38 files changed, 636 insertions, 156 deletions

diff --git a/include/net/netfilter/ipv4/nf_nat_redirect.h b/include/net/netfilter/ipv4/nf_nat_redirect.h
new file mode 100644
index 000000000000..19e1df3a0a4d
--- /dev/null
+++ b/include/net/netfilter/ipv4/nf_nat_redirect.h
@@ -0,0 +1,9 @@
+#ifndef _NF_NAT_REDIRECT_IPV4_H_
+#define _NF_NAT_REDIRECT_IPV4_H_
+
+unsigned int
+nf_nat_redirect_ipv4(struct sk_buff *skb,
+                     const struct nf_nat_ipv4_multi_range_compat *mr,
+                     unsigned int hooknum);
+
+#endif /* _NF_NAT_REDIRECT_IPV4_H_ */
diff --git a/include/net/netfilter/ipv6/nf_nat_redirect.h b/include/net/netfilter/ipv6/nf_nat_redirect.h
new file mode 100644
index 000000000000..1ebdffc461cc
--- /dev/null
+++ b/include/net/netfilter/ipv6/nf_nat_redirect.h
@@ -0,0 +1,8 @@
+#ifndef _NF_NAT_REDIRECT_IPV6_H_
+#define _NF_NAT_REDIRECT_IPV6_H_
+
+unsigned int
+nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+                     unsigned int hooknum);
+
+#endif /* _NF_NAT_REDIRECT_IPV6_H_ */
diff --git a/include/net/netfilter/nft_redir.h b/include/net/netfilter/nft_redir.h
new file mode 100644
index 000000000000..a2d67546afab
--- /dev/null
+++ b/include/net/netfilter/nft_redir.h
@@ -0,0 +1,21 @@
+#ifndef _NFT_REDIR_H_
+#define _NFT_REDIR_H_
+
+struct nft_redir {
+        enum nft_registers      sreg_proto_min:8;
+        enum nft_registers      sreg_proto_max:8;
+        u16                     flags;
+};
+
+extern const struct nla_policy nft_redir_policy[];
+
+int nft_redir_init(const struct nft_ctx *ctx,
+                   const struct nft_expr *expr,
+                   const struct nlattr * const tb[]);
+
+int nft_redir_dump(struct sk_buff *skb, const struct nft_expr *expr);
+
+int nft_redir_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+                       const struct nft_data **data);
+
+#endif /* _NFT_REDIR_H_ */
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index f31fe7b660a5..832bc46db78b 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -579,6 +579,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_CPU: cpu id through smp_processor_id()
  * @NFT_META_IIFGROUP: packet input interface group
  * @NFT_META_OIFGROUP: packet output interface group
+ * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
  */
 enum nft_meta_keys {
         NFT_META_LEN,
@@ -604,6 +605,7 @@ enum nft_meta_keys {
         NFT_META_CPU,
         NFT_META_IIFGROUP,
         NFT_META_OIFGROUP,
+        NFT_META_CGROUP,
 };
 
 /**
@@ -838,6 +840,22 @@ enum nft_masq_attributes {
 #define NFTA_MASQ_MAX           (__NFTA_MASQ_MAX - 1)
 
 /**
+ * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
+ *
+ * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
+ * @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
+ * @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
+ */
+enum nft_redir_attributes {
+        NFTA_REDIR_UNSPEC,
+        NFTA_REDIR_REG_PROTO_MIN,
+        NFTA_REDIR_REG_PROTO_MAX,
+        NFTA_REDIR_FLAGS,
+        __NFTA_REDIR_MAX
+};
+#define NFTA_REDIR_MAX          (__NFTA_REDIR_MAX - 1)
+
+/**
  * enum nft_gen_attributes - nf_tables ruleset generation attributes
  *
  * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 1a4f32c09ad5..c190d22b6b3d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -35,6 +35,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/route.h>
+#include <net/netfilter/br_netfilter.h>
 
 #include <asm/uaccess.h>
 #include "br_private.h"
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 4c019d5c3f57..8358b2da1549 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -104,6 +104,12 @@ config NF_NAT_MASQUERADE_IPV4
           This is the kernel functionality to provide NAT in the masquerade
           flavour (automatic source address selection).
 
+config NF_NAT_REDIRECT_IPV4
+        tristate "IPv4 redirect support"
+        help
+          This is the kernel functionality to provide NAT in the redirect
+          flavour (redirect packets to local machine).
+
 config NFT_MASQ_IPV4
         tristate "IPv4 masquerading support for nf_tables"
         depends on NF_TABLES_IPV4
@@ -113,6 +119,15 @@ config NFT_MASQ_IPV4
           This is the expression that provides IPv4 masquerading support for
           nf_tables.
 
+config NFT_REDIR_IPV4
+        tristate "IPv4 redirect support for nf_tables"
+        depends on NF_TABLES_IPV4
+        depends on NFT_REDIR
+        select NF_NAT_REDIRECT_IPV4
+        help
+          This is the expression that provides IPv4 redirect support for
+          nf_tables.
+
 config NF_NAT_SNMP_BASIC
         tristate "Basic SNMP-ALG support"
         depends on NF_CONNTRACK_SNMP
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index f4cef5af0969..902bcd1597bb 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -31,6 +31,7 @@ obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
 obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
 obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
 obj-$(CONFIG_NF_NAT_MASQUERADE_IPV4) += nf_nat_masquerade_ipv4.o
+obj-$(CONFIG_NF_NAT_REDIRECT_IPV4) += nf_nat_redirect_ipv4.o
 
 # NAT protocols (nf_nat)
 obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
@@ -40,6 +41,7 @@ obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
 obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
 obj-$(CONFIG_NFT_MASQ_IPV4) += nft_masq_ipv4.o
+obj-$(CONFIG_NFT_REDIR_IPV4) += nft_redir_ipv4.o
 obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
 
