patchpanel/firewall.cc - mirrors/cros/chromiumos/platform2 - Git at Google

 // Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "patchpanel/firewall.h"

 #include <arpa/inet.h>
 #include <linux/capability.h>
 #include <netinet/in.h>

 #include <string>
 #include <vector>

 #include <base/bind.h>
 #include <base/callback.h>
 #include <base/callback_helpers.h>
 #include <base/logging.h>
 #include <base/notreached.h>
 #include <base/strings/string_number_conversions.h>
 #include <base/strings/string_util.h>
 #include <base/strings/stringprintf.h>

 #include "patchpanel/net_util.h"

 namespace {

 // Interface names must be shorter than 'IFNAMSIZ' chars.
 // See http://man7.org/linux/man-pages/man7/netdevice.7.html
 // 'IFNAMSIZ' is 16 in recent kernels.
 // See
 // https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/if.h?h=v4.14#n33
 constexpr size_t kInterfaceNameSize = 16;

 // The name of the filter table for iptables and ip6tables commands.
 constexpr char kFilterTable[] = "filter";
 // The name of the nat table for iptables and ip6tables commands.
 constexpr char kNatTable[] = "nat";

 // Interface names are passed directly to the 'iptables' command. Rather than
 // auditing 'iptables' source code to see how it handles malformed names,
 // do some sanitization on the names beforehand.
 bool IsValidInterfaceName(const std::string& iface) {
   // |iface| should be shorter than |kInterfaceNameSize| chars and have only
   // alphanumeric characters (embedded hypens and periods are also permitted).
   if (iface.length() >= kInterfaceNameSize) {
     return false;
   }
   if (base::StartsWith(iface, "-", base::CompareCase::SENSITIVE) ||
       base::EndsWith(iface, "-", base::CompareCase::SENSITIVE) ||
       base::StartsWith(iface, ".", base::CompareCase::SENSITIVE) ||
       base::EndsWith(iface, ".", base::CompareCase::SENSITIVE)) {
     return false;
   }
   for (auto c : iface) {
     if (!std::isalnum(c) && (c != '-') && (c != '.')) {
       return false;
     }
   }
   return true;
 }

 }  // namespace

 namespace patchpanel {

 const std::string ProtocolName(Protocol proto) {
   if (proto == ModifyPortRuleRequest::INVALID_PROTOCOL) {
     NOTREACHED() << "Unexpected L4 protocol value";
   }
   return base::ToLowerASCII(ModifyPortRuleRequest::Protocol_Name(proto));
 }

 Firewall::Firewall() : Firewall(new MinijailedProcessRunner()) {}

 Firewall::Firewall(MinijailedProcessRunner* process_runner) {
   process_runner_.reset(process_runner);
 }

 bool Firewall::AddAcceptRules(Protocol protocol,
                               uint16_t port,
                               const std::string& interface) {
   if (port == 0U) {
     LOG(ERROR) << "Port 0 is not a valid port";
     return false;
   }

   if (!IsValidInterfaceName(interface)) {
     LOG(ERROR) << "Invalid interface name '" << interface << "'";
     return false;
   }

   if (!AddAcceptRule(IPv4, protocol, port, interface)) {
     LOG(ERROR) << "Could not add IPv4 ACCEPT rule";
     return false;
   }

   if (!AddAcceptRule(IPv6, protocol, port, interface)) {
     LOG(ERROR) << "Could not add IPv6 ACCEPT rule";
     DeleteAcceptRule(IPv4, protocol, port, interface);
     return false;
   }

   return true;
 }

 bool Firewall::DeleteAcceptRules(Protocol protocol,
                                  uint16_t port,
                                  const std::string& interface) {
   if (port == 0U) {
     LOG(ERROR) << "Port 0 is not a valid port";
     return false;
   }

   if (!IsValidInterfaceName(interface)) {
     LOG(ERROR) << "Invalid interface name '" << interface << "'";
     return false;
   }

   bool ip4_success = DeleteAcceptRule(IPv4, protocol, port, interface);
   bool ip6_success = DeleteAcceptRule(IPv6, protocol, port, interface);
   return ip4_success && ip6_success;
 }

 bool Firewall::AddIpv4ForwardRule(Protocol protocol,
                                   const std::string& input_ip,
                                   uint16_t port,
                                   const std::string& interface,
                                   const std::string& dst_ip,
                                   uint16_t dst_port) {
   if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
                           "-I")) {
     return false;
   }

   if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port, "-A")) {
     ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
                        "-D");
     return false;
   }

   return true;
 }

 bool Firewall::DeleteIpv4ForwardRule(Protocol protocol,
                                      const std::string& input_ip,
                                      uint16_t port,
                                      const std::string& interface,
                                      const std::string& dst_ip,
                                      uint16_t dst_port) {
   bool success = true;
   if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
                           "-D")) {
     success = false;
   }
   if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port, "-D")) {
     success = false;
   }
   return success;
 }

 bool Firewall::ModifyIpv4DNATRule(Protocol protocol,
                                   const std::string& input_ip,
                                   uint16_t port,
                                   const std::string& interface,
                                   const std::string& dst_ip,
                                   uint16_t dst_port,
                                   const std::string& operation) {
   if (!input_ip.empty() && GetIpFamily(input_ip) != AF_INET) {
     LOG(ERROR) << "Invalid input IPv4 address '" << input_ip << "'";
     return false;
   }

   if (port == 0U) {
     LOG(ERROR) << "Port 0 is not a valid port";
     return false;
   }

   if (!IsValidInterfaceName(interface) || interface.empty()) {
     LOG(ERROR) << "Invalid interface name '" << interface << "'";
     return false;
   }

   if (GetIpFamily(dst_ip) != AF_INET) {
     LOG(ERROR) << "Invalid destination IPv4 address '" << dst_ip << "'";
     return false;
   }

   if (dst_port == 0U) {
     LOG(ERROR) << "Destination port 0 is not a valid port";
     return false;
   }

   // Only support deleting existing forwarding rules or inserting rules in the
   // first position: ARC++ generic inbound DNAT rule always need to go last.
   if (operation != "-I" && operation != "-D") {
     LOG(ERROR) << "Invalid chain operation '" << operation << "'";
     return false;
   }

   std::vector<std::string> argv{
       operation,
       "PREROUTING",
       "-i",
       interface,
       "-p",  // protocol
       ProtocolName(protocol),
   };
   if (!input_ip.empty()) {
     argv.push_back("-d");  // input destination ip
     argv.push_back(input_ip);
   }
   argv.push_back("--dport");  // input destination port
   argv.push_back(std::to_string(port));
   argv.push_back("-j");
   argv.push_back("DNAT");
   argv.push_back("--to-destination");  // new output destination ip:port
   argv.push_back(dst_ip + ":" + std::to_string(dst_port));
   argv.push_back("-w");  // Wait for xtables lock.
   return RunIptables(IPv4, kNatTable, argv);
 }

 bool Firewall::ModifyIpv4ForwardChain(Protocol protocol,
                                       const std::string& interface,
                                       const std::string& dst_ip,
                                       uint16_t dst_port,
                                       const std::string& operation) {
   if (!IsValidInterfaceName(interface) || interface.empty()) {
     LOG(ERROR) << "Invalid interface name '" << interface << "'";
     return false;
   }

   if (GetIpFamily(dst_ip) != AF_INET) {
     LOG(ERROR) << "Invalid IPv4 destination address '" << dst_ip << "'";
     return false;
   }

   if (dst_port == 0U) {
     LOG(ERROR) << "Destination port 0 is not a valid port";
     return false;
   }

