ipv6: do xfrm transform after nat if necessary

In function nf_nat_ipv6_out, after nat is done, nf_xfrm_me_harder() will be called to look up xfrm dst.

---
 net/ipv6/ip6_output.c | 8 ++++++++
 1 file changed, 8 insertions(+)

index 8e950c2..742a845 100644
@@ -124,6 +124,14 @@ static int ip6_finish_output2(struct sk_buff *skb)
 
 static int ip6_finish_output(struct sk_buff *skb)
 {
+#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
+	/* Just like ipv4, policy lookup after nat yielded a new policy */
+	if (skb_dst(skb)->xfrm != NULL) {
+		IP6CB(skb)->flags |= IP6SKB_REROUTED;
+		return dst_output(skb);
+	}
+#endif
+
 	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
 	    dst_allfrag(skb_dst(skb)) ||
 	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))

1.8.3.1

From: Duan Jiong <[email protected]>
Date: Mon, 3 Nov 2014 12:53:03 +0800

This is far from sufficient of a commit log message for a change that is as serious and has as many implications as this one.

You haven't answered many questions, first of which in my mind is why we are bypassing all of the fragmentation checks?

We're also bypassing ip6_finish_output2() which does multicast and hooks up the neighbour.

IPV4 doesn't do this, why doesn't it have the same supposed problem you are trying to solve?

It is not even clear to me what the problem is, because your commit message is way too terse.

Thank you for your advice, I would consider a more comprehensive of the problem.

Thanks,
Duan