IPsec tunnel forwarding in net-next-2.6 since 452edd59

Hi,

I'm able to ping across a tunnel to a peer running net-next-2.6, but 
only to an interface on the peer; trying to ping a host behind the peer 
fails. The incoming packet shows up in encrypted and decrypted form in 
tcpdump, but it's not forwarded. None of the XFRM error counters are 
incremented; the packets just silently fail to be forwarded.

There are no iptables rules and net.ipv4.ip_forward=1. The same config 
works on 2.6.38-rc8. git bisect pointed me to commit 452edd59 from March 2:

     xfrm: Return dst directly from xfrm_lookup()

     Instead of on the stack.


ip xfrm policy:

src 192.168.136.0/24 dst 192.168.137.0/24
         dir out priority 2344 ptype main
         tmpl src 1.1.1.136 dst 1.1.1.137
                 proto esp reqid 16385 mode tunnel

src 192.168.137.0/24 dst 192.168.136.0/24
         dir fwd priority 2344 ptype main
         tmpl src 1.1.1.137 dst 1.1.1.136
                 proto esp reqid 16385 mode tunnel

src 192.168.137.0/24 dst 192.168.136.0/24
         dir in priority 2344 ptype main
         tmpl src 1.1.1.137 dst 1.1.1.136
                 proto esp reqid 16385 mode tunnel

net-next-2.6 host is at 1.1.1.136 and 192.168.136.1. 2.6.35.10 host is 
at 1.1.1.137 and 192.168.137.1. From that host:

ping -I 192.168.137.1 192.168.136.1 -> success
ping -I 192.168.137.1 192.168.136.2 -> silent failure

Thanks,
Mike