Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (353 commits)
  [IPV6] ADDRCONF: Mobile IPv6 Home Address support.
  [IPV6] ADDRCONF: Allow non-DAD'able addresses.
  [IPV6] NDISC: Fix is_router flag setting.
  [IPV6] ADDRCONF: Convert addrconf_lock to RCU.
  [IPV6] NDISC: Add proxy_ndp sysctl.
  [IPV6] NDISC: Set per-entry is_router flag in Proxy NA.
  [IPV6] NDISC: Avoid updating neighbor cache for proxied address in receiving NA.
  [IPV6]: Don't forward packets to proxied link-local address.
  [IPV6] NDISC: Handle NDP messages to proxied addresses.
  [NETFILTER]: PPTP conntrack: fix another GRE keymap leak
  [NETFILTER]: PPTP conntrack: fix GRE keymap leak
  [NETFILTER]: PPTP conntrack: fix PPTP_IN_CALL message types
  [NETFILTER]: PPTP conntrack: check call ID before changing state
  [NETFILTER]: PPTP conntrack: clean up debugging cruft
  [NETFILTER]: PPTP conntrack: consolidate header parsing
  [NETFILTER]: PPTP conntrack: consolidate header size checks
  [NETFILTER]: PPTP conntrack: simplify expectation handling
  [NETFILTER]: PPTP conntrack: remove unnecessary cid/pcid header pointers
  [NETFILTER]: PPTP conntrack: fix header definitions
  [NETFILTER]: PPTP conntrack: remove more dead code
  ...

46 files changed, 927 insertions, 734 deletions

diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 1021f508d82c..e319c649e4fd 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -114,7 +114,7 @@ extern void *__init alloc_large_system_hash(const char *tablename,
 #else
 #define HASHDIST_DEFAULT 0
 #endif
-extern int __initdata hashdist;         /* Distribute hashes across NUMA nodes? */
+extern int hashdist;            /* Distribute hashes across NUMA nodes? */
 
 
 #endif /* _LINUX_BOOTMEM_H */
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 676333b9fad0..2d7671c92c0b 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -438,6 +438,7 @@ struct dccp_ackvec;
  * @dccps_role - Role of this sock, one of %dccp_role
  * @dccps_ndp_count - number of Non Data Packets since last data packet
  * @dccps_hc_rx_ackvec - rx half connection ack vector
+ * @dccps_xmit_timer - timer for when CCID is not ready to send
  */
 struct dccp_sock {
         /* inet_connection_sock has to be the first member of dccp_sock */
@@ -470,6 +471,7 @@ struct dccp_sock {
         enum dccp_role                  dccps_role:2;
         __u8                            dccps_hc_rx_insert_options:1;
         __u8                            dccps_hc_tx_insert_options:1;
+        struct timer_list               dccps_xmit_timer;
 };
  
 static inline struct dccp_sock *dccp_sk(const struct sock *sk)
diff --git a/include/linux/fib_rules.h b/include/linux/fib_rules.h
new file mode 100644
index 000000000000..4418c8d9d479
--- /dev/null
+++ b/include/linux/fib_rules.h
@@ -0,0 +1,65 @@
+#ifndef __LINUX_FIB_RULES_H
+#define __LINUX_FIB_RULES_H
+
+#include <linux/types.h>
+#include <linux/rtnetlink.h>
+
+/* rule is permanent, and cannot be deleted */
+#define FIB_RULE_PERMANENT      1
+
+struct fib_rule_hdr
+{
+        __u8            family;
+        __u8            dst_len;
+        __u8            src_len;
+        __u8            tos;
+
+        __u8            table;
+        __u8            res1;   /* reserved */
+        __u8            res2;   /* reserved */
+        __u8            action;
+
+        __u32           flags;
+};
+
+enum
+{
+        FRA_UNSPEC,
+        FRA_DST,        /* destination address */
+        FRA_SRC,        /* source address */
+        FRA_IFNAME,     /* interface name */
+        FRA_UNUSED1,
+        FRA_UNUSED2,
+        FRA_PRIORITY,   /* priority/preference */
+        FRA_UNUSED3,
+        FRA_UNUSED4,
+        FRA_UNUSED5,
+        FRA_FWMARK,     /* netfilter mark */
+        FRA_FLOW,       /* flow/class id */
+        FRA_UNUSED6,
+        FRA_UNUSED7,
+        FRA_UNUSED8,
+        FRA_TABLE,      /* Extended table id */
+        FRA_FWMASK,     /* mask for netfilter mark */
+        __FRA_MAX
+};
+
+#define FRA_MAX (__FRA_MAX - 1)
+
+enum
+{
+        FR_ACT_UNSPEC,
+        FR_ACT_TO_TBL,          /* Pass to fixed table */
+        FR_ACT_RES1,
+        FR_ACT_RES2,
+        FR_ACT_RES3,
+        FR_ACT_RES4,
+        FR_ACT_BLACKHOLE,       /* Drop without notification */
+        FR_ACT_UNREACHABLE,     /* Drop with ENETUNREACH */
+        FR_ACT_PROHIBIT,        /* Drop with EACCES */
+        __FR_ACT_MAX,
+};
+
+#define FR_ACT_MAX (__FR_ACT_MAX - 1)
+
+#endif
diff --git a/include/linux/filter.h b/include/linux/filter.h
index c6cb8f095088..91b2e3b9251e 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -25,10 +25,10 @@
  
 struct sock_filter      /* Filter block */
 {
-        __u16   code;   /* Actual filter code */
-        __u8    jt;     /* Jump true */
-        __u8    jf;     /* Jump false */
-        __u32   k;      /* Generic multiuse field */
+        __u16   code;   /* Actual filter code */
+        __u8    jt;     /* Jump true */
+        __u8    jf;     /* Jump false */
+        __u32   k;      /* Generic multiuse field */
 };
 
 struct sock_fprog       /* Required for SO_ATTACH_FILTER. */
@@ -41,8 +41,9 @@ struct sock_fprog	/* Required for SO_ATTACH_FILTER. */
 struct sk_filter
 {
         atomic_t                refcnt;
-        unsigned int            len;    /* Number of filter blocks */
-        struct sock_filter      insns[0];
+        unsigned int            len;    /* Number of filter blocks */
+        struct rcu_head         rcu;
+        struct sock_filter      insns[0];
 };
 
 static inline unsigned int sk_filter_len(struct sk_filter *fp)
diff --git a/include/linux/genetlink.h b/include/linux/genetlink.h
index 84f12a41dc01..9049dc65ae51 100644
--- a/include/linux/genetlink.h
+++ b/include/linux/genetlink.h
@@ -16,6 +16,8 @@ struct genlmsghdr {
 
 #define GENL_HDRLEN     NLMSG_ALIGN(sizeof(struct genlmsghdr))
 
+#define GENL_ADMIN_PERM         0x01
+
 /*
  * List of reserved static generic netlink identifiers:
  */
@@ -43,9 +45,25 @@ enum {
         CTRL_ATTR_UNSPEC,
         CTRL_ATTR_FAMILY_ID,
         CTRL_ATTR_FAMILY_NAME,
+        CTRL_ATTR_VERSION,
+        CTRL_ATTR_HDRSIZE,
+        CTRL_ATTR_MAXATTR,
+        CTRL_ATTR_OPS,
         __CTRL_ATTR_MAX,
 };
 
 #define CTRL_ATTR_MAX (__CTRL_ATTR_MAX - 1)
 
+enum {
+        CTRL_ATTR_OP_UNSPEC,
+        CTRL_ATTR_OP_ID,
+        CTRL_ATTR_OP_FLAGS,
+        CTRL_ATTR_OP_POLICY,
+        CTRL_ATTR_OP_DOIT,
+        CTRL_ATTR_OP_DUMPIT,
+        __CTRL_ATTR_OP_MAX,
+};
+
+#define CTRL_ATTR_OP_MAX (__CTRL_ATTR_OP_MAX - 1)
+
 #endif  /* __LINUX_GENERIC_NETLINK_H */
diff --git a/include/linux/if.h b/include/linux/if.h
index 374e20ad8b0d..cd080d765324 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -212,5 +212,134 @@ struct ifconf
 #define ifc_buf ifc_ifcu.ifcu_buf               /* buffer address       */
 #define ifc_req ifc_ifcu.ifcu_req               /* array of structures  */
 
+/* The struct should be in sync with struct net_device_stats */
+struct rtnl_link_stats
+{
+        __u32   rx_packets;             /* total packets received       */
+        __u32   tx_packets;             /* total packets transmitted    */
+        __u32   rx_bytes;               /* total bytes received         */
+        __u32   tx_bytes;               /* total bytes transmitted      */
+        __u32   rx_errors;              /* bad packets received         */
+        __u32   tx_errors;              /* packet transmit problems     */
+        __u32   rx_dropped;             /* no space in linux buffers    */
+        __u32   tx_dropped;             /* no space available in linux  */
+        __u32   multicast;              /* multicast packets received   */
+        __u32   collisions;
+
+        /* detailed rx_errors: */
+        __u32   rx_length_errors;
+        __u32   rx_over_errors;         /* receiver ring buff overflow  */
+        __u32   rx_crc_errors;          /* recved pkt with crc error    */
+        __u32   rx_frame_errors;        /* recv'd frame alignment error */
+        __u32   rx_fifo_errors;         /* recv'r fifo overrun          */
+        __u32   rx_missed_errors;       /* receiver missed packet       */
+
+        /* detailed tx_errors */
+        __u32   tx_aborted_errors;
+        __u32   tx_carrier_errors;
+        __u32   tx_fifo_errors;
+        __u32   tx_heartbeat_errors;
+        __u32   tx_window_errors;
+
+        /* for cslip etc */
+        __u32   rx_compressed;
+        __u32   tx_compressed;
+};
+
+/* The struct should be in sync with struct ifmap */
+struct rtnl_link_ifmap
+{
+        __u64   mem_start;
+        __u64   mem_end;
+        __u64   base_addr;
+        __u16   irq;
+        __u8    dma;
+        __u8    port;
+};
+
+enum
+{
+        IFLA_UNSPEC,
+        IFLA_ADDRESS,
+        IFLA_BROADCAST,
+        IFLA_IFNAME,
+        IFLA_MTU,
+        IFLA_LINK,
+        IFLA_QDISC,
+        IFLA_STATS,
+        IFLA_COST,
+#define IFLA_COST IFLA_COST
+        IFLA_PRIORITY,
+#define IFLA_PRIORITY IFLA_PRIORITY
+        IFLA_MASTER,
+#define IFLA_MASTER IFLA_MASTER
+        IFLA_WIRELESS,          /* Wireless Extension event - see wireless.h */
+#define IFLA_WIRELESS IFLA_WIRELESS
+        IFLA_PROTINFO,          /* Protocol specific information for a link */
+#define IFLA_PROTINFO IFLA_PROTINFO
+        IFLA_TXQLEN,
+#define IFLA_TXQLEN IFLA_TXQLEN
+        IFLA_MAP,
+#define IFLA_MAP IFLA_MAP
+        IFLA_WEIGHT,
+#define IFLA_WEIGHT IFLA_WEIGHT
+        IFLA_OPERSTATE,
+        IFLA_LINKMODE,
+        __IFLA_MAX
+};
+
+
+#define IFLA_MAX (__IFLA_MAX - 1)
+
+/* ifi_flags.
+
+   IFF_* flags.
+
+   The only change is:
+   IFF_LOOPBACK, IFF_BROADCAST and IFF_POINTOPOINT are
+   more not changeable by user. They describe link media
+   characteristics and set by device driver.
+
+   Comments:
+   - Combination IFF_BROADCAST|IFF_POINTOPOINT is invalid
+   - If neither of these three flags are set;
+     the interface is NBMA.
+
+   - IFF_MULTICAST does not mean anything special:
+   multicasts can be used on all not-NBMA links.
+   IFF_MULTICAST means that this media uses special encapsulation
+   for multicast frames. Apparently, all IFF_POINTOPOINT and
+   IFF_BROADCAST devices are able to use multicasts too.
+ */
+
+/* IFLA_LINK.
+   For usual devices it is equal ifi_index.
+   If it is a "virtual interface" (f.e. tunnel), ifi_link
+   can point to real physical interface (f.e. for bandwidth calculations),
+   or maybe 0, what means, that real media is unknown (usual
+   for IPIP tunnels, when route to endpoint is allowed to change)
+ */
+
+/* Subtype attributes for IFLA_PROTINFO */
+enum
+{
+        IFLA_INET6_UNSPEC,
+        IFLA_INET6_FLAGS,       /* link flags                   */
+        IFLA_INET6_CONF,        /* sysctl parameters            */
+        IFLA_INET6_STATS,       /* statistics                   */
+        IFLA_INET6_MCAST,       /* MC things. What of them?     */
+        IFLA_INET6_CACHEINFO,   /* time values and max reasm size */
+        __IFLA_INET6_MAX
+};
+
+#define IFLA_INET6_MAX  (__IFLA_INET6_MAX - 1)
+
+struct ifla_cacheinfo
+{
+        __u32   max_reasm_len;
+        __u32   tstamp;         /* ipv6InterfaceTable updated timestamp */
+        __u32   reachable_time;
+        __u32   retrans_time;
+};
 
