Merge branch 'upstream-fixes'

[linux-2.6] / net / ipv4 / xfrm4_output.c

diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 51fabb8f7c54e621b084f470b1732d760d72a123..32ad229b4fedaf051746f6facb2936a2abd73af3 100644 (file)
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -140,6 +140,7 @@ static int xfrm4_output_one(struct sk_buff *skb)
                x = dst->xfrm;
        } while (x && !x->props.mode);
 
+       IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
        err = 0;
 
 out_exit:
@@ -155,6 +156,12 @@ static int xfrm4_output_finish(struct sk_buff *skb)
 {
        int err;
 
+#ifdef CONFIG_NETFILTER
+       if (!skb->dst->xfrm) {
+               IPCB(skb)->flags |= IPSKB_REROUTED;
+               return dst_output(skb);
+       }
+#endif
        while (likely((err = xfrm4_output_one(skb)) == 0)) {
                nf_reset(skb);
 
@@ -177,6 +184,7 @@ static int xfrm4_output_finish(struct sk_buff *skb)
 
 int xfrm4_output(struct sk_buff *skb)
 {
-       return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
-                      xfrm4_output_finish);
+       return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
+                           xfrm4_output_finish,
+                           !(IPCB(skb)->flags & IPSKB_REROUTED));
 }