Fix Pepper socket API to open incoming ports in the firewall.

content/browser/renderer_host/pepper/pepper_socket_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/pepper/pepper_socket_utils.h"
 
 #include <string>
 #include <vector>
 
 #include "base/logging.h"
@@ skipping 138 matching lines @@
 bool IsLoopbackAddress(const net::IPAddress& address) {
   if (address.IsIPv4()) {
     return net::IPAddressStartsWith(address, kIPv4LocalhostPrefix);
   } else if (address.IsIPv6()) {
     // ::1 is the only loopback address in ipv6.
     return address == net::IPAddress::IPv6Localhost();
   }
   return false;
 }
 
-std::string AddressToFirewallString(const net::IPAddress& address) {
-  if (address.IsZero() || address.empty()) {
-    return std::string();
-  }
-
-  return address.ToString();
-}
-
 }  // namespace
 
 void OpenFirewallHole(const net::IPEndPoint& address,
                       chromeos::FirewallHole::PortType type,
                       FirewallHoleOpenCallback callback) {
   if (IsLoopbackAddress(address.address())) {
     callback.Run(nullptr);
     return;
   }
-  std::string address_string = AddressToFirewallString(address.address());
 
-  chromeos::FirewallHole::Open(type, address.port(), address_string, callback);
+  // TODO(sergeyu): Currently an empty string is passed as interface name, which
+  // means the port will be opened on all network interfaces. Interface name
+  // can be resolved by the address, but the best solution would be to update
+  // firewalld to allow filtering by destination address, not just destination
+  // port. iptables already support it.
+  chromeos::FirewallHole::Open(type, address.port(), std::string(), callback);

[avallee, 2017/01/23 19:28:23]

Might be a bit of plumbing to have both interface or address strings all the way
to firewalld but that would be ideal. The other thing I had considered was
looking up which interface had that address, but that might not be available
here or even a 1-1 mapping.

 }
 
 void OpenTCPFirewallHole(const net::IPEndPoint& address,
                          FirewallHoleOpenCallback callback) {
   OpenFirewallHole(address, chromeos::FirewallHole::PortType::TCP, callback);
 }
 
 void OpenUDPFirewallHole(const net::IPEndPoint& address,
                          FirewallHoleOpenCallback callback) {
   OpenFirewallHole(address, chromeos::FirewallHole::PortType::UDP, callback);
 }
 #endif  // defined(OS_CHROMEOS)
 
 }  // namespace pepper_socket_utils
 }  // namespace content