diff -pur a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c --- a/iptables/ip6tables-save.c 2018-01-08 23:54:07.533731455 +0100 +++ b/iptables/ip6tables-save.c 2018-01-09 10:05:49.400426400 +0100 @@ -3,6 +3,9 @@ * Original code: iptables-save * Authors: Paul 'Rusty' Russel and * Harald Welte + * Contributor: + * (C) 2018 by Alban Vidal + * * This code is distributed under the terms of GNU GPL v2 */ #include @@ -20,9 +23,50 @@ static int show_counters = 0; +/* if = 1 (opt -z): Reset to zero counters of the chains */ +static int rst_chain_counters = 0; + +/* Summary help usage */ +static void print_help_usage() { + printf( + "ip6tables-save version %s\n" + "iptables-save and ip6tables-save are used to dump the contents of IP or " + "IPv6 Table in easily parseable format to STDOUT. Use I/O-redirection " + "provided by your shell to write to a file.\n" + "\n" + "Usage: iptables-save [-h] [-M modprobe] [-c] [-z] [-t table]\n" + " ip6tables-save [-h] [-M modprobe] [-c] [-z] [-t table]\n" + "\n" + "Options:\n" + "Either long or short options are allowed.\n" + "\n" + " -h, --help\n" + " Print this help usage.\n" + "\n" + " -M, --modprobe modprobe_program\n" + " Specify the path to the modprobe program. By default, iptables-save " + "will inspect /proc/sys/kernel/mod‐probe to determine the executable's path.\n" + "\n" + " -c, --counters\n" + " Include the current values of all packet and byte counters in the output.\n" + "\n" + " -z, --zero\n" + " Reset to zero counters of the chains.\n" + "\n" + " -t, --table tablename\n" + " Restrict output to only one table. If not specified, output includes " + "all available tables.\n" + , IPTABLES_VERSION + ); + + exit(0); +} + static const struct option options[] = { + {.name = "help", .has_arg = false, .val = 'h'}, {.name = "counters", .has_arg = false, .val = 'c'}, {.name = "dump", .has_arg = false, .val = 'd'}, + {.name = "zero", .has_arg = false, .val = 'z'}, {.name = "table", .has_arg = true, .val = 't'}, {.name = "modprobe", .has_arg = true, .val = 'M'}, {NULL}, @@ -94,7 +138,10 @@ static int do_output(const char *tablena struct xt_counters count; printf("%s ", ip6tc_get_policy(chain, &count, h)); - printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); + if (rst_chain_counters > 0) + printf("[0:0]\n"); // reset to zero counters of the chains + else + printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); } else { printf("- [0:0]\n"); } @@ -143,7 +190,7 @@ int ip6tables_save_main(int argc, char * init_extensions6(); #endif - while ((c = getopt_long(argc, argv, "bcdt:M:", options, NULL)) != -1) { + while ((c = getopt_long(argc, argv, "bhcdzt:M:", options, NULL)) != -1) { switch (c) { case 'b': fprintf(stderr, "-b/--binary option is not implemented\n"); @@ -156,9 +203,15 @@ int ip6tables_save_main(int argc, char * /* Select specific table. */ tablename = optarg; break; + case 'h': + print_help_usage(); + break; case 'M': xtables_modprobe_program = optarg; break; + case 'z': + rst_chain_counters = 1; + break; case 'd': do_output(tablename); exit(0); diff -pur a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in --- a/iptables/iptables-save.8.in 2018-01-08 18:18:51.577704097 +0100 +++ b/iptables/iptables-save.8.in 2018-01-09 00:15:18.243853517 +0100 @@ -23,11 +23,11 @@ iptables-save \(em dump iptables rules t .P ip6tables-save \(em dump iptables rules to stdout .SH SYNOPSIS -\fBiptables\-save\fP [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP] -[\fB\-t\fP \fItable\fP] +\fBiptables\-save\fP [\fB\-h\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP] +[\fB\-z\fP] [\fB\-t\fP \fItable\fP] .P -\fBip6tables\-save\fP [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP] -[\fB\-t\fP \fItable\fP] +\fBip6tables\-save\fP [\fB\-h\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP] +[\fB\-z\fP] [\fB\-t\fP \fItable\fP] .SH DESCRIPTION .PP .B iptables-save @@ -36,15 +36,21 @@ and are used to dump the contents of IP or IPv6 Table