|
@@ -65,19 +65,16 @@ iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
|
|
|
const struct net_device *in, const struct net_device *out,
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
{
|
|
|
- if (hook == NF_INET_LOCAL_OUT) {
|
|
|
- if (skb->len < sizeof(struct iphdr) ||
|
|
|
- ip_hdrlen(skb) < sizeof(struct iphdr))
|
|
|
- /* root is playing with raw sockets. */
|
|
|
- return NF_ACCEPT;
|
|
|
-
|
|
|
- return ipt_do_table(skb, hook, in, out,
|
|
|
- dev_net(out)->ipv4.iptable_filter);
|
|
|
- }
|
|
|
+ const struct net *net;
|
|
|
+
|
|
|
+ if (hook == NF_INET_LOCAL_OUT &&
|
|
|
+ (skb->len < sizeof(struct iphdr) ||
|
|
|
+ ip_hdrlen(skb) < sizeof(struct iphdr)))
|
|
|
+ /* root is playing with raw sockets. */
|
|
|
+ return NF_ACCEPT;
|
|
|
|
|
|
- /* LOCAL_IN/FORWARD: */
|
|
|
- return ipt_do_table(skb, hook, in, out,
|
|
|
- dev_net(in)->ipv4.iptable_filter);
|
|
|
+ net = dev_net((in != NULL) ? in : out);
|
|
|
+ return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
|
|
|
}
|
|
|
|
|
|
static struct nf_hook_ops ipt_ops[] __read_mostly = {
|