@@ -3,7 +3,7 @@

 # LIBNETWORK_COMMIT is used to build the docker-userland-proxy binary. When

 # updating the binary version, consider updating github.com/docker/libnetwork

 # in vendor.conf accordingly

-LIBNETWORK_COMMIT=fc5a7d91d54cc98f64fc28f9e288b46a0bee756c

+LIBNETWORK_COMMIT=62a13ae87c6058bdc000fcccbf7e0f9f7525e2a9

 install_proxy() {

 	case "$1" in

@@ -39,7 +39,7 @@ github.com/gofrs/flock                              7f43ea2e6a643ad441fc12d0ecc0

 # libnetwork

 # When updating, also update LIBNETWORK_COMMIT in hack/dockerfile/install/proxy.installer accordingly

-github.com/docker/libnetwork                        fc5a7d91d54cc98f64fc28f9e288b46a0bee756c

+github.com/docker/libnetwork                        62a13ae87c6058bdc000fcccbf7e0f9f7525e2a9

 github.com/docker/go-events                         9461782956ad83b30282bf90e31fa6a70c255ba9

 github.com/armon/go-radix                           e39d623f12e8e41c7b5529e9a9dd67a1e2261f80

 github.com/armon/go-metrics                         eb0af217e5e9747e41dd5303755356b62d28e3ec

@@ -50,8 +50,8 @@ github.com/hashicorp/go-sockaddr                    6d291a969b86c4b633730bfc6b8b

 github.com/hashicorp/go-multierror                  fcdddc395df1ddf4247c69bd436e84cfa0733f7e

 github.com/hashicorp/serf                           598c54895cc5a7b1a24a398d635e8c0ea0959870

 github.com/docker/libkv                             458977154600b9f23984d9f4b82e79570b5ae12b

-github.com/vishvananda/netns                        604eaf189ee867d8c147fafc28def2394e878d25

-github.com/vishvananda/netlink                      b2de5d10e38ecce8607e6b438b6d174f389a004e

+github.com/vishvananda/netns                        13995c7128ccc8e51e9a6bd2b551020a27180abd

+github.com/vishvananda/netlink                      a2ad57a690f3caf3015351d2d6e1c0b95c349752 # v1.0.0

 # When updating, consider updating TOMLV_COMMIT in hack/dockerfile/install/tomlv.installer accordingly

 github.com/BurntSushi/toml                          3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005 # v0.3.1

@@ -12,7 +12,6 @@ import (

 	"strconv"

 	"strings"

 	"sync"

-	"syscall"

 	"github.com/docker/docker/pkg/reexec"

 	"github.com/docker/libnetwork/datastore"

@@ -27,6 +26,7 @@ import (

 	"github.com/vishvananda/netlink"

 	"github.com/vishvananda/netlink/nl"

 	"github.com/vishvananda/netns"

+	"golang.org/x/sys/unix"

 )

 var (

@@ -97,18 +97,18 @@ func setDefaultVlan() {

 	}

 	// make sure the sysfs mount doesn't propagate back

-	if err = syscall.Unshare(syscall.CLONE_NEWNS); err != nil {

+	if err = unix.Unshare(unix.CLONE_NEWNS); err != nil {

 		logrus.Errorf("unshare failed, %v", err)

 		os.Exit(1)

 	}

-	flag := syscall.MS_PRIVATE | syscall.MS_REC

-	if err = syscall.Mount("", "/", "", uintptr(flag), ""); err != nil {

+	flag := unix.MS_PRIVATE | unix.MS_REC

+	if err = unix.Mount("", "/", "", uintptr(flag), ""); err != nil {

 		logrus.Errorf("root mount failed, %v", err)

 		os.Exit(1)

 	}

-	if err = syscall.Mount("sysfs", "/sys", "sysfs", 0, ""); err != nil {

+	if err = unix.Mount("sysfs", "/sys", "sysfs", 0, ""); err != nil {

 		logrus.Errorf("mounting sysfs failed, %v", err)

 		os.Exit(1)

 	}

@@ -427,7 +427,7 @@ func populateVNITbl() {

 			}

 			defer ns.Close()

-			nlh, err := netlink.NewHandleAt(ns, syscall.NETLINK_ROUTE)

+			nlh, err := netlink.NewHandleAt(ns, unix.NETLINK_ROUTE)

 			if err != nil {

 				logrus.Errorf("Could not open netlink handle during vni population for ns %s: %v", path, err)

 				return nil

@@ -583,7 +583,7 @@ func (n *network) setupSubnetSandbox(s *subnet, brName, vxlanName string) error

 		if ok {

 			deleteVxlanByVNI(path, s.vni)

-			if err := syscall.Unmount(path, syscall.MNT_FORCE); err != nil {

+			if err := unix.Unmount(path, unix.MNT_FORCE); err != nil {

 				logrus.Errorf("unmount of %s failed: %v", path, err)

 			}

 			os.Remove(path)

@@ -693,7 +693,7 @@ func (n *network) cleanupStaleSandboxes() {

 			if strings.Contains(n.id, pattern) {

 				// Delete all vnis

 				deleteVxlanByVNI(path, 0)