 # generic IP tables 
diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c
index ccfc78db12ee..d059182c1466 100644
--- a/net/ipv4/netfilter/nf_log_arp.c
+++ b/net/ipv4/netfilter/nf_log_arp.c
@@ -10,6 +10,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/module.h>
 #include <linux/spinlock.h>
@@ -74,12 +75,12 @@ static void dump_arp_packet(struct nf_log_buf *m,
                        ap->mac_src, ap->ip_src, ap->mac_dst, ap->ip_dst);
 }
 
-void nf_log_arp_packet(struct net *net, u_int8_t pf,
-                      unsigned int hooknum, const struct sk_buff *skb,
-                      const struct net_device *in,
-                      const struct net_device *out,
-                      const struct nf_loginfo *loginfo,
-                      const char *prefix)
+static void nf_log_arp_packet(struct net *net, u_int8_t pf,
+                              unsigned int hooknum, const struct sk_buff *skb,
+                              const struct net_device *in,
+                              const struct net_device *out,
+                              const struct nf_loginfo *loginfo,
+                              const char *prefix)
 {
         struct nf_log_buf *m;
 
@@ -130,8 +131,17 @@ static int __init nf_log_arp_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_log_register(NFPROTO_ARP, &nf_arp_logger);
+        ret = nf_log_register(NFPROTO_ARP, &nf_arp_logger);
+        if (ret < 0) {
+                pr_err("failed to register logger\n");
+                goto err1;
+        }
+
         return 0;
+
+err1:
+        unregister_pernet_subsys(&nf_log_arp_net_ops);
+        return ret;
 }
 
 static void __exit nf_log_arp_exit(void)
diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c
index 078bdca1b607..75101980eeee 100644
--- a/net/ipv4/netfilter/nf_log_ipv4.c
+++ b/net/ipv4/netfilter/nf_log_ipv4.c
@@ -5,6 +5,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/module.h>
 #include <linux/spinlock.h>
@@ -366,8 +367,17 @@ static int __init nf_log_ipv4_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_log_register(NFPROTO_IPV4, &nf_ip_logger);
+        ret = nf_log_register(NFPROTO_IPV4, &nf_ip_logger);
+        if (ret < 0) {
+                pr_err("failed to register logger\n");
+                goto err1;
+        }
+
         return 0;
+
+err1:
+        unregister_pernet_subsys(&nf_log_ipv4_net_ops);
+        return ret;
 }
 
 static void __exit nf_log_ipv4_exit(void)
diff --git a/net/ipv4/netfilter/nf_nat_redirect_ipv4.c b/net/ipv4/netfilter/nf_nat_redirect_ipv4.c
new file mode 100644
index 000000000000..a220552fc532
--- /dev/null
+++ b/net/ipv4/netfilter/nf_nat_redirect_ipv4.c
@@ -0,0 +1,82 @@
+/*
+ * (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Rusty Russell's IPv4 REDIRECT target. Development of IPv6
+ * NAT funded by Astaro.
+ */
+
+#include <linux/if.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/netfilter.h>
+#include <linux/types.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/addrconf.h>
+#include <net/checksum.h>
+#include <net/protocol.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/ipv4/nf_nat_redirect.h>
+
+unsigned int
+nf_nat_redirect_ipv4(struct sk_buff *skb,
+                     const struct nf_nat_ipv4_multi_range_compat *mr,
+                     unsigned int hooknum)
+{
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        __be32 newdst;
+        struct nf_nat_range newrange;
+
+        NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||
+                     hooknum == NF_INET_LOCAL_OUT);
+
+        ct = nf_ct_get(skb, &ctinfo);
+        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
+
+        /* Local packets: make them go to loopback */
+        if (hooknum == NF_INET_LOCAL_OUT) {
+                newdst = htonl(0x7F000001);
+        } else {
+                struct in_device *indev;
+                struct in_ifaddr *ifa;
+
+                newdst = 0;
+
+                rcu_read_lock();
+                indev = __in_dev_get_rcu(skb->dev);
+                if (indev != NULL) {
+                        ifa = indev->ifa_list;
+                        newdst = ifa->ifa_local;
+                }
+                rcu_read_unlock();
+
+                if (!newdst)
+                        return NF_DROP;
+        }
+
+        /* Transfer from original range. */
+        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
+        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+        newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.ip = newdst;
+        newrange.max_addr.ip = newdst;
+        newrange.min_proto   = mr->range[0].min;
+        newrange.max_proto   = mr->range[0].max;
+
+        /* Hand modified range to generic setup. */
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+}
+EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv4);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 1baaa83dfe5c..536da7bc598a 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -11,6 +11,7 @@
 #include <net/tcp.h>
 #include <net/route.h>
 #include <net/dst.h>
+#include <net/netfilter/ipv4/nf_reject.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/ipv4/nf_reject.h>
 
diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
new file mode 100644
index 000000000000..643c5967aa27
--- /dev/null
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2014 Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/ipv4/nf_nat_redirect.h>
+#include <net/netfilter/nft_redir.h>
+
+static void nft_redir_ipv4_eval(const struct nft_expr *expr,
+                                struct nft_data data[NFT_REG_MAX + 1],
+                                const struct nft_pktinfo *pkt)
+{
+        struct nft_redir *priv = nft_expr_priv(expr);
+        struct nf_nat_ipv4_multi_range_compat mr;
+        unsigned int verdict;
+
+        memset(&mr, 0, sizeof(mr));
+        if (priv->sreg_proto_min) {
+                mr.range[0].min.all = (__force __be16)
+                                        data[priv->sreg_proto_min].data[0];
+                mr.range[0].max.all = (__force __be16)
+                                        data[priv->sreg_proto_max].data[0];
+                mr.range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+        }
+
+        mr.range[0].flags |= priv->flags;
+
+        verdict = nf_nat_redirect_ipv4(pkt->skb, &mr, pkt->ops->hooknum);
+        data[NFT_REG_VERDICT].verdict = verdict;
+}
+
+static struct nft_expr_type nft_redir_ipv4_type;
+static const struct nft_expr_ops nft_redir_ipv4_ops = {
+        .type           = &nft_redir_ipv4_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_redir)),
+        .eval           = nft_redir_ipv4_eval,
+        .init           = nft_redir_init,
+        .dump           = nft_redir_dump,
+        .validate       = nft_redir_validate,
+};
+
+static struct nft_expr_type nft_redir_ipv4_type __read_mostly = {
+        .family         = NFPROTO_IPV4,
+        .name           = "redir",
+        .ops            = &nft_redir_ipv4_ops,
+        .policy         = nft_redir_policy,
+        .maxattr        = NFTA_REDIR_MAX,
+        .owner          = THIS_MODULE,
+};
+
+static int __init nft_redir_ipv4_module_init(void)
+{
+        return nft_register_expr(&nft_redir_ipv4_type);
+}
+
+static void __exit nft_redir_ipv4_module_exit(void)
+{
+        nft_unregister_expr(&nft_redir_ipv4_type);
+}
+
+module_init(nft_redir_ipv4_module_init);
+module_exit(nft_redir_ipv4_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "redir");
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index ed33299c56d1..d729542bd1b7 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -19,9 +19,9 @@
 #include <net/netfilter/ipv4/nf_reject.h>
 #include <net/netfilter/nft_reject.h>
 
