21 files changed, 99 insertions, 163 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 0ade0c63fdf6..18fcb9fa518d 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -67,10 +67,6 @@ static struct packet_type vlan_packet_type = {
        .func = vlan_skb_recv, /* VLAN receive method */
 };
-/* Bits of netdev state that are propagated from real device to virtual */
-#define VLAN_LINK_STATE_MASK \
-        ((1<<__LINK_STATE_PRESENT)|(1<<__LINK_STATE_NOCARRIER)|(1<<__LINK_STATE_DORMANT))
 /* End of global variables definitions. */
 /*
@@ -479,7 +475,9 @@ static struct net_device *register_vlan_device(const char *eth_IF_name,
        new_dev->flags = real_dev->flags;
        new_dev->flags &= ~IFF_UP;
-        new_dev->state = real_dev->state & ~(1<<__LINK_STATE_START);
+        new_dev->state = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
+                                             (1<<__LINK_STATE_DORMANT))) |
+                         (1<<__LINK_STATE_PRESENT); 
        /* need 4 bytes for extra VLAN header info,
         * hope the underlying device can handle it.
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 77eab8f4c7fd..332dd8f436ea 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -55,6 +55,7 @@
 #define VERSION "1.8"
 static int disable_cfc = 0;
+static int channel_mtu = -1;
 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
 static struct task_struct *rfcomm_thread;
@@ -812,7 +813,10 @@ static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d
                pn->credits   = 0;
        }
-        pn->mtu = htobs(d->mtu);
+        if (cr && channel_mtu >= 0)
+                pn->mtu = htobs(channel_mtu);
+        else
+                pn->mtu = htobs(d->mtu);
        *ptr = __fcs(buf); ptr++;
@@ -1243,7 +1247,10 @@ static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
        d->priority = pn->priority;
-        d->mtu = s->mtu = btohs(pn->mtu);
+        d->mtu = btohs(pn->mtu);
+        if (cr && d->mtu > s->mtu)
+                d->mtu = s->mtu;
        return 0;
 }
@@ -1770,6 +1777,11 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
        s = rfcomm_session_add(nsock, BT_OPEN);
        if (s) {
                rfcomm_session_hold(s);
+                /* We should adjust MTU on incoming sessions.
+                 * L2CAP MTU minus UIH header and FCS. */
+                s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
                rfcomm_schedule(RFCOMM_SCHED_RX);
        } else
                sock_release(nsock);
@@ -2087,6 +2099,9 @@ module_exit(rfcomm_exit);
 module_param(disable_cfc, bool, 0644);
 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
+module_param(channel_mtu, int, 0644);
+MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
 module_param(l2cap_mtu, uint, 0644);
 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index cbc8a389a0a8..05b3de888243 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -61,6 +61,9 @@ static int brnf_filter_vlan_tagged = 1;
 #define brnf_filter_vlan_tagged 1
 #endif
+int brnf_deferred_hooks;
+EXPORT_SYMBOL_GPL(brnf_deferred_hooks);
 static __be16 inline vlan_proto(const struct sk_buff *skb)
 {
        return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
@@ -890,6 +893,8 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
                                return NF_ACCEPT;
                        else if (ip->version == 6 && !brnf_call_ip6tables)
                                return NF_ACCEPT;
+                        else if (!brnf_deferred_hooks)
+                                return NF_ACCEPT;
 #endif
                        if (hook == NF_IP_POST_ROUTING)
                                return NF_ACCEPT;
diff --git a/net/dccp/feat.h b/net/dccp/feat.h
index 6048373c7186..b44c45504fb6 100644
--- a/net/dccp/feat.h
+++ b/net/dccp/feat.h
@@ -26,4 +26,6 @@ extern void dccp_feat_clean(struct dccp_minisock *dmsk);
 extern int  dccp_feat_clone(struct sock *oldsk, struct sock *newsk);
 extern int  dccp_feat_init(struct dccp_minisock *dmsk);
+extern int  dccp_feat_default_sequence_window;
 #endif /* _DCCP_FEAT_H */
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index c3073e7e81d3..7f56f7e8f571 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -504,8 +504,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        ireq = inet_rsk(req);
