29 files changed, 149 insertions, 123 deletions
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 8bf312bdea13..b425748f02d7 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -241,7 +241,7 @@ static int arp_constructor(struct neighbour *neigh)
        neigh->type = inet_addr_type(addr);
        rcu_read_lock();
-        in_dev = rcu_dereference(__in_dev_get(dev));
+        in_dev = __in_dev_get_rcu(dev);
        if (in_dev == NULL) {
                rcu_read_unlock();
                return -EINVAL;
@@ -697,12 +697,6 @@ void arp_send(int type, int ptype, u32 dest_ip,
        arp_xmit(skb);
 }
-static void parp_redo(struct sk_buff *skb)
-{
-        nf_reset(skb);
-        arp_rcv(skb, skb->dev, NULL, skb->dev);
-}
 /*
 *      Process an arp request.
 */
@@ -922,6 +916,11 @@ out:
        return 0;
 }
+static void parp_redo(struct sk_buff *skb)
+{
+        arp_process(skb);
+}
 /*
 *      Receive an arp request from the device layer.
@@ -990,8 +989,8 @@ static int arp_req_set(struct arpreq *r, struct net_device * dev)
                        ipv4_devconf.proxy_arp = 1;
                        return 0;
                }
-                if (__in_dev_get(dev)) {
+                if (__in_dev_get_rtnl(dev)) {
-                        __in_dev_get(dev)->cnf.proxy_arp = 1;
+                        __in_dev_get_rtnl(dev)->cnf.proxy_arp = 1;
                        return 0;
                }
                return -ENXIO;
@@ -1096,8 +1095,8 @@ static int arp_req_delete(struct arpreq *r, struct net_device * dev)
                                ipv4_devconf.proxy_arp = 0;
                                return 0;
                        }
-                        if (__in_dev_get(dev)) {
+                        if (__in_dev_get_rtnl(dev)) {
-                                __in_dev_get(dev)->cnf.proxy_arp = 0;
+                                __in_dev_get_rtnl(dev)->cnf.proxy_arp = 0;
                                return 0;
                        }
                        return -ENXIO;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ba2895ae8151..74f2207e131a 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -351,7 +351,7 @@ static int inet_insert_ifa(struct in_ifaddr *ifa)
 static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
 {
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
        ASSERT_RTNL();
@@ -449,7 +449,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
                goto out;
        rc = -ENOBUFS;
-        if ((in_dev = __in_dev_get(dev)) == NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL) {
                in_dev = inetdev_init(dev);
                if (!in_dev)
                        goto out;
@@ -584,7 +584,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
        if (colon)
                *colon = ':';
-        if ((in_dev = __in_dev_get(dev)) != NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
                if (tryaddrmatch) {
                        /* Matthias Andree */
                        /* compare label and address (4.4BSD style) */
@@ -748,7 +748,7 @@ rarok:
 static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
 {
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
        struct in_ifaddr *ifa;
        struct ifreq ifr;
        int done = 0;
@@ -791,7 +791,7 @@ u32 inet_select_addr(const struct net_device *dev, u32 dst, int scope)
        struct in_device *in_dev;
        rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
        if (!in_dev)
                goto no_in_dev;
@@ -818,7 +818,7 @@ no_in_dev:
        read_lock(&dev_base_lock);
        rcu_read_lock();
        for (dev = dev_base; dev; dev = dev->next) {
-                if ((in_dev = __in_dev_get(dev)) == NULL)
+                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
                        continue;
                for_primary_ifa(in_dev) {
@@ -887,7 +887,7 @@ u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scop
        if (dev) {
                rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)))
+                if ((in_dev = __in_dev_get_rcu(dev)))
                        addr = confirm_addr_indev(in_dev, dst, local, scope);
                rcu_read_unlock();
@@ -897,7 +897,7 @@ u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scop
        read_lock(&dev_base_lock);
        rcu_read_lock();
        for (dev = dev_base; dev; dev = dev->next) {
-                if ((in_dev = __in_dev_get(dev))) {
+                if ((in_dev = __in_dev_get_rcu(dev))) {
                        addr = confirm_addr_indev(in_dev, dst, local, scope);
                        if (addr)
                                break;
