17 files changed, 206 insertions, 176 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 2a830de3a699..71da31818cfc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -202,13 +202,11 @@ static inline int ip_finish_output2(struct sk_buff *skb)
 
 static inline int ip_finish_output(struct sk_buff *skb)
 {
-        struct net_device *dev = skb->dst->dev;
-
-        skb->dev = dev;
-        skb->protocol = htons(ETH_P_IP);
-
-        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
-                       ip_finish_output2);
+        if (skb->len > dst_mtu(skb->dst) &&
+            !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
+                return ip_fragment(skb, ip_finish_output2);
+        else
+                return ip_finish_output2(skb);
 }
 
 int ip_mc_output(struct sk_buff *skb)
@@ -265,21 +263,21 @@ int ip_mc_output(struct sk_buff *skb)
                                 newskb->dev, ip_dev_loopback_xmit);
         }
 
-        if (skb->len > dst_mtu(&rt->u.dst))
-                return ip_fragment(skb, ip_finish_output);
-        else
-                return ip_finish_output(skb);
+        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev,
+                       ip_finish_output);
 }
 
 int ip_output(struct sk_buff *skb)
 {
+        struct net_device *dev = skb->dst->dev;
+
         IP_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 
-        if (skb->len > dst_mtu(skb->dst) &&
-                !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
-                return ip_fragment(skb, ip_finish_output);
-        else
-                return ip_finish_output(skb);
+        skb->dev = dev;
+        skb->protocol = htons(ETH_P_IP);
+
+        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
+                       ip_finish_output);
 }
 
 int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index 1aca94a9fd8b..3f47ad8e1cad 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -532,11 +532,8 @@ static unsigned int ip_vs_post_routing(unsigned int hooknum,
 {
         if (!((*pskb)->ipvs_property))
                 return NF_ACCEPT;
-
         /* The packet was sent from IPVS, exit this chain */
-        (*okfn)(*pskb);
-
-        return NF_STOLEN;
+        return NF_STOP;
 }
 
 u16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)
diff --git a/net/ipv4/ipvs/ip_vs_est.c b/net/ipv4/ipvs/ip_vs_est.c
index e7004741ac73..c453e1e57f4b 100644
--- a/net/ipv4/ipvs/ip_vs_est.c
+++ b/net/ipv4/ipvs/ip_vs_est.c
@@ -18,6 +18,7 @@
 #include <linux/jiffies.h>
 #include <linux/slab.h>
 #include <linux/types.h>
+#include <linux/interrupt.h>
 
 #include <net/ip_vs.h>
 
diff --git a/net/ipv4/ipvs/ip_vs_sched.c b/net/ipv4/ipvs/ip_vs_sched.c
index 0f7c56a225bd..8bc42b76223d 100644
--- a/net/ipv4/ipvs/ip_vs_sched.c
+++ b/net/ipv4/ipvs/ip_vs_sched.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
+#include <linux/interrupt.h>
 #include <asm/string.h>
 #include <linux/kmod.h>
 
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index 0366eedb4d70..84e4f79b7ffa 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -36,7 +36,7 @@ static unsigned int master_timeout = 300;
 MODULE_AUTHOR("Brian J. Murrell <netfilter@interlinx.bc.ca>");
 MODULE_DESCRIPTION("Amanda connection tracking module");
 MODULE_LICENSE("GPL");
-module_param(master_timeout, int, 0600);
+module_param(master_timeout, uint, 0600);
 MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 
 static const char *conns[] = { "DATA ", "MESG ", "INDEX " };
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index 68b173bcda60..e627e5856172 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -34,7 +34,7 @@ static int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 
 static int loose;
-module_param(loose, int, 0600);
+module_param(loose, bool, 0600);
 
 unsigned int (*ip_nat_ftp_hook)(struct sk_buff **pskb,
                                 enum ip_conntrack_info ctinfo,
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index d7c40421d0d1..c51a2cf71b4b 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -36,7 +36,7 @@
 #define MAX_PORTS 8
 static unsigned short ports[MAX_PORTS];
 static int ports_c;
-static int max_dcc_channels = 8;
+static unsigned int max_dcc_channels = 8;
 static unsigned int dcc_timeout = 300;
 /* This is slow, but it's simple. --RR */
 static char *irc_buffer;
@@ -54,9 +54,9 @@ MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
 MODULE_LICENSE("GPL");
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
-module_param(max_dcc_channels, int, 0400);
+module_param(max_dcc_channels, uint, 0400);
 MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per IRC session");
-module_param(dcc_timeout, int, 0400);
+module_param(dcc_timeout, uint, 0400);
 MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
 
 static const char *dccprotos[] = { "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT " };
@@ -254,10 +254,6 @@ static int __init init(void)
                 printk("ip_conntrack_irc: max_dcc_channels must be a positive integer\n");
                 return -EBUSY;
         }
-        if (dcc_timeout < 0) {
-                printk("ip_conntrack_irc: dcc_timeout must be a positive integer\n");
-                return -EBUSY;
-        }
 
         irc_buffer = kmalloc(65536, GFP_KERNEL);
         if (!irc_buffer)
diff --git a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
index 186646eb249f..4e68e16a2612 100644
--- a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
+++ b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
@@ -37,7 +37,7 @@ MODULE_DESCRIPTION("NetBIOS name service broadcast connection tracking helper");
 MODULE_LICENSE("GPL");
 
 static unsigned int timeout = 3;
-module_param(timeout, int, 0600);
+module_param(timeout, uint, 0400);
 MODULE_PARM_DESC(timeout, "timeout for master connection/replies in seconds");
 
 static int help(struct sk_buff **pskb,
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 91fe8f2e38ff..c9ebbe0d2d9c 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -79,6 +79,7 @@ ctnetlink_dump_tuples(struct sk_buff *skb,
                       const struct ip_conntrack_tuple *tuple)
 {
         struct nfattr *nest_parms;
+        int ret;
         
         nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
         NFA_PUT(skb, CTA_IP_V4_SRC, sizeof(u_int32_t), &tuple->src.ip);
@@ -86,10 +87,10 @@ ctnetlink_dump_tuples(struct sk_buff *skb,
         NFA_NEST_END(skb, nest_parms);
 
         nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
-        ctnetlink_dump_tuples_proto(skb, tuple);
+        ret = ctnetlink_dump_tuples_proto(skb, tuple);
         NFA_NEST_END(skb, nest_parms);
 
-        return 0;
+        return ret;
 
 nfattr_failure:
         return -1;
@@ -160,7 +161,7 @@ ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct ip_conntrack *ct)
                 return 0;
                 
         nest_helper = NFA_NEST(skb, CTA_HELP);
-        NFA_PUT(skb, CTA_HELP_NAME, CTA_HELP_MAXNAMESIZE, &ct->helper->name);
+        NFA_PUT(skb, CTA_HELP_NAME, strlen(ct->helper->name), ct->helper->name);
 
         if (ct->helper->to_nfattr)
                 ct->helper->to_nfattr(skb, ct);
@@ -229,7 +230,7 @@ nfattr_failure:
 static inline int
 ctnetlink_dump_use(struct sk_buff *skb, const struct ip_conntrack *ct)
 {
-        unsigned int use = htonl(atomic_read(&ct->ct_general.use));
+        u_int32_t use = htonl(atomic_read(&ct->ct_general.use));
         
         NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
         return 0;
@@ -311,29 +312,22 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         if (events & IPCT_DESTROY) {
                 type = IPCTNL_MSG_CT_DELETE;
                 group = NFNLGRP_CONNTRACK_DESTROY;
-                goto alloc_skb;
-        }
-        if (events & (IPCT_NEW | IPCT_RELATED)) {
+        } else if (events & (IPCT_NEW | IPCT_RELATED)) {
                 type = IPCTNL_MSG_CT_NEW;
                 flags = NLM_F_CREATE|NLM_F_EXCL;
                 /* dump everything */
                 events = ~0UL;
                 group = NFNLGRP_CONNTRACK_NEW;
-                goto alloc_skb;
-        }
-        if (events & (IPCT_STATUS |
+        } else if (events & (IPCT_STATUS |
                       IPCT_PROTOINFO |
                       IPCT_HELPER |
                       IPCT_HELPINFO |
                       IPCT_NATINFO)) {
                 type = IPCTNL_MSG_CT_NEW;
                 group = NFNLGRP_CONNTRACK_UPDATE;
-                goto alloc_skb;
-        } 
+        } else 
+                return NOTIFY_DONE;
         
-        return NOTIFY_DONE;
-
-alloc_skb:
   /* FIXME: Check if there are any listeners before, don't hurt performance */
         
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
@@ -1037,6 +1031,11 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
                         return err;
         }
 
+#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
+        if (cda[CTA_MARK-1])
+                ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
+#endif
+
         ct->helper = ip_conntrack_helper_find_get(rtuple);
 
         add_timer(&ct->timeout);
@@ -1045,11 +1044,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         if (ct->helper)
                 ip_conntrack_helper_put(ct->helper);
 
-#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
-        if (cda[CTA_MARK-1])
-                ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
-#endif
-
         DEBUGP("conntrack with id %u inserted\n", ct->id);
         return 0;
 
@@ -1209,7 +1203,6 @@ static int ctnetlink_expect_event(struct notifier_block *this,
         unsigned int type;
         unsigned char *b;
         int flags = 0;
-        u16 proto;
 
         if (events & IPEXP_NEW) {
                 type = IPCTNL_MSG_EXP_NEW;
@@ -1236,7 +1229,6 @@ static int ctnetlink_expect_event(struct notifier_block *this,
                 goto nfattr_failure;
 
         nlh->nlmsg_len = skb->tail - b;
-        proto = exp->tuple.dst.protonum;
         nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
         return NOTIFY_DONE;
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 5f9925db608e..30fc21d6165a 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -47,20 +47,21 @@ static int icmp_pkt_to_tuple(const struct sk_buff *skb,
         return 1;
 }
 
+/* Add 1; spaces filled with 0. */
+static const u_int8_t invmap[] = {
+        [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
+        [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
+        [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
+        [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
+        [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
+        [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
+        [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
+        [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
+};
+
 static int icmp_invert_tuple(struct ip_conntrack_tuple *tuple,
                              const struct ip_conntrack_tuple *orig)
 {
-        /* Add 1; spaces filled with 0. */
-        static const u_int8_t invmap[]
-                = { [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
-                    [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
-                    [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
-                    [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
-                    [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
-                    [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
-                    [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
-                    [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1};
-
         if (orig->dst.u.icmp.type >= sizeof(invmap)
             || !invmap[orig->dst.u.icmp.type])
                 return 0;
@@ -110,17 +111,17 @@ static int icmp_packet(struct ip_conntrack *ct,
         return NF_ACCEPT;
 }
 
-static const u_int8_t valid_new[] = { 
-        [ICMP_ECHO] = 1,
-        [ICMP_TIMESTAMP] = 1,
-        [ICMP_INFO_REQUEST] = 1,
-        [ICMP_ADDRESS] = 1 
-};
-
 /* Called when a new connection for this protocol found. */
 static int icmp_new(struct ip_conntrack *conntrack,
                     const struct sk_buff *skb)
 {
+        static const u_int8_t valid_new[] = { 
+                [ICMP_ECHO] = 1,
+                [ICMP_TIMESTAMP] = 1,
+                [ICMP_INFO_REQUEST] = 1,
+                [ICMP_ADDRESS] = 1 
+        };
+
         if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
             || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
                 /* Can't create a new ICMP `conn' with this. */
@@ -279,10 +280,6 @@ static int icmp_tuple_to_nfattr(struct sk_buff *skb,
         NFA_PUT(skb, CTA_PROTO_ICMP_CODE, sizeof(u_int8_t),
                 &t->dst.u.icmp.code);
 
-        if (t->dst.u.icmp.type >= sizeof(valid_new) 
-            || !valid_new[t->dst.u.icmp.type])
-                return -EINVAL;
-
         return 0;
 
 nfattr_failure:
@@ -295,7 +292,7 @@ static int icmp_nfattr_to_tuple(struct nfattr *tb[],
         if (!tb[CTA_PROTO_ICMP_TYPE-1]
             || !tb[CTA_PROTO_ICMP_CODE-1]
             || !tb[CTA_PROTO_ICMP_ID-1])
-                return -1;
+                return -EINVAL;
 
         tuple->dst.u.icmp.type = 
                         *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_TYPE-1]);
@@ -304,6 +301,10 @@ static int icmp_nfattr_to_tuple(struct nfattr *tb[],
         tuple->src.u.icmp.id =
                         *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
 
+        if (tuple->dst.u.icmp.type >= sizeof(invmap)
+            || !invmap[tuple->dst.u.icmp.type])
+                return -EINVAL;
+
         return 0;
 }
 #endif
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index a88bcc551244..7ba97783e741 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -451,30 +451,6 @@ static unsigned int ip_conntrack_defrag(unsigned int hooknum,
         return NF_ACCEPT;
 }
 
-static unsigned int ip_refrag(unsigned int hooknum,
-                              struct sk_buff **pskb,
-                              const struct net_device *in,
-                              const struct net_device *out,
-                              int (*okfn)(struct sk_buff *))
-{
-        struct rtable *rt = (struct rtable *)(*pskb)->dst;
-
-        /* We've seen it coming out the other side: confirm */
-        if (ip_confirm(hooknum, pskb, in, out, okfn) != NF_ACCEPT)
-                return NF_DROP;
-
-        /* Local packets are never produced too large for their
-           interface.  We degfragment them at LOCAL_OUT, however,
-           so we have to refragment them here. */
-        if ((*pskb)->len > dst_mtu(&rt->u.dst) &&
-            !skb_shinfo(*pskb)->tso_size) {
-                /* No hook can be after us, so this should be OK. */
-                ip_fragment(*pskb, okfn);
-                return NF_STOLEN;
-        }
-        return NF_ACCEPT;
-}
-
 static unsigned int ip_conntrack_local(unsigned int hooknum,
                                        struct sk_buff **pskb,
                                        const struct net_device *in,
@@ -544,7 +520,7 @@ static struct nf_hook_ops ip_conntrack_helper_in_ops = {
 
 /* Refragmenter; last chance. */
 static struct nf_hook_ops ip_conntrack_out_ops = {
-        .hook           = ip_refrag,
+        .hook           = ip_confirm,
         .owner          = THIS_MODULE,
         .pf             = PF_INET,
         .hooknum        = NF_IP_POST_ROUTING,
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 30cd4e18c129..f04111f74e09 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -190,23 +190,6 @@ ip_nat_out(unsigned int hooknum,
             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
                 return NF_ACCEPT;
 
-        /* We can hit fragment here; forwarded packets get
-           defragmented by connection tracking coming in, then
-           fragmented (grr) by the forward code.
-
-           In future: If we have nfct != NULL, AND we have NAT
-           initialized, AND there is no helper, then we can do full
-           NAPT on the head, and IP-address-only NAT on the rest.
-
-           I'm starting to have nightmares about fragments.  */
-
-        if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-                *pskb = ip_ct_gather_frags(*pskb, IP_DEFRAG_NAT_OUT);
-
-                if (!*pskb)
-                        return NF_STOLEN;
-        }
-
         return ip_nat_fn(hooknum, pskb, in, out, okfn);
 }
 
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index f057025a719e..6693526ae128 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -203,7 +203,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
                                                 sizeof(struct tcphdr), 0));
 
