1 files changed, 8 insertions, 0 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ece2781a31b2..bcdb615aed6e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -138,6 +138,14 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
                 return ret;
         }
 
+#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
+        /* Policy lookup after SNAT yielded a new policy */
+        if (skb_dst(skb)->xfrm) {
+                IPCB(skb)->flags |= IPSKB_REROUTED;
+                return dst_output(net, sk, skb);
+        }
+#endif
+
         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
             dst_allfrag(skb_dst(skb)) ||
             (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))