18 files changed, 166 insertions, 504 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2fea3f4402a0..a970b4727ce8 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1806,7 +1806,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         }
 
         for (dev = dev_base; dev != NULL; dev = dev->next) {
-                struct in_device * in_dev = __in_dev_get(dev);
+                struct in_device * in_dev = __in_dev_get_rtnl(dev);
                 if (in_dev && (dev->flags & IFF_UP)) {
                         struct in_ifaddr * ifa;
 
@@ -3520,6 +3520,8 @@ int __init addrconf_init(void)
         if (err)
                 return err;
 
+        ip6_null_entry.rt6i_idev = in6_dev_get(&loopback_dev);
+
         register_netdevice_notifier(&ipv6_dev_notf);
 
 #ifdef CONFIG_IPV6_PRIVACY
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9b27460f0cc7..40d9a1935ab5 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -31,6 +31,7 @@
 #include <net/esp.h>
 #include <asm/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/random.h>
 #include <net/icmp.h>
@@ -66,10 +67,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
 
         alen = esp->auth.icv_trunc_len;
         tfm = esp->conf.tfm;
-        blksize = (crypto_tfm_alg_blocksize(tfm) + 3) & ~3;
-        clen = (clen + 2 + blksize-1)&~(blksize-1);
+        blksize = ALIGN(crypto_tfm_alg_blocksize(tfm), 4);
+        clen = ALIGN(clen + 2, blksize);
         if (esp->conf.padlen)
-                clen = (clen + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+                clen = ALIGN(clen, esp->conf.padlen);
 
         if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0) {
                 goto error;
@@ -133,7 +134,7 @@ static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, stru
         struct ipv6_esp_hdr *esph;
         struct esp_data *esp = x->data;
         struct sk_buff *trailer;
-        int blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+        int blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
         int alen = esp->auth.icv_trunc_len;
         int elen = skb->len - sizeof(struct ipv6_esp_hdr) - esp->conf.ivlen - alen;
 
@@ -235,16 +236,17 @@ out_nofree:
 static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
 {
         struct esp_data *esp = x->data;
-        u32 blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+        u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
 
         if (x->props.mode) {
-                mtu = (mtu + 2 + blksize-1)&~(blksize-1);
+                mtu = ALIGN(mtu + 2, blksize);
         } else {
                 /* The worst case. */
-                mtu += 2 + blksize;
+                u32 padsize = ((blksize - 1) & 7) + 1;
+                mtu = ALIGN(mtu + 2, padsize) + blksize - padsize;
         }
         if (esp->conf.padlen)
-                mtu = (mtu + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+                mtu = ALIGN(mtu, esp->conf.padlen);
 
         return mtu + x->props.header_len + esp->auth.icv_full_len;
 }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 2f589f24c093..563b442ffab8 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -666,7 +666,7 @@ slow_path:
                  */
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
-                if (frag_id) {
+                if (!frag_id) {
                         ipv6_select_ident(skb, fh);
                         frag_id = fh->identification;
                 } else
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 29fed6e58d0a..39a96c768102 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1393,7 +1393,7 @@ static void mld_sendpack(struct sk_buff *skb)
 
 static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
 {
-        return sizeof(struct mld2_grec) + 4*mld_scount(pmc,type,gdel,sdel);
+        return sizeof(struct mld2_grec) + 16 * mld_scount(pmc,type,gdel,sdel);
 }
 
 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
@@ -1968,7 +1968,7 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
         }
         pmc->mca_sources = NULL;
         pmc->mca_sfmode = MCAST_EXCLUDE;
-        pmc->mca_sfcount[MCAST_EXCLUDE] = 0;
+        pmc->mca_sfcount[MCAST_INCLUDE] = 0;
         pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
 }
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 555a31347eda..305d9ee6d7db 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1450,7 +1450,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 
 static void pndisc_redo(struct sk_buff *skb)
 {
-        ndisc_rcv(skb);
+        ndisc_recv_ns(skb);
         kfree_skb(skb);
 }
 
