10 files changed, 438 insertions, 41 deletions

diff --git a/include/net/dst.h b/include/net/dst.h
index 9a7881066fb3..3da47e0a4a1f 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -61,6 +61,7 @@ struct dst_entry {
 #define DST_NOPEER              0x0040
 #define DST_FAKE_RTABLE         0x0080
 #define DST_XFRM_TUNNEL         0x0100
+#define DST_XFRM_QUEUE          0x0200
 
         unsigned short          pending_confirm;
 
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 9b78862014a4..2ba9de89e8ec 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -22,6 +22,7 @@ struct netns_ipv4 {
         struct ctl_table_header *frags_hdr;
         struct ctl_table_header *ipv4_hdr;
         struct ctl_table_header *route_hdr;
+        struct ctl_table_header *xfrm4_hdr;
 #endif
         struct ipv4_devconf     *devconf_all;
         struct ipv4_devconf     *devconf_dflt;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index 214cb0a53359..1242f371718b 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -16,6 +16,7 @@ struct netns_sysctl_ipv6 {
         struct ctl_table_header *route_hdr;
         struct ctl_table_header *icmp_hdr;
         struct ctl_table_header *frags_hdr;
+        struct ctl_table_header *xfrm6_hdr;
 #endif
         int bindv6only;
         int flush_delay;
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index de34883e8b16..24c8886fd969 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -501,6 +501,12 @@ struct xfrm_policy_walk {
         u32 seq;
 };
 
+struct xfrm_policy_queue {
+        struct sk_buff_head     hold_queue;
+        struct timer_list       hold_timer;
+        unsigned long           timeout;
+};
+
 struct xfrm_policy {
 #ifdef CONFIG_NET_NS
         struct net              *xp_net;
@@ -522,6 +528,7 @@ struct xfrm_policy {
         struct xfrm_lifetime_cfg lft;
         struct xfrm_lifetime_cur curlft;
         struct xfrm_policy_walk_entry walk;
+        struct xfrm_policy_queue polq;
         u8                      type;
         u8                      action;
         u8                      flags;
@@ -1320,6 +1327,7 @@ struct xfrm_algo_desc {
         char *name;
         char *compat;
         u8 available:1;
+        u8 pfkey_supported:1;
         union {
                 struct xfrm_algo_aead_info aead;
                 struct xfrm_algo_auth_info auth;
@@ -1561,8 +1569,8 @@ extern void xfrm_input_init(void);
 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
 
 extern void xfrm_probe_algs(void);
-extern int xfrm_count_auth_supported(void);
-extern int xfrm_count_enc_supported(void);
+extern int xfrm_count_pfkey_auth_supported(void);
+extern int xfrm_count_pfkey_enc_supported(void);
 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 3be0ac2c1920..9a459be24af7 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -262,21 +262,56 @@ static struct ctl_table xfrm4_policy_table[] = {
         { }
 };
 
-static struct ctl_table_header *sysctl_hdr;
-#endif
-
-static void __init xfrm4_policy_init(void)
+static int __net_init xfrm4_net_init(struct net *net)
 {
-        xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
+        struct ctl_table *table;
+        struct ctl_table_header *hdr;
+
+        table = xfrm4_policy_table;
+        if (!net_eq(net, &init_net)) {
+                table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL);
+                if (!table)
+                        goto err_alloc;
+
+                table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh;
+        }
+
+        hdr = register_net_sysctl(net, "net/ipv4", table);
+        if (!hdr)
+                goto err_reg;
+
+        net->ipv4.xfrm4_hdr = hdr;
+        return 0;
+
+err_reg:
+        if (!net_eq(net, &init_net))
+                kfree(table);
+err_alloc:
+        return -ENOMEM;
 }
 
-static void __exit xfrm4_policy_fini(void)
+static void __net_exit xfrm4_net_exit(struct net *net)
 {
-#ifdef CONFIG_SYSCTL
-        if (sysctl_hdr)
-                unregister_net_sysctl_table(sysctl_hdr);
+        struct ctl_table *table;
+
+        if (net->ipv4.xfrm4_hdr == NULL)
+                return;
+
+        table = net->ipv4.xfrm4_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->ipv4.xfrm4_hdr);
+        if (!net_eq(net, &init_net))
+                kfree(table);
+}
+
+static struct pernet_operations __net_initdata xfrm4_net_ops = {
+        .init   = xfrm4_net_init,
+        .exit   = xfrm4_net_exit,
+};
 #endif
-        xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
+
+static void __init xfrm4_policy_init(void)
+{
+        xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
 }
 
 void __init xfrm4_init(void)
@@ -286,8 +321,7 @@ void __init xfrm4_init(void)
         xfrm4_state_init();
         xfrm4_policy_init();
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4",
-                                         xfrm4_policy_table);
+        register_pernet_subsys(&xfrm4_net_ops);
 #endif
 }
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 128273744332..4ef7bdb65440 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -320,7 +320,51 @@ static struct ctl_table xfrm6_policy_table[] = {
         { }
 };
 
-static struct ctl_table_header *sysctl_hdr;
+static int __net_init xfrm6_net_init(struct net *net)
+{
+        struct ctl_table *table;
+        struct ctl_table_header *hdr;
+
+        table = xfrm6_policy_table;
+        if (!net_eq(net, &init_net)) {
+                table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
+                if (!table)
+                        goto err_alloc;
+
+                table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
+        }
+
+        hdr = register_net_sysctl(net, "net/ipv6", table);
+        if (!hdr)
+                goto err_reg;
+
+        net->ipv6.sysctl.xfrm6_hdr = hdr;
+        return 0;
+
+err_reg:
+        if (!net_eq(net, &init_net))
+                kfree(table);
+err_alloc:
+        return -ENOMEM;
+}
+
+static void __net_exit xfrm6_net_exit(struct net *net)
+{
+        struct ctl_table *table;
+
+        if (net->ipv6.sysctl.xfrm6_hdr == NULL)
+                return;
+
+        table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
+        if (!net_eq(net, &init_net))
+                kfree(table);
+}
+
+static struct pernet_operations xfrm6_net_ops = {
+        .init   = xfrm6_net_init,
+        .exit   = xfrm6_net_exit,
+};
 #endif
 
 int __init xfrm6_init(void)
@@ -339,8 +383,7 @@ int __init xfrm6_init(void)
                 goto out_policy;
 
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv6",
-                                         xfrm6_policy_table);
+        register_pernet_subsys(&xfrm6_net_ops);
 #endif
 out:
         return ret;
@@ -352,8 +395,7 @@ out_policy:
 void xfrm6_fini(void)
 {
 #ifdef CONFIG_SYSCTL
-        if (sysctl_hdr)
-                unregister_net_sysctl_table(sysctl_hdr);
+        unregister_pernet_subsys(&xfrm6_net_ops);
 #endif
         xfrm6_policy_fini();
         xfrm6_state_fini();
diff --git a/net/key/af_key.c b/net/key/af_key.c
index cc2630ac8061..7b3ba32ca678 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -203,7 +203,6 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
         }
         if (*skb2 != NULL) {
                 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
-                        skb_orphan(*skb2);
                         skb_set_owner_r(*skb2, sk);
                         skb_queue_tail(&sk->sk_receive_queue, *skb2);
                         sk->sk_data_ready(sk, (*skb2)->len);
@@ -816,18 +815,21 @@ static struct sk_buff *__pfkey_xfrm_state2msg(const struct xfrm_state *x,
         sa->sadb_sa_auth = 0;
         if (x->aalg) {
                 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
-                sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0;
+                sa->sadb_sa_auth = (a && a->pfkey_supported) ?
+                                        a->desc.sadb_alg_id : 0;
         }
         sa->sadb_sa_encrypt = 0;
         BUG_ON(x->ealg && x->calg);
         if (x->ealg) {
                 struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0);
-                sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
+                sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
+                                        a->desc.sadb_alg_id : 0;
         }
         /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */
         if (x->calg) {
                 struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0);
-                sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0;
+                sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
+                                        a->desc.sadb_alg_id : 0;
         }
 