@@ -957,7 +957,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                         void *ptr)
 {
        struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
        ASSERT_RTNL();
@@ -1078,7 +1078,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                if (idx > s_idx)
                        s_ip_idx = 0;
                rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) == NULL) {
+                if ((in_dev = __in_dev_get_rcu(dev)) == NULL) {
                        rcu_read_unlock();
                        continue;
                }
@@ -1149,7 +1149,7 @@ void inet_forward_change(void)
        for (dev = dev_base; dev; dev = dev->next) {
                struct in_device *in_dev;
                rcu_read_lock();
-                in_dev = __in_dev_get(dev);
+                in_dev = __in_dev_get_rcu(dev);
                if (in_dev)
                        in_dev->cnf.forwarding = on;
                rcu_read_unlock();
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e1379f71269..e61bc7177eb1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -173,7 +173,7 @@ int fib_validate_source(u32 src, u32 dst, u8 tos, int oif,
        no_addr = rpf = 0;
        rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
        if (in_dev) {
                no_addr = in_dev->ifa_list == NULL;
                rpf = IN_DEV_RPFILTER(in_dev);
@@ -607,7 +607,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
        struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
        if (event == NETDEV_UNREGISTER) {
                fib_disable_ip(dev, 2);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index d41219e8037c..186f20c4a45e 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1087,7 +1087,7 @@ fib_convert_rtentry(int cmd, struct nlmsghdr *nl, struct rtmsg *rtm,
                rta->rta_oif = &dev->ifindex;
                if (colon) {
                        struct in_ifaddr *ifa;
-                        struct in_device *in_dev = __in_dev_get(dev);
+                        struct in_device *in_dev = __in_dev_get_rtnl(dev);
                        if (!in_dev)
                                return -ENODEV;
                        *colon = ':';
@@ -1268,7 +1268,7 @@ int fib_sync_up(struct net_device *dev)
                        }
                        if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
                                continue;
-                        if (nh->nh_dev != dev || __in_dev_get(dev) == NULL)
+                        if (nh->nh_dev != dev || !__in_dev_get_rtnl(dev))
                                continue;
                        alive++;
                        spin_lock_bh(&fib_multipath_lock);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 24eb56ae1b5a..90dca711ac9f 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -188,7 +188,7 @@ struct icmp_err icmp_err_convert[] = {
 /* Control parameters for ECHO replies. */
 int sysctl_icmp_echo_ignore_all;
-int sysctl_icmp_echo_ignore_broadcasts;
+int sysctl_icmp_echo_ignore_broadcasts = 1;
 /* Control parameter - ignore bogus broadcast responses? */
 int sysctl_icmp_ignore_bogus_error_responses;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 70c44e4c3ceb..8b6d3939e1e6 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1323,7 +1323,7 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
        }
        if (dev) {
                imr->imr_ifindex = dev->ifindex;
-                idev = __in_dev_get(dev);
+                idev = __in_dev_get_rtnl(dev);
        }
        return idev;
 }
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 4d1502a49852..f9076ef3a1a8 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -20,7 +20,7 @@ void __inet_twsk_kill(struct inet_timewait_sock *tw, struct inet_hashinfo *hashi
        struct inet_bind_hashbucket *bhead;
        struct inet_bind_bucket *tb;
        /* Unlink from established hashes. */
-        struct inet_ehash_bucket *ehead = &hashinfo->ehash[tw->tw_hashent];
+        struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, tw->tw_hash);
        write_lock(&ehead->lock);
        if (hlist_unhashed(&tw->tw_node)) {
@@ -60,7 +60,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 {
        const struct inet_sock *inet = inet_sk(sk);
        const struct inet_connection_sock *icsk = inet_csk(sk);
-        struct inet_ehash_bucket *ehead = &hashinfo->ehash[sk->sk_hashent];
+        struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, sk->sk_hash);
        struct inet_bind_hashbucket *bhead;
        /* Step 1: Put TW into bind hash. Original socket stays there too.
           Note, that any socket with inet->num != 0 MUST be bound in
@@ -106,7 +106,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                tw->tw_dport        = inet->dport;
                tw->tw_family       = sk->sk_family;
                tw->tw_reuse        = sk->sk_reuse;
-                tw->tw_hashent      = sk->sk_hashent;
+                tw->tw_hash         = sk->sk_hash;
                tw->tw_ipv6only     = 0;
                tw->tw_prot         = sk->sk_prot_creator;
                atomic_set(&tw->tw_refcnt, 1);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f0d5740d7e22..896ce3f8f53a 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1104,10 +1104,10 @@ static int ipgre_open(struct net_device *dev)
                        return -EADDRNOTAVAIL;
                dev = rt->u.dst.dev;
                ip_rt_put(rt);
-                if (__in_dev_get(dev) == NULL)
+                if (__in_dev_get_rtnl(dev) == NULL)
                        return -EADDRNOTAVAIL;
                t->mlink = dev->ifindex;
-                ip_mc_inc_group(__in_dev_get(dev), t->parms.iph.daddr);
+                ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
        }
        return 0;
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9dbf5909f3a6..302b7eb507c9 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -149,7 +149,7 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
                if (err == 0 && (dev = __dev_get_by_name(p.name)) != NULL) {
                        dev->flags |= IFF_MULTICAST;
-                        in_dev = __in_dev_get(dev);
+                        in_dev = __in_dev_get_rtnl(dev);
                        if (in_dev == NULL && (in_dev = inetdev_init(dev)) == NULL)
                                goto failure;
                        in_dev->cnf.rp_filter = 0;
@@ -278,7 +278,7 @@ static int vif_delete(int vifi)
        dev_set_allmulti(dev, -1);
-        if ((in_dev = __in_dev_get(dev)) != NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
                in_dev->cnf.mc_forwarding--;
                ip_rt_multicast_event(in_dev);
        }
@@ -421,7 +421,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
                return -EINVAL;
        }
-        if ((in_dev = __in_dev_get(dev)) == NULL)
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
                return -EADDRNOTAVAIL;
        in_dev->cnf.mc_forwarding++;
        dev_set_allmulti(dev, +1);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 3cf9b451675c..2cd7e7d1ac90 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -537,6 +537,17 @@ config IP_NF_TARGET_TCPMSS
          To compile it as a module, choose M here.  If unsure, say N.
+config IP_NF_TARGET_NFQUEUE
+        tristate "NFQUEUE Target Support"
+        depends on IP_NF_IPTABLES
+        help
+          This Target replaced the old obsolete QUEUE target.
+          As opposed to QUEUE, it supports 65535 different queues,
+          not just one.
+          To compile it as a module, choose M here.  If unsure, say N.
 # NAT + specific targets
 config IP_NF_NAT
        tristate "Full NAT"
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 3d45d3c0283c..dab4b58dd31e 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -4,7 +4,8 @@
 # objects for the standalone - connection tracking / NAT
 ip_conntrack-objs       := ip_conntrack_standalone.o ip_conntrack_core.o ip_conntrack_proto_generic.o ip_conntrack_proto_tcp.o ip_conntrack_proto_udp.o ip_conntrack_proto_icmp.o
-iptable_nat-objs        := ip_nat_standalone.o ip_nat_rule.o ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
+ip_nat-objs     := ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
+iptable_nat-objs        := ip_nat_rule.o ip_nat_standalone.o
 ip_conntrack_pptp-objs  := ip_conntrack_helper_pptp.o ip_conntrack_proto_gre.o
 ip_nat_pptp-objs        := ip_nat_helper_pptp.o ip_nat_proto_gre.o
@@ -40,7 +41,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 # the three instances of ip_tables
 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
-obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
+obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 # matches
@@ -92,6 +93,7 @@ obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
+obj-$(CONFIG_IP_NF_TARGET_NFQUEUE) += ipt_NFQUEUE.o
 # generic ARP tables
 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
@@ -101,4 +103,3 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
 obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
 obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ipt_NFQUEUE.o
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index dc20881004bc..fa3f914117ec 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -65,7 +65,7 @@ static int help(struct sk_buff **pskb,
        /* increase the UDP timeout of the master connection as replies from
         * Amanda clients to the server can be quite delayed */
-        ip_ct_refresh_acct(ct, ctinfo, NULL, master_timeout * HZ);
+        ip_ct_refresh(ct, *pskb, master_timeout * HZ);
        /* No data? */
        dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index c1f82e0c81cf..ea65dd3e517a 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1112,45 +1112,46 @@ void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
        synchronize_net();
 }
-static inline void ct_add_counters(struct ip_conntrack *ct,
+/* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
-                                   enum ip_conntrack_info ctinfo,
+void __ip_ct_refresh_acct(struct ip_conntrack *ct, 
-                                   const struct sk_buff *skb)
-{
-#ifdef CONFIG_IP_NF_CT_ACCT
-        if (skb) {
-                ct->counters[CTINFO2DIR(ctinfo)].packets++;
-                ct->counters[CTINFO2DIR(ctinfo)].bytes += 
-                                        ntohs(skb->nh.iph->tot_len);
-        }
-#endif
-}
-/* Refresh conntrack for this many jiffies and do accounting (if skb != NULL) */
-void ip_ct_refresh_acct(struct ip_conntrack *ct, 
                        enum ip_conntrack_info ctinfo,
                        const struct sk_buff *skb,
-                        unsigned long extra_jiffies)
+                        unsigned long extra_jiffies,
+                        int do_acct)
 {
+        int do_event = 0;
        IP_NF_ASSERT(ct->timeout.data == (unsigned long)ct);
+        IP_NF_ASSERT(skb);
+        write_lock_bh(&ip_conntrack_lock);
        /* If not in hash table, timer will not be active yet */
        if (!is_confirmed(ct)) {
                ct->timeout.expires = extra_jiffies;
-                ct_add_counters(ct, ctinfo, skb);
+                do_event = 1;
        } else {
-                write_lock_bh(&ip_conntrack_lock);
                /* Need del_timer for race avoidance (may already be dying). */
                if (del_timer(&ct->timeout)) {
                        ct->timeout.expires = jiffies + extra_jiffies;
                        add_timer(&ct->timeout);
-                        /* FIXME: We loose some REFRESH events if this function
+                        do_event = 1;
-                         * is called without an skb.  I'll fix this later -HW */
-                        if (skb)
-                                ip_conntrack_event_cache(IPCT_REFRESH, skb);
                }
-                ct_add_counters(ct, ctinfo, skb);
-                write_unlock_bh(&ip_conntrack_lock);
        }
+#ifdef CONFIG_IP_NF_CT_ACCT
+        if (do_acct) {
+                ct->counters[CTINFO2DIR(ctinfo)].packets++;
+                ct->counters[CTINFO2DIR(ctinfo)].bytes += 
+                                                ntohs(skb->nh.iph->tot_len);
+        }
+#endif
+        write_unlock_bh(&ip_conntrack_lock);
+        /* must be unlocked when calling event cache */
+        if (do_event)
+                ip_conntrack_event_cache(IPCT_REFRESH, skb);
 }
 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
index 79db5b70d5f6..926a6684643d 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -172,7 +172,6 @@ static int destroy_sibling_or_exp(const struct ip_conntrack_tuple *t)
                DEBUGP("setting timeout of conntrack %p to 0\n", sibling);
                sibling->proto.gre.timeout = 0;
                sibling->proto.gre.stream_timeout = 0;
-                /* refresh_acct will not modify counters if skb == NULL */
                if (del_timer(&sibling->timeout))
                        sibling->timeout.function((unsigned long)sibling);
                ip_conntrack_put(sibling);
@@ -223,8 +222,8 @@ static void pptp_destroy_siblings(struct ip_conntrack *ct)
 static inline int
 exp_gre(struct ip_conntrack *master,
        u_int32_t seq,
-        u_int16_t callid,
+        __be16 callid,
-        u_int16_t peer_callid)
+        __be16 peer_callid)
 {
        struct ip_conntrack_tuple inv_tuple;
        struct ip_conntrack_tuple exp_tuples[] = {
@@ -263,7 +262,7 @@ exp_gre(struct ip_conntrack *master,
        exp_orig->mask.src.ip = 0xffffffff;
        exp_orig->mask.src.u.all = 0;
        exp_orig->mask.dst.u.all = 0;
-        exp_orig->mask.dst.u.gre.key = 0xffff;
+        exp_orig->mask.dst.u.gre.key = htons(0xffff);
        exp_orig->mask.dst.ip = 0xffffffff;
        exp_orig->mask.dst.protonum = 0xff;
                
@@ -340,7 +339,8 @@ pptp_inbound_pkt(struct sk_buff **pskb,
        unsigned int reqlen;
