diff -urN linux-2.6.17.14/include/linux/xfrm.h linux-2.6.17.14-sleep/include/linux/xfrm.h--- linux-2.6.17.14/include/linux/xfrm.h	2006-12-20 01:41:18.000000000 +0200+++ linux-2.6.17.14-sleep/include/linux/xfrm.h	2006-12-20 01:42:22.000000000 +0200@@ -43,6 +43,12 @@ #define XFRM_SC_ALG_RESERVED 0 #define XFRM_SC_ALG_SELINUX 1 +/* Transport layer flag  passed to xfrm_lookup. If set, the userspace+   process sleeps in a waitqueue until key management daemon has +   finished setting up security associations. This workaround exists +   until we have queues for outgoing IPsec packets. */+#define XFRM_LOOKUP_SLEEP (!in_atomic() && !in_softirq())+ /* Selector, used as selector both on policy rules (SPD) and SAs. */  struct xfrm_selectordiff -urN linux-2.6.17.14/include/net/xfrm.h linux-2.6.17.14-sleep/include/net/xfrm.h--- linux-2.6.17.14/include/net/xfrm.h	2006-12-20 01:41:18.000000000 +0200+++ linux-2.6.17.14-sleep/include/net/xfrm.h	2006-12-20 01:43:22.000000000 +0200@@ -223,7 +223,7 @@ extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c); extern void km_state_notify(struct xfrm_state *x, struct km_event *c);-#define XFRM_ACQ_EXPIRES	30+#define XFRM_ACQ_EXPIRES	3  struct xfrm_tmpl; extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);diff -urN linux-2.6.17.14/net/ipv4/route.c linux-2.6.17.14-sleep/net/ipv4/route.c--- linux-2.6.17.14/net/ipv4/route.c	2006-10-13 21:55:04.000000000 +0300+++ linux-2.6.17.14-sleep/net/ipv4/route.c	2006-12-20 01:49:45.000000000 +0200@@ -108,6 +108,7 @@ #ifdef CONFIG_SYSCTL #include <linux/sysctl.h> #endif+#include <linux/xfrm.h>  #define RT_FL_TOS(oldflp) \     ((u32)(oldflp->fl4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))@@ -2618,7 +2619,7 @@  int ip_route_output_key(struct rtable **rp, struct flowi *flp) {-	return ip_route_output_flow(rp, flp, NULL, 0);+	return ip_route_output_flow(rp, flp, NULL, XFRM_LOOKUP_SLEEP); }  static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,diff -urN linux-2.6.17.14/net/ipv6/icmp.c linux-2.6.17.14-sleep/net/ipv6/icmp.c--- linux-2.6.17.14/net/ipv6/icmp.c	2006-10-13 21:55:04.000000000 +0300+++ linux-2.6.17.14-sleep/net/ipv6/icmp.c	2006-12-20 01:42:22.000000000 +0200@@ -64,6 +64,7 @@ #include <net/ip6_route.h> #include <net/addrconf.h> #include <net/icmp.h>+#include <linux/xfrm.h>  #include <asm/uaccess.h> #include <asm/system.h>@@ -389,7 +390,7 @@ 		goto out_dst_release; 	} -	if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)+	if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0) 		goto out;  	if (ipv6_addr_is_multicast(&fl.fl6_dst))diff -urN linux-2.6.17.14/net/ipv6/tcp_ipv6.c linux-2.6.17.14-sleep/net/ipv6/tcp_ipv6.c--- linux-2.6.17.14/net/ipv6/tcp_ipv6.c	2006-10-13 21:55:04.000000000 +0300+++ linux-2.6.17.14-sleep/net/ipv6/tcp_ipv6.c	2006-12-20 01:42:22.000000000 +0200@@ -258,7 +258,7 @@ 	if (final_p) 		ipv6_addr_copy(&fl.fl6_dst, final_p); -	if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)+	if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0) 		goto failure;  	if (saddr == NULL) {diff -urN linux-2.6.17.14/net/ipv6/udp.c linux-2.6.17.14-sleep/net/ipv6/udp.c--- linux-2.6.17.14/net/ipv6/udp.c	2006-10-13 21:55:04.000000000 +0300+++ linux-2.6.17.14-sleep/net/ipv6/udp.c	2006-12-20 01:42:22.000000000 +0200@@ -789,7 +789,7 @@ 	if (final_p) 		ipv6_addr_copy(&fl->fl6_dst, final_p); -	if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0)+	if ((err = xfrm_lookup(&dst, fl, sk, XFRM_LOOKUP_SLEEP)) < 0) 		goto out;  	if (hlimit < 0) {