7 files changed, 36 insertions, 60 deletions

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index e00767e8ebd9..9ab9d534fbac 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -885,7 +885,7 @@ static int arp_process(struct sk_buff *skb)
                 if (n == NULL &&
                     arp->ar_op == htons(ARPOP_REPLY) &&
                     inet_addr_type(sip) == RTN_UNICAST)
-                        n = __neigh_lookup(&arp_tbl, &sip, dev, -1);
+                        n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
 
         if (n) {
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index a73cf93cee36..2586df09b9b6 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -14,7 +14,8 @@
 #include <net/ip.h>
 
 /* Must be called with locally disabled BHs. */
-void __inet_twsk_kill(struct inet_timewait_sock *tw, struct inet_hashinfo *hashinfo)
+static void __inet_twsk_kill(struct inet_timewait_sock *tw,
+                             struct inet_hashinfo *hashinfo)
 {
         struct inet_bind_hashbucket *bhead;
         struct inet_bind_bucket *tb;
@@ -47,8 +48,6 @@ void __inet_twsk_kill(struct inet_timewait_sock *tw, struct inet_hashinfo *hashi
         inet_twsk_put(tw);
 }
 
-EXPORT_SYMBOL_GPL(__inet_twsk_kill);
-
 /*
  * Enter the time wait state. This is called with locally disabled BH.
  * Essentially we whip up a timewait bucket, copy the relevant info into it
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index e981232942a1..d1149aba9351 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1184,7 +1184,7 @@ static int __init arp_tables_init(void)
         if (ret < 0)
                 goto err4;
 
-        printk("arp_tables: (C) 2002 David S. Miller\n");
+        printk(KERN_INFO "arp_tables: (C) 2002 David S. Miller\n");
         return 0;
 
 err4:
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 3c5629938487..64552afd01cb 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -78,21 +78,26 @@ nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
         return skb;
 }
 
-static int
-ipv4_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff,
-             u_int8_t *protonum)
+static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
+                            unsigned int *dataoff, u_int8_t *protonum)
 {
+        struct iphdr _iph, *iph;
+
+        iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
+        if (iph == NULL)
+                return -NF_DROP;
+
         /* Never happen */
-        if (ip_hdr(*pskb)->frag_off & htons(IP_OFFSET)) {
+        if (iph->frag_off & htons(IP_OFFSET)) {
                 if (net_ratelimit()) {
-                        printk(KERN_ERR "ipv4_prepare: Frag of proto %u (hook=%u)\n",
-                        ip_hdr(*pskb)->protocol, hooknum);
+                        printk(KERN_ERR "ipv4_get_l4proto: Frag of proto %u\n",
+                        iph->protocol);
                 }
                 return -NF_DROP;
         }
 
-        *dataoff = skb_network_offset(*pskb) + ip_hdrlen(*pskb);
-        *protonum = ip_hdr(*pskb)->protocol;
+        *dataoff = nhoff + (iph->ihl << 2);
+        *protonum = iph->protocol;
 
         return NF_ACCEPT;
 }
@@ -400,14 +405,14 @@ static struct nf_sockopt_ops so_getorigdst = {
         .get            = &getorigdst,
 };
 
-struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 = {
+struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
         .l3proto         = PF_INET,
         .name            = "ipv4",
         .pkt_to_tuple    = ipv4_pkt_to_tuple,
         .invert_tuple    = ipv4_invert_tuple,
         .print_tuple     = ipv4_print_tuple,
         .print_conntrack = ipv4_print_conntrack,
-        .prepare         = ipv4_prepare,
+        .get_l4proto     = ipv4_get_l4proto,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nfattr = ipv4_tuple_to_nfattr,
         .nfattr_to_tuple = ipv4_nfattr_to_tuple,
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 0fe8fb0466ef..6593fd2c5b10 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -136,40 +136,22 @@ icmp_error_message(struct sk_buff *skb,
                  unsigned int hooknum)
 {
         struct nf_conntrack_tuple innertuple, origtuple;
-        struct {
-                struct icmphdr icmp;
-                struct iphdr ip;
-        } _in, *inside;
         struct nf_conntrack_l4proto *innerproto;
         struct nf_conntrack_tuple_hash *h;
-        int dataoff;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
-        /* Not enough header? */
-        inside = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_in), &_in);
-        if (inside == NULL)
-                return -NF_ACCEPT;
-
-        /* Ignore ICMP's containing fragments (shouldn't happen) */
-        if (inside->ip.frag_off & htons(IP_OFFSET)) {
-                pr_debug("icmp_error_message: fragment of proto %u\n",
-                         inside->ip.protocol);
+        /* Are they talking about one of our connections? */
+        if (!nf_ct_get_tuplepr(skb,
+                               skb_network_offset(skb) + ip_hdrlen(skb)
+                                                       + sizeof(struct icmphdr),
+                               PF_INET, &origtuple)) {
+                pr_debug("icmp_error_message: failed to get tuple\n");
                 return -NF_ACCEPT;
         }
 