        union pptp_ctrl_union _pptpReq, *pptpReq;
        struct ip_ct_pptp_master *info = &ct->help.ct_pptp_info;
-        u_int16_t msg, *cid, *pcid;
+        u_int16_t msg;
+        __be16 *cid, *pcid;
        u_int32_t seq;  
        ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);
@@ -485,7 +485,7 @@ pptp_inbound_pkt(struct sk_buff **pskb,
                if (info->pns_call_id != ntohs(*pcid)) {
                        DEBUGP("%s for unknown CallID %u\n", 
-                                pptp_msg_name[msg], ntohs(*cid));
+                                pptp_msg_name[msg], ntohs(*pcid));
                        break;
                }
@@ -551,7 +551,8 @@ pptp_outbound_pkt(struct sk_buff **pskb,
        unsigned int reqlen;
        union pptp_ctrl_union _pptpReq, *pptpReq;
        struct ip_ct_pptp_master *info = &ct->help.ct_pptp_info;
-        u_int16_t msg, *cid, *pcid;
+        u_int16_t msg;
+        __be16 *cid, *pcid;
        ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);
        if (!ctlh)
@@ -755,7 +756,7 @@ static struct ip_conntrack_helper pptp = {
                          } 
                 },
        .mask = { .src = { .ip = 0, 
-                           .u = { .tcp = { .port = 0xffff } } 
+                           .u = { .tcp = { .port = __constant_htons(0xffff) } } 
                         }, 
                  .dst = { .ip = 0, 
                           .u = { .all = 0 },
diff --git a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
index 71ef19d126d0..186646eb249f 100644
--- a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
+++ b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
@@ -58,7 +58,7 @@ static int help(struct sk_buff **pskb,
                goto out;
        rcu_read_lock();
-        in_dev = __in_dev_get(rt->u.dst.dev);
+        in_dev = __in_dev_get_rcu(rt->u.dst.dev);
        if (in_dev != NULL) {
                for_primary_ifa(in_dev) {
                        if (ifa->ifa_broadcast == iph->daddr) {
@@ -91,7 +91,7 @@ static int help(struct sk_buff **pskb,
        ip_conntrack_expect_related(exp);
        ip_conntrack_expect_put(exp);
-        ip_ct_refresh_acct(ct, ctinfo, NULL, timeout * HZ);
+        ip_ct_refresh(ct, *pskb, timeout * HZ);
 out:
        return NF_ACCEPT;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_gre.c b/net/ipv4/netfilter/ip_conntrack_proto_gre.c
index de3cb9db6f85..744abb9d377a 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_gre.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_gre.c
@@ -247,6 +247,7 @@ static int gre_packet(struct ip_conntrack *ct,
                                   ct->proto.gre.stream_timeout);
                /* Also, more likely to be important, and not a probe. */
                set_bit(IPS_ASSURED_BIT, &ct->status);
+                ip_conntrack_event_cache(IPCT_STATUS, skb);
        } else
                ip_ct_refresh_acct(ct, conntrackinfo, skb,
                                   ct->proto.gre.timeout);
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index a875f35e576d..59a4a0111dd3 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -416,6 +416,7 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
                DEBUGP("Setting assured bit\n");
                set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                ip_conntrack_event_cache(IPCT_STATUS, skb);
        }
        return NF_ACCEPT;
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 1985abc59d24..121760d6cc50 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -1014,7 +1014,8 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                /* Set ASSURED if we see see valid ack in ESTABLISHED 
                   after SYN_RECV or a valid answer for a picked up 
                   connection. */
-                        set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                ip_conntrack_event_cache(IPCT_STATUS, skb);
        }
        ip_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index d3c7808010ec..dd476b191f4b 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -989,7 +989,7 @@ EXPORT_SYMBOL(need_ip_conntrack);
 EXPORT_SYMBOL(ip_conntrack_helper_register);
 EXPORT_SYMBOL(ip_conntrack_helper_unregister);
 EXPORT_SYMBOL(ip_ct_iterate_cleanup);
-EXPORT_SYMBOL(ip_ct_refresh_acct);
+EXPORT_SYMBOL(__ip_ct_refresh_acct);
 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
 EXPORT_SYMBOL(ip_conntrack_expect_put);
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index c3ea891d38e7..c5e3abd24672 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -74,12 +74,14 @@ ip_nat_proto_find_get(u_int8_t protonum)
        return p;
 }
