tree d4d4a5178f22ee795e2e7a44b1ca49fb0dc209fc
parent d80e773f16f66a610e04f6875d4da84e74a8fb6c
author Steffen Klassert <steffen.klassert@secunet.com> 1396850932 +0200
committer Steffen Klassert <steffen.klassert@secunet.com> 1396860758 +0200

xfrm: Fix crash with ipv6 IPsec tunnel and NAT.

The ipv6 xfrm output path is not aware that packets can be
rerouted by NAT to not use IPsec. We crash in this case
because we expect to have a xfrm state at the dst_entry.
This crash happens if the ipv6 layer does IPsec and NAT
or if we have an interfamily IPsec tunnel with ipv4 NAT.

We fix this by checking for a NAT rerouted packet in each
address family and dst_output() to the new destination
in this case.

Reported-by: Martin Pelikan <martin.pelikan@gmail.com>
Tested-by: Martin Pelikan <martin.pelikan@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>