-				syscall.Unmount(path, syscall.MNT_DETACH)

+				unix.Unmount(path, unix.MNT_DETACH)

 				os.Remove(path)

 				// Now that we have destroyed this

@@ -755,12 +755,12 @@ func (n *network) initSandbox(restore bool) error {

 	var nlSock *nl.NetlinkSocket

 	sbox.InvokeFunc(func() {

-		nlSock, err = nl.Subscribe(syscall.NETLINK_ROUTE, syscall.RTNLGRP_NEIGH)

+		nlSock, err = nl.Subscribe(unix.NETLINK_ROUTE, unix.RTNLGRP_NEIGH)

 		if err != nil {

 			return

 		}

 		// set the receive timeout to not remain stuck on the RecvFrom if the fd gets closed

-		tv := syscall.NsecToTimeval(soTimeout.Nanoseconds())

+		tv := unix.NsecToTimeval(soTimeout.Nanoseconds())

 		err = nlSock.SetReceiveTimeout(&tv)

 	})

 	n.nlSocket = nlSock

@@ -803,7 +803,7 @@ func (n *network) watchMiss(nlSock *nl.NetlinkSocket, nsPath string) {

 				return

 			}

 			// When the receive timeout expires the receive will return EAGAIN

-			if err == syscall.EAGAIN {

+			if err == unix.EAGAIN {

 				// we continue here to avoid spam for timeouts

 				continue

 			}

@@ -812,7 +812,7 @@ func (n *network) watchMiss(nlSock *nl.NetlinkSocket, nsPath string) {

 		}

 		for _, msg := range msgs {

-			if msg.Header.Type != syscall.RTM_GETNEIGH && msg.Header.Type != syscall.RTM_NEWNEIGH {

+			if msg.Header.Type != unix.RTM_GETNEIGH && msg.Header.Type != unix.RTM_NEWNEIGH {

 				continue

 			}

@@ -2,6 +2,7 @@ package libnetwork

 import (

 	"github.com/docker/libnetwork/iptables"

+	"github.com/docker/libnetwork/netlabel"

 	"github.com/sirupsen/logrus"

 )

@@ -9,15 +10,44 @@ const userChain = "DOCKER-USER"

 func (c *controller) arrangeUserFilterRule() {

 	c.Lock()

-	arrangeUserFilterRule()

+

+	if c.hasIPTablesEnabled() {

+		arrangeUserFilterRule()

+	}

+

 	c.Unlock()

+

 	iptables.OnReloaded(func() {

 		c.Lock()

-		arrangeUserFilterRule()

+

+		if c.hasIPTablesEnabled() {

+			arrangeUserFilterRule()

+		}

+

 		c.Unlock()

 	})

 }

+func (c *controller) hasIPTablesEnabled() bool {

+	// Locking c should be handled in the calling method.

+	if c.cfg == nil || c.cfg.Daemon.DriverCfg[netlabel.GenericData] == nil {

+		return false

+	}

+

+	genericData, ok := c.cfg.Daemon.DriverCfg[netlabel.GenericData]

+	if !ok {

+		return false

+	}

+

+	optMap := genericData.(map[string]interface{})

+	enabled, ok := optMap["EnableIPTables"].(bool)

+	if !ok {

+		return false

+	}

+

+	return enabled

+}

+

 // This chain allow users to configure firewall policies in a way that persists

 // docker operations/restarts. Docker will not delete or modify any pre-existing

 // rules from the DOCKER-USER filter chain.

@@ -3,14 +3,13 @@

 package ipvs

 import (

+	"fmt"

 	"net"

-	"syscall"

 	"time"

-	"fmt"

-

 	"github.com/vishvananda/netlink/nl"

 	"github.com/vishvananda/netns"

+	"golang.org/x/sys/unix"

 )

 const (

@@ -98,16 +97,16 @@ func New(path string) (*Handle, error) {

 	}

 	defer n.Close()

-	sock, err := nl.GetNetlinkSocketAt(n, netns.None(), syscall.NETLINK_GENERIC)

+	sock, err := nl.GetNetlinkSocketAt(n, netns.None(), unix.NETLINK_GENERIC)

 	if err != nil {

 		return nil, err

 	}

 	// Add operation timeout to avoid deadlocks

-	tv := syscall.NsecToTimeval(netlinkSendSocketTimeout.Nanoseconds())

+	tv := unix.NsecToTimeval(netlinkSendSocketTimeout.Nanoseconds())

 	if err := sock.SetSendTimeout(&tv); err != nil {

 		return nil, err

 	}

-	tv = syscall.NsecToTimeval(netlinkRecvSocketsTimeout.Nanoseconds())

+	tv = unix.NsecToTimeval(netlinkRecvSocketsTimeout.Nanoseconds())

 	if err := sock.SetReceiveTimeout(&tv); err != nil {

 		return nil, err

 	}

@@ -1381,14 +1381,18 @@ func delIPToName(ipMap setmatrix.SetMatrix, name, serviceID string, ip net.IP) {

