netfilter: xtables: compact table hook functions (2/2)

The calls to ip6t_do_table only show minimal differences, so it seems
like a good cleanup to merge them to a single one too.
Space saving obtained by both patches: 6807725->6807373
("Total" column from `size -A`.)

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index e9d823b149cd5bbe47f76a263cf6cf444004fdf9..deeda9b2cf050b3457499fa20244d46ea08693ee 100644 (file)
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
                     const struct net_device *in, const struct net_device *out,
                     int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_ARP_OUT)
-               return arpt_do_table(skb, hook, in, out,
-                                    dev_net(out)->ipv4.arptable_filter);
+       const struct net *net = dev_net((in != NULL) ? in : out);
 
-       /* INPUT/FORWARD: */
-       return arpt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.arptable_filter);
+       return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {

diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 5369833ad56acb9589119d77bb9efac8eeb5c7d7..1bfeaae6f62473c340c934239bae13402c8b8117 100644 (file)
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
                    const struct net_device *in, const struct net_device *out,
                    int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_INET_LOCAL_OUT) {
-               if (skb->len < sizeof(struct iphdr) ||
-                   ip_hdrlen(skb) < sizeof(struct iphdr))
-                       /* root is playing with raw sockets. */
-                       return NF_ACCEPT;
-
-               return ipt_do_table(skb, hook, in, out,
-                                   dev_net(out)->ipv4.iptable_filter);
-       }
+       const struct net *net;
+
+       if (hook == NF_INET_LOCAL_OUT &&
+           (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr)))
+               /* root is playing with raw sockets. */
+               return NF_ACCEPT;
 
-       /* LOCAL_IN/FORWARD: */
-       return ipt_do_table(skb, hook, in, out,
-                           dev_net(in)->ipv4.iptable_filter);
+       net = dev_net((in != NULL) ? in : out);
+       return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {

diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 2c55575e89f5447619f8d648cceba6d7a9a13d5f..d16e43777c310e6c8caafb5d43dbd7abb65afb7e 100644 (file)
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
                 const struct net_device *in, const struct net_device *out,
                 int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_INET_PRE_ROUTING)
-               return ipt_do_table(skb, hook, in, out,
-                                   dev_net(in)->ipv4.iptable_raw);
-
-       /* OUTPUT: */
-       /* root is playing with raw sockets. */
-       if (skb->len < sizeof(struct iphdr) ||
-           ip_hdrlen(skb) < sizeof(struct iphdr))
+       const struct net *net;
+
+       if (hook == NF_INET_LOCAL_OUT && 
+           (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr)))
+               /* root is playing with raw sockets. */
                return NF_ACCEPT;
-       return ipt_do_table(skb, hook, in, out,
-                           dev_net(out)->ipv4.iptable_raw);
+
+       net = dev_net((in != NULL) ? in : out);
+       return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
 }
 
 /* 'raw' is the very first table. */

diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 1c666bab3269e667c6cb04a23ebd79dea816c6be..324505aaaa731a88c059e1bea5e84aaaa491fb0a 100644 (file)
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb,
                      const struct net_device *out,
                      int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_INET_LOCAL_OUT) {
-               if (skb->len < sizeof(struct iphdr) ||
-                   ip_hdrlen(skb) < sizeof(struct iphdr))
-                       /* Somebody is playing with raw sockets. */
-                       return NF_ACCEPT;
-
-               return ipt_do_table(skb, hook, in, out,
-                                   dev_net(out)->ipv4.iptable_security);
-       }
-
-       /* INPUT/FORWARD: */
-       return ipt_do_table(skb, hook, in, out,
-                           dev_net(in)->ipv4.iptable_security);
+       const struct net *net;
+
+       if (hook == NF_INET_LOCAL_OUT &&
+           (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr)))
+               /* Somebody is playing with raw sockets. */
+               return NF_ACCEPT;
+
+       net = dev_net((in != NULL) ? in : out);
+       return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {

diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 38074e933f67fadbd4e15d477d93f6f7ca00e6f7..866f34ae236b3bf00b9a7f7558fdda44750b976f 100644 (file)
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -64,13 +64,9 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
                     const struct net_device *in, const struct net_device *out,
                     int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_INET_LOCAL_OUT)
-               return ip6t_do_table(skb, hook, in, out,
-                                    dev_net(out)->ipv6.ip6table_filter);
+       const struct net *net = dev_net((in != NULL) ? in : out);
 
-       /* INPUT/FORWARD: */
-       return ip6t_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv6.ip6table_filter);
+       return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {

diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 985e27cf1e0c02d0924cbe34c20eb99fc25b0d4c..5451a36fbc210b18c0f64fdd81fce55532e1fdfb 100644 (file)
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -48,13 +48,9 @@ ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
                  const struct net_device *in, const struct net_device *out,
                  int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_INET_PRE_ROUTING)
-               return ip6t_do_table(skb, hook, in, out,
-                                    dev_net(in)->ipv6.ip6table_raw);
+       const struct net *net = dev_net((in != NULL) ? in : out);
 
-       /* OUTPUT: */
-       return ip6t_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv6.ip6table_raw);
+       return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {

diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 835858929358f0ba86bb5341e0f380e4429d9545..841ea77f521814d993220e53038caa3c8fa985af 100644 (file)
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -69,13 +69,9 @@ ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
                       const struct net_device *out,
                       int (*okfn)(struct sk_buff *))
 {
-       if (hook == NF_INET_LOCAL_OUT)
-               return ip6t_do_table(skb, hook, in, out,
-                                    dev_net(out)->ipv6.ip6table_security);
+       const struct net *net = dev_net((in != NULL) ? in : out);
 
-       /* INPUT/FORWARD: */
-       return ip6t_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv6.ip6table_security);
+       return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {