Method disable

src/helper/linux/firewallcontroller.cpp:491–532

}

bool FirewallController::disable()
{
    // Tear down our own chains and the jumps into the built-in INPUT/OUTPUT chains directly,
    // rather than via a client-supplied delete blob, so firewallOff cannot be steered. Jumps must
    // be removed before the referenced chain can be deleted. iptables -D/-F/-X are no-ops (non-zero
    // exit, ignored) when the rule/chain is already absent, which gives idempotent teardown.
    for (const char *tool : {"iptables", "ip6tables"}) {
        const bool isV6 = (std::strcmp(tool, "ip6tables") == 0);

        Utils::executeCommand(tool, {"-D", "INPUT", "-j", WS_PRODUCT_NAME_LOWER "_input", "-m", "comment", "--comment", kTag.c_str()});
        Utils::executeCommand(tool, {"-D", "OUTPUT", "-j", WS_PRODUCT_NAME_LOWER "_output", "-m", "comment", "--comment", kTag.c_str()});
        if (!isV6) {
            Utils::executeCommand(tool, {"-D", "INPUT", "-j", WS_PRODUCT_NAME_LOWER "_block", "-m", "comment", "--comment", kTag.c_str()});
            Utils::executeCommand(tool, {"-D", "OUTPUT", "-j", WS_PRODUCT_NAME_LOWER "_block", "-m", "comment", "--comment", kTag.c_str()});
        }

        Utils::executeCommand(tool, {"-F", WS_PRODUCT_NAME_LOWER "_input"});
        Utils::executeCommand(tool, {"-F", WS_PRODUCT_NAME_LOWER "_output"});
        Utils::executeCommand(tool, {"-X", WS_PRODUCT_NAME_LOWER "_input"});
        Utils::executeCommand(tool, {"-X", WS_PRODUCT_NAME_LOWER "_output"});
        if (!isV6) {
            Utils::executeCommand(tool, {"-F", WS_PRODUCT_NAME_LOWER "_block"});
            Utils::executeCommand(tool, {"-X", WS_PRODUCT_NAME_LOWER "_block"});
        }
    }

    std::error_code ec;
    std::filesystem::remove(WS_LINUX_RUN_DIR "/rules.v4", ec);
    if (ec) {
        spdlog::warn("Failed to remove rules.v4: {}", ec.message());
    }
    std::filesystem::remove(WS_LINUX_RUN_DIR "/rules.v6", ec);
    if (ec) {
        spdlog::warn("Failed to remove rules.v6: {}", ec.message());
    }

    // The -D/-F/-X commands above return non-zero for already-absent rules, so their exit codes
    // can't distinguish "nothing to do" from "teardown failed". Verify the post-state instead: if a
    // jump survived (e.g. xtables lock contention), report failure so firewallOff retries rather
    // than latching the baseline to "off" while the kill switch is still up.
    return !enabled();
}

void FirewallController::probeInterfaceAddresses(const std::string &iface, std::vector<std::string> &v4Addrs, bool &hasNonLinkLocalV6)
{