   // Order does not matter for the FORWARD chain: both -A or -I are possible.
   if (operation != "-A" && operation != "-I" && operation != "-D") {
     LOG(ERROR) << "Invalid chain operation '" << operation << "'";
     return false;
   }

   std::vector<std::string> argv{
       operation,
       "FORWARD",
       "-i",
       interface,
       "-p",  // protocol
       ProtocolName(protocol),
       "-d",  // destination ip
       dst_ip,
       "--dport",  // destination port
       std::to_string(dst_port),
       "-j",
       "ACCEPT",
       "-w",
   };  // Wait for xtables lock.
   return RunIptables(IPv4, kFilterTable, argv);
 }

 bool Firewall::AddLoopbackLockdownRules(Protocol protocol, uint16_t port) {
   if (port == 0U) {
     LOG(ERROR) << "Port 0 is not a valid port";
     return false;
   }

   if (!AddLoopbackLockdownRule(IPv4, protocol, port)) {
     LOG(ERROR) << "Could not add loopback IPv4 REJECT rule";
     return false;
   }

   if (!AddLoopbackLockdownRule(IPv6, protocol, port)) {
     LOG(ERROR) << "Could not add loopback IPv6 REJECT rule";
     DeleteLoopbackLockdownRule(IPv4, protocol, port);
     return false;
   }

   return true;
 }

 bool Firewall::DeleteLoopbackLockdownRules(Protocol protocol, uint16_t port) {
   if (port == 0U) {
     LOG(ERROR) << "Port 0 is not a valid port";
     return false;
   }

   bool ip4_success = DeleteLoopbackLockdownRule(IPv4, protocol, port);
   bool ip6_success = DeleteLoopbackLockdownRule(IPv6, protocol, port);
   return ip4_success && ip6_success;
 }

 bool Firewall::AddAcceptRule(IpFamily ip_family,
                              Protocol protocol,
                              uint16_t port,
                              const std::string& interface) {
   std::vector<std::string> argv{
       "-I",  // insert
       "INPUT",
       "-p",  // protocol
       ProtocolName(protocol),
       "--dport",  // destination port
       std::to_string(port),
   };
   if (!interface.empty()) {
     argv.push_back("-i");  // interface
     argv.push_back(interface);
   }
   argv.push_back("-j");
   argv.push_back("ACCEPT");
   argv.push_back("-w");  // Wait for xtables lock.

   return RunIptables(ip_family, kFilterTable, argv);
 }

 bool Firewall::DeleteAcceptRule(IpFamily ip_family,
                                 Protocol protocol,
                                 uint16_t port,
                                 const std::string& interface) {
   std::vector<std::string> argv{
       "-D",  // delete
       "INPUT",
       "-p",  // protocol
       ProtocolName(protocol),
       "--dport",  // destination port
       std::to_string(port),
   };
   if (!interface.empty()) {
     argv.push_back("-i");  // interface
     argv.push_back(interface);
   }
   argv.push_back("-j");
   argv.push_back("ACCEPT");
   argv.push_back("-w");  // Wait for xtables lock.

   return RunIptables(ip_family, kFilterTable, argv);
 }

 bool Firewall::AddLoopbackLockdownRule(IpFamily ip_family,
                                        Protocol protocol,
                                        uint16_t port) {
   std::vector<std::string> argv{
       "-I",  // insert
       "OUTPUT",
       "-p",  // protocol
       ProtocolName(protocol),
       "--dport",  // destination port
       std::to_string(port),
       "-o",  // output interface
       "lo",
       "-m",  // match extension
       "owner",
       "!",
       "--uid-owner",
       "chronos",
       "-j",
       "REJECT",
       "-w",  // Wait for xtables lock.
   };

   return RunIptables(ip_family, kFilterTable, argv);
 }

 bool Firewall::DeleteLoopbackLockdownRule(IpFamily ip_family,
                                           Protocol protocol,
                                           uint16_t port) {
   std::vector<std::string> argv{
       "-D",  // delete
       "OUTPUT",
       "-p",  // protocol
       ProtocolName(protocol),
       "--dport",  // destination port
       std::to_string(port),
       "-o",  // output interface
       "lo",
       "-m",  // match extension
       "owner",
       "!",
       "--uid-owner",
       "chronos",
       "-j",
       "REJECT",
       "-w",  // Wait for xtables lock.
   };

   // TODO:  add IPv4 or IPv6
   return RunIptables(ip_family, kFilterTable, argv);
 }

 bool Firewall::RunIptables(IpFamily ip_family,
                            const std::string& table,
                            const std::vector<std::string>& argv) {
   if (ip_family == IPv4)
     return process_runner_->iptables(table, argv, false) == 0;

   if (ip_family == IPv6)
     return process_runner_->ip6tables(table, argv, false) == 0;

   return false;
 }

 }  // namespace patchpanel
	// Copyright 2017 The Chromium OS Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "patchpanel/firewall.h"