         sa->sadb_sa_flags = 0;
@@ -1138,7 +1140,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
         if (sa->sadb_sa_auth) {
                 int keysize = 0;
                 struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth);
-                if (!a) {
+                if (!a || !a->pfkey_supported) {
                         err = -ENOSYS;
                         goto out;
                 }
@@ -1160,7 +1162,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
         if (sa->sadb_sa_encrypt) {
                 if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
                         struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt);
-                        if (!a) {
+                        if (!a || !a->pfkey_supported) {
                                 err = -ENOSYS;
                                 goto out;
                         }
@@ -1172,7 +1174,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                 } else {
                         int keysize = 0;
                         struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt);
-                        if (!a) {
+                        if (!a || !a->pfkey_supported) {
                                 err = -ENOSYS;
                                 goto out;
                         }
@@ -1578,13 +1580,13 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
         struct sadb_msg *hdr;
         int len, auth_len, enc_len, i;
 
-        auth_len = xfrm_count_auth_supported();
+        auth_len = xfrm_count_pfkey_auth_supported();
         if (auth_len) {
                 auth_len *= sizeof(struct sadb_alg);
                 auth_len += sizeof(struct sadb_supported);
         }
 
-        enc_len = xfrm_count_enc_supported();
+        enc_len = xfrm_count_pfkey_enc_supported();
         if (enc_len) {
                 enc_len *= sizeof(struct sadb_alg);
                 enc_len += sizeof(struct sadb_supported);
@@ -1615,6 +1617,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
                         struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
                         if (!aalg)
                                 break;
+                        if (!aalg->pfkey_supported)
+                                continue;
                         if (aalg->available)
                                 *ap++ = aalg->desc;
                 }
@@ -1634,6 +1638,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
                         struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
                         if (!ealg)
                                 break;
+                        if (!ealg->pfkey_supported)
+                                continue;
                         if (ealg->available)
                                 *ap++ = ealg->desc;
                 }
@@ -2825,6 +2831,8 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
                 const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
                 if (!aalg)
                         break;
+                if (!aalg->pfkey_supported)
+                        continue;
                 if (aalg_tmpl_set(t, aalg) && aalg->available)
                         sz += sizeof(struct sadb_comb);
         }
@@ -2840,6 +2848,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
                 if (!ealg)
                         break;
 
+                if (!ealg->pfkey_supported)
+                        continue;
+
                 if (!(ealg_tmpl_set(t, ealg) && ealg->available))
                         continue;
 
@@ -2848,6 +2859,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
                         if (!aalg)
                                 break;
 
+                        if (!aalg->pfkey_supported)
+                                continue;
+
                         if (aalg_tmpl_set(t, aalg) && aalg->available)
                                 sz += sizeof(struct sadb_comb);
                 }
@@ -2871,6 +2885,9 @@ static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
                 if (!aalg)
                         break;
 
+                if (!aalg->pfkey_supported)
+                        continue;
+
                 if (aalg_tmpl_set(t, aalg) && aalg->available) {
                         struct sadb_comb *c;
                         c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
@@ -2903,6 +2920,9 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
                 if (!ealg)
                         break;
 
+                if (!ealg->pfkey_supported)
+                        continue;
+
                 if (!(ealg_tmpl_set(t, ealg) && ealg->available))
                         continue;
 