 #endif /* _LINUX_IF_H */
diff --git a/include/linux/if_addr.h b/include/linux/if_addr.h
new file mode 100644
index 000000000000..dbe8f6120a40
--- /dev/null
+++ b/include/linux/if_addr.h
@@ -0,0 +1,55 @@
+#ifndef __LINUX_IF_ADDR_H
+#define __LINUX_IF_ADDR_H
+
+#include <linux/netlink.h>
+
+struct ifaddrmsg
+{
+        __u8            ifa_family;
+        __u8            ifa_prefixlen;  /* The prefix length            */
+        __u8            ifa_flags;      /* Flags                        */
+        __u8            ifa_scope;      /* Address scope                */
+        __u32           ifa_index;      /* Link index                   */
+};
+
+/*
+ * Important comment:
+ * IFA_ADDRESS is prefix address, rather than local interface address.
+ * It makes no difference for normally configured broadcast interfaces,
+ * but for point-to-point IFA_ADDRESS is DESTINATION address,
+ * local address is supplied in IFA_LOCAL attribute.
+ */
+enum
+{
+        IFA_UNSPEC,
+        IFA_ADDRESS,
+        IFA_LOCAL,
+        IFA_LABEL,
+        IFA_BROADCAST,
+        IFA_ANYCAST,
+        IFA_CACHEINFO,
+        IFA_MULTICAST,
+        __IFA_MAX,
+};
+
+#define IFA_MAX (__IFA_MAX - 1)
+
+/* ifa_flags */
+#define IFA_F_SECONDARY         0x01
+#define IFA_F_TEMPORARY         IFA_F_SECONDARY
+
+#define IFA_F_NODAD             0x02
+#define IFA_F_HOMEADDRESS       0x10
+#define IFA_F_DEPRECATED        0x20
+#define IFA_F_TENTATIVE         0x40
+#define IFA_F_PERMANENT         0x80
+
+struct ifa_cacheinfo
+{
+        __u32   ifa_prefered;
+        __u32   ifa_valid;
+        __u32   cstamp; /* created timestamp, hundredths of seconds */
+        __u32   tstamp; /* updated timestamp, hundredths of seconds */
+};
+
+#endif
diff --git a/include/linux/in.h b/include/linux/in.h
index 94f557fa4636..bcaca8399aed 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -52,7 +52,7 @@ enum {
 
 /* Internet address. */
 struct in_addr {
-        __u32   s_addr;
+        __be32  s_addr;
 };
 
 #define IP_TOS          1
@@ -177,7 +177,7 @@ struct in_pktinfo
 #define __SOCK_SIZE__   16              /* sizeof(struct sockaddr)      */
 struct sockaddr_in {
   sa_family_t           sin_family;     /* Address family               */
-  unsigned short int    sin_port;       /* Port number                  */
+  __be16                sin_port;       /* Port number                  */
   struct in_addr        sin_addr;       /* Internet address             */
 
   /* Pad to size of `struct sockaddr'. */
diff --git a/include/linux/in6.h b/include/linux/in6.h
index 304aaedea305..d776829b443f 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -134,6 +134,7 @@ struct in6_flowlabel_req
 #define IPPROTO_ICMPV6          58      /* ICMPv6                       */
 #define IPPROTO_NONE            59      /* IPv6 no next header          */
 #define IPPROTO_DSTOPTS         60      /* IPv6 destination options     */
+#define IPPROTO_MH              135     /* IPv6 mobility header         */
 
 /*
  *      IPv6 TLV options.
@@ -142,6 +143,7 @@ struct in6_flowlabel_req
 #define IPV6_TLV_PADN           1
 #define IPV6_TLV_ROUTERALERT    5
 #define IPV6_TLV_JUMBO          194
+#define IPV6_TLV_HAO            201     /* home address option */
 
 /*
  *      IPV6 socket options
diff --git a/include/linux/inet.h b/include/linux/inet.h
index 6c5587af118d..b7c6da7d6d32 100644
--- a/include/linux/inet.h
+++ b/include/linux/inet.h
@@ -46,5 +46,7 @@
 #include <linux/types.h>
 
 extern __be32 in_aton(const char *str);
+extern int in4_pton(const char *src, int srclen, u8 *dst, char delim, const char **end);
+extern int in6_pton(const char *src, int srclen, u8 *dst, char delim, const char **end);
 #endif
 #endif  /* _LINUX_INET_H */
diff --git a/include/linux/ip.h b/include/linux/ip.h
index 4b55cf1df732..2f4600146f83 100644
--- a/include/linux/ip.h
+++ b/include/linux/ip.h
@@ -57,6 +57,7 @@
 #define IPOPT_SEC       (2 |IPOPT_CONTROL|IPOPT_COPY)
 #define IPOPT_LSRR      (3 |IPOPT_CONTROL|IPOPT_COPY)
 #define IPOPT_TIMESTAMP (4 |IPOPT_MEASUREMENT)
+#define IPOPT_CIPSO     (6 |IPOPT_CONTROL|IPOPT_COPY)
 #define IPOPT_RR        (7 |IPOPT_CONTROL)
 #define IPOPT_SID       (8 |IPOPT_CONTROL|IPOPT_COPY)
 #define IPOPT_SSRR      (9 |IPOPT_CONTROL|IPOPT_COPY)
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 297853c841b4..caca57df0d7d 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -29,6 +29,7 @@ struct in6_ifreq {
 
 #define IPV6_SRCRT_STRICT       0x01    /* this hop must be a neighbor  */
 #define IPV6_SRCRT_TYPE_0       0       /* IPv6 type 0 Routing Header   */
+#define IPV6_SRCRT_TYPE_2       2       /* IPv6 type 2 Routing Header   */
 
 /*
  *      routing header
@@ -73,6 +74,28 @@ struct rt0_hdr {
 #define rt0_type                rt_hdr.type
 };
 
+/*
+ *      routing header type 2
+ */
+
+struct rt2_hdr {
+        struct ipv6_rt_hdr      rt_hdr;
+        __u32                   reserved;
+        struct in6_addr         addr;
+
+#define rt2_type                rt_hdr.type
+};
+
+/*
+ *      home address option in destination options header
+ */
+
+struct ipv6_destopt_hao {
+        __u8                    type;
+        __u8                    length;
+        struct in6_addr         addr;
+} __attribute__ ((__packed__));
+
 struct ipv6_auth_hdr {
         __u8  nexthdr;
         __u8  hdrlen;           /* This one is measured in 32 bit units! */
@@ -153,6 +176,7 @@ struct ipv6_devconf {
         __s32           accept_ra_rt_info_max_plen;
 #endif
 #endif
+        __s32           proxy_ndp;
         void            *sysctl;
 };
 
@@ -180,6 +204,7 @@ enum {
         DEVCONF_ACCEPT_RA_RTR_PREF,
         DEVCONF_RTR_PROBE_INTERVAL,
         DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN,
+        DEVCONF_PROXY_NDP,
         DEVCONF_MAX
 };
 
@@ -206,6 +231,9 @@ struct inet6_skb_parm {
         __u16                   lastopt;
         __u32                   nhoff;
         __u16                   flags;
+#ifdef CONFIG_IPV6_MIP6
+        __u16                   dsthao;
+#endif
 
 #define IP6SKB_XFRM_TRANSFORMED 1
 };
@@ -242,6 +270,9 @@ struct ipv6_pinfo {
         struct in6_addr         rcv_saddr;
         struct in6_addr         daddr;
         struct in6_addr         *daddr_cache;
+#ifdef CONFIG_IPV6_SUBTREES
+        struct in6_addr         *saddr_cache;
+#endif
 
         __u32                   flow_label;
         __u32                   frag_size;
diff --git a/include/linux/neighbour.h b/include/linux/neighbour.h
new file mode 100644
index 000000000000..bd3bbf668cdb
--- /dev/null
+++ b/include/linux/neighbour.h
@@ -0,0 +1,159 @@
+#ifndef __LINUX_NEIGHBOUR_H
+#define __LINUX_NEIGHBOUR_H
+
+#include <linux/netlink.h>
+
+struct ndmsg
+{
+        __u8            ndm_family;
+        __u8            ndm_pad1;
+        __u16           ndm_pad2;
+        __s32           ndm_ifindex;
+        __u16           ndm_state;
+        __u8            ndm_flags;
+        __u8            ndm_type;
+};
+
+enum
+{
+        NDA_UNSPEC,
+        NDA_DST,
+        NDA_LLADDR,
+        NDA_CACHEINFO,
+        NDA_PROBES,
+        __NDA_MAX
+};
+
+#define NDA_MAX (__NDA_MAX - 1)
+
+/*
+ *      Neighbor Cache Entry Flags
+ */
+
+#define NTF_PROXY       0x08    /* == ATF_PUBL */
+#define NTF_ROUTER      0x80
+
+/*
+ *      Neighbor Cache Entry States.
+ */
+
+#define NUD_INCOMPLETE  0x01
+#define NUD_REACHABLE   0x02
+#define NUD_STALE       0x04
+#define NUD_DELAY       0x08
+#define NUD_PROBE       0x10
+#define NUD_FAILED      0x20
+
+/* Dummy states */
+#define NUD_NOARP       0x40
+#define NUD_PERMANENT   0x80
+#define NUD_NONE        0x00
+
+/* NUD_NOARP & NUD_PERMANENT are pseudostates, they never change
+   and make no address resolution or NUD.
+   NUD_PERMANENT is also cannot be deleted by garbage collectors.
+ */
+
+struct nda_cacheinfo
+{
+        __u32           ndm_confirmed;
+        __u32           ndm_used;
+        __u32           ndm_updated;
+        __u32           ndm_refcnt;
+};
+
+/*****************************************************************
+ *              Neighbour tables specific messages.
+ *
+ * To retrieve the neighbour tables send RTM_GETNEIGHTBL with the
+ * NLM_F_DUMP flag set. Every neighbour table configuration is
+ * spread over multiple messages to avoid running into message
+ * size limits on systems with many interfaces. The first message
+ * in the sequence transports all not device specific data such as
+ * statistics, configuration, and the default parameter set.
+ * This message is followed by 0..n messages carrying device
+ * specific parameter sets.
+ * Although the ordering should be sufficient, NDTA_NAME can be
+ * used to identify sequences. The initial message can be identified
+ * by checking for NDTA_CONFIG. The device specific messages do
+ * not contain this TLV but have NDTPA_IFINDEX set to the
+ * corresponding interface index.
+ *
+ * To change neighbour table attributes, send RTM_SETNEIGHTBL
+ * with NDTA_NAME set. Changeable attribute include NDTA_THRESH[1-3],
+ * NDTA_GC_INTERVAL, and all TLVs in NDTA_PARMS unless marked
+ * otherwise. Device specific parameter sets can be changed by
+ * setting NDTPA_IFINDEX to the interface index of the corresponding
+ * device.
+ ****/
+
+struct ndt_stats
+{
+        __u64           ndts_allocs;
+        __u64           ndts_destroys;
+        __u64           ndts_hash_grows;
+        __u64           ndts_res_failed;
+        __u64           ndts_lookups;
+        __u64           ndts_hits;
+        __u64           ndts_rcv_probes_mcast;
+        __u64           ndts_rcv_probes_ucast;
+        __u64           ndts_periodic_gc_runs;
+        __u64           ndts_forced_gc_runs;
+};
+
+enum {
+        NDTPA_UNSPEC,
+        NDTPA_IFINDEX,                  /* u32, unchangeable */
+        NDTPA_REFCNT,                   /* u32, read-only */
+        NDTPA_REACHABLE_TIME,           /* u64, read-only, msecs */
+        NDTPA_BASE_REACHABLE_TIME,      /* u64, msecs */
+        NDTPA_RETRANS_TIME,             /* u64, msecs */
+        NDTPA_GC_STALETIME,             /* u64, msecs */
+        NDTPA_DELAY_PROBE_TIME,         /* u64, msecs */
+        NDTPA_QUEUE_LEN,                /* u32 */
+        NDTPA_APP_PROBES,               /* u32 */
+        NDTPA_UCAST_PROBES,             /* u32 */
+        NDTPA_MCAST_PROBES,             /* u32 */
+        NDTPA_ANYCAST_DELAY,            /* u64, msecs */
+        NDTPA_PROXY_DELAY,              /* u64, msecs */
+        NDTPA_PROXY_QLEN,               /* u32 */
+        NDTPA_LOCKTIME,                 /* u64, msecs */
+        __NDTPA_MAX
+};
+#define NDTPA_MAX (__NDTPA_MAX - 1)
+
+struct ndtmsg
+{
+        __u8            ndtm_family;
+        __u8            ndtm_pad1;
+        __u16           ndtm_pad2;
+};
+
+struct ndt_config
+{
+        __u16           ndtc_key_len;
+        __u16           ndtc_entry_size;
+        __u32           ndtc_entries;
+        __u32           ndtc_last_flush;        /* delta to now in msecs */
+        __u32           ndtc_last_rand;         /* delta to now in msecs */
+        __u32           ndtc_hash_rnd;
+        __u32           ndtc_hash_mask;
+        __u32           ndtc_hash_chain_gc;
+        __u32           ndtc_proxy_qlen;
+};
+
+enum {
+        NDTA_UNSPEC,
+        NDTA_NAME,                      /* char *, unchangeable */
+        NDTA_THRESH1,                   /* u32 */
+        NDTA_THRESH2,                   /* u32 */
+        NDTA_THRESH3,                   /* u32 */
+        NDTA_CONFIG,                    /* struct ndt_config, read-only */
+        NDTA_PARMS,                     /* nested TLV NDTPA_* */
+        NDTA_STATS,                     /* struct ndt_stats, read-only */
+        NDTA_GC_INTERVAL,               /* u64, msecs */
+        __NDTA_MAX
+};
+#define NDTA_MAX (__NDTA_MAX - 1)
+
+#endif
diff --git a/include/linux/net.h b/include/linux/net.h
index b20c53c74413..c257f716e00f 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -169,11 +169,6 @@ struct proto_ops {
 struct net_proto_family {
         int             family;
         int             (*create)(struct socket *sock, int protocol);
-        /* These are counters for the number of different methods of
-           each we support */
-        short           authentication;
-        short           encryption;
-        short           encrypt_net;
         struct module   *owner;
 };
 