        ireq->loc_addr = daddr;
        ireq->rmt_addr = saddr;
-        req->rcv_wnd    = 100; /* Fake, option parsing will get the
+        req->rcv_wnd    = dccp_feat_default_sequence_window;
-                                  right value */
        ireq->opt       = NULL;
        /* 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index ff42bc43263d..9f3d4d7cd0bf 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -31,6 +31,7 @@
 #include "dccp.h"
 #include "ipv6.h"
+#include "feat.h"
 /* Socket used for sending RSTs and ACKs */
 static struct socket *dccp_v6_ctl_socket;
@@ -707,8 +708,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        ireq = inet_rsk(req);
        ipv6_addr_copy(&ireq6->rmt_addr, &skb->nh.ipv6h->saddr);
        ipv6_addr_copy(&ireq6->loc_addr, &skb->nh.ipv6h->daddr);
-        req->rcv_wnd    = 100; /* Fake, option parsing will get the
+        req->rcv_wnd    = dccp_feat_default_sequence_window;
-                                  right value */
        ireq6->pktopts  = NULL;
        if (ipv6_opt_accepted(sk, skb) ||
diff --git a/net/dccp/options.c b/net/dccp/options.c
index c3cda1e39aa8..daf72bb671f0 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -29,6 +29,8 @@ int dccp_feat_default_ack_ratio	      = DCCPF_INITIAL_ACK_RATIO;
 int dccp_feat_default_send_ack_vector = DCCPF_INITIAL_SEND_ACK_VECTOR;
 int dccp_feat_default_send_ndp_count  = DCCPF_INITIAL_SEND_NDP_COUNT;
+EXPORT_SYMBOL_GPL(dccp_feat_default_sequence_window);
 void dccp_minisock_init(struct dccp_minisock *dmsk)
 {
        dmsk->dccpms_sequence_window = dccp_feat_default_sequence_window;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 184c78ca79e6..212734ca238f 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -429,7 +429,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
        }
        /* Remove any debris in the socket control block */
-        memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
+        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
        return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL,
                       ip_rcv_finish);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9ccacf57f08b..85893eef6b16 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1578,6 +1578,7 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
        cache = ipmr_cache_find(rt->rt_src, rt->rt_dst);
        if (cache==NULL) {
+                struct sk_buff *skb2;
                struct net_device *dev;
                int vif;
@@ -1591,12 +1592,18 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
                        read_unlock(&mrt_lock);
                        return -ENODEV;
                }
-                skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
+                skb2 = skb_clone(skb, GFP_ATOMIC);
-                skb->nh.iph->ihl = sizeof(struct iphdr)>>2;
+                if (!skb2) {
-                skb->nh.iph->saddr = rt->rt_src;
+                        read_unlock(&mrt_lock);
-                skb->nh.iph->daddr = rt->rt_dst;
+                        return -ENOMEM;
-                skb->nh.iph->version = 0;
+                }
-                err = ipmr_cache_unresolved(vif, skb);
+                skb2->nh.raw = skb_push(skb2, sizeof(struct iphdr));
+                skb2->nh.iph->ihl = sizeof(struct iphdr)>>2;
+                skb2->nh.iph->saddr = rt->rt_src;
+                skb2->nh.iph->daddr = rt->rt_dst;
+                skb2->nh.iph->version = 0;
+                err = ipmr_cache_unresolved(vif, skb2);
                read_unlock(&mrt_lock);
                return err;
        }
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index af35235672d5..9a39e2969712 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1200,7 +1200,7 @@ static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
        tuple.dst.protonum = IPPROTO_TCP;
        exp = __ip_conntrack_expect_find(&tuple);
-        if (exp->master == ct)
+        if (exp && exp->master == ct)
                return exp;
        return NULL;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 7bd3c22003a2..7a9fa04a467a 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -534,6 +534,8 @@ static struct nf_hook_ops ip_conntrack_ops[] = {
