Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Conflicts:
	net/ipv4/ip_vti.c

Steffen Klassert says:

====================
pull request (net): ipsec 2014-05-15

This pull request has a merge conflict in net/ipv4/ip_vti.c
between commit 8d89dcdf80d8 ("vti: don't allow to add the same
tunnel twice") and commit a32452366b72  ("vti4:Don't count header
length twice"). It can be solved like it is done in linux-next.

1) Fix a ipv6 xfrm output crash when a packet is rerouted
   by netfilter to not use IPsec.

2) vti4 counts some header lengths twice leading to an incorrect
   device mtu. Fix this by counting these headers only once.

3) We don't catch the case if an unsupported protocol is submitted
   to the xfrm protocol handlers, this can lead to NULL pointer
   dereferences. Fix this by adding the appropriate checks.

4) vti6 may unregister pernet ops twice on init errors.
   Fix this by removing one of the calls to do it only once.
   From Mathias Krause.

5) Set the vti tunnel mark before doing a lookup in the error
   handlers. Otherwise we don't find the correct xfrm state.
====================

The conflict in ip_vti.c was simple, 'net' had a commit
removing a line from vti_tunnel_init() and this tree
being merged had a commit adding a line to the same
location.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --cc net/ipv4/ip_vti.c
Simple merge

diff --cc net/ipv4/xfrm4_output.c
index 40e701f2e1e0324af6f0af781ac6715866ad88d3,f3800bf79d86cb4ac856d435b334f126dc2fe6f6..186a8ecf92fa84bda9d0f6b050131da603c7694a
--- 1/net/ipv4/xfrm4_output.c
--- 2/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@@ -78,22 -89,15 +89,15 @@@ static int __xfrm4_output(struct sk_buf
                IPCB(skb)->flags |= IPSKB_REROUTED;
                return dst_output(skb);
        }
- 
-       IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
  #endif
  
-       skb->protocol = htons(ETH_P_IP);
-       return xfrm_output(skb);
+       return x->outer_mode->afinfo->output_finish(skb);
  }
  
 -int xfrm4_output(struct sk_buff *skb)
 +int xfrm4_output(struct sock *sk, struct sk_buff *skb)
  {
-       struct dst_entry *dst = skb_dst(skb);
-       struct xfrm_state *x = dst->xfrm;
- 
        return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, skb,
-                           NULL, dst->dev,
-                           x->outer_mode->afinfo->output_finish,
+                           NULL, skb_dst(skb)->dev, __xfrm4_output,
                            !(IPCB(skb)->flags & IPSKB_REROUTED));
  }
  

diff --cc net/ipv6/xfrm6_output.c
index 19ef329bdbf8e7418fa1d352bb6c90218935831e,ba624331451c5cf2fababb86a424a4ddef5bfd27..b930d080c66f231f338c7ea860c8c1d798d91fea
--- 1/net/ipv6/xfrm6_output.c
--- 2/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@@ -163,8 -166,9 +166,9 @@@ static int __xfrm6_output(struct sk_buf
        return x->outer_mode->afinfo->output_finish(skb);
  }
  
 -int xfrm6_output(struct sk_buff *skb)
 +int xfrm6_output(struct sock *sk, struct sk_buff *skb)
  {
-       return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
-                      skb_dst(skb)->dev, __xfrm6_output);
+       return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb,
+                           NULL, skb_dst(skb)->dev, __xfrm6_output,
+                           !(IP6CB(skb)->flags & IP6SKB_REROUTED));
  }