 @@ -1,14 +1,14 @@
-/*	$NetBSD: ipsec_output.c,v 1.35 2011/06/07 15:54:57 drochner Exp $	*/
+/*	$NetBSD: ipsec_output.c,v 1.36 2011/06/09 21:04:37 drochner Exp $	*/
 /*-
  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -19,27 +19,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  * $FreeBSD: /repoman/r/ncvs/src/sys/netipsec/ipsec_output.c,v 1.3.2.2 2003/03/28 20:32:53 sam Exp $
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.35 2011/06/07 15:54:57 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.36 2011/06/09 21:04:37 drochner Exp $");
 /*
  * IPsec output processing.
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include "opt_ipsec.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 @@ -622,26 +622,38 @@ ipsec4_process_packet(
 		error = ipsec_process_done(m, isr);
+	}
 	splx(s);
 	return error;
 bad:
 	splx(s);
 	if (m)
 		m_freem(m);
 	return error;
+}
 #endif
 #ifdef INET6
 static int
 in6_sa_equal_addrwithscope(const struct sockaddr_in6 *sa, const struct in6_addr *ia)
+{
 	struct in6_addr ia2;
 	memcpy(&ia2, &sa->sin6_addr, sizeof(ia2));
 	if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6_addr))
 		ia2.s6_addr16[1] = htons(sa->sin6_scope_id);
 	return IN6_ARE_ADDR_EQUAL(ia, &ia2);
+}
 int
 ipsec6_process_packet(
 	struct mbuf *m,
  	struct ipsecrequest *isr
+    )
+{
 	struct secasindex saidx;
 	struct secasvar *sav;
 	struct ip6_hdr *ip6;
 	int s, error, i, off;
 	union sockaddr_union *dst;
 	IPSEC_ASSERT(m != NULL, ("ipsec6_process_packet: null mbuf"));
 @@ -663,27 +675,27 @@ ipsec6_process_packet(
+		}
+	}
 	sav = isr->sav;
 	dst = &sav->sah->saidx.dst;
 	ip6 = mtod(m, struct ip6_hdr *); /* XXX */
 	/* Do the appropriate encapsulation, if necessary */
 	if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
 	    dst->sa.sa_family != AF_INET6 ||        /* PF mismatch */
 	    ((dst->sa.sa_family == AF_INET6) &&
 	     (!IN6_IS_ADDR_UNSPECIFIED(&dst->sin6.sin6_addr)) &&
-	     (!IN6_ARE_ADDR_EQUAL(&dst->sin6.sin6_addr,
+	     (!in6_sa_equal_addrwithscope(&dst->sin6,
 				  &ip6->ip6_dst)))) {
 		struct mbuf *mp;
 		/* Fix IPv6 header payload length. */
 		if (m->m_len < sizeof(struct ip6_hdr))
 			if ((m = m_pullup(m,sizeof(struct ip6_hdr))) == NULL)
 				return ENOBUFS;
 		if (m->m_pkthdr.len - sizeof(*ip6) > IPV6_MAXPACKET) {
 			/* No jumbogram support. */
 			m_freem(m);
 			return ENXIO;   /*XXX*/
+		}