 /* Sysctl support */
+int ip_conntrack_checksum = 1;
 #ifdef CONFIG_SYSCTL
 /* From ip_conntrack_core.c */
@@ -568,8 +570,6 @@ extern unsigned int ip_ct_generic_timeout;
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
-int ip_conntrack_checksum = 1;
 static struct ctl_table_header *ip_ct_sysctl_header;
 static ctl_table ip_ct_sysctl_table[] = {
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index 0b1b416759cc..18b7fbdccb61 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1255,9 +1255,9 @@ static int help(struct sk_buff **pskb,
        struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl);
        /* SNMP replies and originating SNMP traps get mangled */
-        if (udph->source == ntohs(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
+        if (udph->source == htons(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
                return NF_ACCEPT;
-        if (udph->dest == ntohs(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
+        if (udph->dest == htons(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
                return NF_ACCEPT;
        /* No NAT? */
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bd221ec3f81e..62b2762a2420 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -609,6 +609,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (sin) {
                sin->sin_family = AF_INET;
                sin->sin_addr.s_addr = skb->nh.iph->saddr;
+                sin->sin_port = 0;
                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
        }
        if (inet->cmsg_flags)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index df8f051c0fce..25c2a9e03895 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -71,6 +71,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                goto out;
        }
+        memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
        /*
         * Store incoming device index. When the packet will
         * be queued, we cannot refer to skb->dev anymore.
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index fa1ce0ae123e..d57e61ce4a7d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -411,6 +411,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        /* Copy the address. */
        if (sin6) {
                sin6->sin6_family = AF_INET6;
+                sin6->sin6_port = 0;
                ipv6_addr_copy(&sin6->sin6_addr, &skb->nh.ipv6h->saddr);
                sin6->sin6_flowinfo = 0;
                sin6->sin6_scope_id = 0;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 6b44fe8516c3..c8f9369c2a87 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -31,27 +31,6 @@
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
-#ifdef CONFIG_IPV6_XFRM6_TUNNEL_DEBUG
-# define X6TDEBUG       3
-#else
-# define X6TDEBUG       1
-#endif
-#define X6TPRINTK(fmt, args...)         printk(fmt, ## args)
-#define X6TNOPRINTK(fmt, args...)       do { ; } while(0)
-#if X6TDEBUG >= 1
-# define X6TPRINTK1     X6TPRINTK
-#else
-# define X6TPRINTK1     X6TNOPRINTK
-#endif
-#if X6TDEBUG >= 3
-# define X6TPRINTK3     X6TPRINTK
-#else
-# define X6TPRINTK3     X6TNOPRINTK
-#endif
 /*
 * xfrm_tunnel_spi things are for allocating unique id ("spi") 
 * per xfrm_address_t.
@@ -62,15 +41,8 @@ struct xfrm6_tunnel_spi {
        xfrm_address_t addr;
        u32 spi;
        atomic_t refcnt;
-#ifdef XFRM6_TUNNEL_SPI_MAGIC
-        u32 magic;
-#endif
 };
-#ifdef CONFIG_IPV6_XFRM6_TUNNEL_DEBUG
-# define XFRM6_TUNNEL_SPI_MAGIC 0xdeadbeef
-#endif
 static DEFINE_RWLOCK(xfrm6_tunnel_spi_lock);
 static u32 xfrm6_tunnel_spi;
@@ -86,43 +58,15 @@ static kmem_cache_t *xfrm6_tunnel_spi_kmem __read_mostly;
 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
-#ifdef XFRM6_TUNNEL_SPI_MAGIC
-static int x6spi_check_magic(const struct xfrm6_tunnel_spi *x6spi,
-                             const char *name)
-{
-        if (unlikely(x6spi->magic != XFRM6_TUNNEL_SPI_MAGIC)) {
-                X6TPRINTK3(KERN_DEBUG "%s(): x6spi object "
-                                      "at %p has corrupted magic %08x "
-                                      "(should be %08x)\n",
-                           name, x6spi, x6spi->magic, XFRM6_TUNNEL_SPI_MAGIC);
-                return -1;
-        }
-        return 0;
