23 files changed, 432 insertions, 282 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index ac47ba2ba028..bd221ad52eaf 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -34,6 +34,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_arp.h>
 #include <linux/in_route.h>
+#include <linux/inetdevice.h>
 
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -221,10 +222,14 @@ static void __br_dnat_complain(void)
  *
  * Otherwise, the packet is considered to be routed and we just
  * change the destination MAC address so that the packet will
- * later be passed up to the IP stack to be routed.
+ * later be passed up to the IP stack to be routed. For a redirected
+ * packet, ip_route_input() will give back the localhost as output device,
+ * which differs from the bridge device.
  *
  * Let us now consider the case that ip_route_input() fails:
  *
+ * This can be because the destination address is martian, in which case
+ * the packet will be dropped.
  * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
  * will fail, while __ip_route_output_key() will return success. The source
  * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
@@ -237,7 +242,8 @@ static void __br_dnat_complain(void)
  *
  * --Lennert, 20020411
  * --Bart, 20020416 (updated)
- * --Bart, 20021007 (updated) */
+ * --Bart, 20021007 (updated)
+ * --Bart, 20062711 (updated) */
 static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
 {
         if (skb->pkt_type == PACKET_OTHERHOST) {
@@ -264,15 +270,15 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
         struct net_device *dev = skb->dev;
         struct iphdr *iph = skb->nh.iph;
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
+        int err;
 
         if (nf_bridge->mask & BRNF_PKT_TYPE) {
                 skb->pkt_type = PACKET_OTHERHOST;
                 nf_bridge->mask ^= BRNF_PKT_TYPE;
         }
         nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
-
         if (dnat_took_place(skb)) {
-                if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev)) {
+                if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
                         struct rtable *rt;
                         struct flowi fl = {
                                 .nl_u = {
@@ -283,19 +289,33 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
                                 },
                                 .proto = 0,
                         };
+                        struct in_device *in_dev = in_dev_get(dev);
+
+                        /* If err equals -EHOSTUNREACH the error is due to a
+                         * martian destination or due to the fact that
+                         * forwarding is disabled. For most martian packets,
+                         * ip_route_output_key() will fail. It won't fail for 2 types of
+                         * martian destinations: loopback destinations and destination
+                         * 0.0.0.0. In both cases the packet will be dropped because the
+                         * destination is the loopback device and not the bridge. */
+                        if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
+                                goto free_skb;
 
                         if (!ip_route_output_key(&rt, &fl)) {
                                 /* - Bridged-and-DNAT'ed traffic doesn't
-                                 *   require ip_forwarding.
-                                 * - Deal with redirected traffic. */
-                                if (((struct dst_entry *)rt)->dev == dev ||
-                                    rt->rt_type == RTN_LOCAL) {
+                                 *   require ip_forwarding. */
+                                if (((struct dst_entry *)rt)->dev == dev) {
                                         skb->dst = (struct dst_entry *)rt;
                                         goto bridged_dnat;
                                 }
+                                /* we are sure that forwarding is disabled, so printing
+                                 * this message is no problem. Note that the packet could
+                                 * still have a martian destination address, in which case
+                                 * the packet could be dropped even if forwarding were enabled */
                                 __br_dnat_complain();
                                 dst_release((struct dst_entry *)rt);
                         }
+free_skb:
                         kfree_skb(skb);
                         return 0;
                 } else {
diff --git a/net/core/wireless.c b/net/core/wireless.c
index cb1b8728d7ee..f69ab7b4408e 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -2130,7 +2130,7 @@ int iw_handler_set_spy(struct net_device *	dev,
          * The rtnl_lock() make sure we don't race with the other iw_handlers.
          * This make sure wireless_spy_update() "see" that the spy list
          * is temporarily disabled. */
-        wmb();
+        smp_wmb();
 
         /* Are there are addresses to copy? */
         if(wrqu->data.length > 0) {
@@ -2159,7 +2159,7 @@ int iw_handler_set_spy(struct net_device *	dev,
         }
 
         /* Make sure above is updated before re-enabling */
-        wmb();
+        smp_wmb();
 
         /* Enable addresses */
         spydata->spy_number = wrqu->data.length;
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index e28330aa4139..9f414e35c488 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -178,7 +178,6 @@ void inet_twdr_hangman(unsigned long data)
         need_timer = 0;
         if (inet_twdr_do_twkill_work(twdr, twdr->slot)) {
                 twdr->thread_slots |= (1 << twdr->slot);
-                mb();
                 schedule_work(&twdr->twkill_work);
                 need_timer = 1;
         } else {
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 413c2d0a1f3d..71b76ade00e1 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -375,6 +375,13 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                             && unconditional(&e->arp)) {
                                 unsigned int oldpos, size;
 
+                                if (t->verdict < -NF_MAX_VERDICT - 1) {
+                                        duprintf("mark_source_chains: bad "
+                                                "negative verdict (%i)\n",
+                                                                t->verdict);
+                                        return 0;
+                                }
+
                                 /* Return: backtrack through the last
                                  * big jump.
                                  */
@@ -404,6 +411,14 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 if (strcmp(t->target.u.user.name,
                                            ARPT_STANDARD_TARGET) == 0
                                     && newpos >= 0) {
+                                        if (newpos > newinfo->size -
+                                                sizeof(struct arpt_entry)) {
+                                                duprintf("mark_source_chains: "
+                                                        "bad verdict (%i)\n",
+                                                                newpos);
+                                                return 0;
+                                        }
+
                                         /* This a jump; chase it. */
                                         duprintf("Jump rule %u -> %u\n",
                                                  pos, newpos);
@@ -426,8 +441,6 @@ static int mark_source_chains(struct xt_table_info *newinfo,
 static inline int standard_check(const struct arpt_entry_target *t,
                                  unsigned int max_offset)
 {
-        struct arpt_standard_target *targ = (void *)t;
-
         /* Check standard info. */
         if (t->u.target_size
             != ARPT_ALIGN(sizeof(struct arpt_standard_target))) {
@@ -437,18 +450,6 @@ static inline int standard_check(const struct arpt_entry_target *t,
                 return 0;
         }
 
-        if (targ->verdict >= 0
-            && targ->verdict > max_offset - sizeof(struct arpt_entry)) {
-                duprintf("arpt_standard_check: bad verdict (%i)\n",
-                         targ->verdict);
-                return 0;
-        }
-
-        if (targ->verdict < -NF_MAX_VERDICT - 1) {
-                duprintf("arpt_standard_check: bad negative verdict (%i)\n",
-                         targ->verdict);
-                return 0;
-        }
         return 1;
 }
 
@@ -627,18 +628,20 @@ static int translate_table(const char *name,
                 }
         }
 
+        if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
+                duprintf("Looping hook\n");
+                return -ELOOP;
+        }
+
         /* Finally, each sanity check must pass */
         i = 0;
         ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
                                  check_entry, name, size, &i);
 
-        if (ret != 0)
-                goto cleanup;
-
-        ret = -ELOOP;
-        if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
-                duprintf("Looping hook\n");
-                goto cleanup;
+        if (ret != 0) {
+                ARPT_ENTRY_ITERATE(entry0, newinfo->size,
+                                cleanup_entry, &i);
+                return ret;
         }
 
         /* And one copy for every other CPU */
@@ -647,9 +650,6 @@ static int translate_table(const char *name,
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
 
-        return 0;
-cleanup:
-        ARPT_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 8a455439b128..0ff2956d35e5 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -401,6 +401,13 @@ mark_source_chains(struct xt_table_info *newinfo,
                             && unconditional(&e->ip)) {
                                 unsigned int oldpos, size;
 
+                                if (t->verdict < -NF_MAX_VERDICT - 1) {
+                                        duprintf("mark_source_chains: bad "
+                                                "negative verdict (%i)\n",
+                                                                t->verdict);
+                                        return 0;
+                                }
+
                                 /* Return: backtrack through the last
                                    big jump. */
                                 do {
@@ -438,6 +445,13 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 if (strcmp(t->target.u.user.name,
                                            IPT_STANDARD_TARGET) == 0
                                     && newpos >= 0) {
+                                        if (newpos > newinfo->size -
+                                                sizeof(struct ipt_entry)) {
+                                                duprintf("mark_source_chains: "
+                                                        "bad verdict (%i)\n",
+                                                                newpos);
+                                                return 0;
+                                        }
                                         /* This a jump; chase it. */
                                         duprintf("Jump rule %u -> %u\n",
                                                  pos, newpos);
@@ -470,27 +484,6 @@ cleanup_match(struct ipt_entry_match *m, unsigned int *i)
 }
 
 static inline int
-standard_check(const struct ipt_entry_target *t,
-               unsigned int max_offset)
-{
-        struct ipt_standard_target *targ = (void *)t;
-
-        /* Check standard info. */
-        if (targ->verdict >= 0
-            && targ->verdict > max_offset - sizeof(struct ipt_entry)) {
-                duprintf("ipt_standard_check: bad verdict (%i)\n",
-                         targ->verdict);
-                return 0;
-        }
-        if (targ->verdict < -NF_MAX_VERDICT - 1) {
-                duprintf("ipt_standard_check: bad negative verdict (%i)\n",
-                         targ->verdict);
-                return 0;
-        }
-        return 1;
-}
-
-static inline int
 check_match(struct ipt_entry_match *m,
             const char *name,
             const struct ipt_ip *ip,
@@ -576,12 +569,7 @@ check_entry(struct ipt_entry *e, const char *name, unsigned int size,
         if (ret)
                 goto err;
 
-        if (t->u.kernel.target == &ipt_standard_target) {
-                if (!standard_check(t, size)) {
-                        ret = -EINVAL;
-                        goto err;
-                }
-        } else if (t->u.kernel.target->checkentry
+        if (t->u.kernel.target->checkentry
                    && !t->u.kernel.target->checkentry(name, e, target, t->data,
                                                       e->comefrom)) {
                 duprintf("ip_tables: check failed for `%s'.\n",
@@ -718,17 +706,19 @@ translate_table(const char *name,
                 }
         }
 
+        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+                return -ELOOP;
+
         /* Finally, each sanity check must pass */
         i = 0;
         ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
                                 check_entry, name, size, &i);
 
-        if (ret != 0)
-                goto cleanup;
-
-        ret = -ELOOP;
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
-                goto cleanup;
+        if (ret != 0) {
+                IPT_ENTRY_ITERATE(entry0, newinfo->size,
+                                cleanup_entry, &i);
+                return ret;
+        }
 
         /* And one copy for every other CPU */
         for_each_possible_cpu(i) {
@@ -736,9 +726,6 @@ translate_table(const char *name,
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
 
-        return 0;
-cleanup:
-        IPT_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
         return ret;
 }
 
@@ -1529,25 +1516,8 @@ static inline int compat_copy_match_from_user(struct ipt_entry_match *m,
         void **dstptr, compat_uint_t *size, const char *name,
         const struct ipt_ip *ip, unsigned int hookmask)
 {
-        struct ipt_entry_match *dm;
-        struct ipt_match *match;
-        int ret;
-
-        dm = (struct ipt_entry_match *)*dstptr;
-        match = m->u.kernel.match;
         xt_compat_match_from_user(m, dstptr, size);
-
-        ret = xt_check_match(match, AF_INET, dm->u.match_size - sizeof(*dm),
-                             name, hookmask, ip->proto,
-                             ip->invflags & IPT_INV_PROTO);
-        if (!ret && m->u.kernel.match->checkentry
-            && !m->u.kernel.match->checkentry(name, ip, match, dm->data,
-                                              hookmask)) {
-                duprintf("ip_tables: check failed for `%s'.\n",
-                         m->u.kernel.match->name);
-                ret = -EINVAL;
-        }
-        return ret;
+        return 0;
 }
 
 static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
@@ -1569,7 +1539,7 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
         ret = IPT_MATCH_ITERATE(e, compat_copy_match_from_user, dstptr, size,
                         name, &de->ip, de->comefrom);
         if (ret)
-                goto err;
+                return ret;
         de->target_offset = e->target_offset - (origsize - *size);
         t = ipt_get_target(e);
         target = t->u.kernel.target;
@@ -1582,31 +1552,62 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
                 if ((unsigned char *)de - base < newinfo->underflow[h])
                         newinfo->underflow[h] -= origsize - *size;
         }
+        return ret;
+}
+
+static inline int compat_check_match(struct ipt_entry_match *m, const char *name,
+                                const struct ipt_ip *ip, unsigned int hookmask)
+{
+        struct ipt_match *match;
+        int ret;
+
+        match = m->u.kernel.match;
+        ret = xt_check_match(match, AF_INET, m->u.match_size - sizeof(*m),
+                             name, hookmask, ip->proto,
+                             ip->invflags & IPT_INV_PROTO);
+        if (!ret && m->u.kernel.match->checkentry
+            && !m->u.kernel.match->checkentry(name, ip, match, m->data,
+                                              hookmask)) {
+                duprintf("ip_tables: compat: check failed for `%s'.\n",
+                         m->u.kernel.match->name);
+                ret = -EINVAL;
+        }
+        return ret;
+}
+
+static inline int compat_check_target(struct ipt_entry *e, const char *name)
+{
+        struct ipt_entry_target *t;
+        struct ipt_target *target;
+        int ret;
 
-        t = ipt_get_target(de);
+        t = ipt_get_target(e);
         target = t->u.kernel.target;
         ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
                               name, e->comefrom, e->ip.proto,
                               e->ip.invflags & IPT_INV_PROTO);
-        if (ret)
-                goto err;
-
-        ret = -EINVAL;
-        if (t->u.kernel.target == &ipt_standard_target) {
-                if (!standard_check(t, *size))
-                        goto err;
-        } else if (t->u.kernel.target->checkentry
-                   && !t->u.kernel.target->checkentry(name, de, target,
-                                                      t->data, de->comefrom)) {
+        if (!ret && t->u.kernel.target->checkentry
+                   && !t->u.kernel.target->checkentry(name, e, target,
+                                                      t->data, e->comefrom)) {
                 duprintf("ip_tables: compat: check failed for `%s'.\n",
                          t->u.kernel.target->name);
-                goto err;
+                ret = -EINVAL;
         }
-        ret = 0;
-err:
         return ret;
 }
 
+static inline int compat_check_entry(struct ipt_entry *e, const char *name)
+{
+        int ret;
+
+        ret = IPT_MATCH_ITERATE(e, compat_check_match, name, &e->ip,
+                                                                e->comefrom);
+        if (ret)
+                return ret;
+
+        return compat_check_target(e, name);
+}
+
 static int
 translate_compat_table(const char *name,
                 unsigned int valid_hooks,
@@ -1695,6 +1696,11 @@ translate_compat_table(const char *name,
         if (!mark_source_chains(newinfo, valid_hooks, entry1))
                 goto free_newinfo;
 
+        ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
+                                                                        name);
+        if (ret)
+                goto free_newinfo;
+
         /* And one copy for every other CPU */
         for_each_possible_cpu(i)
                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 9f3924c4905e..11c167118e87 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1780,7 +1780,7 @@ static inline int __mkroute_input(struct sk_buff *skb,
 #endif
         if (in_dev->cnf.no_policy)
                 rth->u.dst.flags |= DST_NOPOLICY;
-        if (in_dev->cnf.no_xfrm)
+        if (out_dev->cnf.no_xfrm)
                 rth->u.dst.flags |= DST_NOXFRM;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9304034c0c47..c701f6abbfc1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4235,7 +4235,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * Change state from SYN-SENT only after copied_seq
                  * is initialized. */
                 tp->copied_seq = tp->rcv_nxt;
-                mb();
+                smp_mb();
                 tcp_set_state(sk, TCP_ESTABLISHED);
 
                 security_inet_conn_established(sk, skb);
@@ -4483,7 +4483,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 case TCP_SYN_RECV:
                         if (acceptable) {
                                 tp->copied_seq = tp->rcv_nxt;
-                                mb();
+                                smp_mb();
                                 tcp_set_state(sk, TCP_ESTABLISHED);
                                 sk->sk_state_change(sk);
 
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index d4107bb701b5..fb9f69c616f5 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -274,6 +274,8 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
 
         if (likely(xdst->u.rt.idev))
                 in_dev_put(xdst->u.rt.idev);
+        if (likely(xdst->u.rt.peer))
+                inet_putpeer(xdst->u.rt.peer);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index e05ecbb1412d..e9212c7ff5cf 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -624,13 +624,13 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 skb_shinfo(skb)->frag_list = NULL;
                 /* BUILD HEADER */
 
+                *prevhdr = NEXTHDR_FRAGMENT;
                 tmp_hdr = kmemdup(skb->nh.raw, hlen, GFP_ATOMIC);
                 if (!tmp_hdr) {
                         IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
                         return -ENOMEM;
                 }
 
