Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

Conflicts:

	net/netfilter/nf_conntrack_netlink.c

19 files changed, 289 insertions, 114 deletions

diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 38aedeeaf4e..4f8fcf49854 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -30,6 +30,7 @@ MODULE_AUTHOR("Brian J. Murrell <netfilter@interlinx.bc.ca>");
 MODULE_DESCRIPTION("Amanda connection tracking module");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_amanda");
+MODULE_ALIAS_NFCT_HELPER("amanda");
 
 module_param(master_timeout, uint, 0600);
 MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 233fdd2d7d2..7e83f74cd5d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -39,13 +39,13 @@
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_acct.h>
 #include <net/netfilter/nf_nat.h>
+#include <net/netfilter/nf_nat_core.h>
 
 #define NF_CONNTRACK_VERSION    "0.5.0"
 
-unsigned int
-(*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
-                                  enum nf_nat_manip_type manip,
-                                  struct nlattr *attr) __read_mostly;
+int (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
+                                      enum nf_nat_manip_type manip,
+                                      struct nlattr *attr) __read_mostly;
 EXPORT_SYMBOL_GPL(nfnetlink_parse_nat_setup_hook);
 
 DEFINE_SPINLOCK(nf_conntrack_lock);
@@ -181,7 +181,8 @@ destroy_conntrack(struct nf_conntrack *nfct)
         NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
         NF_CT_ASSERT(!timer_pending(&ct->timeout));
 
-        nf_conntrack_event(IPCT_DESTROY, ct);
+        if (!test_bit(IPS_DYING_BIT, &ct->status))
+                nf_conntrack_event(IPCT_DESTROY, ct);
         set_bit(IPS_DYING_BIT, &ct->status);
 
         /* To make sure we don't get any weird locking issues here:
@@ -586,14 +587,7 @@ init_conntrack(struct net *net,
                 nf_conntrack_get(&ct->master->ct_general);
                 NF_CT_STAT_INC(net, expect_new);
         } else {
-                struct nf_conntrack_helper *helper;
-
-                helper = __nf_ct_helper_find(&repl_tuple);
-                if (helper) {
-                        help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
-                        if (help)
-                                rcu_assign_pointer(help->helper, helper);
-                }
+                __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
                 NF_CT_STAT_INC(net, new);
         }
 
@@ -770,7 +764,6 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
                               const struct nf_conntrack_tuple *newreply)
 {
         struct nf_conn_help *help = nfct_help(ct);
-        struct nf_conntrack_helper *helper;
 
         /* Should be unconfirmed, so not in hash table yet */
         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
@@ -783,23 +776,7 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
                 return;
 
         rcu_read_lock();
-        helper = __nf_ct_helper_find(newreply);
-        if (helper == NULL) {
-                if (help)
-                        rcu_assign_pointer(help->helper, NULL);
-                goto out;
-        }
-
-        if (help == NULL) {
-                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
-                if (help == NULL)
-                        goto out;
-        } else {
-                memset(&help->help, 0, sizeof(help->help));
-        }
-
-        rcu_assign_pointer(help->helper, helper);
-out:
+        __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
         rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
@@ -994,8 +971,20 @@ void nf_ct_iterate_cleanup(struct net *net,
 }
 EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
 
+struct __nf_ct_flush_report {
+        u32 pid;
+        int report;
+};
+
 static int kill_all(struct nf_conn *i, void *data)
 {
+        struct __nf_ct_flush_report *fr = (struct __nf_ct_flush_report *)data;
+
+        /* get_next_corpse sets the dying bit for us */
+        nf_conntrack_event_report(IPCT_DESTROY,
+                                  i,
+                                  fr->pid,
+                                  fr->report);
         return 1;
 }
 
@@ -1009,9 +998,13 @@ void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, unsigned int s
 }
 EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
 
-void nf_conntrack_flush(struct net *net)
+void nf_conntrack_flush(struct net *net, u32 pid, int report)
 {
-        nf_ct_iterate_cleanup(net, kill_all, NULL);
+        struct __nf_ct_flush_report fr = {
+                .pid    = pid,
+                .report = report,
+        };
+        nf_ct_iterate_cleanup(net, kill_all, &fr);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_flush);
 
@@ -1027,7 +1020,7 @@ static void nf_conntrack_cleanup_net(struct net *net)
         nf_ct_event_cache_flush(net);
         nf_conntrack_ecache_fini(net);
  i_see_dead_people:
-        nf_conntrack_flush(net);
+        nf_conntrack_flush(net, 0, 0);
         if (atomic_read(&net->ct.count) != 0) {
                 schedule();
                 goto i_see_dead_people;
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index a5f5e2e65d1..dee4190209c 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -35,9 +35,17 @@ static inline void
 __nf_ct_deliver_cached_events(struct nf_conntrack_ecache *ecache)
 {
         if (nf_ct_is_confirmed(ecache->ct) && !nf_ct_is_dying(ecache->ct)
-            && ecache->events)
-                atomic_notifier_call_chain(&nf_conntrack_chain, ecache->events,
-                                    ecache->ct);
+            && ecache->events) {
+                struct nf_ct_event item = {
+                        .ct     = ecache->ct,
+                        .pid    = 0,
+                        .report = 0
+                };
+
+                atomic_notifier_call_chain(&nf_conntrack_chain,
+                                           ecache->events,
+                                           &item);
+        }
 
         ecache->events = 0;
         nf_ct_put(ecache->ct);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 37a703bc3b8..3a8a34a6d37 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -362,7 +362,7 @@ static inline int refresh_timer(struct nf_conntrack_expect *i)
         return 1;
 }
 
-int nf_ct_expect_related(struct nf_conntrack_expect *expect)
+static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
 {
         const struct nf_conntrack_expect_policy *p;
         struct nf_conntrack_expect *i;
@@ -371,11 +371,8 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
         struct net *net = nf_ct_exp_net(expect);
         struct hlist_node *n;
         unsigned int h;
-        int ret;
-
-        NF_CT_ASSERT(master_help);
+        int ret = 0;
 
-        spin_lock_bh(&nf_conntrack_lock);
         if (!master_help->helper) {
                 ret = -ESHUTDOWN;
                 goto out;
@@ -409,18 +406,50 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
                         printk(KERN_WARNING
                                "nf_conntrack: expectation table full\n");
                 ret = -EMFILE;
-                goto out;
         }
+out:
+        return ret;
+}
+
+int nf_ct_expect_related(struct nf_conntrack_expect *expect)
+{
+        int ret;
+
+        spin_lock_bh(&nf_conntrack_lock);
+        ret = __nf_ct_expect_check(expect);
+        if (ret < 0)
+                goto out;
 
         nf_ct_expect_insert(expect);
+        atomic_inc(&expect->use);
+        spin_unlock_bh(&nf_conntrack_lock);
         nf_ct_expect_event(IPEXP_NEW, expect);
-        ret = 0;
+        nf_ct_expect_put(expect);
+        return ret;
 out:
         spin_unlock_bh(&nf_conntrack_lock);
         return ret;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_related);
 
+int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, 
+                                u32 pid, int report)
+{
+        int ret;
+
+        spin_lock_bh(&nf_conntrack_lock);
+        ret = __nf_ct_expect_check(expect);
+        if (ret < 0)
+                goto out;
+        nf_ct_expect_insert(expect);
+out:
+        spin_unlock_bh(&nf_conntrack_lock);
+        if (ret == 0)
+                nf_ct_expect_event_report(IPEXP_NEW, expect, pid, report);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nf_ct_expect_related_report);
+
 #ifdef CONFIG_PROC_FS
 struct ct_expect_iter_state {
         struct seq_net_private p;
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 629500901bd..00fecc385f9 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -29,6 +29,7 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
 MODULE_DESCRIPTION("ftp connection tracking helper");
 MODULE_ALIAS("ip_conntrack_ftp");
+MODULE_ALIAS_NFCT_HELPER("ftp");
 
 /* This is slow, but it's simple. --RR */
 static char *ftp_buffer;
@@ -357,7 +358,7 @@ static int help(struct sk_buff *skb,
         int ret;
         u32 seq;
         int dir = CTINFO2DIR(ctinfo);
-        unsigned int matchlen, matchoff;
+        unsigned int uninitialized_var(matchlen), uninitialized_var(matchoff);
         struct nf_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
         struct nf_conntrack_expect *exp;
         union nf_inet_addr *daddr;
@@ -427,10 +428,8 @@ static int help(struct sk_buff *skb,
                    connection tracking, not packet filtering.
                    However, it is necessary for accurate tracking in
                    this case. */
-                if (net_ratelimit())
-                        printk("conntrack_ftp: partial %s %u+%u\n",
-                               search[dir][i].pattern,
-                               ntohl(th->seq), datalen);
+                pr_debug("conntrack_ftp: partial %s %u+%u\n",
+                         search[dir][i].pattern,  ntohl(th->seq), datalen);
                 ret = NF_DROP;
                 goto out;
         } else if (found == 0) { /* No match */
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 99bc803d1dd..687bd633c3d 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1827,3 +1827,4 @@ MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
 MODULE_DESCRIPTION("H.323 connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_h323");
+MODULE_ALIAS_NFCT_HELPER("h323");
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index c39b6a99413..a51bdac9f3a 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -45,7 +45,7 @@ static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple)
                 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize;
 }
 