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 216fbe1ac65c..bb7ccfe33f23 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -209,6 +209,17 @@ config IP6_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_TARGET_NFQUEUE
+        tristate "NFQUEUE Target Support"
+        depends on IP_NF_IPTABLES
+        help
+          This Target replaced the old obsolete QUEUE target.
+
+          As opposed to QUEUE, it supports 65535 different queues,
+          not just one.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 #  if [ "$CONFIG_IP6_NF_FILTER" != "n" ]; then
 #    dep_tristate '    REJECT target support' CONFIG_IP6_NF_TARGET_REJECT $CONFIG_IP6_NF_FILTER
 #    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index bd9a16a5cbba..2b2c370e8b1c 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -21,9 +21,9 @@ obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
 obj-$(CONFIG_IP6_NF_TARGET_HL) += ip6t_HL.o
+obj-$(CONFIG_IP6_NF_TARGET_NFQUEUE) += ip6t_NFQUEUE.o
 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ip6t_NFQUEUE.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index aa11cf366efa..5027bbe6415e 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -238,8 +238,8 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 
         pmsg->packet_id       = (unsigned long )entry;
         pmsg->data_len        = data_len;
-        pmsg->timestamp_sec   = skb_tv_base.tv_sec + entry->skb->tstamp.off_sec;
-        pmsg->timestamp_usec  = skb_tv_base.tv_usec + entry->skb->tstamp.off_usec;
+        pmsg->timestamp_sec   = entry->skb->tstamp.off_sec;
+        pmsg->timestamp_usec  = entry->skb->tstamp.off_usec;
         pmsg->mark            = entry->skb->nfmark;
         pmsg->hook            = entry->info->hook;
         pmsg->hw_protocol     = entry->skb->protocol;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 1cb8adb2787f..21deec25a12b 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -28,6 +28,7 @@
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
 #include <linux/proc_fs.h>
+#include <linux/cpumask.h>
 
 #include <linux/netfilter_ipv6/ip6_tables.h>
 
@@ -950,8 +951,10 @@ translate_table(const char *name,
         }
 
         /* And one copy for every other CPU */
-        for (i = 1; i < num_possible_cpus(); i++) {
-                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size)*i,
+        for_each_cpu(i) {
+                if (i == 0)
+                        continue;
+                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
                        newinfo->entries,
                        SMP_ALIGN(newinfo->size));
         }
@@ -972,7 +975,7 @@ replace_table(struct ip6t_table *table,
                 struct ip6t_entry *table_base;
                 unsigned int i;
 
-                for (i = 0; i < num_possible_cpus(); i++) {
+                for_each_cpu(i) {
                         table_base =
                                 (void *)newinfo->entries
                                 + TABLE_OFFSET(newinfo, i);
@@ -1019,7 +1022,7 @@ get_counters(const struct ip6t_table_info *t,
         unsigned int cpu;
         unsigned int i;
 
-        for (cpu = 0; cpu < num_possible_cpus(); cpu++) {
+        for_each_cpu(cpu) {
                 i = 0;
                 IP6T_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
                                   t->size,
@@ -1153,7 +1156,8 @@ do_replace(void __user *user, unsigned int len)
                 return -ENOMEM;
 
         newinfo = vmalloc(sizeof(struct ip6t_table_info)
-                          + SMP_ALIGN(tmp.size) * num_possible_cpus());
+                          + SMP_ALIGN(tmp.size) *
+                                        (highest_possible_processor_id()+1));
         if (!newinfo)
                 return -ENOMEM;
 
@@ -1467,7 +1471,8 @@ int ip6t_register_table(struct ip6t_table *table,
                 = { 0, 0, 0, { 0 }, { 0 }, { } };
 
         newinfo = vmalloc(sizeof(struct ip6t_table_info)
-                          + SMP_ALIGN(repl->size) * num_possible_cpus());
+                          + SMP_ALIGN(repl->size) *
+                                        (highest_possible_processor_id()+1));
         if (!newinfo)
                 return -ENOMEM;
 