-                *prevhdr = NEXTHDR_FRAGMENT;
                 __skb_pull(skb, hlen);
                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
                 skb->nh.raw = __skb_push(skb, hlen);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index f63fb86d7c7b..4eec4b3988b8 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -440,6 +440,13 @@ mark_source_chains(struct xt_table_info *newinfo,
                             && unconditional(&e->ipv6)) {
                                 unsigned int oldpos, size;
 
+                                if (t->verdict < -NF_MAX_VERDICT - 1) {
+                                        duprintf("mark_source_chains: bad "
+                                                "negative verdict (%i)\n",
+                                                                t->verdict);
+                                        return 0;
+                                }
+
                                 /* Return: backtrack through the last
                                    big jump. */
                                 do {
@@ -477,6 +484,13 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 if (strcmp(t->target.u.user.name,
                                            IP6T_STANDARD_TARGET) == 0
                                     && newpos >= 0) {
+                                        if (newpos > newinfo->size -
+                                                sizeof(struct ip6t_entry)) {
+                                                duprintf("mark_source_chains: "
+                                                        "bad verdict (%i)\n",
+                                                                newpos);
+                                                return 0;
+                                        }
                                         /* This a jump; chase it. */
                                         duprintf("Jump rule %u -> %u\n",
                                                  pos, newpos);
@@ -509,27 +523,6 @@ cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
 }
 
 static inline int
-standard_check(const struct ip6t_entry_target *t,
-               unsigned int max_offset)
-{
-        struct ip6t_standard_target *targ = (void *)t;
-
-        /* Check standard info. */
-        if (targ->verdict >= 0
-            && targ->verdict > max_offset - sizeof(struct ip6t_entry)) {
-                duprintf("ip6t_standard_check: bad verdict (%i)\n",
-                         targ->verdict);
-                return 0;
-        }
-        if (targ->verdict < -NF_MAX_VERDICT - 1) {
-                duprintf("ip6t_standard_check: bad negative verdict (%i)\n",
-                         targ->verdict);
-                return 0;
-        }
-        return 1;
-}
-
-static inline int
 check_match(struct ip6t_entry_match *m,
             const char *name,
             const struct ip6t_ip6 *ipv6,
@@ -616,12 +609,7 @@ check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
         if (ret)
                 goto err;
 
-        if (t->u.kernel.target == &ip6t_standard_target) {
-                if (!standard_check(t, size)) {
-                        ret = -EINVAL;
-                        goto err;
-                }
-        } else if (t->u.kernel.target->checkentry
+        if (t->u.kernel.target->checkentry
                    && !t->u.kernel.target->checkentry(name, e, target, t->data,
                                                       e->comefrom)) {
                 duprintf("ip_tables: check failed for `%s'.\n",
@@ -758,17 +746,19 @@ translate_table(const char *name,
                 }
         }
 
+        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+                return -ELOOP;
+
         /* Finally, each sanity check must pass */
         i = 0;
         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
                                 check_entry, name, size, &i);
 
-        if (ret != 0)
-                goto cleanup;
-
-        ret = -ELOOP;
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
-                goto cleanup;
+        if (ret != 0) {
+                IP6T_ENTRY_ITERATE(entry0, newinfo->size,
+                                   cleanup_entry, &i);
+                return ret;
+        }
 
         /* And one copy for every other CPU */
         for_each_possible_cpu(i) {
@@ -777,9 +767,6 @@ translate_table(const char *name,
         }
 
         return 0;
-cleanup:
-        IP6T_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
-        return ret;
 }
 
 /* Gets counters. */
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index c2e629d6aea4..4ae1b19ada5d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -854,7 +854,8 @@ back_from_confirm:
         }
 done:
         dst_release(dst);
-        release_sock(sk);
+        if (!inet->hdrincl)
+                release_sock(sk);
 out:    
         fl6_sock_release(flowlabel);
         return err<0?err:len;
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 252f11012566..03504f3e4990 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1100,7 +1100,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
                         return -ENOMEM;
 
                 /* Reserve space for MUX_CONTROL and LAP header */
-                skb_reserve(tx_skb, TTP_MAX_HEADER);
+                skb_reserve(tx_skb, TTP_MAX_HEADER + TTP_SAR_HEADER);
         } else {
                 tx_skb = userdata;
                 /*
@@ -1349,7 +1349,7 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
                         return -ENOMEM;
 
                 /* Reserve space for MUX_CONTROL and LAP header */
-                skb_reserve(tx_skb, TTP_MAX_HEADER);
+                skb_reserve(tx_skb, TTP_MAX_HEADER + TTP_SAR_HEADER);
         } else {
                 tx_skb = userdata;
                 /*
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 0e1dbfbb9b10..5dd5094659a1 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -27,6 +27,7 @@
 #include <linux/proc_fs.h>
 #include <linux/init.h>
 #include <net/xfrm.h>
+#include <linux/audit.h>
 
 #include <net/sock.h>
 
@@ -1420,6 +1421,9 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
         else
                 err = xfrm_state_update(x);
 
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
                 __xfrm_state_put(x);
@@ -1460,8 +1464,12 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
                 err = -EPERM;
                 goto out;
         }
-        
+
         err = xfrm_state_delete(x);
+
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+
         if (err < 0)
                 goto out;
 
@@ -1637,12 +1645,15 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
 {
         unsigned proto;
         struct km_event c;
+        struct xfrm_audit audit_info;
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
         if (proto == 0)
                 return -EINVAL;
 
-        xfrm_state_flush(proto);
+        audit_info.loginuid = audit_get_loginuid(current->audit_context);
+        audit_info.secid = 0;
+        xfrm_state_flush(proto, &audit_info);
         c.data.proto = proto;
         c.seq = hdr->sadb_msg_seq;
         c.pid = hdr->sadb_msg_pid;
@@ -2205,6 +2216,9 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
                                  hdr->sadb_msg_type != SADB_X_SPDUPDATE);
 
