if (flags.firewall_rules.isSome()) {

vector<Owned<FirewallRule>> rules;

?

const Firewall firewall = flags.firewall_rules.get();

?

if (firewall.has_disabled_endpoints()) {

hashset<string> paths;

?

foreach (const string& path, firewall.disabled_endpoints().paths()) {

paths.insert(path);

}

?

rules.emplace_back(new DisabledEndpointsFirewallRule(paths));

}

?

process::firewall::install(move(rules));

}

// Don‘t use a const reference, since it cannot be guaranteed

// that the rules don‘t keep an internal state.

foreach (Owned<firewall::FirewallRule>& rule, firewallRules) {

Option<Response> rejection = rule->apply(socket, *request);

if (rejection.isSome()) {

VLOG(1) << "Returning ‘"<< rejection.get().status << "‘ for ‘"

<< request->url.path << "‘ (firewall rule forbids request)";

?

// TODO(arojas): Get rid of the duplicated code to return an

// error.

?

// Get the HttpProxy pid for this socket.

PID<HttpProxy> proxy = socket_manager->proxy(socket);

?

// Enqueue the response with the HttpProxy so that it respects

// the order of requests to account for HTTP/1.1 pipelining.

dispatch(

proxy,

&HttpProxy::enqueue,

rejection.get(),

*request);

?

// Cleanup request.

delete request;

return;

}

}

}