@@ -1955,6 +1960,57 @@ static void __exit fini(void)
 #endif
 }
 
+/*
+ * find specified header up to transport protocol header.
+ * If found target header, the offset to the header is set to *offset
+ * and return 0. otherwise, return -1.
+ *
+ * Notes: - non-1st Fragment Header isn't skipped.
+ *        - ESP header isn't skipped.
+ *        - The target header may be trancated.
+ */
+int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, u8 target)
+{
+        unsigned int start = (u8*)(skb->nh.ipv6h + 1) - skb->data;
+        u8 nexthdr = skb->nh.ipv6h->nexthdr;
+        unsigned int len = skb->len - start;
+
+        while (nexthdr != target) {
+                struct ipv6_opt_hdr _hdr, *hp;
+                unsigned int hdrlen;
+
+                if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE)
+                        return -1;
+                hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+                if (hp == NULL)
+                        return -1;
+                if (nexthdr == NEXTHDR_FRAGMENT) {
+                        unsigned short _frag_off, *fp;
+                        fp = skb_header_pointer(skb,
+                                                start+offsetof(struct frag_hdr,
+                                                               frag_off),
+                                                sizeof(_frag_off),
+                                                &_frag_off);
+                        if (fp == NULL)
+                                return -1;
+
+                        if (ntohs(*fp) & ~0x7)
+                                return -1;
+                        hdrlen = 8;
+                } else if (nexthdr == NEXTHDR_AUTH)
+                        hdrlen = (hp->hdrlen + 2) << 2; 
+                else
+                        hdrlen = ipv6_optlen(hp); 
+
+                nexthdr = hp->nexthdr;
+                len -= hdrlen;
+                start += hdrlen;
+        }
+
+        *offset = start;
+        return 0;
+}
+
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
@@ -1963,6 +2019,7 @@ EXPORT_SYMBOL(ip6t_unregister_match);
 EXPORT_SYMBOL(ip6t_register_target);
 EXPORT_SYMBOL(ip6t_unregister_target);
 EXPORT_SYMBOL(ip6t_ext_hdr);
+EXPORT_SYMBOL(ipv6_find_hdr);
 
 module_init(init);
 module_exit(fini);
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index d5b94f142bba..dde37793d20b 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -48,92 +48,21 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-        struct ip_auth_hdr *ah = NULL, _ah;
+        struct ip_auth_hdr *ah, _ah;
         const struct ip6t_ah *ahinfo = matchinfo;
-        unsigned int temp;
-        int len;
-        u8 nexthdr;
         unsigned int ptr;
         unsigned int hdrlen = 0;
 
-        /*DEBUGP("IPv6 AH entered\n");*/
-        /* if (opt->auth == 0) return 0;
-        * It does not filled on output */
-
-        /* type of the 1st exthdr */
-        nexthdr = skb->nh.ipv6h->nexthdr;
-        /* pointer to the 1st exthdr */
-        ptr = sizeof(struct ipv6hdr);
-        /* available length */
-        len = skb->len - ptr;
-        temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-                struct ipv6_opt_hdr _hdr, *hp;
-
-                DEBUGP("ipv6_ah header iteration \n");
-
-                /* Is there enough space for the next ext header? */
-                if (len < sizeof(struct ipv6_opt_hdr))
-                        return 0;
-                /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE)
-                        break;
-                /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP)
-                        break;
-
-                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-                BUG_ON(hp == NULL);
-
-                /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT)
-                        hdrlen = 8;
-                else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-                /* AH -> evaluate */
-                if (nexthdr == NEXTHDR_AUTH) {
-                        temp |= MASK_AH;
-                        break;
-                }
-
-                
-                /* set the flag */
-                switch (nexthdr) {
-                case NEXTHDR_HOP:
-                case NEXTHDR_ROUTING:
-                case NEXTHDR_FRAGMENT:
-                case NEXTHDR_AUTH:
-                case NEXTHDR_DEST:
-                        break;
-                default:
-                        DEBUGP("ipv6_ah match: unknown nextheader %u\n",nexthdr);
-                        return 0;
-                }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if (ptr > skb->len) {
-                        DEBUGP("ipv6_ah: new pointer too large! \n");
-                        break;
-                }
-        }
-
-        /* AH header not found */
-        if (temp != MASK_AH)
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH) < 0)
                 return 0;
 
-        if (len < sizeof(struct ip_auth_hdr)){
+        ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
+        if (ah == NULL) {
                 *hotdrop = 1;
                 return 0;
         }
 
-        ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
-        BUG_ON(ah == NULL);
+        hdrlen = (ah->hdrlen + 2) << 2;
 
         DEBUGP("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
         DEBUGP("RES %04X ", ah->reserved);
diff --git a/net/ipv6/netfilter/ip6t_dst.c b/net/ipv6/netfilter/ip6t_dst.c
index 540925e4a7a8..c450a635e54b 100644
--- a/net/ipv6/netfilter/ip6t_dst.c
+++ b/net/ipv6/netfilter/ip6t_dst.c
@@ -63,8 +63,6 @@ match(const struct sk_buff *skb,
        struct ipv6_opt_hdr _optsh, *oh;
        const struct ip6t_opts *optinfo = matchinfo;
        unsigned int temp;
-       unsigned int len;
-       u8 nexthdr;
        unsigned int ptr;
        unsigned int hdrlen = 0;
        unsigned int ret = 0;
@@ -72,97 +70,25 @@ match(const struct sk_buff *skb,
        u8 _optlen, *lp = NULL;
        unsigned int optlen;
        