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL);
+
         if (err)
                 goto out;
 
@@ -2282,6 +2296,10 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
                                    &sel, tmp.security, 1);
         security_xfrm_policy_free(&tmp);
+
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
+
         if (xp == NULL)
                 return -ENOENT;
 
@@ -2416,8 +2434,11 @@ static int key_notify_policy_flush(struct km_event *c)
 static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
         struct km_event c;
+        struct xfrm_audit audit_info;
 
-        xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN);
+        audit_info.loginuid = audit_get_loginuid(current->audit_context);
+        audit_info.secid = 0;
+        xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
         c.data.type = XFRM_POLICY_TYPE_MAIN;
         c.event = XFRM_MSG_FLUSHPOLICY;
         c.pid = hdr->sadb_msg_pid;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a9638ff52a72..9b02ec4012fb 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1093,7 +1093,7 @@ static void free_conntrack_hash(struct list_head *hash, int vmalloced, int size)
                            get_order(sizeof(struct list_head) * size));
 }
 
-void nf_conntrack_flush()
+void nf_conntrack_flush(void)
 {
         nf_ct_iterate_cleanup(kill_all, NULL);
 }
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c20f901fa177..9cbf926cdd14 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -91,25 +91,28 @@ EXPORT_SYMBOL_GPL(nf_conntrack_expect_find_get);
 struct nf_conntrack_expect *
 find_expectation(const struct nf_conntrack_tuple *tuple)
 {
-        struct nf_conntrack_expect *i;
+        struct nf_conntrack_expect *exp;
+
+        exp = __nf_conntrack_expect_find(tuple);
+        if (!exp)
+                return NULL;
 
-        list_for_each_entry(i, &nf_conntrack_expect_list, list) {
         /* If master is not in hash table yet (ie. packet hasn't left
            this machine yet), how can other end know about expected?
            Hence these are not the droids you are looking for (if
            master ct never got confirmed, we'd hold a reference to it
            and weird things would happen to future packets). */
-                if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)
-                    && nf_ct_is_confirmed(i->master)) {
-                        if (i->flags & NF_CT_EXPECT_PERMANENT) {
-                                atomic_inc(&i->use);
-                                return i;
-                        } else if (del_timer(&i->timeout)) {
-                                nf_ct_unlink_expect(i);
-                                return i;
-                        }
-                }
+        if (!nf_ct_is_confirmed(exp->master))
+                return NULL;
+
+        if (exp->flags & NF_CT_EXPECT_PERMANENT) {
+                atomic_inc(&exp->use);
+                return exp;
+        } else if (del_timer(&exp->timeout)) {
+                nf_ct_unlink_expect(exp);
+                return exp;
         }
+
         return NULL;
 }
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index b9b03747c1f3..548e4e6e698f 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -143,6 +143,13 @@ int genl_register_ops(struct genl_family *family, struct genl_ops *ops)
                 goto errout;
         }
 
+        if (ops->dumpit)
+                ops->flags |= GENL_CMD_CAP_DUMP;
+        if (ops->doit)
+                ops->flags |= GENL_CMD_CAP_DO;
+        if (ops->policy)
+                ops->flags |= GENL_CMD_CAP_HASPOL;
+
         genl_lock();
         list_add_tail(&ops->ops_list, &family->ops_list);
         genl_unlock();
@@ -387,7 +394,7 @@ static void genl_rcv(struct sock *sk, int len)
 static struct genl_family genl_ctrl = {
         .id = GENL_ID_CTRL,
         .name = "nlctrl",
-        .version = 0x1,
+        .version = 0x2,
         .maxattr = CTRL_ATTR_MAX,
 };
 
@@ -425,15 +432,6 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
                         NLA_PUT_U32(skb, CTRL_ATTR_OP_ID, ops->cmd);
                         NLA_PUT_U32(skb, CTRL_ATTR_OP_FLAGS, ops->flags);
 
-                        if (ops->policy)
-                                NLA_PUT_FLAG(skb, CTRL_ATTR_OP_POLICY);
-
-                        if (ops->doit)
-                                NLA_PUT_FLAG(skb, CTRL_ATTR_OP_DOIT);
-
-                        if (ops->dumpit)
-                                NLA_PUT_FLAG(skb, CTRL_ATTR_OP_DUMPIT);
-
                         nla_nest_end(skb, nest);
                 }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 08e68b67bbf6..da73e8a8c18d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -660,7 +660,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
         sll->sll_ifindex = dev->ifindex;
 
         h->tp_status = status;
-        mb();
+        smp_mb();
 
         {
                 struct page *p_start, *p_end;
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index f59a2c4aa039..c797d6ada7de 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -101,9 +101,10 @@ static int fw_classify(struct sk_buff *skb, struct tcf_proto *tp,
         struct fw_head *head = (struct fw_head*)tp->root;
         struct fw_filter *f;
         int r;
-        u32 id = skb->mark & head->mask;
+        u32 id = skb->mark;
 
         if (head != NULL) {
+                id &= head->mask;
                 for (f=head->ht[fw_hash(id)]; f; f=f->next) {
                         if (f->id == id) {
                                 *res = f->res;
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 316211d9f17d..769cdd62c1bb 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -62,63 +62,6 @@
 
