Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.26

16 files changed, 273 insertions, 146 deletions

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 89e6c72ad295..e4c66593b5c6 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -6,11 +6,13 @@
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/net.h>
+#include <linux/netdevice.h>
 #include <linux/if.h>
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/wait.h>
 #include <linux/list.h>
+#include <net/net_namespace.h>
 #endif
 #include <linux/compiler.h>
 
@@ -76,7 +78,6 @@ extern void netfilter_init(void);
 #define NF_MAX_HOOKS 8
 
 struct sk_buff;
-struct net_device;
 
 typedef unsigned int nf_hookfn(unsigned int hooknum,
                                struct sk_buff *skb,
@@ -233,6 +234,11 @@ struct nf_afinfo {
         unsigned short  family;
         __sum16         (*checksum)(struct sk_buff *skb, unsigned int hook,
                                     unsigned int dataoff, u_int8_t protocol);
+        __sum16         (*checksum_partial)(struct sk_buff *skb,
+                                            unsigned int hook,
+                                            unsigned int dataoff,
+                                            unsigned int len,
+                                            u_int8_t protocol);
         int             (*route)(struct dst_entry **dst, struct flowi *fl);
         void            (*saveroute)(const struct sk_buff *skb,
                                      struct nf_queue_entry *entry);
@@ -262,6 +268,23 @@ nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
         return csum;
 }
 
+static inline __sum16
+nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
+                    unsigned int dataoff, unsigned int len,
+                    u_int8_t protocol, unsigned short family)
+{
+        const struct nf_afinfo *afinfo;
+        __sum16 csum = 0;
+
+        rcu_read_lock();
+        afinfo = nf_get_afinfo(family);
+        if (afinfo)
+                csum = afinfo->checksum_partial(skb, hook, dataoff, len,
+                                                protocol);
+        rcu_read_unlock();
+        return csum;
+}
+
 extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
 extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
 
@@ -320,5 +343,56 @@ extern void (*nf_ct_destroy)(struct nf_conntrack *);
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 #endif
 
+static inline struct net *nf_pre_routing_net(const struct net_device *in,
+                                             const struct net_device *out)
+{
+#ifdef CONFIG_NET_NS
+        return in->nd_net;
+#else
+        return &init_net;
+#endif
+}
+
+static inline struct net *nf_local_in_net(const struct net_device *in,
+                                          const struct net_device *out)
+{
+#ifdef CONFIG_NET_NS
+        return in->nd_net;
+#else
+        return &init_net;
+#endif
+}
+
+static inline struct net *nf_forward_net(const struct net_device *in,
+                                         const struct net_device *out)
+{
+#ifdef CONFIG_NET_NS
+        BUG_ON(in->nd_net != out->nd_net);
+        return in->nd_net;
+#else
+        return &init_net;
+#endif
+}
+
+static inline struct net *nf_local_out_net(const struct net_device *in,
+                                           const struct net_device *out)
+{
+#ifdef CONFIG_NET_NS
+        return out->nd_net;
+#else
+        return &init_net;
+#endif
+}
+
+static inline struct net *nf_post_routing_net(const struct net_device *in,
+                                              const struct net_device *out)
+{
+#ifdef CONFIG_NET_NS
+        return out->nd_net;
+#else
+        return &init_net;
+#endif
+}
+
 #endif /*__KERNEL__*/
 #endif /*__LINUX_NETFILTER_H*/
diff --git a/include/linux/netfilter/nf_conntrack_dccp.h b/include/linux/netfilter/nf_conntrack_dccp.h
new file mode 100644
index 000000000000..40dcc82058d1
--- /dev/null
+++ b/include/linux/netfilter/nf_conntrack_dccp.h
@@ -0,0 +1,40 @@
+#ifndef _NF_CONNTRACK_DCCP_H
+#define _NF_CONNTRACK_DCCP_H
+
+/* Exposed to userspace over nfnetlink */
+enum ct_dccp_states {
+        CT_DCCP_NONE,
+        CT_DCCP_REQUEST,
+        CT_DCCP_RESPOND,
+        CT_DCCP_PARTOPEN,
+        CT_DCCP_OPEN,
+        CT_DCCP_CLOSEREQ,
+        CT_DCCP_CLOSING,
+        CT_DCCP_TIMEWAIT,
+        CT_DCCP_IGNORE,
+        CT_DCCP_INVALID,
+        __CT_DCCP_MAX
+};
+#define CT_DCCP_MAX             (__CT_DCCP_MAX - 1)
+
+enum ct_dccp_roles {
+        CT_DCCP_ROLE_CLIENT,
+        CT_DCCP_ROLE_SERVER,
+        __CT_DCCP_ROLE_MAX
+};
+#define CT_DCCP_ROLE_MAX        (__CT_DCCP_ROLE_MAX - 1)
+
+#ifdef __KERNEL__
+#include <net/netfilter/nf_conntrack_tuple.h>
+
+struct nf_ct_dccp {
+        u_int8_t        role[IP_CT_DIR_MAX];
+        u_int8_t        state;
+        u_int8_t        last_pkt;
+        u_int8_t        last_dir;
+        u_int64_t       handshake_seq;
+};
+
+#endif /* __KERNEL__ */
+
+#endif /* _NF_CONNTRACK_DCCP_H */
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index e3e1533aba2d..0a383ac083cb 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -80,6 +80,7 @@ enum ctattr_l4proto {
 enum ctattr_protoinfo {
         CTA_PROTOINFO_UNSPEC,
         CTA_PROTOINFO_TCP,
+        CTA_PROTOINFO_DCCP,
         __CTA_PROTOINFO_MAX
 };
 #define CTA_PROTOINFO_MAX (__CTA_PROTOINFO_MAX - 1)
@@ -95,6 +96,13 @@ enum ctattr_protoinfo_tcp {
 };
 #define CTA_PROTOINFO_TCP_MAX (__CTA_PROTOINFO_TCP_MAX - 1)
 