@@ -2911,6 +2931,8 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
                         const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
                         if (!aalg)
                                 break;
+                        if (!aalg->pfkey_supported)
+                                continue;
                         if (!(aalg_tmpl_set(t, aalg) && aalg->available))
                                 continue;
                         c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index f9a549554740..6fb9d00a75dc 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -35,6 +35,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8,
                 .sadb_alg_ivlen = 8,
@@ -51,6 +53,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12,
                 .sadb_alg_ivlen = 8,
@@ -67,6 +71,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16,
                 .sadb_alg_ivlen = 8,
@@ -83,6 +89,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8,
                 .sadb_alg_ivlen = 8,
@@ -99,6 +107,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12,
                 .sadb_alg_ivlen = 8,
@@ -115,6 +125,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16,
                 .sadb_alg_ivlen = 8,
@@ -131,6 +143,8 @@ static struct xfrm_algo_desc aead_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_NULL_AES_GMAC,
                 .sadb_alg_ivlen = 8,
@@ -151,6 +165,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_NULL,
                 .sadb_alg_ivlen = 0,
@@ -169,6 +185,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_AALG_MD5HMAC,
                 .sadb_alg_ivlen = 0,
@@ -187,6 +205,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_AALG_SHA1HMAC,
                 .sadb_alg_ivlen = 0,
@@ -205,6 +225,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
                 .sadb_alg_ivlen = 0,
@@ -222,6 +244,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_SHA2_384HMAC,
                 .sadb_alg_ivlen = 0,
@@ -239,6 +263,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_SHA2_512HMAC,
                 .sadb_alg_ivlen = 0,
@@ -257,6 +283,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
                 .sadb_alg_ivlen = 0,
@@ -274,6 +302,8 @@ static struct xfrm_algo_desc aalg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
                 .sadb_alg_ivlen = 0,
@@ -295,6 +325,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id =  SADB_EALG_NULL,
                 .sadb_alg_ivlen = 0,
@@ -313,6 +345,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_EALG_DESCBC,
                 .sadb_alg_ivlen = 8,
@@ -331,6 +365,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_EALG_3DESCBC,
                 .sadb_alg_ivlen = 8,
@@ -349,6 +385,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_CASTCBC,
                 .sadb_alg_ivlen = 8,
@@ -367,6 +405,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
                 .sadb_alg_ivlen = 8,
@@ -385,6 +425,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AESCBC,
                 .sadb_alg_ivlen = 8,
@@ -403,6 +445,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
                 .sadb_alg_ivlen = 8,
@@ -421,6 +465,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_CAMELLIACBC,
                 .sadb_alg_ivlen = 8,
@@ -439,6 +485,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
                 .sadb_alg_ivlen = 8,
@@ -456,6 +504,8 @@ static struct xfrm_algo_desc ealg_list[] = {
                 }
         },
 
+        .pfkey_supported = 1,
+
         .desc = {
                 .sadb_alg_id = SADB_X_EALG_AESCTR,
                 .sadb_alg_ivlen = 8,
@@ -473,6 +523,7 @@ static struct xfrm_algo_desc calg_list[] = {
                         .threshold = 90,
                 }
         },
+        .pfkey_supported = 1,
         .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
 },
 {
@@ -482,6 +533,7 @@ static struct xfrm_algo_desc calg_list[] = {
                         .threshold = 90,
                 }
         },
+        .pfkey_supported = 1,
         .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
 },
 {
@@ -491,6 +543,7 @@ static struct xfrm_algo_desc calg_list[] = {
                         .threshold = 50,
                 }
         },
+        .pfkey_supported = 1,
         .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
 },
 };
@@ -714,27 +767,27 @@ void xfrm_probe_algs(void)
 }
 EXPORT_SYMBOL_GPL(xfrm_probe_algs);
 
-int xfrm_count_auth_supported(void)
+int xfrm_count_pfkey_auth_supported(void)
 {
         int i, n;
 
         for (i = 0, n = 0; i < aalg_entries(); i++)
-                if (aalg_list[i].available)
+                if (aalg_list[i].available && aalg_list[i].pfkey_supported)
                         n++;
         return n;
 }
-EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
+EXPORT_SYMBOL_GPL(xfrm_count_pfkey_auth_supported);
 
-int xfrm_count_enc_supported(void)
+int xfrm_count_pfkey_enc_supported(void)
 {
         int i, n;
 
         for (i = 0, n = 0; i < ealg_entries(); i++)
-                if (ealg_list[i].available)
+                if (ealg_list[i].available && ealg_list[i].pfkey_supported)
                         n++;
         return n;
 }
-EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
+EXPORT_SYMBOL_GPL(xfrm_count_pfkey_enc_supported);
 
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 3670526e70b9..bcfda8921b5b 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -64,7 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 
                 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
-                        goto error_nolock;
+                        goto error;
                 }
 
                 err = xfrm_state_check_expire(x);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 6c9aa642a2ba..5b47180986f8 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -35,6 +35,10 @@
 
 #include "xfrm_hash.h"
 
+#define XFRM_QUEUE_TMO_MIN ((unsigned)(HZ/10))
+#define XFRM_QUEUE_TMO_MAX ((unsigned)(60*HZ))
+#define XFRM_MAX_QUEUE_LEN      100
+
 DEFINE_MUTEX(xfrm_cfg_mutex);
 EXPORT_SYMBOL(xfrm_cfg_mutex);
 
@@ -51,7 +55,7 @@ static struct kmem_cache *xfrm_dst_cache __read_mostly;
 static void xfrm_init_pmtu(struct dst_entry *dst);
 static int stale_bundle(struct dst_entry *dst);
 static int xfrm_bundle_ok(struct xfrm_dst *xdst);
-
+static void xfrm_policy_queue_process(unsigned long arg);
 
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
                                                 int dir);
@@ -287,8 +291,11 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
                 INIT_HLIST_NODE(&policy->byidx);
                 rwlock_init(&policy->lock);
                 atomic_set(&policy->refcnt, 1);
+                skb_queue_head_init(&policy->polq.hold_queue);
                 setup_timer(&policy->timer, xfrm_policy_timer,
                                 (unsigned long)policy);
+                setup_timer(&policy->polq.hold_timer, xfrm_policy_queue_process,
+                            (unsigned long)policy);
                 policy->flo.ops = &xfrm_policy_fc_ops;
         }
         return policy;
@@ -309,6 +316,16 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
 }
 EXPORT_SYMBOL(xfrm_policy_destroy);
 
+static void xfrm_queue_purge(struct sk_buff_head *list)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(list)) != NULL) {
+                dev_put(skb->dev);
+                kfree_skb(skb);
+        }
+}
+
 /* Rule must be locked. Release descentant resources, announce
  * entry dead. The rule must be unlinked from lists to the moment.
  */
@@ -319,6 +336,9 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
 
         atomic_inc(&policy->genid);
 
+        del_timer(&policy->polq.hold_timer);
+        xfrm_queue_purge(&policy->polq.hold_queue);
+
         if (del_timer(&policy->timer))
                 xfrm_pol_put(policy);
 
@@ -562,6 +582,46 @@ static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s
         return 0;
 }
 
+static void xfrm_policy_requeue(struct xfrm_policy *old,
+                                struct xfrm_policy *new)
+{
+        struct xfrm_policy_queue *pq = &old->polq;
+        struct sk_buff_head list;
+
+        __skb_queue_head_init(&list);
+
+        spin_lock_bh(&pq->hold_queue.lock);
+        skb_queue_splice_init(&pq->hold_queue, &list);
+        del_timer(&pq->hold_timer);
+        spin_unlock_bh(&pq->hold_queue.lock);
+
+        if (skb_queue_empty(&list))
+                return;
+
+        pq = &new->polq;
+
+        spin_lock_bh(&pq->hold_queue.lock);
+        skb_queue_splice(&list, &pq->hold_queue);
+        pq->timeout = XFRM_QUEUE_TMO_MIN;
+        mod_timer(&pq->hold_timer, jiffies);
+        spin_unlock_bh(&pq->hold_queue.lock);
+}
+
+static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
+                                   struct xfrm_policy *pol)
+{
+        u32 mark = policy->mark.v & policy->mark.m;
+
+        if (policy->mark.v == pol->mark.v && policy->mark.m == pol->mark.m)
+                return true;
+
+        if ((mark & pol->mark.m) == pol->mark.v &&
+            policy->priority == pol->priority)
+                return true;
+
+        return false;
+}
+
 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 {
         struct net *net = xp_net(policy);
@@ -569,7 +629,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *delpol;
         struct hlist_head *chain;
         struct hlist_node *entry, *newpos;
-        u32 mark = policy->mark.v & policy->mark.m;
 