 #define KMEM_SAFETYZONE 8
 
-/***********FOR DEBUGGING PURPOSES*********************************************
-static void * dbg_kmalloc(unsigned int size, int prio, int line) {
-        int i = 0;
-        void * v = kmalloc(size+sizeof(unsigned int)+2*KMEM_SAFETYZONE*8,prio);
-        char * c1 = v;
-        c1 += sizeof(unsigned int);
-        *((unsigned int *)v) = size;
-
-        for (i = 0; i < KMEM_SAFETYZONE; i++) {
-                c1[0] = 'D'; c1[1] = 'E'; c1[2] = 'A'; c1[3] = 'D';
-                c1[4] = 'B'; c1[5] = 'E'; c1[6] = 'E'; c1[7] = 'F';
-                c1 += 8;
-        }
-        c1 += size;
-        for (i = 0; i < KMEM_SAFETYZONE; i++) {
-                c1[0] = 'M'; c1[1] = 'U'; c1[2] = 'N'; c1[3] = 'G';
-                c1[4] = 'W'; c1[5] = 'A'; c1[6] = 'L'; c1[7] = 'L';
-                c1 += 8;
-        }
-        v = ((char *)v) + sizeof(unsigned int) + KMEM_SAFETYZONE*8;
-        printk(KERN_INFO "line %d  kmalloc(%d,%d) = %p\n",line,size,prio,v);
-        return v;
-}
-static void dbg_kfree(void * v, int line) {
-        unsigned int * sp = (unsigned int *)(((char *)v) - (sizeof(unsigned int) + KMEM_SAFETYZONE*8));
-        unsigned int size = *sp;
-        char * c1 = ((char *)v) - KMEM_SAFETYZONE*8;
-        int i = 0;
-        for (i = 0; i < KMEM_SAFETYZONE; i++) {
-                if (   c1[0] != 'D' || c1[1] != 'E' || c1[2] != 'A' || c1[3] != 'D'
-                    || c1[4] != 'B' || c1[5] != 'E' || c1[6] != 'E' || c1[7] != 'F') {
-                        printk(KERN_INFO "kmalloced block at %p has been corrupted (underrun)!\n",v);
-                        printk(KERN_INFO " %4x: %2x %2x %2x %2x %2x %2x %2x %2x\n", i*8,
-                                        c1[0],c1[1],c1[2],c1[3],c1[4],c1[5],c1[6],c1[7] );
-                }
-                c1 += 8;
-        }
-        c1 += size;
-        for (i = 0; i < KMEM_SAFETYZONE; i++) {
-                if (   c1[0] != 'M' || c1[1] != 'U' || c1[2] != 'N' || c1[3] != 'G'
-                    || c1[4] != 'W' || c1[5] != 'A' || c1[6] != 'L' || c1[7] != 'L'
-                   ) {
-                        printk(KERN_INFO "kmalloced block at %p has been corrupted (overrun):\n",v);
-                        printk(KERN_INFO " %4x: %2x %2x %2x %2x %2x %2x %2x %2x\n", i*8,
-                                        c1[0],c1[1],c1[2],c1[3],c1[4],c1[5],c1[6],c1[7] );
-                }
-                c1 += 8;
-        }
-        printk(KERN_INFO "line %d  kfree(%p)\n",line,v);
-        v = ((char *)v) - (sizeof(unsigned int) + KMEM_SAFETYZONE*8);
-        kfree(v);
-}
-
-#define kmalloc(x,y) dbg_kmalloc(x,y,__LINE__)
-#define kfree(x) dbg_kfree(x,__LINE__)
-*****************************************************************************/
-
 /*
  *      Function Prototypes
  */
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 5a0dbeb6bbe8..6b381fc0383d 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -119,6 +119,23 @@ static struct xfrm_algo_desc aalg_list[] = {
                 .sadb_alg_maxbits = 160
         }
 },
+{
+        .name = "xcbc(aes)",
+
+        .uinfo = {
+                .auth = {
+                        .icv_truncbits = 96,
+                        .icv_fullbits = 128,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
+                .sadb_alg_ivlen = 0,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 128
+        }
+},
 };
 
 static struct xfrm_algo_desc ealg_list[] = {
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 3f3f563eb4ab..bebd40e5a62e 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -25,6 +25,7 @@
 #include <linux/cache.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
+#include <linux/audit.h>
 
 #include "xfrm_hash.h"
 
@@ -804,7 +805,7 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
 }
 EXPORT_SYMBOL(xfrm_policy_byid);
 
-void xfrm_policy_flush(u8 type)
+void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
 {
         int dir;
 
@@ -824,6 +825,9 @@ void xfrm_policy_flush(u8 type)
                         hlist_del(&pol->byidx);
                         write_unlock_bh(&xfrm_policy_lock);
 
+                        xfrm_audit_log(audit_info->loginuid, audit_info->secid,
+                                       AUDIT_MAC_IPSEC_DELSPD, 1, pol, NULL);
+
                         xfrm_policy_kill(pol);
                         killed++;
 
@@ -842,6 +846,11 @@ void xfrm_policy_flush(u8 type)
                                 hlist_del(&pol->byidx);
                                 write_unlock_bh(&xfrm_policy_lock);
 
+                                xfrm_audit_log(audit_info->loginuid,
+                                               audit_info->secid,
+                                               AUDIT_MAC_IPSEC_DELSPD, 1,
+                                               pol, NULL);
+
                                 xfrm_policy_kill(pol);
                                 killed++;
 