-}
-#else
-static int inline x6spi_check_magic(const struct xfrm6_tunnel_spi *x6spi,
-                                    const char *name)
-{
-        return 0;
-}
-#endif
-#define X6SPI_CHECK_MAGIC(x6spi) x6spi_check_magic((x6spi), __FUNCTION__)
 static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
        unsigned h;
-        X6TPRINTK3(KERN_DEBUG "%s(addr=%p)\n", __FUNCTION__, addr);
        h = addr->a6[0] ^ addr->a6[1] ^ addr->a6[2] ^ addr->a6[3];
        h ^= h >> 16;
        h ^= h >> 8;
        h &= XFRM6_TUNNEL_SPI_BYADDR_HSIZE - 1;
-        X6TPRINTK3(KERN_DEBUG "%s() = %u\n", __FUNCTION__, h);
        return h;
 }
@@ -136,19 +80,13 @@ static int xfrm6_tunnel_spi_init(void)
 {
        int i;
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
        xfrm6_tunnel_spi = 0;
        xfrm6_tunnel_spi_kmem = kmem_cache_create("xfrm6_tunnel_spi",
                                                  sizeof(struct xfrm6_tunnel_spi),
                                                  0, SLAB_HWCACHE_ALIGN,
                                                  NULL, NULL);
-        if (!xfrm6_tunnel_spi_kmem) {
+        if (!xfrm6_tunnel_spi_kmem)
-                X6TPRINTK1(KERN_ERR
-                           "%s(): failed to allocate xfrm6_tunnel_spi_kmem\n",
-                           __FUNCTION__);
                return -ENOMEM;
-        }
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
                INIT_HLIST_HEAD(&xfrm6_tunnel_spi_byaddr[i]);
@@ -161,22 +99,16 @@ static void xfrm6_tunnel_spi_fini(void)
 {
        int i;
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) {
                if (!hlist_empty(&xfrm6_tunnel_spi_byaddr[i]))
-                        goto err;
+                        return;
        }
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++) {
                if (!hlist_empty(&xfrm6_tunnel_spi_byspi[i]))
-                        goto err;
+                        return;
        }
        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
        xfrm6_tunnel_spi_kmem = NULL;
-        return;
-err:
-        X6TPRINTK1(KERN_ERR "%s(): table is not empty\n", __FUNCTION__);
-        return;
 }
 static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
@@ -184,19 +116,13 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        hlist_for_each_entry(x6spi, pos,
                             &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                             list_byaddr) {
-                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
+                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0)
-                        X6SPI_CHECK_MAGIC(x6spi);
-                        X6TPRINTK3(KERN_DEBUG "%s() = %p(%u)\n", __FUNCTION__, x6spi, x6spi->spi);
                        return x6spi;
-                }
        }
-        X6TPRINTK3(KERN_DEBUG "%s() = NULL(0)\n", __FUNCTION__);
        return NULL;
 }
@@ -205,8 +131,6 @@ u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        read_lock_bh(&xfrm6_tunnel_spi_lock);
        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
        spi = x6spi ? x6spi->spi : 0;
@@ -223,8 +147,6 @@ static u32 __xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
        struct hlist_node *pos;
        unsigned index;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        if (xfrm6_tunnel_spi < XFRM6_TUNNEL_SPI_MIN ||
            xfrm6_tunnel_spi >= XFRM6_TUNNEL_SPI_MAX)
                xfrm6_tunnel_spi = XFRM6_TUNNEL_SPI_MIN;
@@ -258,18 +180,10 @@ try_next_2:;
        spi = 0;
        goto out;
 alloc_spi:
-        X6TPRINTK3(KERN_DEBUG "%s(): allocate new spi for " NIP6_FMT "\n",
-                              __FUNCTION__, 
-                              NIP6(*(struct in6_addr *)saddr));
        x6spi = kmem_cache_alloc(xfrm6_tunnel_spi_kmem, SLAB_ATOMIC);
-        if (!x6spi) {
+        if (!x6spi)
-                X6TPRINTK1(KERN_ERR "%s(): kmem_cache_alloc() failed\n", 
-                           __FUNCTION__);
                goto out;
-        }
-#ifdef XFRM6_TUNNEL_SPI_MAGIC
-        x6spi->magic = XFRM6_TUNNEL_SPI_MAGIC;
-#endif
        memcpy(&x6spi->addr, saddr, sizeof(x6spi->addr));
        x6spi->spi = spi;
        atomic_set(&x6spi->refcnt, 1);
@@ -278,9 +192,7 @@ alloc_spi:
        index = xfrm6_tunnel_spi_hash_byaddr(saddr);
        hlist_add_head(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
-        X6SPI_CHECK_MAGIC(x6spi);
 out:
-        X6TPRINTK3(KERN_DEBUG "%s() = %u\n", __FUNCTION__, spi);
        return spi;
 }
@@ -289,8 +201,6 @@ u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        write_lock_bh(&xfrm6_tunnel_spi_lock);
        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
        if (x6spi) {
@@ -300,8 +210,6 @@ u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
                spi = __xfrm6_tunnel_alloc_spi(saddr);
        write_unlock_bh(&xfrm6_tunnel_spi_lock);
-        X6TPRINTK3(KERN_DEBUG "%s() = %u\n", __FUNCTION__, spi);
        return spi;
 }
@@ -312,8 +220,6 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos, *n;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        write_lock_bh(&xfrm6_tunnel_spi_lock);
        hlist_for_each_entry_safe(x6spi, pos, n, 
@@ -321,12 +227,6 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
                                  list_byaddr)
        {
                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
-                        X6TPRINTK3(KERN_DEBUG "%s(): x6spi object for " NIP6_FMT 
-                                              " found at %p\n",
-                                   __FUNCTION__, 
-                                   NIP6(*(struct in6_addr *)saddr),
-                                   x6spi);
-                        X6SPI_CHECK_MAGIC(x6spi);
                        if (atomic_dec_and_test(&x6spi->refcnt)) {
                                hlist_del(&x6spi->list_byaddr);
                                hlist_del(&x6spi->list_byspi);
@@ -377,20 +277,14 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                case ICMPV6_ADDR_UNREACH:
                case ICMPV6_PORT_UNREACH:
                default:
-                        X6TPRINTK3(KERN_DEBUG
-                                   "xfrm6_tunnel: Destination Unreach.\n");
                        break;
                }
                break;
        case ICMPV6_PKT_TOOBIG:
-                        X6TPRINTK3(KERN_DEBUG 
-                                   "xfrm6_tunnel: Packet Too Big.\n");
                break;
        case ICMPV6_TIME_EXCEED:
                switch (code) {
                case ICMPV6_EXC_HOPLIMIT:
-                        X6TPRINTK3(KERN_DEBUG
-                                   "xfrm6_tunnel: Too small Hoplimit.\n");
                        break;
                case ICMPV6_EXC_FRAGTIME:
                default: 
@@ -447,22 +341,14 @@ static struct xfrm6_tunnel xfrm6_tunnel_handler = {
 static int __init xfrm6_tunnel_init(void)
 {
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
+        if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0)
-        if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0) {
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel init: can't add xfrm type\n");
                return -EAGAIN;
-        }
        if (xfrm6_tunnel_register(&xfrm6_tunnel_handler)) {
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel init(): can't add handler\n");
                xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
                return -EAGAIN;
        }
        if (xfrm6_tunnel_spi_init() < 0) {
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel init: failed to initialize spi\n");
                xfrm6_tunnel_deregister(&xfrm6_tunnel_handler);
                xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
                return -EAGAIN;
@@ -472,15 +358,9 @@ static int __init xfrm6_tunnel_init(void)
 static void __exit xfrm6_tunnel_fini(void)
 {
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
        xfrm6_tunnel_spi_fini();
-        if (xfrm6_tunnel_deregister(&xfrm6_tunnel_handler))
+        xfrm6_tunnel_deregister(&xfrm6_tunnel_handler);
-                X6TPRINTK1(KERN_ERR 
+        xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
-                           "xfrm6_tunnel close: can't remove handler\n");
-        if (xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6) < 0)
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel close: can't remove xfrm type\n");
 }