@@ -181,8 +176,8 @@ struct iovec;
 struct kvec;
 
 extern int           sock_wake_async(struct socket *sk, int how, int band);
-extern int           sock_register(struct net_proto_family *fam);
-extern int           sock_unregister(int family);
+extern int           sock_register(const struct net_proto_family *fam);
+extern void          sock_unregister(int family);
 extern int           sock_create(int family, int type, int proto,
                                  struct socket **res);
 extern int           sock_create_kern(int family, int type, int proto,
@@ -208,6 +203,25 @@ extern int   	     kernel_recvmsg(struct socket *sock, struct msghdr *msg,
                                     struct kvec *vec, size_t num,
                                     size_t len, int flags);
 
+extern int kernel_bind(struct socket *sock, struct sockaddr *addr,
+                       int addrlen);
+extern int kernel_listen(struct socket *sock, int backlog);
+extern int kernel_accept(struct socket *sock, struct socket **newsock,
+                         int flags);
+extern int kernel_connect(struct socket *sock, struct sockaddr *addr,
+                          int addrlen, int flags);
+extern int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
+                              int *addrlen);
+extern int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
+                              int *addrlen);
+extern int kernel_getsockopt(struct socket *sock, int level, int optname,
+                             char *optval, int *optlen);
+extern int kernel_setsockopt(struct socket *sock, int level, int optname,
+                             char *optval, int optlen);
+extern int kernel_sendpage(struct socket *sock, struct page *page, int offset,
+                           size_t size, int flags);
+extern int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg);
+
 #ifndef CONFIG_SMP
 #define SOCKOPS_WRAPPED(name) name
 #define SOCKOPS_WRAP(name, fam)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 50a4719512ed..4f2c2b6beb5e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -976,7 +976,7 @@ extern void		dev_mcast_init(void);
 extern int              netdev_max_backlog;
 extern int              weight_p;
 extern int              netdev_set_master(struct net_device *dev, struct net_device *master);
-extern int skb_checksum_help(struct sk_buff *skb, int inward);
+extern int skb_checksum_help(struct sk_buff *skb);
 extern struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features);
 #ifdef CONFIG_BUG
 extern void netdev_rx_csum_fault(struct net_device *dev);
@@ -1012,7 +1012,7 @@ static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
 {
         return skb_is_gso(skb) &&
                (!skb_gso_ok(skb, dev->features) ||
-                unlikely(skb->ip_summed != CHECKSUM_HW));
+                unlikely(skb->ip_summed != CHECKSUM_PARTIAL));
 }
 
 /* On bonding slaves other than the currently active slave, suppress
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 10168e26a846..b7e67d1d4382 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -282,6 +282,12 @@ extern void nf_invalidate_cache(int pf);
    Returns true or false. */
 extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);
 
+extern u_int16_t nf_csum_update(u_int32_t oldval, u_int32_t newval,
+                                u_int32_t csum);
+extern u_int16_t nf_proto_csum_update(struct sk_buff *skb,
+                                      u_int32_t oldval, u_int32_t newval,
+                                      u_int16_t csum, int pseudohdr);
+
 struct nf_afinfo {
         unsigned short  family;
         unsigned int    (*checksum)(struct sk_buff *skb, unsigned int hook,
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index d2e4bd7a7a14..9e0dae07861e 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -125,6 +125,10 @@ enum ip_conntrack_events
         /* Counter highest bit has been set */
         IPCT_COUNTER_FILLING_BIT = 11,
         IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT),
+
+        /* Mark is set */
+        IPCT_MARK_BIT = 12,
+        IPCT_MARK = (1 << IPCT_MARK_BIT),
 };
 
 enum ip_conntrack_expect_events {
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index b2feeffde384..6b01ba297727 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -49,6 +49,7 @@ struct ip_ct_tcp
         u_int32_t       last_seq;       /* Last sequence number seen in dir */
         u_int32_t       last_ack;       /* Last sequence number seen in opposite dir */
         u_int32_t       last_end;       /* Last seq + len */
+        u_int16_t       last_win;       /* Last window advertisement seen in dir */
 };
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index 9f5b12cf489b..6d8e3e5a80e9 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -43,7 +43,7 @@ struct nfattr
         u_int16_t nfa_len;
         u_int16_t nfa_type;     /* we use 15 bits for the type, and the highest
                                  * bit to indicate whether the payload is nested */
-} __attribute__ ((packed));
+};
 
 /* FIXME: Apart from NFNL_NFA_NESTED shamelessly copy and pasted from
  * rtnetlink.h, it's time to put this in a generic file */
@@ -79,7 +79,7 @@ struct nfgenmsg {
         u_int8_t  nfgen_family;         /* AF_xxx */
         u_int8_t  version;              /* nfnetlink version */
         u_int16_t res_id;               /* resource id */
-} __attribute__ ((packed));
+};
 
 #define NFNETLINK_V0    0
 
diff --git a/include/linux/netfilter/nfnetlink_log.h b/include/linux/netfilter/nfnetlink_log.h
index a7497c7436df..87b92f8b988f 100644
--- a/include/linux/netfilter/nfnetlink_log.h
+++ b/include/linux/netfilter/nfnetlink_log.h
@@ -19,18 +19,18 @@ struct nfulnl_msg_packet_hdr {
         u_int16_t       hw_protocol;    /* hw protocol (network order) */
         u_int8_t        hook;           /* netfilter hook */
         u_int8_t        _pad;
-} __attribute__ ((packed));
+};
 
 struct nfulnl_msg_packet_hw {
         u_int16_t       hw_addrlen;
         u_int16_t       _pad;
         u_int8_t        hw_addr[8];
-} __attribute__ ((packed));
+};
 
 struct nfulnl_msg_packet_timestamp {
         aligned_u64     sec;
         aligned_u64     usec;
-} __attribute__ ((packed));
+};
 
 #define NFULNL_PREFIXLEN        30      /* just like old log target */
 
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
index 9e774373244c..36af0360b56d 100644
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -22,12 +22,12 @@ struct nfqnl_msg_packet_hw {
         u_int16_t       hw_addrlen;
         u_int16_t       _pad;
         u_int8_t        hw_addr[8];
-} __attribute__ ((packed));
+};
 
 struct nfqnl_msg_packet_timestamp {
         aligned_u64     sec;
         aligned_u64     usec;
-} __attribute__ ((packed));
+};
 
 enum nfqnl_attr_type {
         NFQA_UNSPEC,
@@ -49,7 +49,7 @@ enum nfqnl_attr_type {
 struct nfqnl_msg_verdict_hdr {
         u_int32_t verdict;
         u_int32_t id;
-} __attribute__ ((packed));
+};
 
 
 enum nfqnl_msg_config_cmds {
@@ -64,7 +64,7 @@ struct nfqnl_msg_config_cmd {
         u_int8_t        command;        /* nfqnl_msg_config_cmds */
         u_int8_t        _pad;
         u_int16_t       pf;             /* AF_xxx for PF_[UN]BIND */
-} __attribute__ ((packed));
+};
 
 enum nfqnl_config_mode {
         NFQNL_COPY_NONE,
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 48cc32d83f77..739a98eebe2c 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -138,16 +138,6 @@ struct xt_counters_info
 
 #include <linux/netdevice.h>
 
-#define ASSERT_READ_LOCK(x)
-#define ASSERT_WRITE_LOCK(x)
-#include <linux/netfilter_ipv4/listhelp.h>
-
-#ifdef CONFIG_COMPAT
-#define COMPAT_TO_USER          1
-#define COMPAT_FROM_USER        -1
-#define COMPAT_CALC_SIZE        0
-#endif
-
 struct xt_match
 {
         struct list_head list;
@@ -174,21 +164,24 @@ struct xt_match
                           const void *ip,
                           const struct xt_match *match,
                           void *matchinfo,
-                          unsigned int matchinfosize,
                           unsigned int hook_mask);
 
         /* Called when entry of this type deleted. */
-        void (*destroy)(const struct xt_match *match, void *matchinfo,
-                        unsigned int matchinfosize);
+        void (*destroy)(const struct xt_match *match, void *matchinfo);
 
         /* Called when userspace align differs from kernel space one */
-        int (*compat)(void *match, void **dstptr, int *size, int convert);
+        void (*compat_from_user)(void *dst, void *src);
+        int (*compat_to_user)(void __user *dst, void *src);
 
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
+        /* Free to use by each match */
+        unsigned long data;
+
         char *table;
         unsigned int matchsize;
+        unsigned int compatsize;
         unsigned int hooks;
         unsigned short proto;
 
@@ -211,8 +204,7 @@ struct xt_target
                                const struct net_device *out,
                                unsigned int hooknum,
                                const struct xt_target *target,
-                               const void *targinfo,
-                               void *userdata);
+                               const void *targinfo);
 
         /* Called when user tries to insert an entry of this type:
            hook_mask is a bitmask of hooks from which it can be
@@ -222,21 +214,21 @@ struct xt_target
                           const void *entry,
                           const struct xt_target *target,
                           void *targinfo,
-                          unsigned int targinfosize,
                           unsigned int hook_mask);
 
         /* Called when entry of this type deleted. */
-        void (*destroy)(const struct xt_target *target, void *targinfo,
-                        unsigned int targinfosize);
+        void (*destroy)(const struct xt_target *target, void *targinfo);
 
         /* Called when userspace align differs from kernel space one */
-        int (*compat)(void *target, void **dstptr, int *size, int convert);
+        void (*compat_from_user)(void *dst, void *src);
+        int (*compat_to_user)(void __user *dst, void *src);
 
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
         char *table;
         unsigned int targetsize;
+        unsigned int compatsize;
         unsigned int hooks;
         unsigned short proto;
 
@@ -290,8 +282,13 @@ struct xt_table_info
 
 extern int xt_register_target(struct xt_target *target);
 extern void xt_unregister_target(struct xt_target *target);
+extern int xt_register_targets(struct xt_target *target, unsigned int n);
+extern void xt_unregister_targets(struct xt_target *target, unsigned int n);
+
 extern int xt_register_match(struct xt_match *target);
 extern void xt_unregister_match(struct xt_match *target);
+extern int xt_register_matches(struct xt_match *match, unsigned int n);
+extern void xt_unregister_matches(struct xt_match *match, unsigned int n);
 
 extern int xt_check_match(const struct xt_match *match, unsigned short family,
                           unsigned int size, const char *table, unsigned int hook,
@@ -388,9 +385,18 @@ struct compat_xt_counters_info
 
 extern void xt_compat_lock(int af);
 extern void xt_compat_unlock(int af);
-extern int xt_compat_match(void *match, void **dstptr, int *size, int convert);
-extern int xt_compat_target(void *target, void **dstptr, int *size,
-                int convert);
+
+extern int xt_compat_match_offset(struct xt_match *match);
+extern void xt_compat_match_from_user(struct xt_entry_match *m,
+                                      void **dstptr, int *size);
+extern int xt_compat_match_to_user(struct xt_entry_match *m,
+                                   void * __user *dstptr, int *size);
+
+extern int xt_compat_target_offset(struct xt_target *target);
+extern void xt_compat_target_from_user(struct xt_entry_target *t,
+                                       void **dstptr, int *size);
+extern int xt_compat_target_to_user(struct xt_entry_target *t,
+                                    void * __user *dstptr, int *size);
 
 #endif /* CONFIG_COMPAT */
 #endif /* __KERNEL__ */
diff --git a/include/linux/netfilter/xt_DSCP.h b/include/linux/netfilter/xt_DSCP.h
new file mode 100644
index 000000000000..3c7c963997bd
--- /dev/null
+++ b/include/linux/netfilter/xt_DSCP.h
@@ -0,0 +1,20 @@
+/* x_tables module for setting the IPv4/IPv6 DSCP field
+ *
+ * (C) 2002 Harald Welte <laforge@gnumonks.org>
+ * based on ipt_FTOS.c (C) 2000 by Matthew G. Marsh <mgm@paktronix.com>
+ * This software is distributed under GNU GPL v2, 1991
+ *
+ * See RFC2474 for a description of the DSCP field within the IP Header.
+ *
+ * xt_DSCP.h,v 1.7 2002/03/14 12:03:13 laforge Exp
+*/
+#ifndef _XT_DSCP_TARGET_H
+#define _XT_DSCP_TARGET_H
+#include <linux/netfilter/xt_dscp.h>
+
+/* target info */
+struct xt_DSCP_info {
+        u_int8_t dscp;
+};
+
+#endif /* _XT_DSCP_TARGET_H */
diff --git a/include/linux/netfilter/xt_dscp.h b/include/linux/netfilter/xt_dscp.h
new file mode 100644
index 000000000000..1da61e6acaf7
--- /dev/null
+++ b/include/linux/netfilter/xt_dscp.h
@@ -0,0 +1,23 @@
+/* x_tables module for matching the IPv4/IPv6 DSCP field
+ *
+ * (C) 2002 Harald Welte <laforge@gnumonks.org>
+ * This software is distributed under GNU GPL v2, 1991
+ *
+ * See RFC2474 for a description of the DSCP field within the IP Header.
+ *
+ * xt_dscp.h,v 1.3 2002/08/05 19:00:21 laforge Exp
+*/
+#ifndef _XT_DSCP_H
+#define _XT_DSCP_H
+
+#define XT_DSCP_MASK    0xfc    /* 11111100 */
+#define XT_DSCP_SHIFT   2
+#define XT_DSCP_MAX     0x3f    /* 00111111 */
+
+/* match info */
+struct xt_dscp_info {
+        u_int8_t dscp;
+        u_int8_t invert;
+};
+
+#endif /* _XT_DSCP_H */
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 62cc27daca4e..149e87c9ab13 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -248,8 +248,7 @@ extern unsigned int arpt_do_table(struct sk_buff **pskb,
                                   unsigned int hook,
                                   const struct net_device *in,
                                   const struct net_device *out,
-                                  struct arpt_table *table,
-                                  void *userdata);
+                                  struct arpt_table *table);
 
 #define ARPT_ALIGN(s) (((s) + (__alignof__(struct arpt_entry)-1)) & ~(__alignof__(struct arpt_entry)-1))
 #endif /*__KERNEL__*/
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 427c67ff89e9..9a4dd11af86e 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -5,9 +5,8 @@
  */
 
 #include <linux/netfilter.h>
-#if defined(__KERNEL__) && defined(CONFIG_BRIDGE_NETFILTER)
 #include <linux/if_ether.h>
-#endif
+#include <linux/if_vlan.h>
 
 /* Bridge Hooks */
 /* After promisc drops, checksum checks. */
@@ -47,40 +46,20 @@ enum nf_br_hook_priorities {
 
 
 /* Only used in br_forward.c */
-static inline
-int nf_bridge_maybe_copy_header(struct sk_buff *skb)
+extern int nf_bridge_copy_header(struct sk_buff *skb);
+static inline int nf_bridge_maybe_copy_header(struct sk_buff *skb)
 {
-        int err;
-
-        if (skb->nf_bridge) {
-                if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
-                        err = skb_cow(skb, 18);
-                        if (err)
-                                return err;
-                        memcpy(skb->data - 18, skb->nf_bridge->data, 18);
-                        skb_push(skb, 4);
-                } else {
-                        err = skb_cow(skb, 16);
-                        if (err)
-                                return err;
-                        memcpy(skb->data - 16, skb->nf_bridge->data, 16);
-                }
-        }
-        return 0;
+        if (skb->nf_bridge)
+                return nf_bridge_copy_header(skb);
+        return 0;
 }
 
 /* This is called by the IP fragmenting code and it ensures there is
  * enough room for the encapsulating header (if there is one). */
-static inline
-int nf_bridge_pad(struct sk_buff *skb)
+static inline int nf_bridge_pad(const struct sk_buff *skb)
 {
-        if (skb->protocol == __constant_htons(ETH_P_IP))
-                return 0;
-        if (skb->nf_bridge) {
-                if (skb->protocol == __constant_htons(ETH_P_8021Q))
-                        return 4;
-        }
-        return 0;
+        return (skb->nf_bridge && skb->protocol == htons(ETH_P_8021Q))
+                ? VLAN_HLEN : 0;
 }
 
 struct bridge_skb_cb {
@@ -90,6 +69,9 @@ struct bridge_skb_cb {
 };
 
 extern int brnf_deferred_hooks;
+#else
+#define nf_bridge_maybe_copy_header(skb)        (0)
+#define nf_bridge_pad(skb)                      (0)
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_helper.h b/include/linux/netfilter_ipv4/ip_conntrack_helper.h
index 8d69279ccfe4..77fe868d36ff 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_helper.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_helper.h
@@ -25,6 +25,8 @@ struct ip_conntrack_helper
                     struct ip_conntrack *ct,
                     enum ip_conntrack_info conntrackinfo);
 
+        void (*destroy)(struct ip_conntrack *ct);
+
         int (*to_nfattr)(struct sk_buff *skb, const struct ip_conntrack *ct);
 };
 
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_pptp.h b/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
index 816144c75de0..2644b1faddd6 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
@@ -31,8 +31,8 @@ struct ip_ct_pptp_master {
         /* everything below is going to be per-expectation in newnat,
          * since there could be more than one call within one session */
         enum pptp_ctrlcall_state cstate;        /* call state */
-        u_int16_t pac_call_id;                  /* call id of PAC, host byte order */
-        u_int16_t pns_call_id;                  /* call id of PNS, host byte order */
+        __be16 pac_call_id;                     /* call id of PAC, host byte order */
+        __be16 pns_call_id;                     /* call id of PNS, host byte order */
 
         /* in pre-2.6.11 this used to be per-expect. Now it is per-conntrack
          * and therefore imposes a fixed limit on the number of maps */
@@ -42,8 +42,8 @@ struct ip_ct_pptp_master {
 /* conntrack_expect private member */
 struct ip_ct_pptp_expect {
         enum pptp_ctrlcall_state cstate;        /* call state */
-        u_int16_t pac_call_id;                  /* call id of PAC */
-        u_int16_t pns_call_id;                  /* call id of PNS */
+        __be16 pac_call_id;                     /* call id of PAC */
+        __be16 pns_call_id;                     /* call id of PNS */
 };
 
 
@@ -107,8 +107,7 @@ struct PptpControlHeader {
 
 struct PptpStartSessionRequest {
         __be16  protocolVersion;
-        __u8    reserved1;
-        __u8    reserved2;
+        __u16   reserved1;
         __be32  framingCapability;
         __be32  bearerCapability;
         __be16  maxChannels;
@@ -143,6 +142,8 @@ struct PptpStartSessionReply {
 
 struct PptpStopSessionRequest {
         __u8    reason;
+        __u8    reserved1;
+        __u16   reserved2;
 };
 
 /* PptpStopSessionResultCode */
@@ -152,6 +153,7 @@ struct PptpStopSessionRequest {
 struct PptpStopSessionReply {
         __u8    resultCode;
         __u8    generalErrorCode;
+        __u16   reserved1;
 };
 
 struct PptpEchoRequest {
@@ -188,9 +190,8 @@ struct PptpOutCallRequest {
         __be32  framingType;
         __be16  packetWindow;
         __be16  packetProcDelay;
-        __u16   reserved1;
         __be16  phoneNumberLength;
-        __u16   reserved2;
+        __u16   reserved1;
         __u8    phoneNumber[64];
         __u8    subAddress[64];
 };
@@ -285,19 +286,19 @@ struct PptpSetLinkInfo {
 };
 
 union pptp_ctrl_union {
-                struct PptpStartSessionRequest  sreq;
-                struct PptpStartSessionReply    srep;
-                struct PptpStopSessionRequest   streq;
-                struct PptpStopSessionReply     strep;
-                struct PptpOutCallRequest       ocreq;
-                struct PptpOutCallReply         ocack;
-                struct PptpInCallRequest        icreq;
-                struct PptpInCallReply          icack;
-                struct PptpInCallConnected      iccon;
-                struct PptpClearCallRequest     clrreq;
-                struct PptpCallDisconnectNotify disc;
-                struct PptpWanErrorNotify       wanerr;
-                struct PptpSetLinkInfo          setlink;
+        struct PptpStartSessionRequest  sreq;
+        struct PptpStartSessionReply    srep;
+        struct PptpStopSessionRequest   streq;
+        struct PptpStopSessionReply     strep;
+        struct PptpOutCallRequest       ocreq;
+        struct PptpOutCallReply         ocack;
+        struct PptpInCallRequest        icreq;
+        struct PptpInCallReply          icack;
+        struct PptpInCallConnected      iccon;
+        struct PptpClearCallRequest     clrreq;
+        struct PptpCallDisconnectNotify disc;
+        struct PptpWanErrorNotify       wanerr;
+        struct PptpSetLinkInfo          setlink;
 };
 
 extern int
@@ -314,7 +315,7 @@ extern int
                           struct PptpControlHeader *ctlh,
                           union pptp_ctrl_union *pptpReq);
 
-extern int
+extern void
 (*ip_nat_pptp_hook_exp_gre)(struct ip_conntrack_expect *exp_orig,
                             struct ip_conntrack_expect *exp_reply);
 
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
index 8d090ef82f5f..1d853aa873eb 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
@@ -49,18 +49,18 @@ struct gre_hdr {
 #else
 #error "Adjust your <asm/byteorder.h> defines"
 #endif
-        __u16   protocol;
+        __be16  protocol;
 };
 
 /* modified GRE header for PPTP */
 struct gre_hdr_pptp {
-        __u8  flags;            /* bitfield */
-        __u8  version;          /* should be GRE_VERSION_PPTP */
-        __u16 protocol;         /* should be GRE_PROTOCOL_PPTP */
-        __u16 payload_len;      /* size of ppp payload, not inc. gre header */
-        __u16 call_id;          /* peer's call_id for this session */
-        __u32 seq;              /* sequence number.  Present if S==1 */
-        __u32 ack;              /* seq number of highest packet recieved by */
+        __u8   flags;           /* bitfield */
+        __u8   version;         /* should be GRE_VERSION_PPTP */
+        __be16 protocol;        /* should be GRE_PROTOCOL_PPTP */
+        __be16 payload_len;     /* size of ppp payload, not inc. gre header */
+        __be16 call_id;         /* peer's call_id for this session */
+        __be32 seq;             /* sequence number.  Present if S==1 */
+        __be32 ack;             /* seq number of highest packet recieved by */
                                 /*  sender in this session */
 };
 
@@ -92,13 +92,13 @@ void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct);
 
 
 /* get pointer to gre key, if present */
-static inline u_int32_t *gre_key(struct gre_hdr *greh)
+static inline __be32 *gre_key(struct gre_hdr *greh)
 {
         if (!greh->key)
                 return NULL;
         if (greh->csum || greh->routing)
-                return (u_int32_t *) (greh+sizeof(*greh)+4);
-        return (u_int32_t *) (greh+sizeof(*greh));
+                return (__be32 *) (greh+sizeof(*greh)+4);
+        return (__be32 *) (greh+sizeof(*greh));
 }
 
 /* get pointer ot gre csum, if present */
diff --git a/include/linux/netfilter_ipv4/ip_nat.h b/include/linux/netfilter_ipv4/ip_nat.h
index e9f5ed1d9f68..98f8407e4cb5 100644
--- a/include/linux/netfilter_ipv4/ip_nat.h
+++ b/include/linux/netfilter_ipv4/ip_nat.h
@@ -72,10 +72,6 @@ extern unsigned int ip_nat_setup_info(struct ip_conntrack *conntrack,
 extern int ip_nat_used_tuple(const struct ip_conntrack_tuple *tuple,
                              const struct ip_conntrack *ignored_conntrack);
 
-/* Calculate relative checksum. */
-extern u_int16_t ip_nat_cheat_check(u_int32_t oldvalinv,
-                                    u_int32_t newval,
-                                    u_int16_t oldcheck);
 #else  /* !__KERNEL__: iptables wants this to compile. */
 #define ip_nat_multi_range ip_nat_multi_range_compat
 #endif /*__KERNEL__*/
diff --git a/include/linux/netfilter_ipv4/ip_nat_core.h b/include/linux/netfilter_ipv4/ip_nat_core.h
index 30db23f06b03..60566f9fd7b3 100644
--- a/include/linux/netfilter_ipv4/ip_nat_core.h
+++ b/include/linux/netfilter_ipv4/ip_nat_core.h
@@ -11,8 +11,8 @@ extern unsigned int ip_nat_packet(struct ip_conntrack *ct,
                                unsigned int hooknum,
                                struct sk_buff **pskb);
 
-extern int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
-                                         struct ip_conntrack *ct,
-                                         enum ip_nat_manip_type manip,
-                                         enum ip_conntrack_dir dir);
+extern int ip_nat_icmp_reply_translation(struct ip_conntrack *ct,
+                                         enum ip_conntrack_info ctinfo,
+                                         unsigned int hooknum,
+                                         struct sk_buff **pskb);
 #endif /* _IP_NAT_CORE_H */
diff --git a/include/linux/netfilter_ipv4/ip_nat_pptp.h b/include/linux/netfilter_ipv4/ip_nat_pptp.h
index eaf66c2e8f93..36668bf0f373 100644
--- a/include/linux/netfilter_ipv4/ip_nat_pptp.h
+++ b/include/linux/netfilter_ipv4/ip_nat_pptp.h
@@ -4,8 +4,8 @@
 
 /* conntrack private data */
 struct ip_nat_pptp {
-        u_int16_t pns_call_id;          /* NAT'ed PNS call id */
-        u_int16_t pac_call_id;          /* NAT'ed PAC call id */
+        __be16 pns_call_id;             /* NAT'ed PNS call id */
+        __be16 pac_call_id;             /* NAT'ed PAC call id */
 };
 
 #endif /* _NAT_PPTP_H */
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index c0dac16e1902..a536bbdef145 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -312,8 +312,7 @@ extern unsigned int ipt_do_table(struct sk_buff **pskb,
                                  unsigned int hook,
                                  const struct net_device *in,
                                  const struct net_device *out,
-                                 struct ipt_table *table,
-                                 void *userdata);
+                                 struct ipt_table *table);
 
 #define IPT_ALIGN(s) XT_ALIGN(s)
 
diff --git a/include/linux/netfilter_ipv4/ipt_DSCP.h b/include/linux/netfilter_ipv4/ipt_DSCP.h
index b30f510b5bef..3491e524d5ea 100644
--- a/include/linux/netfilter_ipv4/ipt_DSCP.h
+++ b/include/linux/netfilter_ipv4/ipt_DSCP.h
@@ -11,10 +11,8 @@
 #ifndef _IPT_DSCP_TARGET_H
 #define _IPT_DSCP_TARGET_H
 #include <linux/netfilter_ipv4/ipt_dscp.h>
+#include <linux/netfilter/xt_DSCP.h>
 
-/* target info */
-struct ipt_DSCP_info {
-        u_int8_t dscp;
-};
+#define ipt_DSCP_info xt_DSCP_info
 
 #endif /* _IPT_DSCP_TARGET_H */
diff --git a/include/linux/netfilter_ipv4/ipt_dscp.h b/include/linux/netfilter_ipv4/ipt_dscp.h
index 2fa6dfe92894..4b82ca912b0e 100644
--- a/include/linux/netfilter_ipv4/ipt_dscp.h
+++ b/include/linux/netfilter_ipv4/ipt_dscp.h
@@ -10,14 +10,12 @@
 #ifndef _IPT_DSCP_H
 #define _IPT_DSCP_H
 
-#define IPT_DSCP_MASK   0xfc    /* 11111100 */
-#define IPT_DSCP_SHIFT  2
-#define IPT_DSCP_MAX    0x3f    /* 00111111 */
+#include <linux/netfilter/xt_dscp.h>
 
-/* match info */
-struct ipt_dscp_info {
-        u_int8_t dscp;
-        u_int8_t invert;
-};
+#define IPT_DSCP_MASK   XT_DSCP_MASK
+#define IPT_DSCP_SHIFT  XT_DSCP_SHIFT
+#define IPT_DSCP_MAX    XT_DSCP_MAX
+
+#define ipt_dscp_info   xt_dscp_info
 
 #endif /* _IPT_DSCP_H */
diff --git a/include/linux/netfilter_ipv4/listhelp.h b/include/linux/netfilter_ipv4/listhelp.h
deleted file mode 100644
index 5d92cf044d91..000000000000
--- a/include/linux/netfilter_ipv4/listhelp.h
+++ /dev/null
@@ -1,123 +0,0 @@
-#ifndef _LISTHELP_H
-#define _LISTHELP_H
-#include <linux/list.h>
-
-/* Header to do more comprehensive job than linux/list.h; assume list
-   is first entry in structure. */
-
-/* Return pointer to first true entry, if any, or NULL.  A macro
-   required to allow inlining of cmpfn. */
-#define LIST_FIND(head, cmpfn, type, args...)           \
-({                                                      \
-        const struct list_head *__i, *__j = NULL;       \
-                                                        \
-        ASSERT_READ_LOCK(head);                         \
-        list_for_each(__i, (head))                      \
-                if (cmpfn((const type)__i , ## args)) { \
-                        __j = __i;                      \
-                        break;                          \
-                }                                       \
-        (type)__j;                                      \
-})
-
-#define LIST_FIND_W(head, cmpfn, type, args...)         \
-({                                                      \
-        const struct list_head *__i, *__j = NULL;       \
-                                                        \
-        ASSERT_WRITE_LOCK(head);                        \
-        list_for_each(__i, (head))                      \
-                if (cmpfn((type)__i , ## args)) {       \
-                        __j = __i;                      \
-                        break;                          \
-                }                                       \
-        (type)__j;                                      \
-})
-
-/* Just like LIST_FIND but we search backwards */
-#define LIST_FIND_B(head, cmpfn, type, args...)         \
-({                                                      \
-        const struct list_head *__i, *__j = NULL;       \
-                                                        \
-        ASSERT_READ_LOCK(head);                         \
-        list_for_each_prev(__i, (head))                 \
-                if (cmpfn((const type)__i , ## args)) { \
-                        __j = __i;                      \
-                        break;                          \
-                }                                       \
-        (type)__j;                                      \
-})
-
-static inline int
-__list_cmp_same(const void *p1, const void *p2) { return p1 == p2; }
-
-/* Is this entry in the list? */
-static inline int
-list_inlist(struct list_head *head, const void *entry)
-{
-        return LIST_FIND(head, __list_cmp_same, void *, entry) != NULL;
-}
-
-/* Delete from list. */
-#ifdef CONFIG_NETFILTER_DEBUG
-#define LIST_DELETE(head, oldentry)                                     \
-do {                                                                    \
-        ASSERT_WRITE_LOCK(head);                                        \
-        if (!list_inlist(head, oldentry))                               \
-                printk("LIST_DELETE: %s:%u `%s'(%p) not in %s.\n",      \
-                       __FILE__, __LINE__, #oldentry, oldentry, #head); \
-        else list_del((struct list_head *)oldentry);                    \
-} while(0)
-#else
-#define LIST_DELETE(head, oldentry) list_del((struct list_head *)oldentry)
-#endif
-
-/* Append. */
-static inline void
-list_append(struct list_head *head, void *new)
-{
-        ASSERT_WRITE_LOCK(head);
-        list_add((new), (head)->prev);
-}
-
-/* Prepend. */
-static inline void
-list_prepend(struct list_head *head, void *new)
-{
-        ASSERT_WRITE_LOCK(head);
-        list_add(new, head);
-}
-
-/* Insert according to ordering function; insert before first true. */
-#define LIST_INSERT(head, new, cmpfn)                           \
-do {                                                            \
-        struct list_head *__i;                                  \
-        ASSERT_WRITE_LOCK(head);                                \
-        list_for_each(__i, (head))                              \
-                if ((new), (typeof (new))__i)                   \
-                        break;                                  \
-        list_add((struct list_head *)(new), __i->prev);         \
-} while(0)
-
-/* If the field after the list_head is a nul-terminated string, you
-   can use these functions. */
-static inline int __list_cmp_name(const void *i, const char *name)
-{
-        return strcmp(name, i+sizeof(struct list_head)) == 0;
-}
-
-/* Returns false if same name already in list, otherwise does insert. */
-static inline int
-list_named_insert(struct list_head *head, void *new)
-{
-        if (LIST_FIND(head, __list_cmp_name, void *,
-                      new + sizeof(struct list_head)))
-                return 0;
-        list_prepend(head, new);
-        return 1;
-}
-
-/* Find this named element in the list. */
-#define list_named_find(head, name)                     \
-LIST_FIND(head, __list_cmp_name, void *, name)
-
-#endif /*_LISTHELP_H*/
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 52a7b9e76428..d97e268cdfe5 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -73,6 +73,7 @@ enum nf_ip6_hook_priorities {
 };
 
 #ifdef CONFIG_NETFILTER
+extern int ip6_route_me_harder(struct sk_buff *skb);
 extern unsigned int nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                                     unsigned int dataoff, u_int8_t protocol);
 
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index d0d5d1ee4be3..d7a8e9c0dad0 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -300,8 +300,7 @@ extern unsigned int ip6t_do_table(struct sk_buff **pskb,
                                   unsigned int hook,
                                   const struct net_device *in,
                                   const struct net_device *out,
-                                  struct ip6t_table *table,
-                                  void *userdata);
+                                  struct ip6t_table *table);
 
 /* Check for an extension */
 extern int ip6t_ext_hdr(u8 nexthdr);
diff --git a/include/linux/netfilter_logging.h b/include/linux/netfilter_logging.h
deleted file mode 100644
index 562bb6aad4e1..000000000000
--- a/include/linux/netfilter_logging.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* Internal logging interface, which relies on the real 
-   LOG target modules */
-#ifndef __LINUX_NETFILTER_LOGGING_H
-#define __LINUX_NETFILTER_LOGGING_H
-
-#ifdef __KERNEL__
-#include <asm/atomic.h>
-
-struct nf_logging_t {
-        void (*nf_log_packet)(struct sk_buff **pskb,
-                              unsigned int hooknum,
-                              const struct net_device *in,
-                              const struct net_device *out,
-                              const char *prefix);
-        void (*nf_log)(char *pfh, size_t len,
-                       const char *prefix);
-};
-
-extern void nf_log_register(int pf, const struct nf_logging_t *logging);
-extern void nf_log_unregister(int pf, const struct nf_logging_t *logging);
-
-extern void nf_log_packet(int pf,
-                          struct sk_buff **pskb,
-                          unsigned int hooknum,
-                          const struct net_device *in,
-                          const struct net_device *out,
-                          const char *fmt, ...);
-extern void nf_log(int pf,
-                   char *pfh, size_t len,
-                   const char *fmt, ...);
-#endif /*__KERNEL__*/
-
-#endif /*__LINUX_NETFILTER_LOGGING_H*/
diff --git a/include/linux/pkt_cls.h b/include/linux/pkt_cls.h
index bd2c5a2bbbf5..c3f01b3085a4 100644
--- a/include/linux/pkt_cls.h
+++ b/include/linux/pkt_cls.h
@@ -305,6 +305,7 @@ enum
         TCA_FW_POLICE,
         TCA_FW_INDEV, /*  used by CONFIG_NET_CLS_IND */
         TCA_FW_ACT, /* used by CONFIG_NET_CLS_ACT */
+        TCA_FW_MASK,
         __TCA_FW_MAX
 };
 
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index facd9ee37b76..9c92dc8b9a08 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -2,6 +2,7 @@
 #define __LINUX_RTNETLINK_H
 
 #include <linux/netlink.h>
+#include <linux/if.h>
 
 /****
  *              Routing/neighbour discovery messages.
@@ -238,10 +239,8 @@ enum rt_class_t
         RT_TABLE_DEFAULT=253,
         RT_TABLE_MAIN=254,
         RT_TABLE_LOCAL=255,
-        __RT_TABLE_MAX
+        RT_TABLE_MAX=0xFFFFFFFF
 };
-#define RT_TABLE_MAX (__RT_TABLE_MAX - 1)
-
 
 
 /* Routing message attributes */
@@ -263,6 +262,7 @@ enum rtattr_type_t
         RTA_CACHEINFO,
         RTA_SESSION,
         RTA_MP_ALGO,
+        RTA_TABLE,
         __RTA_MAX
 };
 
@@ -383,226 +383,6 @@ struct rta_session
         } u;
 };
 