+enum ctattr_protoinfo_dccp {
+        CTA_PROTOINFO_DCCP_UNSPEC,
+        CTA_PROTOINFO_DCCP_STATE,
+        __CTA_PROTOINFO_DCCP_MAX,
+};
+#define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1)
+
 enum ctattr_counters {
         CTA_COUNTERS_UNSPEC,
         CTA_COUNTERS_PACKETS,           /* old 64bit counters */
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index b2c62cc618f5..2326296b6f25 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -430,13 +430,13 @@ extern int xt_compat_add_offset(int af, unsigned int offset, short delta);
 extern void xt_compat_flush_offsets(int af);
 extern short xt_compat_calc_jump(int af, unsigned int offset);
 
-extern int xt_compat_match_offset(struct xt_match *match);
+extern int xt_compat_match_offset(const struct xt_match *match);
 extern int xt_compat_match_from_user(struct xt_entry_match *m,
                                      void **dstptr, unsigned int *size);
 extern int xt_compat_match_to_user(struct xt_entry_match *m,
                                    void __user **dstptr, unsigned int *size);
 
-extern int xt_compat_target_offset(struct xt_target *target);
+extern int xt_compat_target_offset(const struct xt_target *target);
 extern void xt_compat_target_from_user(struct xt_entry_target *t,
                                        void **dstptr, unsigned int *size);
 extern int xt_compat_target_to_user(struct xt_entry_target *t,
diff --git a/include/linux/netfilter/xt_sctp.h b/include/linux/netfilter/xt_sctp.h
index dd5a4fd4cfd3..32000ba6ecef 100644
--- a/include/linux/netfilter/xt_sctp.h
+++ b/include/linux/netfilter/xt_sctp.h
@@ -37,68 +37,54 @@ struct xt_sctp_info {
 
 #define SCTP_CHUNKMAP_SET(chunkmap, type)               \
         do {                                            \
-                chunkmap[type / bytes(u_int32_t)] |=    \
+                (chunkmap)[type / bytes(u_int32_t)] |=  \
                         1 << (type % bytes(u_int32_t)); \
         } while (0)
 
 #define SCTP_CHUNKMAP_CLEAR(chunkmap, type)                     \
         do {                                                    \
-                chunkmap[type / bytes(u_int32_t)] &=            \
+                (chunkmap)[type / bytes(u_int32_t)] &=          \
                         ~(1 << (type % bytes(u_int32_t)));      \
         } while (0)
 
 #define SCTP_CHUNKMAP_IS_SET(chunkmap, type)                    \
 ({                                                              \
-        (chunkmap[type / bytes (u_int32_t)] &                   \
+        ((chunkmap)[type / bytes (u_int32_t)] &                 \
                 (1 << (type % bytes (u_int32_t)))) ? 1: 0;      \
 })
 
