Patchwork iptables-save: fix don't show counters by default

login
register
mail settings
Submitter Nicolas CARRIER
Date May 10, 2012, 9:40 a.m.
Message ID <4FAB8D11.4040704@parrot.com>
Download mbox | patch
Permalink /patch/158233/
State Rejected
Headers show

Comments

Nicolas CARRIER - May 10, 2012, 9:40 a.m.
When one issue an iptables-save command, counters are always shown in front of policies, which doesn't seem to be the desired result.
The attached patch tries to fix this. It uses the global show_counters flag to decide if counters will be shown.
Pablo Neira - May 14, 2012, 8:39 a.m.
Hi Nicolas,

On Thu, May 10, 2012 at 11:40:33AM +0200, Nicolas CARRIER wrote:
> When one issue an iptables-save command, counters are always shown in front of policies, which doesn't seem to be the desired result.
> The attached patch tries to fix this. It uses the global show_counters flag to decide if counters will be shown.

This changes the behaviour of default iptables-save (that has been to
include the global counters by default for years).

I don't want to break backward compatibility. People expect to get
them without the -c option.

> -- 
> Nicolas CARRIER - Parrot France - Software Engineer

> From 8ccc08a6b0fde5544145f6831b7f80d1bf8bbdf0 Mon Sep 17 00:00:00 2001
> From: Nicolas CARRIER <nicolas.carrier.ext@parrot.com>
> Date: Thu, 10 May 2012 11:25:53 +0200
> Subject: [PATCH] iptables-save: fix don't show counters by default
> 
> ---
>  iptables/ip6tables-save.c |    9 ++++++---
>  iptables/iptables-save.c  |    9 ++++++---
>  2 files changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
> index d819b30..4e7e4e8 100644
> --- a/iptables/ip6tables-save.c
> +++ b/iptables/ip6tables-save.c
> @@ -90,11 +90,14 @@ static int do_output(const char *tablename)
>  		printf(":%s ", chain);
>  		if (ip6tc_builtin(chain, h)) {
>  			struct xt_counters count;
> -			printf("%s ",
> +			printf("%s",
>  			       ip6tc_get_policy(chain, &count, h));
> -			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			if (show_counters)
> +				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			else
> +				printf("\n");
>  		} else {
> -			printf("- [0:0]\n");
> +			printf("-%s\n", show_counters ? " [0:0]" : "");
>  		}
>  	}
>  
> diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
> index e599fce..6322c51 100644
> --- a/iptables/iptables-save.c
> +++ b/iptables/iptables-save.c
> @@ -88,11 +88,14 @@ static int do_output(const char *tablename)
>  		printf(":%s ", chain);
>  		if (iptc_builtin(chain, h)) {
>  			struct xt_counters count;
> -			printf("%s ",
> +			printf("%s",
>  			       iptc_get_policy(chain, &count, h));
> -			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			if (show_counters)
> +				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			else
> +				printf("\n");
>  		} else {
> -			printf("- [0:0]\n");
> +			printf("-%s\n", show_counters ? " [0:0]" : "");
>  		}
>  	}
>  
> -- 
> 1.7.10
> 

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

From 8ccc08a6b0fde5544145f6831b7f80d1bf8bbdf0 Mon Sep 17 00:00:00 2001
From: Nicolas CARRIER <nicolas.carrier.ext@parrot.com>
Date: Thu, 10 May 2012 11:25:53 +0200
Subject: [PATCH] iptables-save: fix don't show counters by default

---
 iptables/ip6tables-save.c |    9 ++++++---
 iptables/iptables-save.c  |    9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
index d819b30..4e7e4e8 100644
--- a/iptables/ip6tables-save.c
+++ b/iptables/ip6tables-save.c
@@ -90,11 +90,14 @@  static int do_output(const char *tablename)
 		printf(":%s ", chain);
 		if (ip6tc_builtin(chain, h)) {
 			struct xt_counters count;
-			printf("%s ",
+			printf("%s",
 			       ip6tc_get_policy(chain, &count, h));
-			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			if (show_counters)
+				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			else
+				printf("\n");
 		} else {
-			printf("- [0:0]\n");
+			printf("-%s\n", show_counters ? " [0:0]" : "");
 		}
 	}
 
diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
index e599fce..6322c51 100644
--- a/iptables/iptables-save.c
+++ b/iptables/iptables-save.c
@@ -88,11 +88,14 @@  static int do_output(const char *tablename)
 		printf(":%s ", chain);
 		if (iptc_builtin(chain, h)) {
 			struct xt_counters count;
-			printf("%s ",
+			printf("%s",
 			       iptc_get_policy(chain, &count, h));
-			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			if (show_counters)
+				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			else
+				printf("\n");
 		} else {
-			printf("- [0:0]\n");
+			printf("-%s\n", show_counters ? " [0:0]" : "");
 		}
 	}
 
-- 
1.7.10