Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

151 files changed, 3795 insertions, 3679 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 6a9a6cd74b1e..a4abed5b4c44 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -657,7 +657,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
 {
         struct nf_bridge_info *nf_bridge;
         struct net_device *parent;
-        int pf;
+        u_int8_t pf;
 
         if (!skb->nf_bridge)
                 return NF_ACCEPT;
@@ -791,7 +791,7 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
 {
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
         struct net_device *realoutdev = bridge_parent(skb->dev);
-        int pf;
+        u_int8_t pf;
 
 #ifdef CONFIG_NETFILTER_DEBUG
         /* Be very paranoid. This probably won't happen anymore, but let's
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 909479794999..366d3e9d51f8 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -2,21 +2,21 @@
 # Bridge netfilter configuration
 #
 
-menu "Bridge: Netfilter Configuration"
-        depends on BRIDGE && BRIDGE_NETFILTER
-
-config BRIDGE_NF_EBTABLES
+menuconfig BRIDGE_NF_EBTABLES
         tristate "Ethernet Bridge tables (ebtables) support"
+        select NETFILTER_XTABLES
         help
           ebtables is a general, extensible frame/packet identification
           framework. Say 'Y' or 'M' here if you want to do Ethernet
           filtering/NAT/brouting on the Ethernet bridge.
+
+if BRIDGE_NF_EBTABLES
+
 #
 # tables
 #
 config BRIDGE_EBT_BROUTE
         tristate "ebt: broute table support"
-        depends on BRIDGE_NF_EBTABLES
         help
           The ebtables broute table is used to define rules that decide between
           bridging and routing frames, giving Linux the functionality of a
@@ -27,7 +27,6 @@ config BRIDGE_EBT_BROUTE
 
 config BRIDGE_EBT_T_FILTER
         tristate "ebt: filter table support"
-        depends on BRIDGE_NF_EBTABLES
         help
           The ebtables filter table is used to define frame filtering rules at
           local input, forwarding and local output. See the man page for
@@ -37,7 +36,6 @@ config BRIDGE_EBT_T_FILTER
 
 config BRIDGE_EBT_T_NAT
         tristate "ebt: nat table support"
-        depends on BRIDGE_NF_EBTABLES
         help
           The ebtables nat table is used to define rules that alter the MAC
           source address (MAC SNAT) or the MAC destination address (MAC DNAT).
@@ -49,7 +47,6 @@ config BRIDGE_EBT_T_NAT
 #
 config BRIDGE_EBT_802_3
         tristate "ebt: 802.3 filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds matching support for 802.3 Ethernet frames.
 
@@ -57,7 +54,6 @@ config BRIDGE_EBT_802_3
 
 config BRIDGE_EBT_AMONG
         tristate "ebt: among filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the among match, which allows matching the MAC source
           and/or destination address on a list of addresses. Optionally,
@@ -67,7 +63,6 @@ config BRIDGE_EBT_AMONG
 
 config BRIDGE_EBT_ARP
         tristate "ebt: ARP filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the ARP match, which allows ARP and RARP header field
           filtering.
@@ -76,7 +71,6 @@ config BRIDGE_EBT_ARP
 
 config BRIDGE_EBT_IP
         tristate "ebt: IP filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the IP match, which allows basic IP header field
           filtering.
@@ -94,7 +88,6 @@ config BRIDGE_EBT_IP6
 
 config BRIDGE_EBT_LIMIT
         tristate "ebt: limit match support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the limit match, which allows you to control
           the rate at which a rule can be matched. This match is the
@@ -105,7 +98,6 @@ config BRIDGE_EBT_LIMIT
 
 config BRIDGE_EBT_MARK
         tristate "ebt: mark filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the mark match, which allows matching frames based on
           the 'nfmark' value in the frame. This can be set by the mark target.
@@ -116,7 +108,6 @@ config BRIDGE_EBT_MARK
 
 config BRIDGE_EBT_PKTTYPE
         tristate "ebt: packet type filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the packet type match, which allows matching on the
           type of packet based on its Ethernet "class" (as determined by
@@ -127,7 +118,6 @@ config BRIDGE_EBT_PKTTYPE
 
 config BRIDGE_EBT_STP
         tristate "ebt: STP filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the Spanning Tree Protocol match, which
           allows STP header field filtering.
@@ -136,7 +126,6 @@ config BRIDGE_EBT_STP
 
 config BRIDGE_EBT_VLAN
         tristate "ebt: 802.1Q VLAN filter support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the 802.1Q vlan match, which allows the filtering of
           802.1Q vlan fields.
@@ -156,7 +145,6 @@ config BRIDGE_EBT_ARPREPLY
 
 config BRIDGE_EBT_DNAT
         tristate "ebt: dnat target support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the MAC DNAT target, which allows altering the MAC
           destination address of frames.
@@ -165,7 +153,6 @@ config BRIDGE_EBT_DNAT
 
 config BRIDGE_EBT_MARK_T
         tristate "ebt: mark target support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the mark target, which allows marking frames by
           setting the 'nfmark' value in the frame.
@@ -176,7 +163,6 @@ config BRIDGE_EBT_MARK_T
 
 config BRIDGE_EBT_REDIRECT
         tristate "ebt: redirect target support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the MAC redirect target, which allows altering the MAC
           destination address of a frame to that of the device it arrived on.
@@ -185,7 +171,6 @@ config BRIDGE_EBT_REDIRECT
 
 config BRIDGE_EBT_SNAT
         tristate "ebt: snat target support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the MAC SNAT target, which allows altering the MAC
           source address of frames.
@@ -196,7 +181,6 @@ config BRIDGE_EBT_SNAT
 #
 config BRIDGE_EBT_LOG
         tristate "ebt: log support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option adds the log watcher, that you can use in any rule
           in any ebtables table. It records info about the frame header
@@ -206,7 +190,6 @@ config BRIDGE_EBT_LOG
 
 config BRIDGE_EBT_ULOG
         tristate "ebt: ulog support (OBSOLETE)"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option enables the old bridge-specific "ebt_ulog" implementation
           which has been obsoleted by the new "nfnetlink_log" code (see
@@ -223,7 +206,6 @@ config BRIDGE_EBT_ULOG
 
 config BRIDGE_EBT_NFLOG
         tristate "ebt: nflog support"
-        depends on BRIDGE_NF_EBTABLES
         help
           This option enables the nflog watcher, which allows to LOG
           messages through the netfilter logging API, which can use
@@ -235,4 +217,4 @@ config BRIDGE_EBT_NFLOG
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-endmenu
+endif # BRIDGE_NF_EBTABLES
diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index 98534025360f..bd91dc58d49b 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -7,64 +7,63 @@
  * May 2003
  *
  */
-
+#include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_802_3.h>
-#include <linux/module.h>
 
-static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
-   const struct net_device *out, const void *data, unsigned int datalen)
+static bool
+ebt_802_3_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_802_3_info *info = data;
+        const struct ebt_802_3_info *info = par->matchinfo;
         const struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
         __be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
 
         if (info->bitmask & EBT_802_3_SAP) {
                 if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP))
-                                return EBT_NOMATCH;
+                        return false;
                 if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
-                                return EBT_NOMATCH;
+                        return false;
         }
 
         if (info->bitmask & EBT_802_3_TYPE) {
                 if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
-                        return EBT_NOMATCH;
+                        return false;
                 if (FWINV(info->type != type, EBT_802_3_TYPE))
-                        return EBT_NOMATCH;
+                        return false;
         }
 
-        return EBT_MATCH;
+        return true;
 }
 
-static struct ebt_match filter_802_3;
-static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_802_3_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_802_3_info *info = data;
+        const struct ebt_802_3_info *info = par->matchinfo;
 
-        if (datalen < sizeof(struct ebt_802_3_info))
-                return -EINVAL;
         if (info->bitmask & ~EBT_802_3_MASK || info->invflags & ~EBT_802_3_MASK)
-                return -EINVAL;
+                return false;
 
-        return 0;
+        return true;
 }
 
-static struct ebt_match filter_802_3 __read_mostly = {
-        .name           = EBT_802_3_MATCH,
-        .match          = ebt_filter_802_3,
-        .check          = ebt_802_3_check,
+static struct xt_match ebt_802_3_mt_reg __read_mostly = {
+        .name           = "802_3",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_802_3_mt,
+        .checkentry     = ebt_802_3_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_802_3_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_802_3_init(void)
 {
-        return ebt_register_match(&filter_802_3);
+        return xt_register_match(&ebt_802_3_mt_reg);
 }
 
 static void __exit ebt_802_3_fini(void)
 {
-        ebt_unregister_match(&filter_802_3);
+        xt_unregister_match(&ebt_802_3_mt_reg);
 }
 
 module_init(ebt_802_3_init);
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 70b6dca5ea75..b595f091f35b 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -7,15 +7,15 @@
  *  August, 2003
  *
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_among.h>
 #include <linux/ip.h>
 #include <linux/if_arp.h>
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_among.h>
 
-static int ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
-                                     const char *mac, __be32 ip)
+static bool ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
+                                      const char *mac, __be32 ip)
 {
         /* You may be puzzled as to how this code works.
          * Some tricks were used, refer to
@@ -33,23 +33,19 @@ static int ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
         if (ip) {
                 for (i = start; i < limit; i++) {
                         p = &wh->pool[i];
-                        if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0]) {
-                                if (p->ip == 0 || p->ip == ip) {
-                                        return 1;
-                                }
-                        }
+                        if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0])
+                                if (p->ip == 0 || p->ip == ip)
+                                        return true;
                 }
         } else {
                 for (i = start; i < limit; i++) {
                         p = &wh->pool[i];
-                        if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0]) {
-                                if (p->ip == 0) {
-                                        return 1;
-                                }
-                        }
+                        if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0])
+                                if (p->ip == 0)
+                                        return true;
                 }
         }
-        return 0;
+        return false;
 }
 
 static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
@@ -131,12 +127,10 @@ static int get_ip_src(const struct sk_buff *skb, __be32 *addr)
         return 0;
 }
 
-static int ebt_filter_among(const struct sk_buff *skb,
-                            const struct net_device *in,
-                            const struct net_device *out, const void *data,
-                            unsigned int datalen)
+static bool
+ebt_among_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_among_info *info = data;
+        const struct ebt_among_info *info = par->matchinfo;
         const char *dmac, *smac;
         const struct ebt_mac_wormhash *wh_dst, *wh_src;
         __be32 dip = 0, sip = 0;
@@ -147,41 +141,41 @@ static int ebt_filter_among(const struct sk_buff *skb,
         if (wh_src) {
                 smac = eth_hdr(skb)->h_source;
                 if (get_ip_src(skb, &sip))
-                        return EBT_NOMATCH;
+                        return false;
                 if (!(info->bitmask & EBT_AMONG_SRC_NEG)) {
                         /* we match only if it contains */
                         if (!ebt_mac_wormhash_contains(wh_src, smac, sip))
-                                return EBT_NOMATCH;
+                                return false;
                 } else {
                         /* we match only if it DOES NOT contain */
                         if (ebt_mac_wormhash_contains(wh_src, smac, sip))
-                                return EBT_NOMATCH;
+                                return false;
                 }
         }
 
         if (wh_dst) {
                 dmac = eth_hdr(skb)->h_dest;
                 if (get_ip_dst(skb, &dip))
-                        return EBT_NOMATCH;
+                        return false;
                 if (!(info->bitmask & EBT_AMONG_DST_NEG)) {
                         /* we match only if it contains */
                         if (!ebt_mac_wormhash_contains(wh_dst, dmac, dip))
-                                return EBT_NOMATCH;
+                                return false;
                 } else {
                         /* we match only if it DOES NOT contain */
                         if (ebt_mac_wormhash_contains(wh_dst, dmac, dip))
-                                return EBT_NOMATCH;
+                                return false;
                 }
         }
 
-        return EBT_MATCH;
+        return true;
 }
 
-static int ebt_among_check(const char *tablename, unsigned int hookmask,
-                           const struct ebt_entry *e, void *data,
-                           unsigned int datalen)
+static bool ebt_among_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_among_info *info = data;
+        const struct ebt_among_info *info = par->matchinfo;
+        const struct ebt_entry_match *em =
+                container_of(par->matchinfo, const struct ebt_entry_match, data);
         int expected_length = sizeof(struct ebt_among_info);
         const struct ebt_mac_wormhash *wh_dst, *wh_src;
         int err;
@@ -191,42 +185,45 @@ static int ebt_among_check(const char *tablename, unsigned int hookmask,
         expected_length += ebt_mac_wormhash_size(wh_dst);
         expected_length += ebt_mac_wormhash_size(wh_src);
 
-        if (datalen != EBT_ALIGN(expected_length)) {
+        if (em->match_size != EBT_ALIGN(expected_length)) {
                 printk(KERN_WARNING
                        "ebtables: among: wrong size: %d "
                        "against expected %d, rounded to %Zd\n",
-                       datalen, expected_length,
+                       em->match_size, expected_length,
                        EBT_ALIGN(expected_length));
-                return -EINVAL;
+                return false;
         }
         if (wh_dst && (err = ebt_mac_wormhash_check_integrity(wh_dst))) {
                 printk(KERN_WARNING
                        "ebtables: among: dst integrity fail: %x\n", -err);
-                return -EINVAL;
+                return false;
         }
         if (wh_src && (err = ebt_mac_wormhash_check_integrity(wh_src))) {
                 printk(KERN_WARNING
                        "ebtables: among: src integrity fail: %x\n", -err);
-                return -EINVAL;
+                return false;
         }
-        return 0;
+        return true;
 }
 
-static struct ebt_match filter_among __read_mostly = {
-        .name           = EBT_AMONG_MATCH,
-        .match          = ebt_filter_among,
-        .check          = ebt_among_check,
+static struct xt_match ebt_among_mt_reg __read_mostly = {
+        .name           = "among",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_among_mt,
+        .checkentry     = ebt_among_mt_check,
+        .matchsize      = -1, /* special case */
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_among_init(void)
 {
-        return ebt_register_match(&filter_among);
+        return xt_register_match(&ebt_among_mt_reg);
 }
 
 static void __exit ebt_among_fini(void)
 {
-        ebt_unregister_match(&filter_among);
+        xt_unregister_match(&ebt_among_mt_reg);
 }
 
 module_init(ebt_among_init);
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 7c535be75665..b7ad60419f9a 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -8,58 +8,58 @@
  *  April, 2002
  *
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_arp.h>
 #include <linux/if_arp.h>
 #include <linux/if_ether.h>
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_arp.h>
 
-static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
-   const struct net_device *out, const void *data, unsigned int datalen)
+static bool
+ebt_arp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_arp_info *info = data;
+        const struct ebt_arp_info *info = par->matchinfo;
         const struct arphdr *ah;
         struct arphdr _arph;
 
         ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
         if (ah == NULL)
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
            ah->ar_op, EBT_ARP_OPCODE))
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
            ah->ar_hrd, EBT_ARP_HTYPE))
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
            ah->ar_pro, EBT_ARP_PTYPE))
-                return EBT_NOMATCH;
+                return false;
 
         if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_GRAT)) {
                 const __be32 *sap, *dap;
                 __be32 saddr, daddr;
 
                 if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
-                        return EBT_NOMATCH;
+                        return false;
                 sap = skb_header_pointer(skb, sizeof(struct arphdr) +
                                         ah->ar_hln, sizeof(saddr),
                                         &saddr);
                 if (sap == NULL)
-                        return EBT_NOMATCH;
+                        return false;
                 dap = skb_header_pointer(skb, sizeof(struct arphdr) +
                                         2*ah->ar_hln+sizeof(saddr),
                                         sizeof(daddr), &daddr);
                 if (dap == NULL)
-                        return EBT_NOMATCH;
+                        return false;
                 if (info->bitmask & EBT_ARP_SRC_IP &&
                     FWINV(info->saddr != (*sap & info->smsk), EBT_ARP_SRC_IP))
-                        return EBT_NOMATCH;
+                        return false;
                 if (info->bitmask & EBT_ARP_DST_IP &&
                     FWINV(info->daddr != (*dap & info->dmsk), EBT_ARP_DST_IP))
-                        return EBT_NOMATCH;
+                        return false;
                 if (info->bitmask & EBT_ARP_GRAT &&
                     FWINV(*dap != *sap, EBT_ARP_GRAT))
-                        return EBT_NOMATCH;
+                        return false;
         }
 
         if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
@@ -68,18 +68,18 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
                 uint8_t verdict, i;
 
                 if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
-                        return EBT_NOMATCH;
+                        return false;
                 if (info->bitmask & EBT_ARP_SRC_MAC) {
                         mp = skb_header_pointer(skb, sizeof(struct arphdr),
                                                 sizeof(_mac), &_mac);
                         if (mp == NULL)
-                                return EBT_NOMATCH;
+                                return false;
                         verdict = 0;
                         for (i = 0; i < 6; i++)
                                 verdict |= (mp[i] ^ info->smaddr[i]) &
                                        info->smmsk[i];
                         if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
-                                return EBT_NOMATCH;
+                                return false;
                 }
 
                 if (info->bitmask & EBT_ARP_DST_MAC) {
@@ -87,50 +87,51 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
                                                 ah->ar_hln + ah->ar_pln,
                                                 sizeof(_mac), &_mac);
                         if (mp == NULL)
-                                return EBT_NOMATCH;
+                                return false;
                         verdict = 0;
                         for (i = 0; i < 6; i++)
                                 verdict |= (mp[i] ^ info->dmaddr[i]) &
                                         info->dmmsk[i];
                         if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
-                                return EBT_NOMATCH;
+                                return false;
                 }
         }
 
-        return EBT_MATCH;
+        return true;
 }
 
-static int ebt_arp_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_arp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_arp_info *info = data;
+        const struct ebt_arp_info *info = par->matchinfo;
+        const struct ebt_entry *e = par->entryinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
-                return -EINVAL;
         if ((e->ethproto != htons(ETH_P_ARP) &&
            e->ethproto != htons(ETH_P_RARP)) ||
            e->invflags & EBT_IPROTO)
-                return -EINVAL;
+                return false;
         if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_match filter_arp __read_mostly = {
-        .name           = EBT_ARP_MATCH,
-        .match          = ebt_filter_arp,
-        .check          = ebt_arp_check,
+static struct xt_match ebt_arp_mt_reg __read_mostly = {
+        .name           = "arp",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_arp_mt,
+        .checkentry     = ebt_arp_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_arp_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_arp_init(void)
 {
-        return ebt_register_match(&filter_arp);
+        return xt_register_match(&ebt_arp_mt_reg);
 }
 
 static void __exit ebt_arp_fini(void)
 {
-        ebt_unregister_match(&filter_arp);
+        xt_unregister_match(&ebt_arp_mt_reg);
 }
 
 module_init(ebt_arp_init);
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 0c4279590fc7..76584cd72e57 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -8,18 +8,17 @@
  *  August, 2003
  *
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_arpreply.h>
 #include <linux/if_arp.h>
 #include <net/arp.h>
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_arpreply.h>
 
-static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_arpreply_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        struct ebt_arpreply_info *info = (void *)data;
+        const struct ebt_arpreply_info *info = par->targinfo;
         const __be32 *siptr, *diptr;
         __be32 _sip, _dip;
         const struct arphdr *ap;
@@ -52,45 +51,45 @@ static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
         if (diptr == NULL)
                 return EBT_DROP;
 
-        arp_send(ARPOP_REPLY, ETH_P_ARP, *siptr, (struct net_device *)in,
+        arp_send(ARPOP_REPLY, ETH_P_ARP, *siptr, (struct net_device *)par->in,
                  *diptr, shp, info->mac, shp);
 
         return info->target;
 }
 
-static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_arpreply_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ebt_arpreply_info *info = data;
+        const struct ebt_arpreply_info *info = par->targinfo;
+        const struct ebt_entry *e = par->entryinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_arpreply_info)))
-                return -EINVAL;
         if (BASE_CHAIN && info->target == EBT_RETURN)
-                return -EINVAL;
+                return false;
         if (e->ethproto != htons(ETH_P_ARP) ||
             e->invflags & EBT_IPROTO)
-                return -EINVAL;
-        CLEAR_BASE_CHAIN_BIT;
-        if (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING))
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_target reply_target __read_mostly = {
-        .name           = EBT_ARPREPLY_TARGET,
-        .target         = ebt_target_reply,
-        .check          = ebt_target_reply_check,
+static struct xt_target ebt_arpreply_tg_reg __read_mostly = {
+        .name           = "arpreply",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .table          = "nat",
+        .hooks          = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING),
+        .target         = ebt_arpreply_tg,
+        .checkentry     = ebt_arpreply_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_arpreply_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_arpreply_init(void)
 {
-        return ebt_register_target(&reply_target);
+        return xt_register_target(&ebt_arpreply_tg_reg);
 }
 
 static void __exit ebt_arpreply_fini(void)
 {
-        ebt_unregister_target(&reply_target);
+        xt_unregister_target(&ebt_arpreply_tg_reg);
 }
 
 module_init(ebt_arpreply_init);
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index ca64c1cc1b47..6b49ea9e31fb 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -7,18 +7,17 @@
  *  June, 2002
  *
  */
-
+#include <linux/module.h>
+#include <net/sock.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_nat.h>
-#include <linux/module.h>
-#include <net/sock.h>
 
-static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_dnat_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ebt_nat_info *info = data;
+        const struct ebt_nat_info *info = par->targinfo;
 
         if (!skb_make_writable(skb, 0))
                 return EBT_DROP;
@@ -27,40 +26,46 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
         return info->target;
 }
 
-static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_dnat_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ebt_nat_info *info = data;
+        const struct ebt_nat_info *info = par->targinfo;
+        unsigned int hook_mask;
 
         if (BASE_CHAIN && info->target == EBT_RETURN)
-                return -EINVAL;
-        CLEAR_BASE_CHAIN_BIT;
-        if ( (strcmp(tablename, "nat") ||
-           (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
-           (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
-                return -EINVAL;
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
-                return -EINVAL;
+                return false;
+
+        hook_mask = par->hook_mask & ~(1 << NF_BR_NUMHOOKS);
+        if ((strcmp(par->table, "nat") != 0 ||
+            (hook_mask & ~((1 << NF_BR_PRE_ROUTING) |
+            (1 << NF_BR_LOCAL_OUT)))) &&
+            (strcmp(par->table, "broute") != 0 ||
+            hook_mask & ~(1 << NF_BR_BROUTING)))
+                return false;
         if (INVALID_TARGET)
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_target dnat __read_mostly = {
-        .name           = EBT_DNAT_TARGET,
-        .target         = ebt_target_dnat,
-        .check          = ebt_target_dnat_check,
+static struct xt_target ebt_dnat_tg_reg __read_mostly = {
+        .name           = "dnat",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .hooks          = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING) |
+                          (1 << NF_BR_LOCAL_OUT) | (1 << NF_BR_BROUTING),
+        .target         = ebt_dnat_tg,
+        .checkentry     = ebt_dnat_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_nat_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_dnat_init(void)
 {
-        return ebt_register_target(&dnat);
+        return xt_register_target(&ebt_dnat_tg_reg);
 }
 
 static void __exit ebt_dnat_fini(void)
 {
-        ebt_unregister_target(&dnat);
+        xt_unregister_target(&ebt_dnat_tg_reg);
 }
 
 module_init(ebt_dnat_init);
diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 65caa00dcf2a..d771bbfbcbe6 100644
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -11,24 +11,23 @@
  *    Innominate Security Technologies AG <mhopf@innominate.com>
  *    September, 2002
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_ip.h>
 #include <linux/ip.h>
 #include <net/ip.h>
 #include <linux/in.h>
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_ip.h>
 
 struct tcpudphdr {
         __be16 src;
         __be16 dst;
 };
 
-static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
-   const struct net_device *out, const void *data,
-   unsigned int datalen)
+static bool
+ebt_ip_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_ip_info *info = data;
+        const struct ebt_ip_info *info = par->matchinfo;
         const struct iphdr *ih;
         struct iphdr _iph;
         const struct tcpudphdr *pptr;
@@ -36,92 +35,93 @@ static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
 
         ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
         if (ih == NULL)
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_IP_TOS &&
            FWINV(info->tos != ih->tos, EBT_IP_TOS))
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_IP_SOURCE &&
            FWINV((ih->saddr & info->smsk) !=
            info->saddr, EBT_IP_SOURCE))
-                return EBT_NOMATCH;
+                return false;
         if ((info->bitmask & EBT_IP_DEST) &&
            FWINV((ih->daddr & info->dmsk) !=
            info->daddr, EBT_IP_DEST))
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_IP_PROTO) {
                 if (FWINV(info->protocol != ih->protocol, EBT_IP_PROTO))
-                        return EBT_NOMATCH;
+                        return false;
                 if (!(info->bitmask & EBT_IP_DPORT) &&
                     !(info->bitmask & EBT_IP_SPORT))
-                        return EBT_MATCH;
+                        return true;
                 if (ntohs(ih->frag_off) & IP_OFFSET)
-                        return EBT_NOMATCH;
+                        return false;
                 pptr = skb_header_pointer(skb, ih->ihl*4,
                                           sizeof(_ports), &_ports);
                 if (pptr == NULL)
-                        return EBT_NOMATCH;
+                        return false;
                 if (info->bitmask & EBT_IP_DPORT) {
                         u32 dst = ntohs(pptr->dst);
                         if (FWINV(dst < info->dport[0] ||
                                   dst > info->dport[1],
                                   EBT_IP_DPORT))
-                        return EBT_NOMATCH;
+                        return false;
                 }
                 if (info->bitmask & EBT_IP_SPORT) {
                         u32 src = ntohs(pptr->src);
                         if (FWINV(src < info->sport[0] ||
                                   src > info->sport[1],
                                   EBT_IP_SPORT))
-                        return EBT_NOMATCH;
+                        return false;
                 }
         }
-        return EBT_MATCH;
+        return true;
 }
 
-static int ebt_ip_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_ip_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_ip_info *info = data;
+        const struct ebt_ip_info *info = par->matchinfo;
+        const struct ebt_entry *e = par->entryinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
-                return -EINVAL;
         if (e->ethproto != htons(ETH_P_IP) ||
            e->invflags & EBT_IPROTO)
-                return -EINVAL;
+                return false;
         if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
-                return -EINVAL;
+                return false;
         if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
                 if (info->invflags & EBT_IP_PROTO)
-                        return -EINVAL;
+                        return false;
                 if (info->protocol != IPPROTO_TCP &&
                     info->protocol != IPPROTO_UDP &&
                     info->protocol != IPPROTO_UDPLITE &&
                     info->protocol != IPPROTO_SCTP &&
                     info->protocol != IPPROTO_DCCP)
-                         return -EINVAL;
+                         return false;
         }
         if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
-                return -EINVAL;
+                return false;
         if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_match filter_ip __read_mostly = {
-        .name           = EBT_IP_MATCH,
-        .match          = ebt_filter_ip,
-        .check          = ebt_ip_check,
+static struct xt_match ebt_ip_mt_reg __read_mostly = {
+        .name           = "ip",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_ip_mt,
+        .checkentry     = ebt_ip_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_ip_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_ip_init(void)
 {
-        return ebt_register_match(&filter_ip);
+        return xt_register_match(&ebt_ip_mt_reg);
 }
 
 static void __exit ebt_ip_fini(void)
 {
-        ebt_unregister_match(&filter_ip);
+        xt_unregister_match(&ebt_ip_mt_reg);
 }
 
 module_init(ebt_ip_init);
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 36efb3a75249..784a6573876c 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -13,26 +13,24 @@
  *
  *  Jan, 2008
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_ip6.h>
 #include <linux/ipv6.h>
 #include <net/ipv6.h>
 #include <linux/in.h>
 #include <linux/module.h>
 #include <net/dsfield.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_ip6.h>
 
 struct tcpudphdr {
         __be16 src;
         __be16 dst;
 };
 
-static int ebt_filter_ip6(const struct sk_buff *skb,
-   const struct net_device *in,
-   const struct net_device *out, const void *data,
-   unsigned int datalen)
+static bool
+ebt_ip6_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_ip6_info *info = (struct ebt_ip6_info *)data;
+        const struct ebt_ip6_info *info = par->matchinfo;
         const struct ipv6hdr *ih6;
         struct ipv6hdr _ip6h;
         const struct tcpudphdr *pptr;
@@ -42,100 +40,100 @@ static int ebt_filter_ip6(const struct sk_buff *skb,
 
         ih6 = skb_header_pointer(skb, 0, sizeof(_ip6h), &_ip6h);
         if (ih6 == NULL)
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_IP6_TCLASS &&
            FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
-                return EBT_NOMATCH;
+                return false;
         for (i = 0; i < 4; i++)
                 tmp_addr.in6_u.u6_addr32[i] = ih6->saddr.in6_u.u6_addr32[i] &
                         info->smsk.in6_u.u6_addr32[i];
         if (info->bitmask & EBT_IP6_SOURCE &&
                 FWINV((ipv6_addr_cmp(&tmp_addr, &info->saddr) != 0),
                         EBT_IP6_SOURCE))
-                return EBT_NOMATCH;
+                return false;
         for (i = 0; i < 4; i++)
                 tmp_addr.in6_u.u6_addr32[i] = ih6->daddr.in6_u.u6_addr32[i] &
                         info->dmsk.in6_u.u6_addr32[i];
         if (info->bitmask & EBT_IP6_DEST &&
            FWINV((ipv6_addr_cmp(&tmp_addr, &info->daddr) != 0), EBT_IP6_DEST))
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_IP6_PROTO) {
                 uint8_t nexthdr = ih6->nexthdr;
                 int offset_ph;
 
                 offset_ph = ipv6_skip_exthdr(skb, sizeof(_ip6h), &nexthdr);
                 if (offset_ph == -1)
-                        return EBT_NOMATCH;
+                        return false;
                 if (FWINV(info->protocol != nexthdr, EBT_IP6_PROTO))
-                        return EBT_NOMATCH;
+                        return false;
                 if (!(info->bitmask & EBT_IP6_DPORT) &&
                     !(info->bitmask & EBT_IP6_SPORT))
-                        return EBT_MATCH;
+                        return true;
                 pptr = skb_header_pointer(skb, offset_ph, sizeof(_ports),
                                           &_ports);
                 if (pptr == NULL)
-                        return EBT_NOMATCH;
+                        return false;
                 if (info->bitmask & EBT_IP6_DPORT) {
                         u32 dst = ntohs(pptr->dst);
                         if (FWINV(dst < info->dport[0] ||
                                   dst > info->dport[1], EBT_IP6_DPORT))
-                                return EBT_NOMATCH;
+                                return false;
                 }
                 if (info->bitmask & EBT_IP6_SPORT) {
                         u32 src = ntohs(pptr->src);
                         if (FWINV(src < info->sport[0] ||
                                   src > info->sport[1], EBT_IP6_SPORT))
-                        return EBT_NOMATCH;
+                        return false;
                 }
-                return EBT_MATCH;
+                return true;
         }
-        return EBT_MATCH;
+        return true;
 }
 
-static int ebt_ip6_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_ip6_mt_check(const struct xt_mtchk_param *par)
 {
-        struct ebt_ip6_info *info = (struct ebt_ip6_info *)data;
+        const struct ebt_entry *e = par->entryinfo;
+        struct ebt_ip6_info *info = par->matchinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_ip6_info)))
-                return -EINVAL;
         if (e->ethproto != htons(ETH_P_IPV6) || e->invflags & EBT_IPROTO)
-                return -EINVAL;
+                return false;
         if (info->bitmask & ~EBT_IP6_MASK || info->invflags & ~EBT_IP6_MASK)
-                return -EINVAL;
+                return false;
         if (info->bitmask & (EBT_IP6_DPORT | EBT_IP6_SPORT)) {
                 if (info->invflags & EBT_IP6_PROTO)
-                        return -EINVAL;
+                        return false;
                 if (info->protocol != IPPROTO_TCP &&
                     info->protocol != IPPROTO_UDP &&
                     info->protocol != IPPROTO_UDPLITE &&
                     info->protocol != IPPROTO_SCTP &&
                     info->protocol != IPPROTO_DCCP)
-                         return -EINVAL;
+                        return false;
         }
         if (info->bitmask & EBT_IP6_DPORT && info->dport[0] > info->dport[1])
-                return -EINVAL;
+                return false;
         if (info->bitmask & EBT_IP6_SPORT && info->sport[0] > info->sport[1])
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_match filter_ip6 =
-{
-        .name           = EBT_IP6_MATCH,
-        .match          = ebt_filter_ip6,
-        .check          = ebt_ip6_check,
+static struct xt_match ebt_ip6_mt_reg __read_mostly = {
+        .name           = "ip6",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_ip6_mt,
+        .checkentry     = ebt_ip6_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_ip6_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_ip6_init(void)
 {
-        return ebt_register_match(&filter_ip6);
+        return xt_register_match(&ebt_ip6_mt_reg);
 }
 
 static void __exit ebt_ip6_fini(void)
 {
-        ebt_unregister_match(&filter_ip6);
+        xt_unregister_match(&ebt_ip6_mt_reg);
 }
 
 module_init(ebt_ip6_init);
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index 8cbdc01c253e..f7bd9192ff0c 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -10,13 +10,12 @@
  *  September, 2003
  *
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_limit.h>
 #include <linux/module.h>
-
 #include <linux/netdevice.h>
 #include <linux/spinlock.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_limit.h>
 
 static DEFINE_SPINLOCK(limit_lock);
 
@@ -31,11 +30,10 @@ static DEFINE_SPINLOCK(limit_lock);
 
 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
 
-static int ebt_limit_match(const struct sk_buff *skb,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static bool
+ebt_limit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        struct ebt_limit_info *info = (struct ebt_limit_info *)data;
+        struct ebt_limit_info *info = (void *)par->matchinfo;
         unsigned long now = jiffies;
 
         spin_lock_bh(&limit_lock);
@@ -47,11 +45,11 @@ static int ebt_limit_match(const struct sk_buff *skb,
                 /* We're not limited. */
                 info->credit -= info->cost;
                 spin_unlock_bh(&limit_lock);
-                return EBT_MATCH;
+                return true;
         }
 
         spin_unlock_bh(&limit_lock);
-        return EBT_NOMATCH;
+        return false;
 }
 
 /* Precision saver. */
@@ -66,20 +64,16 @@ user2credits(u_int32_t user)
         return (user * HZ * CREDITS_PER_JIFFY) / EBT_LIMIT_SCALE;
 }
 
-static int ebt_limit_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_limit_mt_check(const struct xt_mtchk_param *par)
 {
-        struct ebt_limit_info *info = data;
-
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_limit_info)))
-                return -EINVAL;
+        struct ebt_limit_info *info = par->matchinfo;
 
         /* Check for overflow. */
         if (info->burst == 0 ||
             user2credits(info->avg * info->burst) < user2credits(info->avg)) {
                 printk("Overflow in ebt_limit, try lower: %u/%u\n",
                         info->avg, info->burst);
-                return -EINVAL;
+                return false;
         }
 
         /* User avg in seconds * EBT_LIMIT_SCALE: convert to jiffies * 128. */
@@ -87,24 +81,27 @@ static int ebt_limit_check(const char *tablename, unsigned int hookmask,
         info->credit = user2credits(info->avg * info->burst);
         info->credit_cap = user2credits(info->avg * info->burst);
         info->cost = user2credits(info->avg);
-        return 0;
+        return true;
 }
 
-static struct ebt_match ebt_limit_reg __read_mostly = {
-        .name           = EBT_LIMIT_MATCH,
-        .match          = ebt_limit_match,
-        .check          = ebt_limit_check,
+static struct xt_match ebt_limit_mt_reg __read_mostly = {
+        .name           = "limit",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_limit_mt,
+        .checkentry     = ebt_limit_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_limit_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_limit_init(void)
 {
-        return ebt_register_match(&ebt_limit_reg);
+        return xt_register_match(&ebt_limit_mt_reg);
 }
 
 static void __exit ebt_limit_fini(void)
 {
-        ebt_unregister_match(&ebt_limit_reg);
+        xt_unregister_match(&ebt_limit_mt_reg);
 }
 
 module_init(ebt_limit_init);
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 2f430d4ae911..3d33c608906a 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -8,10 +8,6 @@
  *  April, 2002
  *
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_log.h>
-#include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/ip.h>
 #include <linux/in.h>
@@ -21,22 +17,23 @@
 #include <linux/ipv6.h>
 #include <net/ipv6.h>
 #include <linux/in6.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_log.h>
+#include <linux/netfilter.h>
 
 static DEFINE_SPINLOCK(ebt_log_lock);
 
-static int ebt_log_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_log_tg_check(const struct xt_tgchk_param *par)
 {
-        struct ebt_log_info *info = data;
+        struct ebt_log_info *info = par->targinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
-                return -EINVAL;
         if (info->bitmask & ~EBT_LOG_MASK)
-                return -EINVAL;
+                return false;
         if (info->loglevel >= 8)
-                return -EINVAL;
+                return false;
         info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
-        return 0;
+        return true;
 }
 
 struct tcpudphdr
@@ -84,7 +81,7 @@ print_ports(const struct sk_buff *skb, uint8_t protocol, int offset)
 
 #define myNIPQUAD(a) a[0], a[1], a[2], a[3]
 static void
-ebt_log_packet(unsigned int pf, unsigned int hooknum,
+ebt_log_packet(u_int8_t pf, unsigned int hooknum,
    const struct sk_buff *skb, const struct net_device *in,
    const struct net_device *out, const struct nf_loginfo *loginfo,
    const char *prefix)
@@ -194,11 +191,10 @@ out:
 
 }
 
-static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_log_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ebt_log_info *info = data;
+        const struct ebt_log_info *info = par->targinfo;
         struct nf_loginfo li;
 
         li.type = NF_LOG_TYPE_LOG;
@@ -206,18 +202,21 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
         li.u.log.logflags = info->bitmask;
 
         if (info->bitmask & EBT_LOG_NFLOG)
-                nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
-                              "%s", info->prefix);
+                nf_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in,
+                              par->out, &li, "%s", info->prefix);
         else
-                ebt_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
-                               info->prefix);
+                ebt_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in,
+                               par->out, &li, info->prefix);
+        return EBT_CONTINUE;
 }
 
-static struct ebt_watcher log =
-{
-        .name           = EBT_LOG_WATCHER,
-        .watcher        = ebt_log,
-        .check          = ebt_log_check,
+static struct xt_target ebt_log_tg_reg __read_mostly = {
+        .name           = "log",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .target         = ebt_log_tg,
+        .checkentry     = ebt_log_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_log_info)),
         .me             = THIS_MODULE,
 };
 
@@ -231,17 +230,17 @@ static int __init ebt_log_init(void)
 {
         int ret;
 
-        ret = ebt_register_watcher(&log);
+        ret = xt_register_target(&ebt_log_tg_reg);
         if (ret < 0)
                 return ret;
-        nf_log_register(PF_BRIDGE, &ebt_log_logger);
+        nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger);
         return 0;
 }
 
 static void __exit ebt_log_fini(void)
 {
         nf_log_unregister(&ebt_log_logger);
-        ebt_unregister_watcher(&log);
+        xt_unregister_target(&ebt_log_tg_reg);
 }
 
 module_init(ebt_log_init);
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 36723f47db0a..2fee7e8e2e93 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -13,15 +13,15 @@
  * Marking a frame doesn't really change anything in the frame anyway.
  */
 
+#include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_mark_t.h>
-#include <linux/module.h>
 
-static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ebt_mark_t_info *info = data;
+        const struct ebt_mark_t_info *info = par->targinfo;
         int action = info->target & -16;
 
         if (action == MARK_SET_VALUE)
@@ -36,42 +36,41 @@ static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
         return info->target | ~EBT_VERDICT_BITS;
 }
 
-static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_mark_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ebt_mark_t_info *info = data;
+        const struct ebt_mark_t_info *info = par->targinfo;
         int tmp;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
-                return -EINVAL;
         tmp = info->target | ~EBT_VERDICT_BITS;
         if (BASE_CHAIN && tmp == EBT_RETURN)
-                return -EINVAL;
-        CLEAR_BASE_CHAIN_BIT;
+                return false;
         if (tmp < -NUM_STANDARD_TARGETS || tmp >= 0)
-                return -EINVAL;
+                return false;
         tmp = info->target & ~EBT_VERDICT_BITS;
         if (tmp != MARK_SET_VALUE && tmp != MARK_OR_VALUE &&
             tmp != MARK_AND_VALUE && tmp != MARK_XOR_VALUE)
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_target mark_target __read_mostly = {
-        .name           = EBT_MARK_TARGET,
-        .target         = ebt_target_mark,
-        .check          = ebt_target_mark_check,
+static struct xt_target ebt_mark_tg_reg __read_mostly = {
+        .name           = "mark",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .target         = ebt_mark_tg,
+        .checkentry     = ebt_mark_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_mark_t_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_mark_init(void)
 {
-        return ebt_register_target(&mark_target);
+        return xt_register_target(&ebt_mark_tg_reg);
 }
 
 static void __exit ebt_mark_fini(void)
 {
-        ebt_unregister_target(&mark_target);
+        xt_unregister_target(&ebt_mark_tg_reg);
 }
 
 module_init(ebt_mark_init);
diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index 9b0a4543861f..ea570f214b1d 100644
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -7,53 +7,52 @@
  *  July, 2002
  *
  */
-
+#include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_mark_m.h>
-#include <linux/module.h>
 
-static int ebt_filter_mark(const struct sk_buff *skb,
-   const struct net_device *in, const struct net_device *out, const void *data,
-   unsigned int datalen)
+static bool
+ebt_mark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_mark_m_info *info = data;
+        const struct ebt_mark_m_info *info = par->matchinfo;
 
         if (info->bitmask & EBT_MARK_OR)
-                return !(!!(skb->mark & info->mask) ^ info->invert);
-        return !(((skb->mark & info->mask) == info->mark) ^ info->invert);
+                return !!(skb->mark & info->mask) ^ info->invert;
+        return ((skb->mark & info->mask) == info->mark) ^ info->invert;
 }
 
-static int ebt_mark_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_mark_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_mark_m_info *info = data;
+        const struct ebt_mark_m_info *info = par->matchinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
-                return -EINVAL;
         if (info->bitmask & ~EBT_MARK_MASK)
-                return -EINVAL;
+                return false;
         if ((info->bitmask & EBT_MARK_OR) && (info->bitmask & EBT_MARK_AND))
-                return -EINVAL;
+                return false;
         if (!info->bitmask)
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_match filter_mark __read_mostly = {
-        .name           = EBT_MARK_MATCH,
-        .match          = ebt_filter_mark,
-        .check          = ebt_mark_check,
+static struct xt_match ebt_mark_mt_reg __read_mostly = {
+        .name           = "mark_m",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_mark_mt,
+        .checkentry     = ebt_mark_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_mark_m_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_mark_m_init(void)
 {
-        return ebt_register_match(&filter_mark);
+        return xt_register_match(&ebt_mark_mt_reg);
 }
 
 static void __exit ebt_mark_m_fini(void)
 {
-        ebt_unregister_match(&filter_mark);
+        xt_unregister_match(&ebt_mark_mt_reg);
 }
 
 module_init(ebt_mark_m_init);
diff --git a/net/bridge/netfilter/ebt_nflog.c b/net/bridge/netfilter/ebt_nflog.c
index 8e799aa9e560..2a63d996dd4e 100644
--- a/net/bridge/netfilter/ebt_nflog.c
+++ b/net/bridge/netfilter/ebt_nflog.c
@@ -14,17 +14,15 @@
 
 #include <linux/module.h>
 #include <linux/spinlock.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_nflog.h>
 #include <net/netfilter/nf_log.h>
 
-static void ebt_nflog(const struct sk_buff *skb,
-                      unsigned int hooknr,
-                      const struct net_device *in,
-                      const struct net_device *out,
-                      const void *data, unsigned int datalen)
+static unsigned int
+ebt_nflog_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        struct ebt_nflog_info *info = (struct ebt_nflog_info *)data;
+        const struct ebt_nflog_info *info = par->targinfo;
         struct nf_loginfo li;
 
         li.type = NF_LOG_TYPE_ULOG;
@@ -32,39 +30,39 @@ static void ebt_nflog(const struct sk_buff *skb,
         li.u.ulog.group = info->group;
         li.u.ulog.qthreshold = info->threshold;
 
-        nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li, "%s", info->prefix);
+        nf_log_packet(PF_BRIDGE, par->hooknum, skb, par->in, par->out,
+                      &li, "%s", info->prefix);
+        return EBT_CONTINUE;
 }
 
-static int ebt_nflog_check(const char *tablename,
-                           unsigned int hookmask,
-                           const struct ebt_entry *e,
-                           void *data, unsigned int datalen)
+static bool ebt_nflog_tg_check(const struct xt_tgchk_param *par)
 {
-        struct ebt_nflog_info *info = (struct ebt_nflog_info *)data;
+        struct ebt_nflog_info *info = par->targinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_nflog_info)))
-                return -EINVAL;
         if (info->flags & ~EBT_NFLOG_MASK)
-                return -EINVAL;
+                return false;
         info->prefix[EBT_NFLOG_PREFIX_SIZE - 1] = '\0';
-        return 0;
+        return true;
 }
 
-static struct ebt_watcher nflog __read_mostly = {
-        .name = EBT_NFLOG_WATCHER,
-        .watcher = ebt_nflog,
-        .check = ebt_nflog_check,
-        .me = THIS_MODULE,
+static struct xt_target ebt_nflog_tg_reg __read_mostly = {
+        .name       = "nflog",
+        .revision   = 0,
+        .family     = NFPROTO_BRIDGE,
+        .target     = ebt_nflog_tg,
+        .checkentry = ebt_nflog_tg_check,
+        .targetsize = XT_ALIGN(sizeof(struct ebt_nflog_info)),
+        .me         = THIS_MODULE,
 };
 
 static int __init ebt_nflog_init(void)
 {
-        return ebt_register_watcher(&nflog);
+        return xt_register_target(&ebt_nflog_tg_reg);
 }
 
 static void __exit ebt_nflog_fini(void)
 {
-        ebt_unregister_watcher(&nflog);
+        xt_unregister_target(&ebt_nflog_tg_reg);
 }
 
 module_init(ebt_nflog_init);
diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index 676db32df3d1..883e96e2a542 100644
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -7,50 +7,47 @@
  *  April, 2003
  *
  */
-
+#include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_pkttype.h>
-#include <linux/module.h>
 
-static int ebt_filter_pkttype(const struct sk_buff *skb,
-   const struct net_device *in,
-   const struct net_device *out,
-   const void *data,
-   unsigned int datalen)
+static bool
+ebt_pkttype_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_pkttype_info *info = data;
+        const struct ebt_pkttype_info *info = par->matchinfo;
 
-        return (skb->pkt_type != info->pkt_type) ^ info->invert;
+        return (skb->pkt_type == info->pkt_type) ^ info->invert;
 }
 
-static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_pkttype_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_pkttype_info *info = data;
+        const struct ebt_pkttype_info *info = par->matchinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
-                return -EINVAL;
         if (info->invert != 0 && info->invert != 1)
-                return -EINVAL;
+                return false;
         /* Allow any pkt_type value */
-        return 0;
+        return true;
 }
 
-static struct ebt_match filter_pkttype __read_mostly = {
-        .name           = EBT_PKTTYPE_MATCH,
-        .match          = ebt_filter_pkttype,
-        .check          = ebt_pkttype_check,
+static struct xt_match ebt_pkttype_mt_reg __read_mostly = {
+        .name           = "pkttype",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_pkttype_mt,
+        .checkentry     = ebt_pkttype_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_pkttype_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_pkttype_init(void)
 {
-        return ebt_register_match(&filter_pkttype);
+        return xt_register_match(&ebt_pkttype_mt_reg);
 }
 
 static void __exit ebt_pkttype_fini(void)
 {
-        ebt_unregister_match(&filter_pkttype);
+        xt_unregister_match(&ebt_pkttype_mt_reg);
 }
 
 module_init(ebt_pkttype_init);
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index b8afe850cf1e..c8a49f7a57ba 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -7,65 +7,70 @@
  *  April, 2002
  *
  */
-
-#include <linux/netfilter.h>
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_redirect.h>
 #include <linux/module.h>
 #include <net/sock.h>
 #include "../br_private.h"
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_redirect.h>
 
-static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_redirect_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ebt_redirect_info *info = data;
+        const struct ebt_redirect_info *info = par->targinfo;
 
         if (!skb_make_writable(skb, 0))
                 return EBT_DROP;
 
-        if (hooknr != NF_BR_BROUTING)
+        if (par->hooknum != NF_BR_BROUTING)
                 memcpy(eth_hdr(skb)->h_dest,
-                       in->br_port->br->dev->dev_addr, ETH_ALEN);
+                       par->in->br_port->br->dev->dev_addr, ETH_ALEN);
         else
-                memcpy(eth_hdr(skb)->h_dest, in->dev_addr, ETH_ALEN);
+                memcpy(eth_hdr(skb)->h_dest, par->in->dev_addr, ETH_ALEN);
         skb->pkt_type = PACKET_HOST;
         return info->target;
 }
 
-static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_redirect_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ebt_redirect_info *info = data;
+        const struct ebt_redirect_info *info = par->targinfo;
+        unsigned int hook_mask;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
-                return -EINVAL;
         if (BASE_CHAIN && info->target == EBT_RETURN)
-                return -EINVAL;
-        CLEAR_BASE_CHAIN_BIT;
-        if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
-             (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
-                return -EINVAL;
+                return false;
+
+        hook_mask = par->hook_mask & ~(1 << NF_BR_NUMHOOKS);
+        if ((strcmp(par->table, "nat") != 0 ||
+            hook_mask & ~(1 << NF_BR_PRE_ROUTING)) &&
+            (strcmp(par->table, "broute") != 0 ||
+            hook_mask & ~(1 << NF_BR_BROUTING)))
+                return false;
         if (INVALID_TARGET)
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_target redirect_target __read_mostly = {
-        .name           = EBT_REDIRECT_TARGET,
-        .target         = ebt_target_redirect,
-        .check          = ebt_target_redirect_check,
+static struct xt_target ebt_redirect_tg_reg __read_mostly = {
+        .name           = "redirect",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .hooks          = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING) |
+                          (1 << NF_BR_BROUTING),
+        .target         = ebt_redirect_tg,
+        .checkentry     = ebt_redirect_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_redirect_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_redirect_init(void)
 {
-        return ebt_register_target(&redirect_target);
+        return xt_register_target(&ebt_redirect_tg_reg);
 }
 
 static void __exit ebt_redirect_fini(void)
 {
-        ebt_unregister_target(&redirect_target);
+        xt_unregister_target(&ebt_redirect_tg_reg);
 }
 
 module_init(ebt_redirect_init);
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 5425333dda03..8d04d4c302bd 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -7,20 +7,19 @@
  *  June, 2002
  *
  */
-
-#include <linux/netfilter.h>
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_nat.h>
 #include <linux/module.h>
 #include <net/sock.h>
 #include <linux/if_arp.h>
 #include <net/arp.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_nat.h>
 
-static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_snat_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ebt_nat_info *info = data;
+        const struct ebt_nat_info *info = par->targinfo;
 
         if (!skb_make_writable(skb, 0))
                 return EBT_DROP;
@@ -43,46 +42,43 @@ out:
         return info->target | ~EBT_VERDICT_BITS;
 }
 
-static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_snat_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ebt_nat_info *info = data;
+        const struct ebt_nat_info *info = par->targinfo;
         int tmp;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
-                return -EINVAL;
         tmp = info->target | ~EBT_VERDICT_BITS;
         if (BASE_CHAIN && tmp == EBT_RETURN)
-                return -EINVAL;
-        CLEAR_BASE_CHAIN_BIT;
-        if (strcmp(tablename, "nat"))
-                return -EINVAL;
-        if (hookmask & ~(1 << NF_BR_POST_ROUTING))
-                return -EINVAL;
+                return false;
 
         if (tmp < -NUM_STANDARD_TARGETS || tmp >= 0)
-                return -EINVAL;
+                return false;
         tmp = info->target | EBT_VERDICT_BITS;
         if ((tmp & ~NAT_ARP_BIT) != ~NAT_ARP_BIT)
-                return -EINVAL;
-        return 0;
+                return false;
+        return true;
 }
 
-static struct ebt_target snat __read_mostly = {
-        .name           = EBT_SNAT_TARGET,
-        .target         = ebt_target_snat,
-        .check          = ebt_target_snat_check,
+static struct xt_target ebt_snat_tg_reg __read_mostly = {
+        .name           = "snat",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .table          = "nat",
+        .hooks          = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_POST_ROUTING),
+        .target         = ebt_snat_tg,
+        .checkentry     = ebt_snat_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_nat_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_snat_init(void)
 {
-        return ebt_register_target(&snat);
+        return xt_register_target(&ebt_snat_tg_reg);
 }
 
 static void __exit ebt_snat_fini(void)
 {
-        ebt_unregister_target(&snat);
+        xt_unregister_target(&ebt_snat_tg_reg);
 }
 
 module_init(ebt_snat_init);
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 40f36d37607d..48527e621626 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -7,11 +7,11 @@
  *
  *  July, 2003
  */
-
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/netfilter_bridge/ebt_stp.h>
 #include <linux/etherdevice.h>
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_stp.h>
 
 #define BPDU_TYPE_CONFIG 0
 #define BPDU_TYPE_TCN 0x80
@@ -40,7 +40,7 @@ struct stp_config_pdu {
 #define NR16(p) (p[0] << 8 | p[1])
 #define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
 
-static int ebt_filter_config(const struct ebt_stp_info *info,
+static bool ebt_filter_config(const struct ebt_stp_info *info,
    const struct stp_config_pdu *stpc)
 {
         const struct ebt_stp_config_info *c;
@@ -51,12 +51,12 @@ static int ebt_filter_config(const struct ebt_stp_info *info,
         c = &info->config;
         if ((info->bitmask & EBT_STP_FLAGS) &&
             FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
-                return EBT_NOMATCH;
+                return false;
         if (info->bitmask & EBT_STP_ROOTPRIO) {
                 v16 = NR16(stpc->root);
                 if (FWINV(v16 < c->root_priol ||
                     v16 > c->root_priou, EBT_STP_ROOTPRIO))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_ROOTADDR) {
                 verdict = 0;
@@ -64,19 +64,19 @@ static int ebt_filter_config(const struct ebt_stp_info *info,
                         verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
                                    c->root_addrmsk[i];
                 if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_ROOTCOST) {
                 v32 = NR32(stpc->root_cost);
                 if (FWINV(v32 < c->root_costl ||
                     v32 > c->root_costu, EBT_STP_ROOTCOST))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_SENDERPRIO) {
                 v16 = NR16(stpc->sender);
                 if (FWINV(v16 < c->sender_priol ||
                     v16 > c->sender_priou, EBT_STP_SENDERPRIO))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_SENDERADDR) {
                 verdict = 0;
@@ -84,60 +84,60 @@ static int ebt_filter_config(const struct ebt_stp_info *info,
                         verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
                                    c->sender_addrmsk[i];
                 if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_PORT) {
                 v16 = NR16(stpc->port);
                 if (FWINV(v16 < c->portl ||
                     v16 > c->portu, EBT_STP_PORT))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_MSGAGE) {
                 v16 = NR16(stpc->msg_age);
                 if (FWINV(v16 < c->msg_agel ||
                     v16 > c->msg_ageu, EBT_STP_MSGAGE))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_MAXAGE) {
                 v16 = NR16(stpc->max_age);
                 if (FWINV(v16 < c->max_agel ||
                     v16 > c->max_ageu, EBT_STP_MAXAGE))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_HELLOTIME) {
                 v16 = NR16(stpc->hello_time);
                 if (FWINV(v16 < c->hello_timel ||
                     v16 > c->hello_timeu, EBT_STP_HELLOTIME))
-                        return EBT_NOMATCH;
+                        return false;
         }
         if (info->bitmask & EBT_STP_FWDD) {
                 v16 = NR16(stpc->forward_delay);
                 if (FWINV(v16 < c->forward_delayl ||
                     v16 > c->forward_delayu, EBT_STP_FWDD))
-                        return EBT_NOMATCH;
+                        return false;
         }
-        return EBT_MATCH;
+        return true;
 }
 
-static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
-   const struct net_device *out, const void *data, unsigned int datalen)
+static bool
+ebt_stp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_stp_info *info = data;
+        const struct ebt_stp_info *info = par->matchinfo;
         const struct stp_header *sp;
         struct stp_header _stph;
         const uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
 
         sp = skb_header_pointer(skb, 0, sizeof(_stph), &_stph);
         if (sp == NULL)
-                return EBT_NOMATCH;
+                return false;
 
         /* The stp code only considers these */
         if (memcmp(sp, header, sizeof(header)))
-                return EBT_NOMATCH;
+                return false;
 
         if (info->bitmask & EBT_STP_TYPE
             && FWINV(info->type != sp->type, EBT_STP_TYPE))
-                return EBT_NOMATCH;
+                return false;
 
         if (sp->type == BPDU_TYPE_CONFIG &&
             info->bitmask & EBT_STP_CONFIG_MASK) {
@@ -147,48 +147,48 @@ static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in
                 st = skb_header_pointer(skb, sizeof(_stph),
                                         sizeof(_stpc), &_stpc);
                 if (st == NULL)
-                        return EBT_NOMATCH;
+                        return false;
                 return ebt_filter_config(info, st);
         }
-        return EBT_MATCH;
+        return true;
 }
 
-static int ebt_stp_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_stp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ebt_stp_info *info = data;
-        const unsigned int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
+        const struct ebt_stp_info *info = par->matchinfo;
         const uint8_t bridge_ula[6] = {0x01, 0x80, 0xc2, 0x00, 0x00, 0x00};
         const uint8_t msk[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+        const struct ebt_entry *e = par->entryinfo;
 
         if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
             !(info->bitmask & EBT_STP_MASK))
-                return -EINVAL;
-        if (datalen != len)
-                return -EINVAL;
+                return false;
         /* Make sure the match only receives stp frames */
         if (compare_ether_addr(e->destmac, bridge_ula) ||
             compare_ether_addr(e->destmsk, msk) || !(e->bitmask & EBT_DESTMAC))
-                return -EINVAL;
+                return false;
 
-        return 0;
+        return true;
 }
 
-static struct ebt_match filter_stp __read_mostly = {
-        .name           = EBT_STP_MATCH,
-        .match          = ebt_filter_stp,
-        .check          = ebt_stp_check,
+static struct xt_match ebt_stp_mt_reg __read_mostly = {
+        .name           = "stp",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_stp_mt,
+        .checkentry     = ebt_stp_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_stp_info)),
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_stp_init(void)
 {
-        return ebt_register_match(&filter_stp);
+        return xt_register_match(&ebt_stp_mt_reg);
 }
 
 static void __exit ebt_stp_fini(void)
 {
-        ebt_unregister_match(&filter_stp);
+        xt_unregister_match(&ebt_stp_mt_reg);
 }
 
 module_init(ebt_stp_init);
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 2d4c9ef909fc..2c6d6823e703 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -36,6 +36,7 @@
 #include <linux/timer.h>
 #include <linux/netlink.h>
 #include <linux/netdevice.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_ulog.h>
 #include <net/netfilter/nf_log.h>
@@ -223,7 +224,7 @@ alloc_failure:
 }
 
 /* this function is registered with the netfilter core */
-static void ebt_log_packet(unsigned int pf, unsigned int hooknum,
+static void ebt_log_packet(u_int8_t pf, unsigned int hooknum,
    const struct sk_buff *skb, const struct net_device *in,
    const struct net_device *out, const struct nf_loginfo *li,
    const char *prefix)
@@ -245,24 +246,20 @@ static void ebt_log_packet(unsigned int pf, unsigned int hooknum,
         ebt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
 }
 
-static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static unsigned int
+ebt_ulog_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ebt_ulog_info *uloginfo = data;
-
-        ebt_ulog_packet(hooknr, skb, in, out, uloginfo, NULL);
+        ebt_ulog_packet(par->hooknum, skb, par->in, par->out,
+                        par->targinfo, NULL);
+        return EBT_CONTINUE;
 }
 
-
-static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
-   const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_ulog_tg_check(const struct xt_tgchk_param *par)
 {
-        struct ebt_ulog_info *uloginfo = data;
+        struct ebt_ulog_info *uloginfo = par->targinfo;
 
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_ulog_info)) ||
-            uloginfo->nlgroup > 31)
-                return -EINVAL;
+        if (uloginfo->nlgroup > 31)
+                return false;
 
         uloginfo->prefix[EBT_ULOG_PREFIX_LEN - 1] = '\0';
 
@@ -272,27 +269,31 @@ static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_watcher ulog __read_mostly = {
-        .name           = EBT_ULOG_WATCHER,
-        .watcher        = ebt_ulog,
-        .check          = ebt_ulog_check,
+static struct xt_target ebt_ulog_tg_reg __read_mostly = {
+        .name           = "ulog",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .target         = ebt_ulog_tg,
+        .checkentry     = ebt_ulog_tg_check,
+        .targetsize     = XT_ALIGN(sizeof(struct ebt_ulog_info)),
         .me             = THIS_MODULE,
 };
 
 static const struct nf_logger ebt_ulog_logger = {
-        .name           = EBT_ULOG_WATCHER,
+        .name           = "ulog",
         .logfn          = &ebt_log_packet,
         .me             = THIS_MODULE,
 };
 
 static int __init ebt_ulog_init(void)
 {
-        int i, ret = 0;
+        bool ret = true;
+        int i;
 
         if (nlbufsiz >= 128*1024) {
                 printk(KERN_NOTICE "ebt_ulog: Netlink buffer has to be <= 128kB,"
                        " please try a smaller nlbufsiz parameter.\n");
-                return -EINVAL;
+                return false;
         }
 
         /* initialize ulog_buffers */
@@ -304,13 +305,16 @@ static int __init ebt_ulog_init(void)
         ebtulognl = netlink_kernel_create(&init_net, NETLINK_NFLOG,
                                           EBT_ULOG_MAXNLGROUPS, NULL, NULL,
                                           THIS_MODULE);
-        if (!ebtulognl)
-                ret = -ENOMEM;
-        else if ((ret = ebt_register_watcher(&ulog)))
+        if (!ebtulognl) {
+                printk(KERN_WARNING KBUILD_MODNAME ": out of memory trying to "
+                       "call netlink_kernel_create\n");
+                ret = false;
+        } else if (xt_register_target(&ebt_ulog_tg_reg) != 0) {
                 netlink_kernel_release(ebtulognl);
+        }
 
-        if (ret == 0)
-                nf_log_register(PF_BRIDGE, &ebt_ulog_logger);
+        if (ret)
+                nf_log_register(NFPROTO_BRIDGE, &ebt_ulog_logger);
 
         return ret;
 }
@@ -321,7 +325,7 @@ static void __exit ebt_ulog_fini(void)
         int i;
 
         nf_log_unregister(&ebt_ulog_logger);
-        ebt_unregister_watcher(&ulog);
+        xt_unregister_target(&ebt_ulog_tg_reg);
         for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
                 ub = &ulog_buffers[i];
                 if (timer_pending(&ub->timer))
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index ab60b0dade80..3dddd489328e 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -22,6 +22,7 @@
 #include <linux/if_vlan.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_vlan.h>
 
@@ -37,15 +38,12 @@ MODULE_LICENSE("GPL");
 
 #define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
 #define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
-#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return EBT_NOMATCH;}
+#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; }
 
-static int
-ebt_filter_vlan(const struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                const void *data, unsigned int datalen)
+static bool
+ebt_vlan_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ebt_vlan_info *info = data;
+        const struct ebt_vlan_info *info = par->matchinfo;
         const struct vlan_hdr *fp;
         struct vlan_hdr _frame;
 
@@ -57,7 +55,7 @@ ebt_filter_vlan(const struct sk_buff *skb,
 
         fp = skb_header_pointer(skb, 0, sizeof(_frame), &_frame);
         if (fp == NULL)
-                return EBT_NOMATCH;
+                return false;
 
         /* Tag Control Information (TCI) consists of the following elements:
          * - User_priority. The user_priority field is three bits in length,
@@ -83,30 +81,20 @@ ebt_filter_vlan(const struct sk_buff *skb,
         if (GET_BITMASK(EBT_VLAN_ENCAP))
                 EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
 
-        return EBT_MATCH;
+        return true;
 }
 
-static int
-ebt_check_vlan(const char *tablename,
-               unsigned int hooknr,
-               const struct ebt_entry *e, void *data, unsigned int datalen)
+static bool ebt_vlan_mt_check(const struct xt_mtchk_param *par)
 {
-        struct ebt_vlan_info *info = data;
-
-        /* Parameters buffer overflow check */
-        if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
-                DEBUG_MSG
-                    ("passed size %d is not eq to ebt_vlan_info (%Zd)\n",
-                     datalen, sizeof(struct ebt_vlan_info));
-                return -EINVAL;
-        }
+        struct ebt_vlan_info *info = par->matchinfo;
+        const struct ebt_entry *e = par->entryinfo;
 
         /* Is it 802.1Q frame checked? */
         if (e->ethproto != htons(ETH_P_8021Q)) {
                 DEBUG_MSG
                     ("passed entry proto %2.4X is not 802.1Q (8100)\n",
                      (unsigned short) ntohs(e->ethproto));
-                return -EINVAL;
+                return false;
         }
 
         /* Check for bitmask range
@@ -114,14 +102,14 @@ ebt_check_vlan(const char *tablename,
         if (info->bitmask & ~EBT_VLAN_MASK) {
                 DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
                           info->bitmask, EBT_VLAN_MASK);
-                return -EINVAL;
+                return false;
         }
 
