23 files changed, 238 insertions, 105 deletions

diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index a460e8132b4d..6e48f52e197c 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -153,6 +153,19 @@ config INET6_XFRM_MODE_ROUTEOPTIMIZATION
         ---help---
           Support for MIPv6 route optimization mode.
 
+config IPV6_SIT
+        tristate "IPv6: IPv6-in-IPv4 tunnel (SIT driver)"
+        depends on IPV6
+        default y
+        ---help---
+          Tunneling means encapsulating data of one protocol type within
+          another protocol and sending it over a channel that understands the
+          encapsulating protocol. This driver implements encapsulation of IPv6
+          into IPv4 packets. This is useful if you want to connect two IPv6
+          networks over an IPv4-only path.
+
+          Saying M here will produce a module called sit.ko. If unsure, say Y.
+
 config IPV6_TUNNEL
         tristate "IPv6: IPv6-in-IPv6 tunnel"
         select INET6_TUNNEL
@@ -162,9 +175,16 @@ config IPV6_TUNNEL
 
           If unsure, say N.
 
+config IPV6_MULTIPLE_TABLES
+        bool "IPv6: Multiple Routing Tables"
+        depends on IPV6 && EXPERIMENTAL
+        select FIB_RULES
+        ---help---
+          Support multiple routing tables.
+
 config IPV6_SUBTREES
         bool "IPv6: source address based routing"
-        depends on IPV6 && EXPERIMENTAL
+        depends on IPV6_MULTIPLE_TABLES
         ---help---
           Enable routing by source address or prefix.
 
@@ -176,13 +196,6 @@ config IPV6_SUBTREES
 
           If unsure, say N.
 
-config IPV6_MULTIPLE_TABLES
-        bool "IPv6: Multiple Routing Tables"
-        depends on IPV6 && EXPERIMENTAL
-        select FIB_RULES
-        ---help---
-          Support multiple routing tables.
-
 config IPV6_ROUTE_FWMARK
         bool "IPv6: use netfilter MARK value as routing key"
         depends on IPV6_MULTIPLE_TABLES && NETFILTER
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 87274e47fe32..addcc011bc01 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_IPV6) += ipv6.o
 
-ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o sit.o \
+ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                 route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
                 protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
                 exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
@@ -29,6 +29,7 @@ obj-$(CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION) += xfrm6_mode_ro.o
 obj-$(CONFIG_INET6_XFRM_MODE_BEET) += xfrm6_mode_beet.o
 obj-$(CONFIG_NETFILTER) += netfilter/
 
+obj-$(CONFIG_IPV6_SIT) += sit.o
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
 
 obj-y += exthdrs_core.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e03c33b2465b..b312a5f7a759 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -396,8 +396,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         ndev->regen_timer.data = (unsigned long) ndev;
         if ((dev->flags&IFF_LOOPBACK) ||
             dev->type == ARPHRD_TUNNEL ||
-            dev->type == ARPHRD_NONE ||
-            dev->type == ARPHRD_SIT) {
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
+            dev->type == ARPHRD_SIT ||
+#endif
+            dev->type == ARPHRD_NONE) {
                 printk(KERN_INFO
                        "%s: Disabled Privacy Extensions\n",
                        dev->name);
@@ -1546,8 +1548,10 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
            This thing is done here expecting that the whole
            class of non-broadcast devices need not cloning.
          */
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
                 cfg.fc_flags |= RTF_NONEXTHOP;
+#endif
 
         ip6_route_add(&cfg);
 }
@@ -1569,6 +1573,7 @@ static void addrconf_add_mroute(struct net_device *dev)
         ip6_route_add(&cfg);
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_route_add(struct net_device *dev)
 {
         struct fib6_config cfg = {
@@ -1582,6 +1587,7 @@ static void sit_route_add(struct net_device *dev)
         /* prefix length - 96 bits "::d.d.d.d" */
         ip6_route_add(&cfg);
 }
+#endif
 
 static void addrconf_add_lroute(struct net_device *dev)
 {
@@ -1852,6 +1858,7 @@ int addrconf_set_dstaddr(void __user *arg)
         if (dev == NULL)
                 goto err_exit;
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT) {
                 struct ifreq ifr;
                 mm_segment_t    oldfs;
@@ -1881,6 +1888,7 @@ int addrconf_set_dstaddr(void __user *arg)
                         err = dev_open(dev);
                 }
         }
+#endif
 
 err_exit:
         rtnl_unlock();
@@ -2010,6 +2018,7 @@ int addrconf_del_ifaddr(void __user *arg)
         return err;
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_add_v4_addrs(struct inet6_dev *idev)
 {
         struct inet6_ifaddr * ifp;
@@ -2078,6 +2087,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                 }
         }
 }
+#endif
 
 static void init_loopback(struct net_device *dev)
 {
@@ -2141,6 +2151,7 @@ static void addrconf_dev_config(struct net_device *dev)
                 addrconf_add_linklocal(idev, &addr);
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void addrconf_sit_config(struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -2166,6 +2177,7 @@ static void addrconf_sit_config(struct net_device *dev)
         } else
                 sit_route_add(dev);
 }
+#endif
 
 static inline int
 ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
@@ -2260,9 +2272,11 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 }
 
                 switch(dev->type) {
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
                 case ARPHRD_SIT:
                         addrconf_sit_config(dev);
                         break;
+#endif
                 case ARPHRD_TUNNEL6:
                         addrconf_ip6_tnl_config(dev);
                         break;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e94eccb99707..858cae29581c 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -850,7 +850,6 @@ static int __init inet6_init(void)
         err = addrconf_init();
         if (err)
                 goto addrconf_fail;
-        sit_init();
 
         /* Init v6 extension headers. */
         ipv6_rthdr_init();
@@ -927,7 +926,6 @@ static void __exit inet6_exit(void)
         mip6_fini();
 #endif
         /* Cleanup code parts. */
-        sit_cleanup();
         ip6_flowlabel_cleanup();
         addrconf_cleanup();
         ip6_route_cleanup();
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index d8c1057e8b00..1896ecb52899 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -117,12 +117,15 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
         struct fib6_rule *r = (struct fib6_rule *) rule;
 
-        if (!ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
+        if (r->dst.plen &&
+            !ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
                 return 0;
 
-        if ((flags & RT6_LOOKUP_F_HAS_SADDR) &&
-            !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
-                return 0;
+        if (r->src.plen) {
+                if (!(flags & RT6_LOOKUP_F_HAS_SADDR) ||
+                    !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
+                        return 0;
+        }
 
         if (r->tclass && r->tclass != ((ntohl(fl->fl6_flowlabel) >> 20) & 0xff))
                 return 0;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 8fcae7a6510b..f98ca30d7c1f 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -169,7 +169,6 @@ static __inline__ void rt6_release(struct rt6_info *rt)
 
 static struct fib6_table fib6_main_tbl = {
         .tb6_id         = RT6_TABLE_MAIN,
-        .tb6_lock       = RW_LOCK_UNLOCKED,
         .tb6_root       = {
                 .leaf           = &ip6_null_entry,
                 .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
@@ -187,6 +186,12 @@ static void fib6_link_table(struct fib6_table *tb)
 {
         unsigned int h;
 
+        /*
+         * Initialize table lock at a single place to give lockdep a key,
+         * tables aren't visible prior to being linked to the list.
+         */
+        rwlock_init(&tb->tb6_lock);
+
         h = tb->tb6_id & (FIB_TABLE_HASHSZ - 1);
 
         /*
@@ -199,7 +204,6 @@ static void fib6_link_table(struct fib6_table *tb)
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 static struct fib6_table fib6_local_tbl = {
         .tb6_id         = RT6_TABLE_LOCAL,
-        .tb6_lock       = RW_LOCK_UNLOCKED,
         .tb6_root       = {
                 .leaf           = &ip6_null_entry,
                 .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
@@ -213,7 +217,6 @@ static struct fib6_table *fib6_alloc_table(u32 id)
         table = kzalloc(sizeof(*table), GFP_ATOMIC);
         if (table != NULL) {
                 table->tb6_id = id;
-                table->tb6_lock = RW_LOCK_UNLOCKED;
                 table->tb6_root.leaf = &ip6_null_entry;
                 table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
         }
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1d672b0547f2..6d4533b58dca 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -330,8 +330,10 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
         fl->share = freq->flr_share;
         addr_type = ipv6_addr_type(&freq->flr_dst);
         if ((addr_type&IPV6_ADDR_MAPPED)
-            || addr_type == IPV6_ADDR_ANY)
+            || addr_type == IPV6_ADDR_ANY) {
+                err = -EINVAL;
                 goto done;
+        }
         ipv6_addr_copy(&fl->dst, &freq->flr_dst);
         atomic_set(&fl->users, 1);
         switch (fl->share) {
@@ -587,6 +589,8 @@ static struct ip6_flowlabel *ip6fl_get_next(struct seq_file *seq, struct ip6_flo
         while (!fl) {
                 if (++state->bucket <= FL_HASH_MASK)
                         fl = fl_ht[state->bucket];
+                else
+                        break;
         }
         return fl;
 }
@@ -623,9 +627,13 @@ static void ip6fl_seq_stop(struct seq_file *seq, void *v)
         read_unlock_bh(&ip6_fl_lock);
 }
 
-static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
+static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
-        while(fl) {
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
+                           "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
+        else {
+                struct ip6_flowlabel *fl = v;
                 seq_printf(seq,
                            "%05X %-1d %-6d %-6d %-6ld %-8ld " NIP6_SEQFMT " %-4d\n",
                            (unsigned)ntohl(fl->label),
@@ -636,17 +644,7 @@ static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
                            (long)(fl->expires - jiffies)/HZ,
                            NIP6(fl->dst),
                            fl->opt ? fl->opt->opt_nflen : 0);
-                fl = fl->next;
         }
-}
-
-static int ip6fl_seq_show(struct seq_file *seq, void *v)
-{
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
-                           "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
-        else
-                ip6fl_fl_seq_show(seq, v);
         return 0;
 }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 84d7ebdb9d21..b9f40290d12a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -542,6 +542,7 @@ ip6ip6_rcv(struct sk_buff *skb)
                 skb->dev = t->dev;
                 dst_release(skb->dst);
                 skb->dst = NULL;
+                nf_reset(skb);
                 if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
                         ipv6_copy_dscp(ipv6h, skb->nh.ipv6h);
                 ip6ip6_ecn_decapsulate(ipv6h, skb);
@@ -1149,6 +1150,20 @@ fail:
         return err;
 }
 
+static void __exit ip6ip6_destroy_tunnels(void)
+{
+        int h;
+        struct ip6_tnl *t;
+
+        for (h = 0; h < HASH_SIZE; h++) {
+                while ((t = tnls_r_l[h]) != NULL)
+                        unregister_netdevice(t->dev);
+        }
+
+        t = tnls_wc[0];
+        unregister_netdevice(t->dev);
+}
+
 /**
  * ip6_tunnel_cleanup - free resources and unregister protocol
  **/
@@ -1158,7 +1173,9 @@ static void __exit ip6_tunnel_cleanup(void)
         if (xfrm6_tunnel_deregister(&ip6ip6_handler))
                 printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
 
-        unregister_netdev(ip6ip6_fb_tnl_dev);
+        rtnl_lock();
+        ip6ip6_destroy_tunnels();
+        rtnl_unlock();
 }
 
 module_init(ip6_tunnel_init);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0304b5fe8d6a..73eb8c33e9f0 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -967,8 +967,6 @@ static void ndisc_recv_na(struct sk_buff *skb)
                     ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
                     pneigh_lookup(&nd_tbl, &msg->target, dev, 0)) {
                         /* XXX: idev->cnf.prixy_ndp */
-                        WARN_ON(skb->dst != NULL &&
-                                ((struct rt6_info *)skb->dst)->rt6i_idev);
                         goto out;
                 }
 
@@ -1744,6 +1742,7 @@ int __init ndisc_init(struct net_proto_family *ops)
 
 void ndisc_cleanup(void)
 {
+        unregister_netdevice_notifier(&ndisc_netdev_notifier);
 #ifdef CONFIG_SYSCTL
         neigh_sysctl_unregister(&nd_tbl.parms);
 #endif
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 4bc4e5b33794..d7c45a9c15fe 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -40,7 +40,7 @@ config IP6_NF_QUEUE
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP6_NF_IPTABLES
-        tristate "IP6 tables support (required for filtering/masq/NAT)"
+        tristate "IP6 tables support (required for filtering)"
         depends on NETFILTER_XTABLES
         help
           ip6tables is a general, extensible packet identification framework.
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9510c24ca8d2..9fec832ee08b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -349,9 +349,10 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (v->data_len < sizeof(*user_iph))
                 return 0;
         diff = v->data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, v->data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, v->data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (v->data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 4ab368fa0b8f..204e02162d49 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -111,7 +111,7 @@ ip6_packet_match(const struct sk_buff *skb,
                  const char *outdev,
                  const struct ip6t_ip6 *ip6info,
                  unsigned int *protoff,
-                 int *fragoff)
+                 int *fragoff, int *hotdrop)
 {
         size_t i;
         unsigned long ret;
@@ -169,9 +169,11 @@ ip6_packet_match(const struct sk_buff *skb,
                 unsigned short _frag_off;
 