 }

 func addNameToIP(svcMap setmatrix.SetMatrix, name, serviceID string, epIP net.IP) {

-	svcMap.Insert(name, svcMapEntry{

+	// Since DNS name resolution is case-insensitive, Use the lower-case form

+	// of the name as the key into svcMap

+	lowerCaseName := strings.ToLower(name)

+	svcMap.Insert(lowerCaseName, svcMapEntry{

 		ip:        epIP.String(),

 		serviceID: serviceID,

 	})

 }

 func delNameToIP(svcMap setmatrix.SetMatrix, name, serviceID string, epIP net.IP) {

-	svcMap.Remove(name, svcMapEntry{

+	lowerCaseName := strings.ToLower(name)

+	svcMap.Remove(lowerCaseName, svcMapEntry{

 		ip:        epIP.String(),

 		serviceID: serviceID,

 	})

@@ -1956,6 +1960,7 @@ func (n *network) ResolveName(req string, ipType int) ([]net.IP, bool) {

 	}

 	req = strings.TrimSuffix(req, ".")

+	req = strings.ToLower(req)

 	ipSet, ok := sr.svcMap.Get(req)

 	if ipType == types.IPv6 {

@@ -366,8 +366,8 @@ func (r *resolver) ServeDNS(w dns.ResponseWriter, query *dns.Msg) {

 	if query == nil || len(query.Question) == 0 {

 		return

 	}

-	name := query.Question[0].Name

+	name := query.Question[0].Name

 	switch query.Question[0].Qtype {

 	case dns.TypeA:

 		resp, err = r.handleIPQuery(name, query, types.IPv4)

@@ -1,50 +1,54 @@

-github.com/Azure/go-ansiterm d6e3b3328b783f23731bc4d058875b0371ff8109

-github.com/BurntSushi/toml a368813c5e648fee92e5f6c30e3944ff9d5e8895

-github.com/Microsoft/go-winio v0.4.11

-github.com/Microsoft/hcsshim v0.7.3

-github.com/armon/go-metrics eb0af217e5e9747e41dd5303755356b62d28e3ec

-github.com/armon/go-radix e39d623f12e8e41c7b5529e9a9dd67a1e2261f80

-github.com/codegangsta/cli a65b733b303f0055f8d324d805f393cd3e7a7904

-github.com/containerd/continuity d3c23511c1bf5851696cba83143d9cbcd666869b

-github.com/coreos/etcd v3.2.1

-github.com/coreos/go-semver v0.2.0

-github.com/deckarep/golang-set ef32fa3046d9f249d399f98ebaf9be944430fd1d

-go.etcd.io/bbolt v1.3.1-etcd.8

+github.com/Azure/go-ansiterm            d6e3b3328b783f23731bc4d058875b0371ff8109

+github.com/BurntSushi/toml              3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005 # v0.3.1

+github.com/Microsoft/go-winio           c599b533b43b1363d7d7c6cfda5ede70ed73ff13

+github.com/Microsoft/hcsshim            ba3d6667710fa905116f39a19d059c4c1016be7c

+github.com/armon/go-metrics             eb0af217e5e9747e41dd5303755356b62d28e3ec

+github.com/armon/go-radix               e39d623f12e8e41c7b5529e9a9dd67a1e2261f80

+github.com/codegangsta/cli              a65b733b303f0055f8d324d805f393cd3e7a7904

+github.com/containerd/continuity        004b46473808b3e7a4a3049c20e4376c91eb966d

+github.com/coreos/etcd                  fca8add78a9d926166eb739b8e4a124434025ba3 # v3.3.9

+github.com/coreos/go-semver             8ab6407b697782a06568d4b7f1db25550ec2e4c6 # v0.2.0

+github.com/deckarep/golang-set          ef32fa3046d9f249d399f98ebaf9be944430fd1d

+go.etcd.io/bbolt                        7ee3ded59d4835e10f3e7d0f7603c42aa5e83820 # v1.3.1-etcd.8

-github.com/docker/docker 162ba6016def672690ee4a1f3978368853a1e149

-github.com/docker/go-connections 7beb39f0b969b075d1325fecb092faf27fd357b6

-github.com/docker/go-events 9461782956ad83b30282bf90e31fa6a70c255ba9

-github.com/docker/go-units 9e638d38cf6977a37a8ea0078f3ee75a7cdb2dd1

-github.com/docker/libkv 458977154600b9f23984d9f4b82e79570b5ae12b

+github.com/docker/docker                dbe4a30928d418e0570891a09703bcbc0e4997a1

+github.com/docker/distribution          0d3efadf0154c2b8a4e7b6621fff9809655cc580

+github.com/docker/go-connections        7395e3f8aa162843a74ed6d48e79627d9792ac55 # v0.4.0

+github.com/docker/go-events             9461782956ad83b30282bf90e31fa6a70c255ba9

+github.com/docker/go-units              47565b4f722fb6ceae66b95f853feed578a4a51c # v0.3.3

+github.com/docker/libkv                 458977154600b9f23984d9f4b82e79570b5ae12b