-#define SCTP_CHUNKMAP_RESET(chunkmap)                           \
-        do {                                                    \
-                int i;                                          \
-                for (i = 0; i < ARRAY_SIZE(chunkmap); i++)      \
-                        chunkmap[i] = 0;                        \
-        } while (0)
-
-#define SCTP_CHUNKMAP_SET_ALL(chunkmap)                         \
-        do {                                                    \
-                int i;                                          \
-                for (i = 0; i < ARRAY_SIZE(chunkmap); i++)      \
-                        chunkmap[i] = ~0;                       \
-        } while (0)
-
-#define SCTP_CHUNKMAP_COPY(destmap, srcmap)                     \
-        do {                                                    \
-                int i;                                          \
-                for (i = 0; i < ARRAY_SIZE(srcmap); i++)        \
-                        destmap[i] = srcmap[i];                 \
-        } while (0)
-
-#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap)                \
-({                                                      \
-        int i;                                          \
-        int flag = 1;                                   \
-        for (i = 0; i < ARRAY_SIZE(chunkmap); i++) {    \
-                if (chunkmap[i]) {                      \
-                        flag = 0;                       \
-                        break;                          \
-                }                                       \
-        }                                               \
-        flag;                                           \
-})
-
-#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap)              \
-({                                                      \
-        int i;                                          \
-        int flag = 1;                                   \
-        for (i = 0; i < ARRAY_SIZE(chunkmap); i++) {    \
-                if (chunkmap[i] != ~0) {                \
-                        flag = 0;                       \
-                                break;                  \
-                }                                       \
-        }                                               \
-        flag;                                           \
-})
+#define SCTP_CHUNKMAP_RESET(chunkmap) \
+        memset((chunkmap), 0, sizeof(chunkmap))
+
+#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
+        memset((chunkmap), ~0U, sizeof(chunkmap))
+
+#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
+        memcpy((destmap), (srcmap), sizeof(srcmap))
+
+#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
+        __sctp_chunkmap_is_clear((chunkmap), ARRAY_SIZE(chunkmap))
+static inline bool
+__sctp_chunkmap_is_clear(const u_int32_t *chunkmap, unsigned int n)
+{
+        unsigned int i;
+        for (i = 0; i < n; ++i)
+                if (chunkmap[i])
+                        return false;
+        return true;
+}
+
+#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
+        __sctp_chunkmap_is_all_set((chunkmap), ARRAY_SIZE(chunkmap))
+static inline bool
+__sctp_chunkmap_is_all_set(const u_int32_t *chunkmap, unsigned int n)
+{
+        unsigned int i;
+        for (i = 0; i < n; ++i)
+                if (chunkmap[i] != ~0U)
+                        return false;
+        return true;
+}
 
 #endif /* _XT_SCTP_H_ */
 
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index db223ca92c8b..dd9c97f2d436 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -23,8 +23,6 @@
 
 #define ARPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
 #define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
-#define arpt_target xt_target
-#define arpt_table xt_table
 
 #define ARPT_DEV_ADDR_LEN_MAX 16
 
@@ -266,20 +264,15 @@ struct arpt_error
         .target.errorname = "ERROR",                                           \
 }
 
-#define arpt_register_target(tgt)       \
-({      (tgt)->family = NF_ARP;         \
-        xt_register_target(tgt); })
-#define arpt_unregister_target(tgt) xt_unregister_target(tgt)
-
-extern struct arpt_table *arpt_register_table(struct net *net,
-                                              struct arpt_table *table,
-                                              const struct arpt_replace *repl);
-extern void arpt_unregister_table(struct arpt_table *table);
+extern struct xt_table *arpt_register_table(struct net *net,
+                                            struct xt_table *table,
+                                            const struct arpt_replace *repl);
+extern void arpt_unregister_table(struct xt_table *table);
 extern unsigned int arpt_do_table(struct sk_buff *skb,
                                   unsigned int hook,
                                   const struct net_device *in,
                                   const struct net_device *out,
-                                  struct arpt_table *table);
+                                  struct xt_table *table);
 