         /* rcu_read_lock()ed by nf_hook_slow */
-        innerproto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);
-
-        dataoff = ip_hdrlen(skb) + sizeof(inside->icmp);
-        /* Are they talking about one of our connections? */
-        if (!nf_ct_get_tuple(skb, dataoff, dataoff + inside->ip.ihl*4, PF_INET,
-                             inside->ip.protocol, &origtuple,
-                             &nf_conntrack_l3proto_ipv4, innerproto)) {
-                pr_debug("icmp_error_message: ! get_tuple p=%u",
-                         inside->ip.protocol);
-                return -NF_ACCEPT;
-        }
+        innerproto = __nf_ct_l4proto_find(PF_INET, origtuple.dst.protonum);
 
         /* Ordinarily, we'd expect the inverted tupleproto, but it's
            been preserved inside the ICMP. */
@@ -183,25 +165,13 @@ icmp_error_message(struct sk_buff *skb,
 
         h = nf_conntrack_find_get(&innertuple);
         if (!h) {
-                /* Locally generated ICMPs will match inverted if they
-                   haven't been SNAT'ed yet */
-                /* FIXME: NAT code has to handle half-done double NAT --RR */
-                if (hooknum == NF_IP_LOCAL_OUT)
-                        h = nf_conntrack_find_get(&origtuple);
-
-                if (!h) {
-                        pr_debug("icmp_error_message: no match\n");
-                        return -NF_ACCEPT;
-                }
-
-                /* Reverse direction from that found */
-                if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
-                        *ctinfo += IP_CT_IS_REPLY;
-        } else {
-                if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
-                        *ctinfo += IP_CT_IS_REPLY;
+                pr_debug("icmp_error_message: no match\n");
+                return -NF_ACCEPT;
         }
 
+        if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
+                *ctinfo += IP_CT_IS_REPLY;
+
         /* Update skb to refer to this connection */
         skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
         skb->nfctinfo = *ctinfo;
@@ -342,7 +312,7 @@ static struct ctl_table icmp_compat_sysctl_table[] = {
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
 
-struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
+struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly =
 {
         .l3proto                = PF_INET,
         .l4proto                = IPPROTO_ICMP,
@@ -368,4 +338,3 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
 #endif
 #endif
 };
-EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_icmp);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 69f9f1ef3ef6..4e5884ac8f29 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1398,7 +1398,9 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
                  * waiting for the first ACK and did not get it)...
                  */
                 if ((tp->frto_counter == 1) && !(flag&FLAG_DATA_ACKED)) {
-                        tp->retrans_out += tcp_skb_pcount(skb);
+                        /* For some reason this R-bit might get cleared? */
+                        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
+                                tp->retrans_out += tcp_skb_pcount(skb);
                         /* ...enter this if branch just for the first segment */
                         flag |= FLAG_DATA_ACKED;
                 } else {
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 86624fabc4bf..f37d5928921a 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -111,6 +111,7 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         p->snd_una = tp->snd_una;
                         p->snd_cwnd = tp->snd_cwnd;
                         p->snd_wnd = tp->snd_wnd;
+                        p->ssthresh = tcp_current_ssthresh(sk);
                         p->srtt = tp->srtt >> 3;
 
                         tcp_probe.head = (tcp_probe.head + 1) % bufsize;