Commit 2b21e051 authored by Jan Engelhardt's avatar Jan Engelhardt

netfilter: xtables: compact table hook functions (2/2)

The calls to ip6t_do_table only show minimal differences, so it seems
like a good cleanup to merge them to a single one too.
Space saving obtained by both patches: 6807725->6807373
("Total" column from `size -A`.)
Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
parent 737535c5
...@@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb, ...@@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_ARP_OUT) const struct net *net = dev_net((in != NULL) ? in : out);
return arpt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.arptable_filter);
/* INPUT/FORWARD: */ return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
return arpt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.arptable_filter);
} }
static struct nf_hook_ops arpt_ops[] __read_mostly = { static struct nf_hook_ops arpt_ops[] __read_mostly = {
......
...@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb, ...@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_INET_LOCAL_OUT) { const struct net *net;
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)) if (hook == NF_INET_LOCAL_OUT &&
/* root is playing with raw sockets. */ (skb->len < sizeof(struct iphdr) ||
return NF_ACCEPT; ip_hdrlen(skb) < sizeof(struct iphdr)))
/* root is playing with raw sockets. */
return ipt_do_table(skb, hook, in, out, return NF_ACCEPT;
dev_net(out)->ipv4.iptable_filter);
}
/* LOCAL_IN/FORWARD: */ net = dev_net((in != NULL) ? in : out);
return ipt_do_table(skb, hook, in, out, return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
dev_net(in)->ipv4.iptable_filter);
} }
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
......
...@@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb, ...@@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_INET_PRE_ROUTING) const struct net *net;
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_raw); if (hook == NF_INET_LOCAL_OUT &&
(skb->len < sizeof(struct iphdr) ||
/* OUTPUT: */ ip_hdrlen(skb) < sizeof(struct iphdr)))
/* root is playing with raw sockets. */ /* root is playing with raw sockets. */
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT; return NF_ACCEPT;
return ipt_do_table(skb, hook, in, out,
dev_net(out)->ipv4.iptable_raw); net = dev_net((in != NULL) ? in : out);
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
} }
/* 'raw' is the very first table. */ /* 'raw' is the very first table. */
......
...@@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb, ...@@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *out, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_INET_LOCAL_OUT) { const struct net *net;
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)) if (hook == NF_INET_LOCAL_OUT &&
/* Somebody is playing with raw sockets. */ (skb->len < sizeof(struct iphdr) ||
return NF_ACCEPT; ip_hdrlen(skb) < sizeof(struct iphdr)))
/* Somebody is playing with raw sockets. */
return ipt_do_table(skb, hook, in, out, return NF_ACCEPT;
dev_net(out)->ipv4.iptable_security);
} net = dev_net((in != NULL) ? in : out);
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
/* INPUT/FORWARD: */
return ipt_do_table(skb, hook, in, out,
dev_net(in)->ipv4.iptable_security);
} }
static struct nf_hook_ops ipt_ops[] __read_mostly = { static struct nf_hook_ops ipt_ops[] __read_mostly = {
......
...@@ -64,13 +64,9 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb, ...@@ -64,13 +64,9 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_INET_LOCAL_OUT) const struct net *net = dev_net((in != NULL) ? in : out);
return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_filter);
/* INPUT/FORWARD: */ return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
return ip6t_do_table(skb, hook, in, out,
dev_net(in)->ipv6.ip6table_filter);
} }
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
......
...@@ -48,13 +48,9 @@ ip6table_raw_hook(unsigned int hook, struct sk_buff *skb, ...@@ -48,13 +48,9 @@ ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_INET_PRE_ROUTING) const struct net *net = dev_net((in != NULL) ? in : out);
return ip6t_do_table(skb, hook, in, out,
dev_net(in)->ipv6.ip6table_raw);
/* OUTPUT: */ return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_raw);
} }
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
......
...@@ -69,13 +69,9 @@ ip6table_security_hook(unsigned int hook, struct sk_buff *skb, ...@@ -69,13 +69,9 @@ ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
const struct net_device *out, const struct net_device *out,
int (*okfn)(struct sk_buff *)) int (*okfn)(struct sk_buff *))
{ {
if (hook == NF_INET_LOCAL_OUT) const struct net *net = dev_net((in != NULL) ? in : out);
return ip6t_do_table(skb, hook, in, out,
dev_net(out)->ipv6.ip6table_security);
/* INPUT/FORWARD: */ return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
return ip6t_do_table(skb, hook, in, out,
dev_net(in)->ipv6.ip6table_security);
} }
static struct nf_hook_ops ip6t_ops[] __read_mostly = { static struct nf_hook_ops ip6t_ops[] __read_mostly = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment