[NF+IPsec 4/6]: Make IPsec input processing symetrical to output

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: 04.diff --]
[-- Type: text/x-patch, Size: 2294 bytes --]

[NETFILTER]: Make IPsec input processing symetrical to output

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 9b2748c756fd805c0fe5b37505735e02f06ebb28
tree 440bd33a45b20a01481876c5b379017cceec0388
parent 92dffb4b8138637d28173cc9c10fe5990914cf5d
author Patrick McHardy <kaber@trash.net> Mon, 17 Oct 2005 01:32:19 +0200
committer Patrick McHardy <kaber@trash.net> Mon, 17 Oct 2005 01:32:19 +0200

 net/ipv4/xfrm4_input.c |   23 ++++++++++++++---------
 net/ipv6/xfrm6_input.c |   23 ++++++++++++++---------
 2 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -137,16 +137,21 @@ int xfrm4_rcv_encap(struct sk_buff *skb,
 	memcpy(skb->sp->x+skb->sp->len, xfrm_vec, xfrm_nr*sizeof(struct sec_decap_state));
 	skb->sp->len += xfrm_nr;
 
-	if (decaps) {
-		if (!(skb->dev->flags&IFF_LOOPBACK)) {
-			dst_release(skb->dst);
-			skb->dst = NULL;
-		}
-		netif_rx(skb);
-		return 0;
-	} else {
-		return -skb->nh.iph->protocol;
+	if (!decaps) {
+		if (skb_cloned(skb) &&
+		    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+			goto drop;
+		__skb_push(skb, skb->data - skb->nh.raw);
+		skb->nh.iph->tot_len = htons(skb->len);
+		ip_send_check(skb->nh.iph);
 	}
+	if (!(skb->dev->flags&IFF_LOOPBACK)) {
+		dst_release(skb->dst);
+		skb->dst = NULL;
+	}
+	nf_reset(skb);
+	netif_rx(skb);
+	return 0;
 
 drop_unlock:
 	spin_unlock(&x->lock);
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -121,16 +121,21 @@ int xfrm6_rcv_spi(struct sk_buff **pskb,
 	skb->sp->len += xfrm_nr;
 	skb->ip_summed = CHECKSUM_NONE;
 
-	if (decaps) {
-		if (!(skb->dev->flags&IFF_LOOPBACK)) {
-			dst_release(skb->dst);
-			skb->dst = NULL;
-		}
-		netif_rx(skb);
-		return -1;
-	} else {
-		return 1;
+	if (!decaps) {
+		if (skb_cloned(skb) &&
+		    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+			goto drop;
+		/* FIXME: Jumbo payload option */
+		skb->nh.ipv6h->payload_len = htons(skb->len);
+		__skb_push(skb, skb->data - skb->nh.raw);
 	}
+	if (!(skb->dev->flags&IFF_LOOPBACK)) {
+		dst_release(skb->dst);
+		skb->dst = NULL;
+	}
+	nf_reset(skb);
+	netif_rx(skb);
+	return -1;
 
 drop_unlock:
 	spin_unlock(&x->lock);