NS3 DCE iptables

NS3 DCE iptables

git clone http://github.com/richardwithnell/iptables
cd iptables/
./configure LIBS="-pie -rdynamic" CFLAGS="-fPIC -U_FORTIFY_SOURCE" --with-xtlibdir=/lib/xtables --disable-shared 
make
readelf -h iptables/xtables-multi | grep Type:

run_iptables

diff -Naur a/source/ns-3-dce/helper/linux-stack-helper.cc b/source/ns-3-dce/helper/linux-stack-helper.cc
index 340f07d..2aab8b6 100644
--- a/source/ns-3-dce/helper/linux-stack-helper.cc
+++ b/source/ns-3-dce/helper/linux-stack-helper.cc
@@ -115,6 +115,22 @@
 }
 
 void
+LinuxStackHelper::RunIptables (Ptr<Node> node, Time at, std::string str)
+{
+#ifdef KERNEL_STACK
+  DceApplicationHelper process;
+  ApplicationContainer apps;
+  process.SetBinary ("xtables-multi");
+  process.SetStackSize (1 << 16);
+  process.ResetArguments ();
+  std::string iptables_cmd = "iptables " + str;
+  process.ParseArguments (iptables_cmd.c_str ());
+  apps = process.Install (node);
+  apps.Start (at);
+#endif
+}
+
+void
 LinuxStackHelper::RunIp (Ptr<Node> node, Time at, std::string str)
 {
 #ifdef KERNEL_STACK
diff -Naur a/source/ns-3-dce/helper/linux-stack-helper.h b/source/ns-3-dce/helper/linux-stack-helper.h
--- a/source/ns-3-dce/helper/linux-stack-helper.h	2014-12-09 18:32:50.040765202 +0000
+++ b/source/ns-3-dce/helper/linux-stack-helper.h	2015-03-14 00:10:05.990522933 +0000
@@ -130,6 +130,15 @@
    * \param str a string for the command line argument of ip command. e.g., "route add 10.0.1.0/24 via 10.0.0.1"
    */
   static void RunIp (Ptr<Node> node, Time at, std::string str);
+  
+  /**
+   * Execute "xtables-multi iptables" command (of Linux) on a specific node to configure the iptables.
+   *
+   * \param node The node pointer Ptr<Node> to configure.
+   * \param at the delta from the begining of simulation to execute this command.
+   * \param str a string for the command line argument of iptables command. e.g., "iptables -A INPUT -s 10.0.0.1 -j DROP"
+   */
+  static void RunIptables (Ptr<Node> node, Time at, std::string str);
 
 private:
   void Initialize ();

vzalloc

diff --git a/arch/sim/slab.c b/arch/sim/slab.c
--- a/arch/sim/slab.c
+++ b/arch/sim/slab.c
@@ -146,6 +146,11 @@ void free_pages(unsigned long addr, unsigned int order)
     }
 }
 
+void *vzalloc(unsigned long size)
+{
+  return kmalloc (size, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
+}
+
 void *vmalloc(unsigned long size)
 {
   return sim_malloc (size);

I imagine it will get you pretty close. The generated xtables-multi binary contains ip6tables, which is just an interface for netfilter. My net-next-sim / iptables repositories are pre-patched for this, if you want to try them out.