-void nft_reject_ipv4_eval(const struct nft_expr *expr,
-                          struct nft_data data[NFT_REG_MAX + 1],
-                          const struct nft_pktinfo *pkt)
+static void nft_reject_ipv4_eval(const struct nft_expr *expr,
+                                 struct nft_data data[NFT_REG_MAX + 1],
+                                 const struct nft_pktinfo *pkt)
 {
         struct nft_reject *priv = nft_expr_priv(expr);
 
@@ -36,7 +36,6 @@ void nft_reject_ipv4_eval(const struct nft_expr *expr,
 
         data[NFT_REG_VERDICT].verdict = NF_DROP;
 }
-EXPORT_SYMBOL_GPL(nft_reject_ipv4_eval);
 
 static struct nft_expr_type nft_reject_ipv4_type;
 static const struct nft_expr_ops nft_reject_ipv4_ops = {
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 6af874fc187f..0dbe5c7953e5 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -82,6 +82,12 @@ config NF_NAT_MASQUERADE_IPV6
           This is the kernel functionality to provide NAT in the masquerade
           flavour (automatic source address selection) for IPv6.
 
+config NF_NAT_REDIRECT_IPV6
+        tristate "IPv6 redirect support"
+        help
+          This is the kernel functionality to provide NAT in the redirect
+          flavour (redirect packet to local machine) for IPv6.
+
 config NFT_MASQ_IPV6
         tristate "IPv6 masquerade support for nf_tables"
         depends on NF_TABLES_IPV6
@@ -91,6 +97,15 @@ config NFT_MASQ_IPV6
           This is the expression that provides IPv4 masquerading support for
           nf_tables.
 
+config NFT_REDIR_IPV6
+        tristate "IPv6 redirect support for nf_tables"
+        depends on NF_TABLES_IPV6
+        depends on NFT_REDIR
+        select NF_NAT_REDIRECT_IPV6
+        help
+          This is the expression that provides IPv4 redirect support for
+          nf_tables.
+
 endif # NF_NAT_IPV6
 
 config IP6_NF_IPTABLES
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index fbb25f01143c..d2ac9f5f212c 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -19,6 +19,7 @@ obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o
 nf_nat_ipv6-y           := nf_nat_l3proto_ipv6.o nf_nat_proto_icmpv6.o
 obj-$(CONFIG_NF_NAT_IPV6) += nf_nat_ipv6.o
 obj-$(CONFIG_NF_NAT_MASQUERADE_IPV6) += nf_nat_masquerade_ipv6.o
+obj-$(CONFIG_NF_NAT_REDIRECT_IPV6) += nf_nat_redirect_ipv6.o
 
 # defrag
 nf_defrag_ipv6-y := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o
@@ -36,6 +37,7 @@ obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV6) += nft_chain_nat_ipv6.o
 obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o
 obj-$(CONFIG_NFT_MASQ_IPV6) += nft_masq_ipv6.o
+obj-$(CONFIG_NFT_REDIR_IPV6) += nft_redir_ipv6.o
 
 # matches
 obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c
index 7b17a0be93e7..7fc34d1681a1 100644
--- a/net/ipv6/netfilter/nf_log_ipv6.c
+++ b/net/ipv6/netfilter/nf_log_ipv6.c
@@ -5,6 +5,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/module.h>
 #include <linux/spinlock.h>
@@ -398,8 +399,17 @@ static int __init nf_log_ipv6_init(void)
         if (ret < 0)
                 return ret;
 
-        nf_log_register(NFPROTO_IPV6, &nf_ip6_logger);
+        ret = nf_log_register(NFPROTO_IPV6, &nf_ip6_logger);
+        if (ret < 0) {
+                pr_err("failed to register logger\n");
+                goto err1;
+        }
+
         return 0;
+
+err1:
+        unregister_pernet_subsys(&nf_log_ipv6_net_ops);
+        return ret;
 }
 
 static void __exit nf_log_ipv6_exit(void)
diff --git a/net/ipv6/netfilter/nf_nat_redirect_ipv6.c b/net/ipv6/netfilter/nf_nat_redirect_ipv6.c
new file mode 100644
index 000000000000..ea1308aeb048
--- /dev/null
+++ b/net/ipv6/netfilter/nf_nat_redirect_ipv6.c
@@ -0,0 +1,75 @@
+/*
+ * (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Rusty Russell's IPv4 REDIRECT target. Development of IPv6
+ * NAT funded by Astaro.
+ */
+
+#include <linux/if.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/netfilter.h>
+#include <linux/types.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/addrconf.h>
+#include <net/checksum.h>
+#include <net/protocol.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/ipv6/nf_nat_redirect.h>
+
+static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
+
+unsigned int
+nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+                     unsigned int hooknum)
+{
+        struct nf_nat_range newrange;
+        struct in6_addr newdst;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (hooknum == NF_INET_LOCAL_OUT) {
+                newdst = loopback_addr;
+        } else {
+                struct inet6_dev *idev;
+                struct inet6_ifaddr *ifa;
+                bool addr = false;
+
+                rcu_read_lock();
+                idev = __in6_dev_get(skb->dev);
+                if (idev != NULL) {
+                        list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                                newdst = ifa->addr;
+                                addr = true;
+                                break;
+                        }
+                }
+                rcu_read_unlock();
+
+                if (!addr)
+                        return NF_DROP;
+        }
+
+        newrange.flags          = range->flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.in6   = newdst;
+        newrange.max_addr.in6   = newdst;
+        newrange.min_proto      = range->min_proto;
+        newrange.max_proto      = range->max_proto;
+
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+}
+EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv6);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 015eb8a80766..d05b36440e8b 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -11,6 +11,7 @@
 #include <net/ip6_route.h>
 #include <net/ip6_fib.h>
 #include <net/ip6_checksum.h>
+#include <net/netfilter/ipv6/nf_reject.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/ipv6/nf_reject.h>
 
diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
new file mode 100644
index 000000000000..83420eeaad1c
--- /dev/null
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2014 Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/nft_redir.h>
+#include <net/netfilter/ipv6/nf_nat_redirect.h>
+
+static void nft_redir_ipv6_eval(const struct nft_expr *expr,
+                                struct nft_data data[NFT_REG_MAX + 1],
+                                const struct nft_pktinfo *pkt)
+{
+        struct nft_redir *priv = nft_expr_priv(expr);
+        struct nf_nat_range range;
+        unsigned int verdict;
+
+        memset(&range, 0, sizeof(range));
+        if (priv->sreg_proto_min) {
+                range.min_proto.all = (__force __be16)
+                                        data[priv->sreg_proto_min].data[0];
+                range.max_proto.all = (__force __be16)
+                                        data[priv->sreg_proto_max].data[0];
+                range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+        }
+
+        range.flags |= priv->flags;
+
+        verdict = nf_nat_redirect_ipv6(pkt->skb, &range, pkt->ops->hooknum);
+        data[NFT_REG_VERDICT].verdict = verdict;
+}
+
+static struct nft_expr_type nft_redir_ipv6_type;
+static const struct nft_expr_ops nft_redir_ipv6_ops = {
+        .type           = &nft_redir_ipv6_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_redir)),
+        .eval           = nft_redir_ipv6_eval,
+        .init           = nft_redir_init,
+        .dump           = nft_redir_dump,
+        .validate       = nft_redir_validate,
+};
+
+static struct nft_expr_type nft_redir_ipv6_type __read_mostly = {
+        .family         = NFPROTO_IPV6,
+        .name           = "redir",
+        .ops            = &nft_redir_ipv6_ops,
+        .policy         = nft_redir_policy,
+        .maxattr        = NFTA_REDIR_MAX,
+        .owner          = THIS_MODULE,
+};
+
+static int __init nft_redir_ipv6_module_init(void)
+{
+        return nft_register_expr(&nft_redir_ipv6_type);
+}
+
+static void __exit nft_redir_ipv6_module_exit(void)
+{
+        nft_unregister_expr(&nft_redir_ipv6_type);
+}
+
+module_init(nft_redir_ipv6_module_init);
+module_exit(nft_redir_ipv6_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET6, "redir");
diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
index 0bc19fa87821..f73285924144 100644
--- a/net/ipv6/netfilter/nft_reject_ipv6.c
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -19,9 +19,9 @@
 #include <net/netfilter/nft_reject.h>
 #include <net/netfilter/ipv6/nf_reject.h>
 
-void nft_reject_ipv6_eval(const struct nft_expr *expr,
-                          struct nft_data data[NFT_REG_MAX + 1],
-                          const struct nft_pktinfo *pkt)
+static void nft_reject_ipv6_eval(const struct nft_expr *expr,
+                                 struct nft_data data[NFT_REG_MAX + 1],
+                                 const struct nft_pktinfo *pkt)
 {
         struct nft_reject *priv = nft_expr_priv(expr);
         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
@@ -38,7 +38,6 @@ void nft_reject_ipv6_eval(const struct nft_expr *expr,
 
         data[NFT_REG_VERDICT].verdict = NF_DROP;
 }
-EXPORT_SYMBOL_GPL(nft_reject_ipv6_eval);
 
 static struct nft_expr_type nft_reject_ipv6_type;
 static const struct nft_expr_ops nft_reject_ipv6_ops = {
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index ae5096ab65eb..57f15a9aa481 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -505,6 +505,15 @@ config NFT_MASQ
           This option adds the "masquerade" expression that you can use
           to perform NAT in the masquerade flavour.
 
+config NFT_REDIR
+        depends on NF_TABLES
+        depends on NF_CONNTRACK
+        depends on NF_NAT
+        tristate "Netfilter nf_tables redirect support"
+        help
+          This options adds the "redirect" expression that you can use
+          to perform NAT in the redirect flavour.
+
 config NFT_NAT
         depends on NF_TABLES
         depends on NF_CONNTRACK
@@ -835,6 +844,8 @@ config NETFILTER_XT_TARGET_RATEEST
 config NETFILTER_XT_TARGET_REDIRECT
         tristate "REDIRECT target support"
         depends on NF_NAT
+        select NF_NAT_REDIRECT_IPV4 if NF_NAT_IPV4
+        select NF_NAT_REDIRECT_IPV6 if NF_NAT_IPV6
         ---help---
         REDIRECT is a special case of NAT: all incoming connections are
         mapped onto the incoming interface's address, causing the packets to
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index a9571be3f791..f3eb4680f2ec 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -88,6 +88,7 @@ obj-$(CONFIG_NFT_HASH)		+= nft_hash.o
 obj-$(CONFIG_NFT_COUNTER)       += nft_counter.o
 obj-$(CONFIG_NFT_LOG)           += nft_log.o
 obj-$(CONFIG_NFT_MASQ)          += nft_masq.o
+obj-$(CONFIG_NFT_REDIR)         += nft_redir.o
 
 # generic X tables 
 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 024a2e25c8a4..fea9ef566427 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -17,6 +17,7 @@
 #include <linux/interrupt.h>
 #include <linux/if.h>
 #include <linux/netdevice.h>
+#include <linux/netfilter_ipv6.h>
 #include <linux/inetdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index ac7ba689efe7..b8295a430a56 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -465,8 +465,7 @@ __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 
 static void ip_vs_service_free(struct ip_vs_service *svc)
 {
-        if (svc->stats.cpustats)
-                free_percpu(svc->stats.cpustats);
+        free_percpu(svc->stats.cpustats);
         kfree(svc);
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_pe.c b/net/netfilter/ipvs/ip_vs_pe.c
index 1a82b29ce8ea..0df17caa8af6 100644
--- a/net/netfilter/ipvs/ip_vs_pe.c
+++ b/net/netfilter/ipvs/ip_vs_pe.c
@@ -37,8 +37,7 @@ struct ip_vs_pe *__ip_vs_pe_getbyname(const char *pe_name)
                         rcu_read_unlock();
                         return pe;
                 }
-                if (pe->module)
-                        module_put(pe->module);
+                module_put(pe->module);
         }
         rcu_read_unlock();
 
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 4dbcda6258bc..199760c71f39 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -104,8 +104,7 @@ static struct ip_vs_scheduler *ip_vs_sched_getbyname(const char *sched_name)
                         mutex_unlock(&ip_vs_sched_mutex);
                         return sched;
                 }
-                if (sched->module)
-                        module_put(sched->module);
+                module_put(sched->module);
         }
 
         mutex_unlock(&ip_vs_sched_mutex);
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 7162c86fd50d..c47ffd7a0a70 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -820,8 +820,7 @@ ip_vs_conn_fill_param_sync(struct net *net, int af, union ip_vs_sync_conn *sc,
 
                 p->pe_data = kmemdup(pe_data, pe_data_len, GFP_ATOMIC);
                 if (!p->pe_data) {
-                        if (p->pe->module)
-                                module_put(p->pe->module);
+                        module_put(p->pe->module);
                         return -ENOMEM;
                 }
                 p->pe_data_len = pe_data_len;
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index bd90bf8107da..1f933136155a 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -293,7 +293,6 @@ __ip_vs_get_out_rt(int skb_af, struct sk_buff *skb, struct ip_vs_dest *dest,
                                   &dest->addr.ip, &dest_dst->dst_saddr.ip,
                                   atomic_read(&rt->dst.__refcnt));
                 }
-                daddr = dest->addr.ip;
                 if (ret_saddr)
                         *ret_saddr = dest_dst->dst_saddr.ip;
         } else {
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 3a3a60b126e0..1d69f5b9748f 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -728,7 +728,8 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
 
 /* If the calling party is on the same side of the forward-to party,
  * we don't need to track the second call */
-static int callforward_do_filter(const union nf_inet_addr *src,
+static int callforward_do_filter(struct net *net,
+                                 const union nf_inet_addr *src,
                                  const union nf_inet_addr *dst,
                                  u_int8_t family)
 {
@@ -750,9 +751,9 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 
                 memset(&fl2, 0, sizeof(fl2));
                 fl2.daddr = dst->ip;
-                if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
+                if (!afinfo->route(net, (struct dst_entry **)&rt1,
                                    flowi4_to_flowi(&fl1), false)) {
-                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
+                        if (!afinfo->route(net, (struct dst_entry **)&rt2,
                                            flowi4_to_flowi(&fl2), false)) {
                                 if (rt_nexthop(rt1, fl1.daddr) ==
                                     rt_nexthop(rt2, fl2.daddr) &&
@@ -774,9 +775,9 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 
                 memset(&fl2, 0, sizeof(fl2));
                 fl2.daddr = dst->in6;
-                if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
+                if (!afinfo->route(net, (struct dst_entry **)&rt1,
                                    flowi6_to_flowi(&fl1), false)) {
-                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
+                        if (!afinfo->route(net, (struct dst_entry **)&rt2,
                                            flowi6_to_flowi(&fl2), false)) {
                                 if (ipv6_addr_equal(rt6_nexthop(rt1),
                                                     rt6_nexthop(rt2)) &&
@@ -807,6 +808,7 @@ static int expect_callforwarding(struct sk_buff *skb,
         __be16 port;
         union nf_inet_addr addr;
         struct nf_conntrack_expect *exp;
+        struct net *net = nf_ct_net(ct);
         typeof(nat_callforwarding_hook) nat_callforwarding;
 
         /* Read alternativeAddress */
@@ -816,7 +818,7 @@ static int expect_callforwarding(struct sk_buff *skb,
         /* If the calling party is on the same side of the forward-to party,
          * we don't need to track the second call */
         if (callforward_filter &&
-            callforward_do_filter(&addr, &ct->tuplehash[!dir].tuple.src.u3,
+            callforward_do_filter(net, &addr, &ct->tuplehash[!dir].tuple.src.u3,
                                   nf_ct_l3num(ct))) {
                 pr_debug("nf_ct_q931: Call Forwarding not tracked\n");
                 return 0;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 5b3eae7d4c9a..bd9d31537905 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -250,7 +250,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper);
 
-/* appropiate ct lock protecting must be taken by caller */
+/* appropriate ct lock protecting must be taken by caller */
 static inline int unhelp(struct nf_conntrack_tuple_hash *i,
                          const struct nf_conntrack_helper *me)
 {
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index d7197649dba6..49a64174f3f1 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -19,6 +19,9 @@
 static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;
 static DEFINE_MUTEX(nf_log_mutex);
 
+#define nft_log_dereference(logger) \
+        rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex))
+
 static struct nf_logger *__find_logger(int pf, const char *str_logger)
 {
         struct nf_logger *log;
@@ -28,8 +31,7 @@ static struct nf_logger *__find_logger(int pf, const char *str_logger)
                 if (loggers[pf][i] == NULL)
                         continue;
 
-                log = rcu_dereference_protected(loggers[pf][i],
-                                                lockdep_is_held(&nf_log_mutex));
+                log = nft_log_dereference(loggers[pf][i]);
                 if (!strncasecmp(str_logger, log->name, strlen(log->name)))
                         return log;
         }
@@ -45,8 +47,7 @@ void nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger)
                 return;
 
         mutex_lock(&nf_log_mutex);
-        log = rcu_dereference_protected(net->nf.nf_loggers[pf],
-                                        lockdep_is_held(&nf_log_mutex));
+        log = nft_log_dereference(net->nf.nf_loggers[pf]);
         if (log == NULL)
                 rcu_assign_pointer(net->nf.nf_loggers[pf], logger);
 
@@ -61,8 +62,7 @@ void nf_log_unset(struct net *net, const struct nf_logger *logger)
 
         mutex_lock(&nf_log_mutex);
         for (i = 0; i < NFPROTO_NUMPROTO; i++) {
-                log = rcu_dereference_protected(net->nf.nf_loggers[i],
-                                lockdep_is_held(&nf_log_mutex));
+                log = nft_log_dereference(net->nf.nf_loggers[i]);
                 if (log == logger)
                         RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL);
         }
@@ -75,6 +75,7 @@ EXPORT_SYMBOL(nf_log_unset);
 int nf_log_register(u_int8_t pf, struct nf_logger *logger)
 {
         int i;
+        int ret = 0;
 
         if (pf >= ARRAY_SIZE(init_net.nf.nf_loggers))
                 return -EINVAL;
@@ -82,16 +83,25 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
         mutex_lock(&nf_log_mutex);
 
         if (pf == NFPROTO_UNSPEC) {
+                for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
+                        if (rcu_access_pointer(loggers[i][logger->type])) {
+                                ret = -EEXIST;
+                                goto unlock;
+                        }
+                }
                 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
                         rcu_assign_pointer(loggers[i][logger->type], logger);
         } else {
-                /* register at end of list to honor first register win */
+                if (rcu_access_pointer(loggers[pf][logger->type])) {
+                        ret = -EEXIST;
+                        goto unlock;
+                }
                 rcu_assign_pointer(loggers[pf][logger->type], logger);
         }
 
+unlock:
         mutex_unlock(&nf_log_mutex);
-
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(nf_log_register);
 
@@ -144,8 +154,7 @@ int nf_logger_find_get(int pf, enum nf_log_type type)
         struct nf_logger *logger;
         int ret = -ENOENT;
 
-        logger = loggers[pf][type];
-        if (logger == NULL)
+        if (rcu_access_pointer(loggers[pf][type]) == NULL)
                 request_module("nf-logger-%u-%u", pf, type);
 
         rcu_read_lock();
@@ -297,8 +306,7 @@ static int seq_show(struct seq_file *s, void *v)
         int i, ret;
         struct net *net = seq_file_net(s);
 
-        logger = rcu_dereference_protected(net->nf.nf_loggers[*pos],
-                                           lockdep_is_held(&nf_log_mutex));
+        logger = nft_log_dereference(net->nf.nf_loggers[*pos]);
 
         if (!logger)
                 ret = seq_printf(s, "%2lld NONE (", *pos);
@@ -312,8 +320,7 @@ static int seq_show(struct seq_file *s, void *v)
                 if (loggers[*pos][i] == NULL)
                         continue;
 
-                logger = rcu_dereference_protected(loggers[*pos][i],
-                                           lockdep_is_held(&nf_log_mutex));
+                logger = nft_log_dereference(loggers[*pos][i]);
                 ret = seq_printf(s, "%s", logger->name);
                 if (ret < 0)
                         return ret;
@@ -385,8 +392,7 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
                 mutex_unlock(&nf_log_mutex);
         } else {
                 mutex_lock(&nf_log_mutex);
-                logger = rcu_dereference_protected(net->nf.nf_loggers[tindex],
-                                                   lockdep_is_held(&nf_log_mutex));
+                logger = nft_log_dereference(net->nf.nf_loggers[tindex]);
                 if (!logger)
                         table->data = "NONE";
                 else
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 66e8425dbfe7..129a8daa4abf 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2477,7 +2477,7 @@ static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         int err;
 
-        /* Verify existance before starting dump */
+        /* Verify existence before starting dump */
         err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
         if (err < 0)
                 return err;
@@ -3665,8 +3665,7 @@ static int nf_tables_abort(struct sk_buff *skb)
                         break;
                 case NFT_MSG_NEWCHAIN:
                         if (nft_trans_chain_update(trans)) {
-                                if (nft_trans_chain_stats(trans))
-                                        free_percpu(nft_trans_chain_stats(trans));
+                                free_percpu(nft_trans_chain_stats(trans));
 
                                 nft_trans_destroy(trans);
                         } else {
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 5f1be5ba3559..11d85b3813f2 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -12,6 +12,9 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
@@ -337,9 +340,6 @@ nfulnl_alloc_skb(struct net *net, u32 peer_portid, unsigned int inst_size,
 
                         skb = nfnetlink_alloc_skb(net, pkt_size,
                                                   peer_portid, GFP_ATOMIC);
-                        if (!skb)
-                                pr_err("nfnetlink_log: can't even alloc %u bytes\n",
-                                       pkt_size);
                 }
         }
 
@@ -570,10 +570,8 @@ __build_packet_message(struct nfnl_log_net *log,
                 struct nlattr *nla;
                 int size = nla_attr_size(data_len);
 
