Index: openswan-2.6.23/linux/net/ipsec/ipsec_xmit.c
===================================================================
--- openswan-2.6.23.orig/linux/net/ipsec/ipsec_xmit.c	2009-09-09 02:42:54.000000000 +0200
+++ openswan-2.6.23/linux/net/ipsec/ipsec_xmit.c	2009-12-17 15:28:32.000000000 +0100
@@ -116,7 +116,7 @@
 #endif
 
 /* kernels > 2.4.2 */
-#if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW)
+#if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW) && LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
 #define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst, NULL)
 #endif
 
@@ -2037,8 +2037,14 @@
 		return IPSEC_XMIT_RECURSDETECT;
 	}
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
 	dst_release(ixs->skb->dst);
 	ixs->skb->dst = &ixs->route->u.dst;
+#else
+	dst_release(skb_dst(ixs->skb));
+	skb_dst_set(ixs->skb, &ixs->route->u.dst);
+#endif
+
 	if(ixs->stats) {
 		ixs->stats->tx_bytes += ixs->skb->len;
 	}
Index: openswan-2.6.23/linux/net/ipsec/ipsec_rcv.c
===================================================================
--- openswan-2.6.23.orig/linux/net/ipsec/ipsec_rcv.c	2009-12-17 15:28:32.000000000 +0100
+++ openswan-2.6.23/linux/net/ipsec/ipsec_rcv.c	2009-12-17 15:28:32.000000000 +0100
@@ -1710,10 +1710,18 @@
 	/* release the dst that was attached, since we have likely
 	 * changed the actual destination of the packet.
 	 */
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
 	if(skb->dst) {
 		dst_release(skb->dst);
 		skb->dst = NULL;
 	}
+#else
+	if(skb_dst(skb))
+	{
+		dst_release(skb_dst(skb));
+		skb_dst_set(skb, NULL);
+	}
+#endif
 	skb->pkt_type = PACKET_HOST;
 	if(irs->hard_header_len &&
 	   (skb_mac_header(skb) != (skb_network_header(skb) - irs->hard_header_len)) &&
Index: openswan-2.6.23/linux/include/openswan/ipsec_param.h
===================================================================
--- openswan-2.6.23.orig/linux/include/openswan/ipsec_param.h	2009-09-09 02:42:54.000000000 +0200
+++ openswan-2.6.23/linux/include/openswan/ipsec_param.h	2009-12-17 15:28:32.000000000 +0100
@@ -220,7 +220,12 @@
 
 /* kernels > 2.4.2 */
 #if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW)
+/* 2.6.31 changed skb_buff */
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
 #define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst, NULL)
+#else
+#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb_dst(skb), NULL)
+#endif
 #endif
 
 #endif /* SUSE_LINUX_2_4_19_IS_STUPID */
Index: openswan-2.6.23/linux/net/ipsec/pfkey_v2.c
===================================================================
--- openswan-2.6.23.orig/linux/net/ipsec/pfkey_v2.c	2009-09-09 02:42:54.000000000 +0200
+++ openswan-2.6.23/linux/net/ipsec/pfkey_v2.c	2009-12-17 15:28:32.000000000 +0100
@@ -492,7 +492,11 @@
 			printk(" h:0p%p", skb_transport_header(skb));
 			printk(" nh:0p%p", skb_network_header(skb));
 			printk(" mac:0p%p", skb_mac_header(skb));
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
 			printk(" dst:0p%p", skb->dst);
+#else
+			printk(" dst:0p%p", skb_dst(skb));
+#endif
 			if(sysctl_ipsec_debug_verbose) {
 				int i;
 				
Index: openswan-2.6.23/linux/net/ipsec/ipsec_mast.c
===================================================================
--- openswan-2.6.23.orig/linux/net/ipsec/ipsec_mast.c	2009-12-17 15:28:57.000000000 +0100
+++ openswan-2.6.23/linux/net/ipsec/ipsec_mast.c	2009-12-17 15:29:58.000000000 +0100
@@ -178,8 +178,13 @@
 			    ixs->dev->name);
 		return IPSEC_XMIT_RECURSDETECT;
 	}
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
 	dst_release(ixs->skb->dst);
 	ixs->skb->dst = &ixs->route->u.dst;
+#else
+	dst_release(skb_dst(ixs->skb));
+	skb_dst_set(ixs->skb, &ixs->route->u.dst);
+#endif
 	ixs->stats->tx_bytes += ixs->skb->len;
 	if(ixs->skb->len < ixs->skb->nh.raw - ixs->skb->data) {
 		ixs->stats->tx_errors++;