         /* Adjust IP TTL, DF */
-        nskb->nh.iph->ttl = MAXTTL;
+        nskb->nh.iph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
         /* Set DF, id = 0 */
         nskb->nh.iph->frag_off = htons(IP_DF);
         nskb->nh.iph->id = 0;
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 2883ccd8a91d..38641cd06123 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -77,15 +77,15 @@ MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NFLOG);
 #define PRINTR(format, args...) do { if (net_ratelimit()) printk(format , ## args); } while (0)
 
 static unsigned int nlbufsiz = 4096;
-module_param(nlbufsiz, uint, 0600); /* FIXME: Check size < 128k --RR */
+module_param(nlbufsiz, uint, 0400);
 MODULE_PARM_DESC(nlbufsiz, "netlink buffer size");
 
 static unsigned int flushtimeout = 10;
-module_param(flushtimeout, int, 0600);
+module_param(flushtimeout, uint, 0600);
 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout (hundredths of a second)");
 
-static unsigned int nflog = 1;
-module_param(nflog, int, 0400);
+static int nflog = 1;
+module_param(nflog, bool, 0400);
 MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
 
 /* global data structures */
@@ -376,7 +376,7 @@ static int __init init(void)
 
         DEBUGP("ipt_ULOG: init module\n");
 
-        if (nlbufsiz >= 128*1024) {
+        if (nlbufsiz > 128*1024) {
                 printk("Netlink buffer has to be <= 128kB\n");
                 return -EINVAL;
         }
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 261cbb4d4c49..5ddccb18c65e 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -24,10 +24,10 @@
 #define HASH_LOG 9
 
 /* Defaults, these can be overridden on the module command-line. */
-static int ip_list_tot = 100;
-static int ip_pkt_list_tot = 20;
-static int ip_list_hash_size = 0;
-static int ip_list_perms = 0644;
+static unsigned int ip_list_tot = 100;
+static unsigned int ip_pkt_list_tot = 20;
+static unsigned int ip_list_hash_size = 0;
+static unsigned int ip_list_perms = 0644;
 #ifdef DEBUG
 static int debug = 1;
 #endif
@@ -38,13 +38,13 @@ KERN_INFO RECENT_NAME " " RECENT_VER ": Stephen Frost <sfrost@snowman.net>.  htt
 MODULE_AUTHOR("Stephen Frost <sfrost@snowman.net>");
 MODULE_DESCRIPTION("IP tables recently seen matching module " RECENT_VER);
 MODULE_LICENSE("GPL");
-module_param(ip_list_tot, int, 0400);
-module_param(ip_pkt_list_tot, int, 0400);
-module_param(ip_list_hash_size, int, 0400);
-module_param(ip_list_perms, int, 0400);
+module_param(ip_list_tot, uint, 0400);
+module_param(ip_pkt_list_tot, uint, 0400);
+module_param(ip_list_hash_size, uint, 0400);
+module_param(ip_list_perms, uint, 0400);
 #ifdef DEBUG
-module_param(debug, int, 0600);
-MODULE_PARM_DESC(debug,"debugging level, defaults to 1");
+module_param(debug, bool, 0600);
+MODULE_PARM_DESC(debug,"enable debugging output");
 #endif
 MODULE_PARM_DESC(ip_list_tot,"number of IPs to remember per list");
 MODULE_PARM_DESC(ip_pkt_list_tot,"number of packets per IP to remember");
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 8202c1c0afad..9bdbb7793971 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -22,6 +22,7 @@
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
 #include <linux/sysctl.h>
+#include <net/route.h>
 #include <net/ip.h>
 
 #include <linux/netfilter_ipv4.h>
@@ -180,30 +181,6 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
         return NF_ACCEPT;
 }
 