-
-/*********************************************************
- *              Interface address.
- ****/
-
-struct ifaddrmsg
-{
-        unsigned char   ifa_family;
-        unsigned char   ifa_prefixlen;  /* The prefix length            */
-        unsigned char   ifa_flags;      /* Flags                        */
-        unsigned char   ifa_scope;      /* See above                    */
-        int             ifa_index;      /* Link index                   */
-};
-
-enum
-{
-        IFA_UNSPEC,
-        IFA_ADDRESS,
-        IFA_LOCAL,
-        IFA_LABEL,
-        IFA_BROADCAST,
-        IFA_ANYCAST,
-        IFA_CACHEINFO,
-        IFA_MULTICAST,
-        __IFA_MAX
-};
-
-#define IFA_MAX (__IFA_MAX - 1)
-
-/* ifa_flags */
-
-#define IFA_F_SECONDARY         0x01
-#define IFA_F_TEMPORARY         IFA_F_SECONDARY
-
-#define IFA_F_DEPRECATED        0x20
-#define IFA_F_TENTATIVE         0x40
-#define IFA_F_PERMANENT         0x80
-
-struct ifa_cacheinfo
-{
-        __u32   ifa_prefered;
-        __u32   ifa_valid;
-        __u32   cstamp; /* created timestamp, hundredths of seconds */
-        __u32   tstamp; /* updated timestamp, hundredths of seconds */
-};
-
-
-#define IFA_RTA(r)  ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct ifaddrmsg))))
-#define IFA_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct ifaddrmsg))
-
-/*
-   Important comment:
-   IFA_ADDRESS is prefix address, rather than local interface address.
-   It makes no difference for normally configured broadcast interfaces,
-   but for point-to-point IFA_ADDRESS is DESTINATION address,
-   local address is supplied in IFA_LOCAL attribute.
- */
-
-/**************************************************************
- *              Neighbour discovery.
- ****/
-
-struct ndmsg
-{
-        unsigned char   ndm_family;
-        unsigned char   ndm_pad1;
-        unsigned short  ndm_pad2;
-        int             ndm_ifindex;    /* Link index                   */
-        __u16           ndm_state;
-        __u8            ndm_flags;
-        __u8            ndm_type;
-};
-
-enum
-{
-        NDA_UNSPEC,
-        NDA_DST,
-        NDA_LLADDR,
-        NDA_CACHEINFO,
-        NDA_PROBES,
-        __NDA_MAX
-};
-
-#define NDA_MAX (__NDA_MAX - 1)
-
-#define NDA_RTA(r)  ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct ndmsg))))
-#define NDA_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct ndmsg))
-
-/*
- *      Neighbor Cache Entry Flags
- */
-
-#define NTF_PROXY       0x08    /* == ATF_PUBL */
-#define NTF_ROUTER      0x80
-
-/*
- *      Neighbor Cache Entry States.
- */
-
-#define NUD_INCOMPLETE  0x01
-#define NUD_REACHABLE   0x02
-#define NUD_STALE       0x04
-#define NUD_DELAY       0x08
-#define NUD_PROBE       0x10
-#define NUD_FAILED      0x20
-
-/* Dummy states */
-#define NUD_NOARP       0x40
-#define NUD_PERMANENT   0x80
-#define NUD_NONE        0x00
-
-
-struct nda_cacheinfo
-{
-        __u32           ndm_confirmed;
-        __u32           ndm_used;
-        __u32           ndm_updated;
-        __u32           ndm_refcnt;
-};
-
-
-/*****************************************************************
- *              Neighbour tables specific messages.
- *
- * To retrieve the neighbour tables send RTM_GETNEIGHTBL with the
- * NLM_F_DUMP flag set. Every neighbour table configuration is
- * spread over multiple messages to avoid running into message
- * size limits on systems with many interfaces. The first message
- * in the sequence transports all not device specific data such as
- * statistics, configuration, and the default parameter set.
- * This message is followed by 0..n messages carrying device
- * specific parameter sets.
- * Although the ordering should be sufficient, NDTA_NAME can be
- * used to identify sequences. The initial message can be identified
- * by checking for NDTA_CONFIG. The device specific messages do
- * not contain this TLV but have NDTPA_IFINDEX set to the
- * corresponding interface index.
- *
- * To change neighbour table attributes, send RTM_SETNEIGHTBL
- * with NDTA_NAME set. Changeable attribute include NDTA_THRESH[1-3],
- * NDTA_GC_INTERVAL, and all TLVs in NDTA_PARMS unless marked
- * otherwise. Device specific parameter sets can be changed by
- * setting NDTPA_IFINDEX to the interface index of the corresponding
- * device.
- ****/
-
-struct ndt_stats
-{
-        __u64           ndts_allocs;
-        __u64           ndts_destroys;
-        __u64           ndts_hash_grows;
-        __u64           ndts_res_failed;
-        __u64           ndts_lookups;
-        __u64           ndts_hits;
-        __u64           ndts_rcv_probes_mcast;
-        __u64           ndts_rcv_probes_ucast;
-        __u64           ndts_periodic_gc_runs;
-        __u64           ndts_forced_gc_runs;
-};
-
-enum {
-        NDTPA_UNSPEC,
-        NDTPA_IFINDEX,                  /* u32, unchangeable */
-        NDTPA_REFCNT,                   /* u32, read-only */
-        NDTPA_REACHABLE_TIME,           /* u64, read-only, msecs */
-        NDTPA_BASE_REACHABLE_TIME,      /* u64, msecs */
-        NDTPA_RETRANS_TIME,             /* u64, msecs */
-        NDTPA_GC_STALETIME,             /* u64, msecs */
-        NDTPA_DELAY_PROBE_TIME,         /* u64, msecs */
-        NDTPA_QUEUE_LEN,                /* u32 */
-        NDTPA_APP_PROBES,               /* u32 */
-        NDTPA_UCAST_PROBES,             /* u32 */
-        NDTPA_MCAST_PROBES,             /* u32 */
-        NDTPA_ANYCAST_DELAY,            /* u64, msecs */
-        NDTPA_PROXY_DELAY,              /* u64, msecs */
-        NDTPA_PROXY_QLEN,               /* u32 */
-        NDTPA_LOCKTIME,                 /* u64, msecs */
-        __NDTPA_MAX
-};
-#define NDTPA_MAX (__NDTPA_MAX - 1)
-
-struct ndtmsg
-{
-        __u8            ndtm_family;
-        __u8            ndtm_pad1;
-        __u16           ndtm_pad2;
-};
-
-struct ndt_config
-{
-        __u16           ndtc_key_len;
-        __u16           ndtc_entry_size;
-        __u32           ndtc_entries;
-        __u32           ndtc_last_flush;        /* delta to now in msecs */
-        __u32           ndtc_last_rand;         /* delta to now in msecs */
-        __u32           ndtc_hash_rnd;
-        __u32           ndtc_hash_mask;
-        __u32           ndtc_hash_chain_gc;
-        __u32           ndtc_proxy_qlen;
-};
-
-enum {
-        NDTA_UNSPEC,
-        NDTA_NAME,                      /* char *, unchangeable */
-        NDTA_THRESH1,                   /* u32 */
-        NDTA_THRESH2,                   /* u32 */
-        NDTA_THRESH3,                   /* u32 */
-        NDTA_CONFIG,                    /* struct ndt_config, read-only */
-        NDTA_PARMS,                     /* nested TLV NDTPA_* */
-        NDTA_STATS,                     /* struct ndt_stats, read-only */
-        NDTA_GC_INTERVAL,               /* u64, msecs */
-        __NDTA_MAX
-};
-#define NDTA_MAX (__NDTA_MAX - 1)
-
-#define NDTA_RTA(r) ((struct rtattr*)(((char*)(r)) + \
-                     NLMSG_ALIGN(sizeof(struct ndtmsg))))
-#define NDTA_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct ndtmsg))
-
-
 /****
  *              General form of address family dependent message.
  ****/
@@ -663,138 +443,6 @@ struct prefix_cacheinfo
         __u32   valid_time;
 };
 
-/* The struct should be in sync with struct net_device_stats */
-struct rtnl_link_stats
-{
-        __u32   rx_packets;             /* total packets received       */
-        __u32   tx_packets;             /* total packets transmitted    */
-        __u32   rx_bytes;               /* total bytes received         */
-        __u32   tx_bytes;               /* total bytes transmitted      */
-        __u32   rx_errors;              /* bad packets received         */
-        __u32   tx_errors;              /* packet transmit problems     */
-        __u32   rx_dropped;             /* no space in linux buffers    */
-        __u32   tx_dropped;             /* no space available in linux  */
-        __u32   multicast;              /* multicast packets received   */
-        __u32   collisions;
-
-        /* detailed rx_errors: */
-        __u32   rx_length_errors;
-        __u32   rx_over_errors;         /* receiver ring buff overflow  */
-        __u32   rx_crc_errors;          /* recved pkt with crc error    */
-        __u32   rx_frame_errors;        /* recv'd frame alignment error */
-        __u32   rx_fifo_errors;         /* recv'r fifo overrun          */
-        __u32   rx_missed_errors;       /* receiver missed packet       */
-
-        /* detailed tx_errors */
-        __u32   tx_aborted_errors;
-        __u32   tx_carrier_errors;
-        __u32   tx_fifo_errors;
-        __u32   tx_heartbeat_errors;
-        __u32   tx_window_errors;
-        
-        /* for cslip etc */
-        __u32   rx_compressed;
-        __u32   tx_compressed;
-};
-
-/* The struct should be in sync with struct ifmap */
-struct rtnl_link_ifmap
-{
-        __u64   mem_start;
-        __u64   mem_end;
-        __u64   base_addr;
-        __u16   irq;
-        __u8    dma;
-        __u8    port;
-};
-
-enum
-{
-        IFLA_UNSPEC,
-        IFLA_ADDRESS,
-        IFLA_BROADCAST,
-        IFLA_IFNAME,
-        IFLA_MTU,
-        IFLA_LINK,
-        IFLA_QDISC,
-        IFLA_STATS,
-        IFLA_COST,
-#define IFLA_COST IFLA_COST
-        IFLA_PRIORITY,
-#define IFLA_PRIORITY IFLA_PRIORITY
-        IFLA_MASTER,
-#define IFLA_MASTER IFLA_MASTER
-        IFLA_WIRELESS,          /* Wireless Extension event - see wireless.h */
-#define IFLA_WIRELESS IFLA_WIRELESS
-        IFLA_PROTINFO,          /* Protocol specific information for a link */
-#define IFLA_PROTINFO IFLA_PROTINFO
-        IFLA_TXQLEN,
-#define IFLA_TXQLEN IFLA_TXQLEN
-        IFLA_MAP,
-#define IFLA_MAP IFLA_MAP
-        IFLA_WEIGHT,
-#define IFLA_WEIGHT IFLA_WEIGHT
-        IFLA_OPERSTATE,
-        IFLA_LINKMODE,
-        __IFLA_MAX
-};
-
-
-#define IFLA_MAX (__IFLA_MAX - 1)
-
-#define IFLA_RTA(r)  ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct ifinfomsg))))
-#define IFLA_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct ifinfomsg))
-
-/* ifi_flags.
-
-   IFF_* flags.
-
-   The only change is:
-   IFF_LOOPBACK, IFF_BROADCAST and IFF_POINTOPOINT are
-   more not changeable by user. They describe link media
-   characteristics and set by device driver.
-
-   Comments:
-   - Combination IFF_BROADCAST|IFF_POINTOPOINT is invalid
-   - If neither of these three flags are set;
-     the interface is NBMA.
-
-   - IFF_MULTICAST does not mean anything special:
-   multicasts can be used on all not-NBMA links.
-   IFF_MULTICAST means that this media uses special encapsulation
-   for multicast frames. Apparently, all IFF_POINTOPOINT and
-   IFF_BROADCAST devices are able to use multicasts too.
- */
-
-/* IFLA_LINK.
-   For usual devices it is equal ifi_index.
-   If it is a "virtual interface" (f.e. tunnel), ifi_link
-   can point to real physical interface (f.e. for bandwidth calculations),
-   or maybe 0, what means, that real media is unknown (usual
-   for IPIP tunnels, when route to endpoint is allowed to change)
- */
-
-/* Subtype attributes for IFLA_PROTINFO */
-enum
-{
-        IFLA_INET6_UNSPEC,
-        IFLA_INET6_FLAGS,       /* link flags                   */
-        IFLA_INET6_CONF,        /* sysctl parameters            */
-        IFLA_INET6_STATS,       /* statistics                   */
-        IFLA_INET6_MCAST,       /* MC things. What of them?     */
-        IFLA_INET6_CACHEINFO,   /* time values and max reasm size */
-        __IFLA_INET6_MAX
-};
-
-#define IFLA_INET6_MAX  (__IFLA_INET6_MAX - 1)
-
-struct ifla_cacheinfo
-{
-        __u32   max_reasm_len;
-        __u32   tstamp;         /* ipv6InterfaceTable updated timestamp */
-        __u32   reachable_time;
-        __u32   retrans_time;
-};
 
