Re: [PATCH 2/4] netfilter: xtables: compact table hook functions (2/2)

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
> index b320208..7f64ea5 100644
> --- a/net/ipv4/netfilter/iptable_filter.c
> +++ b/net/ipv4/netfilter/iptable_filter.c
> @@ -67,19 +67,15 @@ iptable_filter_hook(unsigned int hook,
>  	 const struct net_device *out,
>  	 int (*okfn)(struct sk_buff *))
>  {
> -	if (hook == NF_INET_LOCAL_OUT) {
> -		if (skb->len < sizeof(struct iphdr) ||
> -		    ip_hdrlen(skb) < sizeof(struct iphdr))
> -			/* root is playing with raw sockets. */
> -			return NF_ACCEPT;
> -
> -		return ipt_do_table(skb, hook, in, out,
> -				    dev_net(out)->ipv4.iptable_filter);
> -	}
> +	const struct net *net;
> +
> +	if (hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) ||
> +	    ip_hdrlen(skb) < sizeof(struct iphdr)))

This also looks strange. The length tests belong together, so this would
make it much more readable:

	if (hook == NF_INET_LOCAL_OUT &&
	    (skb->len < sizeof(struct iphdr) ||
	     ip_hdrlen(skb) < sizeof(struct iphdr)))
		...

Please also fix up similar cases in case there are any.