                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
-                if (protohdr < 0)
+                if (protohdr < 0) {
+                        if (_frag_off == 0)
+                                *hotdrop = 1;
                         return 0;
-
+                }
                 *fragoff = _frag_off;
 
                 dprintf("Packet protocol %hi ?= %s%hi.\n",
@@ -290,7 +292,7 @@ ip6t_do_table(struct sk_buff **pskb,
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
                 if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6,
-                        &protoff, &offset)) {
+                        &protoff, &offset, &hotdrop)) {
                         struct ip6t_entry_target *t;
 
                         if (IP6T_MATCH_ITERATE(e, do_match,
@@ -584,12 +586,19 @@ check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
                 return -EINVAL;
         }
 
+        if (e->target_offset + sizeof(struct ip6t_entry_target) >
+                                                                e->next_offset)
+                return -EINVAL;
+
         j = 0;
         ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6, e->comefrom, &j);
         if (ret != 0)
                 goto cleanup_matches;
 
         t = ip6t_get_target(e);
+        ret = -EINVAL;
+        if (e->target_offset + t->u.target_size > e->next_offset)
+                        goto cleanup_matches;
         target = try_then_request_module(xt_find_target(AF_INET6,
                                                         t->u.user.name,
                                                         t->u.user.revision),
@@ -749,19 +758,17 @@ translate_table(const char *name,
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
-                return -ELOOP;
-
         /* Finally, each sanity check must pass */
         i = 0;
         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
                                 check_entry, name, size, &i);
 
-        if (ret != 0) {
-                IP6T_ENTRY_ITERATE(entry0, newinfo->size,
-                                  cleanup_entry, &i);
-                return ret;
-        }
+        if (ret != 0)
+                goto cleanup;
+
+        ret = -ELOOP;
+        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+                goto cleanup;
 
         /* And one copy for every other CPU */
         for_each_possible_cpu(i) {
@@ -769,6 +776,9 @@ translate_table(const char *name,
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
 
+        return 0;
+cleanup:
+        IP6T_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
         return ret;
 }
 
@@ -1438,6 +1448,9 @@ static void __exit ip6_tables_fini(void)
  * If target header is found, its offset is set in *offset and return protocol
  * number. Otherwise, return -1.
  *
+ * If the first fragment doesn't contain the final protocol header or
+ * NEXTHDR_NONE it is considered invalid.
+ *
  * Note that non-1st fragment is special case that "the protocol number
  * of last header" is "next header" field in Fragment header. In this case,
  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
@@ -1461,12 +1474,12 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
                         if (target < 0)
                                 break;
-                        return -1;
+                        return -ENOENT;
                 }
 
                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
                 if (hp == NULL)
-                        return -1;
+                        return -EBADMSG;
                 if (nexthdr == NEXTHDR_FRAGMENT) {
                         unsigned short _frag_off, *fp;
                         fp = skb_header_pointer(skb,
@@ -1475,18 +1488,18 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                                                 sizeof(_frag_off),
                                                 &_frag_off);
                         if (fp == NULL)
-                                return -1;
+                                return -EBADMSG;
 