-static unsigned int ipv4_refrag(unsigned int hooknum,
-                                struct sk_buff **pskb,
-                                const struct net_device *in,
-                                const struct net_device *out,
-                                int (*okfn)(struct sk_buff *))
-{
-        struct rtable *rt = (struct rtable *)(*pskb)->dst;
-
-        /* We've seen it coming out the other side: confirm */
-        if (ipv4_confirm(hooknum, pskb, in, out, okfn) != NF_ACCEPT)
-                return NF_DROP;
-
-        /* Local packets are never produced too large for their
-           interface.  We degfragment them at LOCAL_OUT, however,
-           so we have to refragment them here. */
-        if ((*pskb)->len > dst_mtu(&rt->u.dst) &&
-            !skb_shinfo(*pskb)->tso_size) {
-                /* No hook can be after us, so this should be OK. */
-                ip_fragment(*pskb, okfn);
-                return NF_STOLEN;
-        }
-        return NF_ACCEPT;
-}
-
 static unsigned int ipv4_conntrack_in(unsigned int hooknum,
                                       struct sk_buff **pskb,
                                       const struct net_device *in,
@@ -283,7 +260,7 @@ static struct nf_hook_ops ipv4_conntrack_helper_in_ops = {
 
 /* Refragmenter; last chance. */
 static struct nf_hook_ops ipv4_conntrack_out_ops = {
-        .hook           = ipv4_refrag,
+        .hook           = ipv4_confirm,
         .owner          = THIS_MODULE,
         .pf             = PF_INET,
         .hooknum        = NF_IP_POST_ROUTING,
@@ -392,6 +369,48 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         return -ENOENT;
 }
 
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_conntrack.h>
+
+static int ipv4_tuple_to_nfattr(struct sk_buff *skb,
+                                const struct nf_conntrack_tuple *tuple)
+{
+        NFA_PUT(skb, CTA_IP_V4_SRC, sizeof(u_int32_t),
+                &tuple->src.u3.ip);
+        NFA_PUT(skb, CTA_IP_V4_DST, sizeof(u_int32_t),
+                &tuple->dst.u3.ip);
+        return 0;
+
+nfattr_failure:
+        return -1;
+}
+
+static const size_t cta_min_ip[CTA_IP_MAX] = {
+        [CTA_IP_V4_SRC-1]       = sizeof(u_int32_t),
+        [CTA_IP_V4_DST-1]       = sizeof(u_int32_t),
+};
+
+static int ipv4_nfattr_to_tuple(struct nfattr *tb[],
+                                struct nf_conntrack_tuple *t)
+{
+        if (!tb[CTA_IP_V4_SRC-1] || !tb[CTA_IP_V4_DST-1])
+                return -EINVAL;
+
+        if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
+                return -EINVAL;
+
+        t->src.u3.ip =
+                *(u_int32_t *)NFA_DATA(tb[CTA_IP_V4_SRC-1]);
+        t->dst.u3.ip =
+                *(u_int32_t *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
+
+        return 0;
+}
+#endif
+
 static struct nf_sockopt_ops so_getorigdst = {
         .pf             = PF_INET,
         .get_optmin     = SO_ORIGINAL_DST,
@@ -408,6 +427,11 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 = {
         .print_conntrack = ipv4_print_conntrack,
         .prepare         = ipv4_prepare,
         .get_features    = ipv4_get_features,
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+        .tuple_to_nfattr = ipv4_tuple_to_nfattr,
+        .nfattr_to_tuple = ipv4_nfattr_to_tuple,
+#endif
         .me              = THIS_MODULE,
 };
 
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 7ddb5c08f7b8..52dc175be39a 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -50,20 +50,21 @@ static int icmp_pkt_to_tuple(const struct sk_buff *skb,
         return 1;
 }
 