-struct nf_conntrack_helper *
+static struct nf_conntrack_helper *
 __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_helper *helper;
@@ -63,7 +63,6 @@ __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
         }
         return NULL;
 }
-EXPORT_SYMBOL_GPL(__nf_ct_helper_find);
 
 struct nf_conntrack_helper *
 __nf_conntrack_helper_find_byname(const char *name)
@@ -95,6 +94,35 @@ struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp)
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
 
+int __nf_ct_try_assign_helper(struct nf_conn *ct, gfp_t flags)
+{
+        int ret = 0;
+        struct nf_conntrack_helper *helper;
+        struct nf_conn_help *help = nfct_help(ct);
+
+        helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        if (helper == NULL) {
+                if (help)
+                        rcu_assign_pointer(help->helper, NULL);
+                goto out;
+        }
+
+        if (help == NULL) {
+                help = nf_ct_helper_ext_add(ct, flags);
+                if (help == NULL) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+        } else {
+                memset(&help->help, 0, sizeof(help->help));
+        }
+
+        rcu_assign_pointer(help->helper, helper);
+out:
+        return ret;
+}
+EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper);
+
 static inline int unhelp(struct nf_conntrack_tuple_hash *i,
                          const struct nf_conntrack_helper *me)
 {
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 4d681a04447..409c8be58e7 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -41,6 +41,7 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_irc");
+MODULE_ALIAS_NFCT_HELPER("irc");
 
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index 08404e6755f..5af4273b466 100644
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -37,6 +37,7 @@ MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 MODULE_DESCRIPTION("NetBIOS name service broadcast connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_netbios_ns");
+MODULE_ALIAS_NFCT_HELPER("netbios_ns");
 
 static unsigned int timeout __read_mostly = 3;
 module_param(timeout, uint, 0400);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 5f4a6516b3b..00e8c27130f 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -105,16 +105,14 @@ ctnetlink_dump_tuples(struct sk_buff *skb,
         struct nf_conntrack_l3proto *l3proto;
         struct nf_conntrack_l4proto *l4proto;
 
-        l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
+        l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
         ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
-        nf_ct_l3proto_put(l3proto);
 
         if (unlikely(ret < 0))
                 return ret;
 
-        l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
+        l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
         ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
-        nf_ct_l4proto_put(l4proto);
 
         return ret;
 }
@@ -151,11 +149,9 @@ ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
         struct nlattr *nest_proto;
         int ret;
 
-        l4proto = nf_ct_l4proto_find_get(nf_ct_l3num(ct), nf_ct_protonum(ct));
-        if (!l4proto->to_nlattr) {
-                nf_ct_l4proto_put(l4proto);
+        l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
+        if (!l4proto->to_nlattr)
                 return 0;
-        }
 
         nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
         if (!nest_proto)
@@ -163,14 +159,11 @@ ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
 
         ret = l4proto->to_nlattr(skb, nest_proto, ct);
 
-        nf_ct_l4proto_put(l4proto);
-
         nla_nest_end(skb, nest_proto);
 
         return ret;
 
 nla_put_failure:
-        nf_ct_l4proto_put(l4proto);
         return -1;
 }
 
@@ -184,7 +177,6 @@ ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
         if (!help)
                 return 0;
 
