netfilter: xtables: compact table hook functions (2/2)
The calls to ip6t_do_table only show minimal differences, so it seems like a good cleanup to merge them to a single one too. Space saving obtained by both patches: 6807725->6807373 ("Total" column from `size -A`.) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
This commit is contained in:
parent
737535c5cf
commit
2b21e05147
|
@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *in, const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_ARP_OUT)
|
||||
return arpt_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv4.arptable_filter);
|
||||
const struct net *net = dev_net((in != NULL) ? in : out);
|
||||
|
||||
/* INPUT/FORWARD: */
|
||||
return arpt_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv4.arptable_filter);
|
||||
return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
|
||||
}
|
||||
|
||||
static struct nf_hook_ops arpt_ops[] __read_mostly = {
|
||||
|
|
|
@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *in, const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_INET_LOCAL_OUT) {
|
||||
if (skb->len < sizeof(struct iphdr) ||
|
||||
ip_hdrlen(skb) < sizeof(struct iphdr))
|
||||
/* root is playing with raw sockets. */
|
||||
return NF_ACCEPT;
|
||||
const struct net *net;
|
||||
|
||||
return ipt_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv4.iptable_filter);
|
||||
}
|
||||
if (hook == NF_INET_LOCAL_OUT &&
|
||||
(skb->len < sizeof(struct iphdr) ||
|
||||
ip_hdrlen(skb) < sizeof(struct iphdr)))
|
||||
/* root is playing with raw sockets. */
|
||||
return NF_ACCEPT;
|
||||
|
||||
/* LOCAL_IN/FORWARD: */
|
||||
return ipt_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv4.iptable_filter);
|
||||
net = dev_net((in != NULL) ? in : out);
|
||||
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
|
||||
}
|
||||
|
||||
static struct nf_hook_ops ipt_ops[] __read_mostly = {
|
||||
|
|
|
@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *in, const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_INET_PRE_ROUTING)
|
||||
return ipt_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv4.iptable_raw);
|
||||
const struct net *net;
|
||||
|
||||
/* OUTPUT: */
|
||||
/* root is playing with raw sockets. */
|
||||
if (skb->len < sizeof(struct iphdr) ||
|
||||
ip_hdrlen(skb) < sizeof(struct iphdr))
|
||||
if (hook == NF_INET_LOCAL_OUT &&
|
||||
(skb->len < sizeof(struct iphdr) ||
|
||||
ip_hdrlen(skb) < sizeof(struct iphdr)))
|
||||
/* root is playing with raw sockets. */
|
||||
return NF_ACCEPT;
|
||||
return ipt_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv4.iptable_raw);
|
||||
|
||||
net = dev_net((in != NULL) ? in : out);
|
||||
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
|
||||
}
|
||||
|
||||
/* 'raw' is the very first table. */
|
||||
|
|
|
@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_INET_LOCAL_OUT) {
|
||||
if (skb->len < sizeof(struct iphdr) ||
|
||||
ip_hdrlen(skb) < sizeof(struct iphdr))
|
||||
/* Somebody is playing with raw sockets. */
|
||||
return NF_ACCEPT;
|
||||
const struct net *net;
|
||||
|
||||
return ipt_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv4.iptable_security);
|
||||
}
|
||||
if (hook == NF_INET_LOCAL_OUT &&
|
||||
(skb->len < sizeof(struct iphdr) ||
|
||||
ip_hdrlen(skb) < sizeof(struct iphdr)))
|
||||
/* Somebody is playing with raw sockets. */
|
||||
return NF_ACCEPT;
|
||||
|
||||
/* INPUT/FORWARD: */
|
||||
return ipt_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv4.iptable_security);
|
||||
net = dev_net((in != NULL) ? in : out);
|
||||
return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
|
||||
}
|
||||
|
||||
static struct nf_hook_ops ipt_ops[] __read_mostly = {
|
||||
|
|
|
@ -64,13 +64,9 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *in, const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_INET_LOCAL_OUT)
|
||||
return ip6t_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv6.ip6table_filter);
|
||||
const struct net *net = dev_net((in != NULL) ? in : out);
|
||||
|
||||
/* INPUT/FORWARD: */
|
||||
return ip6t_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv6.ip6table_filter);
|
||||
return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
|
||||
}
|
||||
|
||||
static struct nf_hook_ops ip6t_ops[] __read_mostly = {
|
||||
|
|
|
@ -48,13 +48,9 @@ ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *in, const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_INET_PRE_ROUTING)
|
||||
return ip6t_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv6.ip6table_raw);
|
||||
const struct net *net = dev_net((in != NULL) ? in : out);
|
||||
|
||||
/* OUTPUT: */
|
||||
return ip6t_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv6.ip6table_raw);
|
||||
return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
|
||||
}
|
||||
|
||||
static struct nf_hook_ops ip6t_ops[] __read_mostly = {
|
||||
|
|
|
@ -69,13 +69,9 @@ ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
|
|||
const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *))
|
||||
{
|
||||
if (hook == NF_INET_LOCAL_OUT)
|
||||
return ip6t_do_table(skb, hook, in, out,
|
||||
dev_net(out)->ipv6.ip6table_security);
|
||||
const struct net *net = dev_net((in != NULL) ? in : out);
|
||||
|
||||
/* INPUT/FORWARD: */
|
||||
return ip6t_do_table(skb, hook, in, out,
|
||||
dev_net(in)->ipv6.ip6table_security);
|
||||
return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
|
||||
}
|
||||
|
||||
static struct nf_hook_ops ip6t_ops[] __read_mostly = {
|
||||
|
|
Loading…
Reference in a new issue