5 files changed, 73 insertions, 23 deletions

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 83fc3a385a26..d21d7b22eebc 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -544,12 +544,12 @@ static int esp_init_authenc(struct xfrm_state *x)
                 BUG_ON(!aalg_desc);
 
                 err = -EINVAL;
-                if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
+                if (aalg_desc->uinfo.auth.icv_fullbits / 8 !=
                     crypto_aead_authsize(aead)) {
-                        NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n",
-                                 x->aalg->alg_name,
-                                 crypto_aead_authsize(aead),
-                                 aalg_desc->uinfo.auth.icv_fullbits/8);
+                        pr_info("ESP: %s digestsize %u != %hu\n",
+                                x->aalg->alg_name,
+                                crypto_aead_authsize(aead),
+                                aalg_desc->uinfo.auth.icv_fullbits / 8);
                         goto free_key;
                 }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 12c3c8ef3849..1fcf62ea5eb4 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -902,7 +902,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
         struct net_device_stats *stats = &t->dev->stats;
         int ret;
 
-        if (!ip6_tnl_xmit_ctl(t))
+        if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
                 goto tx_err;
 
         switch (skb->protocol) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 8e950c250ada..916d2a166a9b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -747,13 +747,11 @@ slow_path:
                 if (len < left) {
                         len &= ~7;
                 }
-                /*
-                 *      Allocate buffer.
-                 */
 
-                if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
-                                      hroom + troom, GFP_ATOMIC)) == NULL) {
-                        NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
+                /* Allocate buffer */
+                frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
+                                 hroom + troom, GFP_ATOMIC);
+                if (!frag) {
                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                                       IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 8c97cd1048c2..4550d08f44de 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -183,6 +183,7 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_
         unsigned int hash = HASH(remote, local);
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+        struct in6_addr any;
 
         for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
@@ -190,6 +191,22 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_
                     (t->dev->flags & IFF_UP))
                         return t;
         }
+
+        memset(&any, 0, sizeof(any));
+        hash = HASH(&any, local);
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+                if (ipv6_addr_equal(local, &t->parms.laddr) &&
+                    (t->dev->flags & IFF_UP))
+                        return t;
+        }
+
+        hash = HASH(remote, &any);
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+                if (ipv6_addr_equal(remote, &t->parms.raddr) &&
+                    (t->dev->flags & IFF_UP))
+                        return t;
+        }
+
         t = rcu_dereference(ip6n->tnls_wc[0]);
         if (t && (t->dev->flags & IFF_UP))
                 return t;
@@ -909,24 +926,28 @@ ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
 
-int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
+int ip6_tnl_xmit_ctl(struct ip6_tnl *t,
+                     const struct in6_addr *laddr,
+                     const struct in6_addr *raddr)
 {
         struct __ip6_tnl_parm *p = &t->parms;
         int ret = 0;
         struct net *net = t->net;
 
-        if (p->flags & IP6_TNL_F_CAP_XMIT) {
+        if ((p->flags & IP6_TNL_F_CAP_XMIT) ||
+            ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
+             (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_XMIT))) {
                 struct net_device *ldev = NULL;
 
                 rcu_read_lock();
                 if (p->link)
                         ldev = dev_get_by_index_rcu(net, p->link);
 
-                if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
+                if (unlikely(!ipv6_chk_addr(net, laddr, ldev, 0)))
                         pr_warn("%s xmit: Local address not yet configured!\n",
                                 p->name);
-                else if (!ipv6_addr_is_multicast(&p->raddr) &&
-                         unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
+                else if (!ipv6_addr_is_multicast(raddr) &&
+                         unlikely(ipv6_chk_addr(net, raddr, NULL, 0)))
                         pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
                                 p->name);
                 else
@@ -975,8 +996,34 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         u8 proto;
         int err = -1;
 
-        if (!fl6->flowi6_mark)
+        /* NBMA tunnel */
+        if (ipv6_addr_any(&t->parms.raddr)) {
+                struct in6_addr *addr6;
+                struct neighbour *neigh;
+                int addr_type;
+
+                if (!skb_dst(skb))
+                        goto tx_err_link_failure;
+
+                neigh = dst_neigh_lookup(skb_dst(skb),
+                                         &ipv6_hdr(skb)->daddr);
+                if (!neigh)
+                        goto tx_err_link_failure;
+
+                addr6 = (struct in6_addr *)&neigh->primary_key;
+                addr_type = ipv6_addr_type(addr6);
+
+                if (addr_type == IPV6_ADDR_ANY)
+                        addr6 = &ipv6_hdr(skb)->daddr;
+
+                memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
+                neigh_release(neigh);
+        } else if (!fl6->flowi6_mark)
                 dst = ip6_tnl_dst_check(t);
+
+        if (!ip6_tnl_xmit_ctl(t, &fl6->saddr, &fl6->daddr))
+                goto tx_err_link_failure;
+
         if (!dst) {
                 ndst = ip6_route_output(net, NULL, fl6);
 
@@ -1086,8 +1133,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         int err;
 
         tproto = ACCESS_ONCE(t->parms.proto);
-        if ((tproto != IPPROTO_IPIP && tproto != 0) ||
-            !ip6_tnl_xmit_ctl(t))
+        if (tproto != IPPROTO_IPIP && tproto != 0)
                 return -1;
 
         if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
@@ -1131,7 +1177,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tproto = ACCESS_ONCE(t->parms.proto);
         if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
-            !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
+            ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
         offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d440bb585524..0e8e97e0d38b 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -416,6 +416,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         struct net_device_stats *stats = &t->dev->stats;
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;
+        struct xfrm_state *x;
         int err = -1;
 
         if (!dst)
@@ -429,7 +430,12 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 goto tx_err_link_failure;
         }
 
-        if (!vti6_state_check(dst->xfrm, &t->parms.raddr, &t->parms.laddr))
+        x = dst->xfrm;
+        if (!vti6_state_check(x, &t->parms.raddr, &t->parms.laddr))
+                goto tx_err_link_failure;
+
+        if (!ip6_tnl_xmit_ctl(t, (const struct in6_addr *)&x->props.saddr,
+                              (const struct in6_addr *)&x->id.daddr))
                 goto tx_err_link_failure;
 
         tdev = dst->dev;
@@ -484,7 +490,7 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 ipv6h = ipv6_hdr(skb);
 
                 if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
-                    !ip6_tnl_xmit_ctl(t) || vti6_addr_conflict(t, ipv6h))
+                    vti6_addr_conflict(t, ipv6h))
                         goto tx_err;
 
                 xfrm_decode_session(skb, &fl, AF_INET6);