 #define ARPT_ALIGN(s) XT_ALIGN(s)
 
diff --git a/include/linux/netfilter_bridge/ebt_nflog.h b/include/linux/netfilter_bridge/ebt_nflog.h
new file mode 100644
index 000000000000..052817849b83
--- /dev/null
+++ b/include/linux/netfilter_bridge/ebt_nflog.h
@@ -0,0 +1,21 @@
+#ifndef __LINUX_BRIDGE_EBT_NFLOG_H
+#define __LINUX_BRIDGE_EBT_NFLOG_H
+
+#define EBT_NFLOG_MASK 0x0
+
+#define EBT_NFLOG_PREFIX_SIZE 64
+#define EBT_NFLOG_WATCHER "nflog"
+
+#define EBT_NFLOG_DEFAULT_GROUP         0x1
+#define EBT_NFLOG_DEFAULT_THRESHOLD     1
+
+struct ebt_nflog_info {
+        u_int32_t len;
+        u_int16_t group;
+        u_int16_t threshold;
+        u_int16_t flags;
+        u_int16_t pad;
+        char prefix[EBT_NFLOG_PREFIX_SIZE];
+};
+
+#endif                          /* __LINUX_BRIDGE_EBT_NFLOG_H */
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index 9a10092e358c..650318b0c405 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -62,8 +62,6 @@ enum nf_ip_hook_priorities {
         NF_IP_PRI_FILTER = 0,
         NF_IP_PRI_NAT_SRC = 100,
         NF_IP_PRI_SELINUX_LAST = 225,
-        NF_IP_PRI_CONNTRACK_HELPER = INT_MAX - 2,
-        NF_IP_PRI_NAT_SEQ_ADJUST = INT_MAX - 1,
         NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
         NF_IP_PRI_LAST = INT_MAX,
 };
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index a3567a7a6d67..2dbd6c015b94 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -20,6 +20,7 @@
 #include <asm/atomic.h>
 
 #include <linux/netfilter/nf_conntrack_tcp.h>
+#include <linux/netfilter/nf_conntrack_dccp.h>
 #include <linux/netfilter/nf_conntrack_sctp.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <net/netfilter/ipv4/nf_conntrack_icmp.h>
@@ -30,6 +31,7 @@
 /* per conntrack: protocol private data */
 union nf_conntrack_proto {
         /* insert conntrack proto private data here */
+        struct nf_ct_dccp dccp;
         struct ip_ct_sctp sctp;
         struct ip_ct_tcp tcp;
         struct ip_ct_icmp icmp;
@@ -63,14 +65,7 @@ union nf_conntrack_help {
 #include <linux/timer.h>
 
 #ifdef CONFIG_NETFILTER_DEBUG
-#define NF_CT_ASSERT(x)                                                 \
-do {                                                                    \
-        if (!(x))                                                       \
-                /* Wooah!  I'm tripping my conntrack in a frenzy of     \
-                   netplay... */                                        \
-                printk("NF_CT_ASSERT: %s:%i(%s)\n",                     \
-                       __FILE__, __LINE__, __FUNCTION__);               \
-} while(0)
+#define NF_CT_ASSERT(x)         WARN_ON(!(x))
 #else
 #define NF_CT_ASSERT(x)
 #endif
@@ -145,6 +140,16 @@ nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
                             tuplehash[hash->tuple.dst.dir]);
 }
 
+static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct)
+{
+        return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
+}
+
+static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct)
+{
+        return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
+}
+
 /* get master conntrack via master expectation */
 #define master_ct(conntr) (conntr->master)
 
@@ -189,12 +194,11 @@ extern void nf_conntrack_hash_insert(struct nf_conn *ct);
 
 extern void nf_conntrack_flush(void);
 
-extern int nf_ct_get_tuplepr(const struct sk_buff *skb,
-                             unsigned int nhoff,
-                             u_int16_t l3num,
-                             struct nf_conntrack_tuple *tuple);
-extern int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
-                                const struct nf_conntrack_tuple *orig);
+extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
+                              unsigned int nhoff, u_int16_t l3num,
+                              struct nf_conntrack_tuple *tuple);
+extern bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
+                                 const struct nf_conntrack_tuple *orig);
 
 extern void __nf_ct_refresh_acct(struct nf_conn *ct,
                                  enum ip_conntrack_info ctinfo,
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 9ee26469c759..a81771210934 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -30,7 +30,7 @@ extern void nf_conntrack_cleanup(void);
 extern int nf_conntrack_proto_init(void);
 extern void nf_conntrack_proto_fini(void);
 
