[IPV6]: Fix tunnel encap limit handling as per RFC2473.

net/ipv6/ip6_tunnel.c

@@ -423,7 +423,7 @@ void ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
 		if (teli && teli == info - 2) {
 			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
-			if (tel->encap_limit <= 1) {
+			if (tel->encap_limit == 0) {
 				if (net_ratelimit())
 					printk(KERN_WARNING
 					       "%s: Too small encapsulation "
@@ -669,7 +669,7 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 	struct ipv6hdr *ipv6h = skb->nh.ipv6h;
 	struct ipv6_txoptions *orig_opt = NULL;
 	struct ipv6_txoptions *opt = NULL;
-	__u8 encap_limit = 0;
+	int encap_limit = -1;
 	__u16 offset;
 	struct flowi fl;
 	struct ip6_flowlabel *fl_lbl = NULL;
@@ -692,7 +692,7 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 	if ((offset = parse_tlv_tnl_enc_lim(skb, skb->nh.raw)) > 0) {
 		struct ipv6_tlv_tnl_enc_lim *tel;
 		tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->nh.raw[offset];
-		if (tel->encap_limit <= 1) {
+		if (tel->encap_limit == 0) {
 			icmpv6_send(skb, ICMPV6_PARAMPROB,
 				    ICMPV6_HDR_FIELD, offset + 2, skb->dev);
 			goto tx_err;
@@ -715,7 +715,7 @@ int ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 		if (fl_lbl)
 			orig_opt = fl_lbl->opt;
 	}
-	if (encap_limit > 0) {
+	if (encap_limit >= 0) {
 		if (!(opt = merge_options(sk, encap_limit, orig_opt))) {
 			goto tx_err_free_fl_lbl;
 		}