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_opts header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* OPTS -> evaluate */
 #if HOPBYHOP
-                if (nexthdr == NEXTHDR_HOP) {
-                     temp |= MASK_HOPOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP) < 0)
 #else
-                if (nexthdr == NEXTHDR_DEST) {
-                     temp |= MASK_DSTOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST) < 0)
 #endif
-                     break;
-              }
-
+                return 0;
 
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_opts: new pointer is too large! \n");
-                        break;
-                }
-        }
-
-       /* OPTIONS header not found */
-#if HOPBYHOP
-       if ( temp != MASK_HOPOPTS ) return 0;
-#else
-       if ( temp != MASK_DSTOPTS ) return 0;
-#endif
-
-       if (len < (int)sizeof(struct ipv6_opt_hdr)){
+       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
+       if (oh == NULL){
                *hotdrop = 1;
                 return 0;
        }
 
-       if (len < hdrlen){
+       hdrlen = ipv6_optlen(oh);
+       if (skb->len - ptr < hdrlen){
                /* Packet smaller than it's length field */
                 return 0;
        }
 
-       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
-       BUG_ON(oh == NULL);
-
        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
 
        DEBUGP("len %02X %04X %02X ",
diff --git a/net/ipv6/netfilter/ip6t_esp.c b/net/ipv6/netfilter/ip6t_esp.c
index e39dd236fd8e..24bc0cde43a1 100644
--- a/net/ipv6/netfilter/ip6t_esp.c
+++ b/net/ipv6/netfilter/ip6t_esp.c
@@ -48,87 +48,22 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-        struct ip_esp_hdr _esp, *eh = NULL;
+        struct ip_esp_hdr _esp, *eh;
         const struct ip6t_esp *espinfo = matchinfo;
-        unsigned int temp;
-        int len;
-        u8 nexthdr;
         unsigned int ptr;
 
         /* Make sure this isn't an evil packet */
         /*DEBUGP("ipv6_esp entered \n");*/
 
-        /* type of the 1st exthdr */
-        nexthdr = skb->nh.ipv6h->nexthdr;
-        /* pointer to the 1st exthdr */
-        ptr = sizeof(struct ipv6hdr);
-        /* available length */
-        len = skb->len - ptr;
-        temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-                struct ipv6_opt_hdr _hdr, *hp;
-                int hdrlen;
-
-                DEBUGP("ipv6_esp header iteration \n");
-
-                /* Is there enough space for the next ext header? */
-                if (len < sizeof(struct ipv6_opt_hdr))
-                        return 0;
-                /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE)
-                        break;
-                /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                        temp |= MASK_ESP;
-                        break;
-                }
-
-                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-                BUG_ON(hp == NULL);
-
-                /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT)
-                        hdrlen = 8;
-                else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-                /* set the flag */
-                switch (nexthdr) {
-                case NEXTHDR_HOP:
-                case NEXTHDR_ROUTING:
-                case NEXTHDR_FRAGMENT:
-                case NEXTHDR_AUTH:
-                case NEXTHDR_DEST:
-                        break;
-                default:
-                        DEBUGP("ipv6_esp match: unknown nextheader %u\n",nexthdr);
-                        return 0;
-                }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if (ptr > skb->len) {
-                        DEBUGP("ipv6_esp: new pointer too large! \n");
-                        break;
-                }
-        }
-
-        /* ESP header not found */
-        if (temp != MASK_ESP)
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ESP) < 0)
                 return 0;
 
-        if (len < sizeof(struct ip_esp_hdr)) {
+        eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
+        if (eh == NULL) {
                 *hotdrop = 1;
                 return 0;
         }
 
-        eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
-        BUG_ON(eh == NULL);
-
         DEBUGP("IPv6 ESP SPI %u %08X\n", ntohl(eh->spi), ntohl(eh->spi));
 
         return (eh != NULL)
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 4bfa30a9bc80..085d5f8eea29 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -48,90 +48,18 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-       struct frag_hdr _frag, *fh = NULL;
+       struct frag_hdr _frag, *fh;
        const struct ip6t_frag *fraginfo = matchinfo;
-       unsigned int temp;
-       int len;
-       u8 nexthdr;
        unsigned int ptr;
-       unsigned int hdrlen = 0;
-
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_frag header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* FRAG -> evaluate */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                     temp |= MASK_FRAGMENT;
-                     break;
-              }
-
-
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_frag match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_frag: new pointer too large! \n");
-                        break;
-                }
-        }
-
-       /* FRAG header not found */
-       if ( temp != MASK_FRAGMENT ) return 0;
-
-       if (len < sizeof(struct frag_hdr)){
-               *hotdrop = 1;
-                return 0;
-       }
 
