__xfrm6_bundle_len_inc(&header_len, &nfheader_len, xfrm[i]);
                trailer_len += xfrm[i]->props.trailer_len;
 
-               if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL) {
+               if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL ||
+                   xfrm[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION) {
                        unsigned short encap_family = xfrm[i]->props.family;
                        switch(encap_family) {
                        case AF_INET:
                                fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;
                                break;
                        case AF_INET6:
-                               ipv6_addr_copy(&fl_tunnel.fl6_dst, (struct in6_addr*)&xfrm[i]->id.daddr.a6);
-                               ipv6_addr_copy(&fl_tunnel.fl6_src, (struct in6_addr*)&xfrm[i]->props.saddr.a6);
+                               ipv6_addr_copy(&fl_tunnel.fl6_dst, __xfrm6_bundle_addr_remote(xfrm[i], &fl->fl6_dst));
+
+                               ipv6_addr_copy(&fl_tunnel.fl6_src, __xfrm6_bundle_addr_remote(xfrm[i], &fl->fl6_src));
                                break;
                        default:
                                BUG_ON(1);