+EXPORT_SYMBOL_GPL(ip_nat_proto_find_get);
 void
 ip_nat_proto_put(struct ip_nat_protocol *p)
 {
        module_put(p->me);
 }
+EXPORT_SYMBOL_GPL(ip_nat_proto_put);
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
@@ -111,6 +113,7 @@ ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck)
        return csum_fold(csum_partial((char *)diffs, sizeof(diffs),
                                      oldcheck^0xFFFF));
 }
+EXPORT_SYMBOL(ip_nat_cheat_check);
 /* Is this tuple already taken? (not by us) */
 int
@@ -127,6 +130,7 @@ ip_nat_used_tuple(const struct ip_conntrack_tuple *tuple,
        invert_tuplepr(&reply, tuple);
        return ip_conntrack_tuple_taken(&reply, ignored_conntrack);
 }
+EXPORT_SYMBOL(ip_nat_used_tuple);
 /* If we source map this tuple so reply looks like reply_tuple, will
 * that meet the constraints of range. */
@@ -347,6 +351,7 @@ ip_nat_setup_info(struct ip_conntrack *conntrack,
        return NF_ACCEPT;
 }
+EXPORT_SYMBOL(ip_nat_setup_info);
 /* Returns true if succeeded. */
 static int
@@ -387,10 +392,10 @@ manip_pkt(u_int16_t proto,
 }
 /* Do packet manipulations according to ip_nat_setup_info. */
-unsigned int nat_packet(struct ip_conntrack *ct,
+unsigned int ip_nat_packet(struct ip_conntrack *ct,
-                        enum ip_conntrack_info ctinfo,
+                           enum ip_conntrack_info ctinfo,
-                        unsigned int hooknum,
+                           unsigned int hooknum,
-                        struct sk_buff **pskb)
+                           struct sk_buff **pskb)
 {
        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
        unsigned long statusbit;
@@ -417,12 +422,13 @@ unsigned int nat_packet(struct ip_conntrack *ct,
        }
        return NF_ACCEPT;
 }
+EXPORT_SYMBOL_GPL(ip_nat_packet);
 /* Dir is direction ICMP is coming from (opposite to packet it contains) */
-int icmp_reply_translation(struct sk_buff **pskb,
+int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
-                           struct ip_conntrack *ct,
+                                  struct ip_conntrack *ct,
-                           enum ip_nat_manip_type manip,
+                                  enum ip_nat_manip_type manip,
-                           enum ip_conntrack_dir dir)
+                                  enum ip_conntrack_dir dir)
 {
        struct {
                struct icmphdr icmp;
@@ -509,6 +515,7 @@ int icmp_reply_translation(struct sk_buff **pskb,
        return 1;
 }
+EXPORT_SYMBOL_GPL(ip_nat_icmp_reply_translation);
 /* Protocol registration. */
 int ip_nat_protocol_register(struct ip_nat_protocol *proto)
@@ -525,6 +532,7 @@ int ip_nat_protocol_register(struct ip_nat_protocol *proto)
        write_unlock_bh(&ip_nat_lock);
        return ret;
 }
+EXPORT_SYMBOL(ip_nat_protocol_register);
 /* Noone stores the protocol anywhere; simply delete it. */
 void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
@@ -536,6 +544,7 @@ void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
        /* Someone could be still looking at the proto in a bh. */
        synchronize_net();
 }
+EXPORT_SYMBOL(ip_nat_protocol_unregister);
 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
@@ -582,7 +591,7 @@ EXPORT_SYMBOL_GPL(ip_nat_port_nfattr_to_range);
 EXPORT_SYMBOL_GPL(ip_nat_port_range_to_nfattr);
 #endif
-int __init ip_nat_init(void)
+static int __init ip_nat_init(void)
 {
        size_t i;
@@ -624,10 +633,14 @@ static int clean_nat(struct ip_conntrack *i, void *data)
        return 0;
 }
-/* Not __exit: called from ip_nat_standalone.c:init_or_cleanup() --RR */
+static void __exit ip_nat_cleanup(void)
-void ip_nat_cleanup(void)
 {
        ip_ct_iterate_cleanup(&clean_nat, NULL);
        ip_conntrack_destroyed = NULL;
        vfree(bysource);
 }
+MODULE_LICENSE("GPL");
+module_init(ip_nat_init);
+module_exit(ip_nat_cleanup);
diff --git a/net/ipv4/netfilter/ip_nat_helper.c b/net/ipv4/netfilter/ip_nat_helper.c
index d2dd5d313556..5d506e0564d5 100644
--- a/net/ipv4/netfilter/ip_nat_helper.c
+++ b/net/ipv4/netfilter/ip_nat_helper.c
@@ -199,6 +199,7 @@ ip_nat_mangle_tcp_packet(struct sk_buff **pskb,
        }
        return 1;
 }
+EXPORT_SYMBOL(ip_nat_mangle_tcp_packet);
                        
 /* Generic function for mangling variable-length address changes inside
 * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
@@ -256,6 +257,7 @@ ip_nat_mangle_udp_packet(struct sk_buff **pskb,
        return 1;
 }
+EXPORT_SYMBOL(ip_nat_mangle_udp_packet);
 /* Adjust one found SACK option including checksum correction */
 static void
@@ -399,6 +401,7 @@ ip_nat_seq_adjust(struct sk_buff **pskb,
        return 1;
 }
+EXPORT_SYMBOL(ip_nat_seq_adjust);
 /* Setup NAT on this expected conntrack so it follows master. */
 /* If we fail to get a free NAT slot, we'll get dropped on confirm */
@@ -425,3 +428,4 @@ void ip_nat_follow_master(struct ip_conntrack *ct,
        /* hook doesn't matter, but it has to do destination manip */
        ip_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
 }
+EXPORT_SYMBOL(ip_nat_follow_master);
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 0ff368b131f6..30cd4e18c129 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -108,8 +108,8 @@ ip_nat_fn(unsigned int hooknum,
        case IP_CT_RELATED:
        case IP_CT_RELATED+IP_CT_IS_REPLY:
                if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
-                        if (!icmp_reply_translation(pskb, ct, maniptype,
+                        if (!ip_nat_icmp_reply_translation(pskb, ct, maniptype,
-                                                    CTINFO2DIR(ctinfo)))
+                                                           CTINFO2DIR(ctinfo)))
                                return NF_DROP;
                        else
                                return NF_ACCEPT;
@@ -152,7 +152,7 @@ ip_nat_fn(unsigned int hooknum,
        }
        IP_NF_ASSERT(info);
-        return nat_packet(ct, ctinfo, hooknum, pskb);
+        return ip_nat_packet(ct, ctinfo, hooknum, pskb);
 }
 static unsigned int
@@ -325,15 +325,10 @@ static int init_or_cleanup(int init)
                printk("ip_nat_init: can't setup rules.\n");
                goto cleanup_nothing;
        }
-        ret = ip_nat_init();
-        if (ret < 0) {
-                printk("ip_nat_init: can't setup rules.\n");
-                goto cleanup_rule_init;
-        }
        ret = nf_register_hook(&ip_nat_in_ops);
        if (ret < 0) {
                printk("ip_nat_init: can't register in hook.\n");
-                goto cleanup_nat;
+                goto cleanup_rule_init;
        }
        ret = nf_register_hook(&ip_nat_out_ops);
        if (ret < 0) {
@@ -374,8 +369,6 @@ static int init_or_cleanup(int init)
        nf_unregister_hook(&ip_nat_out_ops);
 cleanup_inops:
        nf_unregister_hook(&ip_nat_in_ops);
- cleanup_nat:
-        ip_nat_cleanup();
 cleanup_rule_init:
        ip_nat_rule_cleanup();
 cleanup_nothing:
@@ -395,14 +388,4 @@ static void __exit fini(void)
 module_init(init);
 module_exit(fini);
-EXPORT_SYMBOL(ip_nat_setup_info);
-EXPORT_SYMBOL(ip_nat_protocol_register);
-EXPORT_SYMBOL(ip_nat_protocol_unregister);
-EXPORT_SYMBOL_GPL(ip_nat_proto_find_get);
-EXPORT_SYMBOL_GPL(ip_nat_proto_put);
-EXPORT_SYMBOL(ip_nat_cheat_check);
-EXPORT_SYMBOL(ip_nat_mangle_tcp_packet);
-EXPORT_SYMBOL(ip_nat_mangle_udp_packet);
-EXPORT_SYMBOL(ip_nat_used_tuple);
-EXPORT_SYMBOL(ip_nat_follow_master);
 MODULE_LICENSE("GPL");
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index d54f14d926f6..36339eb39e17 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -240,8 +240,8 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
        pmsg->packet_id       = (unsigned long )entry;
        pmsg->data_len        = data_len;
-        pmsg->timestamp_sec   = skb_tv_base.tv_sec + entry->skb->tstamp.off_sec;
+        pmsg->timestamp_sec   = entry->skb->tstamp.off_sec;
-        pmsg->timestamp_usec  = skb_tv_base.tv_usec + entry->skb->tstamp.off_usec;
+        pmsg->timestamp_usec  = entry->skb->tstamp.off_usec;
        pmsg->mark            = entry->skb->nfmark;
        pmsg->hook            = entry->info->hook;
        pmsg->hw_protocol     = entry->skb->protocol;
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 715cb613405c..5245bfd33d52 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -93,7 +93,7 @@ redirect_target(struct sk_buff **pskb,
                newdst = 0;
                
                rcu_read_lock();
-                indev = __in_dev_get((*pskb)->dev);
+                indev = __in_dev_get_rcu((*pskb)->dev);
                if (indev && (ifa = indev->ifa_list))
                        newdst = ifa->ifa_local;
                rcu_read_unlock();
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index e2c14f3cb2fc..2883ccd8a91d 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -225,8 +225,8 @@ static void ipt_ulog_packet(unsigned int hooknum,
        /* copy hook, prefix, timestamp, payload, etc. */
        pm->data_len = copy_len;
-        pm->timestamp_sec = skb_tv_base.tv_sec + skb->tstamp.off_sec;
+        pm->timestamp_sec = skb->tstamp.off_sec;
-        pm->timestamp_usec = skb_tv_base.tv_usec + skb->tstamp.off_usec;
+        pm->timestamp_usec = skb->tstamp.off_usec;
        pm->mark = skb->nfmark;
        pm->hook = hooknum;