-        rcu_read_lock();
         helper = rcu_dereference(help->helper);
         if (!helper)
                 goto out;
@@ -199,11 +191,9 @@ ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
 
         nla_nest_end(skb, nest_helper);
 out:
-        rcu_read_unlock();
         return 0;
 
 nla_put_failure:
-        rcu_read_unlock();
         return -1;
 }
 
@@ -420,7 +410,8 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
         struct nlattr *nest_parms;
-        struct nf_conn *ct = (struct nf_conn *)ptr;
+        struct nf_ct_event *item = (struct nf_ct_event *)ptr;
+        struct nf_conn *ct = item->ct;
         struct sk_buff *skb;
         unsigned int type;
         sk_buff_data_t b;
@@ -453,7 +444,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         b = skb->tail;
 
         type |= NFNL_SUBSYS_CTNETLINK << 8;
-        nlh   = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
+        nlh   = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
         nfmsg = NLMSG_DATA(nlh);
 
         nlh->nlmsg_flags    = flags;
@@ -461,6 +452,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         nfmsg->version  = NFNETLINK_V0;
         nfmsg->res_id   = 0;
 
+        rcu_read_lock();
         nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
         if (!nest_parms)
                 goto nla_put_failure;
@@ -517,13 +509,15 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
             && ctnetlink_dump_mark(skb, ct) < 0)
                 goto nla_put_failure;
 #endif
+        rcu_read_unlock();
 
         nlh->nlmsg_len = skb->tail - b;
-        nfnetlink_send(skb, 0, group, 0);
+        nfnetlink_send(skb, item->pid, group, item->report);
         return NOTIFY_DONE;
 
-nlmsg_failure:
 nla_put_failure:
+        rcu_read_unlock();
+nlmsg_failure:
         kfree_skb(skb);
         return NOTIFY_DONE;
 }
@@ -729,7 +723,9 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
         else {
                 /* Flush the whole table */
-                nf_conntrack_flush(&init_net);
+                nf_conntrack_flush(&init_net, 
+                                   NETLINK_CB(skb).pid, 
+                                   nlmsg_report(nlh));
                 return 0;
         }
 
@@ -750,6 +746,14 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 }
         }
 
+        nf_conntrack_event_report(IPCT_DESTROY,
+                                  ct,
+                                  NETLINK_CB(skb).pid,
+                                  nlmsg_report(nlh));
+
+        /* death_by_timeout would report the event again */
+        set_bit(IPS_DYING_BIT, &ct->status);
+
         nf_ct_kill(ct);
         nf_ct_put(ct);
 
@@ -795,8 +799,10 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return -ENOMEM;
         }
 
+        rcu_read_lock();
         err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
                                   IPCTNL_MSG_CT_NEW, 1, ct);
+        rcu_read_unlock();
         nf_ct_put(ct);
         if (err <= 0)
                 goto free;
@@ -922,8 +928,22 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
         }
 
         helper = __nf_conntrack_helper_find_byname(helpname);
-        if (helper == NULL)
+        if (helper == NULL) {
+#ifdef CONFIG_MODULES
+                spin_unlock_bh(&nf_conntrack_lock);
+
+                if (request_module("nfct-helper-%s", helpname) < 0) {
+                        spin_lock_bh(&nf_conntrack_lock);
+                        return -EOPNOTSUPP;
+                }
+
+                spin_lock_bh(&nf_conntrack_lock);
+                helper = __nf_conntrack_helper_find_byname(helpname);
+                if (helper)
+                        return -EAGAIN;
+#endif
                 return -EOPNOTSUPP;
+        }
 
         if (help) {
                 if (help->helper == helper)
@@ -1079,15 +1099,38 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
         return 0;
 }
 
+static inline void
+ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
+{
+        unsigned int events = 0;
+
+        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
+                events |= IPCT_RELATED;
+        else
+                events |= IPCT_NEW;
+
+        nf_conntrack_event_report(IPCT_STATUS |
+                                  IPCT_HELPER |
+                                  IPCT_REFRESH |
+                                  IPCT_PROTOINFO |
+                                  IPCT_NATSEQADJ |
+                                  IPCT_MARK |
+                                  events,
+                                  ct,
+                                  pid,
+                                  report);
+}
+
 static int
 ctnetlink_create_conntrack(struct nlattr *cda[],
                            struct nf_conntrack_tuple *otuple,
                            struct nf_conntrack_tuple *rtuple,
-                           struct nf_conn *master_ct)
+                           struct nf_conn *master_ct,
+                           u32 pid,
+                           int report)
 {
         struct nf_conn *ct;
         int err = -EINVAL;
-        struct nf_conn_help *help;
         struct nf_conntrack_helper *helper;
 
         ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
@@ -1102,16 +1145,55 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         ct->status |= IPS_CONFIRMED;
 
         rcu_read_lock();
-        helper = __nf_ct_helper_find(rtuple);
-        if (helper) {
-                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
-                if (help == NULL) {
+        if (cda[CTA_HELP]) {
+                char *helpname;
+ 
+                err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
+                if (err < 0) {
+                        rcu_read_unlock();
+                        goto err;
+                }
+
+                helper = __nf_conntrack_helper_find_byname(helpname);
+                if (helper == NULL) {
+                        rcu_read_unlock();
+#ifdef CONFIG_MODULES
+                        if (request_module("nfct-helper-%s", helpname) < 0) {
+                                err = -EOPNOTSUPP;
+                                goto err;
+                        }
+
+                        rcu_read_lock();
+                        helper = __nf_conntrack_helper_find_byname(helpname);
+                        if (helper) {
+                                rcu_read_unlock();
+                                err = -EAGAIN;
+                                goto err;
+                        }
+                        rcu_read_unlock();
+#endif
+                        err = -EOPNOTSUPP;
+                        goto err;
+                } else {
+                        struct nf_conn_help *help;
+
+                        help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
+                        if (help == NULL) {
+                                rcu_read_unlock();
+                                err = -ENOMEM;
+                                goto err;
+                        }
+
+                        /* not in hash table yet so not strictly necessary */
+                        rcu_assign_pointer(help->helper, helper);
+                }
+        } else {
+                /* try an implicit helper assignation */
+                err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
+                if (err < 0) {
                         rcu_read_unlock();
-                        err = -ENOMEM;
                         goto err;
                 }
-                /* not in hash table yet so not strictly necessary */
-                rcu_assign_pointer(help->helper, helper);
         }
 
         if (cda[CTA_STATUS]) {
@@ -1151,9 +1233,12 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 ct->master = master_ct;
         }
 
+        nf_conntrack_get(&ct->ct_general);
         add_timer(&ct->timeout);
         nf_conntrack_hash_insert(ct);
         rcu_read_unlock();
+        ctnetlink_event_report(ct, pid, report);
+        nf_ct_put(ct);
 
         return 0;
 
@@ -1209,7 +1294,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                 goto out_unlock;
                         }
                         master_ct = nf_ct_tuplehash_to_ctrack(master_h);
-                        atomic_inc(&master_ct->ct_general.use);
+                        nf_conntrack_get(&master_ct->ct_general);
                 }
 
                 err = -ENOENT;
@@ -1217,9 +1302,10 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         err = ctnetlink_create_conntrack(cda,
                                                          &otuple,
                                                          &rtuple,
-                                                         master_ct);
+                                                         master_ct,
+                                                         NETLINK_CB(skb).pid,
+                                                         nlmsg_report(nlh));
                 spin_unlock_bh(&nf_conntrack_lock);
-
                 if (err < 0 && master_ct)
                         nf_ct_put(master_ct);
 
@@ -1231,6 +1317,8 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
          * so there's no need to increase the refcount */
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
+                struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
+
                 /* we only allow nat config for new conntracks */
                 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
                         err = -EOPNOTSUPP;
@@ -1241,8 +1329,19 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         err = -EOPNOTSUPP;
                         goto out_unlock;
                 }
-                err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h),
-                                                 cda);
+
+                err = ctnetlink_change_conntrack(ct, cda);
+                if (err == 0) {
+                        nf_conntrack_get(&ct->ct_general);
+                        spin_unlock_bh(&nf_conntrack_lock);
+                        ctnetlink_event_report(ct,
+                                               NETLINK_CB(skb).pid,
+                                               nlmsg_report(nlh));
+                        nf_ct_put(ct);
+                } else
+                        spin_unlock_bh(&nf_conntrack_lock);
+
+                return err;
         }
 
 out_unlock:
@@ -1293,16 +1392,14 @@ ctnetlink_exp_dump_mask(struct sk_buff *skb,
         if (!nest_parms)
                 goto nla_put_failure;
 
-        l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
+        l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
         ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
-        nf_ct_l3proto_put(l3proto);
 
         if (unlikely(ret < 0))
                 goto nla_put_failure;
 
-        l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
+        l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
         ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
-        nf_ct_l4proto_put(l4proto);
         if (unlikely(ret < 0))
                 goto nla_put_failure;
 