-       fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
-       BUG_ON(fh == NULL);
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT) < 0)
+                return 0;
+
+        fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
+        if (fh == NULL){
+                *hotdrop = 1;
+                return 0;
+        }
 
        DEBUGP("INFO %04X ", fh->frag_off);
        DEBUGP("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 27f3650d127e..1d09485111d0 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -63,8 +63,6 @@ match(const struct sk_buff *skb,
        struct ipv6_opt_hdr _optsh, *oh;
        const struct ip6t_opts *optinfo = matchinfo;
        unsigned int temp;
-       unsigned int len;
-       u8 nexthdr;
        unsigned int ptr;
        unsigned int hdrlen = 0;
        unsigned int ret = 0;
@@ -72,97 +70,25 @@ match(const struct sk_buff *skb,
        u8 _optlen, *lp = NULL;
        unsigned int optlen;
        
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_opts header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* OPTS -> evaluate */
 #if HOPBYHOP
-                if (nexthdr == NEXTHDR_HOP) {
-                     temp |= MASK_HOPOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP) < 0)
 #else
-                if (nexthdr == NEXTHDR_DEST) {
-                     temp |= MASK_DSTOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST) < 0)
 #endif
-                     break;
-              }
-
+                return 0;
 
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_opts: new pointer is too large! \n");
-                        break;
-                }
-        }
-
-       /* OPTIONS header not found */
-#if HOPBYHOP
-       if ( temp != MASK_HOPOPTS ) return 0;
-#else
-       if ( temp != MASK_DSTOPTS ) return 0;
-#endif
-
-       if (len < (int)sizeof(struct ipv6_opt_hdr)){
+       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
+       if (oh == NULL){
                *hotdrop = 1;
                 return 0;
        }
 
-       if (len < hdrlen){
+       hdrlen = ipv6_optlen(oh);
+       if (skb->len - ptr < hdrlen){
                /* Packet smaller than it's length field */
                 return 0;
        }
 
-       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
-       BUG_ON(oh == NULL);
-
        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
 
        DEBUGP("len %02X %04X %02X ",
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 2bb670037df3..beb2fd5cebbb 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -50,98 +50,29 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-       struct ipv6_rt_hdr _route, *rh = NULL;
+       struct ipv6_rt_hdr _route, *rh;
        const struct ip6t_rt *rtinfo = matchinfo;
        unsigned int temp;
-       unsigned int len;
-       u8 nexthdr;
        unsigned int ptr;
        unsigned int hdrlen = 0;
        unsigned int ret = 0;
        struct in6_addr *ap, _addr;
 
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING) < 0)
+                return 0;
 
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_rt header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* ROUTING -> evaluate */
-                if (nexthdr == NEXTHDR_ROUTING) {
-                     temp |= MASK_ROUTING;
-                     break;
-              }
-
-
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_rt match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_rt: new pointer is too large! \n");
-                        break;
-                }
-        }
-
-       /* ROUTING header not found */
-       if ( temp != MASK_ROUTING ) return 0;
-
-       if (len < (int)sizeof(struct ipv6_rt_hdr)){
+       rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
+       if (rh == NULL){
                *hotdrop = 1;
                 return 0;
        }
 
-       if (len < hdrlen){
+       hdrlen = ipv6_optlen(rh);
+       if (skb->len - ptr < hdrlen){
                /* Pcket smaller than its length field */
                 return 0;
        }
 
-       rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
-       BUG_ON(rh == NULL);
-
        DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
        DEBUGP("TYPE %04X ", rh->type);
        DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 5aa3691c578d..a1265a320b11 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -627,7 +627,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 
                         if (type && code) {
                                 get_user(fl->fl_icmp_type, type);
-                                __get_user(fl->fl_icmp_code, code);
+                                get_user(fl->fl_icmp_code, code);
                                 probed = 1;
                         }
                         break;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 80643e6b346b..d693cb988b78 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -209,9 +209,11 @@ static __inline__ void __tcp_v6_hash(struct sock *sk)
                 lock = &tcp_hashinfo.lhash_lock;
                 inet_listen_wlock(&tcp_hashinfo);
         } else {
-                sk->sk_hashent = inet6_sk_ehashfn(sk, tcp_hashinfo.ehash_size);
-                list = &tcp_hashinfo.ehash[sk->sk_hashent].chain;
-                lock = &tcp_hashinfo.ehash[sk->sk_hashent].lock;
+                unsigned int hash;
+                sk->sk_hash = hash = inet6_sk_ehashfn(sk);
+                hash &= (tcp_hashinfo.ehash_size - 1);
+                list = &tcp_hashinfo.ehash[hash].chain;
+                lock = &tcp_hashinfo.ehash[hash].lock;
                 write_lock(lock);
         }
 
@@ -322,13 +324,13 @@ static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
         const u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-        const int hash = inet6_ehashfn(daddr, inet->num, saddr, inet->dport,
-                                       tcp_hashinfo.ehash_size);
-        struct inet_ehash_bucket *head = &tcp_hashinfo.ehash[hash];
+        unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr, inet->dport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(&tcp_hashinfo, hash);
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
 
+        prefetch(head->chain.first);
         write_lock(&head->lock);
 
         /* Check TIME-WAIT sockets first. */
@@ -365,14 +367,14 @@ static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
 
         /* And established part... */
         sk_for_each(sk2, node, &head->chain) {
-                if (INET6_MATCH(sk2, saddr, daddr, ports, dif))
+                if (INET6_MATCH(sk2, hash, saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
 unique:
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
-        sk->sk_hashent = hash;
+        sk->sk_hash = hash;
         sock_prot_inc_use(sk->sk_prot);
         write_unlock(&head->lock);
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 69b146843a20..bf9519341fd3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -99,7 +99,7 @@ static int udp_v6_get_port(struct sock *sk, unsigned short snum)
                 next:;
                 }
                 result = best;
-                for(;; result += UDP_HTABLE_SIZE) {
+                for(i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++, result += UDP_HTABLE_SIZE) {
                         if (result > sysctl_local_port_range[1])
                                 result = sysctl_local_port_range[0]
                                         + ((result - sysctl_local_port_range[0]) &
@@ -107,6 +107,8 @@ static int udp_v6_get_port(struct sock *sk, unsigned short snum)
                         if (!udp_lport_inuse(result))
                                 break;
                 }
+                if (i >= (1 << 16) / UDP_HTABLE_SIZE)
+                        goto fail;
 gotit:
                 udp_port_rover = snum = result;
         } else {
@@ -405,9 +407,8 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
                                 continue;
 
                         if (!ipv6_addr_any(&np->rcv_saddr)) {
-                                if (ipv6_addr_equal(&np->rcv_saddr, loc_addr))
-                                        return s;
-                                continue;
+                                if (!ipv6_addr_equal(&np->rcv_saddr, loc_addr))
+                                        continue;
                         }
                         if(!inet6_mc_check(s, loc_addr, rmt_addr))
                                 continue;
@@ -640,6 +641,7 @@ static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int tclass = -1;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
+        int connected = 0;
 
         /* destination address check */
         if (sin6) {
@@ -749,6 +751,7 @@ do_udp_sendmsg:
                 fl->fl_ip_dport = inet->dport;
                 daddr = &np->daddr;
                 fl->fl6_flowlabel = np->flow_label;
+                connected = 1;
         }
 
         if (!fl->oif)
@@ -771,6 +774,7 @@ do_udp_sendmsg:
                 }
                 if (!(opt->opt_nflen|opt->opt_flen))
                         opt = NULL;
+                connected = 0;
         }
         if (opt == NULL)
                 opt = np->opt;
@@ -788,10 +792,13 @@ do_udp_sendmsg:
                 ipv6_addr_copy(&final, &fl->fl6_dst);
                 ipv6_addr_copy(&fl->fl6_dst, rt0->addr);
                 final_p = &final;
+                connected = 0;
         }
 
-        if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst))
+        if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst)) {
                 fl->oif = np->mcast_oif;
+                connected = 0;
+        }
 
         err = ip6_dst_lookup(sk, &dst, fl);
         if (err)
@@ -847,10 +854,16 @@ do_append_data:
         else if (!corkreq)
                 err = udp_v6_push_pending_frames(sk, up);
 
-        if (dst)
-                ip6_dst_store(sk, dst,
-                              ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
-                              &np->daddr : NULL);
+        if (dst) {
+                if (connected) {
+                        ip6_dst_store(sk, dst,
+                                      ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
+                                      &np->daddr : NULL);
+                } else {
+                        dst_release(dst);
+                }
+        }
+
         if (err > 0)
                 err = np->recverr ? net_xmit_errno(err) : 0;
         release_sock(sk);