-extern int
+extern bool
 nf_ct_get_tuple(const struct sk_buff *skb,
                 unsigned int nhoff,
                 unsigned int dataoff,
@@ -40,7 +40,7 @@ nf_ct_get_tuple(const struct sk_buff *skb,
                 const struct nf_conntrack_l3proto *l3proto,
                 const struct nf_conntrack_l4proto *l4proto);
 
-extern int
+extern bool
 nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
                    const struct nf_conntrack_tuple *orig,
                    const struct nf_conntrack_l3proto *l3proto,
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index b886e3ae6cad..0378676c3dd8 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -28,31 +28,20 @@ struct nf_conntrack_l3proto
          * Try to fill in the third arg: nhoff is offset of l3 proto
          * hdr.  Return true if possible.
          */
-        int (*pkt_to_tuple)(const struct sk_buff *skb, unsigned int nhoff,
-                            struct nf_conntrack_tuple *tuple);
+        bool (*pkt_to_tuple)(const struct sk_buff *skb, unsigned int nhoff,
+                             struct nf_conntrack_tuple *tuple);
 
         /*
          * Invert the per-proto part of the tuple: ie. turn xmit into reply.
          * Some packets can't be inverted: return 0 in that case.
          */
-        int (*invert_tuple)(struct nf_conntrack_tuple *inverse,
-                            const struct nf_conntrack_tuple *orig);
+        bool (*invert_tuple)(struct nf_conntrack_tuple *inverse,
+                             const struct nf_conntrack_tuple *orig);
 
         /* Print out the per-protocol part of the tuple. */
         int (*print_tuple)(struct seq_file *s,
                            const struct nf_conntrack_tuple *);
 
-        /* Returns verdict for packet, or -1 for invalid. */
-        int (*packet)(struct nf_conn *ct,
-                      const struct sk_buff *skb,
-                      enum ip_conntrack_info ctinfo);
-
-        /*
-         * Called when a new connection for this protocol found;
-         * returns TRUE if it's OK.  If so, packet() called next.
-         */
-        int (*new)(struct nf_conn *ct, const struct sk_buff *skb);
-
         /*
          * Called before tracking. 
          *      *dataoff: offset of protocol header (TCP, UDP,...) in skb
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index efc16eccddb1..723df9d1cc35 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -25,15 +25,14 @@ struct nf_conntrack_l4proto
 
         /* Try to fill in the third arg: dataoff is offset past network protocol
            hdr.  Return true if possible. */
-        int (*pkt_to_tuple)(const struct sk_buff *skb,
-                            unsigned int dataoff,
-                            struct nf_conntrack_tuple *tuple);
+        bool (*pkt_to_tuple)(const struct sk_buff *skb, unsigned int dataoff,
+                             struct nf_conntrack_tuple *tuple);
 
         /* Invert the per-proto part of the tuple: ie. turn xmit into reply.
          * Some packets can't be inverted: return 0 in that case.
          */
-        int (*invert_tuple)(struct nf_conntrack_tuple *inverse,
-                            const struct nf_conntrack_tuple *orig);
+        bool (*invert_tuple)(struct nf_conntrack_tuple *inverse,
+                             const struct nf_conntrack_tuple *orig);
 
         /* Returns verdict for packet, or -1 for invalid. */
         int (*packet)(struct nf_conn *ct,
@@ -45,8 +44,8 @@ struct nf_conntrack_l4proto
 
         /* Called when a new connection for this protocol found;
          * returns TRUE if it's OK.  If so, packet() called next. */
-        int (*new)(struct nf_conn *ct, const struct sk_buff *skb,
-                   unsigned int dataoff);
+        bool (*new)(struct nf_conn *ct, const struct sk_buff *skb,
+                    unsigned int dataoff);
 
         /* Called when a conntrack entry is destroyed */
         void (*destroy)(struct nf_conn *ct);
diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index 168c91754d89..1bb7087833d3 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -41,6 +41,9 @@ union nf_conntrack_man_proto
         } icmp;
         struct {
                 __be16 port;
+        } dccp;
+        struct {
+                __be16 port;
         } sctp;
         struct {
                 __be16 key;     /* GRE key is 32bit, PPtP only uses 16bit */
@@ -79,6 +82,9 @@ struct nf_conntrack_tuple
                         } icmp;
                         struct {
                                 __be16 port;
+                        } dccp;
+                        struct {
+                                __be16 port;
                         } sctp;
                         struct {
                                 __be16 key;
@@ -145,8 +151,6 @@ static inline void nf_ct_dump_tuple(const struct nf_conntrack_tuple *t)
         }
 }
 
