netfilter: xtables: compact table hook functions (2/2)

The calls to ip6t_do_table only show minimal differences, so it seems
like a good cleanup to merge them to a single one too.
Space saving obtained by both patches: 6807725->6807373
("Total" column from `size -A`.)

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

net/ipv4/netfilter/arptable_filter.c

@@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
 		     const struct net_device *in, const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_ARP_OUT)
+	const struct net *net = dev_net((in != NULL) ? in : out);
-		return arpt_do_table(skb, hook, in, out,
-				     dev_net(out)->ipv4.arptable_filter);
 
-	/* INPUT/FORWARD: */
+	return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
-	return arpt_do_table(skb, hook, in, out,
-			     dev_net(in)->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {

net/ipv4/netfilter/iptable_filter.c

@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
 		    const struct net_device *in, const struct net_device *out,
 		    int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_INET_LOCAL_OUT) {
+	const struct net *net;
-		if (skb->len < sizeof(struct iphdr) ||
-		    ip_hdrlen(skb) < sizeof(struct iphdr))
-			/* root is playing with raw sockets. */
-			return NF_ACCEPT;
 
-		return ipt_do_table(skb, hook, in, out,
+	if (hook == NF_INET_LOCAL_OUT &&
-				    dev_net(out)->ipv4.iptable_filter);
+	    (skb->len < sizeof(struct iphdr) ||
-	}
+	     ip_hdrlen(skb) < sizeof(struct iphdr)))
+		/* root is playing with raw sockets. */
+		return NF_ACCEPT;
 
-	/* LOCAL_IN/FORWARD: */
+	net = dev_net((in != NULL) ? in : out);
-	return ipt_do_table(skb, hook, in, out,
+	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
-			    dev_net(in)->ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {

net/ipv4/netfilter/iptable_raw.c

@@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
 		 const struct net_device *in, const struct net_device *out,
 		 int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_INET_PRE_ROUTING)
+	const struct net *net;
-		return ipt_do_table(skb, hook, in, out,
-				    dev_net(in)->ipv4.iptable_raw);
 
-	/* OUTPUT: */
+	if (hook == NF_INET_LOCAL_OUT && 
-	/* root is playing with raw sockets. */
+	    (skb->len < sizeof(struct iphdr) ||
-	if (skb->len < sizeof(struct iphdr) ||
+	     ip_hdrlen(skb) < sizeof(struct iphdr)))
-	    ip_hdrlen(skb) < sizeof(struct iphdr))
+		/* root is playing with raw sockets. */
 		return NF_ACCEPT;
-	return ipt_do_table(skb, hook, in, out,
+
-			    dev_net(out)->ipv4.iptable_raw);
+	net = dev_net((in != NULL) ? in : out);
+	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
 }
 
 /* 'raw' is the very first table. */

net/ipv4/netfilter/iptable_security.c

@@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb,
 		      const struct net_device *out,
 		      int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_INET_LOCAL_OUT) {
+	const struct net *net;
-		if (skb->len < sizeof(struct iphdr) ||
-		    ip_hdrlen(skb) < sizeof(struct iphdr))
-			/* Somebody is playing with raw sockets. */
-			return NF_ACCEPT;
 
-		return ipt_do_table(skb, hook, in, out,
+	if (hook == NF_INET_LOCAL_OUT &&
-				    dev_net(out)->ipv4.iptable_security);
+	    (skb->len < sizeof(struct iphdr) ||
-	}
+	     ip_hdrlen(skb) < sizeof(struct iphdr)))
+		/* Somebody is playing with raw sockets. */
+		return NF_ACCEPT;
 
-	/* INPUT/FORWARD: */
+	net = dev_net((in != NULL) ? in : out);
-	return ipt_do_table(skb, hook, in, out,
+	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
-			    dev_net(in)->ipv4.iptable_security);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {

net/ipv6/netfilter/ip6table_filter.c

@@ -64,13 +64,9 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
 		     const struct net_device *in, const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_INET_LOCAL_OUT)
+	const struct net *net = dev_net((in != NULL) ? in : out);
-		return ip6t_do_table(skb, hook, in, out,
-				     dev_net(out)->ipv6.ip6table_filter);
 
-	/* INPUT/FORWARD: */
+	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
-	return ip6t_do_table(skb, hook, in, out,
-			     dev_net(in)->ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {

net/ipv6/netfilter/ip6table_raw.c

@@ -48,13 +48,9 @@ ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
 		  const struct net_device *in, const struct net_device *out,
 		  int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_INET_PRE_ROUTING)
+	const struct net *net = dev_net((in != NULL) ? in : out);
-		return ip6t_do_table(skb, hook, in, out,
-				     dev_net(in)->ipv6.ip6table_raw);
 
-	/* OUTPUT: */
+	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
-	return ip6t_do_table(skb, hook, in, out,
-			     dev_net(out)->ipv6.ip6table_raw);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {

net/ipv6/netfilter/ip6table_security.c

@@ -69,13 +69,9 @@ ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
 		       const struct net_device *out,
 		       int (*okfn)(struct sk_buff *))
 {
-	if (hook == NF_INET_LOCAL_OUT)
+	const struct net *net = dev_net((in != NULL) ? in : out);
-		return ip6t_do_table(skb, hook, in, out,
-				     dev_net(out)->ipv6.ip6table_security);
 
-	/* INPUT/FORWARD: */
+	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
-	return ip6t_do_table(skb, hook, in, out,
-			     dev_net(in)->ipv6.ip6table_security);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {