br_nf_pre_routing will call the NF_INET_PRE_ROUTING hooks, at this
time both entry->state.in and entry->state.out are not bridge device.
NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
skb->dev, NULL,
br_nf_pre_routing_finish);
Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> 于2019年4月22日周一 下午4:34写道：
>
> On Tue, Apr 09, 2019 at 06:56:12AM +0000, Rundong Ge wrote:
> [...]
> > diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
> > index 0dcc359..57eb02d 100644
> > --- a/net/netfilter/nfnetlink_queue.c
> > +++ b/net/netfilter/nfnetlink_queue.c
> > @@ -905,13 +905,25 @@ static void free_entry(struct nf_queue_entry *entry)
> > dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
> > {
> > #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
> > - int physinif, physoutif;
> > + struct net_device *physindev, *physoutdev;
> > + struct net_bridge_port *port;
> >
> > - physinif = nf_bridge_get_physinif(entry->skb);
> > - physoutif = nf_bridge_get_physoutif(entry->skb);
> > -
> > - if (physinif == ifindex || physoutif == ifindex)
> > - return 1;
> > + physindev = nf_bridge_get_physindev(entry->skb);
> > + physoutdev = nf_bridge_get_physoutdev(entry->skb);
> > + if (physindev) {
> > + if (physindev->ifindex == ifindex)
> > + return 1;
> > + port = br_port_get_rcu(physindev);
> > + if (port && port->br->dev->ifindex == ifindex)
> > + return 1;
> > + }
> > + if (physoutdev) {
> > + if (physoutdev->ifindex == ifindex)
> > + return 1;
> > + port = br_port_get_rcu(physoutdev);
> > + if (port && port->br->dev->ifindex == ifindex)
> > + return 1;
> > + }
>
> Either entry->state.in and entry->state.out point to the bridge
> device, after this #endif.
>
> > #endif
> > if (entry->state.in)
> > if (entry->state.in->ifindex == ifindex)
> > --
> > 1.8.3.1
> >
