[PATCH]iptables-save: fix don't show counters by default

[PATCH]iptables-save: fix don't show counters by default

[Nicolas CARRIER]

[-- Attachment #1: Type: text/plain, Size: 304 bytes --]

When one issue an iptables-save command, counters are always shown in front of policies, which doesn't seem to be the desired result.
The attached patch tries to fix this. It uses the global show_counters flag to decide if counters will be shown.

-- 
Nicolas CARRIER - Parrot France - Software Engineer

[-- Attachment #2: 0001-iptables-save-fix-don-t-show-counters-by-default.patch --]
[-- Type: text/x-diff, Size: 1857 bytes --]

>From 8ccc08a6b0fde5544145f6831b7f80d1bf8bbdf0 Mon Sep 17 00:00:00 2001
From: Nicolas CARRIER <nicolas.carrier.ext@parrot.com>
Date: Thu, 10 May 2012 11:25:53 +0200
Subject: [PATCH] iptables-save: fix don't show counters by default

---
 iptables/ip6tables-save.c |    9 ++++++---
 iptables/iptables-save.c  |    9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
index d819b30..4e7e4e8 100644
--- a/iptables/ip6tables-save.c
+++ b/iptables/ip6tables-save.c
@@ -90,11 +90,14 @@ static int do_output(const char *tablename)
 		printf(":%s ", chain);
 		if (ip6tc_builtin(chain, h)) {
 			struct xt_counters count;
-			printf("%s ",
+			printf("%s",
 			       ip6tc_get_policy(chain, &count, h));
-			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			if (show_counters)
+				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			else
+				printf("\n");
 		} else {
-			printf("- [0:0]\n");
+			printf("-%s\n", show_counters ? " [0:0]" : "");
 		}
 	}
 
diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
index e599fce..6322c51 100644
--- a/iptables/iptables-save.c
+++ b/iptables/iptables-save.c
@@ -88,11 +88,14 @@ static int do_output(const char *tablename)
 		printf(":%s ", chain);
 		if (iptc_builtin(chain, h)) {
 			struct xt_counters count;
-			printf("%s ",
+			printf("%s",
 			       iptc_get_policy(chain, &count, h));
-			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			if (show_counters)
+				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
+			else
+				printf("\n");
 		} else {
-			printf("- [0:0]\n");
+			printf("-%s\n", show_counters ? " [0:0]" : "");
 		}
 	}
 
-- 
1.7.10

Re: [PATCH]iptables-save: fix don't show counters by default

[Pablo Neira Ayuso]

Hi Nicolas,

On Thu, May 10, 2012 at 11:40:33AM +0200, Nicolas CARRIER wrote:
> When one issue an iptables-save command, counters are always shown in front of policies, which doesn't seem to be the desired result.
> The attached patch tries to fix this. It uses the global show_counters flag to decide if counters will be shown.

This changes the behaviour of default iptables-save (that has been to
include the global counters by default for years).

I don't want to break backward compatibility. People expect to get
them without the -c option.

> -- 
> Nicolas CARRIER - Parrot France - Software Engineer

> From 8ccc08a6b0fde5544145f6831b7f80d1bf8bbdf0 Mon Sep 17 00:00:00 2001
> From: Nicolas CARRIER <nicolas.carrier.ext@parrot.com>
> Date: Thu, 10 May 2012 11:25:53 +0200
> Subject: [PATCH] iptables-save: fix don't show counters by default
> 
> ---
>  iptables/ip6tables-save.c |    9 ++++++---
>  iptables/iptables-save.c  |    9 ++++++---
>  2 files changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
> index d819b30..4e7e4e8 100644
> --- a/iptables/ip6tables-save.c
> +++ b/iptables/ip6tables-save.c
> @@ -90,11 +90,14 @@ static int do_output(const char *tablename)
>  		printf(":%s ", chain);
>  		if (ip6tc_builtin(chain, h)) {
>  			struct xt_counters count;
> -			printf("%s ",
> +			printf("%s",
>  			       ip6tc_get_policy(chain, &count, h));
> -			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			if (show_counters)
> +				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			else
> +				printf("\n");
>  		} else {
> -			printf("- [0:0]\n");
> +			printf("-%s\n", show_counters ? " [0:0]" : "");
>  		}
>  	}
>  
> diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
> index e599fce..6322c51 100644
> --- a/iptables/iptables-save.c
> +++ b/iptables/iptables-save.c
> @@ -88,11 +88,14 @@ static int do_output(const char *tablename)
>  		printf(":%s ", chain);
>  		if (iptc_builtin(chain, h)) {
>  			struct xt_counters count;
> -			printf("%s ",
> +			printf("%s",
>  			       iptc_get_policy(chain, &count, h));
> -			printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			if (show_counters)
> +				printf(" [%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
> +			else
> +				printf("\n");
>  		} else {
> -			printf("- [0:0]\n");
> +			printf("-%s\n", show_counters ? " [0:0]" : "");
>  		}
>  	}
>  
> -- 
> 1.7.10
>