code: func iptablesRunOutput(af seesaw.AF, argsStr string) (string, error) {
  	var cmd string
  	switch af {
  	case seesaw.IPv4:
  		cmd = ipt4Cmd
  	case seesaw.IPv6:
  		cmd = ipt6Cmd
  	default:
  		return "", fmt.Errorf("iptablesRunOutput: Unsupported address family: %v", af)
  	}
  
  	var out []byte
  	var err error
  	log.Infof("%s %s", cmd, argsStr)
  	args := strings.Split(argsStr, " ")
  	failed := false
  	for tries := 1; !failed && tries <= iptMaxTries; tries++ {
  		proc := exec.Command(cmd, args...)
  		iptMutex.Lock()
  		out, err = proc.Output()
  		iptMutex.Unlock()
  		if err == nil {
  			break
  		}
  		// If someone else is running iptables, our command will fail with a
  		// resource error, so retry. Also retry if we can't determine the exit
  		// status at all.
  		switch status := proc.ProcessState.Sys().(type) {
  		case syscall.WaitStatus:
  			if status.ExitStatus() != iptResourceError {
  				failed = true
  			}
  		}
  		log.Infof("'%s %s' try %d of %d failed: %v (%v)", cmd, argsStr, tries, iptMaxTries, err, out)
  	}
  	if err != nil {
  		msg := fmt.Sprintf("iptablesRunOutput: '%s %s': %v", cmd, argsStr, err)
  		log.Infof(msg)
  		return "", fmt.Errorf(msg)
  	}
  	return string(out), nil
  }
docs: // iptablesRunOutput runs the Linux ip(6?)tables command with the specified
  // arguments and returns the output.