-github.com/godbus/dbus v4.0.0

-github.com/gogo/protobuf v1.0.0

-github.com/gorilla/context v1.1

-github.com/gorilla/mux v1.1

-github.com/hashicorp/consul v0.5.2

-github.com/hashicorp/go-msgpack 71c2886f5a673a35f909803f38ece5810165097b

-github.com/hashicorp/go-multierror fcdddc395df1ddf4247c69bd436e84cfa0733f7e

-github.com/hashicorp/memberlist 3d8438da9589e7b608a83ffac1ef8211486bcb7c

-github.com/sean-/seed e2103e2c35297fb7e17febb81e49b312087a2372

-github.com/hashicorp/go-sockaddr 6d291a969b86c4b633730bfc6b8b9d64c3aafed9

-github.com/hashicorp/serf 598c54895cc5a7b1a24a398d635e8c0ea0959870

-github.com/mattn/go-shellwords v1.0.3

-github.com/miekg/dns v1.0.7

-github.com/opencontainers/go-digest v1.0.0-rc1

-github.com/opencontainers/image-spec v1.0.1

-github.com/opencontainers/runc 96ec2177ae841256168fcf76954f7177af9446eb

-github.com/opencontainers/runtime-spec v1.0.1

-github.com/samuel/go-zookeeper d0e0d8e11f318e000a8cc434616d69e329edc374

-github.com/sirupsen/logrus v1.0.3

-github.com/ugorji/go f1f1a805ed361a0e078bb537e4ea78cd37dcf065

-github.com/vishvananda/netlink b2de5d10e38ecce8607e6b438b6d174f389a004e

-github.com/vishvananda/netns 604eaf189ee867d8c147fafc28def2394e878d25

-golang.org/x/crypto 1a580b3eff7814fc9b40602fd35256c63b50f491

-golang.org/x/net 0ed95abb35c445290478a5348a7b38bb154135fd

-golang.org/x/sys 37707fdb30a5b38865cfb95e5aab41707daec7fd

-golang.org/x/sync fd80eb99c8f653c847d294a001bdf2a3a6f768f5

-github.com/pkg/errors 839d9e913e063e28dfd0e6c7b7512793e0a48be9

-github.com/ishidawataru/sctp 07191f837fedd2f13d1ec7b5f885f0f3ec54b1cb

+github.com/gogo/protobuf                ba06b47c162d49f2af050fb4c75bcbc86a159d5c # v1.2.1

+github.com/golang/protobuf              aa810b61a9c79d51363740d207bb46cf8e620ed5 # v1.2.0

+google.golang.org/grpc                  7a6a684ca69eb4cae85ad0a484f2e531598c047b # v1.12.2

+google.golang.org/genproto              694d95ba50e67b2e363f3483057db5d4910c18f9

-gotest.tools v2.1.0

-github.com/google/go-cmp v0.2.0

+github.com/godbus/dbus                  5f6efc7ef2759c81b7ba876593971bfce311eab3 # v4.0.0

+github.com/gorilla/mux                  c5c6c98bc25355028a63748a498942a6398ccd22 # v1.7.1

+github.com/hashicorp/consul             9a9cc9341bb487651a0399e3fc5e1e8a42e62dd9 # v0.5.2

+github.com/hashicorp/go-msgpack         71c2886f5a673a35f909803f38ece5810165097b

+github.com/hashicorp/go-multierror      fcdddc395df1ddf4247c69bd436e84cfa0733f7e

+github.com/hashicorp/memberlist         3d8438da9589e7b608a83ffac1ef8211486bcb7c

+github.com/sean-/seed                   e2103e2c35297fb7e17febb81e49b312087a2372

+github.com/hashicorp/go-sockaddr        6d291a969b86c4b633730bfc6b8b9d64c3aafed9

+github.com/hashicorp/serf               598c54895cc5a7b1a24a398d635e8c0ea0959870

+github.com/mattn/go-shellwords          02e3cf038dcea8290e44424da473dd12be796a8a # v1.0.3

+github.com/miekg/dns                    e57bf427e68187a27e22adceac868350d7a7079b # v1.0.7

+github.com/opencontainers/go-digest     279bed98673dd5bef374d3b6e4b09e2af76183bf # v1.0.0-rc1

+github.com/opencontainers/image-spec    d60099175f88c47cd379c4738d158884749ed235 # v1.0.1

+github.com/opencontainers/runc          2b18fe1d885ee5083ef9f0838fee39b62d653e30

+github.com/opencontainers/runtime-spec  29686dbc5559d93fb1ef402eeda3e35c38d75af4 # v1.0.1-59-g29686db

+github.com/samuel/go-zookeeper          d0e0d8e11f318e000a8cc434616d69e329edc374

+github.com/sirupsen/logrus              f006c2ac4710855cf0f916dd6b77acf6b048dc6e # v1.0.3

+github.com/ugorji/go                    b4c50a2b199d93b13dc15e78929cfb23bfdf21ab # v1.1.1

+github.com/vishvananda/netlink          a2ad57a690f3caf3015351d2d6e1c0b95c349752 # v1.0.0

+github.com/vishvananda/netns            13995c7128ccc8e51e9a6bd2b551020a27180abd