                         _frag_off = ntohs(*fp) & ~0x7;
                         if (_frag_off) {
                                 if (target < 0 &&
                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
-                                     nexthdr == NEXTHDR_NONE)) {
+                                     hp->nexthdr == NEXTHDR_NONE)) {
                                         if (fragoff)
                                                 *fragoff = _frag_off;
                                         return hp->nexthdr;
                                 }
-                                return -1;
+                                return -ENOENT;
                         }
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index ec1b1608156c..46486645eb75 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -54,9 +54,14 @@ match(const struct sk_buff *skb,
         const struct ip6t_ah *ahinfo = matchinfo;
         unsigned int ptr;
         unsigned int hdrlen = 0;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
         if (ah == NULL) {
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 78d9c8b9e28a..cd22eaaccdca 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -52,9 +52,14 @@ match(const struct sk_buff *skb,
         struct frag_hdr _frag, *fh;
         const struct ip6t_frag *fraginfo = matchinfo;
         unsigned int ptr;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
         if (fh == NULL) {
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index d32a205e3af2..3f25babe0440 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -65,9 +65,14 @@ match(const struct sk_buff *skb,
         u8 _opttype, *tp = NULL;
         u8 _optlen, *lp = NULL;
         unsigned int optlen;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, match->data, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
         if (oh == NULL) {
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index bcb2e168a5bc..54d7d14134fd 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -58,9 +58,14 @@ match(const struct sk_buff *skb,
         unsigned int hdrlen = 0;
         unsigned int ret = 0;
         struct in6_addr *ap, _addr;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
         if (rh == NULL) {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d09329ca3267..d6dedc4aec77 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -604,7 +604,7 @@ error:
         return err; 
 }
 
-static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
+static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 {
         struct iovec *iov;
         u8 __user *type = NULL;
@@ -616,7 +616,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
         int i;
 
         if (!msg->msg_iov)
-                return;
+                return 0;
 
         for (i = 0; i < msg->msg_iovlen; i++) {
                 iov = &msg->msg_iov[i];
@@ -638,8 +638,9 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                 code = iov->iov_base;
 
                         if (type && code) {
-                                get_user(fl->fl_icmp_type, type);
-                                get_user(fl->fl_icmp_code, code);
+                                if (get_user(fl->fl_icmp_type, type) ||
+                                    get_user(fl->fl_icmp_code, code))
+                                        return -EFAULT;
                                 probed = 1;
                         }
                         break;
@@ -650,7 +651,8 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                         /* check if type field is readable or not. */
                         if (iov->iov_len > 2 - len) {
                                 u8 __user *p = iov->iov_base;
-                                get_user(fl->fl_mh_type, &p[2 - len]);
+                                if (get_user(fl->fl_mh_type, &p[2 - len]))
+                                        return -EFAULT;
                                 probed = 1;
                         } else
                                 len += iov->iov_len;
@@ -664,6 +666,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                 if (probed)
                         break;
         }
+        return 0;
 }
 
 static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
@@ -787,7 +790,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         opt = ipv6_fixup_options(&opt_space, opt);
 
         fl.proto = proto;
-        rawv6_probe_proto_opt(&fl, msg);
+        err = rawv6_probe_proto_opt(&fl, msg);
+        if (err)
+                goto out;
  
         ipv6_addr_copy(&fl.fl6_dst, daddr);
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d6b4b4f48d18..b39ae99122d5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -141,6 +141,10 @@ struct rt6_info ip6_null_entry = {
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 
+static int ip6_pkt_prohibit(struct sk_buff *skb);
+static int ip6_pkt_prohibit_out(struct sk_buff *skb);
+static int ip6_pkt_blk_hole(struct sk_buff *skb);
+
 struct rt6_info ip6_prohibit_entry = {
         .u = {
                 .dst = {
@@ -150,8 +154,8 @@ struct rt6_info ip6_prohibit_entry = {
                         .obsolete       = -1,
                         .error          = -EACCES,
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
-                        .input          = ip6_pkt_discard,
-                        .output         = ip6_pkt_discard_out,
+                        .input          = ip6_pkt_prohibit,
+                        .output         = ip6_pkt_prohibit_out,
                         .ops            = &ip6_dst_ops,
                         .path           = (struct dst_entry*)&ip6_prohibit_entry,
                 }
@@ -170,8 +174,8 @@ struct rt6_info ip6_blk_hole_entry = {
                         .obsolete       = -1,
                         .error          = -EINVAL,
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
-                        .input          = ip6_pkt_discard,
-                        .output         = ip6_pkt_discard_out,
+                        .input          = ip6_pkt_blk_hole,
+                        .output         = ip6_pkt_blk_hole,
                         .ops            = &ip6_dst_ops,
                         .path           = (struct dst_entry*)&ip6_blk_hole_entry,
                 }
@@ -326,6 +330,8 @@ static int inline rt6_check_neigh(struct rt6_info *rt)
                 read_lock_bh(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID)
                         m = 2;
+                else if (!(neigh->nud_state & NUD_FAILED))
+                        m = 1;
                 read_unlock_bh(&neigh->lock);
         }
         return m;
@@ -343,9 +349,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
         n = rt6_check_neigh(rt);
-        if (n > 1)
-                m |= 16;
-        else if (!n && strict & RT6_LOOKUP_F_REACHABLE)
+        if (!n && (strict & RT6_LOOKUP_F_REACHABLE))
                 return -1;
         return m;
 }
@@ -376,10 +380,11 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
                         continue;
 