+/* Add 1; spaces filled with 0. */
+static const u_int8_t invmap[] = {
+        [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
+        [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
+        [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
+        [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
+        [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
+        [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
+        [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
+        [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
+};
+
 static int icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
                              const struct nf_conntrack_tuple *orig)
 {
-        /* Add 1; spaces filled with 0. */
-        static u_int8_t invmap[]
-                = { [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
-                    [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
-                    [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
-                    [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
-                    [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
-                    [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
-                    [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
-                    [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1};
-
         if (orig->dst.u.icmp.type >= sizeof(invmap)
             || !invmap[orig->dst.u.icmp.type])
                 return 0;
@@ -120,11 +121,12 @@ static int icmp_packet(struct nf_conn *ct,
 static int icmp_new(struct nf_conn *conntrack,
                     const struct sk_buff *skb, unsigned int dataoff)
 {
-        static u_int8_t valid_new[]
-                = { [ICMP_ECHO] = 1,
-                    [ICMP_TIMESTAMP] = 1,
-                    [ICMP_INFO_REQUEST] = 1,
-                    [ICMP_ADDRESS] = 1 };
+        static const u_int8_t valid_new[] = {
+                [ICMP_ECHO] = 1,
+                [ICMP_TIMESTAMP] = 1,
+                [ICMP_INFO_REQUEST] = 1,
+                [ICMP_ADDRESS] = 1
+        };
 
         if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
             || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
@@ -168,7 +170,7 @@ icmp_error_message(struct sk_buff *skb,
                 return -NF_ACCEPT;
         }
 
-        innerproto = nf_ct_find_proto(PF_INET, inside->ip.protocol);
+        innerproto = __nf_ct_proto_find(PF_INET, inside->ip.protocol);
         dataoff = skb->nh.iph->ihl*4 + sizeof(inside->icmp);
         /* Are they talking about one of our connections? */
         if (!nf_ct_get_tuple(skb, dataoff, dataoff + inside->ip.ihl*4, PF_INET,
@@ -281,6 +283,60 @@ checksum_skipped:
         return icmp_error_message(skb, ctinfo, hooknum);
 }
 
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_conntrack.h>
+
+static int icmp_tuple_to_nfattr(struct sk_buff *skb,
+                                const struct nf_conntrack_tuple *t)
+{
+        NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(u_int16_t),
+                &t->src.u.icmp.id);
+        NFA_PUT(skb, CTA_PROTO_ICMP_TYPE, sizeof(u_int8_t),
+                &t->dst.u.icmp.type);
+        NFA_PUT(skb, CTA_PROTO_ICMP_CODE, sizeof(u_int8_t),
+                &t->dst.u.icmp.code);
+
+        return 0;
+
+nfattr_failure:
+        return -1;
+}
+
+static const size_t cta_min_proto[CTA_PROTO_MAX] = {
+        [CTA_PROTO_ICMP_TYPE-1] = sizeof(u_int8_t),
+        [CTA_PROTO_ICMP_CODE-1] = sizeof(u_int8_t),
+        [CTA_PROTO_ICMP_ID-1]   = sizeof(u_int16_t)
+};
+
+static int icmp_nfattr_to_tuple(struct nfattr *tb[],
+                                struct nf_conntrack_tuple *tuple)
+{
+        if (!tb[CTA_PROTO_ICMP_TYPE-1]
+            || !tb[CTA_PROTO_ICMP_CODE-1]
+            || !tb[CTA_PROTO_ICMP_ID-1])
+                return -EINVAL;
+
+        if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
+                return -EINVAL;
+
+        tuple->dst.u.icmp.type = 
+                        *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_TYPE-1]);
+        tuple->dst.u.icmp.code =
+                        *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_CODE-1]);
+        tuple->src.u.icmp.id =
+                        *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
+
+        if (tuple->dst.u.icmp.type >= sizeof(invmap)
+            || !invmap[tuple->dst.u.icmp.type])
+                return -EINVAL;
+
+        return 0;
+}
+#endif
+
 struct nf_conntrack_protocol nf_conntrack_protocol_icmp =
 {
         .list                   = { NULL, NULL },
@@ -295,7 +351,12 @@ struct nf_conntrack_protocol nf_conntrack_protocol_icmp =
         .new                    = icmp_new,
         .error                  = icmp_error,
         .destroy                = NULL,
-        .me                     = NULL
+        .me                     = NULL,
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+        .tuple_to_nfattr        = icmp_tuple_to_nfattr,
+        .nfattr_to_tuple        = icmp_nfattr_to_tuple,
+#endif
 };
 
 EXPORT_SYMBOL(nf_conntrack_protocol_icmp);