in easily parseable format to STDOUT. Use I/O-redirection provided by your shell to write to a file. .TP +\fB\-h\fR, \fB\-\-help\fR +Print help usage. +.TP \fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP Specify the path to the modprobe program. By default, iptables-save will inspect /proc/sys/kernel/modprobe to determine the executable's path. .TP \fB\-c\fR, \fB\-\-counters\fR -include the current values of all packet and byte counters in the output +Include the current values of all packet and byte counters in the output. +.TP +\fB\-z\fR, \fB\-\-zero\fR +Reset to zero counters of the chains. .TP \fB\-t\fR, \fB\-\-table\fR \fItablename\fP -restrict output to only one table. If not specified, output includes all +Restrict output to only one table. If not specified, output includes all available tables. .SH BUGS None known as of iptables-1.2.1 release diff -pur a/iptables/iptables-save.c b/iptables/iptables-save.c --- a/iptables/iptables-save.c 2018-01-08 17:55:19.448372915 +0100 +++ b/iptables/iptables-save.c 2018-01-09 10:07:25.984902948 +0100 @@ -1,6 +1,8 @@ /* Code to save the iptables state, in human readable-form. */ /* (C) 1999 by Paul 'Rusty' Russell and * (C) 2000-2002 by Harald Welte + * Contributor: + * (C) 2018 by Alban Vidal * * This code is distributed under the terms of GNU GPL v2 * @@ -19,9 +21,50 @@ static int show_counters = 0; +/* if = 1 (opt -z): Reset to zero counters of the chains */ +static int rst_chain_counters = 0; + +/* Summary help usage */ +static void print_help_usage() { + printf( + "iptables-save version %s\n" + "iptables-save and ip6tables-save are used to dump the contents of IP or " + "IPv6 Table in easily parseable format to STDOUT. Use I/O-redirection " + "provided by your shell to write to a file.\n" + "\n" + "Usage: iptables-save [-h] [-M modprobe] [-c] [-z] [-t table]\n" + " ip6tables-save [-h] [-M modprobe] [-c] [-z] [-t table]\n" + "\n" + "Options:\n" + "Either long or short options are allowed.\n" + "\n" + " -h, --help\n" + " Print this help usage.\n" + "\n" + " -M, --modprobe modprobe_program\n" + " Specify the path to the modprobe program. By default, iptables-save " + "will inspect /proc/sys/kernel/mod‐probe to determine the executable's path.\n" + "\n" + " -c, --counters\n" + " Include the current values of all packet and byte counters in the output.\n" + "\n" + " -z, --zero\n" + " Reset to zero counters of the chains.\n" + "\n" + " -t, --table tablename\n" + " Restrict output to only one table. If not specified, output includes " + "all available tables.\n" + , IPTABLES_VERSION + ); + + exit(0); +} + static const struct option options[] = { + {.name = "help", .has_arg = false, .val = 'h'}, {.name = "counters", .has_arg = false, .val = 'c'}, {.name = "dump", .has_arg = false, .val = 'd'}, + {.name = "zero", .has_arg = false, .val = 'z'}, {.name = "table", .has_arg = true, .val = 't'}, {.name = "modprobe", .has_arg = true, .val = 'M'}, {NULL}, @@ -92,7 +135,10 @@ static int do_output(const char *tablena struct xt_counters count; printf("%s ", iptc_get_policy(chain, &count, h)); - printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); + if (rst_chain_counters > 0) + printf("[0:0]\n"); // reset to zero counters of the chains + else + printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); } else { printf("- [0:0]\n"); } @@ -142,7 +188,7 @@ iptables_save_main(int argc, char *argv[ init_extensions4(); #endif - while ((c = getopt_long(argc, argv, "bcdt:M:", options, NULL)) != -1) { + while ((c = getopt_long(argc, argv, "bhcdzt:M:", options, NULL)) != -1) { switch (c) { case 'b': fprintf(stderr, "-b/--binary option is not implemented\n"); @@ -155,9 +201,15 @@ iptables_save_main(int argc, char *argv[ /* Select specific table. */ tablename = optarg; break; + case 'h': + print_help_usage(); + break; case 'M': xtables_modprobe_program = optarg; break; + case 'z': + rst_chain_counters = 1; + break; case 'd': do_output(tablename); exit(0);