-                if (skb_tailroom(inst->skb) < nla_total_size(data_len)) {
-                        printk(KERN_WARNING "nfnetlink_log: no tailroom!\n");
-                        return -1;
-                }
+                if (skb_tailroom(inst->skb) < nla_total_size(data_len))
+                        goto nla_put_failure;
 
                 nla = (struct nlattr *)skb_put(inst->skb, nla_total_size(data_len));
                 nla->nla_type = NFULA_PAYLOAD;
@@ -1069,19 +1067,19 @@ static int __init nfnetlink_log_init(void)
         netlink_register_notifier(&nfulnl_rtnl_notifier);
         status = nfnetlink_subsys_register(&nfulnl_subsys);
         if (status < 0) {
-                pr_err("log: failed to create netlink socket\n");
+                pr_err("failed to create netlink socket\n");
                 goto cleanup_netlink_notifier;
         }
 
         status = nf_log_register(NFPROTO_UNSPEC, &nfulnl_logger);
         if (status < 0) {
-                pr_err("log: failed to register logger\n");
+                pr_err("failed to register logger\n");
                 goto cleanup_subsys;
         }
 
         status = register_pernet_subsys(&nfnl_log_net_ops);
         if (status < 0) {
-                pr_err("log: failed to register pernet ops\n");
+                pr_err("failed to register pernet ops\n");
                 goto cleanup_logger;
         }
         return status;
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 1e7c076ca63a..e99911eda915 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -165,6 +165,12 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                         goto err;
                 dest->data[0] = out->group;
                 break;
+        case NFT_META_CGROUP:
+                if (skb->sk == NULL)
+                        break;
+
+                dest->data[0] = skb->sk->sk_classid;
+                break;
         default:
                 WARN_ON(1);
                 goto err;
@@ -240,6 +246,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
         case NFT_META_CPU:
         case NFT_META_IIFGROUP:
         case NFT_META_OIFGROUP:
+        case NFT_META_CGROUP:
                 break;
         default:
                 return -EOPNOTSUPP;
diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
new file mode 100644
index 000000000000..9e8093f28311
--- /dev/null
+++ b/net/netfilter/nft_redir.c
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2014 Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_redir.h>
+
+const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = {
+        [NFTA_REDIR_REG_PROTO_MIN]      = { .type = NLA_U32 },
+        [NFTA_REDIR_REG_PROTO_MAX]      = { .type = NLA_U32 },
+        [NFTA_REDIR_FLAGS]              = { .type = NLA_U32 },
+};
+EXPORT_SYMBOL_GPL(nft_redir_policy);
+
+int nft_redir_init(const struct nft_ctx *ctx,
+                   const struct nft_expr *expr,
+                   const struct nlattr * const tb[])
+{
+        struct nft_redir *priv = nft_expr_priv(expr);
+        int err;
+
+        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        if (err < 0)
+                return err;
+
+        if (tb[NFTA_REDIR_REG_PROTO_MIN]) {
+                priv->sreg_proto_min =
+                        ntohl(nla_get_be32(tb[NFTA_REDIR_REG_PROTO_MIN]));
+
+                err = nft_validate_input_register(priv->sreg_proto_min);
+                if (err < 0)
+                        return err;
+
+                if (tb[NFTA_REDIR_REG_PROTO_MAX]) {
+                        priv->sreg_proto_max =
+                                ntohl(nla_get_be32(tb[NFTA_REDIR_REG_PROTO_MAX]));
+
+                        err = nft_validate_input_register(priv->sreg_proto_max);
+                        if (err < 0)
+                                return err;
+                } else {
+                        priv->sreg_proto_max = priv->sreg_proto_min;
+                }
+        }
+
+        if (tb[NFTA_REDIR_FLAGS]) {
+                priv->flags = ntohl(nla_get_be32(tb[NFTA_REDIR_FLAGS]));
+                if (priv->flags & ~NF_NAT_RANGE_MASK)
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nft_redir_init);
+
+int nft_redir_dump(struct sk_buff *skb, const struct nft_expr *expr)
+{
+        const struct nft_redir *priv = nft_expr_priv(expr);
+
+        if (priv->sreg_proto_min) {
+                if (nla_put_be32(skb, NFTA_REDIR_REG_PROTO_MIN,
+                                 htonl(priv->sreg_proto_min)))
+                        goto nla_put_failure;
+                if (nla_put_be32(skb, NFTA_REDIR_REG_PROTO_MAX,
+                                 htonl(priv->sreg_proto_max)))
+                        goto nla_put_failure;
+        }
+
+        if (priv->flags != 0 &&
+            nla_put_be32(skb, NFTA_REDIR_FLAGS, htonl(priv->flags)))
+                        goto nla_put_failure;
+
+        return 0;
+
+nla_put_failure:
+        return -1;
+}
+EXPORT_SYMBOL_GPL(nft_redir_dump);
+
+int nft_redir_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+                       const struct nft_data **data)
+{
+        return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+}
+EXPORT_SYMBOL_GPL(nft_redir_validate);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index ae8271652efa..3f83d38c4e5b 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -37,7 +37,8 @@ dscp_tg(struct sk_buff *skb, const struct xt_action_param *par)
                 if (!skb_make_writable(skb, sizeof(struct iphdr)))
                         return NF_DROP;
 
-                ipv4_change_dsfield(ip_hdr(skb), (__u8)(~XT_DSCP_MASK),
+                ipv4_change_dsfield(ip_hdr(skb),
+                                    (__force __u8)(~XT_DSCP_MASK),
                                     dinfo->dscp << XT_DSCP_SHIFT);
 
         }
@@ -54,7 +55,8 @@ dscp_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                 if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))
                         return NF_DROP;
 
-                ipv6_change_dsfield(ipv6_hdr(skb), (__u8)(~XT_DSCP_MASK),
+                ipv6_change_dsfield(ipv6_hdr(skb),
+                                    (__force __u8)(~XT_DSCP_MASK),
                                     dinfo->dscp << XT_DSCP_SHIFT);
         }
         return XT_CONTINUE;
diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c
index 22a10309297c..b6ec67efd900 100644
--- a/net/netfilter/xt_REDIRECT.c
+++ b/net/netfilter/xt_REDIRECT.c
@@ -26,48 +26,13 @@
 #include <net/checksum.h>
 #include <net/protocol.h>
 #include <net/netfilter/nf_nat.h>
-
-static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
+#include <net/netfilter/ipv4/nf_nat_redirect.h>
+#include <net/netfilter/ipv6/nf_nat_redirect.h>
 
