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456

FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456

- successful.

#list of iptables nat

iptables -L -t nat

Chain PREROUTING (policy ACCEPT)

target prot opt source destination

sandroproxy all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

Chain POSTROUTING (policy ACCEPT)

target prot opt source destination

Chain sandroproxy (1 references)

target prot opt source destination

REDIRECT tcp -- anywhere anywhere tcp dpt:www redir ports 8009

REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 8010

FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456

FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456

- successful.

#redirect 443 to 8010

iptables -A sandroproxy -t nat -p tcp --dport 443 -j REDIRECT --to-port 8010

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#redirect 80 to 8009

iptables -A sandroproxy -t nat -p tcp --dport 80 -j REDIRECT --to-port 8009

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#create sandroproxy chain, , it could fail if already exist

iptables -t nat --new sandroproxy

iptables: Chain already exists.

- failed!

#accept connection on port 443

iptables -A sandroproxy -p tcp --dport 443 -j ACCEPT

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#accept connection on port 80

iptables -A sandroproxy -p tcp --dport 80 -j ACCEPT

FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450

- successful.

#create sandroproxy chain, it could fail if already exist

iptables --new sandroproxy

iptables: Chain already exists.

- failed!

Attaching iptables -L -t nat command