+golang.org/x/crypto                     b7391e95e576cacdcdd422573063bc057239113d

+golang.org/x/net                        a680a1efc54dd51c040b3b5ce4939ea3cf2ea0d1

+golang.org/x/sys                        d455e41777fca6e8a5a79e34a14b8368bc11d9ba

+golang.org/x/sync                       1d60e4601c6fd243af51cc01ddf169918a5407ca

+github.com/pkg/errors                   ba968bfe8b2f7e042a574c888954fccecfa385b4 # v0.8.1

+github.com/ishidawataru/sctp            07191f837fedd2f13d1ec7b5f885f0f3ec54b1cb

+

+gotest.tools                            b6e20af1ed078cd01a6413b734051a292450b4cb # v2.1.0

+github.com/google/go-cmp                3af367b6b30c263d47e8895973edcca9a49cf029 # v0.2.0

@@ -89,3 +89,4 @@ There are also a few pieces of low level netlink functionality that still

 need to be implemented. Routing rules are not in place and some of the

 more advanced link types. Hopefully there is decent structure and testing

 in place to make these fairly straightforward to add.

+

@@ -8,6 +8,7 @@ import (

 	"github.com/vishvananda/netlink/nl"

 	"github.com/vishvananda/netns"

+	"golang.org/x/sys/unix"

 )

 // IFA_FLAGS is a u32 attribute.

@@ -22,7 +23,7 @@ func AddrAdd(link Link, addr *Addr) error {

 // AddrAdd will add an IP address to a link device.

 // Equivalent to: `ip addr add $addr dev $link`

 func (h *Handle) AddrAdd(link Link, addr *Addr) error {

-	req := h.newNetlinkRequest(syscall.RTM_NEWADDR, syscall.NLM_F_CREATE|syscall.NLM_F_EXCL|syscall.NLM_F_ACK)

+	req := h.newNetlinkRequest(unix.RTM_NEWADDR, unix.NLM_F_CREATE|unix.NLM_F_EXCL|unix.NLM_F_ACK)

 	return h.addrHandle(link, addr, req)

 }

@@ -35,7 +36,7 @@ func AddrReplace(link Link, addr *Addr) error {

 // AddrReplace will replace (or, if not present, add) an IP address on a link device.

 // Equivalent to: `ip addr replace $addr dev $link`

 func (h *Handle) AddrReplace(link Link, addr *Addr) error {

-	req := h.newNetlinkRequest(syscall.RTM_NEWADDR, syscall.NLM_F_CREATE|syscall.NLM_F_REPLACE|syscall.NLM_F_ACK)

+	req := h.newNetlinkRequest(unix.RTM_NEWADDR, unix.NLM_F_CREATE|unix.NLM_F_REPLACE|unix.NLM_F_ACK)

 	return h.addrHandle(link, addr, req)

 }

@@ -48,7 +49,7 @@ func AddrDel(link Link, addr *Addr) error {

 // AddrDel will delete an IP address from a link device.

 // Equivalent to: `ip addr del $addr dev $link`

 func (h *Handle) AddrDel(link Link, addr *Addr) error {

-	req := h.newNetlinkRequest(syscall.RTM_DELADDR, syscall.NLM_F_ACK)

+	req := h.newNetlinkRequest(unix.RTM_DELADDR, unix.NLM_F_ACK)

 	return h.addrHandle(link, addr, req)

 }

@@ -75,7 +76,7 @@ func (h *Handle) addrHandle(link Link, addr *Addr, req *nl.NetlinkRequest) error

 		localAddrData = addr.IP.To16()

 	}

-	localData := nl.NewRtAttr(syscall.IFA_LOCAL, localAddrData)

+	localData := nl.NewRtAttr(unix.IFA_LOCAL, localAddrData)

 	req.AddData(localData)

 	var peerAddrData []byte

 	if addr.Peer != nil {

@@ -88,7 +89,7 @@ func (h *Handle) addrHandle(link Link, addr *Addr, req *nl.NetlinkRequest) error

 		peerAddrData = localAddrData

 	}

-	addressData := nl.NewRtAttr(syscall.IFA_ADDRESS, peerAddrData)

+	addressData := nl.NewRtAttr(unix.IFA_ADDRESS, peerAddrData)

 	req.AddData(addressData)

 	if addr.Flags != 0 {

@@ -102,21 +103,34 @@ func (h *Handle) addrHandle(link Link, addr *Addr, req *nl.NetlinkRequest) error

 		}

 	}

-	if addr.Broadcast == nil {

-		calcBroadcast := make(net.IP, masklen/8)

-		for i := range localAddrData {

-			calcBroadcast[i] = localAddrData[i] | ^addr.Mask[i]

+	if family == FAMILY_V4 {

+		if addr.Broadcast == nil {

+			calcBroadcast := make(net.IP, masklen/8)

+			for i := range localAddrData {

+				calcBroadcast[i] = localAddrData[i] | ^addr.Mask[i]

+			}

+			addr.Broadcast = calcBroadcast

+		}

+		req.AddData(nl.NewRtAttr(unix.IFA_BROADCAST, addr.Broadcast))