 static unsigned int
 redirect_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
-        struct nf_nat_range newrange;
-        struct in6_addr newdst;
-        enum ip_conntrack_info ctinfo;
-        struct nf_conn *ct;
-
-        ct = nf_ct_get(skb, &ctinfo);
-        if (par->hooknum == NF_INET_LOCAL_OUT)
-                newdst = loopback_addr;
-        else {
-                struct inet6_dev *idev;
-                struct inet6_ifaddr *ifa;
-                bool addr = false;
-
-                rcu_read_lock();
-                idev = __in6_dev_get(skb->dev);
-                if (idev != NULL) {
-                        list_for_each_entry(ifa, &idev->addr_list, if_list) {
-                                newdst = ifa->addr;
-                                addr = true;
-                                break;
-                        }
-                }
-                rcu_read_unlock();
-
-                if (!addr)
-                        return NF_DROP;
-        }
-
-        newrange.flags          = range->flags | NF_NAT_RANGE_MAP_IPS;
-        newrange.min_addr.in6   = newdst;
-        newrange.max_addr.in6   = newdst;
-        newrange.min_proto      = range->min_proto;
-        newrange.max_proto      = range->max_proto;
-
-        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+        return nf_nat_redirect_ipv6(skb, par->targinfo, par->hooknum);
 }
 
 static int redirect_tg6_checkentry(const struct xt_tgchk_param *par)
@@ -98,48 +63,7 @@ static int redirect_tg4_check(const struct xt_tgchk_param *par)
 static unsigned int
 redirect_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        __be32 newdst;
-        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_range newrange;
-
-        NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
-                     par->hooknum == NF_INET_LOCAL_OUT);
-
-        ct = nf_ct_get(skb, &ctinfo);
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
-
-        /* Local packets: make them go to loopback */
-        if (par->hooknum == NF_INET_LOCAL_OUT)
-                newdst = htonl(0x7F000001);
-        else {
-                struct in_device *indev;
-                struct in_ifaddr *ifa;
-
-                newdst = 0;
-
-                rcu_read_lock();
-                indev = __in_dev_get_rcu(skb->dev);
-                if (indev && (ifa = indev->ifa_list))
-                        newdst = ifa->ifa_local;
-                rcu_read_unlock();
-
-                if (!newdst)
-                        return NF_DROP;
-        }
-
-        /* Transfer from original range. */
-        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
-        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
-        newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
-        newrange.min_addr.ip = newdst;
-        newrange.max_addr.ip = newdst;
-        newrange.min_proto   = mr->range[0].min;
-        newrange.max_proto   = mr->range[0].max;
-
-        /* Hand modified range to generic setup. */
-        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+        return nf_nat_redirect_ipv4(skb, par->targinfo, par->hooknum);
 }
 
 static struct xt_target redirect_tg_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index fbc66bb250d5..29ba6218a820 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -134,6 +134,7 @@ static bool add_hlist(struct hlist_head *head,
 static unsigned int check_hlist(struct net *net,
                                 struct hlist_head *head,
                                 const struct nf_conntrack_tuple *tuple,
+                                u16 zone,
                                 bool *addit)
 {
         const struct nf_conntrack_tuple_hash *found;
@@ -147,8 +148,7 @@ static unsigned int check_hlist(struct net *net,
 
         /* check the saved connections */
         hlist_for_each_entry_safe(conn, n, head, node) {
-                found    = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
-                                                 &conn->tuple);
+                found = nf_conntrack_find_get(net, zone, &conn->tuple);
                 if (found == NULL) {
                         hlist_del(&conn->node);
                         kmem_cache_free(connlimit_conn_cachep, conn);
@@ -201,7 +201,7 @@ static unsigned int
 count_tree(struct net *net, struct rb_root *root,
            const struct nf_conntrack_tuple *tuple,
            const union nf_inet_addr *addr, const union nf_inet_addr *mask,
-           u8 family)
+           u8 family, u16 zone)
 {
         struct xt_connlimit_rb *gc_nodes[CONNLIMIT_GC_MAX_NODES];
         struct rb_node **rbnode, *parent;
@@ -229,7 +229,7 @@ count_tree(struct net *net, struct rb_root *root,
                 } else {
                         /* same source network -> be counted! */
                         unsigned int count;
-                        count = check_hlist(net, &rbconn->hhead, tuple, &addit);
+                        count = check_hlist(net, &rbconn->hhead, tuple, zone, &addit);
 
                         tree_nodes_free(root, gc_nodes, gc_count);
                         if (!addit)
@@ -245,7 +245,7 @@ count_tree(struct net *net, struct rb_root *root,
                         continue;
 
                 /* only used for GC on hhead, retval and 'addit' ignored */
-                check_hlist(net, &rbconn->hhead, tuple, &addit);
+                check_hlist(net, &rbconn->hhead, tuple, zone, &addit);
                 if (hlist_empty(&rbconn->hhead))
                         gc_nodes[gc_count++] = rbconn;
         }
@@ -290,7 +290,7 @@ static int count_them(struct net *net,
                       const struct nf_conntrack_tuple *tuple,
                       const union nf_inet_addr *addr,
                       const union nf_inet_addr *mask,
-                      u_int8_t family)
+                      u_int8_t family, u16 zone)
 {
         struct rb_root *root;
         int count;
@@ -306,7 +306,7 @@ static int count_them(struct net *net,
 
         spin_lock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
 
-        count = count_tree(net, root, tuple, addr, mask, family);
+        count = count_tree(net, root, tuple, addr, mask, family, zone);
 
         spin_unlock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
 
@@ -324,13 +324,16 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
         enum ip_conntrack_info ctinfo;
         const struct nf_conn *ct;
         unsigned int connections;
+        u16 zone = NF_CT_DEFAULT_ZONE;
 
         ct = nf_ct_get(skb, &ctinfo);
-        if (ct != NULL)
+        if (ct != NULL) {
                 tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
-        else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
-                                    par->family, &tuple))
+                zone = nf_ct_zone(ct);
+        } else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
+                                    par->family, &tuple)) {
                 goto hotdrop;
+        }
 
         if (par->family == NFPROTO_IPV6) {
                 const struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -343,7 +346,7 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
         }
 
         connections = count_them(net, info->data, tuple_ptr, &addr,
-                                 &info->mask, par->family);
+                                 &info->mask, par->family, zone);
         if (connections == 0)
                 /* kmalloc failed, drop it entirely */
                 goto hotdrop;