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
@@ -578,7 +637,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         hlist_for_each_entry(pol, entry, chain, bydst) {
                 if (pol->type == policy->type &&
                     !selector_cmp(&pol->selector, &policy->selector) &&
-                    (mark & pol->mark.m) == pol->mark.v &&
+                    xfrm_policy_mark_match(policy, pol) &&
                     xfrm_sec_ctx_match(pol->security, policy->security) &&
                     !WARN_ON(delpol)) {
                         if (excl) {
@@ -603,8 +662,10 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         net->xfrm.policy_count[dir]++;
         atomic_inc(&flow_cache_genid);
         rt_genid_bump(net);
-        if (delpol)
+        if (delpol) {
+                xfrm_policy_requeue(delpol, policy);
                 __xfrm_policy_unlink(delpol, dir);
+        }
         policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
         hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
         policy->curlft.add_time = get_seconds();
@@ -1115,11 +1176,15 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
                 pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir);
                 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
         }
-        if (old_pol)
+        if (old_pol) {
+                if (pol)
+                        xfrm_policy_requeue(old_pol, pol);
+
                 /* Unlinking succeeds always. This is the only function
                  * allowed to delete or replace socket policy.
                  */
                 __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
+        }
         write_unlock_bh(&xfrm_policy_lock);
 
         if (old_pol) {
@@ -1310,6 +1375,8 @@ static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *f
                  * It means we need to try again resolving. */
                 if (xdst->num_xfrms > 0)
                         return NULL;
+        } else if (dst->flags & DST_XFRM_QUEUE) {
+                return NULL;
         } else {
                 /* Real bundle */
                 if (stale_bundle(dst))
@@ -1673,6 +1740,171 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
         return xdst;
 }
 