         /* Check for inversion flags range */
         if (info->invflags & ~EBT_VLAN_MASK) {
                 DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
                           info->invflags, EBT_VLAN_MASK);
-                return -EINVAL;
+                return false;
         }
 
         /* Reserved VLAN ID (VID) values
@@ -136,7 +124,7 @@ ebt_check_vlan(const char *tablename,
                                 DEBUG_MSG
                                     ("id %d is out of range (1-4096)\n",
                                      info->id);
-                                return -EINVAL;
+                                return false;
                         }
                         /* Note: This is valid VLAN-tagged frame point.
                          * Any value of user_priority are acceptable,
@@ -151,7 +139,7 @@ ebt_check_vlan(const char *tablename,
                 if ((unsigned char) info->prio > 7) {
                         DEBUG_MSG("prio %d is out of range (0-7)\n",
                              info->prio);
-                        return -EINVAL;
+                        return false;
                 }
         }
         /* Check for encapsulated proto range - it is possible to be
@@ -162,17 +150,20 @@ ebt_check_vlan(const char *tablename,
                         DEBUG_MSG
                             ("encap frame length %d is less than minimal\n",
                              ntohs(info->encap));
-                        return -EINVAL;
+                        return false;
                 }
         }
 
-        return 0;
+        return true;
 }
 
-static struct ebt_match filter_vlan __read_mostly = {
-        .name           = EBT_VLAN_MATCH,
-        .match          = ebt_filter_vlan,
-        .check          = ebt_check_vlan,
+static struct xt_match ebt_vlan_mt_reg __read_mostly = {
+        .name           = "vlan",
+        .revision       = 0,
+        .family         = NFPROTO_BRIDGE,
+        .match          = ebt_vlan_mt,
+        .checkentry     = ebt_vlan_mt_check,
+        .matchsize      = XT_ALIGN(sizeof(struct ebt_vlan_info)),
         .me             = THIS_MODULE,
 };
 
@@ -181,12 +172,12 @@ static int __init ebt_vlan_init(void)
         DEBUG_MSG("ebtables 802.1Q extension module v"
                   MODULE_VERS "\n");
         DEBUG_MSG("module debug=%d\n", !!debug);
-        return ebt_register_match(&filter_vlan);
+        return xt_register_match(&ebt_vlan_mt_reg);
 }
 
 static void __exit ebt_vlan_fini(void)
 {
-        ebt_unregister_match(&filter_vlan);
+        xt_unregister_match(&ebt_vlan_mt_reg);
 }
 
 module_init(ebt_vlan_init);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 32afff859e4a..5bb88eb0aad4 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -19,6 +19,7 @@
 #include <linux/kmod.h>
 #include <linux/module.h>
 #include <linux/vmalloc.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
@@ -55,29 +56,31 @@
 
 static DEFINE_MUTEX(ebt_mutex);
 static LIST_HEAD(ebt_tables);
-static LIST_HEAD(ebt_targets);
-static LIST_HEAD(ebt_matches);
-static LIST_HEAD(ebt_watchers);
 
-static struct ebt_target ebt_standard_target =
-{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
+static struct xt_target ebt_standard_target = {
+        .name       = "standard",
+        .revision   = 0,
+        .family     = NFPROTO_BRIDGE,
+        .targetsize = sizeof(int),
+};
 
-static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
-   const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
-   const struct net_device *out)
+static inline int
+ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
+               struct xt_target_param *par)
 {
-        w->u.watcher->watcher(skb, hooknr, in, out, w->data,
-           w->watcher_size);
+        par->target   = w->u.watcher;
+        par->targinfo = w->data;
+        w->u.watcher->target(skb, par);
         /* watchers don't give a verdict */
         return 0;
 }
 
 static inline int ebt_do_match (struct ebt_entry_match *m,
-   const struct sk_buff *skb, const struct net_device *in,
-   const struct net_device *out)
+   const struct sk_buff *skb, struct xt_match_param *par)
 {
-        return m->u.match->match(skb, in, out, m->data,
-           m->match_size);
+        par->match     = m->u.match;
+        par->matchinfo = m->data;
+        return m->u.match->match(skb, par);
 }
 
 static inline int ebt_dev_check(char *entry, const struct net_device *device)
@@ -153,6 +156,15 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
         struct ebt_entries *chaininfo;
         char *base;
         struct ebt_table_info *private;
+        bool hotdrop = false;
+        struct xt_match_param mtpar;
+        struct xt_target_param tgpar;
+
+        mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
+        mtpar.in      = tgpar.in  = in;
+        mtpar.out     = tgpar.out = out;
+        mtpar.hotdrop = &hotdrop;
+        tgpar.hooknum = hook;
 
         read_lock_bh(&table->lock);
         private = table->private;
@@ -173,8 +185,12 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
                         goto letscontinue;
 
-                if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, in, out) != 0)
+                if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
                         goto letscontinue;
+                if (hotdrop) {
+                        read_unlock_bh(&table->lock);
+                        return NF_DROP;
+                }
 
                 /* increase counter */
                 (*(counter_base + i)).pcnt++;
@@ -182,17 +198,18 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 
                 /* these should only watch: not modify, nor tell us
                    what to do with the packet */
-                EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, hook, in,
-                   out);
+                EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
 
                 t = (struct ebt_entry_target *)
                    (((char *)point) + point->target_offset);
                 /* standard target */
                 if (!t->u.target->target)
                         verdict = ((struct ebt_standard_target *)t)->verdict;
-                else
-                        verdict = t->u.target->target(skb, hook,
-                           in, out, t->data, t->target_size);
+                else {
+                        tgpar.target   = t->u.target;
+                        tgpar.targinfo = t->data;
+                        verdict = t->u.target->target(skb, &tgpar);
+                }
                 if (verdict == EBT_ACCEPT) {
                         read_unlock_bh(&table->lock);
                         return NF_ACCEPT;
@@ -312,80 +329,71 @@ find_table_lock(const char *name, int *error, struct mutex *mutex)
         return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
 }
 
-static inline struct ebt_match *
-find_match_lock(const char *name, int *error, struct mutex *mutex)
-{
-        return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
-}
-
-static inline struct ebt_watcher *
-find_watcher_lock(const char *name, int *error, struct mutex *mutex)
-{
-        return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
-}
-
-static inline struct ebt_target *
-find_target_lock(const char *name, int *error, struct mutex *mutex)
-{
-        return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
-}
-
 static inline int
-ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
-   const char *name, unsigned int hookmask, unsigned int *cnt)
+ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
+                unsigned int *cnt)
 {
-        struct ebt_match *match;
+        const struct ebt_entry *e = par->entryinfo;
+        struct xt_match *match;
         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
         int ret;
 
         if (left < sizeof(struct ebt_entry_match) ||
             left - sizeof(struct ebt_entry_match) < m->match_size)
                 return -EINVAL;
-        match = find_match_lock(m->u.name, &ret, &ebt_mutex);
-        if (!match)
-                return ret;
-        m->u.match = match;
-        if (!try_module_get(match->me)) {
-                mutex_unlock(&ebt_mutex);
+
+        match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
+                m->u.name, 0), "ebt_%s", m->u.name);
+        if (IS_ERR(match))
+                return PTR_ERR(match);
+        if (match == NULL)
                 return -ENOENT;
-        }
-        mutex_unlock(&ebt_mutex);
-        if (match->check &&
-           match->check(name, hookmask, e, m->data, m->match_size) != 0) {
-                BUGPRINT("match->check failed\n");
+        m->u.match = match;
+
+        par->match     = match;
+        par->matchinfo = m->data;
+        ret = xt_check_match(par, m->match_size,
+              e->ethproto, e->invflags & EBT_IPROTO);
+        if (ret < 0) {
                 module_put(match->me);
-                return -EINVAL;
+                return ret;
         }
+
         (*cnt)++;
         return 0;
 }
 
 static inline int
-ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
-   const char *name, unsigned int hookmask, unsigned int *cnt)
+ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
+                  unsigned int *cnt)
 {
-        struct ebt_watcher *watcher;
+        const struct ebt_entry *e = par->entryinfo;
+        struct xt_target *watcher;
         size_t left = ((char *)e + e->target_offset) - (char *)w;
         int ret;
 
         if (left < sizeof(struct ebt_entry_watcher) ||
            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
                 return -EINVAL;
-        watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
-        if (!watcher)
-                return ret;
-        w->u.watcher = watcher;
-        if (!try_module_get(watcher->me)) {
-                mutex_unlock(&ebt_mutex);
+
+        watcher = try_then_request_module(
+                  xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
+                  "ebt_%s", w->u.name);
+        if (IS_ERR(watcher))
+                return PTR_ERR(watcher);
+        if (watcher == NULL)
                 return -ENOENT;
-        }
-        mutex_unlock(&ebt_mutex);
-        if (watcher->check &&
-           watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
-                BUGPRINT("watcher->check failed\n");
+        w->u.watcher = watcher;
+
+        par->target   = watcher;
+        par->targinfo = w->data;
+        ret = xt_check_target(par, w->watcher_size,
+              e->ethproto, e->invflags & EBT_IPROTO);
+        if (ret < 0) {
                 module_put(watcher->me);
-                return -EINVAL;
+                return ret;
         }
+
         (*cnt)++;
         return 0;
 }
@@ -558,30 +566,41 @@ ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 static inline int
 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 {
+        struct xt_mtdtor_param par;
+
         if (i && (*i)-- == 0)
                 return 1;
-        if (m->u.match->destroy)
-                m->u.match->destroy(m->data, m->match_size);
-        module_put(m->u.match->me);
 
+        par.match     = m->u.match;
+        par.matchinfo = m->data;
+        par.family    = NFPROTO_BRIDGE;
+        if (par.match->destroy != NULL)
+                par.match->destroy(&par);
+        module_put(par.match->me);
         return 0;
 }
 
 static inline int
 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 {
+        struct xt_tgdtor_param par;
+
         if (i && (*i)-- == 0)
                 return 1;
-        if (w->u.watcher->destroy)
-                w->u.watcher->destroy(w->data, w->watcher_size);
-        module_put(w->u.watcher->me);
 
+        par.target   = w->u.watcher;
+        par.targinfo = w->data;
+        par.family   = NFPROTO_BRIDGE;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
+        module_put(par.target->me);
         return 0;
 }
 
 static inline int
 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 {
+        struct xt_tgdtor_param par;
         struct ebt_entry_target *t;
 
         if (e->bitmask == 0)
@@ -592,10 +611,13 @@ ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
-        if (t->u.target->destroy)
-                t->u.target->destroy(t->data, t->target_size);
-        module_put(t->u.target->me);
 
+        par.target   = t->u.target;
+        par.targinfo = t->data;
+        par.family   = NFPROTO_BRIDGE;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
+        module_put(par.target->me);
         return 0;
 }
 
@@ -605,10 +627,12 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 {
         struct ebt_entry_target *t;
-        struct ebt_target *target;
+        struct xt_target *target;
         unsigned int i, j, hook = 0, hookmask = 0;
         size_t gap;
         int ret;
+        struct xt_mtchk_param mtpar;
+        struct xt_tgchk_param tgpar;
 
         /* don't mess with the struct ebt_entries */
         if (e->bitmask == 0)
@@ -649,24 +673,31 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
                         hookmask = cl_s[i - 1].hookmask;
         }
         i = 0;
-        ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
+
+        mtpar.table     = tgpar.table     = name;
+        mtpar.entryinfo = tgpar.entryinfo = e;
+        mtpar.hook_mask = tgpar.hook_mask = hookmask;
+        mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
+        ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
         if (ret != 0)
                 goto cleanup_matches;
         j = 0;
-        ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
+        ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
         if (ret != 0)
                 goto cleanup_watchers;
         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
         gap = e->next_offset - e->target_offset;
-        target = find_target_lock(t->u.name, &ret, &ebt_mutex);
-        if (!target)
+
+        target = try_then_request_module(
+                 xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
+                 "ebt_%s", t->u.name);
+        if (IS_ERR(target)) {
+                ret = PTR_ERR(target);
                 goto cleanup_watchers;
-        if (!try_module_get(target->me)) {
-                mutex_unlock(&ebt_mutex);
+        } else if (target == NULL) {
                 ret = -ENOENT;
                 goto cleanup_watchers;
         }
-        mutex_unlock(&ebt_mutex);
 
         t->u.target = target;
         if (t->u.target == &ebt_standard_target) {
@@ -681,13 +712,20 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
                         ret = -EFAULT;
                         goto cleanup_watchers;
                 }
-        } else if (t->target_size > gap - sizeof(struct ebt_entry_target) ||
-           (t->u.target->check &&
-           t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
+        } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
                 module_put(t->u.target->me);
                 ret = -EFAULT;
                 goto cleanup_watchers;
         }
+
+        tgpar.target   = target;
+        tgpar.targinfo = t->data;
+        ret = xt_check_target(&tgpar, t->target_size,
+              e->ethproto, e->invflags & EBT_IPROTO);
+        if (ret < 0) {
+                module_put(target->me);
+                goto cleanup_watchers;
+        }
         (*cnt)++;
         return 0;
 cleanup_watchers:
@@ -1068,87 +1106,6 @@ free_newinfo:
         return ret;
 }
 
-int ebt_register_target(struct ebt_target *target)
-{
-        struct ebt_target *t;
-        int ret;
-
-        ret = mutex_lock_interruptible(&ebt_mutex);
-        if (ret != 0)
-                return ret;
-        list_for_each_entry(t, &ebt_targets, list) {
-                if (strcmp(t->name, target->name) == 0) {
-                        mutex_unlock(&ebt_mutex);
-                        return -EEXIST;
-                }
-        }
-        list_add(&target->list, &ebt_targets);
-        mutex_unlock(&ebt_mutex);
-
-        return 0;
-}
-
-void ebt_unregister_target(struct ebt_target *target)
-{
-        mutex_lock(&ebt_mutex);
-        list_del(&target->list);
-        mutex_unlock(&ebt_mutex);
-}
-
-int ebt_register_match(struct ebt_match *match)
-{
-        struct ebt_match *m;
-        int ret;
-
-        ret = mutex_lock_interruptible(&ebt_mutex);
-        if (ret != 0)
-                return ret;
-        list_for_each_entry(m, &ebt_matches, list) {
-                if (strcmp(m->name, match->name) == 0) {
-                        mutex_unlock(&ebt_mutex);
-                        return -EEXIST;
-                }
-        }
-        list_add(&match->list, &ebt_matches);
-        mutex_unlock(&ebt_mutex);
-
-        return 0;
-}
-
-void ebt_unregister_match(struct ebt_match *match)
-{
-        mutex_lock(&ebt_mutex);
-        list_del(&match->list);
-        mutex_unlock(&ebt_mutex);
-}
-
-int ebt_register_watcher(struct ebt_watcher *watcher)
-{
-        struct ebt_watcher *w;
-        int ret;
-
-        ret = mutex_lock_interruptible(&ebt_mutex);
-        if (ret != 0)
-                return ret;
-        list_for_each_entry(w, &ebt_watchers, list) {
-                if (strcmp(w->name, watcher->name) == 0) {
-                        mutex_unlock(&ebt_mutex);
-                        return -EEXIST;
-                }
-        }
-        list_add(&watcher->list, &ebt_watchers);
-        mutex_unlock(&ebt_mutex);
-
-        return 0;
-}
-
-void ebt_unregister_watcher(struct ebt_watcher *watcher)
-{
-        mutex_lock(&ebt_mutex);
-        list_del(&watcher->list);
-        mutex_unlock(&ebt_mutex);
-}
-
 int ebt_register_table(struct ebt_table *table)
 {
         struct ebt_table_info *newinfo;
@@ -1518,11 +1475,14 @@ static int __init ebtables_init(void)
 {
         int ret;
 
-        mutex_lock(&ebt_mutex);
-        list_add(&ebt_standard_target.list, &ebt_targets);
-        mutex_unlock(&ebt_mutex);
-        if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
+        ret = xt_register_target(&ebt_standard_target);
+        if (ret < 0)
+                return ret;
+        ret = nf_register_sockopt(&ebt_sockopts);
+        if (ret < 0) {
+                xt_unregister_target(&ebt_standard_target);
                 return ret;
+        }
 
         printk(KERN_INFO "Ebtables v2.0 registered\n");
         return 0;
@@ -1531,17 +1491,12 @@ static int __init ebtables_init(void)
 static void __exit ebtables_fini(void)
 {
         nf_unregister_sockopt(&ebt_sockopts);
+        xt_unregister_target(&ebt_standard_target);
         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
 }
 
 EXPORT_SYMBOL(ebt_register_table);
 EXPORT_SYMBOL(ebt_unregister_table);
-EXPORT_SYMBOL(ebt_register_match);
-EXPORT_SYMBOL(ebt_unregister_match);
-EXPORT_SYMBOL(ebt_register_watcher);
-EXPORT_SYMBOL(ebt_unregister_watcher);
-EXPORT_SYMBOL(ebt_register_target);
-EXPORT_SYMBOL(ebt_unregister_target);
 EXPORT_SYMBOL(ebt_do_table);
 module_init(ebtables_init);
 module_exit(ebtables_fini);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 7c52fe277b62..b0dc818a91d7 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -18,6 +18,7 @@ static struct list_head *first_device = &pernet_list;
 static DEFINE_MUTEX(net_mutex);
 
 LIST_HEAD(net_namespace_list);
+EXPORT_SYMBOL_GPL(net_namespace_list);
 
 struct net init_net;
 EXPORT_SYMBOL(init_net);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 01671ad51ed3..6efdb70b3eb2 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -12,6 +12,7 @@
 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
 int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
 {
+        struct net *net = dev_net(skb->dst->dev);
         const struct iphdr *iph = ip_hdr(skb);
         struct rtable *rt;
         struct flowi fl = {};
@@ -19,7 +20,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         unsigned int hh_len;
         unsigned int type;
 
-        type = inet_addr_type(&init_net, iph->saddr);
+        type = inet_addr_type(net, iph->saddr);
         if (skb->sk && inet_sk(skb->sk)->transparent)
                 type = RTN_LOCAL;
         if (addr_type == RTN_UNSPEC)
@@ -36,7 +37,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
                 fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
                 fl.mark = skb->mark;
                 fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
-                if (ip_route_output_key(&init_net, &rt, &fl) != 0)
+                if (ip_route_output_key(net, &rt, &fl) != 0)
                         return -1;
 
                 /* Drop old route. */
@@ -46,7 +47,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
                 /* non-local src, find valid iif to satisfy
                  * rp-filter when calling ip_route_input. */
                 fl.nl_u.ip4_u.daddr = iph->saddr;
-                if (ip_route_output_key(&init_net, &rt, &fl) != 0)
+                if (ip_route_output_key(net, &rt, &fl) != 0)
                         return -1;
 
                 odst = skb->dst;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 90eb7cb47e77..3816e1dc9295 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -5,10 +5,15 @@
 menu "IP: Netfilter Configuration"
         depends on INET && NETFILTER
 
+config NF_DEFRAG_IPV4
+        tristate
+        default n
+
 config NF_CONNTRACK_IPV4
         tristate "IPv4 connection tracking support (required for NAT)"
         depends on NF_CONNTRACK
         default m if NETFILTER_ADVANCED=n
+        select NF_DEFRAG_IPV4
         ---help---
           Connection tracking keeps a record of what packets have passed
           through your machine, in order to figure out how they are related
@@ -56,23 +61,30 @@ config IP_NF_IPTABLES
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+if IP_NF_IPTABLES
+
 # The matches.
-config IP_NF_MATCH_RECENT
-        tristate '"recent" match support'
-        depends on IP_NF_IPTABLES
+config IP_NF_MATCH_ADDRTYPE
+        tristate '"addrtype" address type match support'
         depends on NETFILTER_ADVANCED
         help
-          This match is used for creating one or many lists of recently
-          used addresses and then matching against that/those list(s).
+          This option allows you to match what routing thinks of an address,
+          eg. UNICAST, LOCAL, BROADCAST, ...
 
-          Short options are available by using 'iptables -m recent -h'
-          Official Website: <http://snowman.net/projects/ipt_recent/>
+          If you want to compile it as a module, say M here and read
+          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+
+config IP_NF_MATCH_AH
+        tristate '"ah" match support'
+        depends on NETFILTER_ADVANCED
+        help
+          This match extension allows you to match a range of SPIs
+          inside AH header of IPSec packets.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_MATCH_ECN
         tristate '"ecn" match support'
-        depends on IP_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `ECN' match, which allows you to match against
@@ -80,19 +92,8 @@ config IP_NF_MATCH_ECN
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_MATCH_AH
-        tristate '"ah" match support'
-        depends on IP_NF_IPTABLES
-        depends on NETFILTER_ADVANCED
-        help
-          This match extension allows you to match a range of SPIs
-          inside AH header of IPSec packets.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_MATCH_TTL
         tristate '"ttl" match support'
-        depends on IP_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
@@ -100,21 +101,9 @@ config IP_NF_MATCH_TTL
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_MATCH_ADDRTYPE
-        tristate '"addrtype" address type match support'
-        depends on IP_NF_IPTABLES
-        depends on NETFILTER_ADVANCED
-        help
-          This option allows you to match what routing thinks of an address,
-          eg. UNICAST, LOCAL, BROADCAST, ...
-
-          If you want to compile it as a module, say M here and read
-          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
-
 # `filter', generic and specific targets
 config IP_NF_FILTER
         tristate "Packet filtering"
-        depends on IP_NF_IPTABLES
         default m if NETFILTER_ADVANCED=n
         help
           Packet filtering defines a table `filter', which has a series of
@@ -136,7 +125,6 @@ config IP_NF_TARGET_REJECT
 
 config IP_NF_TARGET_LOG
         tristate "LOG target support"
-        depends on IP_NF_IPTABLES
         default m if NETFILTER_ADVANCED=n
         help
           This option adds a `LOG' target, which allows you to create rules in
@@ -146,7 +134,6 @@ config IP_NF_TARGET_LOG
 
 config IP_NF_TARGET_ULOG
         tristate "ULOG target support"
-        depends on IP_NF_IPTABLES
         default m if NETFILTER_ADVANCED=n
         ---help---
 
@@ -167,7 +154,7 @@ config IP_NF_TARGET_ULOG
 # NAT + specific targets: nf_conntrack
 config NF_NAT
         tristate "Full NAT"
-        depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
+        depends on NF_CONNTRACK_IPV4
         default m if NETFILTER_ADVANCED=n
         help
           The Full NAT option allows masquerading, port forwarding and other
@@ -194,26 +181,26 @@ config IP_NF_TARGET_MASQUERADE
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_TARGET_REDIRECT
-        tristate "REDIRECT target support"
+config IP_NF_TARGET_NETMAP
+        tristate "NETMAP target support"
         depends on NF_NAT
         depends on NETFILTER_ADVANCED
         help
-          REDIRECT is a special case of NAT: all incoming connections are
-          mapped onto the incoming interface's address, causing the packets to
-          come to the local machine instead of passing through.  This is
-          useful for transparent proxies.
+          NETMAP is an implementation of static 1:1 NAT mapping of network
+          addresses. It maps the network address part, while keeping the host
+          address part intact.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_TARGET_NETMAP
-        tristate "NETMAP target support"
+config IP_NF_TARGET_REDIRECT
+        tristate "REDIRECT target support"
         depends on NF_NAT
         depends on NETFILTER_ADVANCED
         help
-          NETMAP is an implementation of static 1:1 NAT mapping of network
-          addresses. It maps the network address part, while keeping the host
-          address part intact.
+          REDIRECT is a special case of NAT: all incoming connections are
+          mapped onto the incoming interface's address, causing the packets to
+          come to the local machine instead of passing through.  This is
+          useful for transparent proxies.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
@@ -262,44 +249,43 @@ config NF_NAT_PROTO_SCTP
 
 config NF_NAT_FTP
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_FTP
 
 config NF_NAT_IRC
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_IRC
 
 config NF_NAT_TFTP
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_TFTP
 
 config NF_NAT_AMANDA
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_AMANDA
 
 config NF_NAT_PPTP
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_PPTP
         select NF_NAT_PROTO_GRE
 
 config NF_NAT_H323
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_H323
 
 config NF_NAT_SIP
         tristate
-        depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+        depends on NF_CONNTRACK && NF_NAT
         default NF_NAT && NF_CONNTRACK_SIP
 
 # mangle + specific targets
 config IP_NF_MANGLE
         tristate "Packet mangling"
-        depends on IP_NF_IPTABLES
         default m if NETFILTER_ADVANCED=n
         help
           This option adds a `mangle' table to iptables: see the man page for
@@ -308,6 +294,19 @@ config IP_NF_MANGLE
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_TARGET_CLUSTERIP
+        tristate "CLUSTERIP target support (EXPERIMENTAL)"
+        depends on IP_NF_MANGLE && EXPERIMENTAL
+        depends on NF_CONNTRACK_IPV4
+        depends on NETFILTER_ADVANCED
+        select NF_CONNTRACK_MARK
+        help
+          The CLUSTERIP target allows you to build load-balancing clusters of
+          network servers without having a dedicated load-balancing
+          router/server/switch.
+        
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP_NF_TARGET_ECN
         tristate "ECN target support"
         depends on IP_NF_MANGLE
@@ -338,23 +337,9 @@ config IP_NF_TARGET_TTL
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_TARGET_CLUSTERIP
-        tristate "CLUSTERIP target support (EXPERIMENTAL)"
-        depends on IP_NF_MANGLE && EXPERIMENTAL
-        depends on NF_CONNTRACK_IPV4
-        depends on NETFILTER_ADVANCED
-        select NF_CONNTRACK_MARK
-        help
-          The CLUSTERIP target allows you to build load-balancing clusters of
-          network servers without having a dedicated load-balancing
-          router/server/switch.
-        
-          To compile it as a module, choose M here.  If unsure, say N.
-
 # raw + specific targets
 config IP_NF_RAW
         tristate  'raw table support (required for NOTRACK/TRACE)'
-        depends on IP_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `raw' table to iptables. This table is the very
@@ -367,7 +352,6 @@ config IP_NF_RAW
 # security table for MAC policy
 config IP_NF_SECURITY
         tristate "Security table"
-        depends on IP_NF_IPTABLES
         depends on SECURITY
         depends on NETFILTER_ADVANCED
         help
@@ -376,6 +360,8 @@ config IP_NF_SECURITY
          
           If unsure, say N.
 
+endif # IP_NF_IPTABLES
+
 # ARP tables
 config IP_NF_ARPTABLES
         tristate "ARP tables support"
@@ -388,9 +374,10 @@ config IP_NF_ARPTABLES
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+if IP_NF_ARPTABLES
+
 config IP_NF_ARPFILTER
         tristate "ARP packet filtering"
-        depends on IP_NF_ARPTABLES
         help
           ARP packet filtering defines a table `filter', which has a series of
           rules for simple ARP packet filtering at local input and
@@ -401,10 +388,11 @@ config IP_NF_ARPFILTER
 
 config IP_NF_ARP_MANGLE
         tristate "ARP payload mangling"
-        depends on IP_NF_ARPTABLES
         help
           Allows altering the ARP packet payload: source and destination
           hardware and network addresses.
 
+endif # IP_NF_ARPTABLES
+
 endmenu
 
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 3f31291f37ce..5f9b650d90fc 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -18,6 +18,9 @@ obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
 
 obj-$(CONFIG_NF_NAT) += nf_nat.o
 
+# defrag
+obj-$(CONFIG_NF_DEFRAG_IPV4) += nf_defrag_ipv4.o
+
 # NAT helpers (nf_conntrack)
 obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
 obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
@@ -48,7 +51,6 @@ obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
-obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 
 # targets
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 03e83a65aec5..8d70d29f1ccf 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -200,15 +200,12 @@ static inline int arp_checkentry(const struct arpt_arp *arp)
         return 1;
 }
 
-static unsigned int arpt_error(struct sk_buff *skb,
-                               const struct net_device *in,
-                               const struct net_device *out,
-                               unsigned int hooknum,
-                               const struct xt_target *target,
-                               const void *targinfo)
+static unsigned int
+arpt_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
         if (net_ratelimit())
-                printk("arp_tables: error: '%s'\n", (char *)targinfo);
+                printk("arp_tables: error: '%s'\n",
+                       (const char *)par->targinfo);
 
         return NF_DROP;
 }
@@ -232,6 +229,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         const char *indev, *outdev;
         void *table_base;
         const struct xt_table_info *private;
+        struct xt_target_param tgpar;
 
         if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
                 return NF_DROP;
@@ -245,6 +243,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         e = get_entry(table_base, private->hook_entry[hook]);
         back = get_entry(table_base, private->underflow[hook]);
 
+        tgpar.in      = in;
+        tgpar.out     = out;
+        tgpar.hooknum = hook;
+        tgpar.family  = NFPROTO_ARP;
+
         arp = arp_hdr(skb);
         do {
                 if (arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
@@ -290,11 +293,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                                 /* Targets which reenter must return
                                  * abs. verdicts
                                  */
+                                tgpar.target   = t->u.kernel.target;
+                                tgpar.targinfo = t->data;
                                 verdict = t->u.kernel.target->target(skb,
-                                                                     in, out,
-                                                                     hook,
-                                                                     t->u.kernel.target,
-                                                                     t->data);
+                                                                     &tgpar);
 
                                 /* Target might have changed stuff. */
                                 arp = arp_hdr(skb);
@@ -456,23 +458,24 @@ static inline int check_entry(struct arpt_entry *e, const char *name)
 
 static inline int check_target(struct arpt_entry *e, const char *name)
 {
-        struct arpt_entry_target *t;
-        struct xt_target *target;
+        struct arpt_entry_target *t = arpt_get_target(e);
         int ret;
-
-        t = arpt_get_target(e);
-        target = t->u.kernel.target;
-
-        ret = xt_check_target(target, NF_ARP, t->u.target_size - sizeof(*t),
-                              name, e->comefrom, 0, 0);
-        if (!ret && t->u.kernel.target->checkentry
-            && !t->u.kernel.target->checkentry(name, e, target, t->data,
-                                               e->comefrom)) {
+        struct xt_tgchk_param par = {
+                .table     = name,
+                .entryinfo = e,
+                .target    = t->u.kernel.target,
+                .targinfo  = t->data,
+                .hook_mask = e->comefrom,
+                .family    = NFPROTO_ARP,
+        };
+
+        ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
+        if (ret < 0) {
                 duprintf("arp_tables: check failed for `%s'.\n",
                          t->u.kernel.target->name);
-                ret = -EINVAL;
+                return ret;
         }
-        return ret;
+        return 0;
 }
 
 static inline int
@@ -488,7 +491,8 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
                 return ret;
 
         t = arpt_get_target(e);
-        target = try_then_request_module(xt_find_target(NF_ARP, t->u.user.name,
+        target = try_then_request_module(xt_find_target(NFPROTO_ARP,
+                                                        t->u.user.name,
                                                         t->u.user.revision),
                                          "arpt_%s", t->u.user.name);
         if (IS_ERR(target) || !target) {
@@ -554,15 +558,19 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
 
 static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
 {
+        struct xt_tgdtor_param par;
         struct arpt_entry_target *t;
 
         if (i && (*i)-- == 0)
                 return 1;
 
         t = arpt_get_target(e);
-        if (t->u.kernel.target->destroy)
-                t->u.kernel.target->destroy(t->u.kernel.target, t->data);
-        module_put(t->u.kernel.target->me);
+        par.target   = t->u.kernel.target;
+        par.targinfo = t->data;
+        par.family   = NFPROTO_ARP;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
+        module_put(par.target->me);
         return 0;
 }
 
@@ -788,7 +796,7 @@ static void compat_standard_from_user(void *dst, void *src)
         int v = *(compat_int_t *)src;
 
         if (v > 0)
-                v += xt_compat_calc_jump(NF_ARP, v);
+                v += xt_compat_calc_jump(NFPROTO_ARP, v);
         memcpy(dst, &v, sizeof(v));
 }
 
@@ -797,7 +805,7 @@ static int compat_standard_to_user(void __user *dst, void *src)
         compat_int_t cv = *(int *)src;
 
         if (cv > 0)
-                cv -= xt_compat_calc_jump(NF_ARP, cv);
+                cv -= xt_compat_calc_jump(NFPROTO_ARP, cv);
         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
@@ -815,7 +823,7 @@ static int compat_calc_entry(struct arpt_entry *e,
         t = arpt_get_target(e);
         off += xt_compat_target_offset(t->u.kernel.target);
         newinfo->size -= off;
-        ret = xt_compat_add_offset(NF_ARP, entry_offset, off);
+        ret = xt_compat_add_offset(NFPROTO_ARP, entry_offset, off);
         if (ret)
                 return ret;
 
@@ -866,9 +874,9 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         name[ARPT_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
         if (compat)
-                xt_compat_lock(NF_ARP);
+                xt_compat_lock(NFPROTO_ARP);
 #endif
-        t = try_then_request_module(xt_find_table_lock(net, NF_ARP, name),
+        t = try_then_request_module(xt_find_table_lock(net, NFPROTO_ARP, name),
                                     "arptable_%s", name);
         if (t && !IS_ERR(t)) {
                 struct arpt_getinfo info;
@@ -878,7 +886,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
                 if (compat) {
                         struct xt_table_info tmp;
                         ret = compat_table_info(private, &tmp);
-                        xt_compat_flush_offsets(NF_ARP);
+                        xt_compat_flush_offsets(NFPROTO_ARP);
                         private = &tmp;
                 }
 #endif
@@ -901,7 +909,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
                 ret = t ? PTR_ERR(t) : -ENOENT;
 #ifdef CONFIG_COMPAT
         if (compat)
-                xt_compat_unlock(NF_ARP);
+                xt_compat_unlock(NFPROTO_ARP);
 #endif
         return ret;
 }
@@ -925,7 +933,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
                 return -EINVAL;
         }
 
-        t = xt_find_table_lock(net, NF_ARP, get.name);
+        t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
         if (t && !IS_ERR(t)) {
                 const struct xt_table_info *private = t->private;
 
@@ -967,7 +975,7 @@ static int __do_replace(struct net *net, const char *name,
                 goto out;
         }
 
-        t = try_then_request_module(xt_find_table_lock(net, NF_ARP, name),
+        t = try_then_request_module(xt_find_table_lock(net, NFPROTO_ARP, name),
                                     "arptable_%s", name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1134,7 +1142,7 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
                 goto free;
         }
 
-        t = xt_find_table_lock(net, NF_ARP, name);
+        t = xt_find_table_lock(net, NFPROTO_ARP, name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
                 goto free;
@@ -1218,7 +1226,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         entry_offset = (void *)e - (void *)base;
 
         t = compat_arpt_get_target(e);
-        target = try_then_request_module(xt_find_target(NF_ARP,
+        target = try_then_request_module(xt_find_target(NFPROTO_ARP,
                                                         t->u.user.name,
                                                         t->u.user.revision),
                                          "arpt_%s", t->u.user.name);
@@ -1232,7 +1240,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
 
         off += xt_compat_target_offset(target);
         *size += off;
-        ret = xt_compat_add_offset(NF_ARP, entry_offset, off);
+        ret = xt_compat_add_offset(NFPROTO_ARP, entry_offset, off);
         if (ret)
                 goto release_target;
 
@@ -1333,7 +1341,7 @@ static int translate_compat_table(const char *name,
 
         duprintf("translate_compat_table: size %u\n", info->size);
         j = 0;
-        xt_compat_lock(NF_ARP);
+        xt_compat_lock(NFPROTO_ARP);
         /* Walk through entries, checking offsets. */
         ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
                                         check_compat_entry_size_and_hooks,
@@ -1383,8 +1391,8 @@ static int translate_compat_table(const char *name,
         ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
                                         compat_copy_entry_from_user,
                                         &pos, &size, name, newinfo, entry1);
-        xt_compat_flush_offsets(NF_ARP);
-        xt_compat_unlock(NF_ARP);
+        xt_compat_flush_offsets(NFPROTO_ARP);
+        xt_compat_unlock(NFPROTO_ARP);
         if (ret)
                 goto free_newinfo;
 
@@ -1420,8 +1428,8 @@ out:
         COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
         return ret;
 out_unlock:
-        xt_compat_flush_offsets(NF_ARP);
-        xt_compat_unlock(NF_ARP);
+        xt_compat_flush_offsets(NFPROTO_ARP);
+        xt_compat_unlock(NFPROTO_ARP);
         goto out;
 }
 
@@ -1607,8 +1615,8 @@ static int compat_get_entries(struct net *net,
                 return -EINVAL;
         }
 
-        xt_compat_lock(NF_ARP);
-        t = xt_find_table_lock(net, NF_ARP, get.name);
+        xt_compat_lock(NFPROTO_ARP);
+        t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
         if (t && !IS_ERR(t)) {
                 const struct xt_table_info *private = t->private;
                 struct xt_table_info info;
@@ -1623,13 +1631,13 @@ static int compat_get_entries(struct net *net,
                                  private->size, get.size);
                         ret = -EAGAIN;
                 }
-                xt_compat_flush_offsets(NF_ARP);
+                xt_compat_flush_offsets(NFPROTO_ARP);
                 module_put(t->me);
                 xt_table_unlock(t);
         } else
                 ret = t ? PTR_ERR(t) : -ENOENT;
 
-        xt_compat_unlock(NF_ARP);
+        xt_compat_unlock(NFPROTO_ARP);
         return ret;
 }
 
@@ -1709,7 +1717,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
                         break;
                 }
 
-                try_then_request_module(xt_find_revision(NF_ARP, rev.name,
+                try_then_request_module(xt_find_revision(NFPROTO_ARP, rev.name,
                                                          rev.revision, 1, &ret),
                                         "arpt_%s", rev.name);
                 break;
@@ -1787,7 +1795,7 @@ void arpt_unregister_table(struct xt_table *table)
 static struct xt_target arpt_standard_target __read_mostly = {
         .name           = ARPT_STANDARD_TARGET,
         .targetsize     = sizeof(int),
-        .family         = NF_ARP,
+        .family         = NFPROTO_ARP,
 #ifdef CONFIG_COMPAT
         .compatsize     = sizeof(compat_int_t),
         .compat_from_user = compat_standard_from_user,
@@ -1799,7 +1807,7 @@ static struct xt_target arpt_error_target __read_mostly = {
         .name           = ARPT_ERROR_TARGET,
         .target         = arpt_error,
         .targetsize     = ARPT_FUNCTION_MAXNAMELEN,
-        .family         = NF_ARP,
+        .family         = NFPROTO_ARP,
 };
 
 static struct nf_sockopt_ops arpt_sockopts = {
@@ -1821,12 +1829,12 @@ static struct nf_sockopt_ops arpt_sockopts = {
 
 static int __net_init arp_tables_net_init(struct net *net)
 {
-        return xt_proto_init(net, NF_ARP);
+        return xt_proto_init(net, NFPROTO_ARP);
 }
 
 static void __net_exit arp_tables_net_exit(struct net *net)
 {
-        xt_proto_fini(net, NF_ARP);
+        xt_proto_fini(net, NFPROTO_ARP);
 }
 
 static struct pernet_operations arp_tables_net_ops = {
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index a385959d2655..b0d5b1d0a769 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -9,12 +9,9 @@ MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
 MODULE_DESCRIPTION("arptables arp payload mangle target");
 
 static unsigned int
-target(struct sk_buff *skb,
-       const struct net_device *in, const struct net_device *out,
-       unsigned int hooknum, const struct xt_target *target,
-       const void *targinfo)
+target(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct arpt_mangle *mangle = targinfo;
+        const struct arpt_mangle *mangle = par->targinfo;
         const struct arphdr *arp;
         unsigned char *arpptr;
         int pln, hln;
@@ -57,11 +54,9 @@ target(struct sk_buff *skb,
         return mangle->target;
 }
 
-static bool
-checkentry(const char *tablename, const void *e, const struct xt_target *target,
-           void *targinfo, unsigned int hook_mask)
+static bool checkentry(const struct xt_tgchk_param *par)
 {
-        const struct arpt_mangle *mangle = targinfo;
+        const struct arpt_mangle *mangle = par->targinfo;
 
         if (mangle->flags & ~ARPT_MANGLE_MASK ||
             !(mangle->flags & ARPT_MANGLE_MASK))
@@ -75,7 +70,7 @@ checkentry(const char *tablename, const void *e, const struct xt_target *target,
 
 static struct xt_target arpt_mangle_reg __read_mostly = {
         .name           = "mangle",
-        .family         = NF_ARP,
+        .family         = NFPROTO_ARP,
         .target         = target,
         .targetsize     = sizeof(struct arpt_mangle),
         .checkentry     = checkentry,
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 082f5dd3156c..bee3d117661a 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -51,7 +51,7 @@ static struct xt_table packet_filter = {
         .lock           = __RW_LOCK_UNLOCKED(packet_filter.lock),
         .private        = NULL,
         .me             = THIS_MODULE,
-        .af             = NF_ARP,
+        .af             = NFPROTO_ARP,
 };
 
 /* The work comes in here from netfilter.c */
@@ -89,21 +89,21 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = {
         {
                 .hook           = arpt_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = NF_ARP,
+                .pf             = NFPROTO_ARP,
                 .hooknum        = NF_ARP_IN,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
                 .hook           = arpt_out_hook,
                 .owner          = THIS_MODULE,
-                .pf             = NF_ARP,
+                .pf             = NFPROTO_ARP,
                 .hooknum        = NF_ARP_OUT,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
                 .hook           = arpt_forward_hook,
                 .owner          = THIS_MODULE,
-                .pf             = NF_ARP,
+                .pf             = NFPROTO_ARP,
                 .hooknum        = NF_ARP_FORWARD,
                 .priority       = NF_IP_PRI_FILTER,
         },
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 4e7c719445c2..213fb27debc1 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -171,31 +171,25 @@ ip_checkentry(const struct ipt_ip *ip)
 }
 
 static unsigned int
-ipt_error(struct sk_buff *skb,
-          const struct net_device *in,
-          const struct net_device *out,
-          unsigned int hooknum,
-          const struct xt_target *target,
-          const void *targinfo)
+ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
         if (net_ratelimit())
-                printk("ip_tables: error: `%s'\n", (char *)targinfo);
+                printk("ip_tables: error: `%s'\n",
+                       (const char *)par->targinfo);
 
         return NF_DROP;
 }
 
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ipt_entry_match *m,
-              const struct sk_buff *skb,
-              const struct net_device *in,
-              const struct net_device *out,
-              int offset,
-              bool *hotdrop)
+do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
+         struct xt_match_param *par)
 {
+        par->match     = m->u.kernel.match;
+        par->matchinfo = m->data;
+
         /* Stop iteration if it doesn't match */
-        if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
-                                      offset, ip_hdrlen(skb), hotdrop))
+        if (!m->u.kernel.match->match(skb, par))
                 return true;
         else
                 return false;
@@ -326,7 +320,6 @@ ipt_do_table(struct sk_buff *skb,
              struct xt_table *table)
 {
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
-        u_int16_t offset;
         const struct iphdr *ip;
         u_int16_t datalen;
         bool hotdrop = false;
@@ -336,6 +329,8 @@ ipt_do_table(struct sk_buff *skb,
         void *table_base;
         struct ipt_entry *e, *back;
         struct xt_table_info *private;
+        struct xt_match_param mtpar;
+        struct xt_target_param tgpar;
 
         /* Initialization */
         ip = ip_hdr(skb);
@@ -348,7 +343,13 @@ ipt_do_table(struct sk_buff *skb,
          * things we don't know, ie. tcp syn flag or ports).  If the
          * rule is also a fragment-specific rule, non-fragments won't
          * match it. */
-        offset = ntohs(ip->frag_off) & IP_OFFSET;
+        mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+        mtpar.thoff   = ip_hdrlen(skb);
+        mtpar.hotdrop = &hotdrop;
+        mtpar.in      = tgpar.in  = in;
+        mtpar.out     = tgpar.out = out;
+        mtpar.family  = tgpar.family = NFPROTO_IPV4;
+        tgpar.hooknum = hook;
 
         read_lock_bh(&table->lock);
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
@@ -362,12 +363,11 @@ ipt_do_table(struct sk_buff *skb,
         do {
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
-                if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
+                if (ip_packet_match(ip, indev, outdev,
+                    &e->ip, mtpar.fragoff)) {
                         struct ipt_entry_target *t;
 
-                        if (IPT_MATCH_ITERATE(e, do_match,
-                                              skb, in, out,
-                                              offset, &hotdrop) != 0)
+                        if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
                                 goto no_match;
 
                         ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
@@ -413,16 +413,14 @@ ipt_do_table(struct sk_buff *skb,
                         } else {
                                 /* Targets which reenter must return
                                    abs. verdicts */
+                                tgpar.target   = t->u.kernel.target;
+                                tgpar.targinfo = t->data;
 #ifdef CONFIG_NETFILTER_DEBUG
                                 ((struct ipt_entry *)table_base)->comefrom
                                         = 0xeeeeeeec;
 #endif
                                 verdict = t->u.kernel.target->target(skb,
-                                                                     in, out,
-                                                                     hook,
-                                                                     t->u.kernel.target,
-                                                                     t->data);
-
+                                                                     &tgpar);
 #ifdef CONFIG_NETFILTER_DEBUG
                                 if (((struct ipt_entry *)table_base)->comefrom
                                     != 0xeeeeeeec
@@ -575,12 +573,17 @@ mark_source_chains(struct xt_table_info *newinfo,
 static int
 cleanup_match(struct ipt_entry_match *m, unsigned int *i)
 {
+        struct xt_mtdtor_param par;
+
         if (i && (*i)-- == 0)
                 return 1;
 
-        if (m->u.kernel.match->destroy)
-                m->u.kernel.match->destroy(m->u.kernel.match, m->data);
-        module_put(m->u.kernel.match->me);
+        par.match     = m->u.kernel.match;
+        par.matchinfo = m->data;
+        par.family    = NFPROTO_IPV4;
+        if (par.match->destroy != NULL)
+                par.match->destroy(&par);
+        module_put(par.match->me);
         return 0;
 }
 
@@ -606,34 +609,28 @@ check_entry(struct ipt_entry *e, const char *name)
 }
 
 static int
-check_match(struct ipt_entry_match *m, const char *name,
-                              const struct ipt_ip *ip,
-                              unsigned int hookmask, unsigned int *i)
+check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
+            unsigned int *i)
 {
-        struct xt_match *match;
+        const struct ipt_ip *ip = par->entryinfo;
         int ret;
 
-        match = m->u.kernel.match;
-        ret = xt_check_match(match, AF_INET, m->u.match_size - sizeof(*m),
-                             name, hookmask, ip->proto,
-                             ip->invflags & IPT_INV_PROTO);
-        if (!ret && m->u.kernel.match->checkentry
-            && !m->u.kernel.match->checkentry(name, ip, match, m->data,
-                                              hookmask)) {
+        par->match     = m->u.kernel.match;
+        par->matchinfo = m->data;
+
+        ret = xt_check_match(par, m->u.match_size - sizeof(*m),
+              ip->proto, ip->invflags & IPT_INV_PROTO);
+        if (ret < 0) {
                 duprintf("ip_tables: check failed for `%s'.\n",
-                         m->u.kernel.match->name);
-                ret = -EINVAL;
+                         par.match->name);
+                return ret;
         }
-        if (!ret)
-                (*i)++;
-        return ret;
+        ++*i;
+        return 0;
 }
 
 static int
-find_check_match(struct ipt_entry_match *m,
-                 const char *name,
-                 const struct ipt_ip *ip,
-                 unsigned int hookmask,
+find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
                  unsigned int *i)
 {
         struct xt_match *match;
@@ -648,7 +645,7 @@ find_check_match(struct ipt_entry_match *m,
         }
         m->u.kernel.match = match;
 
-        ret = check_match(m, name, ip, hookmask, i);
+        ret = check_match(m, par, i);
         if (ret)
                 goto err;
 
@@ -660,23 +657,25 @@ err:
 
 static int check_target(struct ipt_entry *e, const char *name)
 {
-        struct ipt_entry_target *t;
-        struct xt_target *target;
+        struct ipt_entry_target *t = ipt_get_target(e);
+        struct xt_tgchk_param par = {
+                .table     = name,
+                .entryinfo = e,
+                .target    = t->u.kernel.target,
+                .targinfo  = t->data,
+                .hook_mask = e->comefrom,
+                .family    = NFPROTO_IPV4,
+        };
         int ret;
 
-        t = ipt_get_target(e);
-        target = t->u.kernel.target;
-        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
-                              name, e->comefrom, e->ip.proto,
-                              e->ip.invflags & IPT_INV_PROTO);
-        if (!ret && t->u.kernel.target->checkentry
-            && !t->u.kernel.target->checkentry(name, e, target, t->data,
-                                               e->comefrom)) {
+        ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
+              e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
+        if (ret < 0) {
                 duprintf("ip_tables: check failed for `%s'.\n",
                          t->u.kernel.target->name);
-                ret = -EINVAL;
+                return ret;
         }
-        return ret;
+        return 0;
 }
 
 static int
@@ -687,14 +686,18 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
         struct xt_target *target;
         int ret;
         unsigned int j;
+        struct xt_mtchk_param mtpar;
 
         ret = check_entry(e, name);
         if (ret)
                 return ret;
 
         j = 0;
-        ret = IPT_MATCH_ITERATE(e, find_check_match, name, &e->ip,
-                                e->comefrom, &j);
+        mtpar.table     = name;
+        mtpar.entryinfo = &e->ip;
+        mtpar.hook_mask = e->comefrom;
+        mtpar.family    = NFPROTO_IPV4;
+        ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
         if (ret != 0)
                 goto cleanup_matches;
 
@@ -769,6 +772,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 static int
 cleanup_entry(struct ipt_entry *e, unsigned int *i)
 {
+        struct xt_tgdtor_param par;
         struct ipt_entry_target *t;
 
         if (i && (*i)-- == 0)
@@ -777,9 +781,13 @@ cleanup_entry(struct ipt_entry *e, unsigned int *i)
         /* Cleanup all matches */
         IPT_MATCH_ITERATE(e, cleanup_match, NULL);
         t = ipt_get_target(e);
-        if (t->u.kernel.target->destroy)
-                t->u.kernel.target->destroy(t->u.kernel.target, t->data);
-        module_put(t->u.kernel.target->me);
+
+        par.target   = t->u.kernel.target;
+        par.targinfo = t->data;
+        par.family   = NFPROTO_IPV4;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
+        module_put(par.target->me);
         return 0;
 }
 
@@ -1648,12 +1656,16 @@ static int
 compat_check_entry(struct ipt_entry *e, const char *name,
                                      unsigned int *i)
 {
+        struct xt_mtchk_param mtpar;
         unsigned int j;
         int ret;
 
         j = 0;
-        ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip,
-                                e->comefrom, &j);
+        mtpar.table     = name;
+        mtpar.entryinfo = &e->ip;
+        mtpar.hook_mask = e->comefrom;
+        mtpar.family    = NFPROTO_IPV4;
+        ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
         if (ret)
                 goto cleanup_matches;
 
@@ -2121,30 +2133,23 @@ icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
 }
 
 static bool
-icmp_match(const struct sk_buff *skb,
-           const struct net_device *in,
-           const struct net_device *out,
-           const struct xt_match *match,
-           const void *matchinfo,
-           int offset,
-           unsigned int protoff,
-           bool *hotdrop)
+icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const struct icmphdr *ic;
         struct icmphdr _icmph;
-        const struct ipt_icmp *icmpinfo = matchinfo;
+        const struct ipt_icmp *icmpinfo = par->matchinfo;
 
         /* Must not be a fragment. */
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph);
+        ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
         if (ic == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("Dropping evil ICMP tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -2155,15 +2160,9 @@ icmp_match(const struct sk_buff *skb,
                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-icmp_checkentry(const char *tablename,
-           const void *entry,
-           const struct xt_match *match,
-           void *matchinfo,
-           unsigned int hook_mask)
+static bool icmp_checkentry(const struct xt_mtchk_param *par)
 {
-        const struct ipt_icmp *icmpinfo = matchinfo;
+        const struct ipt_icmp *icmpinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         return !(icmpinfo->invflags & ~IPT_ICMP_INV);
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index fafe8ebb4c55..7ac1677419a9 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -281,11 +281,9 @@ clusterip_responsible(const struct clusterip_config *config, u_int32_t hash)
  ***********************************************************************/
 
 static unsigned int
-clusterip_tg(struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, unsigned int hooknum,
-             const struct xt_target *target, const void *targinfo)
+clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ipt_clusterip_tgt_info *cipinfo = targinfo;
+        const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         u_int32_t hash;
@@ -349,13 +347,10 @@ clusterip_tg(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-clusterip_tg_check(const char *tablename, const void *e_void,
-                   const struct xt_target *target, void *targinfo,
-                   unsigned int hook_mask)
+static bool clusterip_tg_check(const struct xt_tgchk_param *par)
 {
-        struct ipt_clusterip_tgt_info *cipinfo = targinfo;
-        const struct ipt_entry *e = e_void;
+        struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
+        const struct ipt_entry *e = par->entryinfo;
 
         struct clusterip_config *config;
 
@@ -406,9 +401,9 @@ clusterip_tg_check(const char *tablename, const void *e_void,
         }
         cipinfo->config = config;
 
-        if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", target->family);
+                                    "proto=%u\n", par->target->family);
                 return false;
         }
 
@@ -416,9 +411,9 @@ clusterip_tg_check(const char *tablename, const void *e_void,
 }
 
 /* drop reference count of cluster config when rule is deleted */
-static void clusterip_tg_destroy(const struct xt_target *target, void *targinfo)
+static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
 {
-        const struct ipt_clusterip_tgt_info *cipinfo = targinfo;
+        const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
 
         /* if no more entries are referencing the config, remove it
          * from the list and destroy the proc entry */
@@ -426,7 +421,7 @@ static void clusterip_tg_destroy(const struct xt_target *target, void *targinfo)
 
         clusterip_config_put(cipinfo->config);
 
-        nf_ct_l3proto_module_put(target->family);
+        nf_ct_l3proto_module_put(par->target->family);
 }
 
 #ifdef CONFIG_COMPAT
@@ -445,7 +440,7 @@ struct compat_ipt_clusterip_tgt_info
 
 static struct xt_target clusterip_tg_reg __read_mostly = {
         .name           = "CLUSTERIP",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = clusterip_tg,
         .checkentry     = clusterip_tg_check,
         .destroy        = clusterip_tg_destroy,
@@ -546,7 +541,7 @@ arp_mangle(unsigned int hook,
 
 static struct nf_hook_ops cip_arp_ops __read_mostly = {
         .hook = arp_mangle,
-        .pf = NF_ARP,
+        .pf = NFPROTO_ARP,
         .hooknum = NF_ARP_OUT,
         .priority = -1
 };
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index d60139c134ca..f7e2fa0974dc 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -77,11 +77,9 @@ set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
 }
 
 static unsigned int
-ecn_tg(struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, unsigned int hooknum,
-       const struct xt_target *target, const void *targinfo)
+ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ipt_ECN_info *einfo = targinfo;
+        const struct ipt_ECN_info *einfo = par->targinfo;
 
         if (einfo->operation & IPT_ECN_OP_SET_IP)
                 if (!set_ect_ip(skb, einfo))
@@ -95,13 +93,10 @@ ecn_tg(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-ecn_tg_check(const char *tablename, const void *e_void,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool ecn_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ipt_ECN_info *einfo = targinfo;
-        const struct ipt_entry *e = e_void;
+        const struct ipt_ECN_info *einfo = par->targinfo;
+        const struct ipt_entry *e = par->entryinfo;
 
         if (einfo->operation & IPT_ECN_OP_MASK) {
                 printk(KERN_WARNING "ECN: unsupported ECN operation %x\n",
@@ -124,7 +119,7 @@ ecn_tg_check(const char *tablename, const void *e_void,
 
 static struct xt_target ecn_tg_reg __read_mostly = {
         .name           = "ECN",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = ecn_tg,
         .targetsize     = sizeof(struct ipt_ECN_info),
         .table          = "mangle",
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 0af14137137b..fc6ce04a3e35 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -375,7 +375,7 @@ static struct nf_loginfo default_loginfo = {
 };
 
 static void
-ipt_log_packet(unsigned int pf,
+ipt_log_packet(u_int8_t pf,
                unsigned int hooknum,
                const struct sk_buff *skb,
                const struct net_device *in,
@@ -426,28 +426,23 @@ ipt_log_packet(unsigned int pf,
 }
 
 static unsigned int
-log_tg(struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, unsigned int hooknum,
-       const struct xt_target *target, const void *targinfo)
+log_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ipt_log_info *loginfo = targinfo;
+        const struct ipt_log_info *loginfo = par->targinfo;
         struct nf_loginfo li;
 
         li.type = NF_LOG_TYPE_LOG;
         li.u.log.level = loginfo->level;
         li.u.log.logflags = loginfo->logflags;
 
-        ipt_log_packet(PF_INET, hooknum, skb, in, out, &li,
+        ipt_log_packet(NFPROTO_IPV4, par->hooknum, skb, par->in, par->out, &li,
                        loginfo->prefix);
         return XT_CONTINUE;
 }
 
-static bool
-log_tg_check(const char *tablename, const void *e,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool log_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ipt_log_info *loginfo = targinfo;
+        const struct ipt_log_info *loginfo = par->targinfo;
 
         if (loginfo->level >= 8) {
                 pr_debug("LOG: level %u >= 8\n", loginfo->level);
@@ -463,7 +458,7 @@ log_tg_check(const char *tablename, const void *e,
 
 static struct xt_target log_tg_reg __read_mostly = {
         .name           = "LOG",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = log_tg,
         .targetsize     = sizeof(struct ipt_log_info),
         .checkentry     = log_tg_check,
@@ -483,7 +478,7 @@ static int __init log_tg_init(void)
         ret = xt_register_target(&log_tg_reg);
         if (ret < 0)
                 return ret;
-        nf_log_register(PF_INET, &ipt_log_logger);
+        nf_log_register(NFPROTO_IPV4, &ipt_log_logger);
         return 0;
 }
 
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 0841aefaa503..f389f60cb105 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -31,12 +31,9 @@ MODULE_DESCRIPTION("Xtables: automatic-address SNAT");
 static DEFINE_RWLOCK(masq_lock);
 
 /* FIXME: Multiple targets. --RR */
-static bool
-masquerade_tg_check(const char *tablename, const void *e,
-                    const struct xt_target *target, void *targinfo,
-                    unsigned int hook_mask)
+static bool masquerade_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
                 pr_debug("masquerade_check: bad MAP_IPS.\n");
@@ -50,9 +47,7 @@ masquerade_tg_check(const char *tablename, const void *e,
 }
 
 static unsigned int
-masquerade_tg(struct sk_buff *skb, const struct net_device *in,
-              const struct net_device *out, unsigned int hooknum,
-              const struct xt_target *target, const void *targinfo)
+masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct nf_conn *ct;
         struct nf_conn_nat *nat;
@@ -62,7 +57,7 @@ masquerade_tg(struct sk_buff *skb, const struct net_device *in,
         const struct rtable *rt;
         __be32 newsrc;
 
-        NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
+        NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
 
         ct = nf_ct_get(skb, &ctinfo);
         nat = nfct_nat(ct);
@@ -76,16 +71,16 @@ masquerade_tg(struct sk_buff *skb, const struct net_device *in,
         if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
                 return NF_ACCEPT;
 
-        mr = targinfo;
+        mr = par->targinfo;
         rt = skb->rtable;
-        newsrc = inet_select_addr(out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
+        newsrc = inet_select_addr(par->out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
         if (!newsrc) {
-                printk("MASQUERADE: %s ate my IP address\n", out->name);
+                printk("MASQUERADE: %s ate my IP address\n", par->out->name);
                 return NF_DROP;
         }
 
         write_lock_bh(&masq_lock);
-        nat->masq_index = out->ifindex;
+        nat->masq_index = par->out->ifindex;
         write_unlock_bh(&masq_lock);
 
         /* Transfer from original range. */
@@ -119,9 +114,7 @@ static int masq_device_event(struct notifier_block *this,
                              void *ptr)
 {
         const struct net_device *dev = ptr;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
+        struct net *net = dev_net(dev);
 
         if (event == NETDEV_DOWN) {
                 /* Device was downed.  Search entire table for
@@ -129,7 +122,8 @@ static int masq_device_event(struct notifier_block *this,
                    and forget them. */
                 NF_CT_ASSERT(dev->ifindex != 0);
 
-                nf_ct_iterate_cleanup(device_cmp, (void *)(long)dev->ifindex);
+                nf_ct_iterate_cleanup(net, device_cmp,
+                                      (void *)(long)dev->ifindex);
         }
 
         return NOTIFY_DONE;
@@ -153,7 +147,7 @@ static struct notifier_block masq_inet_notifier = {
 
 static struct xt_target masquerade_tg_reg __read_mostly = {
         .name           = "MASQUERADE",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = masquerade_tg,
         .targetsize     = sizeof(struct nf_nat_multi_range_compat),
         .table          = "nat",
diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index 6739abfd1521..7c29582d4ec8 100644
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -22,12 +22,9 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Svenning Soerensen <svenning@post5.tele.dk>");
 MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of IPv4 subnets");
 
-static bool
-netmap_tg_check(const char *tablename, const void *e,
-                const struct xt_target *target, void *targinfo,
-                unsigned int hook_mask)
+static bool netmap_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
                 pr_debug("NETMAP:check: bad MAP_IPS.\n");
@@ -41,24 +38,23 @@ netmap_tg_check(const char *tablename, const void *e,
 }
 
 static unsigned int
-netmap_tg(struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, unsigned int hooknum,
-          const struct xt_target *target, const void *targinfo)
+netmap_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         __be32 new_ip, netmask;
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
         struct nf_nat_range newrange;
 
-        NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING
-                     || hooknum == NF_INET_POST_ROUTING
-                     || hooknum == NF_INET_LOCAL_OUT);
+        NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
+                     par->hooknum == NF_INET_POST_ROUTING ||
+                     par->hooknum == NF_INET_LOCAL_OUT);
         ct = nf_ct_get(skb, &ctinfo);
 
         netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
 
-        if (hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_LOCAL_OUT)
+        if (par->hooknum == NF_INET_PRE_ROUTING ||
+            par->hooknum == NF_INET_LOCAL_OUT)
                 new_ip = ip_hdr(skb)->daddr & ~netmask;
         else
                 new_ip = ip_hdr(skb)->saddr & ~netmask;
@@ -70,12 +66,12 @@ netmap_tg(struct sk_buff *skb, const struct net_device *in,
                   mr->range[0].min, mr->range[0].max });
 
         /* Hand modified range to generic setup. */
-        return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(hooknum));
+        return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
 }
 
 static struct xt_target netmap_tg_reg __read_mostly = {
         .name           = "NETMAP",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = netmap_tg,
         .targetsize     = sizeof(struct nf_nat_multi_range_compat),
         .table          = "nat",
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 5c6292449d13..698e5e78685b 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -26,12 +26,9 @@ MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: Connection redirection to localhost");
 
 /* FIXME: Take multiple ranges --RR */
-static bool
-redirect_tg_check(const char *tablename, const void *e,
-                  const struct xt_target *target, void *targinfo,
-                  unsigned int hook_mask)
+static bool redirect_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
                 pr_debug("redirect_check: bad MAP_IPS.\n");
@@ -45,24 +42,22 @@ redirect_tg_check(const char *tablename, const void *e,
 }
 
 static unsigned int
-redirect_tg(struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, unsigned int hooknum,
-            const struct xt_target *target, const void *targinfo)
+redirect_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         __be32 newdst;
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
         struct nf_nat_range newrange;
 
-        NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING
-                     || hooknum == NF_INET_LOCAL_OUT);
+        NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
+                     par->hooknum == NF_INET_LOCAL_OUT);
 
         ct = nf_ct_get(skb, &ctinfo);
         NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
 
         /* Local packets: make them go to loopback */
-        if (hooknum == NF_INET_LOCAL_OUT)
+        if (par->hooknum == NF_INET_LOCAL_OUT)
                 newdst = htonl(0x7F000001);
         else {
                 struct in_device *indev;
@@ -92,7 +87,7 @@ redirect_tg(struct sk_buff *skb, const struct net_device *in,
 
 static struct xt_target redirect_tg_reg __read_mostly = {
         .name           = "REDIRECT",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = redirect_tg,
         .targetsize     = sizeof(struct nf_nat_multi_range_compat),
         .table          = "nat",
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 2639872849da..0b4b6e0ff2b9 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -136,11 +136,9 @@ static inline void send_unreach(struct sk_buff *skb_in, int code)
 }
 
 static unsigned int
-reject_tg(struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, unsigned int hooknum,
-          const struct xt_target *target, const void *targinfo)
+reject_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ipt_reject_info *reject = targinfo;
+        const struct ipt_reject_info *reject = par->targinfo;
 
         /* WARNING: This code causes reentry within iptables.
            This means that the iptables jump stack is now crap.  We
@@ -168,7 +166,7 @@ reject_tg(struct sk_buff *skb, const struct net_device *in,
                 send_unreach(skb, ICMP_PKT_FILTERED);
                 break;
         case IPT_TCP_RESET:
-                send_reset(skb, hooknum);
+                send_reset(skb, par->hooknum);
         case IPT_ICMP_ECHOREPLY:
                 /* Doesn't happen. */
                 break;
@@ -177,13 +175,10 @@ reject_tg(struct sk_buff *skb, const struct net_device *in,
         return NF_DROP;
 }
 
-static bool
-reject_tg_check(const char *tablename, const void *e_void,
-                const struct xt_target *target, void *targinfo,
-                unsigned int hook_mask)
+static bool reject_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ipt_reject_info *rejinfo = targinfo;
-        const struct ipt_entry *e = e_void;
+        const struct ipt_reject_info *rejinfo = par->targinfo;
+        const struct ipt_entry *e = par->entryinfo;
 
         if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
                 printk("ipt_REJECT: ECHOREPLY no longer supported.\n");
@@ -201,7 +196,7 @@ reject_tg_check(const char *tablename, const void *e_void,
 
 static struct xt_target reject_tg_reg __read_mostly = {
         .name           = "REJECT",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = reject_tg,
         .targetsize     = sizeof(struct ipt_reject_info),
         .table          = "filter",
diff --git a/net/ipv4/netfilter/ipt_TTL.c b/net/ipv4/netfilter/ipt_TTL.c
index 30eed65e7338..6d76aae90cc0 100644
--- a/net/ipv4/netfilter/ipt_TTL.c
+++ b/net/ipv4/netfilter/ipt_TTL.c
@@ -20,12 +20,10 @@ MODULE_DESCRIPTION("Xtables: IPv4 TTL field modification target");
 MODULE_LICENSE("GPL");
 
 static unsigned int
-ttl_tg(struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, unsigned int hooknum,
-       const struct xt_target *target, const void *targinfo)
+ttl_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct iphdr *iph;
-        const struct ipt_TTL_info *info = targinfo;
+        const struct ipt_TTL_info *info = par->targinfo;
         int new_ttl;
 
         if (!skb_make_writable(skb, skb->len))
@@ -61,12 +59,9 @@ ttl_tg(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-ttl_tg_check(const char *tablename, const void *e,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool ttl_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ipt_TTL_info *info = targinfo;
+        const struct ipt_TTL_info *info = par->targinfo;
 
         if (info->mode > IPT_TTL_MAXMODE) {
                 printk(KERN_WARNING "ipt_TTL: invalid or unknown Mode %u\n",
@@ -80,7 +75,7 @@ ttl_tg_check(const char *tablename, const void *e,
 
 static struct xt_target ttl_tg_reg __read_mostly = {
         .name           = "TTL",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = ttl_tg,
         .targetsize     = sizeof(struct ipt_TTL_info),
         .table          = "mangle",
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index b192756c6d0d..18a2826b57c6 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -281,18 +281,14 @@ alloc_failure:
 }
 
 static unsigned int
-ulog_tg(struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, unsigned int hooknum,
-        const struct xt_target *target, const void *targinfo)
+ulog_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
-
-        ipt_ulog_packet(hooknum, skb, in, out, loginfo, NULL);
-
+        ipt_ulog_packet(par->hooknum, skb, par->in, par->out,
+                        par->targinfo, NULL);
         return XT_CONTINUE;
 }
 
-static void ipt_logfn(unsigned int pf,
+static void ipt_logfn(u_int8_t pf,
                       unsigned int hooknum,
                       const struct sk_buff *skb,
                       const struct net_device *in,
@@ -317,12 +313,9 @@ static void ipt_logfn(unsigned int pf,
         ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
 }
 
-static bool
-ulog_tg_check(const char *tablename, const void *e,
-              const struct xt_target *target, void *targinfo,
-              unsigned int hookmask)
+static bool ulog_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct ipt_ulog_info *loginfo = targinfo;
+        const struct ipt_ulog_info *loginfo = par->targinfo;
 
         if (loginfo->prefix[sizeof(loginfo->prefix) - 1] != '\0') {
                 pr_debug("ipt_ULOG: prefix term %i\n",
@@ -374,7 +367,7 @@ static int ulog_tg_compat_to_user(void __user *dst, void *src)
 
 static struct xt_target ulog_tg_reg __read_mostly = {
         .name           = "ULOG",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .target         = ulog_tg,
         .targetsize     = sizeof(struct ipt_ulog_info),
         .checkentry     = ulog_tg_check,
@@ -419,7 +412,7 @@ static int __init ulog_tg_init(void)
                 return ret;
         }
         if (nflog)
-                nf_log_register(PF_INET, &ipt_ulog_logger);
+                nf_log_register(NFPROTO_IPV4, &ipt_ulog_logger);
 
         return 0;
 }
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 462a22c97877..88762f02779d 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -30,12 +30,9 @@ static inline bool match_type(const struct net_device *dev, __be32 addr,
 }
 
 static bool
-addrtype_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-               const struct net_device *out, const struct xt_match *match,
-               const void *matchinfo, int offset, unsigned int protoff,
-               bool *hotdrop)
+addrtype_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_addrtype_info *info = matchinfo;
+        const struct ipt_addrtype_info *info = par->matchinfo;
         const struct iphdr *iph = ip_hdr(skb);
         bool ret = true;
 
@@ -50,20 +47,17 @@ addrtype_mt_v0(const struct sk_buff *skb, const struct net_device *in,
 }
 
 static bool
-addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
-               const struct net_device *out, const struct xt_match *match,
-               const void *matchinfo, int offset, unsigned int protoff,
-               bool *hotdrop)
+addrtype_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_addrtype_info_v1 *info = matchinfo;
+        const struct ipt_addrtype_info_v1 *info = par->matchinfo;
         const struct iphdr *iph = ip_hdr(skb);
         const struct net_device *dev = NULL;
         bool ret = true;
 
         if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN)
-                dev = in;
+                dev = par->in;
         else if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT)
-                dev = out;
+                dev = par->out;
 
         if (info->source)
                 ret &= match_type(dev, iph->saddr, info->source) ^
@@ -74,12 +68,9 @@ addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
         return ret;
 }
 
-static bool
-addrtype_mt_checkentry_v1(const char *tablename, const void *ip_void,
-                          const struct xt_match *match, void *matchinfo,
-                          unsigned int hook_mask)
+static bool addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
 {
-        struct ipt_addrtype_info_v1 *info = matchinfo;
+        struct ipt_addrtype_info_v1 *info = par->matchinfo;
 
         if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN &&
             info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) {
@@ -88,14 +79,16 @@ addrtype_mt_checkentry_v1(const char *tablename, const void *ip_void,
                 return false;
         }
 
-        if (hook_mask & (1 << NF_INET_PRE_ROUTING | 1 << NF_INET_LOCAL_IN) &&
+        if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
+            (1 << NF_INET_LOCAL_IN)) &&
             info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) {
                 printk(KERN_ERR "ipt_addrtype: output interface limitation "
                                 "not valid in PRE_ROUTING and INPUT\n");
                 return false;
         }
 
-        if (hook_mask & (1 << NF_INET_POST_ROUTING | 1 << NF_INET_LOCAL_OUT) &&
+        if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
+            (1 << NF_INET_LOCAL_OUT)) &&
             info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN) {
                 printk(KERN_ERR "ipt_addrtype: input interface limitation "
                                 "not valid in POST_ROUTING and OUTPUT\n");
@@ -108,14 +101,14 @@ addrtype_mt_checkentry_v1(const char *tablename, const void *ip_void,
 static struct xt_match addrtype_mt_reg[] __read_mostly = {
         {
                 .name           = "addrtype",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = addrtype_mt_v0,
                 .matchsize      = sizeof(struct ipt_addrtype_info),
                 .me             = THIS_MODULE
         },
         {
                 .name           = "addrtype",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .revision       = 1,
                 .match          = addrtype_mt_v1,
                 .checkentry     = addrtype_mt_checkentry_v1,
diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c
index e977989629c7..0104c0b399de 100644
--- a/net/ipv4/netfilter/ipt_ah.c
+++ b/net/ipv4/netfilter/ipt_ah.c
@@ -36,27 +36,23 @@ spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
         return r;
 }
 
-static bool
-ah_mt(const struct sk_buff *skb, const struct net_device *in,
-      const struct net_device *out, const struct xt_match *match,
-      const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool ah_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct ip_auth_hdr _ahdr;
         const struct ip_auth_hdr *ah;
-        const struct ipt_ah *ahinfo = matchinfo;
+        const struct ipt_ah *ahinfo = par->matchinfo;
 
         /* Must not be a fragment. */
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        ah = skb_header_pointer(skb, protoff,
-                                sizeof(_ahdr), &_ahdr);
+        ah = skb_header_pointer(skb, par->thoff, sizeof(_ahdr), &_ahdr);
         if (ah == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("Dropping evil AH tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return 0;
         }
 
@@ -65,13 +61,9 @@ ah_mt(const struct sk_buff *skb, const struct net_device *in,
                          !!(ahinfo->invflags & IPT_AH_INV_SPI));
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-ah_mt_check(const char *tablename, const void *ip_void,
-            const struct xt_match *match, void *matchinfo,
-            unsigned int hook_mask)
+static bool ah_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ipt_ah *ahinfo = matchinfo;
+        const struct ipt_ah *ahinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         if (ahinfo->invflags & ~IPT_AH_INV_MASK) {
@@ -83,7 +75,7 @@ ah_mt_check(const char *tablename, const void *ip_void,
 
 static struct xt_match ah_mt_reg __read_mostly = {
         .name           = "ah",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .match          = ah_mt,
         .matchsize      = sizeof(struct ipt_ah),
         .proto          = IPPROTO_AH,
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index 749de8284ce5..6289b64144c6 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -67,12 +67,9 @@ static inline bool match_tcp(const struct sk_buff *skb,
         return true;
 }
 
-static bool
-ecn_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool ecn_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_ecn_info *info = matchinfo;
+        const struct ipt_ecn_info *info = par->matchinfo;
 
         if (info->operation & IPT_ECN_OP_MATCH_IP)
                 if (!match_ip(skb, info))
@@ -81,20 +78,17 @@ ecn_mt(const struct sk_buff *skb, const struct net_device *in,
         if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
                 if (ip_hdr(skb)->protocol != IPPROTO_TCP)
                         return false;
-                if (!match_tcp(skb, info, hotdrop))
+                if (!match_tcp(skb, info, par->hotdrop))
                         return false;
         }
 
         return true;
 }
 
-static bool
-ecn_mt_check(const char *tablename, const void *ip_void,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool ecn_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ipt_ecn_info *info = matchinfo;
-        const struct ipt_ip *ip = ip_void;
+        const struct ipt_ecn_info *info = par->matchinfo;
+        const struct ipt_ip *ip = par->entryinfo;
 
         if (info->operation & IPT_ECN_OP_MATCH_MASK)
                 return false;
@@ -114,7 +108,7 @@ ecn_mt_check(const char *tablename, const void *ip_void,
 
 static struct xt_match ecn_mt_reg __read_mostly = {
         .name           = "ecn",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .match          = ecn_mt,
         .matchsize      = sizeof(struct ipt_ecn_info),
         .checkentry     = ecn_mt_check,
diff --git a/net/ipv4/netfilter/ipt_ttl.c b/net/ipv4/netfilter/ipt_ttl.c
index e0b8caeb710c..297f1cbf4ff5 100644
--- a/net/ipv4/netfilter/ipt_ttl.c
+++ b/net/ipv4/netfilter/ipt_ttl.c
@@ -18,12 +18,9 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: IPv4 TTL field match");
 MODULE_LICENSE("GPL");
 
-static bool
-ttl_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool ttl_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_ttl_info *info = matchinfo;
+        const struct ipt_ttl_info *info = par->matchinfo;
         const u8 ttl = ip_hdr(skb)->ttl;
 
         switch (info->mode) {
@@ -46,7 +43,7 @@ ttl_mt(const struct sk_buff *skb, const struct net_device *in,
 
 static struct xt_match ttl_mt_reg __read_mostly = {
         .name           = "ttl",
-        .family         = AF_INET,
+        .family         = NFPROTO_IPV4,
         .match          = ttl_mt,
         .matchsize      = sizeof(struct ipt_ttl_info),
         .me             = THIS_MODULE,
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 1ea677dcf845..c9224310ebae 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -70,7 +70,7 @@ ipt_local_in_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_local_in_net(in, out)->ipv4.iptable_filter);
+                            dev_net(in)->ipv4.iptable_filter);
 }
 
 static unsigned int
@@ -81,7 +81,7 @@ ipt_hook(unsigned int hook,
          int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_forward_net(in, out)->ipv4.iptable_filter);
+                            dev_net(in)->ipv4.iptable_filter);
 }
 
 static unsigned int
@@ -101,7 +101,7 @@ ipt_local_out_hook(unsigned int hook,
         }
 
         return ipt_do_table(skb, hook, in, out,
-                            nf_local_out_net(in, out)->ipv4.iptable_filter);
+                            dev_net(out)->ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index da59182f2226..69f2c4287146 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -81,7 +81,7 @@ ipt_pre_routing_hook(unsigned int hook,
                      int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_pre_routing_net(in, out)->ipv4.iptable_mangle);
+                            dev_net(in)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -92,7 +92,7 @@ ipt_post_routing_hook(unsigned int hook,
                       int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_post_routing_net(in, out)->ipv4.iptable_mangle);
+                            dev_net(out)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -103,7 +103,7 @@ ipt_local_in_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_local_in_net(in, out)->ipv4.iptable_mangle);
+                            dev_net(in)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -114,7 +114,7 @@ ipt_forward_hook(unsigned int hook,
          int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_forward_net(in, out)->ipv4.iptable_mangle);
+                            dev_net(in)->ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -147,7 +147,7 @@ ipt_local_hook(unsigned int hook,
         tos = iph->tos;
 
         ret = ipt_do_table(skb, hook, in, out,
-                           nf_local_out_net(in, out)->ipv4.iptable_mangle);
+                           dev_net(out)->ipv4.iptable_mangle);
         /* Reroute for ANY change. */
         if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
                 iph = ip_hdr(skb);
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index fddce7754b72..8faebfe638f1 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -53,7 +53,7 @@ ipt_hook(unsigned int hook,
          int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_pre_routing_net(in, out)->ipv4.iptable_raw);
+                            dev_net(in)->ipv4.iptable_raw);
 }
 
 static unsigned int
@@ -72,7 +72,7 @@ ipt_local_hook(unsigned int hook,
                 return NF_ACCEPT;
         }
         return ipt_do_table(skb, hook, in, out,
-                            nf_local_out_net(in, out)->ipv4.iptable_raw);
+                            dev_net(out)->ipv4.iptable_raw);
 }
 
 /* 'raw' is the very first table. */
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index db6d312128e1..36f3be3cc428 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -73,7 +73,7 @@ ipt_local_in_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_local_in_net(in, out)->ipv4.iptable_security);
+                            dev_net(in)->ipv4.iptable_security);
 }
 
 static unsigned int
@@ -84,7 +84,7 @@ ipt_forward_hook(unsigned int hook,
                  int (*okfn)(struct sk_buff *))
 {
         return ipt_do_table(skb, hook, in, out,
-                            nf_forward_net(in, out)->ipv4.iptable_security);
+                            dev_net(in)->ipv4.iptable_security);
 }
 
 static unsigned int
@@ -103,7 +103,7 @@ ipt_local_out_hook(unsigned int hook,
                 return NF_ACCEPT;
         }
         return ipt_do_table(skb, hook, in, out,
-                            nf_local_out_net(in, out)->ipv4.iptable_security);
+                            dev_net(out)->ipv4.iptable_security);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5a955c440364..4a7c35275396 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -1,3 +1,4 @@
+
 /* (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
@@ -24,6 +25,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/nf_nat_helper.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 
 int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
                               struct nf_conn *ct,
@@ -63,23 +65,6 @@ static int ipv4_print_tuple(struct seq_file *s,
                           NIPQUAD(tuple->dst.u3.ip));
 }
 
-/* Returns new sk_buff, or NULL */
-static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
-{
-        int err;
-
-        skb_orphan(skb);
-
-        local_bh_disable();
-        err = ip_defrag(skb, user);
-        local_bh_enable();
-
-        if (!err)
-                ip_send_check(ip_hdr(skb));
-
-        return err;
-}
-
 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
                             unsigned int *dataoff, u_int8_t *protonum)
 {
@@ -144,35 +129,13 @@ out:
         return nf_conntrack_confirm(skb);
 }
 
-static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
-                                          struct sk_buff *skb,
-                                          const struct net_device *in,
-                                          const struct net_device *out,
-                                          int (*okfn)(struct sk_buff *))
-{
-        /* Previously seen (loopback)?  Ignore.  Do this before
-           fragment check. */
-        if (skb->nfct)
-                return NF_ACCEPT;
-
-        /* Gather fragments. */
-        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                if (nf_ct_ipv4_gather_frags(skb,
-                                            hooknum == NF_INET_PRE_ROUTING ?
-                                            IP_DEFRAG_CONNTRACK_IN :
-                                            IP_DEFRAG_CONNTRACK_OUT))
-                        return NF_STOLEN;
-        }
-        return NF_ACCEPT;
-}
-
 static unsigned int ipv4_conntrack_in(unsigned int hooknum,
                                       struct sk_buff *skb,
                                       const struct net_device *in,
                                       const struct net_device *out,
                                       int (*okfn)(struct sk_buff *))
 {
-        return nf_conntrack_in(PF_INET, hooknum, skb);
+        return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb);
 }
 
 static unsigned int ipv4_conntrack_local(unsigned int hooknum,
@@ -188,20 +151,13 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
                         printk("ipt_hook: happy cracking.\n");
                 return NF_ACCEPT;
         }
-        return nf_conntrack_in(PF_INET, hooknum, skb);
+        return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
 }
 
 /* Connection tracking may drop packets, but never alters them, so
    make it the first hook. */
 static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
         {
-                .hook           = ipv4_conntrack_defrag,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
-        },
-        {
                 .hook           = ipv4_conntrack_in,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
@@ -209,13 +165,6 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
                 .priority       = NF_IP_PRI_CONNTRACK,
         },
         {
-                .hook           = ipv4_conntrack_defrag,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
-        },
-        {
                 .hook           = ipv4_conntrack_local,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
@@ -254,7 +203,7 @@ static ctl_table ip_ct_sysctl_table[] = {
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_COUNT,
                 .procname       = "ip_conntrack_count",
-                .data           = &nf_conntrack_count,
+                .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
                 .proc_handler   = &proc_dointvec,
@@ -270,7 +219,7 @@ static ctl_table ip_ct_sysctl_table[] = {
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_CHECKSUM,
                 .procname       = "ip_conntrack_checksum",
-                .data           = &nf_conntrack_checksum,
+                .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
@@ -278,7 +227,7 @@ static ctl_table ip_ct_sysctl_table[] = {
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
                 .procname       = "ip_conntrack_log_invalid",
-                .data           = &nf_ct_log_invalid,
+                .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec_minmax,
@@ -323,7 +272,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                 return -EINVAL;
         }
 
-        h = nf_conntrack_find_get(&tuple);
+        h = nf_conntrack_find_get(sock_net(sk), &tuple);
         if (h) {
                 struct sockaddr_in sin;
                 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
@@ -422,6 +371,7 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
         int ret = 0;
 
         need_conntrack();
+        nf_defrag_ipv4_enable();
 
         ret = nf_register_sockopt(&so_getorigdst);
         if (ret < 0) {
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 3a020720e40b..313ebf00ee36 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -21,18 +21,20 @@
 #include <net/netfilter/nf_conntrack_acct.h>
 
 struct ct_iter_state {
+        struct seq_net_private p;
         unsigned int bucket;
 };
 
 static struct hlist_node *ct_get_first(struct seq_file *seq)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_iter_state *st = seq->private;
         struct hlist_node *n;
 
         for (st->bucket = 0;
              st->bucket < nf_conntrack_htable_size;
              st->bucket++) {
-                n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                n = rcu_dereference(net->ct.hash[st->bucket].first);
                 if (n)
                         return n;
         }
@@ -42,13 +44,14 @@ static struct hlist_node *ct_get_first(struct seq_file *seq)
 static struct hlist_node *ct_get_next(struct seq_file *seq,
                                       struct hlist_node *head)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_iter_state *st = seq->private;
 
         head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_conntrack_htable_size)
                         return NULL;
-                head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                head = rcu_dereference(net->ct.hash[st->bucket].first);
         }
         return head;
 }
@@ -158,8 +161,8 @@ static const struct seq_operations ct_seq_ops = {
 
 static int ct_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &ct_seq_ops,
-                        sizeof(struct ct_iter_state));
+        return seq_open_net(inode, file, &ct_seq_ops,
+                            sizeof(struct ct_iter_state));
 }
 
 static const struct file_operations ct_file_ops = {
@@ -167,21 +170,23 @@ static const struct file_operations ct_file_ops = {
         .open    = ct_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 
 /* expects */
 struct ct_expect_iter_state {
+        struct seq_net_private p;
         unsigned int bucket;
 };
 
 static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_expect_iter_state *st = seq->private;
         struct hlist_node *n;
 
         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
-                n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+                n = rcu_dereference(net->ct.expect_hash[st->bucket].first);
                 if (n)
                         return n;
         }
@@ -191,13 +196,14 @@ static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
                                              struct hlist_node *head)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_expect_iter_state *st = seq->private;
 
         head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_ct_expect_hsize)
                         return NULL;
-                head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+                head = rcu_dereference(net->ct.expect_hash[st->bucket].first);
         }
         return head;
 }
@@ -265,8 +271,8 @@ static const struct seq_operations exp_seq_ops = {
 
 static int exp_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &exp_seq_ops,
-                        sizeof(struct ct_expect_iter_state));
+        return seq_open_net(inode, file, &exp_seq_ops,
+                            sizeof(struct ct_expect_iter_state));
 }
 
 static const struct file_operations ip_exp_file_ops = {
@@ -274,11 +280,12 @@ static const struct file_operations ip_exp_file_ops = {
         .open    = exp_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 
 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 {
+        struct net *net = seq_file_net(seq);
         int cpu;
 
         if (*pos == 0)
@@ -288,7 +295,7 @@ static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
                 if (!cpu_possible(cpu))
                         continue;
                 *pos = cpu+1;
-                return &per_cpu(nf_conntrack_stat, cpu);
+                return per_cpu_ptr(net->ct.stat, cpu);
         }
 
         return NULL;
@@ -296,13 +303,14 @@ static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 
 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
+        struct net *net = seq_file_net(seq);
         int cpu;
 
         for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
                 if (!cpu_possible(cpu))
                         continue;
                 *pos = cpu+1;
-                return &per_cpu(nf_conntrack_stat, cpu);
+                return per_cpu_ptr(net->ct.stat, cpu);
         }
 
         return NULL;
@@ -314,7 +322,8 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 
 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 {
-        unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
+        struct net *net = seq_file_net(seq);
+        unsigned int nr_conntracks = atomic_read(&net->ct.count);
         const struct ip_conntrack_stat *st = v;
 
         if (v == SEQ_START_TOKEN) {
@@ -354,7 +363,8 @@ static const struct seq_operations ct_cpu_seq_ops = {
 
 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &ct_cpu_seq_ops);
+        return seq_open_net(inode, file, &ct_cpu_seq_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations ct_cpu_seq_fops = {
@@ -362,39 +372,54 @@ static const struct file_operations ct_cpu_seq_fops = {
         .open    = ct_cpu_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 
-int __init nf_conntrack_ipv4_compat_init(void)
+static int __net_init ip_conntrack_net_init(struct net *net)
 {
         struct proc_dir_entry *proc, *proc_exp, *proc_stat;
 
-        proc = proc_net_fops_create(&init_net, "ip_conntrack", 0440, &ct_file_ops);
+        proc = proc_net_fops_create(net, "ip_conntrack", 0440, &ct_file_ops);
         if (!proc)
                 goto err1;
 
-        proc_exp = proc_net_fops_create(&init_net, "ip_conntrack_expect", 0440,
+        proc_exp = proc_net_fops_create(net, "ip_conntrack_expect", 0440,
                                         &ip_exp_file_ops);
         if (!proc_exp)
                 goto err2;
 
         proc_stat = proc_create("ip_conntrack", S_IRUGO,
-                                init_net.proc_net_stat, &ct_cpu_seq_fops);
+                                net->proc_net_stat, &ct_cpu_seq_fops);
         if (!proc_stat)
                 goto err3;
         return 0;
 
 err3:
-        proc_net_remove(&init_net, "ip_conntrack_expect");
+        proc_net_remove(net, "ip_conntrack_expect");
 err2:
-        proc_net_remove(&init_net, "ip_conntrack");
+        proc_net_remove(net, "ip_conntrack");
 err1:
         return -ENOMEM;
 }
 
+static void __net_exit ip_conntrack_net_exit(struct net *net)
+{
+        remove_proc_entry("ip_conntrack", net->proc_net_stat);
+        proc_net_remove(net, "ip_conntrack_expect");
+        proc_net_remove(net, "ip_conntrack");
+}
+
+static struct pernet_operations ip_conntrack_net_ops = {
+        .init = ip_conntrack_net_init,
+        .exit = ip_conntrack_net_exit,
+};
+
+int __init nf_conntrack_ipv4_compat_init(void)
+{
+        return register_pernet_subsys(&ip_conntrack_net_ops);
+}
+
 void __exit nf_conntrack_ipv4_compat_fini(void)
 {
-        remove_proc_entry("ip_conntrack", init_net.proc_net_stat);
-        proc_net_remove(&init_net, "ip_conntrack_expect");
-        proc_net_remove(&init_net, "ip_conntrack");
+        unregister_pernet_subsys(&ip_conntrack_net_ops);
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 97791048fa9b..4e8879220222 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -79,7 +79,7 @@ static int icmp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
-                       int pf,
+                       u_int8_t pf,
                        unsigned int hooknum)
 {
         /* Try to delete connection immediately after all replies:
@@ -91,7 +91,7 @@ static int icmp_packet(struct nf_conn *ct,
                         nf_ct_kill_acct(ct, ctinfo, skb);
         } else {
                 atomic_inc(&ct->proto.icmp.count);
-                nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
+                nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, ct);
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmp_timeout);
         }
 
@@ -123,7 +123,7 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
 
 /* Returns conntrack if it dealt with ICMP, and filled in skb fields */
 static int
-icmp_error_message(struct sk_buff *skb,
+icmp_error_message(struct net *net, struct sk_buff *skb,
                  enum ip_conntrack_info *ctinfo,
                  unsigned int hooknum)
 {
@@ -155,7 +155,7 @@ icmp_error_message(struct sk_buff *skb,
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(&innertuple);
+        h = nf_conntrack_find_get(net, &innertuple);
         if (!h) {
                 pr_debug("icmp_error_message: no match\n");
                 return -NF_ACCEPT;
@@ -172,8 +172,8 @@ icmp_error_message(struct sk_buff *skb,
 
 /* Small and modified version of icmp_rcv */
 static int
-icmp_error(struct sk_buff *skb, unsigned int dataoff,
-           enum ip_conntrack_info *ctinfo, int pf, unsigned int hooknum)
+icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
+           enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
 {
         const struct icmphdr *icmph;
         struct icmphdr _ih;
@@ -181,16 +181,16 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff,
         /* Not enough header? */
         icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
         if (icmph == NULL) {
-                if (LOG_INVALID(IPPROTO_ICMP))
+                if (LOG_INVALID(net, IPPROTO_ICMP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_icmp: short packet ");
                 return -NF_ACCEPT;
         }
 
         /* See ip_conntrack_proto_tcp.c */
-        if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip_checksum(skb, hooknum, dataoff, 0)) {
-                if (LOG_INVALID(IPPROTO_ICMP))
+                if (LOG_INVALID(net, IPPROTO_ICMP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_icmp: bad HW ICMP checksum ");
                 return -NF_ACCEPT;
@@ -203,7 +203,7 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff,
          *                discarded.
          */
         if (icmph->type > NR_ICMP_TYPES) {
-                if (LOG_INVALID(IPPROTO_ICMP))
+                if (LOG_INVALID(net, IPPROTO_ICMP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_icmp: invalid ICMP type ");
                 return -NF_ACCEPT;
@@ -217,7 +217,7 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff,
             && icmph->type != ICMP_REDIRECT)
                 return NF_ACCEPT;
 
-        return icmp_error_message(skb, ctinfo, hooknum);
+        return icmp_error_message(net, skb, ctinfo, hooknum);
 }
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
new file mode 100644
index 000000000000..aa2c50a180f7
--- /dev/null
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -0,0 +1,96 @@
+/* (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/netfilter.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <net/route.h>
+#include <net/ip.h>
+
+#include <linux/netfilter_ipv4.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+
+/* Returns new sk_buff, or NULL */
+static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
+{
+        int err;
+
+        skb_orphan(skb);
+
+        local_bh_disable();
+        err = ip_defrag(skb, user);
+        local_bh_enable();
+
+        if (!err)
+                ip_send_check(ip_hdr(skb));
+
+        return err;
+}
+
+static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
+                                          struct sk_buff *skb,
+                                          const struct net_device *in,
+                                          const struct net_device *out,
+                                          int (*okfn)(struct sk_buff *))
+{
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        /* Previously seen (loopback)?  Ignore.  Do this before
+           fragment check. */
+        if (skb->nfct)
+                return NF_ACCEPT;
+#endif
+
+        /* Gather fragments. */
+        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
+                if (nf_ct_ipv4_gather_frags(skb,
+                                            hooknum == NF_INET_PRE_ROUTING ?
+                                            IP_DEFRAG_CONNTRACK_IN :
+                                            IP_DEFRAG_CONNTRACK_OUT))
+                        return NF_STOLEN;
+        }
+        return NF_ACCEPT;
+}
+
+static struct nf_hook_ops ipv4_defrag_ops[] = {
+        {
+                .hook           = ipv4_conntrack_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_INET_PRE_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ipv4_conntrack_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_INET_LOCAL_OUT,
+                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
+        },
+};
+
+static int __init nf_defrag_init(void)
+{
+        return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
+}
+
+static void __exit nf_defrag_fini(void)
+{
+        nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
+}
+
+void nf_defrag_ipv4_enable(void)
+{
+}
+EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);
+
+module_init(nf_defrag_init);
+module_exit(nf_defrag_fini);
+
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 6c6a3cba8d50..2ac9eaf1a8c9 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -37,9 +37,6 @@ static struct nf_conntrack_l3proto *l3proto __read_mostly;
 
 /* Calculated at init based on memory size */
 static unsigned int nf_nat_htable_size __read_mostly;
-static int nf_nat_vmalloced;
-
-static struct hlist_head *bysource __read_mostly;
 
 #define MAX_IP_NAT_PROTO 256
 static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
@@ -145,7 +142,8 @@ same_src(const struct nf_conn *ct,
 
 /* Only called for SRC manip */
 static int
-find_appropriate_src(const struct nf_conntrack_tuple *tuple,
+find_appropriate_src(struct net *net,
+                     const struct nf_conntrack_tuple *tuple,
                      struct nf_conntrack_tuple *result,
                      const struct nf_nat_range *range)
 {
@@ -155,7 +153,7 @@ find_appropriate_src(const struct nf_conntrack_tuple *tuple,
         const struct hlist_node *n;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(nat, n, &bysource[h], bysource) {
+        hlist_for_each_entry_rcu(nat, n, &net->ipv4.nat_bysource[h], bysource) {
                 ct = nat->ct;
                 if (same_src(ct, tuple)) {
                         /* Copy source part from reply tuple. */
@@ -231,6 +229,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
                  struct nf_conn *ct,
                  enum nf_nat_manip_type maniptype)
 {
+        struct net *net = nf_ct_net(ct);
         const struct nf_nat_protocol *proto;
 
         /* 1) If this srcip/proto/src-proto-part is currently mapped,
@@ -242,7 +241,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
            manips not an issue.  */
         if (maniptype == IP_NAT_MANIP_SRC &&
             !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
-                if (find_appropriate_src(orig_tuple, tuple, range)) {
+                if (find_appropriate_src(net, orig_tuple, tuple, range)) {
                         pr_debug("get_unique_tuple: Found current src map\n");
                         if (!nf_nat_used_tuple(tuple, ct))
                                 return;
@@ -283,6 +282,7 @@ nf_nat_setup_info(struct nf_conn *ct,
                   const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_tuple curr_tuple, new_tuple;
         struct nf_conn_nat *nat;
         int have_to_hash = !(ct->status & IPS_NAT_DONE_MASK);
@@ -334,7 +334,8 @@ nf_nat_setup_info(struct nf_conn *ct,
                 /* nf_conntrack_alter_reply might re-allocate exntension aera */
                 nat = nfct_nat(ct);
                 nat->ct = ct;
-                hlist_add_head_rcu(&nat->bysource, &bysource[srchash]);
+                hlist_add_head_rcu(&nat->bysource,
+                                   &net->ipv4.nat_bysource[srchash]);
                 spin_unlock_bh(&nf_nat_lock);
         }
 
@@ -583,6 +584,40 @@ static struct nf_ct_ext_type nat_extend __read_mostly = {
         .flags          = NF_CT_EXT_F_PREALLOC,
 };
 
+static int __net_init nf_nat_net_init(struct net *net)
+{
+        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
+                                                      &net->ipv4.nat_vmalloced);
+        if (!net->ipv4.nat_bysource)
+                return -ENOMEM;
+        return 0;
+}
+
+/* Clear NAT section of all conntracks, in case we're loaded again. */
+static int clean_nat(struct nf_conn *i, void *data)
+{
+        struct nf_conn_nat *nat = nfct_nat(i);
+
+        if (!nat)
+                return 0;
+        memset(nat, 0, sizeof(*nat));
+        i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK | IPS_SEQ_ADJUST);
+        return 0;
+}
+
+static void __net_exit nf_nat_net_exit(struct net *net)
+{
+        nf_ct_iterate_cleanup(net, &clean_nat, NULL);
+        synchronize_rcu();
+        nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
+                             nf_nat_htable_size);
+}
+
+static struct pernet_operations nf_nat_net_ops = {
+        .init = nf_nat_net_init,
+        .exit = nf_nat_net_exit,
+};
+
 static int __init nf_nat_init(void)
 {
         size_t i;
@@ -599,12 +634,9 @@ static int __init nf_nat_init(void)
         /* Leave them the same for the moment. */
         nf_nat_htable_size = nf_conntrack_htable_size;
 
-        bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
-                                         &nf_nat_vmalloced);
-        if (!bysource) {
-                ret = -ENOMEM;
+        ret = register_pernet_subsys(&nf_nat_net_ops);
+        if (ret < 0)
                 goto cleanup_extend;
-        }
 
         /* Sew in builtin protocols. */
         spin_lock_bh(&nf_nat_lock);
@@ -629,23 +661,9 @@ static int __init nf_nat_init(void)
         return ret;
 }
 
-/* Clear NAT section of all conntracks, in case we're loaded again. */
-static int clean_nat(struct nf_conn *i, void *data)
-{
-        struct nf_conn_nat *nat = nfct_nat(i);
-
-        if (!nat)
-                return 0;
-        memset(nat, 0, sizeof(*nat));
-        i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK | IPS_SEQ_ADJUST);
-        return 0;
-}
-
 static void __exit nf_nat_cleanup(void)
 {
-        nf_ct_iterate_cleanup(&clean_nat, NULL);
-        synchronize_rcu();
-        nf_ct_free_hashtable(bysource, nf_nat_vmalloced, nf_nat_htable_size);
+        unregister_pernet_subsys(&nf_nat_net_ops);
         nf_ct_l3proto_put(l3proto);
         nf_ct_extend_unregister(&nat_extend);
         rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 112dcfa12900..cf7a42bf9820 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -193,7 +193,7 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                 nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
                                         ct, CTINFO2DIR(ctinfo));
 
-                nf_conntrack_event_cache(IPCT_NATSEQADJ, skb);
+                nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
         }
         return 1;
 }
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index da3d91a5ef5c..9eb171056c63 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -40,6 +40,7 @@ MODULE_ALIAS("ip_nat_pptp");
 static void pptp_nat_expected(struct nf_conn *ct,
                               struct nf_conntrack_expect *exp)
 {
+        struct net *net = nf_ct_net(ct);
         const struct nf_conn *master = ct->master;
         struct nf_conntrack_expect *other_exp;
         struct nf_conntrack_tuple t;
@@ -73,7 +74,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
 
         pr_debug("trying to unexpect other dir: ");
         nf_ct_dump_tuple_ip(&t);
-        other_exp = nf_ct_expect_find_get(&t);
+        other_exp = nf_ct_expect_find_get(net, &t);
         if (other_exp) {
                 nf_ct_unexpect_related(other_exp);
                 nf_ct_expect_put(other_exp);
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index e8b4d0d4439e..bea54a685109 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -33,7 +33,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[3];
         struct ipt_error term;
-} nat_initial_table __initdata = {
+} nat_initial_table __net_initdata = {
         .repl = {
                 .name = "nat",
                 .valid_hooks = NAT_VALID_HOOKS,
@@ -58,47 +58,42 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table __nat_table = {
+static struct xt_table nat_table = {
         .name           = "nat",
         .valid_hooks    = NAT_VALID_HOOKS,
         .lock           = __RW_LOCK_UNLOCKED(__nat_table.lock),
         .me             = THIS_MODULE,
         .af             = AF_INET,
 };
-static struct xt_table *nat_table;
 
 /* Source NAT */
-static unsigned int ipt_snat_target(struct sk_buff *skb,
-                                    const struct net_device *in,
-                                    const struct net_device *out,
-                                    unsigned int hooknum,
-                                    const struct xt_target *target,
-                                    const void *targinfo)
+static unsigned int
+ipt_snat_target(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
-        NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
+        NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
 
         ct = nf_ct_get(skb, &ctinfo);
 
         /* Connection must be valid and new. */
         NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
                             ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
-        NF_CT_ASSERT(out);
+        NF_CT_ASSERT(par->out != NULL);
 
         return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);
 }
 
 /* Before 2.6.11 we did implicit source NAT if required. Warn about change. */
-static void warn_if_extra_mangle(__be32 dstip, __be32 srcip)
+static void warn_if_extra_mangle(struct net *net, __be32 dstip, __be32 srcip)
 {
         static int warned = 0;
         struct flowi fl = { .nl_u = { .ip4_u = { .daddr = dstip } } };
         struct rtable *rt;
 
-        if (ip_route_output_key(&init_net, &rt, &fl) != 0)
+        if (ip_route_output_key(net, &rt, &fl) != 0)
                 return;
 
         if (rt->rt_src != srcip && !warned) {
@@ -110,40 +105,32 @@ static void warn_if_extra_mangle(__be32 dstip, __be32 srcip)
         ip_rt_put(rt);
 }
 
-static unsigned int ipt_dnat_target(struct sk_buff *skb,
-                                    const struct net_device *in,
-                                    const struct net_device *out,
-                                    unsigned int hooknum,
-                                    const struct xt_target *target,
-                                    const void *targinfo)
+static unsigned int
+ipt_dnat_target(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
-        NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||
-                     hooknum == NF_INET_LOCAL_OUT);
+        NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
+                     par->hooknum == NF_INET_LOCAL_OUT);
 
         ct = nf_ct_get(skb, &ctinfo);
 
         /* Connection must be valid and new. */
         NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
 
-        if (hooknum == NF_INET_LOCAL_OUT &&
+        if (par->hooknum == NF_INET_LOCAL_OUT &&
             mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)
-                warn_if_extra_mangle(ip_hdr(skb)->daddr,
+                warn_if_extra_mangle(dev_net(par->out), ip_hdr(skb)->daddr,
                                      mr->range[0].min_ip);
 
         return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
 }
 
-static bool ipt_snat_checkentry(const char *tablename,
-                                const void *entry,
-                                const struct xt_target *target,
-                                void *targinfo,
-                                unsigned int hook_mask)
+static bool ipt_snat_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         /* Must be a valid range */
         if (mr->rangesize != 1) {
@@ -153,13 +140,9 @@ static bool ipt_snat_checkentry(const char *tablename,
         return true;
 }
 
-static bool ipt_dnat_checkentry(const char *tablename,
-                                const void *entry,
-                                const struct xt_target *target,
-                                void *targinfo,
-                                unsigned int hook_mask)
+static bool ipt_dnat_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = targinfo;
+        const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         /* Must be a valid range */
         if (mr->rangesize != 1) {
@@ -194,9 +177,10 @@ int nf_nat_rule_find(struct sk_buff *skb,
                      const struct net_device *out,
                      struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         int ret;
 
-        ret = ipt_do_table(skb, hooknum, in, out, nat_table);
+        ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
 
         if (ret == NF_ACCEPT) {
                 if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
@@ -226,14 +210,32 @@ static struct xt_target ipt_dnat_reg __read_mostly = {
         .family         = AF_INET,
 };
 
+static int __net_init nf_nat_rule_net_init(struct net *net)
+{
+        net->ipv4.nat_table = ipt_register_table(net, &nat_table,
+                                                 &nat_initial_table.repl);
+        if (IS_ERR(net->ipv4.nat_table))
+                return PTR_ERR(net->ipv4.nat_table);
+        return 0;
+}
+
+static void __net_exit nf_nat_rule_net_exit(struct net *net)
+{
+        ipt_unregister_table(net->ipv4.nat_table);
+}
+
+static struct pernet_operations nf_nat_rule_net_ops = {
+        .init = nf_nat_rule_net_init,
+        .exit = nf_nat_rule_net_exit,
+};
+
 int __init nf_nat_rule_init(void)
 {
         int ret;
 
-        nat_table = ipt_register_table(&init_net, &__nat_table,
-                                       &nat_initial_table.repl);
-        if (IS_ERR(nat_table))
-                return PTR_ERR(nat_table);
+        ret = register_pernet_subsys(&nf_nat_rule_net_ops);
+        if (ret != 0)
+                goto out;
         ret = xt_register_target(&ipt_snat_reg);
         if (ret != 0)
                 goto unregister_table;
@@ -247,8 +249,8 @@ int __init nf_nat_rule_init(void)
  unregister_snat:
         xt_unregister_target(&ipt_snat_reg);
  unregister_table:
-        ipt_unregister_table(nat_table);
-
+        unregister_pernet_subsys(&nf_nat_rule_net_ops);
+ out:
         return ret;
 }
 
@@ -256,5 +258,5 @@ void nf_nat_rule_cleanup(void)
 {
         xt_unregister_target(&ipt_dnat_reg);
         xt_unregister_target(&ipt_snat_reg);
-        ipt_unregister_table(nat_table);
+        unregister_pernet_subsys(&nf_nat_rule_net_ops);
 }
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 8c6c5e71f210..4cb4844a3220 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -23,7 +23,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
                     .saddr = iph->saddr, } },
         };
 
-        dst = ip6_route_output(&init_net, skb->sk, &fl);
+        dst = ip6_route_output(dev_net(skb->dst->dev), skb->sk, &fl);
 
 #ifdef CONFIG_XFRM
         if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 0cfcce7b18d8..53ea512c4608 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -55,30 +55,29 @@ config IP6_NF_IPTABLES
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+if IP6_NF_IPTABLES
+
 # The simple matches.
-config IP6_NF_MATCH_RT
-        tristate '"rt" Routing header match support'
-        depends on IP6_NF_IPTABLES
+config IP6_NF_MATCH_AH
+        tristate '"ah" match support'
         depends on NETFILTER_ADVANCED
         help
-          rt matching allows you to match packets based on the routing
-          header of the packet.
+          This module allows one to match AH packets.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_OPTS
-        tristate '"hopbyhop" and "dst" opts header match support'
-        depends on IP6_NF_IPTABLES
+config IP6_NF_MATCH_EUI64
+        tristate '"eui64" address check'
         depends on NETFILTER_ADVANCED
         help
-          This allows one to match packets based on the hop-by-hop
-          and destination options headers of a packet.
+          This module performs checking on the IPv6 source address
+          Compares the last 64 bits with the EUI64 (delivered
+          from the MAC address) address
 
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP6_NF_MATCH_FRAG
         tristate '"frag" Fragmentation header match support'
-        depends on IP6_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           frag matching allows you to match packets based on the fragmentation
@@ -86,9 +85,17 @@ config IP6_NF_MATCH_FRAG
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_MATCH_OPTS
+        tristate '"hbh" hop-by-hop and "dst" opts header match support'
+        depends on NETFILTER_ADVANCED
+        help
+          This allows one to match packets based on the hop-by-hop
+          and destination options headers of a packet.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP6_NF_MATCH_HL
         tristate '"hl" match support'
-        depends on IP6_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           HL matching allows you to match packets based on the hop
@@ -98,7 +105,6 @@ config IP6_NF_MATCH_HL
 
 config IP6_NF_MATCH_IPV6HEADER
         tristate '"ipv6header" IPv6 Extension Headers Match'
-        depends on IP6_NF_IPTABLES
         default m if NETFILTER_ADVANCED=n
         help
           This module allows one to match packets based upon
@@ -106,54 +112,40 @@ config IP6_NF_MATCH_IPV6HEADER
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_AH
-        tristate '"ah" match support'
-        depends on IP6_NF_IPTABLES
-        depends on NETFILTER_ADVANCED
-        help
-          This module allows one to match AH packets.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP6_NF_MATCH_MH
         tristate '"mh" match support'
-        depends on IP6_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           This module allows one to match MH packets.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_EUI64
-        tristate '"eui64" address check'
-        depends on IP6_NF_IPTABLES
+config IP6_NF_MATCH_RT
+        tristate '"rt" Routing header match support'
         depends on NETFILTER_ADVANCED
         help
-          This module performs checking on the IPv6 source address
-          Compares the last 64 bits with the EUI64 (delivered
-          from the MAC address) address
+          rt matching allows you to match packets based on the routing
+          header of the packet.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
 # The targets
-config IP6_NF_FILTER
-        tristate "Packet filtering"
-        depends on IP6_NF_IPTABLES
+config IP6_NF_TARGET_LOG
+        tristate "LOG target support"
         default m if NETFILTER_ADVANCED=n
         help
-          Packet filtering defines a table `filter', which has a series of
-          rules for simple packet filtering at local input, forwarding and
-          local output.  See the man page for iptables(8).
+          This option adds a `LOG' target, which allows you to create rules in
+          any iptables table which records the packet header to the syslog.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_TARGET_LOG
-        tristate "LOG target support"
-        depends on IP6_NF_FILTER
+config IP6_NF_FILTER
+        tristate "Packet filtering"
         default m if NETFILTER_ADVANCED=n
         help
-          This option adds a `LOG' target, which allows you to create rules in
-          any iptables table which records the packet header to the syslog.
+          Packet filtering defines a table `filter', which has a series of
+          rules for simple packet filtering at local input, forwarding and
+          local output.  See the man page for iptables(8).
 
           To compile it as a module, choose M here.  If unsure, say N.
 
@@ -170,7 +162,6 @@ config IP6_NF_TARGET_REJECT
 
 config IP6_NF_MANGLE
         tristate "Packet mangling"
-        depends on IP6_NF_IPTABLES
         default m if NETFILTER_ADVANCED=n
         help
           This option adds a `mangle' table to iptables: see the man page for
@@ -198,7 +189,6 @@ config IP6_NF_TARGET_HL
 
 config IP6_NF_RAW
         tristate  'raw table support (required for TRACE)'
-        depends on IP6_NF_IPTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `raw' table to ip6tables. This table is the very
@@ -211,7 +201,6 @@ config IP6_NF_RAW
 # security table for MAC policy
 config IP6_NF_SECURITY
        tristate "Security table"
-       depends on IP6_NF_IPTABLES
        depends on SECURITY
        depends on NETFILTER_ADVANCED
        help
@@ -220,5 +209,7 @@ config IP6_NF_SECURITY
         
          If unsure, say N.
 
+endif # IP6_NF_IPTABLES
+
 endmenu
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 0b4557e03431..a33485dc81cb 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -200,32 +200,25 @@ ip6_checkentry(const struct ip6t_ip6 *ipv6)
 }
 
 static unsigned int
-ip6t_error(struct sk_buff *skb,
-          const struct net_device *in,
-          const struct net_device *out,
-          unsigned int hooknum,
-          const struct xt_target *target,
-          const void *targinfo)
+ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
         if (net_ratelimit())
-                printk("ip6_tables: error: `%s'\n", (char *)targinfo);
+                printk("ip6_tables: error: `%s'\n",
+                       (const char *)par->targinfo);
 
         return NF_DROP;
 }
 
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ip6t_entry_match *m,
-              const struct sk_buff *skb,
-              const struct net_device *in,
-              const struct net_device *out,
-              int offset,
-              unsigned int protoff,
-              bool *hotdrop)
+do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
+         struct xt_match_param *par)
 {
+        par->match     = m->u.kernel.match;
+        par->matchinfo = m->data;
+
         /* Stop iteration if it doesn't match */
-        if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
-                                      offset, protoff, hotdrop))
+        if (!m->u.kernel.match->match(skb, par))
                 return true;
         else
                 return false;
@@ -355,8 +348,6 @@ ip6t_do_table(struct sk_buff *skb,
               struct xt_table *table)
 {
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
-        int offset = 0;
-        unsigned int protoff = 0;
         bool hotdrop = false;
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
@@ -364,6 +355,8 @@ ip6t_do_table(struct sk_buff *skb,
         void *table_base;
         struct ip6t_entry *e, *back;
         struct xt_table_info *private;
+        struct xt_match_param mtpar;
+        struct xt_target_param tgpar;
 
         /* Initialization */
         indev = in ? in->name : nulldevname;
@@ -374,6 +367,11 @@ ip6t_do_table(struct sk_buff *skb,
          * things we don't know, ie. tcp syn flag or ports).  If the
          * rule is also a fragment-specific rule, non-fragments won't
          * match it. */
+        mtpar.hotdrop = &hotdrop;
+        mtpar.in      = tgpar.in  = in;
+        mtpar.out     = tgpar.out = out;
+        mtpar.family  = tgpar.family = NFPROTO_IPV6;
+        tgpar.hooknum = hook;
 
         read_lock_bh(&table->lock);
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
@@ -388,12 +386,10 @@ ip6t_do_table(struct sk_buff *skb,
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
                 if (ip6_packet_match(skb, indev, outdev, &e->ipv6,
-                        &protoff, &offset, &hotdrop)) {
+                        &mtpar.thoff, &mtpar.fragoff, &hotdrop)) {
                         struct ip6t_entry_target *t;
 
-                        if (IP6T_MATCH_ITERATE(e, do_match,
-                                               skb, in, out,
-                                               offset, protoff, &hotdrop) != 0)
+                        if (IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
                                 goto no_match;
 
                         ADD_COUNTER(e->counters,
@@ -441,15 +437,15 @@ ip6t_do_table(struct sk_buff *skb,
                         } else {
                                 /* Targets which reenter must return
                                    abs. verdicts */
+                                tgpar.target   = t->u.kernel.target;
+                                tgpar.targinfo = t->data;
+
 #ifdef CONFIG_NETFILTER_DEBUG
                                 ((struct ip6t_entry *)table_base)->comefrom
                                         = 0xeeeeeeec;
 #endif
                                 verdict = t->u.kernel.target->target(skb,
-                                                                     in, out,
-                                                                     hook,
-                                                                     t->u.kernel.target,
-                                                                     t->data);
+                                                                     &tgpar);
 
 #ifdef CONFIG_NETFILTER_DEBUG
                                 if (((struct ip6t_entry *)table_base)->comefrom
@@ -602,12 +598,17 @@ mark_source_chains(struct xt_table_info *newinfo,
 static int
 cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
 {
+        struct xt_mtdtor_param par;
+
         if (i && (*i)-- == 0)
                 return 1;
 
-        if (m->u.kernel.match->destroy)
-                m->u.kernel.match->destroy(m->u.kernel.match, m->data);
-        module_put(m->u.kernel.match->me);
+        par.match     = m->u.kernel.match;
+        par.matchinfo = m->data;
+        par.family    = NFPROTO_IPV6;
+        if (par.match->destroy != NULL)
+                par.match->destroy(&par);
+        module_put(par.match->me);
         return 0;
 }
 
@@ -632,34 +633,28 @@ check_entry(struct ip6t_entry *e, const char *name)
         return 0;
 }
 
-static int check_match(struct ip6t_entry_match *m, const char *name,
-                              const struct ip6t_ip6 *ipv6,
-                              unsigned int hookmask, unsigned int *i)
+static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
+                       unsigned int *i)
 {
-        struct xt_match *match;
+        const struct ip6t_ip6 *ipv6 = par->entryinfo;
         int ret;
 
-        match = m->u.kernel.match;
-        ret = xt_check_match(match, AF_INET6, m->u.match_size - sizeof(*m),
-                             name, hookmask, ipv6->proto,
-                             ipv6->invflags & IP6T_INV_PROTO);
-        if (!ret && m->u.kernel.match->checkentry
-            && !m->u.kernel.match->checkentry(name, ipv6, match, m->data,
-                                              hookmask)) {
+        par->match     = m->u.kernel.match;
+        par->matchinfo = m->data;
+
+        ret = xt_check_match(par, m->u.match_size - sizeof(*m),
+                             ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
+        if (ret < 0) {
                 duprintf("ip_tables: check failed for `%s'.\n",
-                         m->u.kernel.match->name);
-                ret = -EINVAL;
+                         par.match->name);
+                return ret;
         }
-        if (!ret)
-                (*i)++;
-        return ret;
+        ++*i;
+        return 0;
 }
 
 static int
-find_check_match(struct ip6t_entry_match *m,
-                 const char *name,
-                 const struct ip6t_ip6 *ipv6,
-                 unsigned int hookmask,
+find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
                  unsigned int *i)
 {
         struct xt_match *match;
@@ -674,7 +669,7 @@ find_check_match(struct ip6t_entry_match *m,
         }
         m->u.kernel.match = match;
 
-        ret = check_match(m, name, ipv6, hookmask, i);
+        ret = check_match(m, par, i);
         if (ret)
                 goto err;
 
@@ -686,23 +681,26 @@ err:
 
 static int check_target(struct ip6t_entry *e, const char *name)
 {
-        struct ip6t_entry_target *t;
-        struct xt_target *target;
+        struct ip6t_entry_target *t = ip6t_get_target(e);
+        struct xt_tgchk_param par = {
+                .table     = name,
+                .entryinfo = e,
+                .target    = t->u.kernel.target,
+                .targinfo  = t->data,
+                .hook_mask = e->comefrom,
+                .family    = NFPROTO_IPV6,
+        };
         int ret;
 
         t = ip6t_get_target(e);
-        target = t->u.kernel.target;
-        ret = xt_check_target(target, AF_INET6, t->u.target_size - sizeof(*t),
-                              name, e->comefrom, e->ipv6.proto,
-                              e->ipv6.invflags & IP6T_INV_PROTO);
-        if (!ret && t->u.kernel.target->checkentry
-            && !t->u.kernel.target->checkentry(name, e, target, t->data,
-                                               e->comefrom)) {
+        ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
+              e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
+        if (ret < 0) {
                 duprintf("ip_tables: check failed for `%s'.\n",
                          t->u.kernel.target->name);
-                ret = -EINVAL;
+                return ret;
         }
-        return ret;
+        return 0;
 }
 
 static int
@@ -713,14 +711,18 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
         struct xt_target *target;
         int ret;
         unsigned int j;
+        struct xt_mtchk_param mtpar;
 
         ret = check_entry(e, name);
         if (ret)
                 return ret;
 
         j = 0;
-        ret = IP6T_MATCH_ITERATE(e, find_check_match, name, &e->ipv6,
-                                 e->comefrom, &j);
+        mtpar.table     = name;
+        mtpar.entryinfo = &e->ipv6;
+        mtpar.hook_mask = e->comefrom;
+        mtpar.family    = NFPROTO_IPV6;
+        ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
         if (ret != 0)
                 goto cleanup_matches;
 
@@ -795,6 +797,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
 static int
 cleanup_entry(struct ip6t_entry *e, unsigned int *i)
 {
+        struct xt_tgdtor_param par;
         struct ip6t_entry_target *t;
 
         if (i && (*i)-- == 0)
@@ -803,9 +806,13 @@ cleanup_entry(struct ip6t_entry *e, unsigned int *i)
         /* Cleanup all matches */
         IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
         t = ip6t_get_target(e);
-        if (t->u.kernel.target->destroy)
-                t->u.kernel.target->destroy(t->u.kernel.target, t->data);
-        module_put(t->u.kernel.target->me);
+
+        par.target   = t->u.kernel.target;
+        par.targinfo = t->data;
+        par.family   = NFPROTO_IPV6;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
+        module_put(par.target->me);
         return 0;
 }
 
@@ -1677,10 +1684,14 @@ static int compat_check_entry(struct ip6t_entry *e, const char *name,
 {
         unsigned int j;
         int ret;
+        struct xt_mtchk_param mtpar;
 
         j = 0;
-        ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6,
-                                 e->comefrom, &j);
+        mtpar.table     = name;
+        mtpar.entryinfo = &e->ipv6;
+        mtpar.hook_mask = e->comefrom;
+        mtpar.family    = NFPROTO_IPV6;
+        ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
         if (ret)
                 goto cleanup_matches;
 
@@ -2146,30 +2157,23 @@ icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
 }
 
 static bool
-icmp6_match(const struct sk_buff *skb,
-           const struct net_device *in,
-           const struct net_device *out,
-           const struct xt_match *match,
-           const void *matchinfo,
-           int offset,
-           unsigned int protoff,
-           bool *hotdrop)
+icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const struct icmp6hdr *ic;
         struct icmp6hdr _icmph;
-        const struct ip6t_icmp *icmpinfo = matchinfo;
+        const struct ip6t_icmp *icmpinfo = par->matchinfo;
 
         /* Must not be a fragment. */
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph);
+        ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
         if (ic == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("Dropping evil ICMP tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -2181,14 +2185,9 @@ icmp6_match(const struct sk_buff *skb,
 }
 
 /* Called when user tries to insert an entry of this type. */
-static bool
-icmp6_checkentry(const char *tablename,
-           const void *entry,
-           const struct xt_match *match,
-           void *matchinfo,
-           unsigned int hook_mask)
+static bool icmp6_checkentry(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_icmp *icmpinfo = matchinfo;
+        const struct ip6t_icmp *icmpinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
diff --git a/net/ipv6/netfilter/ip6t_HL.c b/net/ipv6/netfilter/ip6t_HL.c
index d5f8fd5f29d3..27b5adf670a2 100644
--- a/net/ipv6/netfilter/ip6t_HL.c
+++ b/net/ipv6/netfilter/ip6t_HL.c
@@ -19,12 +19,10 @@ MODULE_DESCRIPTION("Xtables: IPv6 Hop Limit field modification target");
 MODULE_LICENSE("GPL");
 
 static unsigned int
-hl_tg6(struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, unsigned int hooknum,
-       const struct xt_target *target, const void *targinfo)
+hl_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct ipv6hdr *ip6h;
-        const struct ip6t_HL_info *info = targinfo;
+        const struct ip6t_HL_info *info = par->targinfo;
         int new_hl;
 
         if (!skb_make_writable(skb, skb->len))
@@ -56,12 +54,9 @@ hl_tg6(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-hl_tg6_check(const char *tablename, const void *entry,
-             const struct xt_target *target, void *targinfo,
-             unsigned int hook_mask)
+static bool hl_tg6_check(const struct xt_tgchk_param *par)
 {
-        const struct ip6t_HL_info *info = targinfo;
+        const struct ip6t_HL_info *info = par->targinfo;
 
         if (info->mode > IP6T_HL_MAXMODE) {
                 printk(KERN_WARNING "ip6t_HL: invalid or unknown Mode %u\n",
@@ -78,7 +73,7 @@ hl_tg6_check(const char *tablename, const void *entry,
 
 static struct xt_target hl_tg6_reg __read_mostly = {
         .name           = "HL",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .target         = hl_tg6,
         .targetsize     = sizeof(struct ip6t_HL_info),
         .table          = "mangle",
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 3a2316974f83..caa441d09567 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -385,7 +385,7 @@ static struct nf_loginfo default_loginfo = {
 };
 
 static void
-ip6t_log_packet(unsigned int pf,
+ip6t_log_packet(u_int8_t pf,
                 unsigned int hooknum,
                 const struct sk_buff *skb,
                 const struct net_device *in,
@@ -438,28 +438,24 @@ ip6t_log_packet(unsigned int pf,
 }
 
 static unsigned int
-log_tg6(struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, unsigned int hooknum,
-        const struct xt_target *target, const void *targinfo)
+log_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ip6t_log_info *loginfo = targinfo;
+        const struct ip6t_log_info *loginfo = par->targinfo;
         struct nf_loginfo li;
 
         li.type = NF_LOG_TYPE_LOG;
         li.u.log.level = loginfo->level;
         li.u.log.logflags = loginfo->logflags;
 
-        ip6t_log_packet(PF_INET6, hooknum, skb, in, out, &li, loginfo->prefix);
+        ip6t_log_packet(NFPROTO_IPV6, par->hooknum, skb, par->in, par->out,
+                        &li, loginfo->prefix);
         return XT_CONTINUE;
 }
 
 
-static bool
-log_tg6_check(const char *tablename, const void *entry,
-              const struct xt_target *target, void *targinfo,
-              unsigned int hook_mask)
+static bool log_tg6_check(const struct xt_tgchk_param *par)
 {
-        const struct ip6t_log_info *loginfo = targinfo;
+        const struct ip6t_log_info *loginfo = par->targinfo;
 
         if (loginfo->level >= 8) {
                 pr_debug("LOG: level %u >= 8\n", loginfo->level);
@@ -475,7 +471,7 @@ log_tg6_check(const char *tablename, const void *entry,
 
 static struct xt_target log_tg6_reg __read_mostly = {
         .name           = "LOG",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .target         = log_tg6,
         .targetsize     = sizeof(struct ip6t_log_info),
         .checkentry     = log_tg6_check,
@@ -495,7 +491,7 @@ static int __init log_tg6_init(void)
         ret = xt_register_target(&log_tg6_reg);
         if (ret < 0)
                 return ret;
-        nf_log_register(PF_INET6, &ip6t_logger);
+        nf_log_register(NFPROTO_IPV6, &ip6t_logger);
         return 0;
 }
 
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 44c8d65a2431..0981b4ccb8b1 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -35,7 +35,7 @@ MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
 MODULE_LICENSE("GPL");
 
 /* Send RST reply */
-static void send_reset(struct sk_buff *oldskb)
+static void send_reset(struct net *net, struct sk_buff *oldskb)
 {
         struct sk_buff *nskb;
         struct tcphdr otcph, *tcph;
@@ -94,7 +94,7 @@ static void send_reset(struct sk_buff *oldskb)
         fl.fl_ip_sport = otcph.dest;
         fl.fl_ip_dport = otcph.source;
         security_skb_classify_flow(oldskb, &fl);
-        dst = ip6_route_output(&init_net, NULL, &fl);
+        dst = ip6_route_output(net, NULL, &fl);
         if (dst == NULL)
                 return;
         if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
@@ -163,20 +163,20 @@ static void send_reset(struct sk_buff *oldskb)
 }
 
 static inline void
-send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum)
+send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
+             unsigned int hooknum)
 {
         if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
-                skb_in->dev = init_net.loopback_dev;
+                skb_in->dev = net->loopback_dev;
 
         icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
 }
 
 static unsigned int
-reject_tg6(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+reject_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ip6t_reject_info *reject = targinfo;
+        const struct ip6t_reject_info *reject = par->targinfo;
+        struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
 
         pr_debug("%s: medium point\n", __func__);
         /* WARNING: This code causes reentry within ip6tables.
@@ -184,25 +184,25 @@ reject_tg6(struct sk_buff *skb, const struct net_device *in,
            must return an absolute verdict. --RR */
         switch (reject->with) {
         case IP6T_ICMP6_NO_ROUTE:
-                send_unreach(skb, ICMPV6_NOROUTE, hooknum);
+                send_unreach(net, skb, ICMPV6_NOROUTE, par->hooknum);
                 break;
         case IP6T_ICMP6_ADM_PROHIBITED:
-                send_unreach(skb, ICMPV6_ADM_PROHIBITED, hooknum);
+                send_unreach(net, skb, ICMPV6_ADM_PROHIBITED, par->hooknum);
                 break;
         case IP6T_ICMP6_NOT_NEIGHBOUR:
-                send_unreach(skb, ICMPV6_NOT_NEIGHBOUR, hooknum);
+                send_unreach(net, skb, ICMPV6_NOT_NEIGHBOUR, par->hooknum);
                 break;
         case IP6T_ICMP6_ADDR_UNREACH:
-                send_unreach(skb, ICMPV6_ADDR_UNREACH, hooknum);
+                send_unreach(net, skb, ICMPV6_ADDR_UNREACH, par->hooknum);
                 break;
         case IP6T_ICMP6_PORT_UNREACH:
-                send_unreach(skb, ICMPV6_PORT_UNREACH, hooknum);
+                send_unreach(net, skb, ICMPV6_PORT_UNREACH, par->hooknum);
                 break;
         case IP6T_ICMP6_ECHOREPLY:
                 /* Do nothing */
                 break;
         case IP6T_TCP_RESET:
-                send_reset(skb);
+                send_reset(net, skb);
                 break;
         default:
                 if (net_ratelimit())
@@ -213,13 +213,10 @@ reject_tg6(struct sk_buff *skb, const struct net_device *in,
         return NF_DROP;
 }
 
-static bool
-reject_tg6_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool reject_tg6_check(const struct xt_tgchk_param *par)
 {
-        const struct ip6t_reject_info *rejinfo = targinfo;
-        const struct ip6t_entry *e = entry;
+        const struct ip6t_reject_info *rejinfo = par->targinfo;
+        const struct ip6t_entry *e = par->entryinfo;
 
         if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
                 printk("ip6t_REJECT: ECHOREPLY is not supported.\n");
@@ -237,7 +234,7 @@ reject_tg6_check(const char *tablename, const void *entry,
 
 static struct xt_target reject_tg6_reg __read_mostly = {
         .name           = "REJECT",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .target         = reject_tg6,
         .targetsize     = sizeof(struct ip6t_reject_info),
         .table          = "filter",
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 429629fd63b6..3a82f24746b9 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -36,14 +36,11 @@ spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
         return r;
 }
 
-static bool
-ah_mt6(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool ah_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct ip_auth_hdr _ah;
         const struct ip_auth_hdr *ah;
-        const struct ip6t_ah *ahinfo = matchinfo;
+        const struct ip6t_ah *ahinfo = par->matchinfo;
         unsigned int ptr;
         unsigned int hdrlen = 0;
         int err;
@@ -51,13 +48,13 @@ ah_mt6(const struct sk_buff *skb, const struct net_device *in,
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                 return false;
         }
 
         ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
         if (ah == NULL) {
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -93,13 +90,9 @@ ah_mt6(const struct sk_buff *skb, const struct net_device *in,
                !(ahinfo->hdrres && ah->reserved);
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-ah_mt6_check(const char *tablename, const void *entry,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool ah_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_ah *ahinfo = matchinfo;
+        const struct ip6t_ah *ahinfo = par->matchinfo;
 
         if (ahinfo->invflags & ~IP6T_AH_INV_MASK) {
                 pr_debug("ip6t_ah: unknown flags %X\n", ahinfo->invflags);
@@ -110,7 +103,7 @@ ah_mt6_check(const char *tablename, const void *entry,
 
 static struct xt_match ah_mt6_reg __read_mostly = {
         .name           = "ah",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .match          = ah_mt6,
         .matchsize      = sizeof(struct ip6t_ah),
         .checkentry     = ah_mt6_check,
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index 8f331f12b2ec..db610bacbcce 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -20,18 +20,15 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
 static bool
-eui64_mt6(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+eui64_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         unsigned char eui64[8];
         int i = 0;
 
         if (!(skb_mac_header(skb) >= skb->head &&
               skb_mac_header(skb) + ETH_HLEN <= skb->data) &&
-            offset != 0) {
-                *hotdrop = true;
+            par->fragoff != 0) {
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -60,7 +57,7 @@ eui64_mt6(const struct sk_buff *skb, const struct net_device *in,
 
 static struct xt_match eui64_mt6_reg __read_mostly = {
         .name           = "eui64",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .match          = eui64_mt6,
         .matchsize      = sizeof(int),
         .hooks          = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index e2bbc63dba5b..673aa0a5084e 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -35,27 +35,24 @@ id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 }
 
 static bool
-frag_mt6(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+frag_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct frag_hdr _frag;
         const struct frag_hdr *fh;
-        const struct ip6t_frag *fraginfo = matchinfo;
+        const struct ip6t_frag *fraginfo = par->matchinfo;
         unsigned int ptr;
         int err;
 
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                 return false;
         }
 
         fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
         if (fh == NULL) {
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -110,13 +107,9 @@ frag_mt6(const struct sk_buff *skb, const struct net_device *in,
                  && (ntohs(fh->frag_off) & IP6_MF));
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-frag_mt6_check(const char *tablename, const void *ip,
-               const struct xt_match *match, void *matchinfo,
-               unsigned int hook_mask)
+static bool frag_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_frag *fraginfo = matchinfo;
+        const struct ip6t_frag *fraginfo = par->matchinfo;
 
         if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
                 pr_debug("ip6t_frag: unknown flags %X\n", fraginfo->invflags);
@@ -127,7 +120,7 @@ frag_mt6_check(const char *tablename, const void *ip,
 
 static struct xt_match frag_mt6_reg __read_mostly = {
         .name           = "frag",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .match          = frag_mt6,
         .matchsize      = sizeof(struct ip6t_frag),
         .checkentry     = frag_mt6_check,
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 26654b26d7fa..cbe8dec9744b 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -42,14 +42,11 @@ MODULE_ALIAS("ip6t_dst");
  */
 
 static bool
-hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, const struct xt_match *match,
-        const void *matchinfo, int offset, unsigned int protoff,
-        bool *hotdrop)
+hbh_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct ipv6_opt_hdr _optsh;
         const struct ipv6_opt_hdr *oh;
-        const struct ip6t_opts *optinfo = matchinfo;
+        const struct ip6t_opts *optinfo = par->matchinfo;
         unsigned int temp;
         unsigned int ptr;
         unsigned int hdrlen = 0;
@@ -61,16 +58,16 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
         unsigned int optlen;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
+        err = ipv6_find_hdr(skb, &ptr, par->match->data, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                 return false;
         }
 
         oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
         if (oh == NULL) {
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -163,13 +160,9 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
         return false;
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-hbh_mt6_check(const char *tablename, const void *entry,
-              const struct xt_match *match, void *matchinfo,
-              unsigned int hook_mask)
+static bool hbh_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_opts *optsinfo = matchinfo;
+        const struct ip6t_opts *optsinfo = par->matchinfo;
 
         if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
                 pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
@@ -187,7 +180,7 @@ hbh_mt6_check(const char *tablename, const void *entry,
 static struct xt_match hbh_mt6_reg[] __read_mostly = {
         {
                 .name           = "hbh",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = hbh_mt6,
                 .matchsize      = sizeof(struct ip6t_opts),
                 .checkentry     = hbh_mt6_check,
@@ -196,7 +189,7 @@ static struct xt_match hbh_mt6_reg[] __read_mostly = {
         },
         {
                 .name           = "dst",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = hbh_mt6,
                 .matchsize      = sizeof(struct ip6t_opts),
                 .checkentry     = hbh_mt6_check,
diff --git a/net/ipv6/netfilter/ip6t_hl.c b/net/ipv6/netfilter/ip6t_hl.c
index 345671673845..c964dca1132d 100644
--- a/net/ipv6/netfilter/ip6t_hl.c
+++ b/net/ipv6/netfilter/ip6t_hl.c
@@ -19,12 +19,9 @@ MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
 MODULE_DESCRIPTION("Xtables: IPv6 Hop Limit field match");
 MODULE_LICENSE("GPL");
 
-static bool
-hl_mt6(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool hl_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ip6t_hl_info *info = matchinfo;
+        const struct ip6t_hl_info *info = par->matchinfo;
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 
         switch (info->mode) {
@@ -51,7 +48,7 @@ hl_mt6(const struct sk_buff *skb, const struct net_device *in,
 
 static struct xt_match hl_mt6_reg __read_mostly = {
         .name           = "hl",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .match          = hl_mt6,
         .matchsize      = sizeof(struct ip6t_hl_info),
         .me             = THIS_MODULE,
diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index 317a8960a757..14e6724d5672 100644
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -27,12 +27,9 @@ MODULE_DESCRIPTION("Xtables: IPv6 header types match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
 static bool
-ipv6header_mt6(const struct sk_buff *skb, const struct net_device *in,
-               const struct net_device *out, const struct xt_match *match,
-               const void *matchinfo, int offset, unsigned int protoff,
-               bool *hotdrop)
+ipv6header_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ip6t_ipv6header_info *info = matchinfo;
+        const struct ip6t_ipv6header_info *info = par->matchinfo;
         unsigned int temp;
         int len;
         u8 nexthdr;
@@ -121,12 +118,9 @@ ipv6header_mt6(const struct sk_buff *skb, const struct net_device *in,
         }
 }
 
-static bool
-ipv6header_mt6_check(const char *tablename, const void *ip,
-                     const struct xt_match *match, void *matchinfo,
-                     unsigned int hook_mask)
+static bool ipv6header_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_ipv6header_info *info = matchinfo;
+        const struct ip6t_ipv6header_info *info = par->matchinfo;
 
         /* invflags is 0 or 0xff in hard mode */
         if ((!info->modeflag) && info->invflags != 0x00 &&
@@ -138,7 +132,7 @@ ipv6header_mt6_check(const char *tablename, const void *ip,
 
 static struct xt_match ipv6header_mt6_reg __read_mostly = {
         .name           = "ipv6header",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .match          = ipv6header_mt6,
         .matchsize      = sizeof(struct ip6t_ipv6header_info),
         .checkentry     = ipv6header_mt6_check,
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index e06678d07ec8..aafe4e66577b 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -37,32 +37,29 @@ type_match(u_int8_t min, u_int8_t max, u_int8_t type, bool invert)
         return (type >= min && type <= max) ^ invert;
 }
 
-static bool
-mh_mt6(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool mh_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct ip6_mh _mh;
         const struct ip6_mh *mh;
-        const struct ip6t_mh *mhinfo = matchinfo;
+        const struct ip6t_mh *mhinfo = par->matchinfo;
 
         /* Must not be a fragment. */
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        mh = skb_header_pointer(skb, protoff, sizeof(_mh), &_mh);
+        mh = skb_header_pointer(skb, par->thoff, sizeof(_mh), &_mh);
         if (mh == NULL) {
                 /* We've been asked to examine this packet, and we
                    can't.  Hence, no choice but to drop. */
                 duprintf("Dropping evil MH tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 duprintf("Dropping invalid MH Payload Proto: %u\n",
                          mh->ip6mh_proto);
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -70,13 +67,9 @@ mh_mt6(const struct sk_buff *skb, const struct net_device *in,
                           !!(mhinfo->invflags & IP6T_MH_INV_TYPE));
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-mh_mt6_check(const char *tablename, const void *entry,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool mh_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_mh *mhinfo = matchinfo;
+        const struct ip6t_mh *mhinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         return !(mhinfo->invflags & ~IP6T_MH_INV_MASK);
@@ -84,7 +77,7 @@ mh_mt6_check(const char *tablename, const void *entry,
 
 static struct xt_match mh_mt6_reg __read_mostly = {
         .name           = "mh",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .checkentry     = mh_mt6_check,
         .match          = mh_mt6,
         .matchsize      = sizeof(struct ip6t_mh),
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 81aaf7aaaabf..356b8d6f6baa 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -36,14 +36,11 @@ segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
         return r;
 }
 
-static bool
-rt_mt6(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool rt_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct ipv6_rt_hdr _route;
         const struct ipv6_rt_hdr *rh;
-        const struct ip6t_rt *rtinfo = matchinfo;
+        const struct ip6t_rt *rtinfo = par->matchinfo;
         unsigned int temp;
         unsigned int ptr;
         unsigned int hdrlen = 0;
@@ -55,13 +52,13 @@ rt_mt6(const struct sk_buff *skb, const struct net_device *in,
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                 return false;
         }
 
         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
         if (rh == NULL) {
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -189,13 +186,9 @@ rt_mt6(const struct sk_buff *skb, const struct net_device *in,
         return false;
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-rt_mt6_check(const char *tablename, const void *entry,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool rt_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_rt *rtinfo = matchinfo;
+        const struct ip6t_rt *rtinfo = par->matchinfo;
 
         if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
                 pr_debug("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
@@ -214,7 +207,7 @@ rt_mt6_check(const char *tablename, const void *entry,
 
 static struct xt_match rt_mt6_reg __read_mostly = {
         .name           = "rt",
-        .family         = AF_INET6,
+        .family         = NFPROTO_IPV6,
         .match          = rt_mt6,
         .matchsize      = sizeof(struct ip6t_rt),
         .checkentry     = rt_mt6_check,
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 55a2c290bad4..b110a8a85a14 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -68,7 +68,7 @@ ip6t_local_in_hook(unsigned int hook,
                    int (*okfn)(struct sk_buff *))
 {
         return ip6t_do_table(skb, hook, in, out,
-                             nf_local_in_net(in, out)->ipv6.ip6table_filter);
+                             dev_net(in)->ipv6.ip6table_filter);
 }
 
 static unsigned int
@@ -79,7 +79,7 @@ ip6t_forward_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
         return ip6t_do_table(skb, hook, in, out,
-                             nf_forward_net(in, out)->ipv6.ip6table_filter);
+                             dev_net(in)->ipv6.ip6table_filter);
 }
 
 static unsigned int
@@ -100,7 +100,7 @@ ip6t_local_out_hook(unsigned int hook,
 #endif
 
         return ip6t_do_table(skb, hook, in, out,
-                             nf_local_out_net(in, out)->ipv6.ip6table_filter);
+                             dev_net(out)->ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index f405cea21a8b..d0b31b259d4d 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -67,17 +67,29 @@ static struct xt_table packet_mangler = {
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_route_hook(unsigned int hook,
+ip6t_in_hook(unsigned int hook,
          struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_mangle);
+        return ip6t_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv6.ip6table_mangle);
 }
 
 static unsigned int
-ip6t_local_hook(unsigned int hook,
+ip6t_post_routing_hook(unsigned int hook,
+                struct sk_buff *skb,
+                const struct net_device *in,
+                const struct net_device *out,
+                int (*okfn)(struct sk_buff *))
+{
+        return ip6t_do_table(skb, hook, in, out,
+                             dev_net(out)->ipv6.ip6table_mangle);
+}
+
+static unsigned int
+ip6t_local_out_hook(unsigned int hook,
                    struct sk_buff *skb,
                    const struct net_device *in,
                    const struct net_device *out,
@@ -108,7 +120,8 @@ ip6t_local_hook(unsigned int hook,
         /* flowlabel and prio (includes version, which shouldn't change either */
         flowlabel = *((u_int32_t *)ipv6_hdr(skb));
 
-        ret = ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_mangle);
+        ret = ip6t_do_table(skb, hook, in, out,
+                            dev_net(out)->ipv6.ip6table_mangle);
 
         if (ret != NF_DROP && ret != NF_STOLEN
                 && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
@@ -122,35 +135,35 @@ ip6t_local_hook(unsigned int hook,
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
-                .hook           = ip6t_route_hook,
+                .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
-                .hook           = ip6t_route_hook,
+                .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
-                .hook           = ip6t_route_hook,
+                .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
-                .hook           = ip6t_local_hook,
+                .hook           = ip6t_local_out_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
-                .hook           = ip6t_route_hook,
+                .hook           = ip6t_post_routing_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_POST_ROUTING,
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 92b91077ac29..109fab6f831a 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -45,25 +45,37 @@ static struct xt_table packet_raw = {
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_hook(unsigned int hook,
+ip6t_pre_routing_hook(unsigned int hook,
          struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_raw);
+        return ip6t_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv6.ip6table_raw);
+}
+
+static unsigned int
+ip6t_local_out_hook(unsigned int hook,
+         struct sk_buff *skb,
+         const struct net_device *in,
+         const struct net_device *out,
+         int (*okfn)(struct sk_buff *))
+{
+        return ip6t_do_table(skb, hook, in, out,
+                             dev_net(out)->ipv6.ip6table_raw);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
-          .hook = ip6t_hook,
+          .hook = ip6t_pre_routing_hook,
           .pf = PF_INET6,
           .hooknum = NF_INET_PRE_ROUTING,
           .priority = NF_IP6_PRI_FIRST,
           .owner = THIS_MODULE,
         },
         {
-          .hook = ip6t_hook,
+          .hook = ip6t_local_out_hook,
           .pf = PF_INET6,
           .hooknum = NF_INET_LOCAL_OUT,
           .priority = NF_IP6_PRI_FIRST,
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 6e7131036bc6..20bc52f13e43 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -72,7 +72,7 @@ ip6t_local_in_hook(unsigned int hook,
                    int (*okfn)(struct sk_buff *))
 {
         return ip6t_do_table(skb, hook, in, out,
-                             nf_local_in_net(in, out)->ipv6.ip6table_security);
+                             dev_net(in)->ipv6.ip6table_security);
 }
 
 static unsigned int
@@ -83,7 +83,7 @@ ip6t_forward_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
         return ip6t_do_table(skb, hook, in, out,
-                             nf_forward_net(in, out)->ipv6.ip6table_security);
+                             dev_net(in)->ipv6.ip6table_security);
 }
 
 static unsigned int
@@ -95,7 +95,7 @@ ip6t_local_out_hook(unsigned int hook,
 {
         /* TBD: handle short packets via raw socket */
         return ip6t_do_table(skb, hook, in, out,
-                             nf_local_out_net(in, out)->ipv6.ip6table_security);
+                             dev_net(out)->ipv6.ip6table_security);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 85050c072abd..e91db16611d9 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -211,11 +211,10 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
         return NF_STOLEN;
 }
 
-static unsigned int ipv6_conntrack_in(unsigned int hooknum,
-                                      struct sk_buff *skb,
-                                      const struct net_device *in,
-                                      const struct net_device *out,
-                                      int (*okfn)(struct sk_buff *))
+static unsigned int __ipv6_conntrack_in(struct net *net,
+                                        unsigned int hooknum,
+                                        struct sk_buff *skb,
+                                        int (*okfn)(struct sk_buff *))
 {
         struct sk_buff *reasm = skb->nfct_reasm;
 
@@ -225,7 +224,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                 if (!reasm->nfct) {
                         unsigned int ret;
 
-                        ret = nf_conntrack_in(PF_INET6, hooknum, reasm);
+                        ret = nf_conntrack_in(net, PF_INET6, hooknum, reasm);
                         if (ret != NF_ACCEPT)
                                 return ret;
                 }
@@ -235,7 +234,16 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                 return NF_ACCEPT;
         }
 
-        return nf_conntrack_in(PF_INET6, hooknum, skb);
+        return nf_conntrack_in(net, PF_INET6, hooknum, skb);
+}
+
+static unsigned int ipv6_conntrack_in(unsigned int hooknum,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      int (*okfn)(struct sk_buff *))
+{
+        return __ipv6_conntrack_in(dev_net(in), hooknum, skb, okfn);
 }
 
 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
@@ -250,7 +258,7 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
                         printk("ipv6_conntrack_local: packet too short\n");
                 return NF_ACCEPT;
         }
-        return ipv6_conntrack_in(hooknum, skb, in, out, okfn);
+        return __ipv6_conntrack_in(dev_net(out), hooknum, skb, okfn);
 }
 
 static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 14d47d833545..05726177903f 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -81,7 +81,7 @@ static int icmpv6_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
-                       int pf,
+                       u_int8_t pf,
                        unsigned int hooknum)
 {
         /* Try to delete connection immediately after all replies:
@@ -93,7 +93,7 @@ static int icmpv6_packet(struct nf_conn *ct,
                         nf_ct_kill_acct(ct, ctinfo, skb);
         } else {
                 atomic_inc(&ct->proto.icmp.count);
-                nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
+                nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, ct);
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmpv6_timeout);
         }
 
@@ -122,7 +122,8 @@ static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,
 }
 
 static int
-icmpv6_error_message(struct sk_buff *skb,
+icmpv6_error_message(struct net *net,
+                     struct sk_buff *skb,
                      unsigned int icmp6off,
                      enum ip_conntrack_info *ctinfo,
                      unsigned int hooknum)
@@ -156,7 +157,7 @@ icmpv6_error_message(struct sk_buff *skb,
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(&intuple);
+        h = nf_conntrack_find_get(net, &intuple);
         if (!h) {
                 pr_debug("icmpv6_error: no match\n");
                 return -NF_ACCEPT;
@@ -172,21 +173,21 @@ icmpv6_error_message(struct sk_buff *skb,
 }
 
 static int
-icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
-             enum ip_conntrack_info *ctinfo, int pf, unsigned int hooknum)
+icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
+             enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
 {
         const struct icmp6hdr *icmp6h;
         struct icmp6hdr _ih;
 
         icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
         if (icmp6h == NULL) {
-                if (LOG_INVALID(IPPROTO_ICMPV6))
+                if (LOG_INVALID(net, IPPROTO_ICMPV6))
                 nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
                               "nf_ct_icmpv6: short packet ");
                 return -NF_ACCEPT;
         }
 
-        if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
                 nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
                               "nf_ct_icmpv6: ICMPv6 checksum failed\n");
@@ -197,7 +198,7 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
         if (icmp6h->icmp6_type >= 128)
                 return NF_ACCEPT;
 
-        return icmpv6_error_message(skb, dataoff, ctinfo, hooknum);
+        return icmpv6_error_message(net, skb, dataoff, ctinfo, hooknum);
 }
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index ee898e74808d..f70b4145ffc7 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -38,10 +38,11 @@ config NF_CONNTRACK
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+if NF_CONNTRACK
+
 config NF_CT_ACCT
         bool "Connection tracking flow accounting"
         depends on NETFILTER_ADVANCED
-        depends on NF_CONNTRACK
         help
           If this option is enabled, the connection tracking code will
           keep per-flow packet and byte counters.
@@ -63,7 +64,6 @@ config NF_CT_ACCT
 config NF_CONNTRACK_MARK
         bool  'Connection mark tracking support'
         depends on NETFILTER_ADVANCED
-        depends on NF_CONNTRACK
         help
           This option enables support for connection marks, used by the
           `CONNMARK' target and `connmark' match. Similar to the mark value
@@ -72,7 +72,7 @@ config NF_CONNTRACK_MARK
 
 config NF_CONNTRACK_SECMARK
         bool  'Connection tracking security mark support'
-        depends on NF_CONNTRACK && NETWORK_SECMARK
+        depends on NETWORK_SECMARK
         default m if NETFILTER_ADVANCED=n
         help
           This option enables security markings to be applied to
@@ -85,7 +85,6 @@ config NF_CONNTRACK_SECMARK
 
 config NF_CONNTRACK_EVENTS
         bool "Connection tracking events"
-        depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         help
           If this option is enabled, the connection tracking code will
@@ -96,7 +95,7 @@ config NF_CONNTRACK_EVENTS
 
 config NF_CT_PROTO_DCCP
         tristate 'DCCP protocol connection tracking support (EXPERIMENTAL)'
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        depends on EXPERIMENTAL
         depends on NETFILTER_ADVANCED
         default IP_DCCP
         help
@@ -107,11 +106,10 @@ config NF_CT_PROTO_DCCP
 
 config NF_CT_PROTO_GRE
         tristate
-        depends on NF_CONNTRACK
 
 config NF_CT_PROTO_SCTP
         tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        depends on EXPERIMENTAL
         depends on NETFILTER_ADVANCED
         default IP_SCTP
         help
@@ -123,7 +121,6 @@ config NF_CT_PROTO_SCTP
 
 config NF_CT_PROTO_UDPLITE
         tristate 'UDP-Lite protocol connection tracking support'
-        depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         help
           With this option enabled, the layer 3 independent connection
@@ -134,7 +131,6 @@ config NF_CT_PROTO_UDPLITE
 
 config NF_CONNTRACK_AMANDA
         tristate "Amanda backup protocol support"
-        depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         select TEXTSEARCH
         select TEXTSEARCH_KMP
@@ -150,7 +146,6 @@ config NF_CONNTRACK_AMANDA
 
 config NF_CONNTRACK_FTP
         tristate "FTP protocol support"
-        depends on NF_CONNTRACK
         default m if NETFILTER_ADVANCED=n
         help
           Tracking FTP connections is problematic: special helpers are
@@ -165,7 +160,7 @@ config NF_CONNTRACK_FTP
 
 config NF_CONNTRACK_H323
         tristate "H.323 protocol support"
-        depends on NF_CONNTRACK && (IPV6 || IPV6=n)
+        depends on (IPV6 || IPV6=n)
         depends on NETFILTER_ADVANCED
         help
           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
@@ -185,7 +180,6 @@ config NF_CONNTRACK_H323
 
 config NF_CONNTRACK_IRC
         tristate "IRC protocol support"
-        depends on NF_CONNTRACK
         default m if NETFILTER_ADVANCED=n
         help
           There is a commonly-used extension to IRC called
@@ -201,7 +195,6 @@ config NF_CONNTRACK_IRC
 
 config NF_CONNTRACK_NETBIOS_NS
         tristate "NetBIOS name service protocol support"
-        depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         help
           NetBIOS name service requests are sent as broadcast messages from an
@@ -221,7 +214,6 @@ config NF_CONNTRACK_NETBIOS_NS
 
 config NF_CONNTRACK_PPTP
         tristate "PPtP protocol support"
-        depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         select NF_CT_PROTO_GRE
         help
@@ -241,7 +233,7 @@ config NF_CONNTRACK_PPTP
 
 config NF_CONNTRACK_SANE
         tristate "SANE protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        depends on EXPERIMENTAL
         depends on NETFILTER_ADVANCED
         help
           SANE is a protocol for remote access to scanners as implemented
@@ -255,7 +247,6 @@ config NF_CONNTRACK_SANE
 
 config NF_CONNTRACK_SIP
         tristate "SIP protocol support"
-        depends on NF_CONNTRACK
         default m if NETFILTER_ADVANCED=n
         help
           SIP is an application-layer control protocol that can establish,
@@ -268,7 +259,6 @@ config NF_CONNTRACK_SIP
 
 config NF_CONNTRACK_TFTP
         tristate "TFTP protocol support"
-        depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         help
           TFTP connection tracking helper, this is required depending
@@ -280,13 +270,29 @@ config NF_CONNTRACK_TFTP
 
 config NF_CT_NETLINK
         tristate 'Connection tracking netlink interface'
-        depends on NF_CONNTRACK
         select NETFILTER_NETLINK
         depends on NF_NAT=n || NF_NAT
         default m if NETFILTER_ADVANCED=n
         help
           This option enables support for a netlink-based userspace interface
 
+# transparent proxy support
+config NETFILTER_TPROXY
+        tristate "Transparent proxying support (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        depends on IP_NF_MANGLE
+        depends on NETFILTER_ADVANCED
+        help
+          This option enables transparent proxying support, that is,
+          support for handling non-locally bound IPv4 TCP and UDP sockets.
+          For it to work you will have to configure certain iptables rules
+          and use policy routing. For more information on how to set it up
+          see Documentation/networking/tproxy.txt.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
+endif # NF_CONNTRACK
+
 config NETFILTER_XTABLES
         tristate "Netfilter Xtables support (required for ip_tables)"
         default m if NETFILTER_ADVANCED=n
@@ -294,11 +300,12 @@ config NETFILTER_XTABLES
           This is required if you intend to use any of ip_tables,
           ip6_tables or arp_tables.
 
+if NETFILTER_XTABLES
+
 # alphabetically ordered list of targets
 
 config NETFILTER_XT_TARGET_CLASSIFY
         tristate '"CLASSIFY" target support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `CLASSIFY' target, which enables the user to set
@@ -311,8 +318,6 @@ config NETFILTER_XT_TARGET_CLASSIFY
 
 config NETFILTER_XT_TARGET_CONNMARK
         tristate  '"CONNMARK" target support'
-        depends on NETFILTER_XTABLES
-        depends on IP_NF_MANGLE || IP6_NF_MANGLE
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         select NF_CONNTRACK_MARK
@@ -325,9 +330,20 @@ config NETFILTER_XT_TARGET_CONNMARK
           <file:Documentation/kbuild/modules.txt>.  The module will be called
           ipt_CONNMARK.ko.  If unsure, say `N'.
 
+config NETFILTER_XT_TARGET_CONNSECMARK
+        tristate '"CONNSECMARK" target support'
+        depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
+        default m if NETFILTER_ADVANCED=n
+        help
+          The CONNSECMARK target copies security markings from packets
+          to connections, and restores security markings from connections
+          to packets (if the packets are not already marked).  This would
+          normally be used in conjunction with the SECMARK target.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_DSCP
         tristate '"DSCP" and "TOS" target support'
-        depends on NETFILTER_XTABLES
         depends on IP_NF_MANGLE || IP6_NF_MANGLE
         depends on NETFILTER_ADVANCED
         help
@@ -344,7 +360,6 @@ config NETFILTER_XT_TARGET_DSCP
 
 config NETFILTER_XT_TARGET_MARK
         tristate '"MARK" target support'
-        depends on NETFILTER_XTABLES
         default m if NETFILTER_ADVANCED=n
         help
           This option adds a `MARK' target, which allows you to create rules
@@ -356,21 +371,8 @@ config NETFILTER_XT_TARGET_MARK
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config NETFILTER_XT_TARGET_NFQUEUE
-        tristate '"NFQUEUE" target Support'
-        depends on NETFILTER_XTABLES
-        depends on NETFILTER_ADVANCED
-        help
-          This target replaced the old obsolete QUEUE target.
-
-          As opposed to QUEUE, it supports 65535 different queues,
-          not just one.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config NETFILTER_XT_TARGET_NFLOG
         tristate '"NFLOG" target support'
-        depends on NETFILTER_XTABLES
         default m if NETFILTER_ADVANCED=n
         help
           This option enables the NFLOG target, which allows to LOG
@@ -380,9 +382,19 @@ config NETFILTER_XT_TARGET_NFLOG
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_TARGET_NFQUEUE
+        tristate '"NFQUEUE" target Support'
+        depends on NETFILTER_ADVANCED
+        help
+          This target replaced the old obsolete QUEUE target.
+
+          As opposed to QUEUE, it supports 65535 different queues,
+          not just one.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_NOTRACK
         tristate  '"NOTRACK" target support'
-        depends on NETFILTER_XTABLES
         depends on IP_NF_RAW || IP6_NF_RAW
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
@@ -397,7 +409,6 @@ config NETFILTER_XT_TARGET_NOTRACK
 
 config NETFILTER_XT_TARGET_RATEEST
         tristate '"RATEEST" target support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `RATEEST' target, which allows to measure
@@ -406,9 +417,23 @@ config NETFILTER_XT_TARGET_RATEEST
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_TARGET_TPROXY
+        tristate '"TPROXY" target support (EXPERIMENTAL)'
+        depends on EXPERIMENTAL
+        depends on NETFILTER_TPROXY
+        depends on NETFILTER_XTABLES
+        depends on NETFILTER_ADVANCED
+        select NF_DEFRAG_IPV4
+        help
+          This option adds a `TPROXY' target, which is somewhat similar to
+          REDIRECT.  It can only be used in the mangle table and is useful
+          to redirect traffic to a transparent proxy.  It does _not_ depend
+          on Netfilter connection tracking and NAT, unlike REDIRECT.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_TRACE
         tristate  '"TRACE" target support'
-        depends on NETFILTER_XTABLES
         depends on IP_NF_RAW || IP6_NF_RAW
         depends on NETFILTER_ADVANCED
         help
@@ -421,7 +446,7 @@ config NETFILTER_XT_TARGET_TRACE
 
 config NETFILTER_XT_TARGET_SECMARK
         tristate '"SECMARK" target support'
-        depends on NETFILTER_XTABLES && NETWORK_SECMARK
+        depends on NETWORK_SECMARK
         default m if NETFILTER_ADVANCED=n
         help
           The SECMARK target allows security marking of network
@@ -429,21 +454,9 @@ config NETFILTER_XT_TARGET_SECMARK
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config NETFILTER_XT_TARGET_CONNSECMARK
-        tristate '"CONNSECMARK" target support'
-        depends on NETFILTER_XTABLES && NF_CONNTRACK && NF_CONNTRACK_SECMARK
-        default m if NETFILTER_ADVANCED=n
-        help
-          The CONNSECMARK target copies security markings from packets
-          to connections, and restores security markings from connections
-          to packets (if the packets are not already marked).  This would
-          normally be used in conjunction with the SECMARK target.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config NETFILTER_XT_TARGET_TCPMSS
         tristate '"TCPMSS" target support'
-        depends on NETFILTER_XTABLES && (IPV6 || IPV6=n)
+        depends on (IPV6 || IPV6=n)
         default m if NETFILTER_ADVANCED=n
         ---help---
           This option adds a `TCPMSS' target, which allows you to alter the
@@ -470,7 +483,7 @@ config NETFILTER_XT_TARGET_TCPMSS
 
 config NETFILTER_XT_TARGET_TCPOPTSTRIP
         tristate '"TCPOPTSTRIP" target support (EXPERIMENTAL)'
-        depends on EXPERIMENTAL && NETFILTER_XTABLES
+        depends on EXPERIMENTAL
         depends on IP_NF_MANGLE || IP6_NF_MANGLE
         depends on NETFILTER_ADVANCED
         help
@@ -479,7 +492,6 @@ config NETFILTER_XT_TARGET_TCPOPTSTRIP
 
 config NETFILTER_XT_MATCH_COMMENT
         tristate  '"comment" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `comment' dummy-match, which allows you to put
@@ -490,7 +502,6 @@ config NETFILTER_XT_MATCH_COMMENT
 
 config NETFILTER_XT_MATCH_CONNBYTES
         tristate  '"connbytes" per-connection counter match support'
-        depends on NETFILTER_XTABLES
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         select NF_CT_ACCT
@@ -503,7 +514,6 @@ config NETFILTER_XT_MATCH_CONNBYTES
 
 config NETFILTER_XT_MATCH_CONNLIMIT
         tristate '"connlimit" match support"'
-        depends on NETFILTER_XTABLES
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         ---help---
@@ -512,7 +522,6 @@ config NETFILTER_XT_MATCH_CONNLIMIT
 
 config NETFILTER_XT_MATCH_CONNMARK
         tristate  '"connmark" connection mark match support'
-        depends on NETFILTER_XTABLES
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         select NF_CONNTRACK_MARK
@@ -526,7 +535,6 @@ config NETFILTER_XT_MATCH_CONNMARK
 
 config NETFILTER_XT_MATCH_CONNTRACK
         tristate '"conntrack" connection tracking match support'
-        depends on NETFILTER_XTABLES
         depends on NF_CONNTRACK
         default m if NETFILTER_ADVANCED=n
         help
@@ -540,7 +548,6 @@ config NETFILTER_XT_MATCH_CONNTRACK
 
 config NETFILTER_XT_MATCH_DCCP
         tristate '"dccp" protocol match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         default IP_DCCP
         help
@@ -553,7 +560,6 @@ config NETFILTER_XT_MATCH_DCCP
 
 config NETFILTER_XT_MATCH_DSCP
         tristate '"dscp" and "tos" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `DSCP' match, which allows you to match against
@@ -569,7 +575,6 @@ config NETFILTER_XT_MATCH_DSCP
 
 config NETFILTER_XT_MATCH_ESP
         tristate '"esp" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This match extension allows you to match a range of SPIs
@@ -577,9 +582,23 @@ config NETFILTER_XT_MATCH_ESP
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_HASHLIMIT
+        tristate '"hashlimit" match support'
+        depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+        depends on NETFILTER_ADVANCED
+        help
+          This option adds a `hashlimit' match.
+
+          As opposed to `limit', this match dynamically creates a hash table
+          of limit buckets, based on your selection of source/destination
+          addresses and/or ports.
+
+          It enables you to express policies like `10kpps for any given
+          destination address' or `500pps from any given source address'
+          with a single rule.
+
 config NETFILTER_XT_MATCH_HELPER
         tristate '"helper" match support'
-        depends on NETFILTER_XTABLES
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         help
@@ -590,7 +609,6 @@ config NETFILTER_XT_MATCH_HELPER
 
 config NETFILTER_XT_MATCH_IPRANGE
         tristate '"iprange" address range match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         ---help---
         This option adds a "iprange" match, which allows you to match based on
@@ -601,7 +619,6 @@ config NETFILTER_XT_MATCH_IPRANGE
 
 config NETFILTER_XT_MATCH_LENGTH
         tristate '"length" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option allows you to match the length of a packet against a
@@ -611,7 +628,6 @@ config NETFILTER_XT_MATCH_LENGTH
 
 config NETFILTER_XT_MATCH_LIMIT
         tristate '"limit" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           limit matching allows you to control the rate at which a rule can be
@@ -622,7 +638,6 @@ config NETFILTER_XT_MATCH_LIMIT
 
 config NETFILTER_XT_MATCH_MAC
         tristate '"mac" address match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           MAC matching allows you to match packets based on the source
@@ -632,7 +647,6 @@ config NETFILTER_XT_MATCH_MAC
 
 config NETFILTER_XT_MATCH_MARK
         tristate '"mark" match support'
-        depends on NETFILTER_XTABLES
         default m if NETFILTER_ADVANCED=n
         help
           Netfilter mark matching allows you to match packets based on the
@@ -641,9 +655,18 @@ config NETFILTER_XT_MATCH_MARK
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_MULTIPORT
+        tristate '"multiport" Multiple port match support'
+        depends on NETFILTER_ADVANCED
+        help
+          Multiport matching allows you to match TCP or UDP packets based on
+          a series of source or destination ports: normally a rule can only
+          match a single range of ports.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_MATCH_OWNER
         tristate '"owner" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         ---help---
         Socket owner matching allows you to match locally-generated packets
@@ -652,7 +675,7 @@ config NETFILTER_XT_MATCH_OWNER
 
 config NETFILTER_XT_MATCH_POLICY
         tristate 'IPsec "policy" match support'
-        depends on NETFILTER_XTABLES && XFRM
+        depends on XFRM
         default m if NETFILTER_ADVANCED=n
         help
           Policy matching allows you to match packets based on the
@@ -661,20 +684,9 @@ config NETFILTER_XT_MATCH_POLICY
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config NETFILTER_XT_MATCH_MULTIPORT
-        tristate '"multiport" Multiple port match support'
-        depends on NETFILTER_XTABLES
-        depends on NETFILTER_ADVANCED
-        help
-          Multiport matching allows you to match TCP or UDP packets based on
-          a series of source or destination ports: normally a rule can only
-          match a single range of ports.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config NETFILTER_XT_MATCH_PHYSDEV
         tristate '"physdev" match support'
-        depends on NETFILTER_XTABLES && BRIDGE && BRIDGE_NETFILTER
+        depends on BRIDGE && BRIDGE_NETFILTER
         depends on NETFILTER_ADVANCED
         help
           Physdev packet matching matches against the physical bridge ports
@@ -684,7 +696,6 @@ config NETFILTER_XT_MATCH_PHYSDEV
 
 config NETFILTER_XT_MATCH_PKTTYPE
         tristate '"pkttype" packet type match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           Packet type matching allows you to match a packet by
@@ -697,7 +708,6 @@ config NETFILTER_XT_MATCH_PKTTYPE
 
 config NETFILTER_XT_MATCH_QUOTA
         tristate '"quota" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `quota' match, which allows to match on a
@@ -708,7 +718,6 @@ config NETFILTER_XT_MATCH_QUOTA
 
 config NETFILTER_XT_MATCH_RATEEST
         tristate '"rateest" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         select NETFILTER_XT_TARGET_RATEEST
         help
@@ -719,7 +728,6 @@ config NETFILTER_XT_MATCH_RATEEST
 
 config NETFILTER_XT_MATCH_REALM
         tristate  '"realm" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         select NET_CLS_ROUTE
         help
@@ -732,9 +740,26 @@ config NETFILTER_XT_MATCH_REALM
           If you want to compile it as a module, say M here and read
           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_RECENT
+        tristate '"recent" match support'
+        depends on NETFILTER_ADVANCED
+        ---help---
+        This match is used for creating one or many lists of recently
+        used addresses and then matching against that/those list(s).
+
+        Short options are available by using 'iptables -m recent -h'
+        Official Website: <http://snowman.net/projects/ipt_recent/>
+
+config NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+        bool 'Enable obsolete /proc/net/ipt_recent'
+        depends on NETFILTER_XT_MATCH_RECENT && PROC_FS
+        ---help---
+        This option enables the old /proc/net/ipt_recent interface,
+        which has been obsoleted by /proc/net/xt_recent.
+
 config NETFILTER_XT_MATCH_SCTP
         tristate  '"sctp" protocol match support (EXPERIMENTAL)'
-        depends on NETFILTER_XTABLES && EXPERIMENTAL
+        depends on EXPERIMENTAL
         depends on NETFILTER_ADVANCED
         default IP_SCTP
         help
@@ -745,9 +770,23 @@ config NETFILTER_XT_MATCH_SCTP
           If you want to compile it as a module, say M here and read
           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_SOCKET
+        tristate '"socket" match support (EXPERIMENTAL)'
+        depends on EXPERIMENTAL
+        depends on NETFILTER_TPROXY
+        depends on NETFILTER_XTABLES
+        depends on NETFILTER_ADVANCED
+        select NF_DEFRAG_IPV4
+        help
+          This option adds a `socket' match, which can be used to match
+          packets for which a TCP or UDP socket lookup finds a valid socket.
+          It can be used in combination with the MARK target and policy
+          routing to implement full featured non-locally bound sockets.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_MATCH_STATE
         tristate '"state" match support'
-        depends on NETFILTER_XTABLES
         depends on NF_CONNTRACK
         default m if NETFILTER_ADVANCED=n
         help
@@ -759,7 +798,6 @@ config NETFILTER_XT_MATCH_STATE
 
 config NETFILTER_XT_MATCH_STATISTIC
         tristate '"statistic" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `statistic' match, which allows you to match
@@ -769,7 +807,6 @@ config NETFILTER_XT_MATCH_STATISTIC
 
 config NETFILTER_XT_MATCH_STRING
         tristate  '"string" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         select TEXTSEARCH
         select TEXTSEARCH_KMP
@@ -783,7 +820,6 @@ config NETFILTER_XT_MATCH_STRING
 
 config NETFILTER_XT_MATCH_TCPMSS
         tristate '"tcpmss" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         help
           This option adds a `tcpmss' match, which allows you to examine the
@@ -794,7 +830,6 @@ config NETFILTER_XT_MATCH_TCPMSS
 
 config NETFILTER_XT_MATCH_TIME
         tristate '"time" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         ---help---
           This option adds a "time" match, which allows you to match based on
@@ -809,7 +844,6 @@ config NETFILTER_XT_MATCH_TIME
 
 config NETFILTER_XT_MATCH_U32
         tristate '"u32" match support'
-        depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
         ---help---
           u32 allows you to extract quantities of up to 4 bytes from a packet,
@@ -821,20 +855,6 @@ config NETFILTER_XT_MATCH_U32
 
           Details and examples are in the kernel module source.
 
-config NETFILTER_XT_MATCH_HASHLIMIT
-        tristate '"hashlimit" match support'
-        depends on NETFILTER_XTABLES && (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
-        depends on NETFILTER_ADVANCED
-        help
-          This option adds a `hashlimit' match.
-
-          As opposed to `limit', this match dynamically creates a hash table
-          of limit buckets, based on your selection of source/destination
-          addresses and/or ports.
-
-          It enables you to express policies like `10kpps for any given
-          destination address' or `500pps from any given source address'
-          with a single rule.
+endif # NETFILTER_XTABLES
 
 endmenu
-
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 3bd2cc556aea..8ce67665882d 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -34,6 +34,9 @@ obj-$(CONFIG_NF_CONNTRACK_SANE) += nf_conntrack_sane.o
 obj-$(CONFIG_NF_CONNTRACK_SIP) += nf_conntrack_sip.o
 obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o
 
+# transparent proxy support
+obj-$(CONFIG_NETFILTER_TPROXY) += nf_tproxy_core.o
+
 # generic X tables 
 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
 
@@ -48,6 +51,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_RATEEST) += xt_RATEEST.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_TPROXY) += xt_TPROXY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP) += xt_TCPOPTSTRIP.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o
@@ -76,7 +80,9 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 292fa28146fb..a90ac83c5918 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -26,7 +26,7 @@
 
 static DEFINE_MUTEX(afinfo_mutex);
 
-const struct nf_afinfo *nf_afinfo[NPROTO] __read_mostly;
+const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
 EXPORT_SYMBOL(nf_afinfo);
 
 int nf_register_afinfo(const struct nf_afinfo *afinfo)
@@ -51,7 +51,7 @@ void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
 }
 EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
 
-struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS] __read_mostly;
+struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;
 EXPORT_SYMBOL(nf_hooks);
 static DEFINE_MUTEX(nf_hook_mutex);
 
@@ -113,7 +113,7 @@ EXPORT_SYMBOL(nf_unregister_hooks);
 
 unsigned int nf_iterate(struct list_head *head,
                         struct sk_buff *skb,
-                        int hook,
+                        unsigned int hook,
                         const struct net_device *indev,
                         const struct net_device *outdev,
                         struct list_head **i,
@@ -155,7 +155,7 @@ unsigned int nf_iterate(struct list_head *head,
 
 /* Returns 1 if okfn() needs to be executed by the caller,
  * -EPERM for NF_DROP, 0 otherwise. */
-int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
+int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
                  struct net_device *indev,
                  struct net_device *outdev,
                  int (*okfn)(struct sk_buff *),
@@ -165,14 +165,6 @@ int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
         unsigned int verdict;
         int ret = 0;
 
-#ifdef CONFIG_NET_NS
-        struct net *net;
-
-        net = indev == NULL ? dev_net(outdev) : dev_net(indev);
-        if (net != &init_net)
-                return 1;
-#endif
-
         /* We may already have this, but read-locks nest anyway */
         rcu_read_lock();
 
@@ -264,7 +256,7 @@ EXPORT_SYMBOL(proc_net_netfilter);
 void __init netfilter_init(void)
 {
         int i, h;
-        for (i = 0; i < NPROTO; i++) {
+        for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) {
                 for (h = 0; h < NF_MAX_HOOKS; h++)
                         INIT_LIST_HEAD(&nf_hooks[i][h]);
         }
diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
index 59bd8b903a19..03591d37b9cc 100644
--- a/net/netfilter/nf_conntrack_acct.c
+++ b/net/netfilter/nf_conntrack_acct.c
@@ -22,19 +22,17 @@
 #define NF_CT_ACCT_DEFAULT 0
 #endif
 
-int nf_ct_acct __read_mostly = NF_CT_ACCT_DEFAULT;
-EXPORT_SYMBOL_GPL(nf_ct_acct);
+static int nf_ct_acct __read_mostly = NF_CT_ACCT_DEFAULT;
 
 module_param_named(acct, nf_ct_acct, bool, 0644);
 MODULE_PARM_DESC(acct, "Enable connection tracking flow accounting.");
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table_header *acct_sysctl_header;
 static struct ctl_table acct_sysctl_table[] = {
         {
                 .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_acct",
-                .data           = &nf_ct_acct,
+                .data           = &init_net.ct.sysctl_acct,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
@@ -64,41 +62,87 @@ static struct nf_ct_ext_type acct_extend __read_mostly = {
         .id     = NF_CT_EXT_ACCT,
 };
 
-int nf_conntrack_acct_init(void)
+#ifdef CONFIG_SYSCTL
+static int nf_conntrack_acct_init_sysctl(struct net *net)
 {
-        int ret;
+        struct ctl_table *table;
 
-#ifdef CONFIG_NF_CT_ACCT
-        printk(KERN_WARNING "CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use\n");
-        printk(KERN_WARNING "nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or\n");
-        printk(KERN_WARNING "sysctl net.netfilter.nf_conntrack_acct=1 to enable it.\n");
-#endif
+        table = kmemdup(acct_sysctl_table, sizeof(acct_sysctl_table),
+                        GFP_KERNEL);
+        if (!table)
+                goto out;
+
+        table[0].data = &net->ct.sysctl_acct;
 
-        ret = nf_ct_extend_register(&acct_extend);
-        if (ret < 0) {
-                printk(KERN_ERR "nf_conntrack_acct: Unable to register extension\n");
-                return ret;
+        net->ct.acct_sysctl_header = register_net_sysctl_table(net,
+                        nf_net_netfilter_sysctl_path, table);
+        if (!net->ct.acct_sysctl_header) {
+                printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
+                goto out_register;
         }
+        return 0;
 
-#ifdef CONFIG_SYSCTL
-        acct_sysctl_header = register_sysctl_paths(nf_net_netfilter_sysctl_path,
-                                acct_sysctl_table);
+out_register:
+        kfree(table);
+out:
+        return -ENOMEM;
+}
 
-        if (!acct_sysctl_header) {
-                nf_ct_extend_unregister(&acct_extend);
+static void nf_conntrack_acct_fini_sysctl(struct net *net)
+{
+        struct ctl_table *table;
 
-                printk(KERN_ERR "nf_conntrack_acct: can't register to sysctl.\n");
-                return -ENOMEM;
-        }
+        table = net->ct.acct_sysctl_header->ctl_table_arg;
+        unregister_net_sysctl_table(net->ct.acct_sysctl_header);
+        kfree(table);
+}
+#else
+static int nf_conntrack_acct_init_sysctl(struct net *net)
+{
+        return 0;
+}
+
+static void nf_conntrack_acct_fini_sysctl(struct net *net)
+{
+}
+#endif
+
+int nf_conntrack_acct_init(struct net *net)
+{
+        int ret;
+
+        net->ct.sysctl_acct = nf_ct_acct;
+
+        if (net_eq(net, &init_net)) {
+#ifdef CONFIG_NF_CT_ACCT
+                printk(KERN_WARNING "CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use\n");
+                printk(KERN_WARNING "nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or\n");
+                printk(KERN_WARNING "sysctl net.netfilter.nf_conntrack_acct=1 to enable it.\n");
 #endif
 
+                ret = nf_ct_extend_register(&acct_extend);
+                if (ret < 0) {
+                        printk(KERN_ERR "nf_conntrack_acct: Unable to register extension\n");
+                        goto out_extend_register;
+                }
+        }
+
+        ret = nf_conntrack_acct_init_sysctl(net);
+        if (ret < 0)
+                goto out_sysctl;
+
         return 0;
+
+out_sysctl:
+        if (net_eq(net, &init_net))
+                nf_ct_extend_unregister(&acct_extend);
+out_extend_register:
+        return ret;
 }
 
-void nf_conntrack_acct_fini(void)
+void nf_conntrack_acct_fini(struct net *net)
 {
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(acct_sysctl_header);
-#endif
-        nf_ct_extend_unregister(&acct_extend);
+        nf_conntrack_acct_fini_sysctl(net);
+        if (net_eq(net, &init_net))
+                nf_ct_extend_unregister(&acct_extend);
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 9d1830da8e84..27de3c7b006e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -44,30 +44,17 @@
 DEFINE_SPINLOCK(nf_conntrack_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_lock);
 
-/* nf_conntrack_standalone needs this */
-atomic_t nf_conntrack_count = ATOMIC_INIT(0);
-EXPORT_SYMBOL_GPL(nf_conntrack_count);
-
 unsigned int nf_conntrack_htable_size __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 
 int nf_conntrack_max __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_max);
 
-struct hlist_head *nf_conntrack_hash __read_mostly;
-EXPORT_SYMBOL_GPL(nf_conntrack_hash);
-
 struct nf_conn nf_conntrack_untracked __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
 
-unsigned int nf_ct_log_invalid __read_mostly;
-HLIST_HEAD(unconfirmed);
-static int nf_conntrack_vmalloc __read_mostly;
 static struct kmem_cache *nf_conntrack_cachep __read_mostly;
 
-DEFINE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
-EXPORT_PER_CPU_SYMBOL(nf_conntrack_stat);
-
 static int nf_conntrack_hash_rnd_initted;
 static unsigned int nf_conntrack_hash_rnd;
 
@@ -180,6 +167,7 @@ static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
         struct nf_conn *ct = (struct nf_conn *)nfct;
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_l4proto *l4proto;
 
         pr_debug("destroy_conntrack(%p)\n", ct);
@@ -212,7 +200,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
                 hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
         }
 
-        NF_CT_STAT_INC(delete);
+        NF_CT_STAT_INC(net, delete);
         spin_unlock_bh(&nf_conntrack_lock);
 
         if (ct->master)
@@ -225,6 +213,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
 static void death_by_timeout(unsigned long ul_conntrack)
 {
         struct nf_conn *ct = (void *)ul_conntrack;
+        struct net *net = nf_ct_net(ct);
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_helper *helper;
 
@@ -239,14 +228,14 @@ static void death_by_timeout(unsigned long ul_conntrack)
         spin_lock_bh(&nf_conntrack_lock);
         /* Inside lock so preempt is disabled on module removal path.
          * Otherwise we can get spurious warnings. */
-        NF_CT_STAT_INC(delete_list);
+        NF_CT_STAT_INC(net, delete_list);
         clean_from_lists(ct);
         spin_unlock_bh(&nf_conntrack_lock);
         nf_ct_put(ct);
 }
 
 struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(const struct nf_conntrack_tuple *tuple)
+__nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_tuple_hash *h;
         struct hlist_node *n;
@@ -256,13 +245,13 @@ __nf_conntrack_find(const struct nf_conntrack_tuple *tuple)
          * at least once for the stats anyway.
          */
         local_bh_disable();
-        hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
+        hlist_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnode) {
                 if (nf_ct_tuple_equal(tuple, &h->tuple)) {
-                        NF_CT_STAT_INC(found);
+                        NF_CT_STAT_INC(net, found);
                         local_bh_enable();
                         return h;
                 }
-                NF_CT_STAT_INC(searched);
+                NF_CT_STAT_INC(net, searched);
         }
         local_bh_enable();
 
@@ -272,13 +261,13 @@ EXPORT_SYMBOL_GPL(__nf_conntrack_find);
 
 /* Find a connection corresponding to a tuple. */
 struct nf_conntrack_tuple_hash *
-nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple)
+nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct;
 
         rcu_read_lock();
-        h = __nf_conntrack_find(tuple);
+        h = __nf_conntrack_find(net, tuple);
         if (h) {
                 ct = nf_ct_tuplehash_to_ctrack(h);
                 if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
@@ -294,10 +283,12 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                                        unsigned int hash,
                                        unsigned int repl_hash)
 {
+        struct net *net = nf_ct_net(ct);
+
         hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
-                           &nf_conntrack_hash[hash]);
+                           &net->ct.hash[hash]);
         hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
-                           &nf_conntrack_hash[repl_hash]);
+                           &net->ct.hash[repl_hash]);
 }
 
 void nf_conntrack_hash_insert(struct nf_conn *ct)
@@ -323,8 +314,10 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         struct nf_conn_help *help;
         struct hlist_node *n;
         enum ip_conntrack_info ctinfo;
+        struct net *net;
 
         ct = nf_ct_get(skb, &ctinfo);
+        net = nf_ct_net(ct);
 
         /* ipt_REJECT uses nf_conntrack_attach to attach related
            ICMP/TCP RST packets in other direction.  Actual packet
@@ -351,11 +344,11 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         /* See if there's one in the list already, including reverse:
            NAT could have grabbed it without realizing, since we're
            not in the hash.  If there is, we lost race. */
-        hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode)
+        hlist_for_each_entry(h, n, &net->ct.hash[hash], hnode)
                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
                                       &h->tuple))
                         goto out;
-        hlist_for_each_entry(h, n, &nf_conntrack_hash[repl_hash], hnode)
+        hlist_for_each_entry(h, n, &net->ct.hash[repl_hash], hnode)
                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
                                       &h->tuple))
                         goto out;
@@ -371,22 +364,22 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         add_timer(&ct->timeout);
         atomic_inc(&ct->ct_general.use);
         set_bit(IPS_CONFIRMED_BIT, &ct->status);
-        NF_CT_STAT_INC(insert);
+        NF_CT_STAT_INC(net, insert);
         spin_unlock_bh(&nf_conntrack_lock);
         help = nfct_help(ct);
         if (help && help->helper)
-                nf_conntrack_event_cache(IPCT_HELPER, skb);
+                nf_conntrack_event_cache(IPCT_HELPER, ct);
 #ifdef CONFIG_NF_NAT_NEEDED
         if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
             test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
-                nf_conntrack_event_cache(IPCT_NATINFO, skb);
+                nf_conntrack_event_cache(IPCT_NATINFO, ct);
 #endif
         nf_conntrack_event_cache(master_ct(ct) ?
-                                 IPCT_RELATED : IPCT_NEW, skb);
+                                 IPCT_RELATED : IPCT_NEW, ct);
         return NF_ACCEPT;
 
 out:
-        NF_CT_STAT_INC(insert_failed);
+        NF_CT_STAT_INC(net, insert_failed);
         spin_unlock_bh(&nf_conntrack_lock);
         return NF_DROP;
 }
@@ -398,6 +391,7 @@ int
 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
                          const struct nf_conn *ignored_conntrack)
 {
+        struct net *net = nf_ct_net(ignored_conntrack);
         struct nf_conntrack_tuple_hash *h;
         struct hlist_node *n;
         unsigned int hash = hash_conntrack(tuple);
@@ -406,14 +400,14 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
          * least once for the stats anyway.
          */
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
+        hlist_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnode) {
                 if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
                     nf_ct_tuple_equal(tuple, &h->tuple)) {
-                        NF_CT_STAT_INC(found);
+                        NF_CT_STAT_INC(net, found);
                         rcu_read_unlock_bh();
                         return 1;
                 }
-                NF_CT_STAT_INC(searched);
+                NF_CT_STAT_INC(net, searched);
         }
         rcu_read_unlock_bh();
 
@@ -425,7 +419,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 
 /* There's a small race here where we may free a just-assured
    connection.  Too bad: we're in trouble anyway. */
-static noinline int early_drop(unsigned int hash)
+static noinline int early_drop(struct net *net, unsigned int hash)
 {
         /* Use oldest entry, which is roughly LRU */
         struct nf_conntrack_tuple_hash *h;
@@ -436,7 +430,7 @@ static noinline int early_drop(unsigned int hash)
 
         rcu_read_lock();
         for (i = 0; i < nf_conntrack_htable_size; i++) {
-                hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash],
+                hlist_for_each_entry_rcu(h, n, &net->ct.hash[hash],
                                          hnode) {
                         tmp = nf_ct_tuplehash_to_ctrack(h);
                         if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
@@ -458,13 +452,14 @@ static noinline int early_drop(unsigned int hash)
         if (del_timer(&ct->timeout)) {
                 death_by_timeout((unsigned long)ct);
                 dropped = 1;
-                NF_CT_STAT_INC_ATOMIC(early_drop);
+                NF_CT_STAT_INC_ATOMIC(net, early_drop);
         }
         nf_ct_put(ct);
         return dropped;
 }
 
-struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
+struct nf_conn *nf_conntrack_alloc(struct net *net,
+                                   const struct nf_conntrack_tuple *orig,
                                    const struct nf_conntrack_tuple *repl,
                                    gfp_t gfp)
 {
@@ -476,13 +471,13 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
         }
 
         /* We don't want any race condition at early drop stage */
-        atomic_inc(&nf_conntrack_count);
+        atomic_inc(&net->ct.count);
 
         if (nf_conntrack_max &&
-            unlikely(atomic_read(&nf_conntrack_count) > nf_conntrack_max)) {
+            unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
                 unsigned int hash = hash_conntrack(orig);
-                if (!early_drop(hash)) {
-                        atomic_dec(&nf_conntrack_count);
+                if (!early_drop(net, hash)) {
+                        atomic_dec(&net->ct.count);
                         if (net_ratelimit())
                                 printk(KERN_WARNING
                                        "nf_conntrack: table full, dropping"
@@ -494,7 +489,7 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
         ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
         if (ct == NULL) {
                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
-                atomic_dec(&nf_conntrack_count);
+                atomic_dec(&net->ct.count);
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -503,6 +498,9 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
         /* Don't set timer yet: wait for confirmation */
         setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
+#ifdef CONFIG_NET_NS
+        ct->ct_net = net;
+#endif
         INIT_RCU_HEAD(&ct->rcu);
 
         return ct;
@@ -512,10 +510,11 @@ EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
 static void nf_conntrack_free_rcu(struct rcu_head *head)
 {
         struct nf_conn *ct = container_of(head, struct nf_conn, rcu);
+        struct net *net = nf_ct_net(ct);
 
         nf_ct_ext_free(ct);
         kmem_cache_free(nf_conntrack_cachep, ct);
-        atomic_dec(&nf_conntrack_count);
+        atomic_dec(&net->ct.count);
 }
 
 void nf_conntrack_free(struct nf_conn *ct)
@@ -528,7 +527,8 @@ EXPORT_SYMBOL_GPL(nf_conntrack_free);
 /* Allocate a new conntrack: we return -ENOMEM if classification
    failed due to stress.  Otherwise it really is unclassifiable. */
 static struct nf_conntrack_tuple_hash *
-init_conntrack(const struct nf_conntrack_tuple *tuple,
+init_conntrack(struct net *net,
+               const struct nf_conntrack_tuple *tuple,
                struct nf_conntrack_l3proto *l3proto,
                struct nf_conntrack_l4proto *l4proto,
                struct sk_buff *skb,
@@ -544,7 +544,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                 return NULL;
         }
 
-        ct = nf_conntrack_alloc(tuple, &repl_tuple, GFP_ATOMIC);
+        ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
         if (ct == NULL || IS_ERR(ct)) {
                 pr_debug("Can't allocate conntrack.\n");
                 return (struct nf_conntrack_tuple_hash *)ct;
@@ -559,7 +559,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
         nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 
         spin_lock_bh(&nf_conntrack_lock);
-        exp = nf_ct_find_expectation(tuple);
+        exp = nf_ct_find_expectation(net, tuple);
         if (exp) {
                 pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
                          ct, exp);
@@ -579,7 +579,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                 ct->secmark = exp->master->secmark;
 #endif
                 nf_conntrack_get(&ct->master->ct_general);
-                NF_CT_STAT_INC(expect_new);
+                NF_CT_STAT_INC(net, expect_new);
         } else {
                 struct nf_conntrack_helper *helper;
 
@@ -589,11 +589,12 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                         if (help)
                                 rcu_assign_pointer(help->helper, helper);
                 }
-                NF_CT_STAT_INC(new);
+                NF_CT_STAT_INC(net, new);
         }
 
         /* Overload tuple linked list to put us in unconfirmed list. */
-        hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);
+        hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
+                       &net->ct.unconfirmed);
 
         spin_unlock_bh(&nf_conntrack_lock);
 
@@ -608,7 +609,8 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
 
 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
 static inline struct nf_conn *
-resolve_normal_ct(struct sk_buff *skb,
+resolve_normal_ct(struct net *net,
+                  struct sk_buff *skb,
                   unsigned int dataoff,
                   u_int16_t l3num,
                   u_int8_t protonum,
@@ -629,9 +631,9 @@ resolve_normal_ct(struct sk_buff *skb,
         }
 
         /* look for tuple match */
-        h = nf_conntrack_find_get(&tuple);
+        h = nf_conntrack_find_get(net, &tuple);
         if (!h) {
-                h = init_conntrack(&tuple, l3proto, l4proto, skb, dataoff);
+                h = init_conntrack(net, &tuple, l3proto, l4proto, skb, dataoff);
                 if (!h)
                         return NULL;
                 if (IS_ERR(h))
@@ -665,7 +667,8 @@ resolve_normal_ct(struct sk_buff *skb,
 }
 
 unsigned int
-nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff *skb)
+nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
+                struct sk_buff *skb)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -678,44 +681,46 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff *skb)
 
         /* Previously seen (loopback or untracked)?  Ignore. */
         if (skb->nfct) {
-                NF_CT_STAT_INC_ATOMIC(ignore);
+                NF_CT_STAT_INC_ATOMIC(net, ignore);
                 return NF_ACCEPT;
         }
 
         /* rcu_read_lock()ed by nf_hook_slow */
-        l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
+        l3proto = __nf_ct_l3proto_find(pf);
         ret = l3proto->get_l4proto(skb, skb_network_offset(skb),
                                    &dataoff, &protonum);
         if (ret <= 0) {
                 pr_debug("not prepared to track yet or error occured\n");
-                NF_CT_STAT_INC_ATOMIC(error);
-                NF_CT_STAT_INC_ATOMIC(invalid);
+                NF_CT_STAT_INC_ATOMIC(net, error);
+                NF_CT_STAT_INC_ATOMIC(net, invalid);
                 return -ret;
         }
 
-        l4proto = __nf_ct_l4proto_find((u_int16_t)pf, protonum);
+        l4proto = __nf_ct_l4proto_find(pf, protonum);
 
         /* It may be an special packet, error, unclean...
          * inverse of the return code tells to the netfilter
          * core what to do with the packet. */
-        if (l4proto->error != NULL &&
-            (ret = l4proto->error(skb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
-                NF_CT_STAT_INC_ATOMIC(error);
-                NF_CT_STAT_INC_ATOMIC(invalid);
-                return -ret;
+        if (l4proto->error != NULL) {
+                ret = l4proto->error(net, skb, dataoff, &ctinfo, pf, hooknum);
+                if (ret <= 0) {
+                        NF_CT_STAT_INC_ATOMIC(net, error);
+                        NF_CT_STAT_INC_ATOMIC(net, invalid);
+                        return -ret;
+                }
         }
 
-        ct = resolve_normal_ct(skb, dataoff, pf, protonum, l3proto, l4proto,
-                               &set_reply, &ctinfo);
+        ct = resolve_normal_ct(net, skb, dataoff, pf, protonum,
+                               l3proto, l4proto, &set_reply, &ctinfo);
         if (!ct) {
                 /* Not valid part of a connection */
-                NF_CT_STAT_INC_ATOMIC(invalid);
+                NF_CT_STAT_INC_ATOMIC(net, invalid);
                 return NF_ACCEPT;
         }
 
         if (IS_ERR(ct)) {
                 /* Too stressed to deal. */
-                NF_CT_STAT_INC_ATOMIC(drop);
+                NF_CT_STAT_INC_ATOMIC(net, drop);
                 return NF_DROP;
         }
 
@@ -728,12 +733,12 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff *skb)
                 pr_debug("nf_conntrack_in: Can't track with proto module\n");
                 nf_conntrack_put(skb->nfct);
                 skb->nfct = NULL;
-                NF_CT_STAT_INC_ATOMIC(invalid);
+                NF_CT_STAT_INC_ATOMIC(net, invalid);
                 return -ret;
         }
 
         if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
-                nf_conntrack_event_cache(IPCT_STATUS, skb);
+                nf_conntrack_event_cache(IPCT_STATUS, ct);
 
         return ret;
 }
@@ -846,7 +851,7 @@ acct:
 
         /* must be unlocked when calling event cache */
         if (event)
-                nf_conntrack_event_cache(event, skb);
+                nf_conntrack_event_cache(event, ct);
 }
 EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
 