	#include <arpa/inet.h>
	#include <linux/capability.h>
	#include <netinet/in.h>

	#include <string>
	#include <vector>

	#include <base/bind.h>
	#include <base/callback.h>
	#include <base/callback_helpers.h>
	#include <base/logging.h>
	#include <base/notreached.h>
	#include <base/strings/string_number_conversions.h>
	#include <base/strings/string_util.h>
	#include <base/strings/stringprintf.h>

	#include "patchpanel/net_util.h"

	namespace {

	// Interface names must be shorter than 'IFNAMSIZ' chars.
	// See http://man7.org/linux/man-pages/man7/netdevice.7.html
	// 'IFNAMSIZ' is 16 in recent kernels.
	// See
	// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/if.h?h=v4.14#n33
	constexpr size_t kInterfaceNameSize = 16;

	// The name of the filter table for iptables and ip6tables commands.
	constexpr char kFilterTable[] = "filter";
	// The name of the nat table for iptables and ip6tables commands.
	constexpr char kNatTable[] = "nat";

	// Interface names are passed directly to the 'iptables' command. Rather than
	// auditing 'iptables' source code to see how it handles malformed names,
	// do some sanitization on the names beforehand.
	bool IsValidInterfaceName(const std::string& iface) {
	// \|iface\| should be shorter than \|kInterfaceNameSize\| chars and have only
	// alphanumeric characters (embedded hypens and periods are also permitted).
	if (iface.length() >= kInterfaceNameSize) {
	return false;
	}
	if (base::StartsWith(iface, "-", base::CompareCase::SENSITIVE) \|\|
	base::EndsWith(iface, "-", base::CompareCase::SENSITIVE) \|\|
	base::StartsWith(iface, ".", base::CompareCase::SENSITIVE) \|\|
	base::EndsWith(iface, ".", base::CompareCase::SENSITIVE)) {
	return false;
	}
	for (auto c : iface) {
	if (!std::isalnum(c) && (c != '-') && (c != '.')) {
	return false;
	}
	}
	return true;
	}

	} // namespace

	namespace patchpanel {

	const std::string ProtocolName(Protocol proto) {
	if (proto == ModifyPortRuleRequest::INVALID_PROTOCOL) {
	NOTREACHED() << "Unexpected L4 protocol value";
	}
	return base::ToLowerASCII(ModifyPortRuleRequest::Protocol_Name(proto));
	}

	Firewall::Firewall() : Firewall(new MinijailedProcessRunner()) {}

	Firewall::Firewall(MinijailedProcessRunner* process_runner) {
	process_runner_.reset(process_runner);
	}

	bool Firewall::AddAcceptRules(Protocol protocol,
	uint16_t port,
	const std::string& interface) {
	if (port == 0U) {
	LOG(ERROR) << "Port 0 is not a valid port";
	return false;
	}

	if (!IsValidInterfaceName(interface)) {
	LOG(ERROR) << "Invalid interface name '" << interface << "'";
	return false;
	}

	if (!AddAcceptRule(IPv4, protocol, port, interface)) {
	LOG(ERROR) << "Could not add IPv4 ACCEPT rule";
	return false;
	}

	if (!AddAcceptRule(IPv6, protocol, port, interface)) {
	LOG(ERROR) << "Could not add IPv6 ACCEPT rule";
	DeleteAcceptRule(IPv4, protocol, port, interface);
	return false;
	}

	return true;
	}

	bool Firewall::DeleteAcceptRules(Protocol protocol,
	uint16_t port,
	const std::string& interface) {
	if (port == 0U) {
	LOG(ERROR) << "Port 0 is not a valid port";
	return false;
	}

	if (!IsValidInterfaceName(interface)) {
	LOG(ERROR) << "Invalid interface name '" << interface << "'";
	return false;
	}

	bool ip4_success = DeleteAcceptRule(IPv4, protocol, port, interface);
	bool ip6_success = DeleteAcceptRule(IPv6, protocol, port, interface);
	return ip4_success && ip6_success;
	}