+static void xfrm_policy_queue_process(unsigned long arg)
+{
+        int err = 0;
+        struct sk_buff *skb;
+        struct sock *sk;
+        struct dst_entry *dst;
+        struct net_device *dev;
+        struct xfrm_policy *pol = (struct xfrm_policy *)arg;
+        struct xfrm_policy_queue *pq = &pol->polq;
+        struct flowi fl;
+        struct sk_buff_head list;
+
+        spin_lock(&pq->hold_queue.lock);
+        skb = skb_peek(&pq->hold_queue);
+        dst = skb_dst(skb);
+        sk = skb->sk;
+        xfrm_decode_session(skb, &fl, dst->ops->family);
+        spin_unlock(&pq->hold_queue.lock);
+
+        dst_hold(dst->path);
+        dst = xfrm_lookup(xp_net(pol), dst->path, &fl,
+                          sk, 0);
+        if (IS_ERR(dst))
+                goto purge_queue;
+
+        if (dst->flags & DST_XFRM_QUEUE) {
+                dst_release(dst);
+
+                if (pq->timeout >= XFRM_QUEUE_TMO_MAX)
+                        goto purge_queue;
+
+                pq->timeout = pq->timeout << 1;
+                mod_timer(&pq->hold_timer, jiffies + pq->timeout);
+                return;
+        }
+
+        dst_release(dst);
+
+        __skb_queue_head_init(&list);
+
+        spin_lock(&pq->hold_queue.lock);
+        pq->timeout = 0;
+        skb_queue_splice_init(&pq->hold_queue, &list);
+        spin_unlock(&pq->hold_queue.lock);
+
+        while (!skb_queue_empty(&list)) {
+                skb = __skb_dequeue(&list);
+
+                xfrm_decode_session(skb, &fl, skb_dst(skb)->ops->family);
+                dst_hold(skb_dst(skb)->path);
+                dst = xfrm_lookup(xp_net(pol), skb_dst(skb)->path,
+                                  &fl, skb->sk, 0);
+                if (IS_ERR(dst)) {
+                        dev_put(skb->dev);
+                        kfree_skb(skb);
+                        continue;
+                }
+
+                nf_reset(skb);
+                skb_dst_drop(skb);
+                skb_dst_set(skb, dst);
+
+                dev = skb->dev;
+                err = dst_output(skb);
+                dev_put(dev);
+        }
+
+        return;
+
+purge_queue:
+        pq->timeout = 0;
+        xfrm_queue_purge(&pq->hold_queue);
+}
+
+static int xdst_queue_output(struct sk_buff *skb)
+{
+        unsigned long sched_next;
+        struct dst_entry *dst = skb_dst(skb);
+        struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
+        struct xfrm_policy_queue *pq = &xdst->pols[0]->polq;
+
+        if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
+                kfree_skb(skb);
+                return -EAGAIN;
+        }
+
+        skb_dst_force(skb);
+        dev_hold(skb->dev);
+
+        spin_lock_bh(&pq->hold_queue.lock);
+
+        if (!pq->timeout)
+                pq->timeout = XFRM_QUEUE_TMO_MIN;
+
+        sched_next = jiffies + pq->timeout;
+
+        if (del_timer(&pq->hold_timer)) {
+                if (time_before(pq->hold_timer.expires, sched_next))
+                        sched_next = pq->hold_timer.expires;
+        }
+
+        __skb_queue_tail(&pq->hold_queue, skb);
+        mod_timer(&pq->hold_timer, sched_next);
+
+        spin_unlock_bh(&pq->hold_queue.lock);
+
+        return 0;
+}
+
+static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net,
+                                                 struct dst_entry *dst,
+                                                 const struct flowi *fl,
+                                                 int num_xfrms,
+                                                 u16 family)
+{
+        int err;
+        struct net_device *dev;
+        struct dst_entry *dst1;
+        struct xfrm_dst *xdst;
+
+        xdst = xfrm_alloc_dst(net, family);
+        if (IS_ERR(xdst))
+                return xdst;
+
+        if (net->xfrm.sysctl_larval_drop || num_xfrms <= 0 ||
+            (fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP))
+                return xdst;
+
+        dst1 = &xdst->u.dst;
+        dst_hold(dst);
+        xdst->route = dst;
+
+        dst_copy_metrics(dst1, dst);
+
+        dst1->obsolete = DST_OBSOLETE_FORCE_CHK;
+        dst1->flags |= DST_HOST | DST_XFRM_QUEUE;
+        dst1->lastuse = jiffies;
+
+        dst1->input = dst_discard;
+        dst1->output = xdst_queue_output;
+
+        dst_hold(dst);
+        dst1->child = dst;
+        dst1->path = dst;
+
+        xfrm_init_path((struct xfrm_dst *)dst1, dst, 0);
+
+        err = -ENODEV;
+        dev = dst->dev;
+        if (!dev)
+                goto free_dst;
+
+        err = xfrm_fill_dst(xdst, dev, fl);
+        if (err)
+                goto free_dst;
+
+out:
+        return xdst;
+
+free_dst:
+        dst_release(dst1);
+        xdst = ERR_PTR(err);
+        goto out;
+}
+
 static struct flow_cache_object *
 xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
                    struct flow_cache_object *oldflo, void *ctx)
@@ -1751,7 +1983,7 @@ make_dummy_bundle:
         /* We found policies, but there's no bundles to instantiate:
          * either because the policy blocks, has no transformations or
          * we could not build template (no xfrm_states).*/
-        xdst = xfrm_alloc_dst(net, family);
+        xdst = xfrm_create_dummy_bundle(net, dst_orig, fl, num_xfrms, family);
         if (IS_ERR(xdst)) {
                 xfrm_pols_put(pols, num_pols);
                 return ERR_CAST(xdst);
@@ -2359,6 +2591,9 @@ static int xfrm_bundle_ok(struct xfrm_dst *first)
             (dst->dev && !netif_running(dst->dev)))
                 return 0;
 
+        if (dst->flags & DST_XFRM_QUEUE)
+                return 1;
+
         last = NULL;
 
         do {