Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b21e051 authored by Jan Engelhardt's avatar Jan Engelhardt
Browse files

netfilter: xtables: compact table hook functions (2/2) 



The calls to ip6t_do_table only show minimal differences, so it seems
like a good cleanup to merge them to a single one too.
Space saving obtained by both patches: 6807725->6807373
("Total" column from `size -A`.)

Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
parent 737535c5

net/ipv4/netfilter/arptable_filter.c

+2 −6
Original line number Diff line number Diff line
@@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb, 
		     const struct net_device *in, const struct net_device *out,

		     int (*okfn)(struct sk_buff *))

{

	if (hook == NF_ARP_OUT)

		return arpt_do_table(skb, hook, in, out,

				     dev_net(out)->ipv4.arptable_filter);

	const struct net *net = dev_net((in != NULL) ? in : out);



	/* INPUT/FORWARD: */

	return arpt_do_table(skb, hook, in, out,

			     dev_net(in)->ipv4.arptable_filter);

	return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);

}



static struct nf_hook_ops arpt_ops[] __read_mostly = {

net/ipv4/netfilter/iptable_filter.c

+9 −12
Original line number Diff line number Diff line
@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb, 
		    const struct net_device *in, const struct net_device *out,

		    int (*okfn)(struct sk_buff *))

{

	if (hook == NF_INET_LOCAL_OUT) {

		if (skb->len < sizeof(struct iphdr) ||

		    ip_hdrlen(skb) < sizeof(struct iphdr))

	const struct net *net;



	if (hook == NF_INET_LOCAL_OUT &&

	    (skb->len < sizeof(struct iphdr) ||

	     ip_hdrlen(skb) < sizeof(struct iphdr)))

		/* root is playing with raw sockets. */

		return NF_ACCEPT;



		return ipt_do_table(skb, hook, in, out,

				    dev_net(out)->ipv4.iptable_filter);

	}



	/* LOCAL_IN/FORWARD: */

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_filter);

	net = dev_net((in != NULL) ? in : out);

	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);

}



static struct nf_hook_ops ipt_ops[] __read_mostly = {

net/ipv4/netfilter/iptable_raw.c

+9 −10
Original line number Diff line number Diff line
@@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb, 
		 const struct net_device *in, const struct net_device *out,

		 int (*okfn)(struct sk_buff *))

{

	if (hook == NF_INET_PRE_ROUTING)

		return ipt_do_table(skb, hook, in, out,

				    dev_net(in)->ipv4.iptable_raw);

	const struct net *net;



	/* OUTPUT: */

	if (hook == NF_INET_LOCAL_OUT && 

	    (skb->len < sizeof(struct iphdr) ||

	     ip_hdrlen(skb) < sizeof(struct iphdr)))

		/* root is playing with raw sockets. */

	if (skb->len < sizeof(struct iphdr) ||

	    ip_hdrlen(skb) < sizeof(struct iphdr))

		return NF_ACCEPT;

	return ipt_do_table(skb, hook, in, out,

			    dev_net(out)->ipv4.iptable_raw);



	net = dev_net((in != NULL) ? in : out);

	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);

}



/* 'raw' is the very first table. */

net/ipv4/netfilter/iptable_security.c

+10 −13
Original line number Diff line number Diff line
@@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb, 
		      const struct net_device *out,

		      int (*okfn)(struct sk_buff *))

{

	if (hook == NF_INET_LOCAL_OUT) {

		if (skb->len < sizeof(struct iphdr) ||

		    ip_hdrlen(skb) < sizeof(struct iphdr))

	const struct net *net;



	if (hook == NF_INET_LOCAL_OUT &&

	    (skb->len < sizeof(struct iphdr) ||

	     ip_hdrlen(skb) < sizeof(struct iphdr)))

		/* Somebody is playing with raw sockets. */

		return NF_ACCEPT;



		return ipt_do_table(skb, hook, in, out,

				    dev_net(out)->ipv4.iptable_security);

	}



	/* INPUT/FORWARD: */

	return ipt_do_table(skb, hook, in, out,

			    dev_net(in)->ipv4.iptable_security);

	net = dev_net((in != NULL) ? in : out);

	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);

}



static struct nf_hook_ops ipt_ops[] __read_mostly = {

net/ipv6/netfilter/ip6table_filter.c

+2 −6
Original line number Diff line number Diff line
@@ -64,13 +64,9 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb, 
		     const struct net_device *in, const struct net_device *out,

		     int (*okfn)(struct sk_buff *))

{

	if (hook == NF_INET_LOCAL_OUT)

		return ip6t_do_table(skb, hook, in, out,

				     dev_net(out)->ipv6.ip6table_filter);

	const struct net *net = dev_net((in != NULL) ? in : out);



	/* INPUT/FORWARD: */

	return ip6t_do_table(skb, hook, in, out,

			     dev_net(in)->ipv6.ip6table_filter);

	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);

}



static struct nf_hook_ops ip6t_ops[] __read_mostly = {