@@ -1379,7 +1476,8 @@ static int ctnetlink_expect_event(struct notifier_block *this,
 {
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
-        struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
+        struct nf_exp_event *item = (struct nf_exp_event *)ptr;
+        struct nf_conntrack_expect *exp = item->exp;
         struct sk_buff *skb;
         unsigned int type;
         sk_buff_data_t b;
@@ -1401,7 +1499,7 @@ static int ctnetlink_expect_event(struct notifier_block *this,
         b = skb->tail;
 
         type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
-        nlh   = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
+        nlh   = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
         nfmsg = NLMSG_DATA(nlh);
 
         nlh->nlmsg_flags    = flags;
@@ -1409,15 +1507,18 @@ static int ctnetlink_expect_event(struct notifier_block *this,
         nfmsg->version      = NFNETLINK_V0;
         nfmsg->res_id       = 0;
 
+        rcu_read_lock();
         if (ctnetlink_exp_dump_expect(skb, exp) < 0)
                 goto nla_put_failure;
+        rcu_read_unlock();
 
         nlh->nlmsg_len = skb->tail - b;
-        nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
+        nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW, item->report);
         return NOTIFY_DONE;
 
-nlmsg_failure:
 nla_put_failure:
+        rcu_read_unlock();
+nlmsg_failure:
         kfree_skb(skb);
         return NOTIFY_DONE;
 }
@@ -1521,9 +1622,11 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         if (!skb2)
                 goto out;
 
+        rcu_read_lock();
         err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
                                       nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
                                       1, exp);
+        rcu_read_unlock();
         if (err <= 0)
                 goto free;
 
@@ -1624,7 +1727,7 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nlattr *cda[])
 }
 
 static int
-ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3)
+ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
 {
         struct nf_conntrack_tuple tuple, mask, master_tuple;
         struct nf_conntrack_tuple_hash *h = NULL;
@@ -1653,7 +1756,7 @@ ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3)
 
         if (!help || !help->helper) {
                 /* such conntrack hasn't got any helper, abort */
-                err = -EINVAL;
+                err = -EOPNOTSUPP;
                 goto out;
         }
 
@@ -1671,7 +1774,7 @@ ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3)
         memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
         exp->mask.src.u.all = mask.src.u.all;
 
-        err = nf_ct_expect_related(exp);
+        err = nf_ct_expect_related_report(exp, pid, report);
         nf_ct_expect_put(exp);
 
 out:
@@ -1704,8 +1807,12 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         if (!exp) {
                 spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
-                if (nlh->nlmsg_flags & NLM_F_CREATE)
-                        err = ctnetlink_create_expect(cda, u3);
+                if (nlh->nlmsg_flags & NLM_F_CREATE) {
+                        err = ctnetlink_create_expect(cda,
+                                                      u3,
+                                                      NETLINK_CB(skb).pid,
+                                                      nlmsg_report(nlh));
+                }
                 return err;
         }
 
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 1bc3001d182..9e169ef2e85 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -37,6 +37,7 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
 MODULE_DESCRIPTION("Netfilter connection tracking helper module for PPTP");
 MODULE_ALIAS("ip_conntrack_pptp");
+MODULE_ALIAS_NFCT_HELPER("pptp");
 
 static DEFINE_SPINLOCK(nf_pptp_lock);
 
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 4ab62ad85dd..1b279f9d6bf 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -341,7 +341,7 @@ static int __init nf_ct_proto_gre_init(void)
         return rv;
 }
 
-static void nf_ct_proto_gre_fini(void)
+static void __exit nf_ct_proto_gre_fini(void)
 {
         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
         unregister_pernet_gen_subsys(proto_gre_net_id, &proto_gre_net_ops);
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index c2bd457bc2f..74e03790119 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -317,7 +317,7 @@ static int sctp_packet(struct nf_conn *ct,
                 goto out;
         }
 
-        old_state = new_state = SCTP_CONNTRACK_MAX;
+        old_state = new_state = SCTP_CONNTRACK_NONE;
         write_lock_bh(&sctp_lock);
         for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
                 /* Special cases of Verification tag check (Sec 8.5.1) */
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index a94294b2b23..dcfecbb81c4 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -30,6 +30,7 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Schmidt <mschmidt@redhat.com>");
 MODULE_DESCRIPTION("SANE connection tracking helper");
+MODULE_ALIAS_NFCT_HELPER("sane");
 
 static char *sane_buffer;
 