@@ -860,33 +869,12 @@ EXPORT_SYMBOL(xfrm_policy_flush);
 int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int, void*),
                      void *data)
 {
-        struct xfrm_policy *pol;
+        struct xfrm_policy *pol, *last = NULL;
         struct hlist_node *entry;
-        int dir, count, error;
+        int dir, last_dir = 0, count, error;
 
         read_lock_bh(&xfrm_policy_lock);
         count = 0;
-        for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
-                struct hlist_head *table = xfrm_policy_bydst[dir].table;
-                int i;
-
-                hlist_for_each_entry(pol, entry,
-                                     &xfrm_policy_inexact[dir], bydst) {
-                        if (pol->type == type)
-                                count++;
-                }
-                for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
-                        hlist_for_each_entry(pol, entry, table + i, bydst) {
-                                if (pol->type == type)
-                                        count++;
-                        }
-                }
-        }
-
-        if (count == 0) {
-                error = -ENOENT;
-                goto out;
-        }
 
         for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
                 struct hlist_head *table = xfrm_policy_bydst[dir].table;
@@ -896,21 +884,37 @@ int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int, void*)
                                      &xfrm_policy_inexact[dir], bydst) {
                         if (pol->type != type)
                                 continue;
-                        error = func(pol, dir % XFRM_POLICY_MAX, --count, data);
-                        if (error)
-                                goto out;
+                        if (last) {
+                                error = func(last, last_dir % XFRM_POLICY_MAX,
+                                             count, data);
+                                if (error)
+                                        goto out;
+                        }
+                        last = pol;
+                        last_dir = dir;
+                        count++;
                 }
                 for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
                         hlist_for_each_entry(pol, entry, table + i, bydst) {
                                 if (pol->type != type)
                                         continue;
-                                error = func(pol, dir % XFRM_POLICY_MAX, --count, data);
-                                if (error)
-                                        goto out;
+                                if (last) {
+                                        error = func(last, last_dir % XFRM_POLICY_MAX,
+                                                     count, data);
+                                        if (error)
+                                                goto out;
+                                }
+                                last = pol;
+                                last_dir = dir;
+                                count++;
                         }
                 }
         }
-        error = 0;
+        if (count == 0) {
+                error = -ENOENT;
+                goto out;
+        }
+        error = func(last, last_dir % XFRM_POLICY_MAX, 0, data);
 out:
         read_unlock_bh(&xfrm_policy_lock);
         return error;
@@ -1982,6 +1986,117 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
 
 EXPORT_SYMBOL(xfrm_bundle_ok);
 
+#ifdef CONFIG_AUDITSYSCALL
+/* Audit addition and deletion of SAs and ipsec policy */
+
+void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
+                    struct xfrm_policy *xp, struct xfrm_state *x)
+{
+
+        char *secctx;
+        u32 secctx_len;
+        struct xfrm_sec_ctx *sctx = NULL;
+        struct audit_buffer *audit_buf;
+        int family;
+        extern int audit_enabled;
+
+        if (audit_enabled == 0)
+                return;
+
+        audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
+        if (audit_buf == NULL)
+        return;
+
+        switch(type) {
+        case AUDIT_MAC_IPSEC_ADDSA:
+                audit_log_format(audit_buf, "SAD add: auid=%u", auid);
+                break;
+        case AUDIT_MAC_IPSEC_DELSA:
+                audit_log_format(audit_buf, "SAD delete: auid=%u", auid);
+                break;
+        case AUDIT_MAC_IPSEC_ADDSPD:
+                audit_log_format(audit_buf, "SPD add: auid=%u", auid);
+                break;
+        case AUDIT_MAC_IPSEC_DELSPD:
+                audit_log_format(audit_buf, "SPD delete: auid=%u", auid);
+                break;
+        default:
+                return;
+        }
+
+        if (sid != 0 &&
+                security_secid_to_secctx(sid, &secctx, &secctx_len) == 0)
+                audit_log_format(audit_buf, " subj=%s", secctx);
+        else
+                audit_log_task_context(audit_buf);
+
+        if (xp) {
+                family = xp->selector.family;
+                if (xp->security)
+                        sctx = xp->security;
+        } else {
+                family = x->props.family;
+                if (x->security)
+                        sctx = x->security;
+        }
+
+        if (sctx)
+                audit_log_format(audit_buf,
+                                " sec_alg=%u sec_doi=%u sec_obj=%s",
+                                sctx->ctx_alg, sctx->ctx_doi, sctx->ctx_str);
+
+        switch(family) {
+        case AF_INET:
+                {
+                        struct in_addr saddr, daddr;
+                        if (xp) {
+                                saddr.s_addr = xp->selector.saddr.a4;
+                                daddr.s_addr = xp->selector.daddr.a4;
+                        } else {
+                                saddr.s_addr = x->props.saddr.a4;
+                                daddr.s_addr = x->id.daddr.a4;
+                        }
+                        audit_log_format(audit_buf,
+                                         " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
+                                         NIPQUAD(saddr), NIPQUAD(daddr));
+                }
+                        break;
+        case AF_INET6:
+                {
+                        struct in6_addr saddr6, daddr6;
+                        if (xp) {
+                                memcpy(&saddr6, xp->selector.saddr.a6,
+                                        sizeof(struct in6_addr));
+                                memcpy(&daddr6, xp->selector.daddr.a6,
+                                        sizeof(struct in6_addr));
+                        } else {
+                                memcpy(&saddr6, x->props.saddr.a6,
+                                        sizeof(struct in6_addr));
+                                memcpy(&daddr6, x->id.daddr.a6,
+                                        sizeof(struct in6_addr));
+                        }
+                        audit_log_format(audit_buf,
+                                         " src=" NIP6_FMT "dst=" NIP6_FMT,
+                                         NIP6(saddr6), NIP6(daddr6));
+                }
+                break;
+        }
+
+        if (x)
+                audit_log_format(audit_buf, " spi=%lu(0x%lx) protocol=%s",
+                                (unsigned long)ntohl(x->id.spi),
+                                (unsigned long)ntohl(x->id.spi),
+                                x->id.proto == IPPROTO_AH ? "AH" :
+                                (x->id.proto == IPPROTO_ESP ?
+                                "ESP" : "IPCOMP"));
+
+        audit_log_format(audit_buf, " res=%u", result);
+        audit_log_end(audit_buf);
+}
+
+EXPORT_SYMBOL(xfrm_audit_log);
+#endif /* CONFIG_AUDITSYSCALL */
+
 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
 {
         int err = 0;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index da54a64ccfa3..fdb08d9f34aa 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/cache.h>
 #include <asm/uaccess.h>
+#include <linux/audit.h>
 
 #include "xfrm_hash.h"
 
@@ -238,6 +239,7 @@ static void xfrm_timer_handler(unsigned long data)
         unsigned long now = (unsigned long)xtime.tv_sec;
         long next = LONG_MAX;
         int warn = 0;
+        int err = 0;
 
         spin_lock(&x->lock);
         if (x->km.state == XFRM_STATE_DEAD)
@@ -295,9 +297,14 @@ expired:
                 next = 2;
                 goto resched;
         }
-        if (!__xfrm_state_delete(x) && x->id.spi)
+
+        err = __xfrm_state_delete(x);
+        if (!err && x->id.spi)
                 km_state_expired(x, 1, 0);
 
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+
 out:
         spin_unlock(&x->lock);
 }
@@ -384,9 +391,10 @@ int xfrm_state_delete(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(xfrm_state_delete);
 
-void xfrm_state_flush(u8 proto)
+void xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
 {
         int i;
+        int err = 0;
 
         spin_lock_bh(&xfrm_state_lock);
         for (i = 0; i <= xfrm_state_hmask; i++) {
@@ -399,7 +407,11 @@ restart:
                                 xfrm_state_hold(x);
                                 spin_unlock_bh(&xfrm_state_lock);
 
-                                xfrm_state_delete(x);
+                                err = xfrm_state_delete(x);
+                                xfrm_audit_log(audit_info->loginuid,
+                                               audit_info->secid,
+                                               AUDIT_MAC_IPSEC_DELSA,
+                                               err ? 0 : 1, NULL, x);
                                 xfrm_state_put(x);
 
                                 spin_lock_bh(&xfrm_state_lock);
@@ -1099,7 +1111,7 @@ int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
                     void *data)
 {
         int i;
-        struct xfrm_state *x;
+        struct xfrm_state *x, *last = NULL;
         struct hlist_node *entry;
         int count = 0;
         int err = 0;
@@ -1107,24 +1119,22 @@ int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
         spin_lock_bh(&xfrm_state_lock);
         for (i = 0; i <= xfrm_state_hmask; i++) {
                 hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
-                        if (xfrm_id_proto_match(x->id.proto, proto))
-                                count++;
+                        if (!xfrm_id_proto_match(x->id.proto, proto))
+                                continue;
+                        if (last) {
+                                err = func(last, count, data);
+                                if (err)
+                                        goto out;
+                        }
+                        last = x;
+                        count++;
                 }
         }
         if (count == 0) {
                 err = -ENOENT;
                 goto out;
         }
-
-        for (i = 0; i <= xfrm_state_hmask; i++) {
-                hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
-                        if (!xfrm_id_proto_match(x->id.proto, proto))
-                                continue;
-                        err = func(x, --count, data);
-                        if (err)
-                                goto out;
-                }
-        }
+        err = func(last, 0, data);
 out:
         spin_unlock_bh(&xfrm_state_lock);
         return err;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 311205ffa775..e5372b11fc8f 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -31,6 +31,7 @@
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <linux/in6.h>
 #endif
+#include <linux/audit.h>
 
 static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
 {
@@ -454,6 +455,9 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         else
                 err = xfrm_state_update(x);
 
+        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                       AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
                 __xfrm_state_put(x);
@@ -523,6 +527,10 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         }
 
         err = xfrm_state_delete(x);
+
+        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+
         if (err < 0)
                 goto out;
 
@@ -1030,6 +1038,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
          * a type XFRM_MSG_UPDPOLICY - JHS */
         excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
         err = xfrm_policy_insert(p->dir, xp, excl);
+        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
         if (err) {
                 security_xfrm_policy_free(xp);
                 kfree(xp);
@@ -1257,6 +1268,10 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
                 xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
                 security_xfrm_policy_free(&tmp);
         }
+        if (delete)
+                xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                               AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
+
         if (xp == NULL)
                 return -ENOENT;
 
@@ -1291,8 +1306,11 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma
 {
         struct km_event c;
         struct xfrm_usersa_flush *p = NLMSG_DATA(nlh);
+        struct xfrm_audit audit_info;
 
-        xfrm_state_flush(p->proto);
+        audit_info.loginuid = NETLINK_CB(skb).loginuid;
+        audit_info.secid = NETLINK_CB(skb).sid;
+        xfrm_state_flush(p->proto, &audit_info);
         c.data.proto = p->proto;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1442,12 +1460,15 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **x
         struct km_event c;
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err;
+        struct xfrm_audit audit_info;
 
         err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
         if (err)
                 return err;
 
-        xfrm_policy_flush(type);
+        audit_info.loginuid = NETLINK_CB(skb).loginuid;
+        audit_info.secid = NETLINK_CB(skb).sid;
+        xfrm_policy_flush(type, &audit_info);
         c.data.type = type;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1502,6 +1523,9 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void *
         err = 0;
         if (up->hard) {
                 xfrm_policy_delete(xp, p->dir);
+                xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                                AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL);
+
         } else {
                 // reset the timers here?
                 printk("Dont know what to do with soft policy expire\n");
@@ -1533,8 +1557,11 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void **
                 goto out;
         km_state_expired(x, ue->hard, current->pid);
 
-        if (ue->hard)
+        if (ue->hard) {
                 __xfrm_state_delete(x);
+                xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                               AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
+        }
 out:
         spin_unlock_bh(&x->lock);
         xfrm_state_put(x);