commit 05662965b9d55cc4e3d4f2a0445ba3083d05b12a
Author: Sascha Hlusiak <contact@saschahlusiak.de>
Date:   Mon Aug 24 11:32:48 2009 +0200

    sit: 6to4: honour routing table
    
    Using only the actual destination address to determine the IPv4 target in
    try_6to4(&iph6->daddr) seems wrong to me and breaks, if a 6to4 address is
    the next-hop, like ::192.88.99.1 written as 6to4:
    
    default via 2002:c058:6301:: dev 6to4
    
    A package to 2001:: would fall through the try_6to4 check to the
    IPv4-compat check and die there.
    
    This patch makes try_6to4 use the address of the Next-Hop as well, which
    could be a 6to4 address, if the final destination itself is no 6to4 address.
    
    Signed-off-by: Sascha Hlusiak <contact@saschahlusiak.de>

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 98b7327..39059e8 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -658,6 +658,17 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	if (!dst)
 		dst = try_6to4(&iph6->daddr);
+	if (!dst) {
+		struct neighbour *neigh = NULL;
+
+		if (skb_dst(skb))
+			neigh = skb_dst(skb)->neighbour;
+
+		if (neigh) {
+			addr6 = (struct in6_addr *)&neigh->primary_key;
+			dst = try_6to4(addr6);
+		}
+	}
 
 	if (!dst) {
 		struct neighbour *neigh = NULL;