                 if (m > mpri) {
-                        rt6_probe(match);
+                        if (strict & RT6_LOOKUP_F_REACHABLE)
+                                rt6_probe(match);
                         match = rt;
                         mpri = m;
-                } else {
+                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
                         rt6_probe(rt);
                 }
         }
@@ -484,7 +489,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
 do { \
         if (rt == &ip6_null_entry) { \
                 struct fib6_node *pn; \
-                while (fn) { \
+                while (1) { \
                         if (fn->fn_flags & RTN_TL_ROOT) \
                                 goto out; \
                         pn = fn->parent; \
@@ -529,13 +534,17 @@ struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
                 .nl_u = {
                         .ip6_u = {
                                 .daddr = *daddr,
-                                /* TODO: saddr */
                         },
                 },
         };
         struct dst_entry *dst;
         int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
 
+        if (saddr) {
+                memcpy(&fl.fl6_src, saddr, sizeof(*saddr));
+                flags |= RT6_LOOKUP_F_HAS_SADDR;
+        }
+
         dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_lookup);
         if (dst->error == 0)
                 return (struct rt6_info *) dst;
@@ -614,8 +623,6 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
                 ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
                 rt->rt6i_dst.plen = 128;
                 rt->rt6i_flags |= RTF_CACHE;
-                if (rt->rt6i_flags & RTF_REJECT)
-                        rt->u.dst.error = ort->u.dst.error;
                 rt->u.dst.flags |= DST_HOST;
                 rt->rt6i_nexthop = neigh_clone(ort->rt6i_nexthop);
         }
@@ -630,7 +637,7 @@ static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = RT6_LOOKUP_F_REACHABLE;
+        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -697,6 +704,7 @@ out2:
 void ip6_route_input(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = skb->nh.ipv6h;
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct flowi fl = {
                 .iif = skb->dev->ifindex,
                 .nl_u = {
@@ -711,7 +719,9 @@ void ip6_route_input(struct sk_buff *skb)
                 },
                 .proto = iph->nexthdr,
         };
-        int flags = rt6_need_strict(&iph->daddr) ? RT6_LOOKUP_F_IFACE : 0;
+
+        if (rt6_need_strict(&iph->daddr))
+                flags |= RT6_LOOKUP_F_IFACE;
 
         skb->dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_input);
 }
@@ -724,7 +734,7 @@ static struct rt6_info *ip6_pol_route_output(struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = RT6_LOOKUP_F_REACHABLE;
+        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -794,6 +804,9 @@ struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
         if (rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
+        if (!ipv6_addr_any(&fl->fl6_src))
+                flags |= RT6_LOOKUP_F_HAS_SADDR;
+
         return fib6_rule_lookup(fl, flags, ip6_pol_route_output);
 }
 
@@ -1345,6 +1358,7 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                            struct in6_addr *gateway,
                                            struct net_device *dev)
 {
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct ip6rd_flowi rdfl = {
                 .fl = {
                         .oif = dev->ifindex,
@@ -1357,7 +1371,9 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                 },
                 .gateway = *gateway,
         };
-        int flags = rt6_need_strict(dest) ? RT6_LOOKUP_F_IFACE : 0;
+
+        if (rt6_need_strict(dest))
+                flags |= RT6_LOOKUP_F_IFACE;
 
         return (struct rt6_info *)fib6_rule_lookup((struct flowi *)&rdfl, flags, __ip6_route_redirect);
 }
@@ -1527,6 +1543,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
                 rt->u.dst.output = ort->u.dst.output;
 
                 memcpy(rt->u.dst.metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
+                rt->u.dst.error = ort->u.dst.error;
                 rt->u.dst.dev = ort->u.dst.dev;
                 if (rt->u.dst.dev)
                         dev_hold(rt->u.dst.dev);
@@ -1730,24 +1747,50 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
  *      Drop the packet on the floor
  */
 
-static int ip6_pkt_discard(struct sk_buff *skb)
+static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
 {
         int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
         if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
                 IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
 
         IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
         kfree_skb(skb);
         return 0;
 }
 
+static int ip6_pkt_discard(struct sk_buff *skb)
+{
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE);
+}
+
 static int ip6_pkt_discard_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
         return ip6_pkt_discard(skb);
 }
 
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+
+static int ip6_pkt_prohibit(struct sk_buff *skb)
+{
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED);
+}
+
+static int ip6_pkt_prohibit_out(struct sk_buff *skb)
+{
+        skb->dev = skb->dst->dev;
+        return ip6_pkt_prohibit(skb);
+}
+
+static int ip6_pkt_blk_hole(struct sk_buff *skb)
+{
+        kfree_skb(skb);
+        return 0;
+}
+
+#endif
+
 /*
  *      Allocate a dst for local (unicast / anycast) address.
  */
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 836eecd7e62b..be699f85b2c7 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -850,3 +850,8 @@ int __init sit_init(void)
         inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
         goto out;
 }
+
+module_init(sit_init);
+module_exit(sit_cleanup);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("sit0");
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3b6575478fcc..4c2a7c0cafef 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -329,7 +329,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         if (sk->sk_state == TCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -653,7 +653,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         int tot_len = sizeof(struct tcphdr);
 
         if (ts)
-                tot_len += 3*4;
+                tot_len += TCPOLEN_TSTAMP_ALIGNED;
 
         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
                          GFP_ATOMIC);
@@ -749,7 +749,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -1283,18 +1283,17 @@ discard_and_relse:
 
 do_time_wait:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
-        switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-                                           skb, th)) {
+        switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
         case TCP_TW_SYN:
         {
                 struct sock *sk2;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e0c3934a7e4b..c83f23e51c46 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -242,14 +242,13 @@ static void udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct ipv6_pinfo *np;
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
-        struct net_device *dev = skb->dev;
         struct in6_addr *saddr = &hdr->saddr;
         struct in6_addr *daddr = &hdr->daddr;
         struct udphdr *uh = (struct udphdr*)(skb->data+offset);
         struct sock *sk;
         int err;
 
-        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, dev->ifindex);
+        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, inet6_iif(skb));
    
         if (sk == NULL)
                 return;
@@ -348,7 +347,7 @@ static void udpv6_mcast_deliver(struct udphdr *uh,
 
         read_lock(&udp_hash_lock);
         sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
-        dif = skb->dev->ifindex;
+        dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
                 kfree_skb(skb);
@@ -429,7 +428,7 @@ static int udpv6_rcv(struct sk_buff **pskb)
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
-        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, dev->ifindex);
+        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, inet6_iif(skb));
 
         if (sk == NULL) {
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6a252e2134d1..d400f8fae129 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -25,12 +25,14 @@
 static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 
-static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
+static int xfrm6_dst_lookup(struct xfrm_dst **xdst, struct flowi *fl)
 {
-        int err = 0;
-        *dst = (struct xfrm_dst*)ip6_route_output(NULL, fl);
-        if (!*dst)
-                err = -ENETUNREACH;
+        struct dst_entry *dst = ip6_route_output(NULL, fl);
+        int err = dst->error;
+        if (!err)
+                *xdst = (struct xfrm_dst *) dst;
+        else
+                dst_release(dst);
         return err;
 }
 
@@ -73,7 +75,7 @@ __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                                  xdst->u.rt6.rt6i_src.plen);
                 if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
                     ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
-                    xfrm_bundle_ok(xdst, fl, AF_INET6,
+                    xfrm_bundle_ok(policy, xdst, fl, AF_INET6,
                                    (xdst->u.rt6.rt6i_dst.plen != 128 ||
                                     xdst->u.rt6.rt6i_src.plen != 128))) {
                         dst_clone(dst);
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 7af227bb1551..7931e4f898d4 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -135,7 +135,7 @@ u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
         x6spi = __xfrm6_tunnel_spi_lookup(saddr);
         spi = x6spi ? x6spi->spi : 0;
         read_unlock_bh(&xfrm6_tunnel_spi_lock);
-        return spi;
+        return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_spi_lookup);
@@ -210,7 +210,7 @@ u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
                 spi = __xfrm6_tunnel_alloc_spi(saddr);
         write_unlock_bh(&xfrm6_tunnel_spi_lock);
 
-        return spi;
+        return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);