 /*****************************************************************
  *              Traffic control messages.
@@ -885,10 +533,13 @@ enum rtnetlink_groups {
         RTNLGRP_NOP2,
         RTNLGRP_DECnet_ROUTE,
 #define RTNLGRP_DECnet_ROUTE    RTNLGRP_DECnet_ROUTE
-        RTNLGRP_NOP3,
+        RTNLGRP_DECnet_RULE,
+#define RTNLGRP_DECnet_RULE     RTNLGRP_DECnet_RULE
         RTNLGRP_NOP4,
         RTNLGRP_IPV6_PREFIX,
 #define RTNLGRP_IPV6_PREFIX     RTNLGRP_IPV6_PREFIX
+        RTNLGRP_IPV6_RULE,
+#define RTNLGRP_IPV6_RULE       RTNLGRP_IPV6_RULE
         __RTNLGRP_MAX
 };
 #define RTNLGRP_MAX     (__RTNLGRP_MAX - 1)
@@ -923,8 +574,6 @@ extern int rtattr_parse(struct rtattr *tb[], int maxattr, struct rtattr *rta, in
 #define rtattr_parse_nested(tb, max, rta) \
         rtattr_parse((tb), (max), RTA_DATA((rta)), RTA_PAYLOAD((rta)))
 
-extern struct sock *rtnl;
-
 struct rtnetlink_link
 {
         int (*doit)(struct sk_buff *, struct nlmsghdr*, void *attr);
@@ -933,6 +582,10 @@ struct rtnetlink_link
 
 extern struct rtnetlink_link * rtnetlink_links[NPROTO];
 extern int rtnetlink_send(struct sk_buff *skb, u32 pid, u32 group, int echo);
+extern int rtnl_unicast(struct sk_buff *skb, u32 pid);
+extern int rtnl_notify(struct sk_buff *skb, u32 pid, u32 group,
+                       struct nlmsghdr *nlh, gfp_t flags);
+extern void rtnl_set_sk_err(u32 group, int error);
 extern int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics);
 
 extern void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data);
@@ -1065,6 +718,13 @@ extern void __rtnl_unlock(void);
         } \
 } while(0)
 
+static inline u32 rtm_get_table(struct rtattr **rta, u8 table)
+{
+        return RTA_GET_U32(rta[RTA_TABLE-1]);
+rtattr_failure:
+        return table;
+}
+
 #endif /* __KERNEL__ */
 
 
diff --git a/include/linux/security.h b/include/linux/security.h
index 6bc2aad494ff..9f56fb8a4a6c 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -31,6 +31,8 @@
 #include <linux/msg.h>
 #include <linux/sched.h>
 #include <linux/key.h>
+#include <linux/xfrm.h>
+#include <net/flow.h>
 
 struct ctl_table;
 
@@ -88,6 +90,7 @@ extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 struct nfsctl_arg;
 struct sched_param;
 struct swap_info_struct;
+struct request_sock;
 
 /* bprm_apply_creds unsafe reasons */
 #define LSM_UNSAFE_SHARE        1
@@ -812,9 +815,19 @@ struct swap_info_struct;
  *      which is used to copy security attributes between local stream sockets.
  * @sk_free_security:
  *      Deallocate security structure.
- * @sk_getsid:
- *      Retrieve the LSM-specific sid for the sock to enable caching of network
+ * @sk_clone_security:
+ *      Clone/copy security structure.
+ * @sk_getsecid:
+ *      Retrieve the LSM-specific secid for the sock to enable caching of network
  *      authorizations.
+ * @sock_graft:
+ *      Sets the socket's isec sid to the sock's sid.
+ * @inet_conn_request:
+ *      Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
+ * @inet_csk_clone:
+ *      Sets the new child socket's sid to the openreq sid.
+ * @req_classify_flow:
+ *      Sets the flow's sid to the openreq sid.
  *
  * Security hooks for XFRM operations.
  *
@@ -823,9 +836,10 @@ struct swap_info_struct;
  *      used by the XFRM system.
  *      @sec_ctx contains the security context information being provided by
  *      the user-level policy update program (e.g., setkey).
- *      Allocate a security structure to the xp->security field.
- *      The security field is initialized to NULL when the xfrm_policy is
- *      allocated.
+ *      @sk refers to the sock from which to derive the security context.
+ *      Allocate a security structure to the xp->security field; the security
+ *      field is initialized to NULL when the xfrm_policy is allocated. Only
+ *      one of sec_ctx or sock can be specified.
  *      Return 0 if operation was successful (memory to allocate, legal context)
  * @xfrm_policy_clone_security:
  *      @old contains an existing xfrm_policy in the SPD.
@@ -844,9 +858,14 @@ struct swap_info_struct;
  *      Database by the XFRM system.
  *      @sec_ctx contains the security context information being provided by
  *      the user-level SA generation program (e.g., setkey or racoon).
- *      Allocate a security structure to the x->security field.  The
- *      security field is initialized to NULL when the xfrm_state is
- *      allocated.
+ *      @polsec contains the security context information associated with a xfrm
+ *      policy rule from which to take the base context. polsec must be NULL
+ *      when sec_ctx is specified.
+ *      @secid contains the secid from which to take the mls portion of the context.
+ *      Allocate a security structure to the x->security field; the security
+ *      field is initialized to NULL when the xfrm_state is allocated. Set the
+ *      context to correspond to either sec_ctx or polsec, with the mls portion
+ *      taken from secid in the latter case.
  *      Return 0 if operation was successful (memory to allocate, legal context).
  * @xfrm_state_free_security:
  *      @x contains the xfrm_state.
@@ -857,13 +876,27 @@ struct swap_info_struct;
  * @xfrm_policy_lookup:
  *      @xp contains the xfrm_policy for which the access control is being
  *      checked.
- *      @sk_sid contains the sock security label that is used to authorize
+ *      @fl_secid contains the flow security label that is used to authorize
  *      access to the policy xp.
  *      @dir contains the direction of the flow (input or output).
- *      Check permission when a sock selects a xfrm_policy for processing
+ *      Check permission when a flow selects a xfrm_policy for processing
  *      XFRMs on a packet.  The hook is called when selecting either a
  *      per-socket policy or a generic xfrm policy.
  *      Return 0 if permission is granted.
+ * @xfrm_state_pol_flow_match:
+ *      @x contains the state to match.
+ *      @xp contains the policy to check for a match.
+ *      @fl contains the flow to check for a match.
+ *      Return 1 if there is a match.
+ * @xfrm_flow_state_match:
+ *      @fl contains the flow key to match.
+ *      @xfrm points to the xfrm_state to match.
+ *      Return 1 if there is a match.
+ * @xfrm_decode_session:
+ *      @skb points to skb to decode.
+ *      @secid points to the flow key secid to set.
+ *      @ckall says if all xfrms used should be checked for same secid.
+ *      Return 0 if ckall is zero or all xfrms used have the same secid.
  *
  * Security hooks affecting all Key Management operations
  *
@@ -1308,8 +1341,8 @@ struct security_operations {
         int (*unix_may_send) (struct socket * sock, struct socket * other);
 
         int (*socket_create) (int family, int type, int protocol, int kern);
-        void (*socket_post_create) (struct socket * sock, int family,
-                                    int type, int protocol, int kern);
+        int (*socket_post_create) (struct socket * sock, int family,
+                                   int type, int protocol, int kern);
         int (*socket_bind) (struct socket * sock,
                             struct sockaddr * address, int addrlen);
         int (*socket_connect) (struct socket * sock,
@@ -1332,18 +1365,31 @@ struct security_operations {
         int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);
         int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
         void (*sk_free_security) (struct sock *sk);
-        unsigned int (*sk_getsid) (struct sock *sk, struct flowi *fl, u8 dir);
+        void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);
+        void (*sk_getsecid) (struct sock *sk, u32 *secid);
+        void (*sock_graft)(struct sock* sk, struct socket *parent);
+        int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb,
+                                        struct request_sock *req);
+        void (*inet_csk_clone)(struct sock *newsk, const struct request_sock *req);
+        void (*req_classify_flow)(const struct request_sock *req, struct flowi *fl);
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-        int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx);
+        int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp,
+                        struct xfrm_user_sec_ctx *sec_ctx, struct sock *sk);
         int (*xfrm_policy_clone_security) (struct xfrm_policy *old, struct xfrm_policy *new);
         void (*xfrm_policy_free_security) (struct xfrm_policy *xp);
         int (*xfrm_policy_delete_security) (struct xfrm_policy *xp);
-        int (*xfrm_state_alloc_security) (struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
+        int (*xfrm_state_alloc_security) (struct xfrm_state *x,
+                struct xfrm_user_sec_ctx *sec_ctx, struct xfrm_sec_ctx *polsec,
+                u32 secid);
         void (*xfrm_state_free_security) (struct xfrm_state *x);
         int (*xfrm_state_delete_security) (struct xfrm_state *x);
-        int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 sk_sid, u8 dir);
+        int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
+        int (*xfrm_state_pol_flow_match)(struct xfrm_state *x,
+                        struct xfrm_policy *xp, struct flowi *fl);
+        int (*xfrm_flow_state_match)(struct flowi *fl, struct xfrm_state *xfrm);
+        int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall);
 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
 
         /* key management security hooks */
@@ -2778,13 +2824,13 @@ static inline int security_socket_create (int family, int type,
         return security_ops->socket_create(family, type, protocol, kern);
 }
 
-static inline void security_socket_post_create(struct socket * sock, 
-                                               int family,
-                                               int type, 
-                                               int protocol, int kern)
+static inline int security_socket_post_create(struct socket * sock,
+                                              int family,
+                                              int type,
+                                              int protocol, int kern)
 {
-        security_ops->socket_post_create(sock, family, type,
-                                         protocol, kern);
+        return security_ops->socket_post_create(sock, family, type,
+                                                protocol, kern);
 }
 
 static inline int security_socket_bind(struct socket * sock, 
@@ -2885,9 +2931,36 @@ static inline void security_sk_free(struct sock *sk)
         return security_ops->sk_free_security(sk);
 }
 
-static inline unsigned int security_sk_sid(struct sock *sk, struct flowi *fl, u8 dir)
+static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
+{
+        return security_ops->sk_clone_security(sk, newsk);
+}
+
+static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
 {
-        return security_ops->sk_getsid(sk, fl, dir);
+        security_ops->sk_getsecid(sk, &fl->secid);
+}
+
+static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+{
+        security_ops->req_classify_flow(req, fl);
+}
+
+static inline void security_sock_graft(struct sock* sk, struct socket *parent)
+{
+        security_ops->sock_graft(sk, parent);
+}
+
+static inline int security_inet_conn_request(struct sock *sk,
+                        struct sk_buff *skb, struct request_sock *req)
+{
+        return security_ops->inet_conn_request(sk, skb, req);
+}
+
+static inline void security_inet_csk_clone(struct sock *newsk,
+                        const struct request_sock *req)
+{
+        security_ops->inet_csk_clone(newsk, req);
 }
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct socket * sock,
@@ -2909,11 +2982,12 @@ static inline int security_socket_create (int family, int type,
         return 0;
 }
 
-static inline void security_socket_post_create(struct socket * sock, 
-                                               int family,
-                                               int type, 
-                                               int protocol, int kern)
+static inline int security_socket_post_create(struct socket * sock,
+                                              int family,
+                                              int type,
+                                              int protocol, int kern)
 {
+        return 0;
 }
 
 static inline int security_socket_bind(struct socket * sock, 
@@ -3011,16 +3085,43 @@ static inline void security_sk_free(struct sock *sk)
 {
 }
 
-static inline unsigned int security_sk_sid(struct sock *sk, struct flowi *fl, u8 dir)
+static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
+{
+}
+
+static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
+{
+}
+
+static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+{
+}
+
+static inline void security_sock_graft(struct sock* sk, struct socket *parent)
+{
+}
+
+static inline int security_inet_conn_request(struct sock *sk,
+                        struct sk_buff *skb, struct request_sock *req)
 {
         return 0;
 }
+
+static inline void security_inet_csk_clone(struct sock *newsk,
+                        const struct request_sock *req)
+{
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
 {
-        return security_ops->xfrm_policy_alloc_security(xp, sec_ctx);
+        return security_ops->xfrm_policy_alloc_security(xp, sec_ctx, NULL);
+}
+
+static inline int security_xfrm_sock_policy_alloc(struct xfrm_policy *xp, struct sock *sk)
+{
+        return security_ops->xfrm_policy_alloc_security(xp, NULL, sk);
 }
 
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
@@ -3038,9 +3139,18 @@ static inline int security_xfrm_policy_delete(struct xfrm_policy *xp)
         return security_ops->xfrm_policy_delete_security(xp);
 }
 