-#define NF_CT_DUMP_TUPLE(tp)    nf_ct_dump_tuple(tp)
-
 /* If we're the first tuple, it's the original dir. */
 #define NF_CT_DIRECTION(h)                                              \
         ((enum ip_conntrack_dir)(h)->tuple.dst.dir)
@@ -160,61 +164,64 @@ struct nf_conntrack_tuple_hash
 
 #endif /* __KERNEL__ */
 
-static inline int __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
-                                          const struct nf_conntrack_tuple *t2)
+static inline bool __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
+                                           const struct nf_conntrack_tuple *t2)
 { 
         return (nf_inet_addr_cmp(&t1->src.u3, &t2->src.u3) &&
                 t1->src.u.all == t2->src.u.all &&
                 t1->src.l3num == t2->src.l3num);
 }
 
-static inline int __nf_ct_tuple_dst_equal(const struct nf_conntrack_tuple *t1,
-                                          const struct nf_conntrack_tuple *t2)
+static inline bool __nf_ct_tuple_dst_equal(const struct nf_conntrack_tuple *t1,
+                                           const struct nf_conntrack_tuple *t2)
 {
         return (nf_inet_addr_cmp(&t1->dst.u3, &t2->dst.u3) &&
                 t1->dst.u.all == t2->dst.u.all &&
                 t1->dst.protonum == t2->dst.protonum);
 }
 
-static inline int nf_ct_tuple_equal(const struct nf_conntrack_tuple *t1,
-                                    const struct nf_conntrack_tuple *t2)
+static inline bool nf_ct_tuple_equal(const struct nf_conntrack_tuple *t1,
+                                     const struct nf_conntrack_tuple *t2)
 {
         return __nf_ct_tuple_src_equal(t1, t2) &&
                __nf_ct_tuple_dst_equal(t1, t2);
 }
 
-static inline int nf_ct_tuple_mask_equal(const struct nf_conntrack_tuple_mask *m1,
-                                         const struct nf_conntrack_tuple_mask *m2)
+static inline bool
+nf_ct_tuple_mask_equal(const struct nf_conntrack_tuple_mask *m1,
+                       const struct nf_conntrack_tuple_mask *m2)
 {
         return (nf_inet_addr_cmp(&m1->src.u3, &m2->src.u3) &&
                 m1->src.u.all == m2->src.u.all);
 }
 
-static inline int nf_ct_tuple_src_mask_cmp(const struct nf_conntrack_tuple *t1,
-                                           const struct nf_conntrack_tuple *t2,
-                                           const struct nf_conntrack_tuple_mask *mask)
+static inline bool
+nf_ct_tuple_src_mask_cmp(const struct nf_conntrack_tuple *t1,
+                         const struct nf_conntrack_tuple *t2,
+                         const struct nf_conntrack_tuple_mask *mask)
 {
         int count;
 
         for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++) {
                 if ((t1->src.u3.all[count] ^ t2->src.u3.all[count]) &
                     mask->src.u3.all[count])
-                        return 0;
+                        return false;
         }
 
         if ((t1->src.u.all ^ t2->src.u.all) & mask->src.u.all)
-                return 0;
+                return false;
 
         if (t1->src.l3num != t2->src.l3num ||
             t1->dst.protonum != t2->dst.protonum)
-                return 0;
+                return false;
 
-        return 1;
+        return true;
 }
 
-static inline int nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,
-                                       const struct nf_conntrack_tuple *tuple,
-                                       const struct nf_conntrack_tuple_mask *mask)
+static inline bool
+nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,
+                     const struct nf_conntrack_tuple *tuple,
+                     const struct nf_conntrack_tuple_mask *mask)
 {
         return nf_ct_tuple_src_mask_cmp(t, tuple, mask) &&
                __nf_ct_tuple_dst_equal(t, tuple);
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 58dd22687949..237a961f40e1 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -24,6 +24,9 @@ extern int nf_nat_mangle_udp_packet(struct sk_buff *skb,
 extern int nf_nat_seq_adjust(struct sk_buff *skb,
                              struct nf_conn *ct,
                              enum ip_conntrack_info ctinfo);
+extern int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
+                                     struct nf_conn *ct,
+                                     enum ip_conntrack_info ctinfo);
 