+

+		if addr.Label != "" {

+			labelData := nl.NewRtAttr(unix.IFA_LABEL, nl.ZeroTerminated(addr.Label))

+			req.AddData(labelData)

 		}

-		addr.Broadcast = calcBroadcast

 	}

-	req.AddData(nl.NewRtAttr(syscall.IFA_BROADCAST, addr.Broadcast))

-	if addr.Label != "" {

-		labelData := nl.NewRtAttr(syscall.IFA_LABEL, nl.ZeroTerminated(addr.Label))

-		req.AddData(labelData)

+	// 0 is the default value for these attributes. However, 0 means "expired", while the least-surprising default

+	// value should be "forever". To compensate for that, only add the attributes if at least one of the values is

+	// non-zero, which means the caller has explicitly set them

+	if addr.ValidLft > 0 || addr.PreferedLft > 0 {

+		cachedata := nl.IfaCacheInfo{

+			IfaValid:    uint32(addr.ValidLft),

+			IfaPrefered: uint32(addr.PreferedLft),

+		}

+		req.AddData(nl.NewRtAttr(unix.IFA_CACHEINFO, cachedata.Serialize()))

 	}

-	_, err := req.Execute(syscall.NETLINK_ROUTE, 0)

+	_, err := req.Execute(unix.NETLINK_ROUTE, 0)

 	return err

 }

@@ -131,11 +145,11 @@ func AddrList(link Link, family int) ([]Addr, error) {

 // Equivalent to: `ip addr show`.

 // The list can be filtered by link and ip family.

 func (h *Handle) AddrList(link Link, family int) ([]Addr, error) {

-	req := h.newNetlinkRequest(syscall.RTM_GETADDR, syscall.NLM_F_DUMP)

+	req := h.newNetlinkRequest(unix.RTM_GETADDR, unix.NLM_F_DUMP)

 	msg := nl.NewIfInfomsg(family)

 	req.AddData(msg)

-	msgs, err := req.Execute(syscall.NETLINK_ROUTE, syscall.RTM_NEWADDR)

+	msgs, err := req.Execute(unix.NETLINK_ROUTE, unix.RTM_NEWADDR)

 	if err != nil {

 		return nil, err

 	}

@@ -187,21 +201,21 @@ func parseAddr(m []byte) (addr Addr, family, index int, err error) {

 	var local, dst *net.IPNet

 	for _, attr := range attrs {

 		switch attr.Attr.Type {

-		case syscall.IFA_ADDRESS:

+		case unix.IFA_ADDRESS:

 			dst = &net.IPNet{

 				IP:   attr.Value,

 				Mask: net.CIDRMask(int(msg.Prefixlen), 8*len(attr.Value)),

 			}

 			addr.Peer = dst

-		case syscall.IFA_LOCAL:

+		case unix.IFA_LOCAL:

 			local = &net.IPNet{

 				IP:   attr.Value,

 				Mask: net.CIDRMask(int(msg.Prefixlen), 8*len(attr.Value)),

 			}

 			addr.IPNet = local

-		case syscall.IFA_BROADCAST:

+		case unix.IFA_BROADCAST:

 			addr.Broadcast = attr.Value

-		case syscall.IFA_LABEL:

+		case unix.IFA_LABEL:

 			addr.Label = string(attr.Value[:len(attr.Value)-1])

 		case IFA_FLAGS:

 			addr.Flags = int(native.Uint32(attr.Value[0:4]))

@@ -236,13 +250,13 @@ type AddrUpdate struct {

 // AddrSubscribe takes a chan down which notifications will be sent

 // when addresses change.  Close the 'done' chan to stop subscription.

 func AddrSubscribe(ch chan<- AddrUpdate, done <-chan struct{}) error {

-	return addrSubscribeAt(netns.None(), netns.None(), ch, done, nil)

+	return addrSubscribeAt(netns.None(), netns.None(), ch, done, nil, false)

 }

 // AddrSubscribeAt works like AddrSubscribe plus it allows the caller

 // to choose the network namespace in which to subscribe (ns).

 func AddrSubscribeAt(ns netns.NsHandle, ch chan<- AddrUpdate, done <-chan struct{}) error {

-	return addrSubscribeAt(ns, netns.None(), ch, done, nil)

+	return addrSubscribeAt(ns, netns.None(), ch, done, nil, false)

 }

 // AddrSubscribeOptions contains a set of options to use with

@@ -250,6 +264,7 @@ func AddrSubscribeAt(ns netns.NsHandle, ch chan<- AddrUpdate, done <-chan struct

 type AddrSubscribeOptions struct {

 	Namespace     *netns.NsHandle

 	ErrorCallback func(error)

+	ListExisting  bool

 }

 // AddrSubscribeWithOptions work like AddrSubscribe but enable to

@@ -260,11 +275,11 @@ func AddrSubscribeWithOptions(ch chan<- AddrUpdate, done <-chan struct{}, option

 		none := netns.None()

 		options.Namespace = &none

 	}

-	return addrSubscribeAt(*options.Namespace, netns.None(), ch, done, options.ErrorCallback)