	bool Firewall::AddIpv4ForwardRule(Protocol protocol,
	const std::string& input_ip,
	uint16_t port,
	const std::string& interface,
	const std::string& dst_ip,
	uint16_t dst_port) {
	if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
	"-I")) {
	return false;
	}

	if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port, "-A")) {
	ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
	"-D");
	return false;
	}

	return true;
	}

	bool Firewall::DeleteIpv4ForwardRule(Protocol protocol,
	const std::string& input_ip,
	uint16_t port,
	const std::string& interface,
	const std::string& dst_ip,
	uint16_t dst_port) {
	bool success = true;
	if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
	"-D")) {
	success = false;
	}
	if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port, "-D")) {
	success = false;
	}
	return success;
	}

	bool Firewall::ModifyIpv4DNATRule(Protocol protocol,
	const std::string& input_ip,
	uint16_t port,
	const std::string& interface,
	const std::string& dst_ip,
	uint16_t dst_port,
	const std::string& operation) {
	if (!input_ip.empty() && GetIpFamily(input_ip) != AF_INET) {
	LOG(ERROR) << "Invalid input IPv4 address '" << input_ip << "'";
	return false;
	}

	if (port == 0U) {
	LOG(ERROR) << "Port 0 is not a valid port";
	return false;
	}

	if (!IsValidInterfaceName(interface) \|\| interface.empty()) {
	LOG(ERROR) << "Invalid interface name '" << interface << "'";
	return false;
	}

	if (GetIpFamily(dst_ip) != AF_INET) {
	LOG(ERROR) << "Invalid destination IPv4 address '" << dst_ip << "'";
	return false;
	}

	if (dst_port == 0U) {
	LOG(ERROR) << "Destination port 0 is not a valid port";
	return false;
	}

	// Only support deleting existing forwarding rules or inserting rules in the
	// first position: ARC++ generic inbound DNAT rule always need to go last.
	if (operation != "-I" && operation != "-D") {
	LOG(ERROR) << "Invalid chain operation '" << operation << "'";
	return false;
	}

	std::vector<std::string> argv{
	operation,
	"PREROUTING",
	"-i",
	interface,
	"-p", // protocol
	ProtocolName(protocol),
	};
	if (!input_ip.empty()) {
	argv.push_back("-d"); // input destination ip
	argv.push_back(input_ip);
	}
	argv.push_back("--dport"); // input destination port
	argv.push_back(std::to_string(port));
	argv.push_back("-j");
	argv.push_back("DNAT");
	argv.push_back("--to-destination"); // new output destination ip:port
	argv.push_back(dst_ip + ":" + std::to_string(dst_port));
	argv.push_back("-w"); // Wait for xtables lock.
	return RunIptables(IPv4, kNatTable, argv);
	}

	bool Firewall::ModifyIpv4ForwardChain(Protocol protocol,
	const std::string& interface,
	const std::string& dst_ip,
	uint16_t dst_port,
	const std::string& operation) {
	if (!IsValidInterfaceName(interface) \|\| interface.empty()) {
	LOG(ERROR) << "Invalid interface name '" << interface << "'";
	return false;
	}

	if (GetIpFamily(dst_ip) != AF_INET) {
	LOG(ERROR) << "Invalid IPv4 destination address '" << dst_ip << "'";
	return false;
	}

	if (dst_port == 0U) {
	LOG(ERROR) << "Destination port 0 is not a valid port";
	return false;
	}