 /* Setup NAT on this expected conntrack so it follows master, but goes
  * to port ct->master->saved_proto. */
diff --git a/include/net/netfilter/nf_nat_protocol.h b/include/net/netfilter/nf_nat_protocol.h
index 4aa0edbb5b96..f3662c4394ef 100644
--- a/include/net/netfilter/nf_nat_protocol.h
+++ b/include/net/netfilter/nf_nat_protocol.h
@@ -8,9 +8,6 @@ struct nf_nat_range;
 
 struct nf_nat_protocol
 {
-        /* Protocol name */
-        const char *name;
-
         /* Protocol number. */
         unsigned int protonum;
 
@@ -18,25 +15,25 @@ struct nf_nat_protocol
 
         /* Translate a packet to the target according to manip type.
            Return true if succeeded. */
-        int (*manip_pkt)(struct sk_buff *skb,
-                         unsigned int iphdroff,
-                         const struct nf_conntrack_tuple *tuple,
-                         enum nf_nat_manip_type maniptype);
+        bool (*manip_pkt)(struct sk_buff *skb,
+                          unsigned int iphdroff,
+                          const struct nf_conntrack_tuple *tuple,
+                          enum nf_nat_manip_type maniptype);
 
         /* Is the manipable part of the tuple between min and max incl? */
-        int (*in_range)(const struct nf_conntrack_tuple *tuple,
-                        enum nf_nat_manip_type maniptype,
-                        const union nf_conntrack_man_proto *min,
-                        const union nf_conntrack_man_proto *max);
+        bool (*in_range)(const struct nf_conntrack_tuple *tuple,
+                         enum nf_nat_manip_type maniptype,
+                         const union nf_conntrack_man_proto *min,
+                         const union nf_conntrack_man_proto *max);
 
         /* Alter the per-proto part of the tuple (depending on
            maniptype), to give a unique tuple in the given range if
            possible; return false if not.  Per-protocol part of tuple
            is initialized to the incoming packet. */
-        int (*unique_tuple)(struct nf_conntrack_tuple *tuple,
-                            const struct nf_nat_range *range,
-                            enum nf_nat_manip_type maniptype,
-                            const struct nf_conn *ct);
+        bool (*unique_tuple)(struct nf_conntrack_tuple *tuple,
+                             const struct nf_nat_range *range,
+                             enum nf_nat_manip_type maniptype,
+                             const struct nf_conn *ct);
 
         int (*range_to_nlattr)(struct sk_buff *skb,
                                const struct nf_nat_range *range);
@@ -62,9 +59,20 @@ extern int init_protocols(void) __init;
 extern void cleanup_protocols(void);
 extern const struct nf_nat_protocol *find_nat_proto(u_int16_t protonum);
 
-extern int nf_nat_port_range_to_nlattr(struct sk_buff *skb,
-                                       const struct nf_nat_range *range);
-extern int nf_nat_port_nlattr_to_range(struct nlattr *tb[],
-                                       struct nf_nat_range *range);
+extern bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
+                                  enum nf_nat_manip_type maniptype,
+                                  const union nf_conntrack_man_proto *min,
+                                  const union nf_conntrack_man_proto *max);
+
+extern bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
+                                      const struct nf_nat_range *range,
+                                      enum nf_nat_manip_type maniptype,
+                                      const struct nf_conn *ct,
+                                      u_int16_t *rover);
+
+extern int nf_nat_proto_range_to_nlattr(struct sk_buff *skb,
+                                        const struct nf_nat_range *range);
+extern int nf_nat_proto_nlattr_to_range(struct nlattr *tb[],
+                                        struct nf_nat_range *range);
 
 #endif /*_NF_NAT_PROTO_H*/
diff --git a/include/net/netfilter/nf_nat_rule.h b/include/net/netfilter/nf_nat_rule.h
index 75d1825031d7..e4a18ae361c6 100644
--- a/include/net/netfilter/nf_nat_rule.h
+++ b/include/net/netfilter/nf_nat_rule.h
@@ -14,7 +14,4 @@ extern int nf_nat_rule_find(struct sk_buff *skb,
 
 extern unsigned int
 alloc_null_binding(struct nf_conn *ct, unsigned int hooknum);
-
-extern unsigned int
-alloc_null_binding_confirmed(struct nf_conn *ct, unsigned int hooknum);
 #endif /* _NF_NAT_RULE_H */