@@ -938,7 +943,7 @@ static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
 
 /* Bring out ya dead! */
 static struct nf_conn *
-get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
+get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
                 void *data, unsigned int *bucket)
 {
         struct nf_conntrack_tuple_hash *h;
@@ -947,13 +952,13 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
 
         spin_lock_bh(&nf_conntrack_lock);
         for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
-                hlist_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnode) {
+                hlist_for_each_entry(h, n, &net->ct.hash[*bucket], hnode) {
                         ct = nf_ct_tuplehash_to_ctrack(h);
                         if (iter(ct, data))
                                 goto found;
                 }
         }
-        hlist_for_each_entry(h, n, &unconfirmed, hnode) {
+        hlist_for_each_entry(h, n, &net->ct.unconfirmed, hnode) {
                 ct = nf_ct_tuplehash_to_ctrack(h);
                 if (iter(ct, data))
                         set_bit(IPS_DYING_BIT, &ct->status);
@@ -966,13 +971,14 @@ found:
         return ct;
 }
 
-void
-nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data)
+void nf_ct_iterate_cleanup(struct net *net,
+                           int (*iter)(struct nf_conn *i, void *data),
+                           void *data)
 {
         struct nf_conn *ct;
         unsigned int bucket = 0;
 
-        while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
+        while ((ct = get_next_corpse(net, iter, data, &bucket)) != NULL) {
                 /* Time to push up daises... */
                 if (del_timer(&ct->timeout))
                         death_by_timeout((unsigned long)ct);
@@ -998,27 +1004,26 @@ void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, unsigned int s
 }
 EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
 
-void nf_conntrack_flush(void)
+void nf_conntrack_flush(struct net *net)
 {
-        nf_ct_iterate_cleanup(kill_all, NULL);
+        nf_ct_iterate_cleanup(net, kill_all, NULL);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_flush);
 
-/* Mishearing the voices in his head, our hero wonders how he's
-   supposed to kill the mall. */
-void nf_conntrack_cleanup(void)
+static void nf_conntrack_cleanup_init_net(void)
 {
-        rcu_assign_pointer(ip_ct_attach, NULL);
-
-        /* This makes sure all current packets have passed through
-           netfilter framework.  Roll on, two-stage module
-           delete... */
-        synchronize_net();
+        nf_conntrack_helper_fini();
+        nf_conntrack_proto_fini();
+        kmem_cache_destroy(nf_conntrack_cachep);
+}
 
-        nf_ct_event_cache_flush();
+static void nf_conntrack_cleanup_net(struct net *net)
+{
+        nf_ct_event_cache_flush(net);
+        nf_conntrack_ecache_fini(net);
  i_see_dead_people:
-        nf_conntrack_flush();
-        if (atomic_read(&nf_conntrack_count) != 0) {
+        nf_conntrack_flush(net);
+        if (atomic_read(&net->ct.count) != 0) {
                 schedule();
                 goto i_see_dead_people;
         }
@@ -1026,16 +1031,31 @@ void nf_conntrack_cleanup(void)
         while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
                 schedule();
 
-        rcu_assign_pointer(nf_ct_destroy, NULL);
-
-        kmem_cache_destroy(nf_conntrack_cachep);
-        nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
+        nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
                              nf_conntrack_htable_size);
+        nf_conntrack_acct_fini(net);
+        nf_conntrack_expect_fini(net);
+        free_percpu(net->ct.stat);
+}
 
-        nf_conntrack_acct_fini();
-        nf_conntrack_expect_fini();
-        nf_conntrack_helper_fini();
-        nf_conntrack_proto_fini();
+/* Mishearing the voices in his head, our hero wonders how he's
+   supposed to kill the mall. */
+void nf_conntrack_cleanup(struct net *net)
+{
+        if (net_eq(net, &init_net))
+                rcu_assign_pointer(ip_ct_attach, NULL);
+
+        /* This makes sure all current packets have passed through
+           netfilter framework.  Roll on, two-stage module
+           delete... */
+        synchronize_net();
+
+        nf_conntrack_cleanup_net(net);
+
+        if (net_eq(net, &init_net)) {
+                rcu_assign_pointer(nf_ct_destroy, NULL);
+                nf_conntrack_cleanup_init_net();
+        }
 }
 
 struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
@@ -1094,8 +1114,8 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
          */
         spin_lock_bh(&nf_conntrack_lock);
         for (i = 0; i < nf_conntrack_htable_size; i++) {
-                while (!hlist_empty(&nf_conntrack_hash[i])) {
-                        h = hlist_entry(nf_conntrack_hash[i].first,
+                while (!hlist_empty(&init_net.ct.hash[i])) {
+                        h = hlist_entry(init_net.ct.hash[i].first,
                                         struct nf_conntrack_tuple_hash, hnode);
                         hlist_del_rcu(&h->hnode);
                         bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
@@ -1103,12 +1123,12 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
                 }
         }
         old_size = nf_conntrack_htable_size;
-        old_vmalloced = nf_conntrack_vmalloc;
-        old_hash = nf_conntrack_hash;
+        old_vmalloced = init_net.ct.hash_vmalloc;
+        old_hash = init_net.ct.hash;
 
         nf_conntrack_htable_size = hashsize;
-        nf_conntrack_vmalloc = vmalloced;
-        nf_conntrack_hash = hash;
+        init_net.ct.hash_vmalloc = vmalloced;
+        init_net.ct.hash = hash;
         nf_conntrack_hash_rnd = rnd;
         spin_unlock_bh(&nf_conntrack_lock);
 
@@ -1120,7 +1140,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);
 module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
                   &nf_conntrack_htable_size, 0600);
 
-int __init nf_conntrack_init(void)
+static int nf_conntrack_init_init_net(void)
 {
         int max_factor = 8;
         int ret;
@@ -1142,13 +1162,6 @@ int __init nf_conntrack_init(void)
                  * entries. */
                 max_factor = 4;
         }
-        nf_conntrack_hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
-                                                  &nf_conntrack_vmalloc);
-        if (!nf_conntrack_hash) {
-                printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
-                goto err_out;
-        }
-
         nf_conntrack_max = max_factor * nf_conntrack_htable_size;
 
         printk("nf_conntrack version %s (%u buckets, %d max)\n",
@@ -1160,48 +1173,103 @@ int __init nf_conntrack_init(void)
                                                 0, 0, NULL);
         if (!nf_conntrack_cachep) {
                 printk(KERN_ERR "Unable to create nf_conn slab cache\n");
-                goto err_free_hash;
+                ret = -ENOMEM;
+                goto err_cache;
         }
 
         ret = nf_conntrack_proto_init();
         if (ret < 0)
-                goto err_free_conntrack_slab;
-
-        ret = nf_conntrack_expect_init();
-        if (ret < 0)
-                goto out_fini_proto;
+                goto err_proto;
 
         ret = nf_conntrack_helper_init();
         if (ret < 0)
-                goto out_fini_expect;
+                goto err_helper;
 
-        ret = nf_conntrack_acct_init();
-        if (ret < 0)
-                goto out_fini_helper;
+        return 0;
 
-        /* For use by REJECT target */
-        rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
-        rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+err_helper:
+        nf_conntrack_proto_fini();
+err_proto:
+        kmem_cache_destroy(nf_conntrack_cachep);
+err_cache:
+        return ret;
+}
+
+static int nf_conntrack_init_net(struct net *net)
+{
+        int ret;
+
+        atomic_set(&net->ct.count, 0);
+        INIT_HLIST_HEAD(&net->ct.unconfirmed);
+        net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
+        if (!net->ct.stat) {
+                ret = -ENOMEM;
+                goto err_stat;
+        }
+        ret = nf_conntrack_ecache_init(net);
+        if (ret < 0)
+                goto err_ecache;
+        net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
+                                                  &net->ct.hash_vmalloc);
+        if (!net->ct.hash) {
+                ret = -ENOMEM;
+                printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
+                goto err_hash;
+        }
+        ret = nf_conntrack_expect_init(net);
+        if (ret < 0)
+                goto err_expect;
+        ret = nf_conntrack_acct_init(net);
+        if (ret < 0)
+                goto err_acct;
 
         /* Set up fake conntrack:
             - to never be deleted, not in any hashes */
+#ifdef CONFIG_NET_NS
+        nf_conntrack_untracked.ct_net = &init_net;
+#endif
         atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
         /*  - and look it like as a confirmed connection */
         set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
 
-        return ret;
+        return 0;
 
-out_fini_helper:
-        nf_conntrack_helper_fini();
-out_fini_expect:
-        nf_conntrack_expect_fini();
-out_fini_proto:
-        nf_conntrack_proto_fini();
-err_free_conntrack_slab:
-        kmem_cache_destroy(nf_conntrack_cachep);
-err_free_hash:
-        nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
+err_acct:
+        nf_conntrack_expect_fini(net);
+err_expect:
+        nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
                              nf_conntrack_htable_size);
-err_out:
-        return -ENOMEM;
+err_hash:
+        nf_conntrack_ecache_fini(net);
+err_ecache:
+        free_percpu(net->ct.stat);
+err_stat:
+        return ret;
+}
+
+int nf_conntrack_init(struct net *net)
+{
+        int ret;
+
+        if (net_eq(net, &init_net)) {
+                ret = nf_conntrack_init_init_net();
+                if (ret < 0)
+                        goto out_init_net;
+        }
+        ret = nf_conntrack_init_net(net);
+        if (ret < 0)
+                goto out_net;
+
+        if (net_eq(net, &init_net)) {
+                /* For use by REJECT target */
+                rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
+                rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+        }
+        return 0;
+
+out_net:
+        if (net_eq(net, &init_net))
+                nf_conntrack_cleanup_init_net();
+out_init_net:
+        return ret;
 }
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index 83c41ac3505b..a5f5e2e65d13 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -29,9 +29,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_chain);
 ATOMIC_NOTIFIER_HEAD(nf_ct_expect_chain);
 EXPORT_SYMBOL_GPL(nf_ct_expect_chain);
 
-DEFINE_PER_CPU(struct nf_conntrack_ecache, nf_conntrack_ecache);
-EXPORT_PER_CPU_SYMBOL_GPL(nf_conntrack_ecache);
-
 /* deliver cached events and clear cache entry - must be called with locally
  * disabled softirqs */
 static inline void
@@ -51,10 +48,11 @@ __nf_ct_deliver_cached_events(struct nf_conntrack_ecache *ecache)
  * by code prior to async packet handling for freeing the skb */
 void nf_ct_deliver_cached_events(const struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_ecache *ecache;
 
         local_bh_disable();
-        ecache = &__get_cpu_var(nf_conntrack_ecache);
+        ecache = per_cpu_ptr(net->ct.ecache, raw_smp_processor_id());
         if (ecache->ct == ct)
                 __nf_ct_deliver_cached_events(ecache);
         local_bh_enable();
@@ -64,10 +62,11 @@ EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
 /* Deliver cached events for old pending events, if current conntrack != old */
 void __nf_ct_event_cache_init(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_ecache *ecache;
 
         /* take care of delivering potentially old events */
-        ecache = &__get_cpu_var(nf_conntrack_ecache);
+        ecache = per_cpu_ptr(net->ct.ecache, raw_smp_processor_id());
         BUG_ON(ecache->ct == ct);
         if (ecache->ct)
                 __nf_ct_deliver_cached_events(ecache);
@@ -79,18 +78,31 @@ EXPORT_SYMBOL_GPL(__nf_ct_event_cache_init);
 
 /* flush the event cache - touches other CPU's data and must not be called
  * while packets are still passing through the code */
-void nf_ct_event_cache_flush(void)
+void nf_ct_event_cache_flush(struct net *net)
 {
         struct nf_conntrack_ecache *ecache;
         int cpu;
 
         for_each_possible_cpu(cpu) {
-                ecache = &per_cpu(nf_conntrack_ecache, cpu);
+                ecache = per_cpu_ptr(net->ct.ecache, cpu);
                 if (ecache->ct)
                         nf_ct_put(ecache->ct);
         }
 }
 
+int nf_conntrack_ecache_init(struct net *net)
+{
+        net->ct.ecache = alloc_percpu(struct nf_conntrack_ecache);
+        if (!net->ct.ecache)
+                return -ENOMEM;
+        return 0;
+}
+
+void nf_conntrack_ecache_fini(struct net *net)
+{
+        free_percpu(net->ct.ecache);
+}
+
 int nf_conntrack_register_notifier(struct notifier_block *nb)
 {
         return atomic_notifier_chain_register(&nf_conntrack_chain, nb);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e8f0dead267f..37a703bc3b8e 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -28,17 +28,12 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
 
-struct hlist_head *nf_ct_expect_hash __read_mostly;
-EXPORT_SYMBOL_GPL(nf_ct_expect_hash);
-
 unsigned int nf_ct_expect_hsize __read_mostly;
 EXPORT_SYMBOL_GPL(nf_ct_expect_hsize);
 
 static unsigned int nf_ct_expect_hash_rnd __read_mostly;
-static unsigned int nf_ct_expect_count;
 unsigned int nf_ct_expect_max __read_mostly;
 static int nf_ct_expect_hash_rnd_initted __read_mostly;
-static int nf_ct_expect_vmalloc;
 
 static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
 
@@ -46,18 +41,19 @@ static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
 void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
 {
         struct nf_conn_help *master_help = nfct_help(exp->master);
+        struct net *net = nf_ct_exp_net(exp);
 
         NF_CT_ASSERT(master_help);
         NF_CT_ASSERT(!timer_pending(&exp->timeout));
 
         hlist_del_rcu(&exp->hnode);
-        nf_ct_expect_count--;
+        net->ct.expect_count--;
 
         hlist_del(&exp->lnode);
         master_help->expecting[exp->class]--;
         nf_ct_expect_put(exp);
 
-        NF_CT_STAT_INC(expect_delete);
+        NF_CT_STAT_INC(net, expect_delete);
 }
 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect);
 
@@ -87,17 +83,17 @@ static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple
 }
 
 struct nf_conntrack_expect *
-__nf_ct_expect_find(const struct nf_conntrack_tuple *tuple)
+__nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
         struct hlist_node *n;
         unsigned int h;
 
-        if (!nf_ct_expect_count)
+        if (!net->ct.expect_count)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry_rcu(i, n, &nf_ct_expect_hash[h], hnode) {
+        hlist_for_each_entry_rcu(i, n, &net->ct.expect_hash[h], hnode) {
                 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
                         return i;
         }
@@ -107,12 +103,12 @@ EXPORT_SYMBOL_GPL(__nf_ct_expect_find);
 
 /* Just find a expectation corresponding to a tuple. */
 struct nf_conntrack_expect *
-nf_ct_expect_find_get(const struct nf_conntrack_tuple *tuple)
+nf_ct_expect_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
 
         rcu_read_lock();
-        i = __nf_ct_expect_find(tuple);
+        i = __nf_ct_expect_find(net, tuple);
         if (i && !atomic_inc_not_zero(&i->use))
                 i = NULL;
         rcu_read_unlock();
@@ -124,17 +120,17 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_find_get);
 /* If an expectation for this connection is found, it gets delete from
  * global list then returned. */
 struct nf_conntrack_expect *
-nf_ct_find_expectation(const struct nf_conntrack_tuple *tuple)
+nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i, *exp = NULL;
         struct hlist_node *n;
         unsigned int h;
 
-        if (!nf_ct_expect_count)
+        if (!net->ct.expect_count)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry(i, n, &nf_ct_expect_hash[h], hnode) {
+        hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
                 if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
                     nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
                         exp = i;
@@ -241,7 +237,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
 
 void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
-                       int family,
+                       u_int8_t family,
                        const union nf_inet_addr *saddr,
                        const union nf_inet_addr *daddr,
                        u_int8_t proto, const __be16 *src, const __be16 *dst)
@@ -311,6 +307,7 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_put);
 static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
 {
         struct nf_conn_help *master_help = nfct_help(exp->master);
+        struct net *net = nf_ct_exp_net(exp);
         const struct nf_conntrack_expect_policy *p;
         unsigned int h = nf_ct_expect_dst_hash(&exp->tuple);
 
@@ -319,8 +316,8 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         hlist_add_head(&exp->lnode, &master_help->expectations);
         master_help->expecting[exp->class]++;
 
-        hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]);
-        nf_ct_expect_count++;
+        hlist_add_head_rcu(&exp->hnode, &net->ct.expect_hash[h]);
+        net->ct.expect_count++;
 
         setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
                     (unsigned long)exp);
@@ -329,7 +326,7 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         add_timer(&exp->timeout);
 
         atomic_inc(&exp->use);
-        NF_CT_STAT_INC(expect_create);
+        NF_CT_STAT_INC(net, expect_create);
 }
 
 /* Race with expectations being used means we could have none to find; OK. */
@@ -371,6 +368,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
         struct nf_conntrack_expect *i;
         struct nf_conn *master = expect->master;
         struct nf_conn_help *master_help = nfct_help(master);
+        struct net *net = nf_ct_exp_net(expect);
         struct hlist_node *n;
         unsigned int h;
         int ret;
@@ -383,7 +381,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
                 goto out;
         }
         h = nf_ct_expect_dst_hash(&expect->tuple);
-        hlist_for_each_entry(i, n, &nf_ct_expect_hash[h], hnode) {
+        hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
                 if (expect_matches(i, expect)) {
                         /* Refresh timer: if it's dying, ignore.. */
                         if (refresh_timer(i)) {
@@ -406,7 +404,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
                 }
         }
 
-        if (nf_ct_expect_count >= nf_ct_expect_max) {
+        if (net->ct.expect_count >= nf_ct_expect_max) {
                 if (net_ratelimit())
                         printk(KERN_WARNING
                                "nf_conntrack: expectation table full\n");
@@ -425,16 +423,18 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_related);
 
 #ifdef CONFIG_PROC_FS
 struct ct_expect_iter_state {
+        struct seq_net_private p;
         unsigned int bucket;
 };
 
 static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_expect_iter_state *st = seq->private;
         struct hlist_node *n;
 
         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
-                n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+                n = rcu_dereference(net->ct.expect_hash[st->bucket].first);
                 if (n)
                         return n;
         }
@@ -444,13 +444,14 @@ static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
                                              struct hlist_node *head)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_expect_iter_state *st = seq->private;
 
         head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_ct_expect_hsize)
                         return NULL;
-                head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+                head = rcu_dereference(net->ct.expect_hash[st->bucket].first);
         }
         return head;
 }
@@ -524,7 +525,7 @@ static const struct seq_operations exp_seq_ops = {
 
 static int exp_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &exp_seq_ops,
+        return seq_open_net(inode, file, &exp_seq_ops,
                         sizeof(struct ct_expect_iter_state));
 }
 
@@ -533,72 +534,79 @@ static const struct file_operations exp_file_ops = {
         .open    = exp_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 #endif /* CONFIG_PROC_FS */
 
-static int __init exp_proc_init(void)
+static int exp_proc_init(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *proc;
 
-        proc = proc_net_fops_create(&init_net, "nf_conntrack_expect", 0440, &exp_file_ops);
+        proc = proc_net_fops_create(net, "nf_conntrack_expect", 0440, &exp_file_ops);
         if (!proc)
                 return -ENOMEM;
 #endif /* CONFIG_PROC_FS */
         return 0;
 }
 
-static void exp_proc_remove(void)
+static void exp_proc_remove(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        proc_net_remove(&init_net, "nf_conntrack_expect");
+        proc_net_remove(net, "nf_conntrack_expect");
 #endif /* CONFIG_PROC_FS */
 }
 
 module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
 
-int __init nf_conntrack_expect_init(void)
+int nf_conntrack_expect_init(struct net *net)
 {
         int err = -ENOMEM;
 
-        if (!nf_ct_expect_hsize) {
-                nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
-                if (!nf_ct_expect_hsize)
-                        nf_ct_expect_hsize = 1;
+        if (net_eq(net, &init_net)) {
+                if (!nf_ct_expect_hsize) {
+                        nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
+                        if (!nf_ct_expect_hsize)
+                                nf_ct_expect_hsize = 1;
+                }
+                nf_ct_expect_max = nf_ct_expect_hsize * 4;
         }
-        nf_ct_expect_max = nf_ct_expect_hsize * 4;
 
-        nf_ct_expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize,
-                                                  &nf_ct_expect_vmalloc);
-        if (nf_ct_expect_hash == NULL)
+        net->ct.expect_count = 0;
+        net->ct.expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize,
+                                                  &net->ct.expect_vmalloc);
+        if (net->ct.expect_hash == NULL)
                 goto err1;
 
-        nf_ct_expect_cachep = kmem_cache_create("nf_conntrack_expect",
+        if (net_eq(net, &init_net)) {
+                nf_ct_expect_cachep = kmem_cache_create("nf_conntrack_expect",
                                         sizeof(struct nf_conntrack_expect),
                                         0, 0, NULL);
-        if (!nf_ct_expect_cachep)
-                goto err2;
+                if (!nf_ct_expect_cachep)
+                        goto err2;
+        }
 
-        err = exp_proc_init();
+        err = exp_proc_init(net);
         if (err < 0)
                 goto err3;
 
         return 0;
 
 err3:
-        kmem_cache_destroy(nf_ct_expect_cachep);
+        if (net_eq(net, &init_net))
+                kmem_cache_destroy(nf_ct_expect_cachep);
 err2:
-        nf_ct_free_hashtable(nf_ct_expect_hash, nf_ct_expect_vmalloc,
+        nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
                              nf_ct_expect_hsize);
 err1:
         return err;
 }
 
-void nf_conntrack_expect_fini(void)
+void nf_conntrack_expect_fini(struct net *net)
 {
-        exp_proc_remove();
-        kmem_cache_destroy(nf_ct_expect_cachep);
-        nf_ct_free_hashtable(nf_ct_expect_hash, nf_ct_expect_vmalloc,
+        exp_proc_remove(net);
+        if (net_eq(net, &init_net))
+                kmem_cache_destroy(nf_ct_expect_cachep);
+        nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
                              nf_ct_expect_hsize);
 }
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index bb20672fe036..4f7107107e99 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -318,7 +318,8 @@ static int find_nl_seq(u32 seq, const struct nf_ct_ftp_master *info, int dir)
 }
 
 /* We don't update if it's older than what we have. */
-static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
+static void update_nl_seq(struct nf_conn *ct, u32 nl_seq,
+                          struct nf_ct_ftp_master *info, int dir,
                           struct sk_buff *skb)
 {
         unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
@@ -336,11 +337,11 @@ static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
 
         if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
                 info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
-                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
+                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, ct);
         } else if (oldest != NUM_SEQ_TO_REMEMBER &&
                    after(nl_seq, info->seq_aft_nl[dir][oldest])) {
                 info->seq_aft_nl[dir][oldest] = nl_seq;
-                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
+                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, ct);
         }
 }
 
@@ -509,7 +510,7 @@ out_update_nl:
         /* Now if this ends in \n, update ftp info.  Seq may have been
          * adjusted by NAT code. */
         if (ends_in_nl)
-                update_nl_seq(seq, ct_ftp_info, dir, skb);
+                update_nl_seq(ct, seq, ct_ftp_info, dir, skb);
  out:
         spin_unlock_bh(&nf_ftp_lock);
         return ret;
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 2f83c158934d..c1504f71cdff 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -709,7 +709,8 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
 /* If the calling party is on the same side of the forward-to party,
  * we don't need to track the second call */
 static int callforward_do_filter(const union nf_inet_addr *src,
-                                 const union nf_inet_addr *dst, int family)
+                                 const union nf_inet_addr *dst,
+                                 u_int8_t family)
 {
         const struct nf_afinfo *afinfo;
         struct flowi fl1, fl2;
@@ -1209,6 +1210,7 @@ static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
                                                union nf_inet_addr *addr,
                                                __be16 port)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_expect *exp;
         struct nf_conntrack_tuple tuple;
 
@@ -1218,7 +1220,7 @@ static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
         tuple.dst.u.tcp.port = port;
         tuple.dst.protonum = IPPROTO_TCP;
 
-        exp = __nf_ct_expect_find(&tuple);
+        exp = __nf_ct_expect_find(net, &tuple);
         if (exp && exp->master == ct)
                 return exp;
         return NULL;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 8e0b4c8f62a8..9c06b9f86ad4 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -123,29 +123,18 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_register);
 
-void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
+static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
+                                             struct net *net)
 {
         struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_expect *exp;
         const struct hlist_node *n, *next;
         unsigned int i;
 
-        mutex_lock(&nf_ct_helper_mutex);
-        hlist_del_rcu(&me->hnode);
-        nf_ct_helper_count--;
-        mutex_unlock(&nf_ct_helper_mutex);
-
-        /* Make sure every nothing is still using the helper unless its a
-         * connection in the hash.
-         */
-        synchronize_rcu();
-
-        spin_lock_bh(&nf_conntrack_lock);
-
         /* Get rid of expectations */
         for (i = 0; i < nf_ct_expect_hsize; i++) {
                 hlist_for_each_entry_safe(exp, n, next,
-                                          &nf_ct_expect_hash[i], hnode) {
+                                          &net->ct.expect_hash[i], hnode) {
                         struct nf_conn_help *help = nfct_help(exp->master);
                         if ((help->helper == me || exp->helper == me) &&
                             del_timer(&exp->timeout)) {
@@ -156,12 +145,31 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
         }
 
         /* Get rid of expecteds, set helpers to NULL. */
-        hlist_for_each_entry(h, n, &unconfirmed, hnode)
+        hlist_for_each_entry(h, n, &net->ct.unconfirmed, hnode)
                 unhelp(h, me);
         for (i = 0; i < nf_conntrack_htable_size; i++) {
-                hlist_for_each_entry(h, n, &nf_conntrack_hash[i], hnode)
+                hlist_for_each_entry(h, n, &net->ct.hash[i], hnode)
                         unhelp(h, me);
         }
+}
+
+void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
+{
+        struct net *net;
+
+        mutex_lock(&nf_ct_helper_mutex);
+        hlist_del_rcu(&me->hnode);
+        nf_ct_helper_count--;
+        mutex_unlock(&nf_ct_helper_mutex);
+
+        /* Make sure every nothing is still using the helper unless its a
+         * connection in the hash.
+         */
+        synchronize_rcu();
+
+        spin_lock_bh(&nf_conntrack_lock);
+        for_each_net(net)
+                __nf_conntrack_helper_unregister(me, net);
         spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index a8752031adcb..cadfd15b44f6 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -549,7 +549,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         last = (struct nf_conn *)cb->args[1];
         for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
 restart:
-                hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[cb->args[0]],
+                hlist_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
                                          hnode) {
                         if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
                                 continue;
@@ -794,14 +794,14 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
         else {
                 /* Flush the whole table */
-                nf_conntrack_flush();
+                nf_conntrack_flush(&init_net);
                 return 0;
         }
 
         if (err < 0)
                 return err;
 
-        h = nf_conntrack_find_get(&tuple);
+        h = nf_conntrack_find_get(&init_net, &tuple);
         if (!h)
                 return -ENOENT;
 
@@ -847,7 +847,7 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        h = nf_conntrack_find_get(&tuple);
+        h = nf_conntrack_find_get(&init_net, &tuple);
         if (!h)
                 return -ENOENT;
 
@@ -1125,7 +1125,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         struct nf_conn_help *help;
         struct nf_conntrack_helper *helper;
 
-        ct = nf_conntrack_alloc(otuple, rtuple, GFP_KERNEL);
+        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM;
 
@@ -1213,9 +1213,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         spin_lock_bh(&nf_conntrack_lock);
         if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(&otuple);
+                h = __nf_conntrack_find(&init_net, &otuple);
         else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(&rtuple);
+                h = __nf_conntrack_find(&init_net, &rtuple);
 
         if (h == NULL) {
                 struct nf_conntrack_tuple master;
@@ -1230,7 +1230,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         if (err < 0)
                                 goto out_unlock;
 
-                        master_h = __nf_conntrack_find(&master);
+                        master_h = __nf_conntrack_find(&init_net, &master);
                         if (master_h == NULL) {
                                 err = -ENOENT;
                                 goto out_unlock;
@@ -1458,6 +1458,7 @@ static int ctnetlink_exp_done(struct netlink_callback *cb)
 static int
 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct net *net = &init_net;
         struct nf_conntrack_expect *exp, *last;
         struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
         struct hlist_node *n;
@@ -1467,7 +1468,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         last = (struct nf_conntrack_expect *)cb->args[1];
         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry(exp, n, &nf_ct_expect_hash[cb->args[0]],
+                hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
                                      hnode) {
                         if (l3proto && exp->tuple.src.l3num != l3proto)
                                 continue;
@@ -1529,7 +1530,7 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        exp = nf_ct_expect_find_get(&tuple);
+        exp = nf_ct_expect_find_get(&init_net, &tuple);
         if (!exp)
                 return -ENOENT;
 
@@ -1583,7 +1584,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                         return err;
 
                 /* bump usage count to 2 */
-                exp = nf_ct_expect_find_get(&tuple);
+                exp = nf_ct_expect_find_get(&init_net, &tuple);
                 if (!exp)
                         return -ENOENT;
 
@@ -1613,7 +1614,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 }
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, n, next,
-                                                  &nf_ct_expect_hash[i],
+                                                  &init_net.ct.expect_hash[i],
                                                   hnode) {
                                 m_help = nfct_help(exp->master);
                                 if (m_help->helper == h
@@ -1629,7 +1630,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, n, next,
-                                                  &nf_ct_expect_hash[i],
+                                                  &init_net.ct.expect_hash[i],
                                                   hnode) {
                                 if (del_timer(&exp->timeout)) {
                                         nf_ct_unlink_expect(exp);
@@ -1670,7 +1671,7 @@ ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3)
                 return err;
 
         /* Look for master conntrack of this expectation */
-        h = nf_conntrack_find_get(&master_tuple);
+        h = nf_conntrack_find_get(&init_net, &master_tuple);
         if (!h)
                 return -ENOENT;
         ct = nf_ct_tuplehash_to_ctrack(h);
@@ -1724,7 +1725,7 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         spin_lock_bh(&nf_conntrack_lock);
-        exp = __nf_ct_expect_find(&tuple);
+        exp = __nf_ct_expect_find(&init_net, &tuple);
 
         if (!exp) {
                 spin_unlock_bh(&nf_conntrack_lock);
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 97e54b0e43a3..373e51e91ce5 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -98,6 +98,7 @@ EXPORT_SYMBOL(pptp_msg_name);
 static void pptp_expectfn(struct nf_conn *ct,
                          struct nf_conntrack_expect *exp)
 {
+        struct net *net = nf_ct_net(ct);
         typeof(nf_nat_pptp_hook_expectfn) nf_nat_pptp_expectfn;
         pr_debug("increasing timeouts\n");
 
@@ -121,7 +122,7 @@ static void pptp_expectfn(struct nf_conn *ct,
                 pr_debug("trying to unexpect other dir: ");
                 nf_ct_dump_tuple(&inv_t);
 
-                exp_other = nf_ct_expect_find_get(&inv_t);
+                exp_other = nf_ct_expect_find_get(net, &inv_t);
                 if (exp_other) {
                         /* delete other expectation.  */
                         pr_debug("found\n");
@@ -134,7 +135,8 @@ static void pptp_expectfn(struct nf_conn *ct,
         rcu_read_unlock();
 }
 
-static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
+static int destroy_sibling_or_exp(struct net *net,
+                                  const struct nf_conntrack_tuple *t)
 {
         const struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_expect *exp;
@@ -143,7 +145,7 @@ static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
         pr_debug("trying to timeout ct or exp for tuple ");
         nf_ct_dump_tuple(t);
 
-        h = nf_conntrack_find_get(t);
+        h = nf_conntrack_find_get(net, t);
         if (h)  {
                 sibling = nf_ct_tuplehash_to_ctrack(h);
                 pr_debug("setting timeout of conntrack %p to 0\n", sibling);
@@ -154,7 +156,7 @@ static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
                 nf_ct_put(sibling);
                 return 1;
         } else {
-                exp = nf_ct_expect_find_get(t);
+                exp = nf_ct_expect_find_get(net, t);
                 if (exp) {
                         pr_debug("unexpect_related of expect %p\n", exp);
                         nf_ct_unexpect_related(exp);
@@ -168,6 +170,7 @@ static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
 /* timeout GRE data connections */
 static void pptp_destroy_siblings(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         const struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_tuple t;
 
@@ -178,7 +181,7 @@ static void pptp_destroy_siblings(struct nf_conn *ct)
         t.dst.protonum = IPPROTO_GRE;
         t.src.u.gre.key = help->help.ct_pptp_info.pns_call_id;
         t.dst.u.gre.key = help->help.ct_pptp_info.pac_call_id;
-        if (!destroy_sibling_or_exp(&t))
+        if (!destroy_sibling_or_exp(net, &t))
                 pr_debug("failed to timeout original pns->pac ct/exp\n");
 
         /* try reply (pac->pns) tuple */
@@ -186,7 +189,7 @@ static void pptp_destroy_siblings(struct nf_conn *ct)
         t.dst.protonum = IPPROTO_GRE;
         t.src.u.gre.key = help->help.ct_pptp_info.pac_call_id;
         t.dst.u.gre.key = help->help.ct_pptp_info.pns_call_id;
-        if (!destroy_sibling_or_exp(&t))
+        if (!destroy_sibling_or_exp(net, &t))
                 pr_debug("failed to timeout reply pac->pns ct/exp\n");
 }
 
@@ -594,15 +597,32 @@ static struct nf_conntrack_helper pptp __read_mostly = {
         .expect_policy          = &pptp_exp_policy,
 };
 
+static void nf_conntrack_pptp_net_exit(struct net *net)
+{
+        nf_ct_gre_keymap_flush(net);
+}
+
+static struct pernet_operations nf_conntrack_pptp_net_ops = {
+        .exit = nf_conntrack_pptp_net_exit,
+};
+
 static int __init nf_conntrack_pptp_init(void)
 {
-        return nf_conntrack_helper_register(&pptp);
+        int rv;
+
+        rv = nf_conntrack_helper_register(&pptp);
+        if (rv < 0)
+                return rv;
+        rv = register_pernet_subsys(&nf_conntrack_pptp_net_ops);
+        if (rv < 0)
+                nf_conntrack_helper_unregister(&pptp);
+        return rv;
 }
 
 static void __exit nf_conntrack_pptp_fini(void)
 {
         nf_conntrack_helper_unregister(&pptp);
-        nf_ct_gre_keymap_flush();
+        unregister_pernet_subsys(&nf_conntrack_pptp_net_ops);
 }
 
 module_init(nf_conntrack_pptp_init);
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index a49fc932629b..a59a307e685d 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -207,6 +207,8 @@ EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_register);
 
 void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
 {
+        struct net *net;
+
         BUG_ON(proto->l3proto >= AF_MAX);
 
         mutex_lock(&nf_ct_proto_mutex);
@@ -219,7 +221,8 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
         synchronize_rcu();
 
         /* Remove all contrack entries for this protocol */
-        nf_ct_iterate_cleanup(kill_l3proto, proto);
+        for_each_net(net)
+                nf_ct_iterate_cleanup(net, kill_l3proto, proto);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
 
@@ -316,6 +319,8 @@ EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_register);
 
 void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
 {
+        struct net *net;
+
         BUG_ON(l4proto->l3proto >= PF_MAX);
 
         mutex_lock(&nf_ct_proto_mutex);
@@ -328,7 +333,8 @@ void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
         synchronize_rcu();
 
         /* Remove all contrack entries for this protocol */
-        nf_ct_iterate_cleanup(kill_l4proto, l4proto);
+        for_each_net(net)
+                nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
 
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index e7866dd3cde6..8fcf1762fabf 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -418,6 +418,7 @@ static bool dccp_invert_tuple(struct nf_conntrack_tuple *inv,
 static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
                      unsigned int dataoff)
 {
+        struct net *net = nf_ct_net(ct);
         struct dccp_hdr _dh, *dh;
         const char *msg;
         u_int8_t state;
@@ -445,7 +446,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
         return true;
 
 out_invalid:
-        if (LOG_INVALID(IPPROTO_DCCP))
+        if (LOG_INVALID(net, IPPROTO_DCCP))
                 nf_log_packet(nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, msg);
         return false;
 }
@@ -461,8 +462,9 @@ static u64 dccp_ack_seq(const struct dccp_hdr *dh)
 
 static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
                        unsigned int dataoff, enum ip_conntrack_info ctinfo,
-                       int pf, unsigned int hooknum)
+                       u_int8_t pf, unsigned int hooknum)
 {
+        struct net *net = nf_ct_net(ct);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         struct dccp_hdr _dh, *dh;
         u_int8_t type, old_state, new_state;
@@ -524,13 +526,13 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
                 ct->proto.dccp.last_pkt = type;
 
                 write_unlock_bh(&dccp_lock);
-                if (LOG_INVALID(IPPROTO_DCCP))
+                if (LOG_INVALID(net, IPPROTO_DCCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_dccp: invalid packet ignored ");
                 return NF_ACCEPT;
         case CT_DCCP_INVALID:
                 write_unlock_bh(&dccp_lock);
-                if (LOG_INVALID(IPPROTO_DCCP))
+                if (LOG_INVALID(net, IPPROTO_DCCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_dccp: invalid state transition ");
                 return -NF_ACCEPT;
@@ -545,9 +547,9 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
-static int dccp_error(struct sk_buff *skb, unsigned int dataoff,
-                      enum ip_conntrack_info *ctinfo, int pf,
-                      unsigned int hooknum)
+static int dccp_error(struct net *net, struct sk_buff *skb,
+                      unsigned int dataoff, enum ip_conntrack_info *ctinfo,
+                      u_int8_t pf, unsigned int hooknum)
 {
         struct dccp_hdr _dh, *dh;
         unsigned int dccp_len = skb->len - dataoff;
@@ -575,7 +577,7 @@ static int dccp_error(struct sk_buff *skb, unsigned int dataoff,
                 }
         }
 
-        if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_DCCP,
                                 pf)) {
                 msg = "nf_ct_dccp: bad checksum ";
@@ -590,7 +592,7 @@ static int dccp_error(struct sk_buff *skb, unsigned int dataoff,
         return NF_ACCEPT;
 
 out_invalid:
-        if (LOG_INVALID(IPPROTO_DCCP))
+        if (LOG_INVALID(net, IPPROTO_DCCP))
                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL, msg);
         return -NF_ACCEPT;
 }
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index e31b0e7bd0b1..dbe680af85d2 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -45,7 +45,7 @@ static int packet(struct nf_conn *ct,
                   const struct sk_buff *skb,
                   unsigned int dataoff,
                   enum ip_conntrack_info ctinfo,
-                  int pf,
+                  u_int8_t pf,
                   unsigned int hooknum)
 {
         nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_generic_timeout);
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 9bd03967fea4..a2cdbcbf64c4 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -29,8 +29,11 @@
 #include <linux/list.h>
 #include <linux/seq_file.h>
 #include <linux/in.h>
+#include <linux/netdevice.h>
 #include <linux/skbuff.h>
-
+#include <net/dst.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_core.h>
@@ -40,19 +43,23 @@
 #define GRE_TIMEOUT             (30 * HZ)
 #define GRE_STREAM_TIMEOUT      (180 * HZ)
 
-static DEFINE_RWLOCK(nf_ct_gre_lock);
-static LIST_HEAD(gre_keymap_list);
+static int proto_gre_net_id;
+struct netns_proto_gre {
+        rwlock_t                keymap_lock;
+        struct list_head        keymap_list;
+};
 
-void nf_ct_gre_keymap_flush(void)
+void nf_ct_gre_keymap_flush(struct net *net)
 {
+        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
         struct nf_ct_gre_keymap *km, *tmp;
 
-        write_lock_bh(&nf_ct_gre_lock);
-        list_for_each_entry_safe(km, tmp, &gre_keymap_list, list) {
+        write_lock_bh(&net_gre->keymap_lock);
+        list_for_each_entry_safe(km, tmp, &net_gre->keymap_list, list) {
                 list_del(&km->list);
                 kfree(km);
         }
-        write_unlock_bh(&nf_ct_gre_lock);
+        write_unlock_bh(&net_gre->keymap_lock);
 }
 EXPORT_SYMBOL(nf_ct_gre_keymap_flush);
 
@@ -67,19 +74,20 @@ static inline int gre_key_cmpfn(const struct nf_ct_gre_keymap *km,
 }
 
 /* look up the source key for a given tuple */
-static __be16 gre_keymap_lookup(struct nf_conntrack_tuple *t)
+static __be16 gre_keymap_lookup(struct net *net, struct nf_conntrack_tuple *t)
 {
+        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
         struct nf_ct_gre_keymap *km;
         __be16 key = 0;
 
-        read_lock_bh(&nf_ct_gre_lock);
-        list_for_each_entry(km, &gre_keymap_list, list) {
+        read_lock_bh(&net_gre->keymap_lock);
+        list_for_each_entry(km, &net_gre->keymap_list, list) {
                 if (gre_key_cmpfn(km, t)) {
                         key = km->tuple.src.u.gre.key;
                         break;
                 }
         }
-        read_unlock_bh(&nf_ct_gre_lock);
+        read_unlock_bh(&net_gre->keymap_lock);
 
         pr_debug("lookup src key 0x%x for ", key);
         nf_ct_dump_tuple(t);
@@ -91,20 +99,22 @@ static __be16 gre_keymap_lookup(struct nf_conntrack_tuple *t)
 int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
                          struct nf_conntrack_tuple *t)
 {
+        struct net *net = nf_ct_net(ct);
+        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_ct_gre_keymap **kmp, *km;
 
         kmp = &help->help.ct_pptp_info.keymap[dir];
         if (*kmp) {
                 /* check whether it's a retransmission */
-                read_lock_bh(&nf_ct_gre_lock);
-                list_for_each_entry(km, &gre_keymap_list, list) {
+                read_lock_bh(&net_gre->keymap_lock);
+                list_for_each_entry(km, &net_gre->keymap_list, list) {
                         if (gre_key_cmpfn(km, t) && km == *kmp) {
-                                read_unlock_bh(&nf_ct_gre_lock);
+                                read_unlock_bh(&net_gre->keymap_lock);
                                 return 0;
                         }
                 }
-                read_unlock_bh(&nf_ct_gre_lock);
+                read_unlock_bh(&net_gre->keymap_lock);
                 pr_debug("trying to override keymap_%s for ct %p\n",
                          dir == IP_CT_DIR_REPLY ? "reply" : "orig", ct);
                 return -EEXIST;
@@ -119,9 +129,9 @@ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
         pr_debug("adding new entry %p: ", km);
         nf_ct_dump_tuple(&km->tuple);
 
-        write_lock_bh(&nf_ct_gre_lock);
-        list_add_tail(&km->list, &gre_keymap_list);
-        write_unlock_bh(&nf_ct_gre_lock);
+        write_lock_bh(&net_gre->keymap_lock);
+        list_add_tail(&km->list, &net_gre->keymap_list);
+        write_unlock_bh(&net_gre->keymap_lock);
 
         return 0;
 }
@@ -130,12 +140,14 @@ EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_add);
 /* destroy the keymap entries associated with specified master ct */
 void nf_ct_gre_keymap_destroy(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
+        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
         struct nf_conn_help *help = nfct_help(ct);
         enum ip_conntrack_dir dir;
 
         pr_debug("entering for ct %p\n", ct);
 
-        write_lock_bh(&nf_ct_gre_lock);
+        write_lock_bh(&net_gre->keymap_lock);
         for (dir = IP_CT_DIR_ORIGINAL; dir < IP_CT_DIR_MAX; dir++) {
                 if (help->help.ct_pptp_info.keymap[dir]) {
                         pr_debug("removing %p from list\n",
@@ -145,7 +157,7 @@ void nf_ct_gre_keymap_destroy(struct nf_conn *ct)
                         help->help.ct_pptp_info.keymap[dir] = NULL;
                 }
         }
-        write_unlock_bh(&nf_ct_gre_lock);
+        write_unlock_bh(&net_gre->keymap_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_destroy);
 
@@ -164,6 +176,7 @@ static bool gre_invert_tuple(struct nf_conntrack_tuple *tuple,
 static bool gre_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
                              struct nf_conntrack_tuple *tuple)
 {
+        struct net *net = dev_net(skb->dev ? skb->dev : skb->dst->dev);
         const struct gre_hdr_pptp *pgrehdr;
         struct gre_hdr_pptp _pgrehdr;
         __be16 srckey;
@@ -190,7 +203,7 @@ static bool gre_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
         }
 
         tuple->dst.u.gre.key = pgrehdr->call_id;
-        srckey = gre_keymap_lookup(tuple);
+        srckey = gre_keymap_lookup(net, tuple);
         tuple->src.u.gre.key = srckey;
 
         return true;
@@ -219,7 +232,7 @@ static int gre_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      int pf,
+                      u_int8_t pf,
                       unsigned int hooknum)
 {
         /* If we've seen traffic both ways, this is a GRE connection.
@@ -229,7 +242,7 @@ static int gre_packet(struct nf_conn *ct,
                                    ct->proto.gre.stream_timeout);
                 /* Also, more likely to be important, and not a probe. */
                 set_bit(IPS_ASSURED_BIT, &ct->status);
-                nf_conntrack_event_cache(IPCT_STATUS, skb);
+                nf_conntrack_event_cache(IPCT_STATUS, ct);
         } else
                 nf_ct_refresh_acct(ct, ctinfo, skb,
                                    ct->proto.gre.timeout);
@@ -285,15 +298,53 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
 #endif
 };
 
+static int proto_gre_net_init(struct net *net)
+{
+        struct netns_proto_gre *net_gre;
+        int rv;
+
+        net_gre = kmalloc(sizeof(struct netns_proto_gre), GFP_KERNEL);
+        if (!net_gre)
+                return -ENOMEM;
+        rwlock_init(&net_gre->keymap_lock);
+        INIT_LIST_HEAD(&net_gre->keymap_list);
+
+        rv = net_assign_generic(net, proto_gre_net_id, net_gre);
+        if (rv < 0)
+                kfree(net_gre);
+        return rv;
+}
+
+static void proto_gre_net_exit(struct net *net)
+{
+        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
+
+        nf_ct_gre_keymap_flush(net);
+        kfree(net_gre);
+}
+
+static struct pernet_operations proto_gre_net_ops = {
+        .init = proto_gre_net_init,
+        .exit = proto_gre_net_exit,
+};
+
 static int __init nf_ct_proto_gre_init(void)
 {
-        return nf_conntrack_l4proto_register(&nf_conntrack_l4proto_gre4);
+        int rv;
+
+        rv = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_gre4);
+        if (rv < 0)
+                return rv;
+        rv = register_pernet_gen_device(&proto_gre_net_id, &proto_gre_net_ops);
+        if (rv < 0)
+                nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
+        return rv;
 }
 
 static void nf_ct_proto_gre_fini(void)
 {
         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
-        nf_ct_gre_keymap_flush();
+        unregister_pernet_gen_device(proto_gre_net_id, &proto_gre_net_ops);
 }
 
 module_init(nf_ct_proto_gre_init);
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 30aa5b94a771..ae8c2609e230 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -287,7 +287,7 @@ static int sctp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
-                       int pf,
+                       u_int8_t pf,
                        unsigned int hooknum)
 {
         enum sctp_conntrack new_state, old_state;
@@ -369,7 +369,7 @@ static int sctp_packet(struct nf_conn *ct,
 
                 ct->proto.sctp.state = new_state;
                 if (old_state != new_state)
-                        nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
+                        nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
         }
         write_unlock_bh(&sctp_lock);
 
@@ -380,7 +380,7 @@ static int sctp_packet(struct nf_conn *ct,
             new_state == SCTP_CONNTRACK_ESTABLISHED) {
                 pr_debug("Setting assured bit\n");
                 set_bit(IPS_ASSURED_BIT, &ct->status);
-                nf_conntrack_event_cache(IPCT_STATUS, skb);
+                nf_conntrack_event_cache(IPCT_STATUS, ct);
         }
 
         return NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 6f61261888ef..f947ec41e391 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -486,8 +486,9 @@ static bool tcp_in_window(const struct nf_conn *ct,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
                           const struct tcphdr *tcph,
-                          int pf)
+                          u_int8_t pf)
 {
+        struct net *net = nf_ct_net(ct);
         struct ip_ct_tcp_state *sender = &state->seen[dir];
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
@@ -668,7 +669,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
                     nf_ct_tcp_be_liberal)
                         res = true;
-                if (!res && LOG_INVALID(IPPROTO_TCP))
+                if (!res && LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                         "nf_ct_tcp: %s ",
                         before(seq, sender->td_maxend + 1) ?
@@ -746,10 +747,11 @@ static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 };
 
 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
-static int tcp_error(struct sk_buff *skb,
+static int tcp_error(struct net *net,
+                     struct sk_buff *skb,
                      unsigned int dataoff,
                      enum ip_conntrack_info *ctinfo,
-                     int pf,
+                     u_int8_t pf,
                      unsigned int hooknum)
 {
         const struct tcphdr *th;
@@ -760,7 +762,7 @@ static int tcp_error(struct sk_buff *skb,
         /* Smaller that minimal TCP header? */
         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
         if (th == NULL) {
-                if (LOG_INVALID(IPPROTO_TCP))
+                if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                 "nf_ct_tcp: short packet ");
                 return -NF_ACCEPT;
@@ -768,7 +770,7 @@ static int tcp_error(struct sk_buff *skb,
 
         /* Not whole TCP header or malformed packet */
         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
-                if (LOG_INVALID(IPPROTO_TCP))
+                if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                 "nf_ct_tcp: truncated/malformed packet ");
                 return -NF_ACCEPT;
@@ -779,9 +781,9 @@ static int tcp_error(struct sk_buff *skb,
          * because the checksum is assumed to be correct.
          */
         /* FIXME: Source route IP option packets --RR */
-        if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
-                if (LOG_INVALID(IPPROTO_TCP))
+                if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                   "nf_ct_tcp: bad TCP checksum ");
                 return -NF_ACCEPT;
@@ -790,7 +792,7 @@ static int tcp_error(struct sk_buff *skb,
         /* Check TCP flags. */
         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
         if (!tcp_valid_flags[tcpflags]) {
-                if (LOG_INVALID(IPPROTO_TCP))
+                if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                   "nf_ct_tcp: invalid TCP flag combination ");
                 return -NF_ACCEPT;
@@ -804,9 +806,10 @@ static int tcp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      int pf,
+                      u_int8_t pf,
                       unsigned int hooknum)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_tuple *tuple;
         enum tcp_conntrack new_state, old_state;
         enum ip_conntrack_dir dir;
@@ -885,7 +888,7 @@ static int tcp_packet(struct nf_conn *ct,
                          * thus initiate a clean new session.
                          */
                         write_unlock_bh(&tcp_lock);
-                        if (LOG_INVALID(IPPROTO_TCP))
+                        if (LOG_INVALID(net, IPPROTO_TCP))
                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                           "nf_ct_tcp: killing out of sync session ");
                         nf_ct_kill(ct);
@@ -898,7 +901,7 @@ static int tcp_packet(struct nf_conn *ct,
                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
 
                 write_unlock_bh(&tcp_lock);
-                if (LOG_INVALID(IPPROTO_TCP))
+                if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                   "nf_ct_tcp: invalid packet ignored ");
                 return NF_ACCEPT;
@@ -907,7 +910,7 @@ static int tcp_packet(struct nf_conn *ct,
                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
                          dir, get_conntrack_index(th), old_state);
                 write_unlock_bh(&tcp_lock);
-                if (LOG_INVALID(IPPROTO_TCP))
+                if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                   "nf_ct_tcp: invalid state ");
                 return -NF_ACCEPT;
@@ -968,9 +971,9 @@ static int tcp_packet(struct nf_conn *ct,
                 timeout = tcp_timeouts[new_state];
         write_unlock_bh(&tcp_lock);
 
-        nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
+        nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, ct);
         if (new_state != old_state)
-                nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
+                nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 
         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
                 /* If only reply is a RST, we can consider ourselves not to
@@ -989,7 +992,7 @@ static int tcp_packet(struct nf_conn *ct,
                    after SYN_RECV or a valid answer for a picked up
                    connection. */
                 set_bit(IPS_ASSURED_BIT, &ct->status);
-                nf_conntrack_event_cache(IPCT_STATUS, skb);
+                nf_conntrack_event_cache(IPCT_STATUS, ct);
         }
         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
 
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 8b21762e65de..7c2ca48698be 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -66,7 +66,7 @@ static int udp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      int pf,
+                      u_int8_t pf,
                       unsigned int hooknum)
 {
         /* If we've seen traffic both ways, this is some kind of UDP
@@ -75,7 +75,7 @@ static int udp_packet(struct nf_conn *ct,
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
                 /* Also, more likely to be important, and not a probe */
                 if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
-                        nf_conntrack_event_cache(IPCT_STATUS, skb);
+                        nf_conntrack_event_cache(IPCT_STATUS, ct);
         } else
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);
 
@@ -89,9 +89,9 @@ static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb,
         return true;
 }
 
-static int udp_error(struct sk_buff *skb, unsigned int dataoff,
+static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
                      enum ip_conntrack_info *ctinfo,
-                     int pf,
+                     u_int8_t pf,
                      unsigned int hooknum)
 {
         unsigned int udplen = skb->len - dataoff;
@@ -101,7 +101,7 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
         /* Header is too small? */
         hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (hdr == NULL) {
-                if (LOG_INVALID(IPPROTO_UDP))
+                if (LOG_INVALID(net, IPPROTO_UDP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_udp: short packet ");
                 return -NF_ACCEPT;
@@ -109,7 +109,7 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
 
         /* Truncated/malformed packets */
         if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
-                if (LOG_INVALID(IPPROTO_UDP))
+                if (LOG_INVALID(net, IPPROTO_UDP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                 "nf_ct_udp: truncated/malformed packet ");
                 return -NF_ACCEPT;
@@ -123,9 +123,9 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
          * We skip checking packets on the outgoing path
          * because the checksum is assumed to be correct.
          * FIXME: Source route IP option packets --RR */
-        if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
-                if (LOG_INVALID(IPPROTO_UDP))
+                if (LOG_INVALID(net, IPPROTO_UDP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                 "nf_ct_udp: bad UDP checksum ");
                 return -NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 1fa62f3c24f1..d22d839e4f94 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -65,7 +65,7 @@ static int udplite_packet(struct nf_conn *ct,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
                           enum ip_conntrack_info ctinfo,
-                          int pf,
+                          u_int8_t pf,
                           unsigned int hooknum)
 {
         /* If we've seen traffic both ways, this is some kind of UDP
@@ -75,7 +75,7 @@ static int udplite_packet(struct nf_conn *ct,
                                    nf_ct_udplite_timeout_stream);
                 /* Also, more likely to be important, and not a probe */
                 if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
-                        nf_conntrack_event_cache(IPCT_STATUS, skb);
+                        nf_conntrack_event_cache(IPCT_STATUS, ct);
         } else
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);
 
@@ -89,9 +89,11 @@ static bool udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
         return true;
 }
 
-static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
+static int udplite_error(struct net *net,
+                         struct sk_buff *skb,
+                         unsigned int dataoff,
                          enum ip_conntrack_info *ctinfo,
-                         int pf,
+                         u_int8_t pf,
                          unsigned int hooknum)
 {
         unsigned int udplen = skb->len - dataoff;
@@ -102,7 +104,7 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
         /* Header is too small? */
         hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (hdr == NULL) {
-                if (LOG_INVALID(IPPROTO_UDPLITE))
+                if (LOG_INVALID(net, IPPROTO_UDPLITE))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_udplite: short packet ");
                 return -NF_ACCEPT;
@@ -112,7 +114,7 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
         if (cscov == 0)
                 cscov = udplen;
         else if (cscov < sizeof(*hdr) || cscov > udplen) {
-                if (LOG_INVALID(IPPROTO_UDPLITE))
+                if (LOG_INVALID(net, IPPROTO_UDPLITE))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                 "nf_ct_udplite: invalid checksum coverage ");
                 return -NF_ACCEPT;
@@ -120,17 +122,17 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
 
         /* UDPLITE mandates checksums */
         if (!hdr->check) {
-                if (LOG_INVALID(IPPROTO_UDPLITE))
+                if (LOG_INVALID(net, IPPROTO_UDPLITE))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_udplite: checksum missing ");
                 return -NF_ACCEPT;
         }
 
         /* Checksum invalid? Ignore. */
-        if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
+        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
                                 pf)) {
-                if (LOG_INVALID(IPPROTO_UDPLITE))
+                if (LOG_INVALID(net, IPPROTO_UDPLITE))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_udplite: bad UDPLite checksum ");
                 return -NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 1fa306be60fb..6813f1c8863f 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -736,6 +736,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
         struct nf_conntrack_expect *exp, *rtp_exp, *rtcp_exp;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        struct net *net = nf_ct_net(ct);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         union nf_inet_addr *saddr;
         struct nf_conntrack_tuple tuple;
@@ -775,7 +776,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
 
         rcu_read_lock();
         do {
-                exp = __nf_ct_expect_find(&tuple);
+                exp = __nf_ct_expect_find(net, &tuple);
 
                 if (!exp || exp->master == ct ||
                     nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 8509db14670b..98106d4e89f0 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -40,18 +40,20 @@ print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
 EXPORT_SYMBOL_GPL(print_tuple);
 
 struct ct_iter_state {
+        struct seq_net_private p;
         unsigned int bucket;
 };
 
 static struct hlist_node *ct_get_first(struct seq_file *seq)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_iter_state *st = seq->private;
         struct hlist_node *n;
 
         for (st->bucket = 0;
              st->bucket < nf_conntrack_htable_size;
              st->bucket++) {
-                n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                n = rcu_dereference(net->ct.hash[st->bucket].first);
                 if (n)
                         return n;
         }
@@ -61,13 +63,14 @@ static struct hlist_node *ct_get_first(struct seq_file *seq)
 static struct hlist_node *ct_get_next(struct seq_file *seq,
                                       struct hlist_node *head)
 {
+        struct net *net = seq_file_net(seq);
         struct ct_iter_state *st = seq->private;
 
         head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_conntrack_htable_size)
                         return NULL;
-                head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                head = rcu_dereference(net->ct.hash[st->bucket].first);
         }
         return head;
 }
@@ -177,7 +180,7 @@ static const struct seq_operations ct_seq_ops = {
 
 static int ct_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &ct_seq_ops,
+        return seq_open_net(inode, file, &ct_seq_ops,
                         sizeof(struct ct_iter_state));
 }
 
@@ -186,11 +189,12 @@ static const struct file_operations ct_file_ops = {
         .open    = ct_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 
 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 {
+        struct net *net = seq_file_net(seq);
         int cpu;
 
         if (*pos == 0)
@@ -200,7 +204,7 @@ static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
                 if (!cpu_possible(cpu))
                         continue;
                 *pos = cpu + 1;
-                return &per_cpu(nf_conntrack_stat, cpu);
+                return per_cpu_ptr(net->ct.stat, cpu);
         }
 
         return NULL;
@@ -208,13 +212,14 @@ static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 
 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
+        struct net *net = seq_file_net(seq);
         int cpu;
 
         for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
                 if (!cpu_possible(cpu))
                         continue;
                 *pos = cpu + 1;
-                return &per_cpu(nf_conntrack_stat, cpu);
+                return per_cpu_ptr(net->ct.stat, cpu);
         }
 
         return NULL;
@@ -226,7 +231,8 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 
 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 {
-        unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
+        struct net *net = seq_file_net(seq);
+        unsigned int nr_conntracks = atomic_read(&net->ct.count);
         const struct ip_conntrack_stat *st = v;
 
         if (v == SEQ_START_TOKEN) {
@@ -266,7 +272,8 @@ static const struct seq_operations ct_cpu_seq_ops = {
 
 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &ct_cpu_seq_ops);
+        return seq_open_net(inode, file, &ct_cpu_seq_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations ct_cpu_seq_fops = {
@@ -274,56 +281,52 @@ static const struct file_operations ct_cpu_seq_fops = {
         .open    = ct_cpu_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 
-static int nf_conntrack_standalone_init_proc(void)
+static int nf_conntrack_standalone_init_proc(struct net *net)
 {
         struct proc_dir_entry *pde;
 
-        pde = proc_net_fops_create(&init_net, "nf_conntrack", 0440, &ct_file_ops);
+        pde = proc_net_fops_create(net, "nf_conntrack", 0440, &ct_file_ops);
         if (!pde)
                 goto out_nf_conntrack;
 
-        pde = proc_create("nf_conntrack", S_IRUGO, init_net.proc_net_stat,
+        pde = proc_create("nf_conntrack", S_IRUGO, net->proc_net_stat,
                           &ct_cpu_seq_fops);
         if (!pde)
                 goto out_stat_nf_conntrack;
         return 0;
 
 out_stat_nf_conntrack:
-        proc_net_remove(&init_net, "nf_conntrack");
+        proc_net_remove(net, "nf_conntrack");
 out_nf_conntrack:
         return -ENOMEM;
 }
 
-static void nf_conntrack_standalone_fini_proc(void)
+static void nf_conntrack_standalone_fini_proc(struct net *net)
 {
-        remove_proc_entry("nf_conntrack", init_net.proc_net_stat);
-        proc_net_remove(&init_net, "nf_conntrack");
+        remove_proc_entry("nf_conntrack", net->proc_net_stat);
+        proc_net_remove(net, "nf_conntrack");
 }
 #else
-static int nf_conntrack_standalone_init_proc(void)
+static int nf_conntrack_standalone_init_proc(struct net *net)
 {
         return 0;
 }
 
-static void nf_conntrack_standalone_fini_proc(void)
+static void nf_conntrack_standalone_fini_proc(struct net *net)
 {
 }
 #endif /* CONFIG_PROC_FS */
 
 /* Sysctl support */
 
-int nf_conntrack_checksum __read_mostly = 1;
-EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
-
 #ifdef CONFIG_SYSCTL
 /* Log invalid packets of a given protocol */
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
-static struct ctl_table_header *nf_ct_sysctl_header;
 static struct ctl_table_header *nf_ct_netfilter_header;
 
 static ctl_table nf_ct_sysctl_table[] = {
@@ -338,7 +341,7 @@ static ctl_table nf_ct_sysctl_table[] = {
         {
                 .ctl_name       = NET_NF_CONNTRACK_COUNT,
                 .procname       = "nf_conntrack_count",
-                .data           = &nf_conntrack_count,
+                .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
                 .proc_handler   = &proc_dointvec,
@@ -354,7 +357,7 @@ static ctl_table nf_ct_sysctl_table[] = {
         {
                 .ctl_name       = NET_NF_CONNTRACK_CHECKSUM,
                 .procname       = "nf_conntrack_checksum",
-                .data           = &nf_conntrack_checksum,
+                .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
@@ -362,7 +365,7 @@ static ctl_table nf_ct_sysctl_table[] = {
         {
                 .ctl_name       = NET_NF_CONNTRACK_LOG_INVALID,
                 .procname       = "nf_conntrack_log_invalid",
-                .data           = &nf_ct_log_invalid,
+                .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec_minmax,
@@ -400,74 +403,109 @@ static struct ctl_path nf_ct_path[] = {
         { }
 };
 
-EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
-
-static int nf_conntrack_standalone_init_sysctl(void)
+static int nf_conntrack_standalone_init_sysctl(struct net *net)
 {
-        nf_ct_netfilter_header =
-                register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
-        if (!nf_ct_netfilter_header)
-                goto out;
-
-        nf_ct_sysctl_header =
-                 register_sysctl_paths(nf_net_netfilter_sysctl_path,
-                                        nf_ct_sysctl_table);
-        if (!nf_ct_sysctl_header)
+        struct ctl_table *table;
+
+        if (net_eq(net, &init_net)) {
+                nf_ct_netfilter_header =
+                       register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
+                if (!nf_ct_netfilter_header)
+                        goto out;
+        }
+
+        table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
+                        GFP_KERNEL);
+        if (!table)
+                goto out_kmemdup;
+
+        table[1].data = &net->ct.count;
+        table[3].data = &net->ct.sysctl_checksum;
+        table[4].data = &net->ct.sysctl_log_invalid;
+
+        net->ct.sysctl_header = register_net_sysctl_table(net,
+                                        nf_net_netfilter_sysctl_path, table);
+        if (!net->ct.sysctl_header)
                 goto out_unregister_netfilter;
 
         return 0;
 
 out_unregister_netfilter:
-        unregister_sysctl_table(nf_ct_netfilter_header);
+        kfree(table);
+out_kmemdup:
+        if (net_eq(net, &init_net))
+                unregister_sysctl_table(nf_ct_netfilter_header);
 out:
         printk("nf_conntrack: can't register to sysctl.\n");
         return -ENOMEM;
 }
 
-static void nf_conntrack_standalone_fini_sysctl(void)
+static void nf_conntrack_standalone_fini_sysctl(struct net *net)
 {
-        unregister_sysctl_table(nf_ct_netfilter_header);
-        unregister_sysctl_table(nf_ct_sysctl_header);
+        struct ctl_table *table;
+
+        if (net_eq(net, &init_net))
+                unregister_sysctl_table(nf_ct_netfilter_header);
+        table = net->ct.sysctl_header->ctl_table_arg;
+        unregister_net_sysctl_table(net->ct.sysctl_header);
+        kfree(table);
 }
 #else
-static int nf_conntrack_standalone_init_sysctl(void)
+static int nf_conntrack_standalone_init_sysctl(struct net *net)
 {
         return 0;
 }
 
-static void nf_conntrack_standalone_fini_sysctl(void)
+static void nf_conntrack_standalone_fini_sysctl(struct net *net)
 {
 }
 #endif /* CONFIG_SYSCTL */
 
-static int __init nf_conntrack_standalone_init(void)
+static int nf_conntrack_net_init(struct net *net)
 {
         int ret;
 
-        ret = nf_conntrack_init();
+        ret = nf_conntrack_init(net);
         if (ret < 0)
-                goto out;
-        ret = nf_conntrack_standalone_init_proc();
+                goto out_init;
+        ret = nf_conntrack_standalone_init_proc(net);
         if (ret < 0)
                 goto out_proc;
-        ret = nf_conntrack_standalone_init_sysctl();
+        net->ct.sysctl_checksum = 1;
+        net->ct.sysctl_log_invalid = 0;
+        ret = nf_conntrack_standalone_init_sysctl(net);
         if (ret < 0)
                 goto out_sysctl;
         return 0;
 
 out_sysctl:
-        nf_conntrack_standalone_fini_proc();
+        nf_conntrack_standalone_fini_proc(net);
 out_proc:
-        nf_conntrack_cleanup();
-out:
+        nf_conntrack_cleanup(net);
+out_init:
         return ret;
 }
 
+static void nf_conntrack_net_exit(struct net *net)
+{
+        nf_conntrack_standalone_fini_sysctl(net);
+        nf_conntrack_standalone_fini_proc(net);
+        nf_conntrack_cleanup(net);
+}
+
+static struct pernet_operations nf_conntrack_net_ops = {
+        .init = nf_conntrack_net_init,
+        .exit = nf_conntrack_net_exit,
+};
+
+static int __init nf_conntrack_standalone_init(void)
+{
+        return register_pernet_subsys(&nf_conntrack_net_ops);
+}
+
 static void __exit nf_conntrack_standalone_fini(void)
 {
-        nf_conntrack_standalone_fini_sysctl();
-        nf_conntrack_standalone_fini_proc();
-        nf_conntrack_cleanup();
+        unregister_pernet_subsys(&nf_conntrack_net_ops);
 }
 
 module_init(nf_conntrack_standalone_init);
diff --git a/net/netfilter/nf_internals.h b/net/netfilter/nf_internals.h
index 196269c1e586..bf6609978af7 100644
--- a/net/netfilter/nf_internals.h
+++ b/net/netfilter/nf_internals.h
@@ -15,7 +15,7 @@
 /* core.c */
 extern unsigned int nf_iterate(struct list_head *head,
                                 struct sk_buff *skb,
-                                int hook,
+                                unsigned int hook,
                                 const struct net_device *indev,
                                 const struct net_device *outdev,
                                 struct list_head **i,
@@ -25,7 +25,7 @@ extern unsigned int nf_iterate(struct list_head *head,
 /* nf_queue.c */
 extern int nf_queue(struct sk_buff *skb,
                     struct list_head *elem,
-                    int pf, unsigned int hook,
+                    u_int8_t pf, unsigned int hook,
                     struct net_device *indev,
                     struct net_device *outdev,
                     int (*okfn)(struct sk_buff *),
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 9fda6ee95a31..fa8ae5d2659c 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -15,16 +15,16 @@
 
 #define NF_LOG_PREFIXLEN                128
 
-static const struct nf_logger *nf_loggers[NPROTO] __read_mostly;
+static const struct nf_logger *nf_loggers[NFPROTO_NUMPROTO] __read_mostly;
 static DEFINE_MUTEX(nf_log_mutex);
 
 /* return EBUSY if somebody else is registered, EEXIST if the same logger
  * is registred, 0 on success. */
-int nf_log_register(int pf, const struct nf_logger *logger)
+int nf_log_register(u_int8_t pf, const struct nf_logger *logger)
 {
         int ret;
 
-        if (pf >= NPROTO)
+        if (pf >= ARRAY_SIZE(nf_loggers))
                 return -EINVAL;
 
         /* Any setup of logging members must be done before
@@ -45,9 +45,9 @@ int nf_log_register(int pf, const struct nf_logger *logger)
 }
 EXPORT_SYMBOL(nf_log_register);
 
-void nf_log_unregister_pf(int pf)
+void nf_log_unregister_pf(u_int8_t pf)
 {
-        if (pf >= NPROTO)
+        if (pf >= ARRAY_SIZE(nf_loggers))
                 return;
         mutex_lock(&nf_log_mutex);
         rcu_assign_pointer(nf_loggers[pf], NULL);
@@ -63,7 +63,7 @@ void nf_log_unregister(const struct nf_logger *logger)
         int i;
 
         mutex_lock(&nf_log_mutex);
-        for (i = 0; i < NPROTO; i++) {
+        for (i = 0; i < ARRAY_SIZE(nf_loggers); i++) {
                 if (nf_loggers[i] == logger)
                         rcu_assign_pointer(nf_loggers[i], NULL);
         }
@@ -73,7 +73,7 @@ void nf_log_unregister(const struct nf_logger *logger)
 }
 EXPORT_SYMBOL(nf_log_unregister);
 
-void nf_log_packet(int pf,
+void nf_log_packet(u_int8_t pf,
                    unsigned int hooknum,
                    const struct sk_buff *skb,
                    const struct net_device *in,
@@ -103,7 +103,7 @@ static void *seq_start(struct seq_file *seq, loff_t *pos)
 {
         rcu_read_lock();
 
-        if (*pos >= NPROTO)
+        if (*pos >= ARRAY_SIZE(nf_loggers))
                 return NULL;
 
         return pos;
@@ -113,7 +113,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
         (*pos)++;
 
-        if (*pos >= NPROTO)
+        if (*pos >= ARRAY_SIZE(nf_loggers))
                 return NULL;
 
         return pos;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 582ec3efc8a5..4f2310c93e01 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -16,17 +16,17 @@
  * long term mutex.  The handler must provide an an outfn() to accept packets
  * for queueing and must reinject all packets it receives, no matter what.
  */
-static const struct nf_queue_handler *queue_handler[NPROTO];
+static const struct nf_queue_handler *queue_handler[NFPROTO_NUMPROTO] __read_mostly;
 
 static DEFINE_MUTEX(queue_handler_mutex);
 
 /* return EBUSY when somebody else is registered, return EEXIST if the
  * same handler is registered, return 0 in case of success. */
-int nf_register_queue_handler(int pf, const struct nf_queue_handler *qh)
+int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
 {
         int ret;
 
-        if (pf >= NPROTO)
+        if (pf >= ARRAY_SIZE(queue_handler))
                 return -EINVAL;
 
         mutex_lock(&queue_handler_mutex);
@@ -45,9 +45,9 @@ int nf_register_queue_handler(int pf, const struct nf_queue_handler *qh)
 EXPORT_SYMBOL(nf_register_queue_handler);
 
 /* The caller must flush their queue before this */
-int nf_unregister_queue_handler(int pf, const struct nf_queue_handler *qh)
+int nf_unregister_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
 {
-        if (pf >= NPROTO)
+        if (pf >= ARRAY_SIZE(queue_handler))
                 return -EINVAL;
 
         mutex_lock(&queue_handler_mutex);
@@ -67,10 +67,10 @@ EXPORT_SYMBOL(nf_unregister_queue_handler);
 
 void nf_unregister_queue_handlers(const struct nf_queue_handler *qh)
 {
-        int pf;
+        u_int8_t pf;
 
         mutex_lock(&queue_handler_mutex);
-        for (pf = 0; pf < NPROTO; pf++)  {
+        for (pf = 0; pf < ARRAY_SIZE(queue_handler); pf++)  {
                 if (queue_handler[pf] == qh)
                         rcu_assign_pointer(queue_handler[pf], NULL);
         }
@@ -107,7 +107,7 @@ static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
  */
 static int __nf_queue(struct sk_buff *skb,
                       struct list_head *elem,
-                      int pf, unsigned int hook,
+                      u_int8_t pf, unsigned int hook,
                       struct net_device *indev,
                       struct net_device *outdev,
                       int (*okfn)(struct sk_buff *),
@@ -191,7 +191,7 @@ err:
 
 int nf_queue(struct sk_buff *skb,
              struct list_head *elem,
-             int pf, unsigned int hook,
+             u_int8_t pf, unsigned int hook,
              struct net_device *indev,
              struct net_device *outdev,
              int (*okfn)(struct sk_buff *),
@@ -285,7 +285,7 @@ EXPORT_SYMBOL(nf_reinject);
 #ifdef CONFIG_PROC_FS
 static void *seq_start(struct seq_file *seq, loff_t *pos)
 {
-        if (*pos >= NPROTO)
+        if (*pos >= ARRAY_SIZE(queue_handler))
                 return NULL;
 
         return pos;
@@ -295,7 +295,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
         (*pos)++;
 
-        if (*pos >= NPROTO)
+        if (*pos >= ARRAY_SIZE(queue_handler))
                 return NULL;
 
         return pos;
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
index 01489681fa96..8ab829f86574 100644
--- a/net/netfilter/nf_sockopt.c
+++ b/net/netfilter/nf_sockopt.c
@@ -60,14 +60,11 @@ void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
 }
 EXPORT_SYMBOL(nf_unregister_sockopt);
 
-static struct nf_sockopt_ops *nf_sockopt_find(struct sock *sk, int pf,
+static struct nf_sockopt_ops *nf_sockopt_find(struct sock *sk, u_int8_t pf,
                 int val, int get)
 {
         struct nf_sockopt_ops *ops;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return ERR_PTR(-ENOPROTOOPT);
-
         if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)
                 return ERR_PTR(-EINTR);
 
@@ -96,7 +93,7 @@ out:
 }
 
 /* Call get/setsockopt() */
-static int nf_sockopt(struct sock *sk, int pf, int val,
+static int nf_sockopt(struct sock *sk, u_int8_t pf, int val,
                       char __user *opt, int *len, int get)
 {
         struct nf_sockopt_ops *ops;
@@ -115,21 +112,22 @@ static int nf_sockopt(struct sock *sk, int pf, int val,
         return ret;
 }
 
-int nf_setsockopt(struct sock *sk, int pf, int val, char __user *opt,
+int nf_setsockopt(struct sock *sk, u_int8_t pf, int val, char __user *opt,
                   int len)
 {
         return nf_sockopt(sk, pf, val, opt, &len, 0);
 }
 EXPORT_SYMBOL(nf_setsockopt);
 
-int nf_getsockopt(struct sock *sk, int pf, int val, char __user *opt, int *len)
+int nf_getsockopt(struct sock *sk, u_int8_t pf, int val, char __user *opt,
+                  int *len)
 {
         return nf_sockopt(sk, pf, val, opt, len, 1);
 }
 EXPORT_SYMBOL(nf_getsockopt);
 
 #ifdef CONFIG_COMPAT
-static int compat_nf_sockopt(struct sock *sk, int pf, int val,
+static int compat_nf_sockopt(struct sock *sk, u_int8_t pf, int val,
                              char __user *opt, int *len, int get)
 {
         struct nf_sockopt_ops *ops;
@@ -155,14 +153,14 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,
         return ret;
 }
 
-int compat_nf_setsockopt(struct sock *sk, int pf,
+int compat_nf_setsockopt(struct sock *sk, u_int8_t pf,
                 int val, char __user *opt, int len)
 {
         return compat_nf_sockopt(sk, pf, val, opt, &len, 0);
 }
 EXPORT_SYMBOL(compat_nf_setsockopt);
 
-int compat_nf_getsockopt(struct sock *sk, int pf,
+int compat_nf_getsockopt(struct sock *sk, u_int8_t pf,
                 int val, char __user *opt, int *len)
 {
         return compat_nf_sockopt(sk, pf, val, opt, len, 1);
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
new file mode 100644
index 000000000000..fe34f4bf74cc
--- /dev/null
+++ b/net/netfilter/nf_tproxy_core.c
@@ -0,0 +1,96 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (c) 2006-2007 BalaBit IT Ltd.
+ * Author: Balazs Scheidler, Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+
+#include <linux/net.h>
+#include <linux/if.h>
+#include <linux/netdevice.h>
+#include <net/udp.h>
+#include <net/netfilter/nf_tproxy_core.h>
+
+struct sock *
+nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
+                      const __be32 saddr, const __be32 daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in, bool listening_only)
+{
+        struct sock *sk;
+
+        /* look up socket */
+        switch (protocol) {
+        case IPPROTO_TCP:
+                if (listening_only)
+                        sk = __inet_lookup_listener(net, &tcp_hashinfo,
+                                                    daddr, ntohs(dport),
+                                                    in->ifindex);
+                else
+                        sk = __inet_lookup(net, &tcp_hashinfo,
+                                           saddr, sport, daddr, dport,
+                                           in->ifindex);
+                break;
+        case IPPROTO_UDP:
+                sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
+                                     in->ifindex);
+                break;
+        default:
+                WARN_ON(1);
+                sk = NULL;
+        }
+
+        pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, listener only: %d, sock %p\n",
+                 protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), listening_only, sk);
+
+        return sk;
+}
+EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v4);
+
+static void
+nf_tproxy_destructor(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+
+        skb->sk = NULL;
+        skb->destructor = NULL;
+
+        if (sk)
+                nf_tproxy_put_sock(sk);
+}
+
+/* consumes sk */
+int
+nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
+{
+        if (inet_sk(sk)->transparent) {
+                skb->sk = sk;
+                skb->destructor = nf_tproxy_destructor;
+                return 1;
+        } else
+                nf_tproxy_put_sock(sk);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nf_tproxy_assign_sock);
+
+static int __init nf_tproxy_init(void)
+{
+        pr_info("NF_TPROXY: Transparent proxy support initialized, version 4.1.0\n");
+        pr_info("NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.\n");
+        return 0;
+}
+
+module_init(nf_tproxy_init);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Krisztian Kovacs");
+MODULE_DESCRIPTION("Transparent proxy support core routines");
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 9a35b57ab76d..41e0105d3828 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -359,7 +359,7 @@ static inline int
 __build_packet_message(struct nfulnl_instance *inst,
                         const struct sk_buff *skb,
                         unsigned int data_len,
-                        unsigned int pf,
+                        u_int8_t pf,
                         unsigned int hooknum,
                         const struct net_device *indev,
                         const struct net_device *outdev,
@@ -534,7 +534,7 @@ static struct nf_loginfo default_loginfo = {
 
 /* log handler for internal netfilter logging api */
 static void
-nfulnl_log_packet(unsigned int pf,
+nfulnl_log_packet(u_int8_t pf,
                   unsigned int hooknum,
                   const struct sk_buff *skb,
                   const struct net_device *in,
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 5d75cd86ebb3..89837a4eef76 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -30,7 +30,7 @@
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("[ip,ip6,arp]_tables backend module");
+MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
 
 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
 
@@ -58,17 +58,20 @@ static struct xt_af *xt;
 #define duprintf(format, args...)
 #endif
 
-static const char *const xt_prefix[NPROTO] = {
-        [AF_INET]       = "ip",
-        [AF_INET6]      = "ip6",
-        [NF_ARP]        = "arp",
+static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
+        [NFPROTO_UNSPEC] = "x",
+        [NFPROTO_IPV4]   = "ip",
+        [NFPROTO_ARP]    = "arp",
+        [NFPROTO_BRIDGE] = "eb",
+        [NFPROTO_IPV6]   = "ip6",
 };
 
 /* Registration hooks for targets. */
 int
 xt_register_target(struct xt_target *target)
 {
-        int ret, af = target->family;
+        u_int8_t af = target->family;
+        int ret;
 
         ret = mutex_lock_interruptible(&xt[af].mutex);
         if (ret != 0)
@@ -82,7 +85,7 @@ EXPORT_SYMBOL(xt_register_target);
 void
 xt_unregister_target(struct xt_target *target)
 {
-        int af = target->family;
+        u_int8_t af = target->family;
 
         mutex_lock(&xt[af].mutex);
         list_del(&target->list);
@@ -123,7 +126,8 @@ EXPORT_SYMBOL(xt_unregister_targets);
 int
 xt_register_match(struct xt_match *match)
 {
-        int ret, af = match->family;
+        u_int8_t af = match->family;
+        int ret;
 
         ret = mutex_lock_interruptible(&xt[af].mutex);
         if (ret != 0)
@@ -139,7 +143,7 @@ EXPORT_SYMBOL(xt_register_match);
 void
 xt_unregister_match(struct xt_match *match)
 {
-        int af =  match->family;
+        u_int8_t af = match->family;
 
         mutex_lock(&xt[af].mutex);
         list_del(&match->list);
@@ -185,7 +189,7 @@ EXPORT_SYMBOL(xt_unregister_matches);
  */
 
 /* Find match, grabs ref.  Returns ERR_PTR() on error. */
-struct xt_match *xt_find_match(int af, const char *name, u8 revision)
+struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
 {
         struct xt_match *m;
         int err = 0;
@@ -205,12 +209,17 @@ struct xt_match *xt_find_match(int af, const char *name, u8 revision)
                 }
         }
         mutex_unlock(&xt[af].mutex);
+
+        if (af != NFPROTO_UNSPEC)
+                /* Try searching again in the family-independent list */
+                return xt_find_match(NFPROTO_UNSPEC, name, revision);
+
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL(xt_find_match);
 
 /* Find target, grabs ref.  Returns ERR_PTR() on error. */
-struct xt_target *xt_find_target(int af, const char *name, u8 revision)
+struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
 {
         struct xt_target *t;
         int err = 0;
@@ -230,11 +239,16 @@ struct xt_target *xt_find_target(int af, const char *name, u8 revision)
                 }
         }
         mutex_unlock(&xt[af].mutex);
+
+        if (af != NFPROTO_UNSPEC)
+                /* Try searching again in the family-independent list */
+                return xt_find_target(NFPROTO_UNSPEC, name, revision);
+
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL(xt_find_target);
 
-struct xt_target *xt_request_find_target(int af, const char *name, u8 revision)
+struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
 {
         struct xt_target *target;
 
@@ -246,7 +260,7 @@ struct xt_target *xt_request_find_target(int af, const char *name, u8 revision)
 }
 EXPORT_SYMBOL_GPL(xt_request_find_target);
 
-static int match_revfn(int af, const char *name, u8 revision, int *bestp)
+static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
 {
         const struct xt_match *m;
         int have_rev = 0;
@@ -262,7 +276,7 @@ static int match_revfn(int af, const char *name, u8 revision, int *bestp)
         return have_rev;
 }
 
-static int target_revfn(int af, const char *name, u8 revision, int *bestp)
+static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
 {
         const struct xt_target *t;
         int have_rev = 0;
@@ -279,7 +293,7 @@ static int target_revfn(int af, const char *name, u8 revision, int *bestp)
 }
 
 /* Returns true or false (if no such extension at all) */
-int xt_find_revision(int af, const char *name, u8 revision, int target,
+int xt_find_revision(u8 af, const char *name, u8 revision, int target,
                      int *err)
 {
         int have_rev, best = -1;
@@ -307,37 +321,47 @@ int xt_find_revision(int af, const char *name, u8 revision, int target,
 }
 EXPORT_SYMBOL_GPL(xt_find_revision);
 
-int xt_check_match(const struct xt_match *match, unsigned short family,
-                   unsigned int size, const char *table, unsigned int hook_mask,
-                   unsigned short proto, int inv_proto)
+int xt_check_match(struct xt_mtchk_param *par,
+                   unsigned int size, u_int8_t proto, bool inv_proto)
 {
-        if (XT_ALIGN(match->matchsize) != size) {
+        if (XT_ALIGN(par->match->matchsize) != size &&
+            par->match->matchsize != -1) {
+                /*
+                 * ebt_among is exempt from centralized matchsize checking
+                 * because it uses a dynamic-size data set.
+                 */
                 printk("%s_tables: %s match: invalid size %Zu != %u\n",
-                       xt_prefix[family], match->name,
-                       XT_ALIGN(match->matchsize), size);
+                       xt_prefix[par->family], par->match->name,
+                       XT_ALIGN(par->match->matchsize), size);
                 return -EINVAL;
         }
-        if (match->table && strcmp(match->table, table)) {
+        if (par->match->table != NULL &&
+            strcmp(par->match->table, par->table) != 0) {
                 printk("%s_tables: %s match: only valid in %s table, not %s\n",
-                       xt_prefix[family], match->name, match->table, table);
+                       xt_prefix[par->family], par->match->name,
+                       par->match->table, par->table);
                 return -EINVAL;
         }
-        if (match->hooks && (hook_mask & ~match->hooks) != 0) {
-                printk("%s_tables: %s match: bad hook_mask %u/%u\n",
-                       xt_prefix[family], match->name, hook_mask, match->hooks);
+        if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
+                printk("%s_tables: %s match: bad hook_mask %#x/%#x\n",
+                       xt_prefix[par->family], par->match->name,
+                       par->hook_mask, par->match->hooks);
                 return -EINVAL;
         }
-        if (match->proto && (match->proto != proto || inv_proto)) {
+        if (par->match->proto && (par->match->proto != proto || inv_proto)) {
                 printk("%s_tables: %s match: only valid for protocol %u\n",
-                       xt_prefix[family], match->name, match->proto);
+                       xt_prefix[par->family], par->match->name,
+                       par->match->proto);
                 return -EINVAL;
         }
+        if (par->match->checkentry != NULL && !par->match->checkentry(par))
+                return -EINVAL;
         return 0;
 }
 EXPORT_SYMBOL_GPL(xt_check_match);
 
 #ifdef CONFIG_COMPAT
-int xt_compat_add_offset(int af, unsigned int offset, short delta)
+int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta)
 {
         struct compat_delta *tmp;
 
@@ -359,7 +383,7 @@ int xt_compat_add_offset(int af, unsigned int offset, short delta)
 }
 EXPORT_SYMBOL_GPL(xt_compat_add_offset);
 
-void xt_compat_flush_offsets(int af)
+void xt_compat_flush_offsets(u_int8_t af)
 {
         struct compat_delta *tmp, *next;
 
@@ -373,7 +397,7 @@ void xt_compat_flush_offsets(int af)
 }
 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
 
-short xt_compat_calc_jump(int af, unsigned int offset)
+short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
 {
         struct compat_delta *tmp;
         short delta;
@@ -448,32 +472,36 @@ int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
 EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
 #endif /* CONFIG_COMPAT */
 
-int xt_check_target(const struct xt_target *target, unsigned short family,
-                    unsigned int size, const char *table, unsigned int hook_mask,
-                    unsigned short proto, int inv_proto)
+int xt_check_target(struct xt_tgchk_param *par,
+                    unsigned int size, u_int8_t proto, bool inv_proto)
 {
-        if (XT_ALIGN(target->targetsize) != size) {
+        if (XT_ALIGN(par->target->targetsize) != size) {
                 printk("%s_tables: %s target: invalid size %Zu != %u\n",
-                       xt_prefix[family], target->name,
-                       XT_ALIGN(target->targetsize), size);
+                       xt_prefix[par->family], par->target->name,
+                       XT_ALIGN(par->target->targetsize), size);
                 return -EINVAL;
         }
-        if (target->table && strcmp(target->table, table)) {
+        if (par->target->table != NULL &&
+            strcmp(par->target->table, par->table) != 0) {
                 printk("%s_tables: %s target: only valid in %s table, not %s\n",
-                       xt_prefix[family], target->name, target->table, table);
+                       xt_prefix[par->family], par->target->name,
+                       par->target->table, par->table);
                 return -EINVAL;
         }
-        if (target->hooks && (hook_mask & ~target->hooks) != 0) {
-                printk("%s_tables: %s target: bad hook_mask %u/%u\n",
-                       xt_prefix[family], target->name, hook_mask,
-                       target->hooks);
+        if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
+                printk("%s_tables: %s target: bad hook_mask %#x/%#x\n",
+                       xt_prefix[par->family], par->target->name,
+                       par->hook_mask, par->target->hooks);
                 return -EINVAL;
         }
-        if (target->proto && (target->proto != proto || inv_proto)) {
+        if (par->target->proto && (par->target->proto != proto || inv_proto)) {
                 printk("%s_tables: %s target: only valid for protocol %u\n",
-                       xt_prefix[family], target->name, target->proto);
+                       xt_prefix[par->family], par->target->name,
+                       par->target->proto);
                 return -EINVAL;
         }
+        if (par->target->checkentry != NULL && !par->target->checkentry(par))
+                return -EINVAL;
         return 0;
 }
 EXPORT_SYMBOL_GPL(xt_check_target);
@@ -590,7 +618,8 @@ void xt_free_table_info(struct xt_table_info *info)
 EXPORT_SYMBOL(xt_free_table_info);
 
 /* Find table by name, grabs mutex & ref.  Returns ERR_PTR() on error. */
-struct xt_table *xt_find_table_lock(struct net *net, int af, const char *name)
+struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
+                                    const char *name)
 {
         struct xt_table *t;
 
@@ -612,13 +641,13 @@ void xt_table_unlock(struct xt_table *table)
 EXPORT_SYMBOL_GPL(xt_table_unlock);
 
 #ifdef CONFIG_COMPAT
-void xt_compat_lock(int af)
+void xt_compat_lock(u_int8_t af)
 {
         mutex_lock(&xt[af].compat_mutex);
 }
 EXPORT_SYMBOL_GPL(xt_compat_lock);
 
-void xt_compat_unlock(int af)
+void xt_compat_unlock(u_int8_t af)
 {
         mutex_unlock(&xt[af].compat_mutex);
 }
@@ -722,13 +751,13 @@ EXPORT_SYMBOL_GPL(xt_unregister_table);
 #ifdef CONFIG_PROC_FS
 struct xt_names_priv {
         struct seq_net_private p;
-        int af;
+        u_int8_t af;
 };
 static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct xt_names_priv *priv = seq->private;
         struct net *net = seq_file_net(seq);
-        int af = priv->af;
+        u_int8_t af = priv->af;
 
         mutex_lock(&xt[af].mutex);
         return seq_list_start(&net->xt.tables[af], *pos);
@@ -738,7 +767,7 @@ static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct xt_names_priv *priv = seq->private;
         struct net *net = seq_file_net(seq);
-        int af = priv->af;
+        u_int8_t af = priv->af;
 
         return seq_list_next(v, &net->xt.tables[af], pos);
 }
@@ -746,7 +775,7 @@ static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 static void xt_table_seq_stop(struct seq_file *seq, void *v)
 {
         struct xt_names_priv *priv = seq->private;
-        int af = priv->af;
+        u_int8_t af = priv->af;
 
         mutex_unlock(&xt[af].mutex);
 }
@@ -922,14 +951,14 @@ static const struct file_operations xt_target_ops = {
 
 #endif /* CONFIG_PROC_FS */
 
-int xt_proto_init(struct net *net, int af)
+int xt_proto_init(struct net *net, u_int8_t af)
 {
 #ifdef CONFIG_PROC_FS
         char buf[XT_FUNCTION_MAXNAMELEN];
         struct proc_dir_entry *proc;
 #endif
 
-        if (af >= NPROTO)
+        if (af >= ARRAY_SIZE(xt_prefix))
                 return -EINVAL;
 
 
@@ -974,7 +1003,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(xt_proto_init);
 
-void xt_proto_fini(struct net *net, int af)
+void xt_proto_fini(struct net *net, u_int8_t af)
 {
 #ifdef CONFIG_PROC_FS
         char buf[XT_FUNCTION_MAXNAMELEN];
@@ -998,7 +1027,7 @@ static int __net_init xt_net_init(struct net *net)
 {
         int i;
 
-        for (i = 0; i < NPROTO; i++)
+        for (i = 0; i < NFPROTO_NUMPROTO; i++)
                 INIT_LIST_HEAD(&net->xt.tables[i]);
         return 0;
 }
@@ -1011,11 +1040,11 @@ static int __init xt_init(void)
 {
         int i, rv;
 
-        xt = kmalloc(sizeof(struct xt_af) * NPROTO, GFP_KERNEL);
+        xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
         if (!xt)
                 return -ENOMEM;
 
-        for (i = 0; i < NPROTO; i++) {
+        for (i = 0; i < NFPROTO_NUMPROTO; i++) {
                 mutex_init(&xt[i].mutex);
 #ifdef CONFIG_COMPAT
                 mutex_init(&xt[i].compat_mutex);
diff --git a/net/netfilter/xt_CLASSIFY.c b/net/netfilter/xt_CLASSIFY.c
index 77a52bf83225..011bc80dd2a1 100644
--- a/net/netfilter/xt_CLASSIFY.c
+++ b/net/netfilter/xt_CLASSIFY.c
@@ -27,50 +27,34 @@ MODULE_ALIAS("ipt_CLASSIFY");
 MODULE_ALIAS("ip6t_CLASSIFY");
 
 static unsigned int
-classify_tg(struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, unsigned int hooknum,
-            const struct xt_target *target, const void *targinfo)
+classify_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_classify_target_info *clinfo = targinfo;
+        const struct xt_classify_target_info *clinfo = par->targinfo;
 
         skb->priority = clinfo->priority;
         return XT_CONTINUE;
 }
 
-static struct xt_target classify_tg_reg[] __read_mostly = {
-        {
-                .family         = AF_INET,
-                .name           = "CLASSIFY",
-                .target         = classify_tg,
-                .targetsize     = sizeof(struct xt_classify_target_info),
-                .table          = "mangle",
-                .hooks          = (1 << NF_INET_LOCAL_OUT) |
-                                  (1 << NF_INET_FORWARD) |
-                                  (1 << NF_INET_POST_ROUTING),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "CLASSIFY",
-                .family         = AF_INET6,
-                .target         = classify_tg,
-                .targetsize     = sizeof(struct xt_classify_target_info),
-                .table          = "mangle",
-                .hooks          = (1 << NF_INET_LOCAL_OUT) |
-                                  (1 << NF_INET_FORWARD) |
-                                  (1 << NF_INET_POST_ROUTING),
-                .me             = THIS_MODULE,
-        },
+static struct xt_target classify_tg_reg __read_mostly = {
+        .name       = "CLASSIFY",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .table      = "mangle",
+        .hooks      = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
+                      (1 << NF_INET_POST_ROUTING),
+        .target     = classify_tg,
+        .targetsize = sizeof(struct xt_classify_target_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init classify_tg_init(void)
 {
-        return xt_register_targets(classify_tg_reg,
-               ARRAY_SIZE(classify_tg_reg));
+        return xt_register_target(&classify_tg_reg);
 }
 
 static void __exit classify_tg_exit(void)
 {
-        xt_unregister_targets(classify_tg_reg, ARRAY_SIZE(classify_tg_reg));
+        xt_unregister_target(&classify_tg_reg);
 }
 
 module_init(classify_tg_init);
diff --git a/net/netfilter/xt_CONNMARK.c b/net/netfilter/xt_CONNMARK.c
index 5fecfb4794b1..d6e5ab463277 100644
--- a/net/netfilter/xt_CONNMARK.c
+++ b/net/netfilter/xt_CONNMARK.c
@@ -36,11 +36,9 @@ MODULE_ALIAS("ip6t_CONNMARK");
 #include <net/netfilter/nf_conntrack_ecache.h>
 
 static unsigned int
-connmark_tg_v0(struct sk_buff *skb, const struct net_device *in,
-               const struct net_device *out, unsigned int hooknum,
-               const struct xt_target *target, const void *targinfo)
+connmark_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_connmark_target_info *markinfo = targinfo;
+        const struct xt_connmark_target_info *markinfo = par->targinfo;
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         u_int32_t diff;
@@ -54,7 +52,7 @@ connmark_tg_v0(struct sk_buff *skb, const struct net_device *in,
                         newmark = (ct->mark & ~markinfo->mask) | markinfo->mark;
                         if (newmark != ct->mark) {
                                 ct->mark = newmark;
-                                nf_conntrack_event_cache(IPCT_MARK, skb);
+                                nf_conntrack_event_cache(IPCT_MARK, ct);
                         }
                         break;
                 case XT_CONNMARK_SAVE:
@@ -62,7 +60,7 @@ connmark_tg_v0(struct sk_buff *skb, const struct net_device *in,
                                   (skb->mark & markinfo->mask);
                         if (ct->mark != newmark) {
                                 ct->mark = newmark;
-                                nf_conntrack_event_cache(IPCT_MARK, skb);
+                                nf_conntrack_event_cache(IPCT_MARK, ct);
                         }
                         break;
                 case XT_CONNMARK_RESTORE:
@@ -77,11 +75,9 @@ connmark_tg_v0(struct sk_buff *skb, const struct net_device *in,
 }
 
 static unsigned int
-connmark_tg(struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, unsigned int hooknum,
-            const struct xt_target *target, const void *targinfo)
+connmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_connmark_tginfo1 *info = targinfo;
+        const struct xt_connmark_tginfo1 *info = par->targinfo;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
         u_int32_t newmark;
@@ -95,7 +91,7 @@ connmark_tg(struct sk_buff *skb, const struct net_device *in,
                 newmark = (ct->mark & ~info->ctmask) ^ info->ctmark;
                 if (ct->mark != newmark) {
                         ct->mark = newmark;
-                        nf_conntrack_event_cache(IPCT_MARK, skb);
+                        nf_conntrack_event_cache(IPCT_MARK, ct);
                 }
                 break;
         case XT_CONNMARK_SAVE:
@@ -103,7 +99,7 @@ connmark_tg(struct sk_buff *skb, const struct net_device *in,
                           (skb->mark & info->nfmask);
                 if (ct->mark != newmark) {
                         ct->mark = newmark;
-                        nf_conntrack_event_cache(IPCT_MARK, skb);
+                        nf_conntrack_event_cache(IPCT_MARK, ct);
                 }
                 break;
         case XT_CONNMARK_RESTORE:
@@ -116,18 +112,15 @@ connmark_tg(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-connmark_tg_check_v0(const char *tablename, const void *entry,
-                     const struct xt_target *target, void *targinfo,
-                     unsigned int hook_mask)
+static bool connmark_tg_check_v0(const struct xt_tgchk_param *par)
 {
-        const struct xt_connmark_target_info *matchinfo = targinfo;
+        const struct xt_connmark_target_info *matchinfo = par->targinfo;
 
         if (matchinfo->mode == XT_CONNMARK_RESTORE) {
-                if (strcmp(tablename, "mangle") != 0) {
+                if (strcmp(par->table, "mangle") != 0) {
                         printk(KERN_WARNING "CONNMARK: restore can only be "
                                "called from \"mangle\" table, not \"%s\"\n",
-                               tablename);
+                               par->table);
                         return false;
                 }
         }
@@ -135,31 +128,27 @@ connmark_tg_check_v0(const char *tablename, const void *entry,
                 printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
                 return false;
         }
-        if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", target->family);
+                                    "proto=%u\n", par->family);
                 return false;
         }
         return true;
 }
 
-static bool
-connmark_tg_check(const char *tablename, const void *entry,
-                  const struct xt_target *target, void *targinfo,
-                  unsigned int hook_mask)
+static bool connmark_tg_check(const struct xt_tgchk_param *par)
 {
-        if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "cannot load conntrack support for "
-                       "proto=%u\n", target->family);
+                       "proto=%u\n", par->family);
                 return false;
         }
         return true;
 }
 
-static void
-connmark_tg_destroy(const struct xt_target *target, void *targinfo)
+static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
-        nf_ct_l3proto_module_put(target->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
 #ifdef CONFIG_COMPAT
@@ -197,7 +186,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
         {
                 .name           = "CONNMARK",
                 .revision       = 0,
-                .family         = AF_INET,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = connmark_tg_check_v0,
                 .destroy        = connmark_tg_destroy,
                 .target         = connmark_tg_v0,
@@ -210,34 +199,9 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
                 .me             = THIS_MODULE
         },
         {
-                .name           = "CONNMARK",
-                .revision       = 0,
-                .family         = AF_INET6,
-                .checkentry     = connmark_tg_check_v0,
-                .destroy        = connmark_tg_destroy,
-                .target         = connmark_tg_v0,
-                .targetsize     = sizeof(struct xt_connmark_target_info),
-#ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_connmark_target_info),
-                .compat_from_user = connmark_tg_compat_from_user_v0,
-                .compat_to_user = connmark_tg_compat_to_user_v0,
-#endif
-                .me             = THIS_MODULE
-        },
-        {
-                .name           = "CONNMARK",
-                .revision       = 1,
-                .family         = AF_INET,
-                .checkentry     = connmark_tg_check,
-                .target         = connmark_tg,
-                .targetsize     = sizeof(struct xt_connmark_tginfo1),
-                .destroy        = connmark_tg_destroy,
-                .me             = THIS_MODULE,
-        },
-        {
                 .name           = "CONNMARK",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = connmark_tg_check,
                 .target         = connmark_tg,
                 .targetsize     = sizeof(struct xt_connmark_tginfo1),
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 76ca1f2421eb..b54c3756fdc3 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -43,7 +43,7 @@ static void secmark_save(const struct sk_buff *skb)
                 ct = nf_ct_get(skb, &ctinfo);
                 if (ct && !ct->secmark) {
                         ct->secmark = skb->secmark;
-                        nf_conntrack_event_cache(IPCT_SECMARK, skb);
+                        nf_conntrack_event_cache(IPCT_SECMARK, ct);
                 }
         }
 }
@@ -65,11 +65,9 @@ static void secmark_restore(struct sk_buff *skb)
 }
 
 static unsigned int
-connsecmark_tg(struct sk_buff *skb, const struct net_device *in,
-               const struct net_device *out, unsigned int hooknum,
-               const struct xt_target *target, const void *targinfo)
+connsecmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_connsecmark_target_info *info = targinfo;
+        const struct xt_connsecmark_target_info *info = par->targinfo;
 
         switch (info->mode) {
         case CONNSECMARK_SAVE:
@@ -87,16 +85,14 @@ connsecmark_tg(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-connsecmark_tg_check(const char *tablename, const void *entry,
-                     const struct xt_target *target, void *targinfo,
-                     unsigned int hook_mask)
+static bool connsecmark_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct xt_connsecmark_target_info *info = targinfo;
+        const struct xt_connsecmark_target_info *info = par->targinfo;
 
-        if (strcmp(tablename, "mangle") && strcmp(tablename, "security")) {
+        if (strcmp(par->table, "mangle") != 0 &&
+            strcmp(par->table, "security") != 0) {
                 printk(KERN_INFO PFX "target only valid in the \'mangle\' "
-                       "or \'security\' tables, not \'%s\'.\n", tablename);
+                       "or \'security\' tables, not \'%s\'.\n", par->table);
                 return false;
         }
 
@@ -110,51 +106,38 @@ connsecmark_tg_check(const char *tablename, const void *entry,
                 return false;
         }
 
-        if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", target->family);
+                                    "proto=%u\n", par->family);
                 return false;
         }
         return true;
 }
 
-static void
-connsecmark_tg_destroy(const struct xt_target *target, void *targinfo)
+static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
-        nf_ct_l3proto_module_put(target->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
-static struct xt_target connsecmark_tg_reg[] __read_mostly = {
-        {
-                .name           = "CONNSECMARK",
-                .family         = AF_INET,
-                .checkentry     = connsecmark_tg_check,
-                .destroy        = connsecmark_tg_destroy,
-                .target         = connsecmark_tg,
-                .targetsize     = sizeof(struct xt_connsecmark_target_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "CONNSECMARK",
-                .family         = AF_INET6,
-                .checkentry     = connsecmark_tg_check,
-                .destroy        = connsecmark_tg_destroy,
-                .target         = connsecmark_tg,
-                .targetsize     = sizeof(struct xt_connsecmark_target_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_target connsecmark_tg_reg __read_mostly = {
+        .name       = "CONNSECMARK",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = connsecmark_tg_check,
+        .destroy    = connsecmark_tg_destroy,
+        .target     = connsecmark_tg,
+        .targetsize = sizeof(struct xt_connsecmark_target_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init connsecmark_tg_init(void)
 {
-        return xt_register_targets(connsecmark_tg_reg,
-               ARRAY_SIZE(connsecmark_tg_reg));
+        return xt_register_target(&connsecmark_tg_reg);
 }
 
 static void __exit connsecmark_tg_exit(void)
 {
-        xt_unregister_targets(connsecmark_tg_reg,
-                              ARRAY_SIZE(connsecmark_tg_reg));
+        xt_unregister_target(&connsecmark_tg_reg);
 }
 
 module_init(connsecmark_tg_init);
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index 97efd74c04fe..6a347e768f86 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -29,11 +29,9 @@ MODULE_ALIAS("ipt_TOS");
 MODULE_ALIAS("ip6t_TOS");
 
 static unsigned int
-dscp_tg(struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, unsigned int hooknum,
-        const struct xt_target *target, const void *targinfo)
+dscp_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_DSCP_info *dinfo = targinfo;
+        const struct xt_DSCP_info *dinfo = par->targinfo;
         u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
 
         if (dscp != dinfo->dscp) {
@@ -48,11 +46,9 @@ dscp_tg(struct sk_buff *skb, const struct net_device *in,
 }
 
 static unsigned int
-dscp_tg6(struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, unsigned int hooknum,
-         const struct xt_target *target, const void *targinfo)
+dscp_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_DSCP_info *dinfo = targinfo;
+        const struct xt_DSCP_info *dinfo = par->targinfo;
         u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
 
         if (dscp != dinfo->dscp) {
@@ -65,26 +61,21 @@ dscp_tg6(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-dscp_tg_check(const char *tablename, const void *e_void,
-              const struct xt_target *target, void *targinfo,
-              unsigned int hook_mask)
+static bool dscp_tg_check(const struct xt_tgchk_param *par)
 {
-        const u_int8_t dscp = ((struct xt_DSCP_info *)targinfo)->dscp;
+        const struct xt_DSCP_info *info = par->targinfo;
 
-        if (dscp > XT_DSCP_MAX) {
-                printk(KERN_WARNING "DSCP: dscp %x out of range\n", dscp);
+        if (info->dscp > XT_DSCP_MAX) {
+                printk(KERN_WARNING "DSCP: dscp %x out of range\n", info->dscp);
                 return false;
         }
         return true;
 }
 
 static unsigned int
-tos_tg_v0(struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, unsigned int hooknum,
-          const struct xt_target *target, const void *targinfo)
+tos_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct ipt_tos_target_info *info = targinfo;
+        const struct ipt_tos_target_info *info = par->targinfo;
         struct iphdr *iph = ip_hdr(skb);
         u_int8_t oldtos;
 
@@ -101,12 +92,10 @@ tos_tg_v0(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static bool
-tos_tg_check_v0(const char *tablename, const void *e_void,
-                const struct xt_target *target, void *targinfo,
-                unsigned int hook_mask)
+static bool tos_tg_check_v0(const struct xt_tgchk_param *par)
 {
-        const u_int8_t tos = ((struct ipt_tos_target_info *)targinfo)->tos;
+        const struct ipt_tos_target_info *info = par->targinfo;
+        const uint8_t tos = info->tos;
 
         if (tos != IPTOS_LOWDELAY && tos != IPTOS_THROUGHPUT &&
             tos != IPTOS_RELIABILITY && tos != IPTOS_MINCOST &&
@@ -119,11 +108,9 @@ tos_tg_check_v0(const char *tablename, const void *e_void,
 }
 
 static unsigned int
-tos_tg(struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, unsigned int hooknum,
-       const struct xt_target *target, const void *targinfo)
+tos_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_tos_target_info *info = targinfo;
+        const struct xt_tos_target_info *info = par->targinfo;
         struct iphdr *iph = ip_hdr(skb);
         u_int8_t orig, nv;
 
@@ -141,11 +128,9 @@ tos_tg(struct sk_buff *skb, const struct net_device *in,
 }
 
 static unsigned int
-tos_tg6(struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, unsigned int hooknum,
-        const struct xt_target *target, const void *targinfo)
+tos_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_tos_target_info *info = targinfo;
+        const struct xt_tos_target_info *info = par->targinfo;
         struct ipv6hdr *iph = ipv6_hdr(skb);
         u_int8_t orig, nv;
 
@@ -165,7 +150,7 @@ tos_tg6(struct sk_buff *skb, const struct net_device *in,
 static struct xt_target dscp_tg_reg[] __read_mostly = {
         {
                 .name           = "DSCP",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = dscp_tg_check,
                 .target         = dscp_tg,
                 .targetsize     = sizeof(struct xt_DSCP_info),
@@ -174,7 +159,7 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
         },
         {
                 .name           = "DSCP",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = dscp_tg_check,
                 .target         = dscp_tg6,
                 .targetsize     = sizeof(struct xt_DSCP_info),
@@ -184,7 +169,7 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
         {
                 .name           = "TOS",
                 .revision       = 0,
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .table          = "mangle",
                 .target         = tos_tg_v0,
                 .targetsize     = sizeof(struct ipt_tos_target_info),
@@ -194,7 +179,7 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
         {
                 .name           = "TOS",
                 .revision       = 1,
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .table          = "mangle",
                 .target         = tos_tg,
                 .targetsize     = sizeof(struct xt_tos_target_info),
@@ -203,7 +188,7 @@ static struct xt_target dscp_tg_reg[] __read_mostly = {
         {
                 .name           = "TOS",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .table          = "mangle",
                 .target         = tos_tg6,
                 .targetsize     = sizeof(struct xt_tos_target_info),
diff --git a/net/netfilter/xt_MARK.c b/net/netfilter/xt_MARK.c
index f9ce20b58981..67574bcfb8ac 100644
--- a/net/netfilter/xt_MARK.c
+++ b/net/netfilter/xt_MARK.c
@@ -25,22 +25,18 @@ MODULE_ALIAS("ipt_MARK");
 MODULE_ALIAS("ip6t_MARK");
 
 static unsigned int
-mark_tg_v0(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+mark_tg_v0(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_mark_target_info *markinfo = targinfo;
+        const struct xt_mark_target_info *markinfo = par->targinfo;
 
         skb->mark = markinfo->mark;
         return XT_CONTINUE;
 }
 
 static unsigned int
-mark_tg_v1(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+mark_tg_v1(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_mark_target_info_v1 *markinfo = targinfo;
+        const struct xt_mark_target_info_v1 *markinfo = par->targinfo;
         int mark = 0;
 
         switch (markinfo->mode) {
@@ -62,22 +58,17 @@ mark_tg_v1(struct sk_buff *skb, const struct net_device *in,
 }
 
 static unsigned int
-mark_tg(struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, unsigned int hooknum,
-        const struct xt_target *target, const void *targinfo)
+mark_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_mark_tginfo2 *info = targinfo;
+        const struct xt_mark_tginfo2 *info = par->targinfo;
 
         skb->mark = (skb->mark & ~info->mask) ^ info->mark;
         return XT_CONTINUE;
 }
 
-static bool
-mark_tg_check_v0(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool mark_tg_check_v0(const struct xt_tgchk_param *par)
 {
-        const struct xt_mark_target_info *markinfo = targinfo;
+        const struct xt_mark_target_info *markinfo = par->targinfo;
 
         if (markinfo->mark > 0xffffffff) {
                 printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
@@ -86,12 +77,9 @@ mark_tg_check_v0(const char *tablename, const void *entry,
         return true;
 }
 
-static bool
-mark_tg_check_v1(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool mark_tg_check_v1(const struct xt_tgchk_param *par)
 {
-        const struct xt_mark_target_info_v1 *markinfo = targinfo;
+        const struct xt_mark_target_info_v1 *markinfo = par->targinfo;
 
         if (markinfo->mode != XT_MARK_SET
             && markinfo->mode != XT_MARK_AND
@@ -161,7 +149,7 @@ static int mark_tg_compat_to_user_v1(void __user *dst, void *src)
 static struct xt_target mark_tg_reg[] __read_mostly = {
         {
                 .name           = "MARK",
-                .family         = AF_INET,
+                .family         = NFPROTO_UNSPEC,
                 .revision       = 0,
                 .checkentry     = mark_tg_check_v0,
                 .target         = mark_tg_v0,
@@ -176,7 +164,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
         },
         {
                 .name           = "MARK",
-                .family         = AF_INET,
+                .family         = NFPROTO_UNSPEC,
                 .revision       = 1,
                 .checkentry     = mark_tg_check_v1,
                 .target         = mark_tg_v1,
@@ -190,47 +178,9 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
                 .me             = THIS_MODULE,
         },
         {
-                .name           = "MARK",
-                .family         = AF_INET6,
-                .revision       = 0,
-                .checkentry     = mark_tg_check_v0,
-                .target         = mark_tg_v0,
-                .targetsize     = sizeof(struct xt_mark_target_info),
-#ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_mark_target_info),
-                .compat_from_user = mark_tg_compat_from_user_v0,
-                .compat_to_user = mark_tg_compat_to_user_v0,
-#endif
-                .table          = "mangle",
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "MARK",
-                .family         = AF_INET6,
-                .revision       = 1,
-                .checkentry     = mark_tg_check_v1,
-                .target         = mark_tg_v1,
-                .targetsize     = sizeof(struct xt_mark_target_info_v1),
-#ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_mark_target_info_v1),
-                .compat_from_user = mark_tg_compat_from_user_v1,
-                .compat_to_user = mark_tg_compat_to_user_v1,
-#endif
-                .table          = "mangle",
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "MARK",
-                .revision       = 2,
-                .family         = AF_INET,
-                .target         = mark_tg,
-                .targetsize     = sizeof(struct xt_mark_tginfo2),
-                .me             = THIS_MODULE,
-        },
-        {
                 .name           = "MARK",
                 .revision       = 2,
-                .family         = AF_INET6,
+                .family         = NFPROTO_UNSPEC,
                 .target         = mark_tg,
                 .targetsize     = sizeof(struct xt_mark_tginfo2),
                 .me             = THIS_MODULE,
diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index 19ae8efae655..50e3a52d3b31 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -21,11 +21,9 @@ MODULE_ALIAS("ipt_NFLOG");
 MODULE_ALIAS("ip6t_NFLOG");
 
 static unsigned int
-nflog_tg(struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, unsigned int hooknum,
-         const struct xt_target *target, const void *targinfo)
+nflog_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_nflog_info *info = targinfo;
+        const struct xt_nflog_info *info = par->targinfo;
         struct nf_loginfo li;
 
         li.type              = NF_LOG_TYPE_ULOG;
@@ -33,17 +31,14 @@ nflog_tg(struct sk_buff *skb, const struct net_device *in,
         li.u.ulog.group      = info->group;
         li.u.ulog.qthreshold = info->threshold;
 
-        nf_log_packet(target->family, hooknum, skb, in, out, &li,
-                      "%s", info->prefix);
+        nf_log_packet(par->family, par->hooknum, skb, par->in,
+                      par->out, &li, "%s", info->prefix);
         return XT_CONTINUE;
 }
 
-static bool
-nflog_tg_check(const char *tablename, const void *entry,
-               const struct xt_target *target, void *targetinfo,
-               unsigned int hookmask)
+static bool nflog_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct xt_nflog_info *info = targetinfo;
+        const struct xt_nflog_info *info = par->targinfo;
 
         if (info->flags & ~XT_NFLOG_MASK)
                 return false;
@@ -52,33 +47,24 @@ nflog_tg_check(const char *tablename, const void *entry,
         return true;
 }
 
-static struct xt_target nflog_tg_reg[] __read_mostly = {
-        {
-                .name           = "NFLOG",
-                .family         = AF_INET,
-                .checkentry     = nflog_tg_check,
-                .target         = nflog_tg,
-                .targetsize     = sizeof(struct xt_nflog_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "NFLOG",
-                .family         = AF_INET6,
-                .checkentry     = nflog_tg_check,
-                .target         = nflog_tg,
-                .targetsize     = sizeof(struct xt_nflog_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_target nflog_tg_reg __read_mostly = {
+        .name       = "NFLOG",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = nflog_tg_check,
+        .target     = nflog_tg,
+        .targetsize = sizeof(struct xt_nflog_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init nflog_tg_init(void)
 {
-        return xt_register_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));
+        return xt_register_target(&nflog_tg_reg);
 }
 
 static void __exit nflog_tg_exit(void)
 {
-        xt_unregister_targets(nflog_tg_reg, ARRAY_SIZE(nflog_tg_reg));
+        xt_unregister_target(&nflog_tg_reg);
 }
 
 module_init(nflog_tg_init);
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index beb24d19a56f..2cc1fff49307 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -24,11 +24,9 @@ MODULE_ALIAS("ip6t_NFQUEUE");
 MODULE_ALIAS("arpt_NFQUEUE");
 
 static unsigned int
-nfqueue_tg(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+nfqueue_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_NFQ_info *tinfo = targinfo;
+        const struct xt_NFQ_info *tinfo = par->targinfo;
 
         return NF_QUEUE_NR(tinfo->queuenum);
 }
@@ -36,14 +34,14 @@ nfqueue_tg(struct sk_buff *skb, const struct net_device *in,
 static struct xt_target nfqueue_tg_reg[] __read_mostly = {
         {
                 .name           = "NFQUEUE",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .target         = nfqueue_tg,
                 .targetsize     = sizeof(struct xt_NFQ_info),
                 .me             = THIS_MODULE,
         },
         {
                 .name           = "NFQUEUE",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .target         = nfqueue_tg,
                 .targetsize     = sizeof(struct xt_NFQ_info),
                 .me             = THIS_MODULE,
diff --git a/net/netfilter/xt_NOTRACK.c b/net/netfilter/xt_NOTRACK.c
index 6c9de611eb8d..e7a0a54fd4ea 100644
--- a/net/netfilter/xt_NOTRACK.c
+++ b/net/netfilter/xt_NOTRACK.c
@@ -13,9 +13,7 @@ MODULE_ALIAS("ipt_NOTRACK");
 MODULE_ALIAS("ip6t_NOTRACK");
 
 static unsigned int
-notrack_tg(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+notrack_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         /* Previously seen (loopback)? Ignore. */
         if (skb->nfct != NULL)
@@ -32,31 +30,23 @@ notrack_tg(struct sk_buff *skb, const struct net_device *in,
         return XT_CONTINUE;
 }
 
-static struct xt_target notrack_tg_reg[] __read_mostly = {
-        {
-                .name           = "NOTRACK",
-                .family         = AF_INET,
-                .target         = notrack_tg,
-                .table          = "raw",
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "NOTRACK",
-                .family         = AF_INET6,
-                .target         = notrack_tg,
-                .table          = "raw",
-                .me             = THIS_MODULE,
-        },
+static struct xt_target notrack_tg_reg __read_mostly = {
+        .name     = "NOTRACK",
+        .revision = 0,
+        .family   = NFPROTO_UNSPEC,
+        .target   = notrack_tg,
+        .table    = "raw",
+        .me       = THIS_MODULE,
 };
 
 static int __init notrack_tg_init(void)
 {
-        return xt_register_targets(notrack_tg_reg, ARRAY_SIZE(notrack_tg_reg));
+        return xt_register_target(&notrack_tg_reg);
 }
 
 static void __exit notrack_tg_exit(void)
 {
-        xt_unregister_targets(notrack_tg_reg, ARRAY_SIZE(notrack_tg_reg));
+        xt_unregister_target(&notrack_tg_reg);
 }
 
 module_init(notrack_tg_init);
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 64d6ad380293..43f5676b1af4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -71,14 +71,9 @@ void xt_rateest_put(struct xt_rateest *est)
 EXPORT_SYMBOL_GPL(xt_rateest_put);
 
 static unsigned int
-xt_rateest_tg(struct sk_buff *skb,
-              const struct net_device *in,
-              const struct net_device *out,
-              unsigned int hooknum,
-              const struct xt_target *target,
-              const void *targinfo)
+xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        const struct xt_rateest_target_info *info = targinfo;
+        const struct xt_rateest_target_info *info = par->targinfo;
         struct gnet_stats_basic *stats = &info->est->bstats;
 
         spin_lock_bh(&info->est->lock);
@@ -89,14 +84,9 @@ xt_rateest_tg(struct sk_buff *skb,
         return XT_CONTINUE;
 }
 
-static bool
-xt_rateest_tg_checkentry(const char *tablename,
-                         const void *entry,
-                         const struct xt_target *target,
-                         void *targinfo,
-                         unsigned int hook_mask)
+static bool xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
 {
-        struct xt_rateest_target_info *info = targinfo;
+        struct xt_rateest_target_info *info = par->targinfo;
         struct xt_rateest *est;
         struct {
                 struct nlattr           opt;
@@ -149,33 +139,22 @@ err1:
         return false;
 }
 
-static void xt_rateest_tg_destroy(const struct xt_target *target,
-                                  void *targinfo)
+static void xt_rateest_tg_destroy(const struct xt_tgdtor_param *par)
 {
-        struct xt_rateest_target_info *info = targinfo;
+        struct xt_rateest_target_info *info = par->targinfo;
 
         xt_rateest_put(info->est);
 }
 
-static struct xt_target xt_rateest_target[] __read_mostly = {
-        {
-                .family         = AF_INET,
-                .name           = "RATEEST",
-                .target         = xt_rateest_tg,
-                .checkentry     = xt_rateest_tg_checkentry,
-                .destroy        = xt_rateest_tg_destroy,
-                .targetsize     = sizeof(struct xt_rateest_target_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .family         = AF_INET6,
-                .name           = "RATEEST",
-                .target         = xt_rateest_tg,
-                .checkentry     = xt_rateest_tg_checkentry,
-                .destroy        = xt_rateest_tg_destroy,
-                .targetsize     = sizeof(struct xt_rateest_target_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_target xt_rateest_tg_reg __read_mostly = {
+        .name       = "RATEEST",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .target     = xt_rateest_tg,
+        .checkentry = xt_rateest_tg_checkentry,
+        .destroy    = xt_rateest_tg_destroy,
+        .targetsize = sizeof(struct xt_rateest_target_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init xt_rateest_tg_init(void)
@@ -186,13 +165,12 @@ static int __init xt_rateest_tg_init(void)
                 INIT_HLIST_HEAD(&rateest_hash[i]);
 
         get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
-        return xt_register_targets(xt_rateest_target,
-                                   ARRAY_SIZE(xt_rateest_target));
+        return xt_register_target(&xt_rateest_tg_reg);
 }
 
 static void __exit xt_rateest_tg_fini(void)
 {
-        xt_unregister_targets(xt_rateest_target, ARRAY_SIZE(xt_rateest_target));
+        xt_unregister_target(&xt_rateest_tg_reg);
 }
 
 
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 94f87ee7552b..7a6f9e6f5dfa 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -29,12 +29,10 @@ MODULE_ALIAS("ip6t_SECMARK");
 static u8 mode;
 
 static unsigned int
-secmark_tg(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+secmark_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         u32 secmark = 0;
-        const struct xt_secmark_target_info *info = targinfo;
+        const struct xt_secmark_target_info *info = par->targinfo;
 
         BUG_ON(info->mode != mode);
 
@@ -82,16 +80,14 @@ static bool checkentry_selinux(struct xt_secmark_target_info *info)
         return true;
 }
 
-static bool
-secmark_tg_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool secmark_tg_check(const struct xt_tgchk_param *par)
 {
-        struct xt_secmark_target_info *info = targinfo;
+        struct xt_secmark_target_info *info = par->targinfo;
 
-        if (strcmp(tablename, "mangle") && strcmp(tablename, "security")) {
+        if (strcmp(par->table, "mangle") != 0 &&
+            strcmp(par->table, "security") != 0) {
                 printk(KERN_INFO PFX "target only valid in the \'mangle\' "
-                       "or \'security\' tables, not \'%s\'.\n", tablename);
+                       "or \'security\' tables, not \'%s\'.\n", par->table);
                 return false;
         }
 
@@ -117,7 +113,7 @@ secmark_tg_check(const char *tablename, const void *entry,
         return true;
 }
 
-static void secmark_tg_destroy(const struct xt_target *target, void *targinfo)
+static void secmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
         switch (mode) {
         case SECMARK_MODE_SEL:
@@ -125,35 +121,25 @@ static void secmark_tg_destroy(const struct xt_target *target, void *targinfo)
         }
 }
 
-static struct xt_target secmark_tg_reg[] __read_mostly = {
-        {
-                .name           = "SECMARK",
-                .family         = AF_INET,
-                .checkentry     = secmark_tg_check,
-                .destroy        = secmark_tg_destroy,
-                .target         = secmark_tg,
-                .targetsize     = sizeof(struct xt_secmark_target_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "SECMARK",
-                .family         = AF_INET6,
-                .checkentry     = secmark_tg_check,
-                .destroy        = secmark_tg_destroy,
-                .target         = secmark_tg,
-                .targetsize     = sizeof(struct xt_secmark_target_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_target secmark_tg_reg __read_mostly = {
+        .name       = "SECMARK",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = secmark_tg_check,
+        .destroy    = secmark_tg_destroy,
+        .target     = secmark_tg,
+        .targetsize = sizeof(struct xt_secmark_target_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init secmark_tg_init(void)
 {
-        return xt_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
+        return xt_register_target(&secmark_tg_reg);
 }
 
 static void __exit secmark_tg_exit(void)
 {
-        xt_unregister_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
+        xt_unregister_target(&secmark_tg_reg);
 }
 
 module_init(secmark_tg_init);
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index beb5094703cb..4f3b1f808795 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -174,15 +174,13 @@ static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
 }
 
 static unsigned int
-tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+tcpmss_tg4(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct iphdr *iph = ip_hdr(skb);
         __be16 newlen;
         int ret;
 
-        ret = tcpmss_mangle_packet(skb, targinfo,
+        ret = tcpmss_mangle_packet(skb, par->targinfo,
                                    tcpmss_reverse_mtu(skb, PF_INET),
                                    iph->ihl * 4,
                                    sizeof(*iph) + sizeof(struct tcphdr));
@@ -199,9 +197,7 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 static unsigned int
-tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, unsigned int hooknum,
-           const struct xt_target *target, const void *targinfo)
+tcpmss_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         u8 nexthdr;
@@ -212,7 +208,7 @@ tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,
         tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
         if (tcphoff < 0)
                 return NF_DROP;
-        ret = tcpmss_mangle_packet(skb, targinfo,
+        ret = tcpmss_mangle_packet(skb, par->targinfo,
                                    tcpmss_reverse_mtu(skb, PF_INET6),
                                    tcphoff,
                                    sizeof(*ipv6h) + sizeof(struct tcphdr));
@@ -241,16 +237,13 @@ static inline bool find_syn_match(const struct xt_entry_match *m)
         return false;
 }
 
-static bool
-tcpmss_tg4_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
 {
-        const struct xt_tcpmss_info *info = targinfo;
-        const struct ipt_entry *e = entry;
+        const struct xt_tcpmss_info *info = par->targinfo;
+        const struct ipt_entry *e = par->entryinfo;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
-            (hook_mask & ~((1 << NF_INET_FORWARD) |
+            (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                            (1 << NF_INET_LOCAL_OUT) |
                            (1 << NF_INET_POST_ROUTING))) != 0) {
                 printk("xt_TCPMSS: path-MTU clamping only supported in "
@@ -264,16 +257,13 @@ tcpmss_tg4_check(const char *tablename, const void *entry,
 }
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-static bool
-tcpmss_tg6_check(const char *tablename, const void *entry,
-                 const struct xt_target *target, void *targinfo,
-                 unsigned int hook_mask)
+static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
 {
-        const struct xt_tcpmss_info *info = targinfo;
-        const struct ip6t_entry *e = entry;
+        const struct xt_tcpmss_info *info = par->targinfo;
+        const struct ip6t_entry *e = par->entryinfo;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
-            (hook_mask & ~((1 << NF_INET_FORWARD) |
+            (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                            (1 << NF_INET_LOCAL_OUT) |
                            (1 << NF_INET_POST_ROUTING))) != 0) {
                 printk("xt_TCPMSS: path-MTU clamping only supported in "
@@ -289,7 +279,7 @@ tcpmss_tg6_check(const char *tablename, const void *entry,
 
 static struct xt_target tcpmss_tg_reg[] __read_mostly = {
         {
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .name           = "TCPMSS",
                 .checkentry     = tcpmss_tg4_check,
                 .target         = tcpmss_tg4,
@@ -299,7 +289,7 @@ static struct xt_target tcpmss_tg_reg[] __read_mostly = {
         },
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
         {
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .name           = "TCPMSS",
                 .checkentry     = tcpmss_tg6_check,
                 .target         = tcpmss_tg6,
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c
index 9685b6fcbc81..9dd8c8ef63eb 100644
--- a/net/netfilter/xt_TCPOPTSTRIP.c
+++ b/net/netfilter/xt_TCPOPTSTRIP.c
@@ -75,19 +75,15 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
 }
 
 static unsigned int
-tcpoptstrip_tg4(struct sk_buff *skb, const struct net_device *in,
-                const struct net_device *out, unsigned int hooknum,
-                const struct xt_target *target, const void *targinfo)
+tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_target_param *par)
 {
-        return tcpoptstrip_mangle_packet(skb, targinfo, ip_hdrlen(skb),
+        return tcpoptstrip_mangle_packet(skb, par->targinfo, ip_hdrlen(skb),
                sizeof(struct iphdr) + sizeof(struct tcphdr));
 }
 
 #if defined(CONFIG_IP6_NF_MANGLE) || defined(CONFIG_IP6_NF_MANGLE_MODULE)
 static unsigned int
-tcpoptstrip_tg6(struct sk_buff *skb, const struct net_device *in,
-                const struct net_device *out, unsigned int hooknum,
-                const struct xt_target *target, const void *targinfo)
+tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_target_param *par)
 {
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         int tcphoff;
@@ -98,7 +94,7 @@ tcpoptstrip_tg6(struct sk_buff *skb, const struct net_device *in,
         if (tcphoff < 0)
                 return NF_DROP;
 
-        return tcpoptstrip_mangle_packet(skb, targinfo, tcphoff,
+        return tcpoptstrip_mangle_packet(skb, par->targinfo, tcphoff,
                sizeof(*ipv6h) + sizeof(struct tcphdr));
 }
 #endif
@@ -106,7 +102,7 @@ tcpoptstrip_tg6(struct sk_buff *skb, const struct net_device *in,
 static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
         {
                 .name       = "TCPOPTSTRIP",
-                .family     = AF_INET,
+                .family     = NFPROTO_IPV4,
                 .table      = "mangle",
                 .proto      = IPPROTO_TCP,
                 .target     = tcpoptstrip_tg4,
@@ -116,7 +112,7 @@ static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
 #if defined(CONFIG_IP6_NF_MANGLE) || defined(CONFIG_IP6_NF_MANGLE_MODULE)
         {
                 .name       = "TCPOPTSTRIP",
-                .family     = AF_INET6,
+                .family     = NFPROTO_IPV6,
                 .table      = "mangle",
                 .proto      = IPPROTO_TCP,
                 .target     = tcpoptstrip_tg6,
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
new file mode 100644
index 000000000000..1340c2fa3621
--- /dev/null
+++ b/net/netfilter/xt_TPROXY.c
@@ -0,0 +1,102 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (c) 2006-2007 BalaBit IT Ltd.
+ * Author: Balazs Scheidler, Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+#include <net/udp.h>
+#include <net/inet_sock.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter/xt_TPROXY.h>
+
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#include <net/netfilter/nf_tproxy_core.h>
+
+static unsigned int
+tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par)
+{
+        const struct iphdr *iph = ip_hdr(skb);
+        const struct xt_tproxy_target_info *tgi = par->targinfo;
+        struct udphdr _hdr, *hp;
+        struct sock *sk;
+
+        hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
+        if (hp == NULL)
+                return NF_DROP;
+
+        sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
+                                   iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr,
+                                   hp->source, tgi->lport ? tgi->lport : hp->dest,
+                                   par->in, true);
+
+        /* NOTE: assign_sock consumes our sk reference */
+        if (sk && nf_tproxy_assign_sock(skb, sk)) {
+                /* This should be in a separate target, but we don't do multiple
+                   targets on the same rule yet */
+                skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
+
+                pr_debug("redirecting: proto %u %08x:%u -> %08x:%u, mark: %x\n",
+                         iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),
+                         ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+                return NF_ACCEPT;
+        }
+
+        pr_debug("no socket, dropping: proto %u %08x:%u -> %08x:%u, mark: %x\n",
+                 iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),
+                 ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+        return NF_DROP;
+}
+
+static bool tproxy_tg_check(const struct xt_tgchk_param *par)
+{
+        const struct ipt_ip *i = par->entryinfo;
+
+        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
+            && !(i->invflags & IPT_INV_PROTO))
+                return true;
+
+        pr_info("xt_TPROXY: Can be used only in combination with "
+                "either -p tcp or -p udp\n");
+        return false;
+}
+
+static struct xt_target tproxy_tg_reg __read_mostly = {
+        .name           = "TPROXY",
+        .family         = AF_INET,
+        .table          = "mangle",
+        .target         = tproxy_tg,
+        .targetsize     = sizeof(struct xt_tproxy_target_info),
+        .checkentry     = tproxy_tg_check,
+        .hooks          = 1 << NF_INET_PRE_ROUTING,
+        .me             = THIS_MODULE,
+};
+
+static int __init tproxy_tg_init(void)
+{
+        nf_defrag_ipv4_enable();
+        return xt_register_target(&tproxy_tg_reg);
+}
+
+static void __exit tproxy_tg_exit(void)
+{
+        xt_unregister_target(&tproxy_tg_reg);
+}
+
+module_init(tproxy_tg_init);
+module_exit(tproxy_tg_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Krisztian Kovacs");
+MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module.");
+MODULE_ALIAS("ipt_TPROXY");
diff --git a/net/netfilter/xt_TRACE.c b/net/netfilter/xt_TRACE.c
index 30dab79a3438..fbb04b86c46b 100644
--- a/net/netfilter/xt_TRACE.c
+++ b/net/netfilter/xt_TRACE.c
@@ -11,39 +11,29 @@ MODULE_ALIAS("ipt_TRACE");
 MODULE_ALIAS("ip6t_TRACE");
 
 static unsigned int
-trace_tg(struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, unsigned int hooknum,
-         const struct xt_target *target, const void *targinfo)
+trace_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         skb->nf_trace = 1;
         return XT_CONTINUE;
 }
 
-static struct xt_target trace_tg_reg[] __read_mostly = {
-        {
-                .name           = "TRACE",
-                .family         = AF_INET,
-                .target         = trace_tg,
-                .table          = "raw",
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "TRACE",
-                .family         = AF_INET6,
-                .target         = trace_tg,
-                .table          = "raw",
-                .me             = THIS_MODULE,
-        },
+static struct xt_target trace_tg_reg __read_mostly = {
+        .name       = "TRACE",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .table      = "raw",
+        .target     = trace_tg,
+        .me         = THIS_MODULE,
 };
 
 static int __init trace_tg_init(void)
 {
-        return xt_register_targets(trace_tg_reg, ARRAY_SIZE(trace_tg_reg));
+        return xt_register_target(&trace_tg_reg);
 }
 
 static void __exit trace_tg_exit(void)
 {
-        xt_unregister_targets(trace_tg_reg, ARRAY_SIZE(trace_tg_reg));
+        xt_unregister_target(&trace_tg_reg);
 }
 
 module_init(trace_tg_init);
diff --git a/net/netfilter/xt_comment.c b/net/netfilter/xt_comment.c
index 89f47364e848..e82179832acd 100644
--- a/net/netfilter/xt_comment.c
+++ b/net/netfilter/xt_comment.c
@@ -16,40 +16,29 @@ MODULE_ALIAS("ipt_comment");
 MODULE_ALIAS("ip6t_comment");
 
 static bool
-comment_mt(const struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, const struct xt_match *match,
-           const void *matchinfo, int offset, unsigned int protooff,
-           bool *hotdrop)
+comment_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         /* We always match */
         return true;
 }
 
-static struct xt_match comment_mt_reg[] __read_mostly = {
-        {
-                .name           = "comment",
-                .family         = AF_INET,
-                .match          = comment_mt,
-                .matchsize      = sizeof(struct xt_comment_info),
-                .me             = THIS_MODULE
-        },
-        {
-                .name           = "comment",
-                .family         = AF_INET6,
-                .match          = comment_mt,
-                .matchsize      = sizeof(struct xt_comment_info),
-                .me             = THIS_MODULE
-        },
+static struct xt_match comment_mt_reg __read_mostly = {
+        .name      = "comment",
+        .revision  = 0,
+        .family    = NFPROTO_UNSPEC,
+        .match     = comment_mt,
+        .matchsize = sizeof(struct xt_comment_info),
+        .me        = THIS_MODULE,
 };
 
 static int __init comment_mt_init(void)
 {
-        return xt_register_matches(comment_mt_reg, ARRAY_SIZE(comment_mt_reg));
+        return xt_register_match(&comment_mt_reg);
 }
 
 static void __exit comment_mt_exit(void)
 {
-        xt_unregister_matches(comment_mt_reg, ARRAY_SIZE(comment_mt_reg));
+        xt_unregister_match(&comment_mt_reg);
 }
 
 module_init(comment_mt_init);
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c
index 3e39c4fe1931..955e6598a7f0 100644
--- a/net/netfilter/xt_connbytes.c
+++ b/net/netfilter/xt_connbytes.c
@@ -17,12 +17,9 @@ MODULE_ALIAS("ipt_connbytes");
 MODULE_ALIAS("ip6t_connbytes");
 
 static bool
-connbytes_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+connbytes_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_connbytes_info *sinfo = matchinfo;
+        const struct xt_connbytes_info *sinfo = par->matchinfo;
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         u_int64_t what = 0;     /* initialize to make gcc happy */
@@ -95,12 +92,9 @@ connbytes_mt(const struct sk_buff *skb, const struct net_device *in,
                 return what >= sinfo->count.from;
 }
 
-static bool
-connbytes_mt_check(const char *tablename, const void *ip,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool connbytes_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_connbytes_info *sinfo = matchinfo;
+        const struct xt_connbytes_info *sinfo = par->matchinfo;
 
         if (sinfo->what != XT_CONNBYTES_PKTS &&
             sinfo->what != XT_CONNBYTES_BYTES &&
@@ -112,51 +106,39 @@ connbytes_mt_check(const char *tablename, const void *ip,
             sinfo->direction != XT_CONNBYTES_DIR_BOTH)
                 return false;
 
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", match->family);
+                                    "proto=%u\n", par->family);
                 return false;
         }
 
         return true;
 }
 
-static void
-connbytes_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        nf_ct_l3proto_module_put(match->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
-static struct xt_match connbytes_mt_reg[] __read_mostly = {
-        {
-                .name           = "connbytes",
-                .family         = AF_INET,
-                .checkentry     = connbytes_mt_check,
-                .match          = connbytes_mt,
-                .destroy        = connbytes_mt_destroy,
-                .matchsize      = sizeof(struct xt_connbytes_info),
-                .me             = THIS_MODULE
-        },
-        {
-                .name           = "connbytes",
-                .family         = AF_INET6,
-                .checkentry     = connbytes_mt_check,
-                .match          = connbytes_mt,
-                .destroy        = connbytes_mt_destroy,
-                .matchsize      = sizeof(struct xt_connbytes_info),
-                .me             = THIS_MODULE
-        },
+static struct xt_match connbytes_mt_reg __read_mostly = {
+        .name       = "connbytes",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = connbytes_mt_check,
+        .match      = connbytes_mt,
+        .destroy    = connbytes_mt_destroy,
+        .matchsize  = sizeof(struct xt_connbytes_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init connbytes_mt_init(void)
 {
-        return xt_register_matches(connbytes_mt_reg,
-               ARRAY_SIZE(connbytes_mt_reg));
+        return xt_register_match(&connbytes_mt_reg);
 }
 
 static void __exit connbytes_mt_exit(void)
 {
-        xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));
+        xt_unregister_match(&connbytes_mt_reg);
 }
 
 module_init(connbytes_mt_init);
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 70907f6baac3..7f404cc64c83 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -82,9 +82,9 @@ static inline bool already_closed(const struct nf_conn *conn)
 static inline unsigned int
 same_source_net(const union nf_inet_addr *addr,
                 const union nf_inet_addr *mask,
-                const union nf_inet_addr *u3, unsigned int family)
+                const union nf_inet_addr *u3, u_int8_t family)
 {
-        if (family == AF_INET) {
+        if (family == NFPROTO_IPV4) {
                 return (addr->ip & mask->ip) == (u3->ip & mask->ip);
         } else {
                 union nf_inet_addr lh, rh;
@@ -114,7 +114,7 @@ static int count_them(struct xt_connlimit_data *data,
         int matches = 0;
 
 
-        if (match->family == AF_INET6)
+        if (match->family == NFPROTO_IPV6)
                 hash = &data->iphash[connlimit_iphash6(addr, mask)];
         else
                 hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
@@ -123,7 +123,7 @@ static int count_them(struct xt_connlimit_data *data,
 
         /* check the saved connections */
         list_for_each_entry_safe(conn, tmp, hash, list) {
-                found    = __nf_conntrack_find(&conn->tuple);
+                found    = __nf_conntrack_find(&init_net, &conn->tuple);
                 found_ct = NULL;
 
                 if (found != NULL)
@@ -178,12 +178,9 @@ static int count_them(struct xt_connlimit_data *data,
 }
 
 static bool
-connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_connlimit_info *info = matchinfo;
+        const struct xt_connlimit_info *info = par->matchinfo;
         union nf_inet_addr addr;
         struct nf_conntrack_tuple tuple;
         const struct nf_conntrack_tuple *tuple_ptr = &tuple;
@@ -195,10 +192,10 @@ connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
         if (ct != NULL)
                 tuple_ptr = &ct->tuplehash[0].tuple;
         else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
-                                    match->family, &tuple))
+                                    par->family, &tuple))
                 goto hotdrop;
 
-        if (match->family == AF_INET6) {
+        if (par->family == NFPROTO_IPV6) {
                 const struct ipv6hdr *iph = ipv6_hdr(skb);
                 memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
         } else {
@@ -208,40 +205,37 @@ connlimit_mt(const struct sk_buff *skb, const struct net_device *in,
 
         spin_lock_bh(&info->data->lock);
         connections = count_them(info->data, tuple_ptr, &addr,
-                                 &info->mask, match);
+                                 &info->mask, par->match);
         spin_unlock_bh(&info->data->lock);
 
         if (connections < 0) {
                 /* kmalloc failed, drop it entirely */
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
         return (connections > info->limit) ^ info->inverse;
 
  hotdrop:
-        *hotdrop = true;
+        *par->hotdrop = true;
         return false;
 }
 
-static bool
-connlimit_mt_check(const char *tablename, const void *ip,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool connlimit_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_connlimit_info *info = matchinfo;
+        struct xt_connlimit_info *info = par->matchinfo;
         unsigned int i;
 
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "cannot load conntrack support for "
-                       "address family %u\n", match->family);
+                       "address family %u\n", par->family);
                 return false;
         }
 
         /* init private data */
         info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
         if (info->data == NULL) {
-                nf_ct_l3proto_module_put(match->family);
+                nf_ct_l3proto_module_put(par->family);
                 return false;
         }
 
@@ -252,16 +246,15 @@ connlimit_mt_check(const char *tablename, const void *ip,
         return true;
 }
 
-static void
-connlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        const struct xt_connlimit_info *info = matchinfo;
+        const struct xt_connlimit_info *info = par->matchinfo;
         struct xt_connlimit_conn *conn;
         struct xt_connlimit_conn *tmp;
         struct list_head *hash = info->data->iphash;
         unsigned int i;
 
-        nf_ct_l3proto_module_put(match->family);
+        nf_ct_l3proto_module_put(par->family);
 
         for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
                 list_for_each_entry_safe(conn, tmp, &hash[i], list) {
@@ -273,41 +266,30 @@ connlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
         kfree(info->data);
 }
 
-static struct xt_match connlimit_mt_reg[] __read_mostly = {
-        {
-                .name       = "connlimit",
-                .family     = AF_INET,
-                .checkentry = connlimit_mt_check,
-                .match      = connlimit_mt,
-                .matchsize  = sizeof(struct xt_connlimit_info),
-                .destroy    = connlimit_mt_destroy,
-                .me         = THIS_MODULE,
-        },
-        {
-                .name       = "connlimit",
-                .family     = AF_INET6,
-                .checkentry = connlimit_mt_check,
-                .match      = connlimit_mt,
-                .matchsize  = sizeof(struct xt_connlimit_info),
-                .destroy    = connlimit_mt_destroy,
-                .me         = THIS_MODULE,
-        },
+static struct xt_match connlimit_mt_reg __read_mostly = {
+        .name       = "connlimit",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = connlimit_mt_check,
+        .match      = connlimit_mt,
+        .matchsize  = sizeof(struct xt_connlimit_info),
+        .destroy    = connlimit_mt_destroy,
+        .me         = THIS_MODULE,
 };
 
 static int __init connlimit_mt_init(void)
 {
-        return xt_register_matches(connlimit_mt_reg,
-               ARRAY_SIZE(connlimit_mt_reg));
+        return xt_register_match(&connlimit_mt_reg);
 }
 
 static void __exit connlimit_mt_exit(void)
 {
-        xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg));
+        xt_unregister_match(&connlimit_mt_reg);
 }
 
 module_init(connlimit_mt_init);
 module_exit(connlimit_mt_exit);
-MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
 MODULE_DESCRIPTION("Xtables: Number of connections matching");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_connlimit");
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index aaa1b96691f9..86cacab7a4a3 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -34,12 +34,9 @@ MODULE_ALIAS("ipt_connmark");
 MODULE_ALIAS("ip6t_connmark");
 
 static bool
-connmark_mt(const struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, const struct xt_match *match,
-            const void *matchinfo, int offset, unsigned int protoff,
-            bool *hotdrop)
+connmark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_connmark_mtinfo1 *info = matchinfo;
+        const struct xt_connmark_mtinfo1 *info = par->matchinfo;
         enum ip_conntrack_info ctinfo;
         const struct nf_conn *ct;
 
@@ -51,12 +48,9 @@ connmark_mt(const struct sk_buff *skb, const struct net_device *in,
 }
 
 static bool
-connmark_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-               const struct net_device *out, const struct xt_match *match,
-               const void *matchinfo, int offset, unsigned int protoff,
-               bool *hotdrop)
+connmark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_connmark_info *info = matchinfo;
+        const struct xt_connmark_info *info = par->matchinfo;
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
 
@@ -67,42 +61,35 @@ connmark_mt_v0(const struct sk_buff *skb, const struct net_device *in,
         return ((ct->mark & info->mask) == info->mark) ^ info->invert;
 }
 
-static bool
-connmark_mt_check_v0(const char *tablename, const void *ip,
-                     const struct xt_match *match, void *matchinfo,
-                     unsigned int hook_mask)
+static bool connmark_mt_check_v0(const struct xt_mtchk_param *par)
 {
-        const struct xt_connmark_info *cm = matchinfo;
+        const struct xt_connmark_info *cm = par->matchinfo;
 
         if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
                 printk(KERN_WARNING "connmark: only support 32bit mark\n");
                 return false;
         }
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", match->family);
+                                    "proto=%u\n", par->family);
                 return false;
         }
         return true;
 }
 
-static bool
-connmark_mt_check(const char *tablename, const void *ip,
-                  const struct xt_match *match, void *matchinfo,
-                  unsigned int hook_mask)
+static bool connmark_mt_check(const struct xt_mtchk_param *par)
 {
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "cannot load conntrack support for "
-                       "proto=%u\n", match->family);
+                       "proto=%u\n", par->family);
                 return false;
         }
         return true;
 }
 
-static void
-connmark_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void connmark_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        nf_ct_l3proto_module_put(match->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
 #ifdef CONFIG_COMPAT
@@ -140,7 +127,7 @@ static struct xt_match connmark_mt_reg[] __read_mostly = {
         {
                 .name           = "connmark",
                 .revision       = 0,
-                .family         = AF_INET,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = connmark_mt_check_v0,
                 .match          = connmark_mt_v0,
                 .destroy        = connmark_mt_destroy,
@@ -153,34 +140,9 @@ static struct xt_match connmark_mt_reg[] __read_mostly = {
                 .me             = THIS_MODULE
         },
         {
-                .name           = "connmark",
-                .revision       = 0,
-                .family         = AF_INET6,
-                .checkentry     = connmark_mt_check_v0,
-                .match          = connmark_mt_v0,
-                .destroy        = connmark_mt_destroy,
-                .matchsize      = sizeof(struct xt_connmark_info),
-#ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_connmark_info),
-                .compat_from_user = connmark_mt_compat_from_user_v0,
-                .compat_to_user = connmark_mt_compat_to_user_v0,
-#endif
-                .me             = THIS_MODULE
-        },
-        {
-                .name           = "connmark",
-                .revision       = 1,
-                .family         = AF_INET,
-                .checkentry     = connmark_mt_check,
-                .match          = connmark_mt,
-                .matchsize      = sizeof(struct xt_connmark_mtinfo1),
-                .destroy        = connmark_mt_destroy,
-                .me             = THIS_MODULE,
-        },
-        {
                 .name           = "connmark",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = connmark_mt_check,
                 .match          = connmark_mt,
                 .matchsize      = sizeof(struct xt_connmark_mtinfo1),
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index d61412f58ef7..0b7139f3dd78 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -25,12 +25,9 @@ MODULE_ALIAS("ipt_conntrack");
 MODULE_ALIAS("ip6t_conntrack");
 
 static bool
-conntrack_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-                const struct net_device *out, const struct xt_match *match,
-                const void *matchinfo, int offset, unsigned int protoff,
-                bool *hotdrop)
+conntrack_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_conntrack_info *sinfo = matchinfo;
+        const struct xt_conntrack_info *sinfo = par->matchinfo;
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         unsigned int statebit;
@@ -121,9 +118,9 @@ conntrack_addrcmp(const union nf_inet_addr *kaddr,
                   const union nf_inet_addr *uaddr,
                   const union nf_inet_addr *umask, unsigned int l3proto)
 {
-        if (l3proto == AF_INET)
+        if (l3proto == NFPROTO_IPV4)
                 return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
-        else if (l3proto == AF_INET6)
+        else if (l3proto == NFPROTO_IPV6)
                 return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
                        &uaddr->in6) == 0;
         else
@@ -133,7 +130,7 @@ conntrack_addrcmp(const union nf_inet_addr *kaddr,
 static inline bool
 conntrack_mt_origsrc(const struct nf_conn *ct,
                      const struct xt_conntrack_mtinfo1 *info,
-                     unsigned int family)
+                     u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
                &info->origsrc_addr, &info->origsrc_mask, family);
@@ -142,7 +139,7 @@ conntrack_mt_origsrc(const struct nf_conn *ct,
 static inline bool
 conntrack_mt_origdst(const struct nf_conn *ct,
                      const struct xt_conntrack_mtinfo1 *info,
-                     unsigned int family)
+                     u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
                &info->origdst_addr, &info->origdst_mask, family);
@@ -151,7 +148,7 @@ conntrack_mt_origdst(const struct nf_conn *ct,
 static inline bool
 conntrack_mt_replsrc(const struct nf_conn *ct,
                      const struct xt_conntrack_mtinfo1 *info,
-                     unsigned int family)
+                     u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
                &info->replsrc_addr, &info->replsrc_mask, family);
@@ -160,7 +157,7 @@ conntrack_mt_replsrc(const struct nf_conn *ct,
 static inline bool
 conntrack_mt_repldst(const struct nf_conn *ct,
                      const struct xt_conntrack_mtinfo1 *info,
-                     unsigned int family)
+                     u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
                &info->repldst_addr, &info->repldst_mask, family);
@@ -205,12 +202,9 @@ ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
 }
 
 static bool
-conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_conntrack_mtinfo1 *info = matchinfo;
+        const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
         enum ip_conntrack_info ctinfo;
         const struct nf_conn *ct;
         unsigned int statebit;
@@ -244,22 +238,22 @@ conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
                 return false;
 
         if (info->match_flags & XT_CONNTRACK_ORIGSRC)
-                if (conntrack_mt_origsrc(ct, info, match->family) ^
+                if (conntrack_mt_origsrc(ct, info, par->family) ^
                     !(info->invert_flags & XT_CONNTRACK_ORIGSRC))
                         return false;
 
         if (info->match_flags & XT_CONNTRACK_ORIGDST)
-                if (conntrack_mt_origdst(ct, info, match->family) ^
+                if (conntrack_mt_origdst(ct, info, par->family) ^
                     !(info->invert_flags & XT_CONNTRACK_ORIGDST))
                         return false;
 
         if (info->match_flags & XT_CONNTRACK_REPLSRC)
-                if (conntrack_mt_replsrc(ct, info, match->family) ^
+                if (conntrack_mt_replsrc(ct, info, par->family) ^
                     !(info->invert_flags & XT_CONNTRACK_REPLSRC))
                         return false;
 
         if (info->match_flags & XT_CONNTRACK_REPLDST)
-                if (conntrack_mt_repldst(ct, info, match->family) ^
+                if (conntrack_mt_repldst(ct, info, par->family) ^
                     !(info->invert_flags & XT_CONNTRACK_REPLDST))
                         return false;
 
@@ -284,23 +278,19 @@ conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
         return true;
 }
 
-static bool
-conntrack_mt_check(const char *tablename, const void *ip,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool conntrack_mt_check(const struct xt_mtchk_param *par)
 {
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", match->family);
+                                    "proto=%u\n", par->family);
                 return false;
         }
         return true;
 }
 
-static void
-conntrack_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        nf_ct_l3proto_module_put(match->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
 #ifdef CONFIG_COMPAT
@@ -356,7 +346,7 @@ static struct xt_match conntrack_mt_reg[] __read_mostly = {
         {
                 .name       = "conntrack",
                 .revision   = 0,
-                .family     = AF_INET,
+                .family     = NFPROTO_IPV4,
                 .match      = conntrack_mt_v0,
                 .checkentry = conntrack_mt_check,
                 .destroy    = conntrack_mt_destroy,
@@ -371,17 +361,7 @@ static struct xt_match conntrack_mt_reg[] __read_mostly = {
         {
                 .name       = "conntrack",
                 .revision   = 1,
-                .family     = AF_INET,
-                .matchsize  = sizeof(struct xt_conntrack_mtinfo1),
-                .match      = conntrack_mt,
-                .checkentry = conntrack_mt_check,
-                .destroy    = conntrack_mt_destroy,
-                .me         = THIS_MODULE,
-        },
-        {
-                .name       = "conntrack",
-                .revision   = 1,
-                .family     = AF_INET6,
+                .family     = NFPROTO_UNSPEC,
                 .matchsize  = sizeof(struct xt_conntrack_mtinfo1),
                 .match      = conntrack_mt,
                 .checkentry = conntrack_mt_check,
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index 8b6522186d9f..e5d3e8673287 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -93,20 +93,18 @@ match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
 }
 
 static bool
-dccp_mt(const struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, const struct xt_match *match,
-        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+dccp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_dccp_info *info = matchinfo;
+        const struct xt_dccp_info *info = par->matchinfo;
         const struct dccp_hdr *dh;
         struct dccp_hdr _dh;
 
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        dh = skb_header_pointer(skb, protoff, sizeof(_dh), &_dh);
+        dh = skb_header_pointer(skb, par->thoff, sizeof(_dh), &_dh);
         if (dh == NULL) {
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -118,17 +116,14 @@ dccp_mt(const struct sk_buff *skb, const struct net_device *in,
                         XT_DCCP_DEST_PORTS, info->flags, info->invflags)
                 && DCCHECK(match_types(dh, info->typemask),
                            XT_DCCP_TYPE, info->flags, info->invflags)
-                && DCCHECK(match_option(info->option, skb, protoff, dh,
-                                        hotdrop),
+                && DCCHECK(match_option(info->option, skb, par->thoff, dh,
+                                        par->hotdrop),
                            XT_DCCP_OPTION, info->flags, info->invflags);
 }
 
-static bool
-dccp_mt_check(const char *tablename, const void *inf,
-              const struct xt_match *match, void *matchinfo,
-              unsigned int hook_mask)
+static bool dccp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_dccp_info *info = matchinfo;
+        const struct xt_dccp_info *info = par->matchinfo;
 
         return !(info->flags & ~XT_DCCP_VALID_FLAGS)
                 && !(info->invflags & ~XT_DCCP_VALID_FLAGS)
@@ -138,7 +133,7 @@ dccp_mt_check(const char *tablename, const void *inf,
 static struct xt_match dccp_mt_reg[] __read_mostly = {
         {
                 .name           = "dccp",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = dccp_mt_check,
                 .match          = dccp_mt,
                 .matchsize      = sizeof(struct xt_dccp_info),
@@ -147,7 +142,7 @@ static struct xt_match dccp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "dccp",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = dccp_mt_check,
                 .match          = dccp_mt,
                 .matchsize      = sizeof(struct xt_dccp_info),
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
index 26f4aab9c429..c3f8085460d7 100644
--- a/net/netfilter/xt_dscp.c
+++ b/net/netfilter/xt_dscp.c
@@ -26,61 +26,48 @@ MODULE_ALIAS("ipt_tos");
 MODULE_ALIAS("ip6t_tos");
 
 static bool
-dscp_mt(const struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, const struct xt_match *match,
-        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+dscp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_dscp_info *info = matchinfo;
+        const struct xt_dscp_info *info = par->matchinfo;
         u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
 
         return (dscp == info->dscp) ^ !!info->invert;
 }
 
 static bool
-dscp_mt6(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+dscp_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_dscp_info *info = matchinfo;
+        const struct xt_dscp_info *info = par->matchinfo;
         u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
 
         return (dscp == info->dscp) ^ !!info->invert;
 }
 
-static bool
-dscp_mt_check(const char *tablename, const void *info,
-              const struct xt_match *match, void *matchinfo,
-              unsigned int hook_mask)
+static bool dscp_mt_check(const struct xt_mtchk_param *par)
 {
-        const u_int8_t dscp = ((struct xt_dscp_info *)matchinfo)->dscp;
+        const struct xt_dscp_info *info = par->matchinfo;
 
-        if (dscp > XT_DSCP_MAX) {
-                printk(KERN_ERR "xt_dscp: dscp %x out of range\n", dscp);
+        if (info->dscp > XT_DSCP_MAX) {
+                printk(KERN_ERR "xt_dscp: dscp %x out of range\n", info->dscp);
                 return false;
         }
 
         return true;
 }
 
-static bool tos_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-                      const struct net_device *out,
-                      const struct xt_match *match, const void *matchinfo,
-                      int offset, unsigned int protoff, bool *hotdrop)
+static bool
+tos_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_tos_info *info = matchinfo;
+        const struct ipt_tos_info *info = par->matchinfo;
 
         return (ip_hdr(skb)->tos == info->tos) ^ info->invert;
 }
 
-static bool tos_mt(const struct sk_buff *skb, const struct net_device *in,
-                   const struct net_device *out, const struct xt_match *match,
-                   const void *matchinfo, int offset, unsigned int protoff,
-                   bool *hotdrop)
+static bool tos_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_tos_match_info *info = matchinfo;
+        const struct xt_tos_match_info *info = par->matchinfo;
 
-        if (match->family == AF_INET)
+        if (par->match->family == NFPROTO_IPV4)
                 return ((ip_hdr(skb)->tos & info->tos_mask) ==
                        info->tos_value) ^ !!info->invert;
         else
@@ -91,7 +78,7 @@ static bool tos_mt(const struct sk_buff *skb, const struct net_device *in,
 static struct xt_match dscp_mt_reg[] __read_mostly = {
         {
                 .name           = "dscp",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = dscp_mt_check,
                 .match          = dscp_mt,
                 .matchsize      = sizeof(struct xt_dscp_info),
@@ -99,7 +86,7 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "dscp",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = dscp_mt_check,
                 .match          = dscp_mt6,
                 .matchsize      = sizeof(struct xt_dscp_info),
@@ -108,7 +95,7 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
         {
                 .name           = "tos",
                 .revision       = 0,
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = tos_mt_v0,
                 .matchsize      = sizeof(struct ipt_tos_info),
                 .me             = THIS_MODULE,
@@ -116,7 +103,7 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
         {
                 .name           = "tos",
                 .revision       = 1,
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = tos_mt,
                 .matchsize      = sizeof(struct xt_tos_match_info),
                 .me             = THIS_MODULE,
@@ -124,7 +111,7 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
         {
                 .name           = "tos",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = tos_mt,
                 .matchsize      = sizeof(struct xt_tos_match_info),
                 .me             = THIS_MODULE,
diff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c
index a133eb9b23e1..609439967c2c 100644
--- a/net/netfilter/xt_esp.c
+++ b/net/netfilter/xt_esp.c
@@ -42,26 +42,23 @@ spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
         return r;
 }
 
-static bool
-esp_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool esp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const struct ip_esp_hdr *eh;
         struct ip_esp_hdr _esp;
-        const struct xt_esp *espinfo = matchinfo;
+        const struct xt_esp *espinfo = par->matchinfo;
 
         /* Must not be a fragment. */
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        eh = skb_header_pointer(skb, protoff, sizeof(_esp), &_esp);
+        eh = skb_header_pointer(skb, par->thoff, sizeof(_esp), &_esp);
         if (eh == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("Dropping evil ESP tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -69,13 +66,9 @@ esp_mt(const struct sk_buff *skb, const struct net_device *in,
                          !!(espinfo->invflags & XT_ESP_INV_SPI));
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-esp_mt_check(const char *tablename, const void *ip_void,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool esp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_esp *espinfo = matchinfo;
+        const struct xt_esp *espinfo = par->matchinfo;
 
         if (espinfo->invflags & ~XT_ESP_INV_MASK) {
                 duprintf("xt_esp: unknown flags %X\n", espinfo->invflags);
@@ -88,7 +81,7 @@ esp_mt_check(const char *tablename, const void *ip_void,
 static struct xt_match esp_mt_reg[] __read_mostly = {
         {
                 .name           = "esp",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = esp_mt_check,
                 .match          = esp_mt,
                 .matchsize      = sizeof(struct xt_esp),
@@ -97,7 +90,7 @@ static struct xt_match esp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "esp",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = esp_mt_check,
                 .match          = esp_mt,
                 .matchsize      = sizeof(struct xt_esp),
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index d9418a267812..6fc4292d46e6 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -80,7 +80,7 @@ struct dsthash_ent {
 struct xt_hashlimit_htable {
         struct hlist_node node;         /* global list of all htables */
         atomic_t use;
-        int family;
+        u_int8_t family;
 
         struct hashlimit_cfg1 cfg;      /* config */
 
@@ -185,7 +185,7 @@ dsthash_free(struct xt_hashlimit_htable *ht, struct dsthash_ent *ent)
 }
 static void htable_gc(unsigned long htlong);
 
-static int htable_create_v0(struct xt_hashlimit_info *minfo, int family)
+static int htable_create_v0(struct xt_hashlimit_info *minfo, u_int8_t family)
 {
         struct xt_hashlimit_htable *hinfo;
         unsigned int size;
@@ -218,7 +218,7 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, int family)
         hinfo->cfg.gc_interval = minfo->cfg.gc_interval;
         hinfo->cfg.expire      = minfo->cfg.expire;
 
-        if (family == AF_INET)
+        if (family == NFPROTO_IPV4)
                 hinfo->cfg.srcmask = hinfo->cfg.dstmask = 32;
         else
                 hinfo->cfg.srcmask = hinfo->cfg.dstmask = 128;
@@ -237,11 +237,10 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, int family)
         hinfo->family = family;
         hinfo->rnd_initialized = 0;
         spin_lock_init(&hinfo->lock);
-        hinfo->pde =
-                proc_create_data(minfo->name, 0,
-                                 family == AF_INET ? hashlimit_procdir4 :
-                                                     hashlimit_procdir6,
-                                 &dl_file_ops, hinfo);
+        hinfo->pde = proc_create_data(minfo->name, 0,
+                (family == NFPROTO_IPV4) ?
+                hashlimit_procdir4 : hashlimit_procdir6,
+                &dl_file_ops, hinfo);
         if (!hinfo->pde) {
                 vfree(hinfo);
                 return -1;
@@ -258,8 +257,7 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, int family)
         return 0;
 }
 
-static int htable_create(struct xt_hashlimit_mtinfo1 *minfo,
-                         unsigned int family)
+static int htable_create(struct xt_hashlimit_mtinfo1 *minfo, u_int8_t family)
 {
         struct xt_hashlimit_htable *hinfo;
         unsigned int size;
@@ -301,11 +299,10 @@ static int htable_create(struct xt_hashlimit_mtinfo1 *minfo,
         hinfo->rnd_initialized = 0;
         spin_lock_init(&hinfo->lock);
 
-        hinfo->pde =
-                proc_create_data(minfo->name, 0,
-                                 family == AF_INET ? hashlimit_procdir4 :
-                                                     hashlimit_procdir6,
-                                 &dl_file_ops, hinfo);
+        hinfo->pde = proc_create_data(minfo->name, 0,
+                (family == NFPROTO_IPV4) ?
+                hashlimit_procdir4 : hashlimit_procdir6,
+                &dl_file_ops, hinfo);
         if (hinfo->pde == NULL) {
                 vfree(hinfo);
                 return -1;
@@ -371,14 +368,14 @@ static void htable_destroy(struct xt_hashlimit_htable *hinfo)
 
         /* remove proc entry */
         remove_proc_entry(hinfo->pde->name,
-                          hinfo->family == AF_INET ? hashlimit_procdir4 :
+                          hinfo->family == NFPROTO_IPV4 ? hashlimit_procdir4 :
                                                      hashlimit_procdir6);
         htable_selective_cleanup(hinfo, select_all);
         vfree(hinfo);
 }
 
 static struct xt_hashlimit_htable *htable_find_get(const char *name,
-                                                   int family)
+                                                   u_int8_t family)
 {
         struct xt_hashlimit_htable *hinfo;
         struct hlist_node *pos;
@@ -502,7 +499,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
         memset(dst, 0, sizeof(*dst));
 
         switch (hinfo->family) {
-        case AF_INET:
+        case NFPROTO_IPV4:
                 if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
                         dst->ip.dst = maskl(ip_hdr(skb)->daddr,
                                       hinfo->cfg.dstmask);
@@ -516,7 +513,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                 nexthdr = ip_hdr(skb)->protocol;
                 break;
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-        case AF_INET6:
+        case NFPROTO_IPV6:
                 if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
                         memcpy(&dst->ip6.dst, &ipv6_hdr(skb)->daddr,
                                sizeof(dst->ip6.dst));
@@ -566,19 +563,16 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
 }
 
 static bool
-hashlimit_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-                const struct net_device *out, const struct xt_match *match,
-                const void *matchinfo, int offset, unsigned int protoff,
-                bool *hotdrop)
+hashlimit_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const struct xt_hashlimit_info *r =
-                ((const struct xt_hashlimit_info *)matchinfo)->u.master;
+                ((const struct xt_hashlimit_info *)par->matchinfo)->u.master;
         struct xt_hashlimit_htable *hinfo = r->hinfo;
         unsigned long now = jiffies;
         struct dsthash_ent *dh;
         struct dsthash_dst dst;
 
-        if (hashlimit_init_dst(hinfo, &dst, skb, protoff) < 0)
+        if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
                 goto hotdrop;
 
         spin_lock_bh(&hinfo->lock);
@@ -616,23 +610,20 @@ hashlimit_mt_v0(const struct sk_buff *skb, const struct net_device *in,
         return false;
 
 hotdrop:
-        *hotdrop = true;
+        *par->hotdrop = true;
         return false;
 }
 
 static bool
-hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+hashlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_hashlimit_mtinfo1 *info = matchinfo;
+        const struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
         struct xt_hashlimit_htable *hinfo = info->hinfo;
         unsigned long now = jiffies;
         struct dsthash_ent *dh;
         struct dsthash_dst dst;
 
-        if (hashlimit_init_dst(hinfo, &dst, skb, protoff) < 0)
+        if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
                 goto hotdrop;
 
         spin_lock_bh(&hinfo->lock);
@@ -669,16 +660,13 @@ hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
         return info->cfg.mode & XT_HASHLIMIT_INVERT;
 
  hotdrop:
-        *hotdrop = true;
+        *par->hotdrop = true;
         return false;
 }
 
-static bool
-hashlimit_mt_check_v0(const char *tablename, const void *inf,
-                      const struct xt_match *match, void *matchinfo,
-                      unsigned int hook_mask)
+static bool hashlimit_mt_check_v0(const struct xt_mtchk_param *par)
 {
-        struct xt_hashlimit_info *r = matchinfo;
+        struct xt_hashlimit_info *r = par->matchinfo;
 
         /* Check for overflow. */
         if (r->cfg.burst == 0 ||
@@ -707,8 +695,8 @@ hashlimit_mt_check_v0(const char *tablename, const void *inf,
          * the list of htable's in htable_create(), since then we would
          * create duplicate proc files. -HW */
         mutex_lock(&hlimit_mutex);
-        r->hinfo = htable_find_get(r->name, match->family);
-        if (!r->hinfo && htable_create_v0(r, match->family) != 0) {
+        r->hinfo = htable_find_get(r->name, par->match->family);
+        if (!r->hinfo && htable_create_v0(r, par->match->family) != 0) {
                 mutex_unlock(&hlimit_mutex);
                 return false;
         }
@@ -719,12 +707,9 @@ hashlimit_mt_check_v0(const char *tablename, const void *inf,
         return true;
 }
 
-static bool
-hashlimit_mt_check(const char *tablename, const void *inf,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool hashlimit_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_hashlimit_mtinfo1 *info = matchinfo;
+        struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
 
         /* Check for overflow. */
         if (info->cfg.burst == 0 ||
@@ -738,7 +723,7 @@ hashlimit_mt_check(const char *tablename, const void *inf,
                 return false;
         if (info->name[sizeof(info->name)-1] != '\0')
                 return false;
-        if (match->family == AF_INET) {
+        if (par->match->family == NFPROTO_IPV4) {
                 if (info->cfg.srcmask > 32 || info->cfg.dstmask > 32)
                         return false;
         } else {
@@ -753,8 +738,8 @@ hashlimit_mt_check(const char *tablename, const void *inf,
          * the list of htable's in htable_create(), since then we would
          * create duplicate proc files. -HW */
         mutex_lock(&hlimit_mutex);
-        info->hinfo = htable_find_get(info->name, match->family);
-        if (!info->hinfo && htable_create(info, match->family) != 0) {
+        info->hinfo = htable_find_get(info->name, par->match->family);
+        if (!info->hinfo && htable_create(info, par->match->family) != 0) {
                 mutex_unlock(&hlimit_mutex);
                 return false;
         }
@@ -763,17 +748,16 @@ hashlimit_mt_check(const char *tablename, const void *inf,
 }
 
 static void
-hashlimit_mt_destroy_v0(const struct xt_match *match, void *matchinfo)
+hashlimit_mt_destroy_v0(const struct xt_mtdtor_param *par)
 {
-        const struct xt_hashlimit_info *r = matchinfo;
+        const struct xt_hashlimit_info *r = par->matchinfo;
 
         htable_put(r->hinfo);
 }
 
-static void
-hashlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void hashlimit_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        const struct xt_hashlimit_mtinfo1 *info = matchinfo;
+        const struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
 
         htable_put(info->hinfo);
 }
@@ -806,7 +790,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
         {
                 .name           = "hashlimit",
                 .revision       = 0,
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = hashlimit_mt_v0,
                 .matchsize      = sizeof(struct xt_hashlimit_info),
 #ifdef CONFIG_COMPAT
@@ -821,7 +805,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
         {
                 .name           = "hashlimit",
                 .revision       = 1,
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = hashlimit_mt,
                 .matchsize      = sizeof(struct xt_hashlimit_mtinfo1),
                 .checkentry     = hashlimit_mt_check,
@@ -831,7 +815,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
         {
                 .name           = "hashlimit",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = hashlimit_mt_v0,
                 .matchsize      = sizeof(struct xt_hashlimit_info),
 #ifdef CONFIG_COMPAT
@@ -846,7 +830,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
         {
                 .name           = "hashlimit",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = hashlimit_mt,
                 .matchsize      = sizeof(struct xt_hashlimit_mtinfo1),
                 .checkentry     = hashlimit_mt_check,
@@ -901,14 +885,14 @@ static void dl_seq_stop(struct seq_file *s, void *v)
         spin_unlock_bh(&htable->lock);
 }
 
-static int dl_seq_real_show(struct dsthash_ent *ent, int family,
+static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
                                    struct seq_file *s)
 {
         /* recalculate to show accurate numbers */
         rateinfo_recalc(ent, jiffies);
 
         switch (family) {
-        case AF_INET:
+        case NFPROTO_IPV4:
                 return seq_printf(s, "%ld %u.%u.%u.%u:%u->"
                                      "%u.%u.%u.%u:%u %u %u %u\n",
                                  (long)(ent->expires - jiffies)/HZ,
@@ -919,7 +903,7 @@ static int dl_seq_real_show(struct dsthash_ent *ent, int family,
                                  ent->rateinfo.credit, ent->rateinfo.credit_cap,
                                  ent->rateinfo.cost);
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-        case AF_INET6:
+        case NFPROTO_IPV6:
                 return seq_printf(s, "%ld " NIP6_FMT ":%u->"
                                      NIP6_FMT ":%u %u %u %u\n",
                                  (long)(ent->expires - jiffies)/HZ,
diff --git a/net/netfilter/xt_helper.c b/net/netfilter/xt_helper.c
index dada2905d66e..64fc7f277221 100644
--- a/net/netfilter/xt_helper.c
+++ b/net/netfilter/xt_helper.c
@@ -24,12 +24,9 @@ MODULE_ALIAS("ip6t_helper");
 
 
 static bool
-helper_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+helper_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_helper_info *info = matchinfo;
+        const struct xt_helper_info *info = par->matchinfo;
         const struct nf_conn *ct;
         const struct nf_conn_help *master_help;
         const struct nf_conntrack_helper *helper;
@@ -57,56 +54,43 @@ helper_mt(const struct sk_buff *skb, const struct net_device *in,
         return ret;
 }
 
-static bool
-helper_mt_check(const char *tablename, const void *inf,
-                const struct xt_match *match, void *matchinfo,
-                unsigned int hook_mask)
+static bool helper_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_helper_info *info = matchinfo;
+        struct xt_helper_info *info = par->matchinfo;
 
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", match->family);
+                                    "proto=%u\n", par->family);
                 return false;
         }
         info->name[29] = '\0';
         return true;
 }
 
-static void helper_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void helper_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        nf_ct_l3proto_module_put(match->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
-static struct xt_match helper_mt_reg[] __read_mostly = {
-        {
-                .name           = "helper",
-                .family         = AF_INET,
-                .checkentry     = helper_mt_check,
-                .match          = helper_mt,
-                .destroy        = helper_mt_destroy,
-                .matchsize      = sizeof(struct xt_helper_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "helper",
-                .family         = AF_INET6,
-                .checkentry     = helper_mt_check,
-                .match          = helper_mt,
-                .destroy        = helper_mt_destroy,
-                .matchsize      = sizeof(struct xt_helper_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_match helper_mt_reg __read_mostly = {
+        .name       = "helper",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = helper_mt_check,
+        .match      = helper_mt,
+        .destroy    = helper_mt_destroy,
+        .matchsize  = sizeof(struct xt_helper_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init helper_mt_init(void)
 {
-        return xt_register_matches(helper_mt_reg, ARRAY_SIZE(helper_mt_reg));
+        return xt_register_match(&helper_mt_reg);
 }
 
 static void __exit helper_mt_exit(void)
 {
-        xt_unregister_matches(helper_mt_reg, ARRAY_SIZE(helper_mt_reg));
+        xt_unregister_match(&helper_mt_reg);
 }
 
 module_init(helper_mt_init);
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index c63e9333c755..6f62c36948d9 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -17,12 +17,9 @@
 #include <linux/netfilter_ipv4/ipt_iprange.h>
 
 static bool
-iprange_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-              const struct net_device *out, const struct xt_match *match,
-              const void *matchinfo, int offset, unsigned int protoff,
-              bool *hotdrop)
+iprange_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_iprange_info *info = matchinfo;
+        const struct ipt_iprange_info *info = par->matchinfo;
         const struct iphdr *iph = ip_hdr(skb);
 
         if (info->flags & IPRANGE_SRC) {
@@ -55,12 +52,9 @@ iprange_mt_v0(const struct sk_buff *skb, const struct net_device *in,
 }
 
 static bool
-iprange_mt4(const struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, const struct xt_match *match,
-            const void *matchinfo, int offset, unsigned int protoff,
-            bool *hotdrop)
+iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_iprange_mtinfo *info = matchinfo;
+        const struct xt_iprange_mtinfo *info = par->matchinfo;
         const struct iphdr *iph = ip_hdr(skb);
         bool m;
 
@@ -111,12 +105,9 @@ iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
 }
 
 static bool
-iprange_mt6(const struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, const struct xt_match *match,
-            const void *matchinfo, int offset, unsigned int protoff,
-            bool *hotdrop)
+iprange_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_iprange_mtinfo *info = matchinfo;
+        const struct xt_iprange_mtinfo *info = par->matchinfo;
         const struct ipv6hdr *iph = ipv6_hdr(skb);
         bool m;
 
@@ -141,7 +132,7 @@ static struct xt_match iprange_mt_reg[] __read_mostly = {
         {
                 .name      = "iprange",
                 .revision  = 0,
-                .family    = AF_INET,
+                .family    = NFPROTO_IPV4,
                 .match     = iprange_mt_v0,
                 .matchsize = sizeof(struct ipt_iprange_info),
                 .me        = THIS_MODULE,
@@ -149,7 +140,7 @@ static struct xt_match iprange_mt_reg[] __read_mostly = {
         {
                 .name      = "iprange",
                 .revision  = 1,
-                .family    = AF_INET,
+                .family    = NFPROTO_IPV4,
                 .match     = iprange_mt4,
                 .matchsize = sizeof(struct xt_iprange_mtinfo),
                 .me        = THIS_MODULE,
@@ -157,7 +148,7 @@ static struct xt_match iprange_mt_reg[] __read_mostly = {
         {
                 .name      = "iprange",
                 .revision  = 1,
-                .family    = AF_INET6,
+                .family    = NFPROTO_IPV6,
                 .match     = iprange_mt6,
                 .matchsize = sizeof(struct xt_iprange_mtinfo),
                 .me        = THIS_MODULE,
diff --git a/net/netfilter/xt_length.c b/net/netfilter/xt_length.c
index b8640f972950..c4871ca6c86d 100644
--- a/net/netfilter/xt_length.c
+++ b/net/netfilter/xt_length.c
@@ -21,24 +21,18 @@ MODULE_ALIAS("ipt_length");
 MODULE_ALIAS("ip6t_length");
 
 static bool
-length_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+length_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_length_info *info = matchinfo;
+        const struct xt_length_info *info = par->matchinfo;
         u_int16_t pktlen = ntohs(ip_hdr(skb)->tot_len);
 
         return (pktlen >= info->min && pktlen <= info->max) ^ info->invert;
 }
 
 static bool
-length_mt6(const struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, const struct xt_match *match,
-           const void *matchinfo, int offset, unsigned int protoff,
-           bool *hotdrop)
+length_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_length_info *info = matchinfo;
+        const struct xt_length_info *info = par->matchinfo;
         const u_int16_t pktlen = ntohs(ipv6_hdr(skb)->payload_len) +
                                  sizeof(struct ipv6hdr);
 
@@ -48,14 +42,14 @@ length_mt6(const struct sk_buff *skb, const struct net_device *in,
 static struct xt_match length_mt_reg[] __read_mostly = {
         {
                 .name           = "length",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = length_mt,
                 .matchsize      = sizeof(struct xt_length_info),
                 .me             = THIS_MODULE,
         },
         {
                 .name           = "length",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = length_mt6,
                 .matchsize      = sizeof(struct xt_length_info),
                 .me             = THIS_MODULE,
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index aad9ab8d2046..c908d69a5595 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -58,13 +58,10 @@ static DEFINE_SPINLOCK(limit_lock);
 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
 
 static bool
-limit_mt(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+limit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct xt_rateinfo *r =
-                ((const struct xt_rateinfo *)matchinfo)->master;
+                ((const struct xt_rateinfo *)par->matchinfo)->master;
         unsigned long now = jiffies;
 
         spin_lock_bh(&limit_lock);
@@ -95,12 +92,9 @@ user2credits(u_int32_t user)
         return (user * HZ * CREDITS_PER_JIFFY) / XT_LIMIT_SCALE;
 }
 
-static bool
-limit_mt_check(const char *tablename, const void *inf,
-               const struct xt_match *match, void *matchinfo,
-               unsigned int hook_mask)
+static bool limit_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_rateinfo *r = matchinfo;
+        struct xt_rateinfo *r = par->matchinfo;
 
         /* Check for overflow. */
         if (r->burst == 0
@@ -167,43 +161,29 @@ static int limit_mt_compat_to_user(void __user *dst, void *src)
 }
 #endif /* CONFIG_COMPAT */
 
-static struct xt_match limit_mt_reg[] __read_mostly = {
-        {
-                .name           = "limit",
-                .family         = AF_INET,
-                .checkentry     = limit_mt_check,
-                .match          = limit_mt,
-                .matchsize      = sizeof(struct xt_rateinfo),
-#ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_rateinfo),
-                .compat_from_user = limit_mt_compat_from_user,
-                .compat_to_user = limit_mt_compat_to_user,
-#endif
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "limit",
-                .family         = AF_INET6,
-                .checkentry     = limit_mt_check,
-                .match          = limit_mt,
-                .matchsize      = sizeof(struct xt_rateinfo),
+static struct xt_match limit_mt_reg __read_mostly = {
+        .name             = "limit",
+        .revision         = 0,
+        .family           = NFPROTO_UNSPEC,
+        .match            = limit_mt,
+        .checkentry       = limit_mt_check,
+        .matchsize        = sizeof(struct xt_rateinfo),
 #ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_rateinfo),
-                .compat_from_user = limit_mt_compat_from_user,
-                .compat_to_user = limit_mt_compat_to_user,
+        .compatsize       = sizeof(struct compat_xt_rateinfo),
+        .compat_from_user = limit_mt_compat_from_user,
+        .compat_to_user   = limit_mt_compat_to_user,
 #endif
-                .me             = THIS_MODULE,
-        },
+        .me               = THIS_MODULE,
 };
 
 static int __init limit_mt_init(void)
 {
-        return xt_register_matches(limit_mt_reg, ARRAY_SIZE(limit_mt_reg));
+        return xt_register_match(&limit_mt_reg);
 }
 
 static void __exit limit_mt_exit(void)
 {
-        xt_unregister_matches(limit_mt_reg, ARRAY_SIZE(limit_mt_reg));
+        xt_unregister_match(&limit_mt_reg);
 }
 
 module_init(limit_mt_init);
diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c
index b3e96a0ec176..c2007116ce5b 100644
--- a/net/netfilter/xt_mac.c
+++ b/net/netfilter/xt_mac.c
@@ -24,12 +24,9 @@ MODULE_DESCRIPTION("Xtables: MAC address match");
 MODULE_ALIAS("ipt_mac");
 MODULE_ALIAS("ip6t_mac");
 
-static bool
-mac_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool mac_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-    const struct xt_mac_info *info = matchinfo;
+    const struct xt_mac_info *info = par->matchinfo;
 
     /* Is mac pointer valid? */
     return skb_mac_header(skb) >= skb->head &&
@@ -39,37 +36,25 @@ mac_mt(const struct sk_buff *skb, const struct net_device *in,
                 ^ info->invert);
 }
 
-static struct xt_match mac_mt_reg[] __read_mostly = {
-        {
-                .name           = "mac",
-                .family         = AF_INET,
-                .match          = mac_mt,
-                .matchsize      = sizeof(struct xt_mac_info),
-                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN) |
-                                  (1 << NF_INET_FORWARD),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "mac",
-                .family         = AF_INET6,
-                .match          = mac_mt,
-                .matchsize      = sizeof(struct xt_mac_info),
-                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN) |
-                                  (1 << NF_INET_FORWARD),
-                .me             = THIS_MODULE,
-        },
+static struct xt_match mac_mt_reg __read_mostly = {
+        .name      = "mac",
+        .revision  = 0,
+        .family    = NFPROTO_UNSPEC,
+        .match     = mac_mt,
+        .matchsize = sizeof(struct xt_mac_info),
+        .hooks     = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
+                     (1 << NF_INET_FORWARD),
+        .me        = THIS_MODULE,
 };
 
 static int __init mac_mt_init(void)
 {
-        return xt_register_matches(mac_mt_reg, ARRAY_SIZE(mac_mt_reg));
+        return xt_register_match(&mac_mt_reg);
 }
 
 static void __exit mac_mt_exit(void)
 {
-        xt_unregister_matches(mac_mt_reg, ARRAY_SIZE(mac_mt_reg));
+        xt_unregister_match(&mac_mt_reg);
 }
 
 module_init(mac_mt_init);
diff --git a/net/netfilter/xt_mark.c b/net/netfilter/xt_mark.c
index 9f78f6120fbd..10b9e34bbc5b 100644
--- a/net/netfilter/xt_mark.c
+++ b/net/netfilter/xt_mark.c
@@ -23,32 +23,24 @@ MODULE_ALIAS("ipt_mark");
 MODULE_ALIAS("ip6t_mark");
 
 static bool
-mark_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, const struct xt_match *match,
-           const void *matchinfo, int offset, unsigned int protoff,
-           bool *hotdrop)
+mark_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_mark_info *info = matchinfo;
+        const struct xt_mark_info *info = par->matchinfo;
 
         return ((skb->mark & info->mask) == info->mark) ^ info->invert;
 }
 
 static bool
-mark_mt(const struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, const struct xt_match *match,
-        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+mark_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_mark_mtinfo1 *info = matchinfo;
+        const struct xt_mark_mtinfo1 *info = par->matchinfo;
 
         return ((skb->mark & info->mask) == info->mark) ^ info->invert;
 }
 
-static bool
-mark_mt_check_v0(const char *tablename, const void *entry,
-                 const struct xt_match *match, void *matchinfo,
-                 unsigned int hook_mask)
+static bool mark_mt_check_v0(const struct xt_mtchk_param *par)
 {
-        const struct xt_mark_info *minfo = matchinfo;
+        const struct xt_mark_info *minfo = par->matchinfo;
 
         if (minfo->mark > 0xffffffff || minfo->mask > 0xffffffff) {
                 printk(KERN_WARNING "mark: only supports 32bit mark\n");
@@ -92,7 +84,7 @@ static struct xt_match mark_mt_reg[] __read_mostly = {
         {
                 .name           = "mark",
                 .revision       = 0,
-                .family         = AF_INET,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = mark_mt_check_v0,
                 .match          = mark_mt_v0,
                 .matchsize      = sizeof(struct xt_mark_info),
@@ -104,31 +96,9 @@ static struct xt_match mark_mt_reg[] __read_mostly = {
                 .me             = THIS_MODULE,
         },
         {
-                .name           = "mark",
-                .revision       = 0,
-                .family         = AF_INET6,
-                .checkentry     = mark_mt_check_v0,
-                .match          = mark_mt_v0,
-                .matchsize      = sizeof(struct xt_mark_info),
-#ifdef CONFIG_COMPAT
-                .compatsize     = sizeof(struct compat_xt_mark_info),
-                .compat_from_user = mark_mt_compat_from_user_v0,
-                .compat_to_user = mark_mt_compat_to_user_v0,
-#endif
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "mark",
-                .revision       = 1,
-                .family         = AF_INET,
-                .match          = mark_mt,
-                .matchsize      = sizeof(struct xt_mark_mtinfo1),
-                .me             = THIS_MODULE,
-        },
-        {
                 .name           = "mark",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_UNSPEC,
                 .match          = mark_mt,
                 .matchsize      = sizeof(struct xt_mark_mtinfo1),
                 .me             = THIS_MODULE,
diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c
index fd88c489b70e..d06bb2dd3900 100644
--- a/net/netfilter/xt_multiport.c
+++ b/net/netfilter/xt_multiport.c
@@ -95,25 +95,22 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 }
 
 static bool
-multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-                const struct net_device *out, const struct xt_match *match,
-                const void *matchinfo, int offset, unsigned int protoff,
-                bool *hotdrop)
+multiport_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const __be16 *pptr;
         __be16 _ports[2];
-        const struct xt_multiport *multiinfo = matchinfo;
+        const struct xt_multiport *multiinfo = par->matchinfo;
 
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
+        pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
         if (pptr == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -122,25 +119,22 @@ multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in,
 }
 
 static bool
-multiport_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+multiport_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const __be16 *pptr;
         __be16 _ports[2];
-        const struct xt_multiport_v1 *multiinfo = matchinfo;
+        const struct xt_multiport_v1 *multiinfo = par->matchinfo;
 
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
+        pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
         if (pptr == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -164,50 +158,37 @@ check(u_int16_t proto,
                 && count <= XT_MULTI_PORTS;
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-multiport_mt_check_v0(const char *tablename, const void *info,
-                      const struct xt_match *match, void *matchinfo,
-                      unsigned int hook_mask)
+static bool multiport_mt_check_v0(const struct xt_mtchk_param *par)
 {
-        const struct ipt_ip *ip = info;
-        const struct xt_multiport *multiinfo = matchinfo;
+        const struct ipt_ip *ip = par->entryinfo;
+        const struct xt_multiport *multiinfo = par->matchinfo;
 
         return check(ip->proto, ip->invflags, multiinfo->flags,
                      multiinfo->count);
 }
 
-static bool
-multiport_mt_check(const char *tablename, const void *info,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool multiport_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ipt_ip *ip = info;
-        const struct xt_multiport_v1 *multiinfo = matchinfo;
+        const struct ipt_ip *ip = par->entryinfo;
+        const struct xt_multiport_v1 *multiinfo = par->matchinfo;
 
         return check(ip->proto, ip->invflags, multiinfo->flags,
                      multiinfo->count);
 }
 
-static bool
-multiport_mt6_check_v0(const char *tablename, const void *info,
-                       const struct xt_match *match, void *matchinfo,
-                       unsigned int hook_mask)
+static bool multiport_mt6_check_v0(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_ip6 *ip = info;
-        const struct xt_multiport *multiinfo = matchinfo;
+        const struct ip6t_ip6 *ip = par->entryinfo;
+        const struct xt_multiport *multiinfo = par->matchinfo;
 
         return check(ip->proto, ip->invflags, multiinfo->flags,
                      multiinfo->count);
 }
 
-static bool
-multiport_mt6_check(const char *tablename, const void *info,
-                    const struct xt_match *match, void *matchinfo,
-                    unsigned int hook_mask)
+static bool multiport_mt6_check(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_ip6 *ip = info;
-        const struct xt_multiport_v1 *multiinfo = matchinfo;
+        const struct ip6t_ip6 *ip = par->entryinfo;
+        const struct xt_multiport_v1 *multiinfo = par->matchinfo;
 
         return check(ip->proto, ip->invflags, multiinfo->flags,
                      multiinfo->count);
@@ -216,7 +197,7 @@ multiport_mt6_check(const char *tablename, const void *info,
 static struct xt_match multiport_mt_reg[] __read_mostly = {
         {
                 .name           = "multiport",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .revision       = 0,
                 .checkentry     = multiport_mt_check_v0,
                 .match          = multiport_mt_v0,
@@ -225,7 +206,7 @@ static struct xt_match multiport_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "multiport",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .revision       = 1,
                 .checkentry     = multiport_mt_check,
                 .match          = multiport_mt,
@@ -234,7 +215,7 @@ static struct xt_match multiport_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "multiport",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .revision       = 0,
                 .checkentry     = multiport_mt6_check_v0,
                 .match          = multiport_mt_v0,
@@ -243,7 +224,7 @@ static struct xt_match multiport_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "multiport",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .revision       = 1,
                 .checkentry     = multiport_mt6_check,
                 .match          = multiport_mt,
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 9059c16144c3..f19ebd9b78f5 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -21,12 +21,9 @@
 #include <linux/netfilter_ipv6/ip6t_owner.h>
 
 static bool
-owner_mt_v0(const struct sk_buff *skb, const struct net_device *in,
-            const struct net_device *out, const struct xt_match *match,
-            const void *matchinfo, int offset, unsigned int protoff,
-            bool *hotdrop)
+owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_owner_info *info = matchinfo;
+        const struct ipt_owner_info *info = par->matchinfo;
         const struct file *filp;
 
         if (skb->sk == NULL || skb->sk->sk_socket == NULL)
@@ -50,12 +47,9 @@ owner_mt_v0(const struct sk_buff *skb, const struct net_device *in,
 }
 
 static bool
-owner_mt6_v0(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ip6t_owner_info *info = matchinfo;
+        const struct ip6t_owner_info *info = par->matchinfo;
         const struct file *filp;
 
         if (skb->sk == NULL || skb->sk->sk_socket == NULL)
@@ -79,12 +73,9 @@ owner_mt6_v0(const struct sk_buff *skb, const struct net_device *in,
 }
 
 static bool
-owner_mt(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_owner_match_info *info = matchinfo;
+        const struct xt_owner_match_info *info = par->matchinfo;
         const struct file *filp;
 
         if (skb->sk == NULL || skb->sk->sk_socket == NULL)
@@ -116,12 +107,9 @@ owner_mt(const struct sk_buff *skb, const struct net_device *in,
         return true;
 }
 
-static bool
-owner_mt_check_v0(const char *tablename, const void *ip,
-                  const struct xt_match *match, void *matchinfo,
-                  unsigned int hook_mask)
+static bool owner_mt_check_v0(const struct xt_mtchk_param *par)
 {
-        const struct ipt_owner_info *info = matchinfo;
+        const struct ipt_owner_info *info = par->matchinfo;
 
         if (info->match & (IPT_OWNER_PID | IPT_OWNER_SID | IPT_OWNER_COMM)) {
                 printk(KERN_WARNING KBUILD_MODNAME
@@ -133,12 +121,9 @@ owner_mt_check_v0(const char *tablename, const void *ip,
         return true;
 }
 
-static bool
-owner_mt6_check_v0(const char *tablename, const void *ip,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool owner_mt6_check_v0(const struct xt_mtchk_param *par)
 {
-        const struct ip6t_owner_info *info = matchinfo;
+        const struct ip6t_owner_info *info = par->matchinfo;
 
         if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
                 printk(KERN_WARNING KBUILD_MODNAME
@@ -153,7 +138,7 @@ static struct xt_match owner_mt_reg[] __read_mostly = {
         {
                 .name       = "owner",
                 .revision   = 0,
-                .family     = AF_INET,
+                .family     = NFPROTO_IPV4,
                 .match      = owner_mt_v0,
                 .matchsize  = sizeof(struct ipt_owner_info),
                 .checkentry = owner_mt_check_v0,
@@ -164,7 +149,7 @@ static struct xt_match owner_mt_reg[] __read_mostly = {
         {
                 .name       = "owner",
                 .revision   = 0,
-                .family     = AF_INET6,
+                .family     = NFPROTO_IPV6,
                 .match      = owner_mt6_v0,
                 .matchsize  = sizeof(struct ip6t_owner_info),
                 .checkentry = owner_mt6_check_v0,
@@ -175,17 +160,7 @@ static struct xt_match owner_mt_reg[] __read_mostly = {
         {
                 .name       = "owner",
                 .revision   = 1,
-                .family     = AF_INET,
-                .match      = owner_mt,
-                .matchsize  = sizeof(struct xt_owner_match_info),
-                .hooks      = (1 << NF_INET_LOCAL_OUT) |
-                              (1 << NF_INET_POST_ROUTING),
-                .me         = THIS_MODULE,
-        },
-        {
-                .name       = "owner",
-                .revision   = 1,
-                .family     = AF_INET6,
+                .family     = NFPROTO_UNSPEC,
                 .match      = owner_mt,
                 .matchsize  = sizeof(struct xt_owner_match_info),
                 .hooks      = (1 << NF_INET_LOCAL_OUT) |
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 4ec1094bda92..1bcdfc12cf59 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -21,14 +21,11 @@ MODULE_ALIAS("ipt_physdev");
 MODULE_ALIAS("ip6t_physdev");
 
 static bool
-physdev_mt(const struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, const struct xt_match *match,
-           const void *matchinfo, int offset, unsigned int protoff,
-           bool *hotdrop)
+physdev_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         int i;
         static const char nulldevname[IFNAMSIZ];
-        const struct xt_physdev_info *info = matchinfo;
+        const struct xt_physdev_info *info = par->matchinfo;
         bool ret;
         const char *indev, *outdev;
         const struct nf_bridge_info *nf_bridge;
@@ -94,12 +91,9 @@ match_outdev:
         return ret ^ !(info->invert & XT_PHYSDEV_OP_OUT);
 }
 
-static bool
-physdev_mt_check(const char *tablename, const void *ip,
-                 const struct xt_match *match, void *matchinfo,
-                 unsigned int hook_mask)
+static bool physdev_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_physdev_info *info = matchinfo;
+        const struct xt_physdev_info *info = par->matchinfo;
 
         if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
             info->bitmask & ~XT_PHYSDEV_OP_MASK)
@@ -107,44 +101,35 @@ physdev_mt_check(const char *tablename, const void *ip,
         if (info->bitmask & XT_PHYSDEV_OP_OUT &&
             (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
              info->invert & XT_PHYSDEV_OP_BRIDGED) &&
-            hook_mask & ((1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
-                         (1 << NF_INET_POST_ROUTING))) {
+            par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
+            (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
                 printk(KERN_WARNING "physdev match: using --physdev-out in the "
                        "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
                        "traffic is not supported anymore.\n");
-                if (hook_mask & (1 << NF_INET_LOCAL_OUT))
+                if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
                         return false;
         }
         return true;
 }
 
-static struct xt_match physdev_mt_reg[] __read_mostly = {
-        {
-                .name           = "physdev",
-                .family         = AF_INET,
-                .checkentry     = physdev_mt_check,
-                .match          = physdev_mt,
-                .matchsize      = sizeof(struct xt_physdev_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "physdev",
-                .family         = AF_INET6,
-                .checkentry     = physdev_mt_check,
-                .match          = physdev_mt,
-                .matchsize      = sizeof(struct xt_physdev_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_match physdev_mt_reg __read_mostly = {
+        .name       = "physdev",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .checkentry = physdev_mt_check,
+        .match      = physdev_mt,
+        .matchsize  = sizeof(struct xt_physdev_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init physdev_mt_init(void)
 {
-        return xt_register_matches(physdev_mt_reg, ARRAY_SIZE(physdev_mt_reg));
+        return xt_register_match(&physdev_mt_reg);
 }
 
 static void __exit physdev_mt_exit(void)
 {
-        xt_unregister_matches(physdev_mt_reg, ARRAY_SIZE(physdev_mt_reg));
+        xt_unregister_match(&physdev_mt_reg);
 }
 
 module_init(physdev_mt_init);
diff --git a/net/netfilter/xt_pkttype.c b/net/netfilter/xt_pkttype.c
index 7936f7e23254..69da1d3a1d85 100644
--- a/net/netfilter/xt_pkttype.c
+++ b/net/netfilter/xt_pkttype.c
@@ -23,20 +23,17 @@ MODULE_ALIAS("ipt_pkttype");
 MODULE_ALIAS("ip6t_pkttype");
 
 static bool
-pkttype_mt(const struct sk_buff *skb, const struct net_device *in,
-           const struct net_device *out, const struct xt_match *match,
-           const void *matchinfo, int offset, unsigned int protoff,
-           bool *hotdrop)
+pkttype_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_pkttype_info *info = matchinfo;
+        const struct xt_pkttype_info *info = par->matchinfo;
         u_int8_t type;
 
         if (skb->pkt_type != PACKET_LOOPBACK)
                 type = skb->pkt_type;
-        else if (match->family == AF_INET &&
+        else if (par->family == NFPROTO_IPV4 &&
             ipv4_is_multicast(ip_hdr(skb)->daddr))
                 type = PACKET_MULTICAST;
-        else if (match->family == AF_INET6 &&
+        else if (par->family == NFPROTO_IPV6 &&
             ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
                 type = PACKET_MULTICAST;
         else
@@ -45,31 +42,23 @@ pkttype_mt(const struct sk_buff *skb, const struct net_device *in,
         return (type == info->pkttype) ^ info->invert;
 }
 
-static struct xt_match pkttype_mt_reg[] __read_mostly = {
-        {
-                .name           = "pkttype",
-                .family         = AF_INET,
-                .match          = pkttype_mt,
-                .matchsize      = sizeof(struct xt_pkttype_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "pkttype",
-                .family         = AF_INET6,
-                .match          = pkttype_mt,
-                .matchsize      = sizeof(struct xt_pkttype_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_match pkttype_mt_reg __read_mostly = {
+        .name      = "pkttype",
+        .revision  = 0,
+        .family    = NFPROTO_UNSPEC,
+        .match     = pkttype_mt,
+        .matchsize = sizeof(struct xt_pkttype_info),
+        .me        = THIS_MODULE,
 };
 
 static int __init pkttype_mt_init(void)
 {
-        return xt_register_matches(pkttype_mt_reg, ARRAY_SIZE(pkttype_mt_reg));
+        return xt_register_match(&pkttype_mt_reg);
 }
 
 static void __exit pkttype_mt_exit(void)
 {
-        xt_unregister_matches(pkttype_mt_reg, ARRAY_SIZE(pkttype_mt_reg));
+        xt_unregister_match(&pkttype_mt_reg);
 }
 
 module_init(pkttype_mt_init);
diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index d351582b2a3d..328bd20ddd25 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -26,9 +26,9 @@ xt_addr_cmp(const union nf_inet_addr *a1, const union nf_inet_addr *m,
             const union nf_inet_addr *a2, unsigned short family)
 {
         switch (family) {
-        case AF_INET:
+        case NFPROTO_IPV4:
                 return ((a1->ip ^ a2->ip) & m->ip) == 0;
-        case AF_INET6:
+        case NFPROTO_IPV6:
                 return ipv6_masked_addr_cmp(&a1->in6, &m->in6, &a2->in6) == 0;
         }
         return false;
@@ -110,18 +110,15 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
 }
 
 static bool
-policy_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+policy_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_policy_info *info = matchinfo;
+        const struct xt_policy_info *info = par->matchinfo;
         int ret;
 
         if (info->flags & XT_POLICY_MATCH_IN)
-                ret = match_policy_in(skb, info, match->family);
+                ret = match_policy_in(skb, info, par->match->family);
         else
-                ret = match_policy_out(skb, info, match->family);
+                ret = match_policy_out(skb, info, par->match->family);
 
         if (ret < 0)
                 ret = info->flags & XT_POLICY_MATCH_NONE ? true : false;
@@ -131,26 +128,23 @@ policy_mt(const struct sk_buff *skb, const struct net_device *in,
         return ret;
 }
 
-static bool
-policy_mt_check(const char *tablename, const void *ip_void,
-                const struct xt_match *match, void *matchinfo,
-                unsigned int hook_mask)
+static bool policy_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_policy_info *info = matchinfo;
+        const struct xt_policy_info *info = par->matchinfo;
 
         if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT))) {
                 printk(KERN_ERR "xt_policy: neither incoming nor "
                                 "outgoing policy selected\n");
                 return false;
         }
-        if (hook_mask & (1 << NF_INET_PRE_ROUTING | 1 << NF_INET_LOCAL_IN)
-            && info->flags & XT_POLICY_MATCH_OUT) {
+        if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
+            (1 << NF_INET_LOCAL_IN)) && info->flags & XT_POLICY_MATCH_OUT) {
                 printk(KERN_ERR "xt_policy: output policy not valid in "
                                 "PRE_ROUTING and INPUT\n");
                 return false;
         }
-        if (hook_mask & (1 << NF_INET_POST_ROUTING | 1 << NF_INET_LOCAL_OUT)
-            && info->flags & XT_POLICY_MATCH_IN) {
+        if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
+            (1 << NF_INET_LOCAL_OUT)) && info->flags & XT_POLICY_MATCH_IN) {
                 printk(KERN_ERR "xt_policy: input policy not valid in "
                                 "POST_ROUTING and OUTPUT\n");
                 return false;
@@ -165,7 +159,7 @@ policy_mt_check(const char *tablename, const void *ip_void,
 static struct xt_match policy_mt_reg[] __read_mostly = {
         {
                 .name           = "policy",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = policy_mt_check,
                 .match          = policy_mt,
                 .matchsize      = sizeof(struct xt_policy_info),
@@ -173,7 +167,7 @@ static struct xt_match policy_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "policy",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = policy_mt_check,
                 .match          = policy_mt,
                 .matchsize      = sizeof(struct xt_policy_info),
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 3b021d0c522a..c84fce5e0f3e 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -18,13 +18,10 @@ MODULE_ALIAS("ip6t_quota");
 static DEFINE_SPINLOCK(quota_lock);
 
 static bool
-quota_mt(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+quota_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         struct xt_quota_info *q =
-                ((const struct xt_quota_info *)matchinfo)->master;
+                ((const struct xt_quota_info *)par->matchinfo)->master;
         bool ret = q->flags & XT_QUOTA_INVERT;
 
         spin_lock_bh(&quota_lock);
@@ -40,12 +37,9 @@ quota_mt(const struct sk_buff *skb, const struct net_device *in,
         return ret;
 }
 
-static bool
-quota_mt_check(const char *tablename, const void *entry,
-               const struct xt_match *match, void *matchinfo,
-               unsigned int hook_mask)
+static bool quota_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_quota_info *q = matchinfo;
+        struct xt_quota_info *q = par->matchinfo;
 
         if (q->flags & ~XT_QUOTA_MASK)
                 return false;
@@ -54,33 +48,24 @@ quota_mt_check(const char *tablename, const void *entry,
         return true;
 }
 
-static struct xt_match quota_mt_reg[] __read_mostly = {
-        {
-                .name           = "quota",
-                .family         = AF_INET,
-                .checkentry     = quota_mt_check,
-                .match          = quota_mt,
-                .matchsize      = sizeof(struct xt_quota_info),
-                .me             = THIS_MODULE
-        },
-        {
-                .name           = "quota",
-                .family         = AF_INET6,
-                .checkentry     = quota_mt_check,
-                .match          = quota_mt,
-                .matchsize      = sizeof(struct xt_quota_info),
-                .me             = THIS_MODULE
-        },
+static struct xt_match quota_mt_reg __read_mostly = {
+        .name       = "quota",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .match      = quota_mt,
+        .checkentry = quota_mt_check,
+        .matchsize  = sizeof(struct xt_quota_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init quota_mt_init(void)
 {
-        return xt_register_matches(quota_mt_reg, ARRAY_SIZE(quota_mt_reg));
+        return xt_register_match(&quota_mt_reg);
 }
 
 static void __exit quota_mt_exit(void)
 {
-        xt_unregister_matches(quota_mt_reg, ARRAY_SIZE(quota_mt_reg));
+        xt_unregister_match(&quota_mt_reg);
 }
 
 module_init(quota_mt_init);
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index ebd84f1b4f62..220a1d588ee0 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -14,16 +14,10 @@
 #include <net/netfilter/xt_rateest.h>
 
 
-static bool xt_rateest_mt(const struct sk_buff *skb,
-                          const struct net_device *in,
-                          const struct net_device *out,
-                          const struct xt_match *match,
-                          const void *matchinfo,
-                          int offset,
-                          unsigned int protoff,
-                          bool *hotdrop)
+static bool
+xt_rateest_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_rateest_match_info *info = matchinfo;
+        const struct xt_rateest_match_info *info = par->matchinfo;
         struct gnet_stats_rate_est *r;
         u_int32_t bps1, bps2, pps1, pps2;
         bool ret = true;
@@ -80,13 +74,9 @@ static bool xt_rateest_mt(const struct sk_buff *skb,
         return ret;
 }
 
-static bool xt_rateest_mt_checkentry(const char *tablename,
-                                     const void *ip,
-                                     const struct xt_match *match,
-                                     void *matchinfo,
-                                     unsigned int hook_mask)
+static bool xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
 {
-        struct xt_rateest_match_info *info = matchinfo;
+        struct xt_rateest_match_info *info = par->matchinfo;
         struct xt_rateest *est1, *est2;
 
         if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS |
@@ -127,46 +117,34 @@ err1:
         return false;
 }
 
-static void xt_rateest_mt_destroy(const struct xt_match *match,
-                                  void *matchinfo)
+static void xt_rateest_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        struct xt_rateest_match_info *info = matchinfo;
+        struct xt_rateest_match_info *info = par->matchinfo;
 
         xt_rateest_put(info->est1);
         if (info->est2)
                 xt_rateest_put(info->est2);
 }
 
-static struct xt_match xt_rateest_match[] __read_mostly = {
-        {
-                .family         = AF_INET,
-                .name           = "rateest",
-                .match          = xt_rateest_mt,
-                .checkentry     = xt_rateest_mt_checkentry,
-                .destroy        = xt_rateest_mt_destroy,
-                .matchsize      = sizeof(struct xt_rateest_match_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .family         = AF_INET6,
-                .name           = "rateest",
-                .match          = xt_rateest_mt,
-                .checkentry     = xt_rateest_mt_checkentry,
-                .destroy        = xt_rateest_mt_destroy,
-                .matchsize      = sizeof(struct xt_rateest_match_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_match xt_rateest_mt_reg __read_mostly = {
+        .name       = "rateest",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .match      = xt_rateest_mt,
+        .checkentry = xt_rateest_mt_checkentry,
+        .destroy    = xt_rateest_mt_destroy,
+        .matchsize  = sizeof(struct xt_rateest_match_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init xt_rateest_mt_init(void)
 {
-        return xt_register_matches(xt_rateest_match,
-                                   ARRAY_SIZE(xt_rateest_match));
+        return xt_register_match(&xt_rateest_mt_reg);
 }
 
 static void __exit xt_rateest_mt_fini(void)
 {
-        xt_unregister_matches(xt_rateest_match, ARRAY_SIZE(xt_rateest_match));
+        xt_unregister_match(&xt_rateest_mt_reg);
 }
 
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
index 7df1627c536f..67419287bc7e 100644
--- a/net/netfilter/xt_realm.c
+++ b/net/netfilter/xt_realm.c
@@ -22,12 +22,9 @@ MODULE_DESCRIPTION("Xtables: Routing realm match");
 MODULE_ALIAS("ipt_realm");
 
 static bool
-realm_mt(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+realm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_realm_info *info = matchinfo;
+        const struct xt_realm_info *info = par->matchinfo;
         const struct dst_entry *dst = skb->dst;
 
         return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
@@ -39,7 +36,7 @@ static struct xt_match realm_mt_reg __read_mostly = {
         .matchsize      = sizeof(struct xt_realm_info),
         .hooks          = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
                           (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
-        .family         = AF_INET,
+        .family         = NFPROTO_UNSPEC,
         .me             = THIS_MODULE
 };
 
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/netfilter/xt_recent.c
index 3974d7cae5c0..4ebd4ca9a991 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
+ * Copyright © CC Computer Consultants GmbH, 2007 - 2008
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -13,6 +14,8 @@
  */
 #include <linux/init.h>
 #include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -27,11 +30,14 @@
 #include <net/net_namespace.h>
 
 #include <linux/netfilter/x_tables.h>
-#include <linux/netfilter_ipv4/ipt_recent.h>
+#include <linux/netfilter/xt_recent.h>
 
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
 MODULE_DESCRIPTION("Xtables: \"recently-seen\" host matching for IPv4");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_recent");
+MODULE_ALIAS("ip6t_recent");
 
 static unsigned int ip_list_tot = 100;
 static unsigned int ip_pkt_list_tot = 20;
@@ -48,14 +54,15 @@ module_param(ip_list_gid, uint, 0400);
 MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
 MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
 MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
-MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");
-MODULE_PARM_DESC(ip_list_uid,"owner of /proc/net/ipt_recent/* files");
-MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
+MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/xt_recent/* files");
+MODULE_PARM_DESC(ip_list_uid,"owner of /proc/net/xt_recent/* files");
+MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/xt_recent/* files");
 
 struct recent_entry {
         struct list_head        list;
         struct list_head        lru_list;
-        __be32                  addr;
+        union nf_inet_addr      addr;
+        u_int16_t               family;
         u_int8_t                ttl;
         u_int8_t                index;
         u_int16_t               nstamps;
@@ -64,9 +71,9 @@ struct recent_entry {
 
 struct recent_table {
         struct list_head        list;
-        char                    name[IPT_RECENT_NAME_LEN];
+        char                    name[XT_RECENT_NAME_LEN];
 #ifdef CONFIG_PROC_FS
-        struct proc_dir_entry   *proc;
+        struct proc_dir_entry   *proc_old, *proc;
 #endif
         unsigned int            refcnt;
         unsigned int            entries;
@@ -79,31 +86,53 @@ static DEFINE_SPINLOCK(recent_lock);
 static DEFINE_MUTEX(recent_mutex);
 
 #ifdef CONFIG_PROC_FS
-static struct proc_dir_entry    *proc_dir;
-static const struct file_operations     recent_fops;
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+static struct proc_dir_entry *proc_old_dir;
+#endif
+static struct proc_dir_entry *recent_proc_dir;
+static const struct file_operations recent_old_fops, recent_mt_fops;
 #endif
 
 static u_int32_t hash_rnd;
-static int hash_rnd_initted;
+static bool hash_rnd_initted;
+
+static unsigned int recent_entry_hash4(const union nf_inet_addr *addr)
+{
+        if (!hash_rnd_initted) {
+                get_random_bytes(&hash_rnd, sizeof(hash_rnd));
+                hash_rnd_initted = true;
+        }
+        return jhash_1word((__force u32)addr->ip, hash_rnd) &
+               (ip_list_hash_size - 1);
+}
 
-static unsigned int recent_entry_hash(__be32 addr)
+static unsigned int recent_entry_hash6(const union nf_inet_addr *addr)
 {
         if (!hash_rnd_initted) {
-                get_random_bytes(&hash_rnd, 4);
-                hash_rnd_initted = 1;
+                get_random_bytes(&hash_rnd, sizeof(hash_rnd));
+                hash_rnd_initted = true;
         }
-        return jhash_1word((__force u32)addr, hash_rnd) & (ip_list_hash_size - 1);
+        return jhash2((u32 *)addr->ip6, ARRAY_SIZE(addr->ip6), hash_rnd) &
+               (ip_list_hash_size - 1);
 }
 
 static struct recent_entry *
-recent_entry_lookup(const struct recent_table *table, __be32 addr, u_int8_t ttl)
+recent_entry_lookup(const struct recent_table *table,
+                    const union nf_inet_addr *addrp, u_int16_t family,
+                    u_int8_t ttl)
 {
         struct recent_entry *e;
         unsigned int h;
 
-        h = recent_entry_hash(addr);
+        if (family == NFPROTO_IPV4)
+                h = recent_entry_hash4(addrp);
+        else
+                h = recent_entry_hash6(addrp);
+
         list_for_each_entry(e, &table->iphash[h], list)
-                if (e->addr == addr && (ttl == e->ttl || !ttl || !e->ttl))
+                if (e->family == family &&
+                    memcmp(&e->addr, addrp, sizeof(e->addr)) == 0 &&
+                    (ttl == e->ttl || ttl == 0 || e->ttl == 0))
                         return e;
         return NULL;
 }
@@ -117,7 +146,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
 }
 
 static struct recent_entry *
-recent_entry_init(struct recent_table *t, __be32 addr, u_int8_t ttl)
+recent_entry_init(struct recent_table *t, const union nf_inet_addr *addr,
+                  u_int16_t family, u_int8_t ttl)
 {
         struct recent_entry *e;
 
@@ -129,12 +159,16 @@ recent_entry_init(struct recent_table *t, __be32 addr, u_int8_t ttl)
                     GFP_ATOMIC);
         if (e == NULL)
                 return NULL;
-        e->addr      = addr;
+        memcpy(&e->addr, addr, sizeof(e->addr));
         e->ttl       = ttl;
         e->stamps[0] = jiffies;
         e->nstamps   = 1;
         e->index     = 1;
-        list_add_tail(&e->list, &t->iphash[recent_entry_hash(addr)]);
+        e->family    = family;
+        if (family == NFPROTO_IPV4)
+                list_add_tail(&e->list, &t->iphash[recent_entry_hash4(addr)]);
+        else
+                list_add_tail(&e->list, &t->iphash[recent_entry_hash6(addr)]);
         list_add_tail(&e->lru_list, &t->lru_list);
         t->entries++;
         return e;
@@ -170,48 +204,59 @@ static void recent_table_flush(struct recent_table *t)
 }
 
 static bool
-recent_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct ipt_recent_info *info = matchinfo;
+        const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
         struct recent_entry *e;
-        __be32 addr;
+        union nf_inet_addr addr = {};
         u_int8_t ttl;
         bool ret = info->invert;
 
-        if (info->side == IPT_RECENT_DEST)
-                addr = ip_hdr(skb)->daddr;
-        else
-                addr = ip_hdr(skb)->saddr;
+        if (par->match->family == NFPROTO_IPV4) {
+                const struct iphdr *iph = ip_hdr(skb);
+
+                if (info->side == XT_RECENT_DEST)
+                        addr.ip = iph->daddr;
+                else
+                        addr.ip = iph->saddr;
+
+                ttl = iph->ttl;
+        } else {
+                const struct ipv6hdr *iph = ipv6_hdr(skb);
+
+                if (info->side == XT_RECENT_DEST)
+                        memcpy(&addr.in6, &iph->daddr, sizeof(addr.in6));
+                else
+                        memcpy(&addr.in6, &iph->saddr, sizeof(addr.in6));
+
+                ttl = iph->hop_limit;
+        }
 
-        ttl = ip_hdr(skb)->ttl;
         /* use TTL as seen before forwarding */
-        if (out && !skb->sk)
+        if (par->out != NULL && skb->sk == NULL)
                 ttl++;
 
         spin_lock_bh(&recent_lock);
         t = recent_table_lookup(info->name);
-        e = recent_entry_lookup(t, addr,
-                                info->check_set & IPT_RECENT_TTL ? ttl : 0);
+        e = recent_entry_lookup(t, &addr, par->match->family,
+                                (info->check_set & XT_RECENT_TTL) ? ttl : 0);
         if (e == NULL) {
-                if (!(info->check_set & IPT_RECENT_SET))
+                if (!(info->check_set & XT_RECENT_SET))
                         goto out;
-                e = recent_entry_init(t, addr, ttl);
+                e = recent_entry_init(t, &addr, par->match->family, ttl);
                 if (e == NULL)
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                 ret = !ret;
                 goto out;
         }
 
-        if (info->check_set & IPT_RECENT_SET)
+        if (info->check_set & XT_RECENT_SET)
                 ret = !ret;
-        else if (info->check_set & IPT_RECENT_REMOVE) {
+        else if (info->check_set & XT_RECENT_REMOVE) {
                 recent_entry_remove(t, e);
                 ret = !ret;
-        } else if (info->check_set & (IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) {
+        } else if (info->check_set & (XT_RECENT_CHECK | XT_RECENT_UPDATE)) {
                 unsigned long time = jiffies - info->seconds * HZ;
                 unsigned int i, hits = 0;
 
@@ -225,8 +270,8 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in,
                 }
         }
 
-        if (info->check_set & IPT_RECENT_SET ||
-            (info->check_set & IPT_RECENT_UPDATE && ret)) {
+        if (info->check_set & XT_RECENT_SET ||
+            (info->check_set & XT_RECENT_UPDATE && ret)) {
                 recent_entry_update(t, e);
                 e->ttl = ttl;
         }
@@ -235,27 +280,24 @@ out:
         return ret;
 }
 
-static bool
-recent_mt_check(const char *tablename, const void *ip,
-                const struct xt_match *match, void *matchinfo,
-                unsigned int hook_mask)
+static bool recent_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct ipt_recent_info *info = matchinfo;
+        const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
         unsigned i;
         bool ret = false;
 
         if (hweight8(info->check_set &
-                     (IPT_RECENT_SET | IPT_RECENT_REMOVE |
-                      IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) != 1)
+                     (XT_RECENT_SET | XT_RECENT_REMOVE |
+                      XT_RECENT_CHECK | XT_RECENT_UPDATE)) != 1)
                 return false;
-        if ((info->check_set & (IPT_RECENT_SET | IPT_RECENT_REMOVE)) &&
+        if ((info->check_set & (XT_RECENT_SET | XT_RECENT_REMOVE)) &&
             (info->seconds || info->hit_count))
                 return false;
         if (info->hit_count > ip_pkt_list_tot)
                 return false;
         if (info->name[0] == '\0' ||
-            strnlen(info->name, IPT_RECENT_NAME_LEN) == IPT_RECENT_NAME_LEN)
+            strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN)
                 return false;
 
         mutex_lock(&recent_mutex);
@@ -276,11 +318,24 @@ recent_mt_check(const char *tablename, const void *ip,
         for (i = 0; i < ip_list_hash_size; i++)
                 INIT_LIST_HEAD(&t->iphash[i]);
 #ifdef CONFIG_PROC_FS
-        t->proc = proc_create(t->name, ip_list_perms, proc_dir, &recent_fops);
+        t->proc = proc_create(t->name, ip_list_perms, recent_proc_dir,
+                  &recent_mt_fops);
         if (t->proc == NULL) {
                 kfree(t);
                 goto out;
         }
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+        t->proc_old = proc_create(t->name, ip_list_perms, proc_old_dir,
+                      &recent_old_fops);
+        if (t->proc_old == NULL) {
+                remove_proc_entry(t->name, proc_old_dir);
+                kfree(t);
+                goto out;
+        }
+        t->proc_old->uid   = ip_list_uid;
+        t->proc_old->gid   = ip_list_gid;
+        t->proc_old->data  = t;
+#endif
         t->proc->uid       = ip_list_uid;
         t->proc->gid       = ip_list_gid;
         t->proc->data      = t;
@@ -294,9 +349,9 @@ out:
         return ret;
 }
 
-static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void recent_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        const struct ipt_recent_info *info = matchinfo;
+        const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
 
         mutex_lock(&recent_mutex);
@@ -306,7 +361,10 @@ static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)
                 list_del(&t->list);
                 spin_unlock_bh(&recent_lock);
 #ifdef CONFIG_PROC_FS
-                remove_proc_entry(t->name, proc_dir);
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+                remove_proc_entry(t->name, proc_old_dir);
+#endif
+                remove_proc_entry(t->name, recent_proc_dir);
 #endif
                 recent_table_flush(t);
                 kfree(t);
@@ -316,7 +374,7 @@ static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)
 
 #ifdef CONFIG_PROC_FS
 struct recent_iter_state {
-        struct recent_table     *table;
+        const struct recent_table *table;
         unsigned int            bucket;
 };
 
@@ -341,8 +399,8 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct recent_iter_state *st = seq->private;
         const struct recent_table *t = st->table;
-        struct recent_entry *e = v;
-        struct list_head *head = e->list.next;
+        const struct recent_entry *e = v;
+        const struct list_head *head = e->list.next;
 
         while (head == &t->iphash[st->bucket]) {
                 if (++st->bucket >= ip_list_hash_size)
@@ -365,8 +423,14 @@ static int recent_seq_show(struct seq_file *seq, void *v)
         unsigned int i;
 
         i = (e->index - 1) % ip_pkt_list_tot;
-        seq_printf(seq, "src=%u.%u.%u.%u ttl: %u last_seen: %lu oldest_pkt: %u",
-                   NIPQUAD(e->addr), e->ttl, e->stamps[i], e->index);
+        if (e->family == NFPROTO_IPV4)
+                seq_printf(seq, "src=" NIPQUAD_FMT " ttl: %u last_seen: %lu "
+                           "oldest_pkt: %u", NIPQUAD(e->addr.ip), e->ttl,
+                           e->stamps[i], e->index);
+        else
+                seq_printf(seq, "src=" NIP6_FMT " ttl: %u last_seen: %lu "
+                           "oldest_pkt: %u", NIP6(e->addr.in6), e->ttl,
+                           e->stamps[i], e->index);
         for (i = 0; i < e->nstamps; i++)
                 seq_printf(seq, "%s %lu", i ? "," : "", e->stamps[i]);
         seq_printf(seq, "\n");
@@ -393,8 +457,22 @@ static int recent_seq_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static ssize_t recent_proc_write(struct file *file, const char __user *input,
-                                 size_t size, loff_t *loff)
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+static int recent_old_seq_open(struct inode *inode, struct file *filp)
+{
+        static bool warned_of_old;
+
+        if (unlikely(!warned_of_old)) {
+                printk(KERN_INFO KBUILD_MODNAME ": Use of /proc/net/ipt_recent"
+                       " is deprecated; use /proc/net/xt_recent.\n");
+                warned_of_old = true;
+        }
+        return recent_seq_open(inode, filp);
+}
+
+static ssize_t recent_old_proc_write(struct file *file,
+                                     const char __user *input,
+                                     size_t size, loff_t *loff)
 {
         const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
         struct recent_table *t = pde->data;
@@ -407,6 +485,7 @@ static ssize_t recent_proc_write(struct file *file, const char __user *input,
                 size = sizeof(buf);
         if (copy_from_user(buf, input, size))
                 return -EFAULT;
+
         while (isspace(*c))
                 c++;
 
@@ -434,10 +513,11 @@ static ssize_t recent_proc_write(struct file *file, const char __user *input,
         addr = in_aton(c);
 
         spin_lock_bh(&recent_lock);
-        e = recent_entry_lookup(t, addr, 0);
+        e = recent_entry_lookup(t, (const void *)&addr, NFPROTO_IPV4, 0);
         if (e == NULL) {
                 if (add)
-                        recent_entry_init(t, addr, 0);
+                        recent_entry_init(t, (const void *)&addr,
+                                          NFPROTO_IPV4, 0);
         } else {
                 if (add)
                         recent_entry_update(t, e);
@@ -448,23 +528,118 @@ static ssize_t recent_proc_write(struct file *file, const char __user *input,
         return size;
 }
 
-static const struct file_operations recent_fops = {
-        .open           = recent_seq_open,
+static const struct file_operations recent_old_fops = {
+        .open           = recent_old_seq_open,
         .read           = seq_read,
-        .write          = recent_proc_write,
+        .write          = recent_old_proc_write,
         .release        = seq_release_private,
         .owner          = THIS_MODULE,
 };
+#endif
+
+static ssize_t
+recent_mt_proc_write(struct file *file, const char __user *input,
+                     size_t size, loff_t *loff)
+{
+        const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
+        struct recent_table *t = pde->data;
+        struct recent_entry *e;
+        char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
+        const char *c = buf;
+        union nf_inet_addr addr;
+        u_int16_t family;
+        bool add, succ;
+
+        if (size == 0)
+                return 0;
+        if (size > sizeof(buf))
+                size = sizeof(buf);
+        if (copy_from_user(buf, input, size) != 0)
+                return -EFAULT;
+
+        /* Strict protocol! */
+        if (*loff != 0)
+                return -ESPIPE;
+        switch (*c) {
+        case '/': /* flush table */
+                spin_lock_bh(&recent_lock);
+                recent_table_flush(t);
+                spin_unlock_bh(&recent_lock);
+                return size;
+        case '-': /* remove address */
+                add = false;
+                break;
+        case '+': /* add address */
+                add = true;
+                break;
+        default:
+                printk(KERN_INFO KBUILD_MODNAME ": Need +ip, -ip or /\n");
+                return -EINVAL;
+        }
+
+        ++c;
+        --size;
+        if (strnchr(c, size, ':') != NULL) {
+                family = NFPROTO_IPV6;
+                succ   = in6_pton(c, size, (void *)&addr, '\n', NULL);
+        } else {
+                family = NFPROTO_IPV4;
+                succ   = in4_pton(c, size, (void *)&addr, '\n', NULL);
+        }
+
+        if (!succ) {
+                printk(KERN_INFO KBUILD_MODNAME ": illegal address written "
+                       "to procfs\n");
+                return -EINVAL;
+        }
+
+        spin_lock_bh(&recent_lock);
+        e = recent_entry_lookup(t, &addr, family, 0);
+        if (e == NULL) {
+                if (add)
+                        recent_entry_init(t, &addr, family, 0);
+        } else {
+                if (add)
+                        recent_entry_update(t, e);
+                else
+                        recent_entry_remove(t, e);
+        }
+        spin_unlock_bh(&recent_lock);
+        /* Note we removed one above */
+        *loff += size + 1;
+        return size + 1;
+}
+
+static const struct file_operations recent_mt_fops = {
+        .open    = recent_seq_open,
+        .read    = seq_read,
+        .write   = recent_mt_proc_write,
+        .release = seq_release_private,
+        .owner   = THIS_MODULE,
+};
 #endif /* CONFIG_PROC_FS */
 
-static struct xt_match recent_mt_reg __read_mostly = {
-        .name           = "recent",
-        .family         = AF_INET,
-        .match          = recent_mt,
-        .matchsize      = sizeof(struct ipt_recent_info),
-        .checkentry     = recent_mt_check,
-        .destroy        = recent_mt_destroy,
-        .me             = THIS_MODULE,
+static struct xt_match recent_mt_reg[] __read_mostly = {
+        {
+                .name       = "recent",
+                .revision   = 0,
+                .family     = NFPROTO_IPV4,
+                .match      = recent_mt,
+                .matchsize  = sizeof(struct xt_recent_mtinfo),
+                .checkentry = recent_mt_check,
+                .destroy    = recent_mt_destroy,
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "recent",
+                .revision   = 0,
+                .family     = NFPROTO_IPV6,
+                .match      = recent_mt,
+                .matchsize  = sizeof(struct xt_recent_mtinfo),
+                .checkentry = recent_mt_check,
+                .destroy    = recent_mt_destroy,
+                .me         = THIS_MODULE,
+        },
 };
 
 static int __init recent_mt_init(void)
@@ -475,26 +650,39 @@ static int __init recent_mt_init(void)
                 return -EINVAL;
         ip_list_hash_size = 1 << fls(ip_list_tot);
 
-        err = xt_register_match(&recent_mt_reg);
+        err = xt_register_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
 #ifdef CONFIG_PROC_FS
         if (err)
                 return err;
-        proc_dir = proc_mkdir("ipt_recent", init_net.proc_net);
-        if (proc_dir == NULL) {
-                xt_unregister_match(&recent_mt_reg);
+        recent_proc_dir = proc_mkdir("xt_recent", init_net.proc_net);
+        if (recent_proc_dir == NULL) {
+                xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
+                err = -ENOMEM;
+        }
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+        if (err < 0)
+                return err;
+        proc_old_dir = proc_mkdir("ipt_recent", init_net.proc_net);
+        if (proc_old_dir == NULL) {
+                remove_proc_entry("xt_recent", init_net.proc_net);
+                xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
                 err = -ENOMEM;
         }
 #endif
+#endif
         return err;
 }
 
 static void __exit recent_mt_exit(void)
 {
         BUG_ON(!list_empty(&tables));
-        xt_unregister_match(&recent_mt_reg);
+        xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
 #ifdef CONFIG_PROC_FS
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
         remove_proc_entry("ipt_recent", init_net.proc_net);
 #endif
+        remove_proc_entry("xt_recent", init_net.proc_net);
+#endif
 }
 
 module_init(recent_mt_init);
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index e6e4681fa047..e223cb43ae8e 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -117,23 +117,21 @@ match_packet(const struct sk_buff *skb,
 }
 
 static bool
-sctp_mt(const struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, const struct xt_match *match,
-        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+sctp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_sctp_info *info = matchinfo;
+        const struct xt_sctp_info *info = par->matchinfo;
         const sctp_sctphdr_t *sh;
         sctp_sctphdr_t _sh;
 
-        if (offset) {
+        if (par->fragoff != 0) {
                 duprintf("Dropping non-first fragment.. FIXME\n");
                 return false;
         }
 
-        sh = skb_header_pointer(skb, protoff, sizeof(_sh), &_sh);
+        sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
         if (sh == NULL) {
                 duprintf("Dropping evil TCP offset=0 tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
         duprintf("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
@@ -144,17 +142,14 @@ sctp_mt(const struct sk_buff *skb, const struct net_device *in,
                 && SCCHECK(ntohs(sh->dest) >= info->dpts[0]
                         && ntohs(sh->dest) <= info->dpts[1],
                         XT_SCTP_DEST_PORTS, info->flags, info->invflags)
-                && SCCHECK(match_packet(skb, protoff + sizeof (sctp_sctphdr_t),
-                                        info, hotdrop),
+                && SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t),
+                                        info, par->hotdrop),
                            XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
 }
 
-static bool
-sctp_mt_check(const char *tablename, const void *inf,
-              const struct xt_match *match, void *matchinfo,
-              unsigned int hook_mask)
+static bool sctp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_sctp_info *info = matchinfo;
+        const struct xt_sctp_info *info = par->matchinfo;
 
         return !(info->flags & ~XT_SCTP_VALID_FLAGS)
                 && !(info->invflags & ~XT_SCTP_VALID_FLAGS)
@@ -169,7 +164,7 @@ sctp_mt_check(const char *tablename, const void *inf,
 static struct xt_match sctp_mt_reg[] __read_mostly = {
         {
                 .name           = "sctp",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = sctp_mt_check,
                 .match          = sctp_mt,
                 .matchsize      = sizeof(struct xt_sctp_info),
@@ -178,7 +173,7 @@ static struct xt_match sctp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "sctp",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = sctp_mt_check,
                 .match          = sctp_mt,
                 .matchsize      = sizeof(struct xt_sctp_info),
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
new file mode 100644
index 000000000000..02a8fed21082
--- /dev/null
+++ b/net/netfilter/xt_socket.c
@@ -0,0 +1,185 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (C) 2007-2008 BalaBit IT Ltd.
+ * Author: Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <net/tcp.h>
+#include <net/udp.h>
+#include <net/icmp.h>
+#include <net/sock.h>
+#include <net/inet_sock.h>
+#include <net/netfilter/nf_tproxy_core.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#define XT_SOCKET_HAVE_CONNTRACK 1
+#include <net/netfilter/nf_conntrack.h>
+#endif
+
+static int
+extract_icmp_fields(const struct sk_buff *skb,
+                    u8 *protocol,
+                    __be32 *raddr,
+                    __be32 *laddr,
+                    __be16 *rport,
+                    __be16 *lport)
+{
+        unsigned int outside_hdrlen = ip_hdrlen(skb);
+        struct iphdr *inside_iph, _inside_iph;
+        struct icmphdr *icmph, _icmph;
+        __be16 *ports, _ports[2];
+
+        icmph = skb_header_pointer(skb, outside_hdrlen,
+                                   sizeof(_icmph), &_icmph);
+        if (icmph == NULL)
+                return 1;
+
+        switch (icmph->type) {
+        case ICMP_DEST_UNREACH:
+        case ICMP_SOURCE_QUENCH:
+        case ICMP_REDIRECT:
+        case ICMP_TIME_EXCEEDED:
+        case ICMP_PARAMETERPROB:
+                break;
+        default:
+                return 1;
+        }
+
+        inside_iph = skb_header_pointer(skb, outside_hdrlen +
+                                        sizeof(struct icmphdr),
+                                        sizeof(_inside_iph), &_inside_iph);
+        if (inside_iph == NULL)
+                return 1;
+
+        if (inside_iph->protocol != IPPROTO_TCP &&
+            inside_iph->protocol != IPPROTO_UDP)
+                return 1;
+
+        ports = skb_header_pointer(skb, outside_hdrlen +
+                                   sizeof(struct icmphdr) +
+                                   (inside_iph->ihl << 2),
+                                   sizeof(_ports), &_ports);
+        if (ports == NULL)
+                return 1;
+
+        /* the inside IP packet is the one quoted from our side, thus
+         * its saddr is the local address */
+        *protocol = inside_iph->protocol;
+        *laddr = inside_iph->saddr;
+        *lport = ports[0];
+        *raddr = inside_iph->daddr;
+        *rport = ports[1];
+
+        return 0;
+}
+
+
+static bool
+socket_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+        const struct iphdr *iph = ip_hdr(skb);
+        struct udphdr _hdr, *hp = NULL;
+        struct sock *sk;
+        __be32 daddr, saddr;
+        __be16 dport, sport;
+        u8 protocol;
+#ifdef XT_SOCKET_HAVE_CONNTRACK
+        struct nf_conn const *ct;
+        enum ip_conntrack_info ctinfo;
+#endif
+
+        if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
+                hp = skb_header_pointer(skb, ip_hdrlen(skb),
+                                        sizeof(_hdr), &_hdr);
+                if (hp == NULL)
+                        return false;
+
+                protocol = iph->protocol;
+                saddr = iph->saddr;
+                sport = hp->source;
+                daddr = iph->daddr;
+                dport = hp->dest;
+
+        } else if (iph->protocol == IPPROTO_ICMP) {
+                if (extract_icmp_fields(skb, &protocol, &saddr, &daddr,
+                                        &sport, &dport))
+                        return false;
+        } else {
+                return false;
+        }
+
+#ifdef XT_SOCKET_HAVE_CONNTRACK
+        /* Do the lookup with the original socket address in case this is a
+         * reply packet of an established SNAT-ted connection. */
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (ct && (ct != &nf_conntrack_untracked) &&
+            ((iph->protocol != IPPROTO_ICMP &&
+              ctinfo == IP_CT_IS_REPLY + IP_CT_ESTABLISHED) ||
+             (iph->protocol == IPPROTO_ICMP &&
+              ctinfo == IP_CT_IS_REPLY + IP_CT_RELATED)) &&
+            (ct->status & IPS_SRC_NAT_DONE)) {
+
+                daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
+                dport = (iph->protocol == IPPROTO_TCP) ?
+                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port :
+                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
+        }
+#endif
+
+        sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
+                                   saddr, daddr, sport, dport, par->in, false);
+        if (sk != NULL) {
+                bool wildcard = (inet_sk(sk)->rcv_saddr == 0);
+
+                nf_tproxy_put_sock(sk);
+                if (wildcard)
+                        sk = NULL;
+        }
+
+        pr_debug("socket match: proto %u %08x:%u -> %08x:%u "
+                 "(orig %08x:%u) sock %p\n",
+                 protocol, ntohl(saddr), ntohs(sport),
+                 ntohl(daddr), ntohs(dport),
+                 ntohl(iph->daddr), hp ? ntohs(hp->dest) : 0, sk);
+
+        return (sk != NULL);
+}
+
+static struct xt_match socket_mt_reg __read_mostly = {
+        .name           = "socket",
+        .family         = AF_INET,
+        .match          = socket_mt,
+        .hooks          = 1 << NF_INET_PRE_ROUTING,
+        .me             = THIS_MODULE,
+};
+
+static int __init socket_mt_init(void)
+{
+        nf_defrag_ipv4_enable();
+        return xt_register_match(&socket_mt_reg);
+}
+
+static void __exit socket_mt_exit(void)
+{
+        xt_unregister_match(&socket_mt_reg);
+}
+
+module_init(socket_mt_init);
+module_exit(socket_mt_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
+MODULE_DESCRIPTION("x_tables socket match module");
+MODULE_ALIAS("ipt_socket");
diff --git a/net/netfilter/xt_state.c b/net/netfilter/xt_state.c
index a776dc36a193..4c946cbd731f 100644
--- a/net/netfilter/xt_state.c
+++ b/net/netfilter/xt_state.c
@@ -21,12 +21,9 @@ MODULE_ALIAS("ipt_state");
 MODULE_ALIAS("ip6t_state");
 
 static bool
-state_mt(const struct sk_buff *skb, const struct net_device *in,
-         const struct net_device *out, const struct xt_match *match,
-         const void *matchinfo, int offset, unsigned int protoff,
-         bool *hotdrop)
+state_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_state_info *sinfo = matchinfo;
+        const struct xt_state_info *sinfo = par->matchinfo;
         enum ip_conntrack_info ctinfo;
         unsigned int statebit;
 
@@ -40,28 +37,25 @@ state_mt(const struct sk_buff *skb, const struct net_device *in,
         return (sinfo->statemask & statebit);
 }
 
-static bool
-state_mt_check(const char *tablename, const void *inf,
-               const struct xt_match *match, void *matchinfo,
-               unsigned int hook_mask)
+static bool state_mt_check(const struct xt_mtchk_param *par)
 {
-        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
+        if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
                 printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", match->family);
+                                    "proto=%u\n", par->match->family);
                 return false;
         }
         return true;
 }
 
-static void state_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void state_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        nf_ct_l3proto_module_put(match->family);
+        nf_ct_l3proto_module_put(par->match->family);
 }
 
 static struct xt_match state_mt_reg[] __read_mostly = {
         {
                 .name           = "state",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = state_mt_check,
                 .match          = state_mt,
                 .destroy        = state_mt_destroy,
@@ -70,7 +64,7 @@ static struct xt_match state_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "state",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = state_mt_check,
                 .match          = state_mt,
                 .destroy        = state_mt_destroy,
diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
index 43133080da7d..0d75141139d5 100644
--- a/net/netfilter/xt_statistic.c
+++ b/net/netfilter/xt_statistic.c
@@ -25,12 +25,9 @@ MODULE_ALIAS("ip6t_statistic");
 static DEFINE_SPINLOCK(nth_lock);
 
 static bool
-statistic_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+statistic_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        struct xt_statistic_info *info = (struct xt_statistic_info *)matchinfo;
+        struct xt_statistic_info *info = (void *)par->matchinfo;
         bool ret = info->flags & XT_STATISTIC_INVERT;
 
         switch (info->mode) {
@@ -52,12 +49,9 @@ statistic_mt(const struct sk_buff *skb, const struct net_device *in,
         return ret;
 }
 
-static bool
-statistic_mt_check(const char *tablename, const void *entry,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+static bool statistic_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_statistic_info *info = matchinfo;
+        struct xt_statistic_info *info = par->matchinfo;
 
         if (info->mode > XT_STATISTIC_MODE_MAX ||
             info->flags & ~XT_STATISTIC_MASK)
@@ -66,35 +60,24 @@ statistic_mt_check(const char *tablename, const void *entry,
         return true;
 }
 
-static struct xt_match statistic_mt_reg[] __read_mostly = {
-        {
-                .name           = "statistic",
-                .family         = AF_INET,
-                .checkentry     = statistic_mt_check,
-                .match          = statistic_mt,
-                .matchsize      = sizeof(struct xt_statistic_info),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "statistic",
-                .family         = AF_INET6,
-                .checkentry     = statistic_mt_check,
-                .match          = statistic_mt,
-                .matchsize      = sizeof(struct xt_statistic_info),
-                .me             = THIS_MODULE,
-        },
+static struct xt_match xt_statistic_mt_reg __read_mostly = {
+        .name       = "statistic",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .match      = statistic_mt,
+        .checkentry = statistic_mt_check,
+        .matchsize  = sizeof(struct xt_statistic_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init statistic_mt_init(void)
 {
-        return xt_register_matches(statistic_mt_reg,
-               ARRAY_SIZE(statistic_mt_reg));
+        return xt_register_match(&xt_statistic_mt_reg);
 }
 
 static void __exit statistic_mt_exit(void)
 {
-        xt_unregister_matches(statistic_mt_reg,
-                              ARRAY_SIZE(statistic_mt_reg));
+        xt_unregister_match(&xt_statistic_mt_reg);
 }
 
 module_init(statistic_mt_init);
diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c
index 4903182a062b..b4d774111311 100644
--- a/net/netfilter/xt_string.c
+++ b/net/netfilter/xt_string.c
@@ -22,18 +22,15 @@ MODULE_ALIAS("ipt_string");
 MODULE_ALIAS("ip6t_string");
 
 static bool
-string_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+string_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_string_info *conf = matchinfo;
+        const struct xt_string_info *conf = par->matchinfo;
         struct ts_state state;
         int invert;
 
         memset(&state, 0, sizeof(struct ts_state));
 
-        invert = (match->revision == 0 ? conf->u.v0.invert :
+        invert = (par->match->revision == 0 ? conf->u.v0.invert :
                                     conf->u.v1.flags & XT_STRING_FLAG_INVERT);
 
         return (skb_find_text((struct sk_buff *)skb, conf->from_offset,
@@ -43,12 +40,9 @@ string_mt(const struct sk_buff *skb, const struct net_device *in,
 
 #define STRING_TEXT_PRIV(m) ((struct xt_string_info *)(m))
 
-static bool
-string_mt_check(const char *tablename, const void *ip,
-                const struct xt_match *match, void *matchinfo,
-                unsigned int hook_mask)
+static bool string_mt_check(const struct xt_mtchk_param *par)
 {
-        struct xt_string_info *conf = matchinfo;
+        struct xt_string_info *conf = par->matchinfo;
         struct ts_config *ts_conf;
         int flags = TS_AUTOLOAD;
 
@@ -59,7 +53,7 @@ string_mt_check(const char *tablename, const void *ip,
                 return false;
         if (conf->patlen > XT_STRING_MAX_PATTERN_SIZE)
                 return false;
-        if (match->revision == 1) {
+        if (par->match->revision == 1) {
                 if (conf->u.v1.flags &
                     ~(XT_STRING_FLAG_IGNORECASE | XT_STRING_FLAG_INVERT))
                         return false;
@@ -76,36 +70,16 @@ string_mt_check(const char *tablename, const void *ip,
         return true;
 }
 
-static void string_mt_destroy(const struct xt_match *match, void *matchinfo)
+static void string_mt_destroy(const struct xt_mtdtor_param *par)
 {
-        textsearch_destroy(STRING_TEXT_PRIV(matchinfo)->config);
+        textsearch_destroy(STRING_TEXT_PRIV(par->matchinfo)->config);
 }
 
-static struct xt_match string_mt_reg[] __read_mostly = {
-        {
-                .name           = "string",
-                .revision       = 0,
-                .family         = AF_INET,
-                .checkentry     = string_mt_check,
-                .match          = string_mt,
-                .destroy        = string_mt_destroy,
-                .matchsize      = sizeof(struct xt_string_info),
-                .me             = THIS_MODULE
-        },
-        {
-                .name           = "string",
-                .revision       = 1,
-                .family         = AF_INET,
-                .checkentry     = string_mt_check,
-                .match          = string_mt,
-                .destroy        = string_mt_destroy,
-                .matchsize      = sizeof(struct xt_string_info),
-                .me             = THIS_MODULE
-        },
+static struct xt_match xt_string_mt_reg[] __read_mostly = {
         {
                 .name           = "string",
                 .revision       = 0,
-                .family         = AF_INET6,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = string_mt_check,
                 .match          = string_mt,
                 .destroy        = string_mt_destroy,
@@ -115,7 +89,7 @@ static struct xt_match string_mt_reg[] __read_mostly = {
         {
                 .name           = "string",
                 .revision       = 1,
-                .family         = AF_INET6,
+                .family         = NFPROTO_UNSPEC,
                 .checkentry     = string_mt_check,
                 .match          = string_mt,
                 .destroy        = string_mt_destroy,
@@ -126,12 +100,13 @@ static struct xt_match string_mt_reg[] __read_mostly = {
 
 static int __init string_mt_init(void)
 {
-        return xt_register_matches(string_mt_reg, ARRAY_SIZE(string_mt_reg));
+        return xt_register_matches(xt_string_mt_reg,
+                                   ARRAY_SIZE(xt_string_mt_reg));
 }
 
 static void __exit string_mt_exit(void)
 {
-        xt_unregister_matches(string_mt_reg, ARRAY_SIZE(string_mt_reg));
+        xt_unregister_matches(xt_string_mt_reg, ARRAY_SIZE(xt_string_mt_reg));
 }
 
 module_init(string_mt_init);
diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
index 6771bf01275b..4809b34b10f8 100644
--- a/net/netfilter/xt_tcpmss.c
+++ b/net/netfilter/xt_tcpmss.c
@@ -25,12 +25,9 @@ MODULE_ALIAS("ipt_tcpmss");
 MODULE_ALIAS("ip6t_tcpmss");
 
 static bool
-tcpmss_mt(const struct sk_buff *skb, const struct net_device *in,
-          const struct net_device *out, const struct xt_match *match,
-          const void *matchinfo, int offset, unsigned int protoff,
-          bool *hotdrop)
+tcpmss_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_tcpmss_match_info *info = matchinfo;
+        const struct xt_tcpmss_match_info *info = par->matchinfo;
         const struct tcphdr *th;
         struct tcphdr _tcph;
         /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
@@ -39,7 +36,7 @@ tcpmss_mt(const struct sk_buff *skb, const struct net_device *in,
         unsigned int i, optlen;
 
         /* If we don't have the whole header, drop packet. */
-        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
         if (th == NULL)
                 goto dropit;
 
@@ -52,7 +49,7 @@ tcpmss_mt(const struct sk_buff *skb, const struct net_device *in,
                 goto out;
 
         /* Truncated options. */
-        op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt);
+        op = skb_header_pointer(skb, par->thoff + sizeof(*th), optlen, _opt);
         if (op == NULL)
                 goto dropit;
 
@@ -76,14 +73,14 @@ out:
         return info->invert;
 
 dropit:
-        *hotdrop = true;
+        *par->hotdrop = true;
         return false;
 }
 
 static struct xt_match tcpmss_mt_reg[] __read_mostly = {
         {
                 .name           = "tcpmss",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .match          = tcpmss_mt,
                 .matchsize      = sizeof(struct xt_tcpmss_match_info),
                 .proto          = IPPROTO_TCP,
@@ -91,7 +88,7 @@ static struct xt_match tcpmss_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "tcpmss",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .match          = tcpmss_mt,
                 .matchsize      = sizeof(struct xt_tcpmss_match_info),
                 .proto          = IPPROTO_TCP,
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index 951b06b8d701..1ebdc4934eed 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -68,25 +68,22 @@ tcp_find_option(u_int8_t option,
         return invert;
 }
 
-static bool
-tcp_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool tcp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const struct tcphdr *th;
         struct tcphdr _tcph;
-        const struct xt_tcp *tcpinfo = matchinfo;
+        const struct xt_tcp *tcpinfo = par->matchinfo;
 
-        if (offset) {
+        if (par->fragoff != 0) {
                 /* To quote Alan:
 
                    Don't allow a fragment of TCP 8 bytes in. Nobody normal
                    causes this. Its a cracker trying to break in by doing a
                    flag overwrite to pass the direction checks.
                 */
-                if (offset == 1) {
+                if (par->fragoff == 1) {
                         duprintf("Dropping evil TCP offset=1 frag.\n");
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                 }
                 /* Must not be a fragment. */
                 return false;
@@ -94,12 +91,12 @@ tcp_mt(const struct sk_buff *skb, const struct net_device *in,
 
 #define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
 
-        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
         if (th == NULL) {
                 /* We've been asked to examine this packet, and we
                    can't.  Hence, no choice but to drop. */
                 duprintf("Dropping evil TCP offset=0 tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -117,49 +114,42 @@ tcp_mt(const struct sk_buff *skb, const struct net_device *in,
                 return false;
         if (tcpinfo->option) {
                 if (th->doff * 4 < sizeof(_tcph)) {
-                        *hotdrop = true;
+                        *par->hotdrop = true;
                         return false;
                 }
-                if (!tcp_find_option(tcpinfo->option, skb, protoff,
+                if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
                                      th->doff*4 - sizeof(_tcph),
                                      tcpinfo->invflags & XT_TCP_INV_OPTION,
-                                     hotdrop))
+                                     par->hotdrop))
                         return false;
         }
         return true;
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-tcp_mt_check(const char *tablename, const void *info,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool tcp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_tcp *tcpinfo = matchinfo;
+        const struct xt_tcp *tcpinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         return !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
 }
 
-static bool
-udp_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool udp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
         const struct udphdr *uh;
         struct udphdr _udph;
-        const struct xt_udp *udpinfo = matchinfo;
+        const struct xt_udp *udpinfo = par->matchinfo;
 
         /* Must not be a fragment. */
-        if (offset)
+        if (par->fragoff != 0)
                 return false;
 
-        uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
+        uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph);
         if (uh == NULL) {
                 /* We've been asked to examine this packet, and we
                    can't.  Hence, no choice but to drop. */
                 duprintf("Dropping evil UDP tinygram.\n");
-                *hotdrop = true;
+                *par->hotdrop = true;
                 return false;
         }
 
@@ -171,13 +161,9 @@ udp_mt(const struct sk_buff *skb, const struct net_device *in,
                               !!(udpinfo->invflags & XT_UDP_INV_DSTPT));
 }
 
-/* Called when user tries to insert an entry of this type. */
-static bool
-udp_mt_check(const char *tablename, const void *info,
-             const struct xt_match *match, void *matchinfo,
-             unsigned int hook_mask)
+static bool udp_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_udp *udpinfo = matchinfo;
+        const struct xt_udp *udpinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         return !(udpinfo->invflags & ~XT_UDP_INV_MASK);
@@ -186,7 +172,7 @@ udp_mt_check(const char *tablename, const void *info,
 static struct xt_match tcpudp_mt_reg[] __read_mostly = {
         {
                 .name           = "tcp",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = tcp_mt_check,
                 .match          = tcp_mt,
                 .matchsize      = sizeof(struct xt_tcp),
@@ -195,7 +181,7 @@ static struct xt_match tcpudp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "tcp",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = tcp_mt_check,
                 .match          = tcp_mt,
                 .matchsize      = sizeof(struct xt_tcp),
@@ -204,7 +190,7 @@ static struct xt_match tcpudp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "udp",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = udp_mt_check,
                 .match          = udp_mt,
                 .matchsize      = sizeof(struct xt_udp),
@@ -213,7 +199,7 @@ static struct xt_match tcpudp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "udp",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = udp_mt_check,
                 .match          = udp_mt,
                 .matchsize      = sizeof(struct xt_udp),
@@ -222,7 +208,7 @@ static struct xt_match tcpudp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "udplite",
-                .family         = AF_INET,
+                .family         = NFPROTO_IPV4,
                 .checkentry     = udp_mt_check,
                 .match          = udp_mt,
                 .matchsize      = sizeof(struct xt_udp),
@@ -231,7 +217,7 @@ static struct xt_match tcpudp_mt_reg[] __read_mostly = {
         },
         {
                 .name           = "udplite",
-                .family         = AF_INET6,
+                .family         = NFPROTO_IPV6,
                 .checkentry     = udp_mt_check,
                 .match          = udp_mt,
                 .matchsize      = sizeof(struct xt_udp),
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 307a2c3c2df4..29375ba8db73 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -153,11 +153,9 @@ static void localtime_3(struct xtm *r, time_t time)
 }
 
 static bool
-time_mt(const struct sk_buff *skb, const struct net_device *in,
-        const struct net_device *out, const struct xt_match *match,
-        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+time_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_time_info *info = matchinfo;
+        const struct xt_time_info *info = par->matchinfo;
         unsigned int packet_time;
         struct xtm current_time;
         s64 stamp;
@@ -220,12 +218,9 @@ time_mt(const struct sk_buff *skb, const struct net_device *in,
         return true;
 }
 
-static bool
-time_mt_check(const char *tablename, const void *ip,
-              const struct xt_match *match, void *matchinfo,
-              unsigned int hook_mask)
+static bool time_mt_check(const struct xt_mtchk_param *par)
 {
-        const struct xt_time_info *info = matchinfo;
+        const struct xt_time_info *info = par->matchinfo;
 
         if (info->daytime_start > XT_TIME_MAX_DAYTIME ||
             info->daytime_stop > XT_TIME_MAX_DAYTIME) {
@@ -237,33 +232,23 @@ time_mt_check(const char *tablename, const void *ip,
         return true;
 }
 
-static struct xt_match time_mt_reg[] __read_mostly = {
-        {
-                .name       = "time",
-                .family     = AF_INET,
-                .match      = time_mt,
-                .matchsize  = sizeof(struct xt_time_info),
-                .checkentry = time_mt_check,
-                .me         = THIS_MODULE,
-        },
-        {
-                .name       = "time",
-                .family     = AF_INET6,
-                .match      = time_mt,
-                .matchsize  = sizeof(struct xt_time_info),
-                .checkentry = time_mt_check,
-                .me         = THIS_MODULE,
-        },
+static struct xt_match xt_time_mt_reg __read_mostly = {
+        .name       = "time",
+        .family     = NFPROTO_UNSPEC,
+        .match      = time_mt,
+        .checkentry = time_mt_check,
+        .matchsize  = sizeof(struct xt_time_info),
+        .me         = THIS_MODULE,
 };
 
 static int __init time_mt_init(void)
 {
-        return xt_register_matches(time_mt_reg, ARRAY_SIZE(time_mt_reg));
+        return xt_register_match(&xt_time_mt_reg);
 }
 
 static void __exit time_mt_exit(void)
 {
-        xt_unregister_matches(time_mt_reg, ARRAY_SIZE(time_mt_reg));
+        xt_unregister_match(&xt_time_mt_reg);
 }
 
 module_init(time_mt_init);
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 627e0f336d54..24a527624500 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -87,43 +87,32 @@ static bool u32_match_it(const struct xt_u32 *data,
         return true;
 }
 
-static bool
-u32_mt(const struct sk_buff *skb, const struct net_device *in,
-       const struct net_device *out, const struct xt_match *match,
-       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
+static bool u32_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_u32 *data = matchinfo;
+        const struct xt_u32 *data = par->matchinfo;
         bool ret;
 
         ret = u32_match_it(data, skb);
         return ret ^ data->invert;
 }
 
-static struct xt_match u32_mt_reg[] __read_mostly = {
-        {
-                .name       = "u32",
-                .family     = AF_INET,
-                .match      = u32_mt,
-                .matchsize  = sizeof(struct xt_u32),
-                .me         = THIS_MODULE,
-        },
-        {
-                .name       = "u32",
-                .family     = AF_INET6,
-                .match      = u32_mt,
-                .matchsize  = sizeof(struct xt_u32),
-                .me         = THIS_MODULE,
-        },
+static struct xt_match xt_u32_mt_reg __read_mostly = {
+        .name       = "u32",
+        .revision   = 0,
+        .family     = NFPROTO_UNSPEC,
+        .match      = u32_mt,
+        .matchsize  = sizeof(struct xt_u32),
+        .me         = THIS_MODULE,
 };
 
 static int __init u32_mt_init(void)
 {
-        return xt_register_matches(u32_mt_reg, ARRAY_SIZE(u32_mt_reg));
+        return xt_register_match(&xt_u32_mt_reg);
 }
 
 static void __exit u32_mt_exit(void)
 {
-        xt_unregister_matches(u32_mt_reg, ARRAY_SIZE(u32_mt_reg));
+        xt_unregister_match(&xt_u32_mt_reg);
 }
 
 module_init(u32_mt_init);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index d1263b3c96c3..0453d79ebf57 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -40,6 +40,7 @@ static struct tcf_hashinfo ipt_hash_info = {
 
 static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
 {
+        struct xt_tgchk_param par;
         struct xt_target *target;
         int ret = 0;
 
@@ -49,29 +50,30 @@ static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int
                 return -ENOENT;
 
         t->u.kernel.target = target;
-
-        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
-                              table, hook, 0, 0);
-        if (ret) {
+        par.table     = table;
+        par.entryinfo = NULL;
+        par.target    = target;
+        par.targinfo  = t->data;
+        par.hook_mask = hook;
+        par.family    = NFPROTO_IPV4;
+
+        ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
+        if (ret < 0) {
                 module_put(t->u.kernel.target->me);
                 return ret;
         }
-        if (t->u.kernel.target->checkentry
-            && !t->u.kernel.target->checkentry(table, NULL,
-                                               t->u.kernel.target, t->data,
-                                               hook)) {
-                module_put(t->u.kernel.target->me);
-                ret = -EINVAL;
-        }
-
-        return ret;
+        return 0;
 }
 
 static void ipt_destroy_target(struct ipt_entry_target *t)
 {
-        if (t->u.kernel.target->destroy)
-                t->u.kernel.target->destroy(t->u.kernel.target, t->data);
-        module_put(t->u.kernel.target->me);
+        struct xt_tgdtor_param par = {
+                .target   = t->u.kernel.target,
+                .targinfo = t->data,
+        };
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
+        module_put(par.target->me);
 }
 
 static int tcf_ipt_release(struct tcf_ipt *ipt, int bind)
@@ -196,6 +198,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
 {
         int ret = 0, result = 0;
         struct tcf_ipt *ipt = a->priv;
+        struct xt_target_param par;
 
         if (skb_cloned(skb)) {
                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
@@ -211,10 +214,13 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
         /* yes, we have to worry about both in and out dev
          worry later - danger - this API seems to have changed
          from earlier kernels */
-        ret = ipt->tcfi_t->u.kernel.target->target(skb, skb->dev, NULL,
-                                                   ipt->tcfi_hook,
-                                                   ipt->tcfi_t->u.kernel.target,
-                                                   ipt->tcfi_t->data);
+        par.in       = skb->dev;
+        par.out      = NULL;
+        par.hooknum  = ipt->tcfi_hook;
+        par.target   = ipt->tcfi_t->u.kernel.target;
+        par.targinfo = ipt->tcfi_t->data;
+        ret = par.target->target(skb, &par);
+
         switch (ret) {
         case NF_ACCEPT:
                 result = TC_ACT_OK;