+	return addrSubscribeAt(*options.Namespace, netns.None(), ch, done, options.ErrorCallback, options.ListExisting)

 }

-func addrSubscribeAt(newNs, curNs netns.NsHandle, ch chan<- AddrUpdate, done <-chan struct{}, cberr func(error)) error {

-	s, err := nl.SubscribeAt(newNs, curNs, syscall.NETLINK_ROUTE, syscall.RTNLGRP_IPV4_IFADDR, syscall.RTNLGRP_IPV6_IFADDR)

+func addrSubscribeAt(newNs, curNs netns.NsHandle, ch chan<- AddrUpdate, done <-chan struct{}, cberr func(error), listExisting bool) error {

+	s, err := nl.SubscribeAt(newNs, curNs, unix.NETLINK_ROUTE, unix.RTNLGRP_IPV4_IFADDR, unix.RTNLGRP_IPV6_IFADDR)

 	if err != nil {

 		return err

 	}

@@ -274,6 +289,15 @@ func addrSubscribeAt(newNs, curNs netns.NsHandle, ch chan<- AddrUpdate, done <-c

 			s.Close()

 		}()

 	}

+	if listExisting {

+		req := pkgHandle.newNetlinkRequest(unix.RTM_GETADDR,

+			unix.NLM_F_DUMP)

+		infmsg := nl.NewIfInfomsg(unix.AF_UNSPEC)

+		req.AddData(infmsg)

+		if err := s.Send(req); err != nil {

+			return err

+		}

+	}

 	go func() {

 		defer close(ch)

 		for {

@@ -285,8 +309,22 @@ func addrSubscribeAt(newNs, curNs netns.NsHandle, ch chan<- AddrUpdate, done <-c

 				return

 			}

 			for _, m := range msgs {

+				if m.Header.Type == unix.NLMSG_DONE {

+					continue

+				}

+				if m.Header.Type == unix.NLMSG_ERROR {

+					native := nl.NativeEndian()

+					error := int32(native.Uint32(m.Data[0:4]))

+					if error == 0 {

+						continue

+					}

+					if cberr != nil {

+						cberr(syscall.Errno(-error))

+					}

+					return

+				}

 				msgType := m.Header.Type

-				if msgType != syscall.RTM_NEWADDR && msgType != syscall.RTM_DELADDR {

+				if msgType != unix.RTM_NEWADDR && msgType != unix.RTM_DELADDR {

 					if cberr != nil {

 						cberr(fmt.Errorf("bad message type: %d", msgType))

 					}

@@ -303,7 +341,7 @@ func addrSubscribeAt(newNs, curNs netns.NsHandle, ch chan<- AddrUpdate, done <-c

 				ch <- AddrUpdate{LinkAddress: *addr.IPNet,

 					LinkIndex:   ifindex,

-					NewAddr:     msgType == syscall.RTM_NEWADDR,

+					NewAddr:     msgType == unix.RTM_NEWADDR,

 					Flags:       addr.Flags,

 					Scope:       addr.Scope,

 					PreferedLft: addr.PreferedLft,

@@ -1,49 +1,12 @@

 package netlink

-/*

-#include <asm/types.h>

-#include <asm/unistd.h>

-#include <errno.h>

-#include <stdio.h>

-#include <stdint.h>

-#include <unistd.h>

+import (

+	"unsafe"

-static int load_simple_bpf(int prog_type, int ret) {

-#ifdef __NR_bpf

-	// { return ret; }

-	__u64 __attribute__((aligned(8))) insns[] = {

-		0x00000000000000b7ull | ((__u64)ret<<32),

-		0x0000000000000095ull,

-	};

-	__u8 __attribute__((aligned(8))) license[] = "ASL2";

-	// Copied from a header file since libc is notoriously slow to update.

-	// The call will succeed or fail and that will be our indication on

-	// whether or not it is supported.

-	struct {

-		__u32 prog_type;

-		__u32 insn_cnt;

-		__u64 insns;

-		__u64 license;

-		__u32 log_level;

-		__u32 log_size;

-		__u64 log_buf;

-		__u32 kern_version;

-	} __attribute__((aligned(8))) attr = {

-		.prog_type = prog_type,

-		.insn_cnt = 2,

-		.insns = (uintptr_t)&insns,

-		.license = (uintptr_t)&license,

-	};

-	return syscall(__NR_bpf, 5, &attr, sizeof(attr));

-#else

-	errno = EINVAL;

-	return -1;

-#endif

-}

-*/

-import "C"

+	"golang.org/x/sys/unix"

+)

-type BpfProgType C.int

+type BpfProgType uint32

 const (

 	BPF_PROG_TYPE_UNSPEC BpfProgType = iota

@@ -55,8 +18,36 @@ const (

 	BPF_PROG_TYPE_XDP

 )

-// loadSimpleBpf loads a trivial bpf program for testing purposes

-func loadSimpleBpf(progType BpfProgType, ret int) (int, error) {

-	fd, err := C.load_simple_bpf(C.int(progType), C.int(ret))

-	return int(fd), err

+type BPFAttr struct {

+	ProgType    uint32

+	InsnCnt     uint32

+	Insns       uintptr

+	License     uintptr

+	LogLevel    uint32

+	LogSize     uint32

+	LogBuf      uintptr

+	KernVersion uint32

+}

+

+// loadSimpleBpf loads a trivial bpf program for testing purposes.