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 6813f1c8863..4b572163784 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -28,6 +28,7 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
 MODULE_DESCRIPTION("SIP connection tracking helper");
 MODULE_ALIAS("ip_conntrack_sip");
+MODULE_ALIAS_NFCT_HELPER("sip");
 
 #define MAX_PORTS       8
 static unsigned short ports[MAX_PORTS];
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index f57f6e7a71e..46e646b2e9b 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -22,6 +22,7 @@ MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
 MODULE_DESCRIPTION("TFTP connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_tftp");
+MODULE_ALIAS_NFCT_HELPER("tftp");
 
 #define MAX_PORTS 8
 static unsigned short ports[MAX_PORTS];
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 41e0105d382..2770b4e57ea 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -30,6 +30,7 @@
 #include <linux/random.h>
 #include <net/sock.h>
 #include <net/netfilter/nf_log.h>
+#include <net/netfilter/nfnetlink_log.h>
 
 #include <asm/atomic.h>
 
@@ -533,7 +534,7 @@ static struct nf_loginfo default_loginfo = {
 };
 
 /* log handler for internal netfilter logging api */
-static void
+void
 nfulnl_log_packet(u_int8_t pf,
                   unsigned int hooknum,
                   const struct sk_buff *skb,
@@ -648,6 +649,7 @@ alloc_failure:
         /* FIXME: statistics */
         goto unlock_and_release;
 }
+EXPORT_SYMBOL_GPL(nfulnl_log_packet);
 
 static int
 nfulnl_rcv_nl_event(struct notifier_block *this,
diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index 50e3a52d3b3..a57c5cf018e 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -13,6 +13,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_NFLOG.h>
 #include <net/netfilter/nf_log.h>
+#include <net/netfilter/nfnetlink_log.h>
 
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 MODULE_DESCRIPTION("Xtables: packet logging to netlink using NFLOG");
@@ -31,8 +32,8 @@ nflog_tg(struct sk_buff *skb, const struct xt_target_param *par)
         li.u.ulog.group      = info->group;
         li.u.ulog.qthreshold = info->threshold;
 
-        nf_log_packet(par->family, par->hooknum, skb, par->in,
-                      par->out, &li, "%s", info->prefix);
+        nfulnl_log_packet(par->family, par->hooknum, skb, par->in,
+                          par->out, &li, info->prefix);
         return XT_CONTINUE;
 }
 
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 3c3dd22b1d0..fe80b614a40 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -72,9 +72,6 @@ struct recent_entry {
 struct recent_table {
         struct list_head        list;
         char                    name[XT_RECENT_NAME_LEN];
-#ifdef CONFIG_PROC_FS
-        struct proc_dir_entry   *proc_old, *proc;
-#endif
         unsigned int            refcnt;
         unsigned int            entries;
         struct list_head        lru_list;
@@ -284,6 +281,9 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
 {
         const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
+#ifdef CONFIG_PROC_FS
+        struct proc_dir_entry *pde;
+#endif
         unsigned i;
         bool ret = false;
 
@@ -318,25 +318,25 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
         for (i = 0; i < ip_list_hash_size; i++)
                 INIT_LIST_HEAD(&t->iphash[i]);
 #ifdef CONFIG_PROC_FS
-        t->proc = proc_create_data(t->name, ip_list_perms, recent_proc_dir,
+        pde = proc_create_data(t->name, ip_list_perms, recent_proc_dir,
                   &recent_mt_fops, t);
-        if (t->proc == NULL) {
+        if (pde == NULL) {
                 kfree(t);
                 goto out;
         }
+        pde->uid = ip_list_uid;
+        pde->gid = ip_list_gid;
 #ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
-        t->proc_old = proc_create_data(t->name, ip_list_perms, proc_old_dir,
+        pde = proc_create_data(t->name, ip_list_perms, proc_old_dir,
                       &recent_old_fops, t);
-        if (t->proc_old == NULL) {
+        if (pde == NULL) {
                 remove_proc_entry(t->name, proc_old_dir);
                 kfree(t);
                 goto out;
         }
-        t->proc_old->uid   = ip_list_uid;
-        t->proc_old->gid   = ip_list_gid;
+        pde->uid = ip_list_uid;
+        pde->gid = ip_list_gid;
 #endif
-        t->proc->uid       = ip_list_uid;
-        t->proc->gid       = ip_list_gid;
 #endif
         spin_lock_bh(&recent_lock);
         list_add_tail(&t->list, &tables);