        if (prefix != NULL)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8549f26e2495..381dd6a6aebb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2128,7 +2128,7 @@ int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr,
                struct in_device *in_dev;
                rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) != NULL) {
+                if ((in_dev = __in_dev_get_rcu(dev)) != NULL) {
                        int our = ip_check_mc(in_dev, daddr, saddr,
                                skb->nh.iph->protocol);
                        if (our
@@ -2443,7 +2443,9 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                err = -ENODEV;
                if (dev_out == NULL)
                        goto out;
-                if (__in_dev_get(dev_out) == NULL) {
+                /* RACE: Check return value of inet_select_addr instead. */
+                if (__in_dev_get_rtnl(dev_out) == NULL) {
                        dev_put(dev_out);
                        goto out;       /* Wrong error code */
                }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a7537c7bbd06..677419d0c9ad 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -355,8 +355,6 @@ static void tcp_clamp_window(struct sock *sk, struct tcp_sock *tp)
                        app_win -= icsk->icsk_ack.rcv_mss;
                app_win = max(app_win, 2U*tp->advmss);
-                if (!ofo_win)
-                        tp->window_clamp = min(tp->window_clamp, app_win);
                tp->rcv_ssthresh = min(tp->window_clamp, 2U*tp->advmss);
        }
 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 13dfb391cdf1..c85819d8474b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -130,19 +130,20 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
        int dif = sk->sk_bound_dev_if;
        INET_ADDR_COOKIE(acookie, saddr, daddr)
        const __u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-        const int hash = inet_ehashfn(daddr, lport, saddr, inet->dport, tcp_hashinfo.ehash_size);
+        unsigned int hash = inet_ehashfn(daddr, lport, saddr, inet->dport);
-        struct inet_ehash_bucket *head = &tcp_hashinfo.ehash[hash];
+        struct inet_ehash_bucket *head = inet_ehash_bucket(&tcp_hashinfo, hash);
        struct sock *sk2;
        const struct hlist_node *node;
        struct inet_timewait_sock *tw;
+        prefetch(head->chain.first);
        write_lock(&head->lock);
        /* Check TIME-WAIT sockets first. */
        sk_for_each(sk2, node, &(head + tcp_hashinfo.ehash_size)->chain) {
                tw = inet_twsk(sk2);
-                if (INET_TW_MATCH(sk2, acookie, saddr, daddr, ports, dif)) {
+                if (INET_TW_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif)) {
                        const struct tcp_timewait_sock *tcptw = tcp_twsk(sk2);
                        struct tcp_sock *tp = tcp_sk(sk);
@@ -179,7 +180,7 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
        /* And established part... */
        sk_for_each(sk2, node, &head->chain) {
-                if (INET_MATCH(sk2, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif))
                        goto not_unique;
        }
@@ -188,7 +189,7 @@ unique:
         * in hash table socket with a funny identity. */
        inet->num = lport;
        inet->sport = htons(lport);
-        sk->sk_hashent = hash;
+        sk->sk_hash = hash;
        BUG_TRAP(sk_unhashed(sk));
        __sk_add_node(sk, &head->chain);
        sock_prot_inc_use(sk->sk_prot);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5dd6dd7d091e..c5b911f9b662 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -190,7 +190,7 @@ void tcp_select_initial_window(int __space, __u32 mss,
        }
        /* Set initial window to value enough for senders,
-         * following RFC1414. Senders, not following this RFC,
+         * following RFC2414. Senders, not following this RFC,
         * will be satisfied with 2.
         */
        if (mss > (1<<*rcv_wscale)) {
@@ -509,7 +509,16 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
                        tp->lost_out -= diff;
                        tp->left_out -= diff;
                }
                if (diff > 0) {
+                        /* Adjust Reno SACK estimate. */
+                        if (!tp->rx_opt.sack_ok) {
+                                tp->sacked_out -= diff;
+                                if ((int)tp->sacked_out < 0)
+                                        tp->sacked_out = 0;
+                                tcp_sync_left_out(tp);
+                        }
                        tp->fackets_out -= diff;
                        if ((int)tp->fackets_out < 0)
                                tp->fackets_out = 0;