[IPSEC]: In TCP/v6 input, check policy before socket filter.

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 64fc399d0708c341d50703d234d6ca1d5d3a485c..e3a137ba61f705948414b87cfb2becebd04838c6 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1639,10 +1639,10 @@ process:
        if(sk->state == TCP_TIME_WAIT)
                goto do_time_wait;
 
-       if (sk_filter(sk, skb, 0))
+       if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                goto discard_and_relse;
 
-       if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+       if (sk_filter(sk, skb, 0))
                goto discard_and_relse;
 
        skb->dev = NULL;