Merge branch 'upstream-fixes'

[linux-2.6] / net / ipv6 / xfrm6_input.c

diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 1079e47f393383f09624988e705e55d5c9080fa7..1ca2da68ef69c35e420c1badf3c84e079bb88aec 100644 (file)
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -11,6 +11,8 @@
 
 #include <linux/module.h>
 #include <linux/string.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
 #include <net/dsfield.h>
 #include <net/inet_ecn.h>
 #include <net/ip.h>
@@ -121,6 +123,8 @@ int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi)
        skb->sp->len += xfrm_nr;
        skb->ip_summed = CHECKSUM_NONE;
 
+       nf_reset(skb);
+
        if (decaps) {
                if (!(skb->dev->flags&IFF_LOOPBACK)) {
                        dst_release(skb->dst);
@@ -129,7 +133,16 @@ int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi)
                netif_rx(skb);
                return -1;
        } else {
+#ifdef CONFIG_NETFILTER
+               skb->nh.ipv6h->payload_len = htons(skb->len);
+               __skb_push(skb, skb->data - skb->nh.raw);
+
+               NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
+                       ip6_rcv_finish);
+               return -1;
+#else
                return 1;
+#endif
        }
 
 drop_unlock: