4 files changed, 8 insertions, 72 deletions

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 137b8eb666b7..94ef788a2ac6 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -166,6 +166,7 @@ static struct dst_ops ipv4_dst_ops = {
         .negative_advice =      ipv4_negative_advice,
         .link_failure =         ipv4_link_failure,
         .update_pmtu =          ip_rt_update_pmtu,
+        .local_out =            ip_local_out,
         .entry_size =           sizeof(struct rtable),
 };
 
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 0ffc3d078489..2fb4efa3ff2c 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -59,7 +59,7 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
+        IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED;
 
         skb->protocol = htons(ETH_P_IP);
 
@@ -67,87 +67,19 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(xfrm4_prepare_output);
 
-static inline int xfrm4_output_one(struct sk_buff *skb)
-{
-        int err;
-
-        err = xfrm_output(skb);
-        if (err)
-                goto error_nolock;
-
-        IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
-        err = 0;
-
-out_exit:
-        return err;
-error_nolock:
-        kfree_skb(skb);
-        goto out_exit;
-}
-
-static int xfrm4_output_finish2(struct sk_buff *skb)
-{
-        int err;
-
-        while (likely((err = xfrm4_output_one(skb)) == 0)) {
-                nf_reset(skb);
-
-                err = __ip_local_out(skb);
-                if (unlikely(err != 1))
-                        break;
-
-                if (!skb->dst->xfrm)
-                        return dst_output(skb);
-
-                err = nf_hook(PF_INET, NF_IP_POST_ROUTING, skb, NULL,
-                              skb->dst->dev, xfrm4_output_finish2);
-                if (unlikely(err != 1))
-                        break;
-        }
-
-        return err;
-}
-
 static int xfrm4_output_finish(struct sk_buff *skb)
 {
-        struct sk_buff *segs;
-
 #ifdef CONFIG_NETFILTER
         if (!skb->dst->xfrm) {
                 IPCB(skb)->flags |= IPSKB_REROUTED;
                 return dst_output(skb);
         }
-#endif
 
-        if (!skb_is_gso(skb))
-                return xfrm4_output_finish2(skb);
+        IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
+#endif
 
         skb->protocol = htons(ETH_P_IP);
-        segs = skb_gso_segment(skb, 0);
-        kfree_skb(skb);
-        if (unlikely(IS_ERR(segs)))
-                return PTR_ERR(segs);
-
-        do {
-                struct sk_buff *nskb = segs->next;
-                int err;
-
-                segs->next = NULL;
-                err = xfrm4_output_finish2(segs);
-
-                if (unlikely(err)) {
-                        while ((segs = nskb)) {
-                                nskb = segs->next;
-                                segs->next = NULL;
-                                kfree_skb(segs);
-                        }
-                        return err;
-                }
-
-                segs = nskb;
-        } while (segs);
-
-        return 0;
+        return xfrm_output(skb);
 }
 
 int xfrm4_output(struct sk_buff *skb)
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 1d7524375b49..b4948c170b3e 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -237,6 +237,7 @@ static struct dst_ops xfrm4_dst_ops = {
         .update_pmtu =          xfrm4_update_pmtu,
         .destroy =              xfrm4_dst_destroy,
         .ifdown =               xfrm4_dst_ifdown,
+        .local_out =            __ip_local_out,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 85f04b7b237f..80292fbf221a 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -11,6 +11,7 @@
 #include <net/xfrm.h>
 #include <linux/pfkeyv2.h>
 #include <linux/ipsec.h>
+#include <linux/netfilter_ipv4.h>
 
 static struct xfrm_state_afinfo xfrm4_state_afinfo;
 
@@ -66,6 +67,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .family                 = AF_INET,
         .proto                  = IPPROTO_IPIP,
         .eth_proto              = htons(ETH_P_IP),
+        .nf_post_routing        = NF_IP_POST_ROUTING,
         .owner                  = THIS_MODULE,
         .init_flags             = xfrm4_init_flags,
         .init_tempsel           = __xfrm4_init_tempsel,