-static inline int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
+static inline int security_xfrm_state_alloc(struct xfrm_state *x,
+                        struct xfrm_user_sec_ctx *sec_ctx)
 {
-        return security_ops->xfrm_state_alloc_security(x, sec_ctx);
+        return security_ops->xfrm_state_alloc_security(x, sec_ctx, NULL, 0);
+}
+
+static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
+                                struct xfrm_sec_ctx *polsec, u32 secid)
+{
+        if (!polsec)
+                return 0;
+        return security_ops->xfrm_state_alloc_security(x, NULL, polsec, secid);
 }
 
 static inline int security_xfrm_state_delete(struct xfrm_state *x)
@@ -3053,9 +3163,32 @@ static inline void security_xfrm_state_free(struct xfrm_state *x)
         security_ops->xfrm_state_free_security(x);
 }
 
-static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
+static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
+{
+        return security_ops->xfrm_policy_lookup(xp, fl_secid, dir);
+}
+
+static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
+                        struct xfrm_policy *xp, struct flowi *fl)
 {
-        return security_ops->xfrm_policy_lookup(xp, sk_sid, dir);
+        return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
+}
+
+static inline int security_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm)
+{
+        return security_ops->xfrm_flow_state_match(fl, xfrm);
+}
+
+static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
+{
+        return security_ops->xfrm_decode_session(skb, secid, 1);
+}
+
+static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
+{
+        int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0);
+
+        BUG_ON(rc);
 }
 #else   /* CONFIG_SECURITY_NETWORK_XFRM */
 static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
@@ -3063,6 +3196,11 @@ static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm
         return 0;
 }
 
+static inline int security_xfrm_sock_policy_alloc(struct xfrm_policy *xp, struct sock *sk)
+{
+        return 0;
+}
+
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
 {
         return 0;
@@ -3077,7 +3215,14 @@ static inline int security_xfrm_policy_delete(struct xfrm_policy *xp)
         return 0;
 }
 
-static inline int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
+static inline int security_xfrm_state_alloc(struct xfrm_state *x,
+                                        struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return 0;
+}
+
+static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
+                                        struct xfrm_sec_ctx *polsec, u32 secid)
 {
         return 0;
 }
@@ -3091,10 +3236,32 @@ static inline int security_xfrm_state_delete(struct xfrm_state *x)
         return 0;
 }
 
-static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
+static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
+{
+        return 0;
+}
+
+static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
+                        struct xfrm_policy *xp, struct flowi *fl)
+{
+        return 1;
+}
+
+static inline int security_xfrm_flow_state_match(struct flowi *fl,
+                                struct xfrm_state *xfrm)
+{
+        return 1;
+}
+
+static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 {
         return 0;
 }
+
+static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
+{
+}
+
 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
 
 #ifdef CONFIG_KEYS
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 755e9cddac47..85577a4ffa61 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -34,8 +34,9 @@
 #define HAVE_ALIGNABLE_SKB      /* Ditto 8)                */
 
 #define CHECKSUM_NONE 0
-#define CHECKSUM_HW 1
+#define CHECKSUM_PARTIAL 1
 #define CHECKSUM_UNNECESSARY 2
+#define CHECKSUM_COMPLETE 3
 
 #define SKB_DATA_ALIGN(X)       (((X) + (SMP_CACHE_BYTES - 1)) & \
                                  ~(SMP_CACHE_BYTES - 1))
@@ -56,17 +57,17 @@
  *            Apparently with secret goal to sell you new device, when you
  *            will add new protocol to your host. F.e. IPv6. 8)
  *
- *      HW: the most generic way. Device supplied checksum of _all_
+ *      COMPLETE: the most generic way. Device supplied checksum of _all_
  *          the packet as seen by netif_rx in skb->csum.
  *          NOTE: Even if device supports only some protocols, but
- *          is able to produce some skb->csum, it MUST use HW,
+ *          is able to produce some skb->csum, it MUST use COMPLETE,
  *          not UNNECESSARY.
  *
  * B. Checksumming on output.
  *
  *      NONE: skb is checksummed by protocol or csum is not required.
  *
- *      HW: device is required to csum packet as seen by hard_start_xmit
+ *      PARTIAL: device is required to csum packet as seen by hard_start_xmit
  *      from skb->h.raw to the end and to record the checksum
  *      at skb->h.raw+skb->csum.
  *
@@ -1261,14 +1262,14 @@ static inline int skb_linearize_cow(struct sk_buff *skb)
  *      @len: length of data pulled
  *
  *      After doing a pull on a received packet, you need to call this to
- *      update the CHECKSUM_HW checksum, or set ip_summed to CHECKSUM_NONE
- *      so that it can be recomputed from scratch.
+ *      update the CHECKSUM_COMPLETE checksum, or set ip_summed to
+ *      CHECKSUM_NONE so that it can be recomputed from scratch.
  */
 
 static inline void skb_postpull_rcsum(struct sk_buff *skb,
                                       const void *start, unsigned int len)
 {
-        if (skb->ip_summed == CHECKSUM_HW)
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
                 skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
 }
 
@@ -1287,7 +1288,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
 {
         if (likely(len >= skb->len))
                 return 0;
-        if (skb->ip_summed == CHECKSUM_HW)
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
                 skb->ip_summed = CHECKSUM_NONE;
         return __pskb_trim(skb, len);
 }
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 4db25d5c7cd1..854aa6b543f1 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -155,42 +155,11 @@ enum
         UDP_MIB_NOPORTS,                        /* NoPorts */
         UDP_MIB_INERRORS,                       /* InErrors */
         UDP_MIB_OUTDATAGRAMS,                   /* OutDatagrams */
+        UDP_MIB_RCVBUFERRORS,                   /* RcvbufErrors */
+        UDP_MIB_SNDBUFERRORS,                   /* SndbufErrors */
         __UDP_MIB_MAX
 };
 
-/* sctp mib definitions */
-/*
- * draft-ietf-sigtran-sctp-mib-07.txt
- */
-enum
-{
-        SCTP_MIB_NUM = 0,
-        SCTP_MIB_CURRESTAB,                     /* CurrEstab */
-        SCTP_MIB_ACTIVEESTABS,                  /* ActiveEstabs */
-        SCTP_MIB_PASSIVEESTABS,                 /* PassiveEstabs */
-        SCTP_MIB_ABORTEDS,                      /* Aborteds */
-        SCTP_MIB_SHUTDOWNS,                     /* Shutdowns */
-        SCTP_MIB_OUTOFBLUES,                    /* OutOfBlues */
-        SCTP_MIB_CHECKSUMERRORS,                /* ChecksumErrors */
-        SCTP_MIB_OUTCTRLCHUNKS,                 /* OutCtrlChunks */
-        SCTP_MIB_OUTORDERCHUNKS,                /* OutOrderChunks */
-        SCTP_MIB_OUTUNORDERCHUNKS,              /* OutUnorderChunks */
-        SCTP_MIB_INCTRLCHUNKS,                  /* InCtrlChunks */
-        SCTP_MIB_INORDERCHUNKS,                 /* InOrderChunks */
-        SCTP_MIB_INUNORDERCHUNKS,               /* InUnorderChunks */
-        SCTP_MIB_FRAGUSRMSGS,                   /* FragUsrMsgs */
-        SCTP_MIB_REASMUSRMSGS,                  /* ReasmUsrMsgs */
-        SCTP_MIB_OUTSCTPPACKS,                  /* OutSCTPPacks */
-        SCTP_MIB_INSCTPPACKS,                   /* InSCTPPacks */
-        SCTP_MIB_RTOALGORITHM,                  /* RtoAlgorithm */
-        SCTP_MIB_RTOMIN,                        /* RtoMin */
-        SCTP_MIB_RTOMAX,                        /* RtoMax */
-        SCTP_MIB_RTOINITIAL,                    /* RtoInitial */
-        SCTP_MIB_VALCOOKIELIFE,                 /* ValCookieLife */
-        SCTP_MIB_MAXINITRETR,                   /* MaxInitRetr */
-        __SCTP_MIB_MAX
-};
-
 /* linux mib definitions */
 enum
 {
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index e4b1a4d4dcf3..736ed917a4f8 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -411,6 +411,10 @@ enum
         NET_IPV4_TCP_WORKAROUND_SIGNED_WINDOWS=115,
         NET_TCP_DMA_COPYBREAK=116,
         NET_TCP_SLOW_START_AFTER_IDLE=117,
+        NET_CIPSOV4_CACHE_ENABLE=118,
+        NET_CIPSOV4_CACHE_BUCKET_SIZE=119,
+        NET_CIPSOV4_RBM_OPTFMT=120,
+        NET_CIPSOV4_RBM_STRICTVALID=121,
 };
 
 enum {
@@ -552,6 +556,7 @@ enum {
         NET_IPV6_ACCEPT_RA_RTR_PREF=20,
         NET_IPV6_RTR_PROBE_INTERVAL=21,
         NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
+        NET_IPV6_PROXY_NDP=23,
         __NET_IPV6_MAX
 };
 
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 46a15c7a1a13..14ecd19f4cdc 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -104,6 +104,13 @@ struct xfrm_stats {
 
 enum
 {
+        XFRM_POLICY_TYPE_MAIN   = 0,
+        XFRM_POLICY_TYPE_SUB    = 1,
+        XFRM_POLICY_TYPE_MAX    = 2
+};
+
+enum
+{
         XFRM_POLICY_IN  = 0,
         XFRM_POLICY_OUT = 1,
         XFRM_POLICY_FWD = 2,
@@ -120,7 +127,9 @@ enum
 
 #define XFRM_MODE_TRANSPORT 0
 #define XFRM_MODE_TUNNEL 1
-#define XFRM_MODE_MAX 2
+#define XFRM_MODE_ROUTEOPTIMIZATION 2
+#define XFRM_MODE_IN_TRIGGER 3
+#define XFRM_MODE_MAX 4
 
 /* Netlink configuration messages.  */
 enum {
@@ -164,6 +173,10 @@ enum {
 #define XFRM_MSG_NEWAE XFRM_MSG_NEWAE
         XFRM_MSG_GETAE,
 #define XFRM_MSG_GETAE XFRM_MSG_GETAE
+
+        XFRM_MSG_REPORT,
+#define XFRM_MSG_REPORT XFRM_MSG_REPORT
+
         __XFRM_MSG_MAX
 };
 #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
@@ -217,6 +230,12 @@ enum xfrm_ae_ftype_t {
 #define XFRM_AE_MAX (__XFRM_AE_MAX - 1)
 };
 
+struct xfrm_userpolicy_type {
+        __u8            type;
+        __u16           reserved1;
+        __u8            reserved2;
+};
+
 /* Netlink message attributes.  */
 enum xfrm_attr_type_t {
         XFRMA_UNSPEC,
@@ -232,6 +251,10 @@ enum xfrm_attr_type_t {
         XFRMA_REPLAY_VAL,
         XFRMA_REPLAY_THRESH,
         XFRMA_ETIMER_THRESH,
+        XFRMA_SRCADDR,          /* xfrm_address_t */
+        XFRMA_COADDR,           /* xfrm_address_t */
+        XFRMA_LASTUSED,
+        XFRMA_POLICY_TYPE,      /* struct xfrm_userpolicy_type */
         __XFRMA_MAX
 
 #define XFRMA_MAX (__XFRMA_MAX - 1)
@@ -247,12 +270,13 @@ struct xfrm_usersa_info {
         __u32                           seq;
         __u32                           reqid;
         __u16                           family;
-        __u8                            mode; /* 0=transport,1=tunnel */
+        __u8                            mode;           /* XFRM_MODE_xxx */
         __u8                            replay_window;
         __u8                            flags;
 #define XFRM_STATE_NOECN        1
 #define XFRM_STATE_DECAP_DSCP   2
 #define XFRM_STATE_NOPMTUDISC   4
+#define XFRM_STATE_WILDRECV     8
 };
 
 struct xfrm_usersa_id {
@@ -319,12 +343,18 @@ struct xfrm_usersa_flush {
         __u8                            proto;
 };
 
+struct xfrm_user_report {
+        __u8                            proto;
+        struct xfrm_selector            sel;
+};
+
 #ifndef __KERNEL__
 /* backwards compatibility for userspace */
 #define XFRMGRP_ACQUIRE         1
 #define XFRMGRP_EXPIRE          2
 #define XFRMGRP_SA              4
 #define XFRMGRP_POLICY          8
+#define XFRMGRP_REPORT          0x10
 #endif
 
 enum xfrm_nlgroups {
@@ -340,6 +370,8 @@ enum xfrm_nlgroups {
 #define XFRMNLGRP_POLICY        XFRMNLGRP_POLICY
         XFRMNLGRP_AEVENTS,
 #define XFRMNLGRP_AEVENTS       XFRMNLGRP_AEVENTS
+        XFRMNLGRP_REPORT,
+#define XFRMNLGRP_REPORT        XFRMNLGRP_REPORT
         __XFRMNLGRP_MAX
 };
 #define XFRMNLGRP_MAX   (__XFRMNLGRP_MAX - 1)