	// Order does not matter for the FORWARD chain: both -A or -I are possible.
	if (operation != "-A" && operation != "-I" && operation != "-D") {
	LOG(ERROR) << "Invalid chain operation '" << operation << "'";
	return false;
	}

	std::vector<std::string> argv{
	operation,
	"FORWARD",
	"-i",
	interface,
	"-p", // protocol
	ProtocolName(protocol),
	"-d", // destination ip
	dst_ip,
	"--dport", // destination port
	std::to_string(dst_port),
	"-j",
	"ACCEPT",
	"-w",
	}; // Wait for xtables lock.
	return RunIptables(IPv4, kFilterTable, argv);
	}

	bool Firewall::AddLoopbackLockdownRules(Protocol protocol, uint16_t port) {
	if (port == 0U) {
	LOG(ERROR) << "Port 0 is not a valid port";
	return false;
	}

	if (!AddLoopbackLockdownRule(IPv4, protocol, port)) {
	LOG(ERROR) << "Could not add loopback IPv4 REJECT rule";
	return false;
	}

	if (!AddLoopbackLockdownRule(IPv6, protocol, port)) {
	LOG(ERROR) << "Could not add loopback IPv6 REJECT rule";
	DeleteLoopbackLockdownRule(IPv4, protocol, port);
	return false;
	}

	return true;
	}

	bool Firewall::DeleteLoopbackLockdownRules(Protocol protocol, uint16_t port) {
	if (port == 0U) {
	LOG(ERROR) << "Port 0 is not a valid port";
	return false;
	}

	bool ip4_success = DeleteLoopbackLockdownRule(IPv4, protocol, port);
	bool ip6_success = DeleteLoopbackLockdownRule(IPv6, protocol, port);
	return ip4_success && ip6_success;
	}

	bool Firewall::AddAcceptRule(IpFamily ip_family,
	Protocol protocol,
	uint16_t port,
	const std::string& interface) {
	std::vector<std::string> argv{
	"-I", // insert
	"INPUT",
	"-p", // protocol
	ProtocolName(protocol),
	"--dport", // destination port
	std::to_string(port),
	};
	if (!interface.empty()) {
	argv.push_back("-i"); // interface
	argv.push_back(interface);
	}
	argv.push_back("-j");
	argv.push_back("ACCEPT");
	argv.push_back("-w"); // Wait for xtables lock.

	return RunIptables(ip_family, kFilterTable, argv);
	}

	bool Firewall::DeleteAcceptRule(IpFamily ip_family,
	Protocol protocol,
	uint16_t port,
	const std::string& interface) {
	std::vector<std::string> argv{
	"-D", // delete
	"INPUT",
	"-p", // protocol
	ProtocolName(protocol),
	"--dport", // destination port
	std::to_string(port),
	};
	if (!interface.empty()) {
	argv.push_back("-i"); // interface
	argv.push_back(interface);
	}
	argv.push_back("-j");
	argv.push_back("ACCEPT");
	argv.push_back("-w"); // Wait for xtables lock.

	return RunIptables(ip_family, kFilterTable, argv);
	}

	bool Firewall::AddLoopbackLockdownRule(IpFamily ip_family,
	Protocol protocol,
	uint16_t port) {
	std::vector<std::string> argv{
	"-I", // insert
	"OUTPUT",
	"-p", // protocol
	ProtocolName(protocol),
	"--dport", // destination port
	std::to_string(port),
	"-o", // output interface
	"lo",
	"-m", // match extension
	"owner",
	"!",
	"--uid-owner",
	"chronos",
	"-j",
	"REJECT",
	"-w", // Wait for xtables lock.
	};

	return RunIptables(ip_family, kFilterTable, argv);
	}

	bool Firewall::DeleteLoopbackLockdownRule(IpFamily ip_family,
	Protocol protocol,
	uint16_t port) {
	std::vector<std::string> argv{
	"-D", // delete
	"OUTPUT",
	"-p", // protocol
	ProtocolName(protocol),
	"--dport", // destination port
	std::to_string(port),
	"-o", // output interface
	"lo",
	"-m", // match extension
	"owner",
	"!",
	"--uid-owner",
	"chronos",
	"-j",
	"REJECT",
	"-w", // Wait for xtables lock.
	};

	// TODO: add IPv4 or IPv6
	return RunIptables(ip_family, kFilterTable, argv);
	}

	bool Firewall::RunIptables(IpFamily ip_family,
	const std::string& table,
	const std::vector<std::string>& argv) {
	if (ip_family == IPv4)
	return process_runner_->iptables(table, argv, false) == 0;

	if (ip_family == IPv6)
	return process_runner_->ip6tables(table, argv, false) == 0;

	return false;
	}

	} // namespace patchpanel