 module_init(xfrm6_tunnel_init);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 42a178aa30f9..a9894ddfd72a 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -386,8 +386,8 @@ config NETFILTER_XT_MATCH_REALM
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 config NETFILTER_XT_MATCH_SCTP
-        tristate  '"sctp" protocol match support'
+        tristate  '"sctp" protocol match support (EXPERIMENTAL)'
-        depends on NETFILTER_XTABLES
+        depends on NETFILTER_XTABLES && EXPERIMENTAL
        help
          With this option enabled, you will be able to use the 
          `sctp' match in order to match on SCTP source/destination ports
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 5fcab2ef231f..4ef836699962 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -428,6 +428,8 @@ static struct file_operations ct_cpu_seq_fops = {
 /* Sysctl support */
+int nf_conntrack_checksum = 1;
 #ifdef CONFIG_SYSCTL
 /* From nf_conntrack_core.c */
@@ -459,8 +461,6 @@ extern unsigned int nf_ct_generic_timeout;
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
-int nf_conntrack_checksum = 1;
 static struct ctl_table_header *nf_ct_sysctl_header;
 static ctl_table nf_ct_sysctl_table[] = {
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index bb6fcee452ca..662a869593bf 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -219,21 +219,20 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
        switch (verdict & NF_VERDICT_MASK) {
        case NF_ACCEPT:
+        case NF_STOP:
                info->okfn(skb);
+        case NF_STOLEN:
                break;
        case NF_QUEUE:
                if (!nf_queue(&skb, elem, info->pf, info->hook, 
                              info->indev, info->outdev, info->okfn,
                              verdict >> NF_VERDICT_BITS))
                        goto next_hook;
                break;
+        default:
+                kfree_skb(skb);
        }
        rcu_read_unlock();
-        if (verdict == NF_DROP)
-                kfree_skb(skb);
        kfree(info);
        return;
 }
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 5fe4c9df17f5..a9f4f6f3c628 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -113,6 +113,21 @@ checkentry(const char *tablename,
        if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
            info->bitmask & ~XT_PHYSDEV_OP_MASK)
                return 0;
+        if (brnf_deferred_hooks == 0 &&
+            info->bitmask & XT_PHYSDEV_OP_OUT &&
+            (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
+             info->invert & XT_PHYSDEV_OP_BRIDGED) &&
+            hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
+                         (1 << NF_IP_POST_ROUTING))) {
+                printk(KERN_WARNING "physdev match: using --physdev-out in the "
+                       "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
+                       "traffic is deprecated and breaks other things, it will "
+                       "be removed in January 2007. See Documentation/"
+                       "feature-removal-schedule.txt for details. This doesn't "
+                       "affect you in case you're using it for purely bridged "
+                       "traffic.\n");
+                brnf_deferred_hooks = 1;
+        }
        return 1;
 }
diff --git a/net/netfilter/xt_pkttype.c b/net/netfilter/xt_pkttype.c
index 3ac703b5cb8f..d2f5320a80bf 100644
--- a/net/netfilter/xt_pkttype.c
+++ b/net/netfilter/xt_pkttype.c
@@ -9,6 +9,8 @@
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
+#include <linux/in.h>
+#include <linux/ip.h>
 #include <linux/netfilter/xt_pkttype.h>
 #include <linux/netfilter/x_tables.h>
@@ -28,9 +30,17 @@ static int match(const struct sk_buff *skb,
      unsigned int protoff,
      int *hotdrop)
 {
+        u_int8_t type;
        const struct xt_pkttype_info *info = matchinfo;
-        return (skb->pkt_type == info->pkttype) ^ info->invert;
+        if (skb->pkt_type == PACKET_LOOPBACK)
+                type = (MULTICAST(skb->nh.iph->daddr)
+                        ? PACKET_MULTICAST
+                        : PACKET_BROADCAST);
+        else
+                type = skb->pkt_type;
+        return (type == info->pkttype) ^ info->invert;
 }
 static struct xt_match pkttype_match = {