4 files changed, 30 insertions, 41 deletions

diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index e9d823b149cd..deeda9b2cf05 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -58,13 +58,9 @@ arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
                      const struct net_device *in, const struct net_device *out,
                      int (*okfn)(struct sk_buff *))
 {
-        if (hook == NF_ARP_OUT)
-                return arpt_do_table(skb, hook, in, out,
-                                     dev_net(out)->ipv4.arptable_filter);
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-        /* INPUT/FORWARD: */
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 5369833ad56a..1bfeaae6f624 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
                     const struct net_device *in, const struct net_device *out,
                     int (*okfn)(struct sk_buff *))
 {
-        if (hook == NF_INET_LOCAL_OUT) {
-                if (skb->len < sizeof(struct iphdr) ||
-                    ip_hdrlen(skb) < sizeof(struct iphdr))
-                        /* root is playing with raw sockets. */
-                        return NF_ACCEPT;
-
-                return ipt_do_table(skb, hook, in, out,
-                                    dev_net(out)->ipv4.iptable_filter);
-        }
+        const struct net *net;
+
+        if (hook == NF_INET_LOCAL_OUT &&
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* root is playing with raw sockets. */
+                return NF_ACCEPT;
 
-        /* LOCAL_IN/FORWARD: */
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_filter);
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 2c55575e89f5..d16e43777c31 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -49,17 +49,16 @@ iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
                  const struct net_device *in, const struct net_device *out,
                  int (*okfn)(struct sk_buff *))
 {
-        if (hook == NF_INET_PRE_ROUTING)
-                return ipt_do_table(skb, hook, in, out,
-                                    dev_net(in)->ipv4.iptable_raw);
-
-        /* OUTPUT: */
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
+        const struct net *net;
+
+        if (hook == NF_INET_LOCAL_OUT && 
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* root is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_raw);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
 }
 
 /* 'raw' is the very first table. */
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 1c666bab3269..324505aaaa73 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -70,19 +70,16 @@ iptable_security_hook(unsigned int hook, struct sk_buff *skb,
                       const struct net_device *out,
                       int (*okfn)(struct sk_buff *))
 {
-        if (hook == NF_INET_LOCAL_OUT) {
-                if (skb->len < sizeof(struct iphdr) ||
-                    ip_hdrlen(skb) < sizeof(struct iphdr))
-                        /* Somebody is playing with raw sockets. */
-                        return NF_ACCEPT;
-
-                return ipt_do_table(skb, hook, in, out,
-                                    dev_net(out)->ipv4.iptable_security);
-        }
-
-        /* INPUT/FORWARD: */
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_security);
+        const struct net *net;
+
+        if (hook == NF_INET_LOCAL_OUT &&
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* Somebody is playing with raw sockets. */
+                return NF_ACCEPT;
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {