Merge branch 'from-linus'

13 files changed, 54 insertions, 49 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 6bb0c7eb1ef0..e060aad8624d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -90,6 +90,7 @@ static struct rtable __fake_rtable = {
                         .dev                    = &__fake_net_device,
                         .path                   = &__fake_rtable.u.dst,
                         .metrics                = {[RTAX_MTU - 1] = 1500},
+                        .flags                  = DST_NOXFRM,
                 }
         },
         .rt_flags       = 0,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6766f118f070..2144952d1c6c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -411,6 +411,9 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(pkt_type);
         C(ip_summed);
         C(priority);
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        C(ipvs_property);
+#endif
         C(protocol);
         n->destructor = NULL;
 #ifdef CONFIG_NETFILTER
@@ -422,13 +425,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(nfct_reasm);
         nf_conntrack_get_reasm(skb->nfct_reasm);
 #endif
-#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
-        C(ipvs_property);
-#endif
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-        C(nfct_reasm);
-        nf_conntrack_get_reasm(skb->nfct_reasm);
-#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         C(nf_bridge);
         nf_bridge_get(skb->nf_bridge);
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 9890fd97e538..c971f14712ec 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -95,6 +95,12 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                 saddr = dev->dev_addr;
         memcpy(eth->h_source,saddr,dev->addr_len);
 
+        if(daddr)
+        {
+                memcpy(eth->h_dest,daddr,dev->addr_len);
+                return ETH_HLEN;
+        }
+        
         /*
          *      Anyway, the loopback-device should never use this function... 
          */
@@ -105,12 +111,6 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                 return ETH_HLEN;
         }
         
-        if(daddr)
-        {
-                memcpy(eth->h_dest,daddr,dev->addr_len);
-                return ETH_HLEN;
-        }
-        
         return -ETH_HLEN;
 }
 
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index c1a61462507f..1741d555ad0d 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -434,6 +434,7 @@ int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
         } *inside;
         struct ip_conntrack_tuple inner, target;
         int hdrlen = (*pskb)->nh.iph->ihl * 4;
+        unsigned long statusbit;
 
         if (!skb_make_writable(pskb, hdrlen + sizeof(*inside)))
                 return 0;
@@ -495,17 +496,16 @@ int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
 
         /* Change outer to look the reply to an incoming packet
          * (proto 0 means don't invert per-proto part). */
+        if (manip == IP_NAT_MANIP_SRC)
+                statusbit = IPS_SRC_NAT;
+        else
+                statusbit = IPS_DST_NAT;
 
-        /* Obviously, we need to NAT destination IP, but source IP
-           should be NAT'ed only if it is from a NAT'd host.
+        /* Invert if this is reply dir. */
+        if (dir == IP_CT_DIR_REPLY)
+                statusbit ^= IPS_NAT_MASK;
 
-           Explanation: some people use NAT for anonymizing.  Also,
-           CERT recommends dropping all packets from private IP
-           addresses (although ICMP errors from internal links with
-           such addresses are not too uncommon, as Alan Cox points
-           out) */
-        if (manip != IP_NAT_MANIP_SRC
-            || ((*pskb)->nh.iph->saddr == ct->tuplehash[dir].tuple.src.ip)) {
+        if (ct->status & statusbit) {
                 invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
                 if (!manip_pkt(0, pskb, 0, &target, manip))
                         return 0;
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 7c3f7d380240..ab1f88fa21ec 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -200,20 +200,14 @@ ip_nat_in(unsigned int hooknum,
           const struct net_device *out,
           int (*okfn)(struct sk_buff *))
 {
-        struct ip_conntrack *ct;
-        enum ip_conntrack_info ctinfo;
         unsigned int ret;
+        u_int32_t daddr = (*pskb)->nh.iph->daddr;
 
         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
         if (ret != NF_DROP && ret != NF_STOLEN
-            && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (ct->tuplehash[dir].tuple.dst.ip !=
-                    ct->tuplehash[!dir].tuple.src.ip) {
-                        dst_release((*pskb)->dst);
-                        (*pskb)->dst = NULL;
-                }
+            && daddr != (*pskb)->nh.iph->daddr) {
+                dst_release((*pskb)->dst);
+                (*pskb)->dst = NULL;
         }
         return ret;
 }
@@ -276,7 +270,7 @@ ip_nat_local_fn(unsigned int hooknum,
                     ct->tuplehash[!dir].tuple.src.ip
 #ifdef CONFIG_XFRM
                     || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[dir].tuple.src.u.all
+                       ct->tuplehash[!dir].tuple.src.u.all
 #endif
                     )
                         return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d82c242ea704..fca5fe0cf94a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -835,7 +835,7 @@ static int rt_garbage_collect(void)
                                         int r;
 
                                         rthp = rt_remove_balanced_route(
-                                                &rt_hash_table[i].chain,
+                                                &rt_hash_table[k].chain,
                                                 rth,
                                                 &r);
                                         goal -= r;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 45f7ae58f2c0..f285bbf296e2 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -35,6 +35,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
+                    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
                     xfrm_bundle_ok(xdst, fl, AF_INET)) {
                         dst_clone(dst);
                         break;
@@ -61,7 +62,8 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 .nl_u = {
                         .ip4_u = {
                                 .saddr = local,
-                                .daddr = remote
+                                .daddr = remote,
+                                .tos = fl->fl4_tos
                         }
                 }
         };
@@ -230,6 +232,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
         fl->proto = iph->protocol;
         fl->fl4_dst = iph->daddr;
         fl->fl4_src = iph->saddr;
+        fl->fl4_tos = iph->tos;
 }
 
 static inline int xfrm4_garbage_collect(void)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index efa3e72cfcfa..f999edd846a9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -494,6 +494,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         struct net_device *dev;
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info*)skb->dst;
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
@@ -505,7 +506,12 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         hlen = ip6_find_1stfragopt(skb, &prevhdr);
         nexthdr = *prevhdr;
 
-        mtu = dst_mtu(&rt->u.dst) - hlen - sizeof(struct frag_hdr);
+        mtu = dst_mtu(&rt->u.dst);
+        if (np && np->frag_size < mtu) {
+                if (np->frag_size)
+                        mtu = np->frag_size;
+        }
+        mtu -= hlen + sizeof(struct frag_hdr);
 
         if (skb_shinfo(skb)->frag_list) {
                 int first_len = skb_pagelen(skb);
@@ -882,7 +888,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl = *fl;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                inet->cork.fragsize = mtu = dst_mtu(rt->u.dst.path);
+                mtu = dst_mtu(rt->u.dst.path);
+                if (np && np->frag_size < mtu) {
+                        if (np->frag_size)
+                                mtu = np->frag_size;
+                }
+                inet->cork.fragsize = mtu;
                 if (dst_allfrag(rt->u.dst.path))
                         inet->cork.flags |= IPCORK_ALLFRAG;
                 inet->cork.length = 0;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 92ead3cf956b..48597538db3f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -458,7 +458,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         mtu = IPV6_MIN_MTU;
                 t->dev->mtu = mtu;
 
-                if ((len = sizeof (*ipv6h) + ipv6h->payload_len) > mtu) {
+                if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
                         rel_type = ICMPV6_PKT_TOOBIG;
                         rel_code = 0;
                         rel_info = mtu;
@@ -884,6 +884,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
         t->parms.encap_limit = p->encap_limit;
         t->parms.flowinfo = p->flowinfo;
         t->parms.link = p->link;
+        ip6_tnl_dst_reset(t);
         ip6ip6_tnl_link_config(t);
         return 0;
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ae86d237a456..b2d4d1dd2116 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1423,7 +1423,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                 goto out;
         }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 98ec53bd3ac7..8206025d8e46 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -782,7 +782,7 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
         int nx = 0;
         int err;
         u32 genid;
-        u16 family = dst_orig->ops->family;
+        u16 family;
         u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
         u32 sk_sid = security_sk_sid(sk, fl, dir);
 restart:
@@ -796,13 +796,14 @@ restart:
                 if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
                         return 0;
 
-                policy = flow_cache_lookup(fl, sk_sid, family, dir,
-                                           xfrm_policy_lookup);
+                policy = flow_cache_lookup(fl, sk_sid, dst_orig->ops->family,
+                                           dir, xfrm_policy_lookup);
         }
 
         if (!policy)
                 return 0;
 
+        family = dst_orig->ops->family;
         policy->curlft.use_time = (unsigned long)xtime.tv_sec;
 
         switch (policy->action) {
@@ -885,8 +886,6 @@ restart:
                          * We can't enlist stable bundles either.
                          */
                         write_unlock_bh(&policy->lock);
-
-                        xfrm_pol_put(policy);
                         if (dst)
                                 dst_free(dst);
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e12d0be5f976..c656cbaf35e8 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -220,14 +220,14 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                 x->km.state = XFRM_STATE_DEAD;
                 spin_lock(&xfrm_state_lock);
                 list_del(&x->bydst);
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                 if (x->id.spi) {
                         list_del(&x->byspi);
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
                 }
                 spin_unlock(&xfrm_state_lock);
                 if (del_timer(&x->timer))
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
 
                 /* The number two in this test is the reference
                  * mentioned in the comment below plus the reference
@@ -243,7 +243,7 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                  * The xfrm_state_alloc call gives a reference, and that
                  * is what we are dropping here.
                  */
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                 err = 0;
         }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ac87a09ba83e..7de17559249a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -345,7 +345,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                 goto out;
         }