1 files changed, 11 insertions, 5 deletions

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 2ebfd281e721..e78680a9985b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -99,8 +99,13 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         esph->seq_no = htonl(++x->replay.oseq);
         xfrm_aevent_doreplay(x);
 
-        if (esp->conf.ivlen)
+        if (esp->conf.ivlen) {
+                if (unlikely(!esp->conf.ivinitted)) {
+                        get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                        esp->conf.ivinitted = 1;
+                }
                 crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
+        }
 
         do {
                 struct scatterlist *sg = &esp->sgbuf[0];
@@ -237,7 +242,7 @@ static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
 
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                 mtu = ALIGN(mtu + 2, blksize);
         } else {
                 /* The worst case. */
@@ -353,12 +358,12 @@ static int esp6_init_state(struct xfrm_state *x)
                 esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
                 if (unlikely(esp->conf.ivec == NULL))
                         goto error;
-                get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                esp->conf.ivinitted = 0;
         }
         if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                 goto error;
         x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct ipv6hdr);
         x->data = esp;
         return 0;
@@ -379,7 +384,8 @@ static struct xfrm_type esp6_type =
         .destructor     = esp6_destroy,
         .get_max_size   = esp6_get_max_size,
         .input          = esp6_input,
-        .output         = esp6_output
+        .output         = esp6_output,
+        .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
 static struct inet6_protocol esp6_protocol = {