+func loadSimpleBpf(progType BpfProgType, ret uint32) (int, error) {

+	insns := []uint64{

+		0x00000000000000b7 | (uint64(ret) << 32),

+		0x0000000000000095,

+	}

+	license := []byte{'A', 'S', 'L', '2', '\x00'}

+	attr := BPFAttr{

+		ProgType: uint32(progType),

+		InsnCnt:  uint32(len(insns)),

+		Insns:    uintptr(unsafe.Pointer(&insns[0])),

+		License:  uintptr(unsafe.Pointer(&license[0])),

+	}

+	fd, _, errno := unix.Syscall(unix.SYS_BPF,

+		5, /* bpf cmd */

+		uintptr(unsafe.Pointer(&attr)),

+		unsafe.Sizeof(attr))

+	if errno != 0 {

+		return 0, errno

+	}

+	return int(fd), nil

 }

@@ -2,9 +2,9 @@ package netlink

 import (

 	"fmt"

-	"syscall"

 	"github.com/vishvananda/netlink/nl"

+	"golang.org/x/sys/unix"

 )

 // BridgeVlanList gets a map of device id to bridge vlan infos.

@@ -16,12 +16,12 @@ func BridgeVlanList() (map[int32][]*nl.BridgeVlanInfo, error) {

 // BridgeVlanList gets a map of device id to bridge vlan infos.

 // Equivalent to: `bridge vlan show`

 func (h *Handle) BridgeVlanList() (map[int32][]*nl.BridgeVlanInfo, error) {

-	req := h.newNetlinkRequest(syscall.RTM_GETLINK, syscall.NLM_F_DUMP)

-	msg := nl.NewIfInfomsg(syscall.AF_BRIDGE)

+	req := h.newNetlinkRequest(unix.RTM_GETLINK, unix.NLM_F_DUMP)

+	msg := nl.NewIfInfomsg(unix.AF_BRIDGE)

 	req.AddData(msg)

-	req.AddData(nl.NewRtAttr(nl.IFLA_EXT_MASK, nl.Uint32Attr(uint32(nl.RTEXT_FILTER_BRVLAN))))

+	req.AddData(nl.NewRtAttr(unix.IFLA_EXT_MASK, nl.Uint32Attr(uint32(nl.RTEXT_FILTER_BRVLAN))))

-	msgs, err := req.Execute(syscall.NETLINK_ROUTE, syscall.RTM_NEWLINK)

+	msgs, err := req.Execute(unix.NETLINK_ROUTE, unix.RTM_NEWLINK)

 	if err != nil {

 		return nil, err

 	}

@@ -35,7 +35,7 @@ func (h *Handle) BridgeVlanList() (map[int32][]*nl.BridgeVlanInfo, error) {

 		}

 		for _, attr := range attrs {

 			switch attr.Attr.Type {

-			case nl.IFLA_AF_SPEC:

+			case unix.IFLA_AF_SPEC:

 				//nested attr

 				nestAttrs, err := nl.ParseRouteAttr(attr.Value)

 				if err != nil {

@@ -63,7 +63,7 @@ func BridgeVlanAdd(link Link, vid uint16, pvid, untagged, self, master bool) err

 // BridgeVlanAdd adds a new vlan filter entry

 // Equivalent to: `bridge vlan add dev DEV vid VID [ pvid ] [ untagged ] [ self ] [ master ]`

 func (h *Handle) BridgeVlanAdd(link Link, vid uint16, pvid, untagged, self, master bool) error {

-	return h.bridgeVlanModify(syscall.RTM_SETLINK, link, vid, pvid, untagged, self, master)

+	return h.bridgeVlanModify(unix.RTM_SETLINK, link, vid, pvid, untagged, self, master)

 }

 // BridgeVlanDel adds a new vlan filter entry

@@ -75,19 +75,19 @@ func BridgeVlanDel(link Link, vid uint16, pvid, untagged, self, master bool) err

 // BridgeVlanDel adds a new vlan filter entry

 // Equivalent to: `bridge vlan del dev DEV vid VID [ pvid ] [ untagged ] [ self ] [ master ]`

 func (h *Handle) BridgeVlanDel(link Link, vid uint16, pvid, untagged, self, master bool) error {

-	return h.bridgeVlanModify(syscall.RTM_DELLINK, link, vid, pvid, untagged, self, master)

+	return h.bridgeVlanModify(unix.RTM_DELLINK, link, vid, pvid, untagged, self, master)

 }

 func (h *Handle) bridgeVlanModify(cmd int, link Link, vid uint16, pvid, untagged, self, master bool) error {

 	base := link.Attrs()

 	h.ensureIndex(base)

-	req := h.newNetlinkRequest(cmd, syscall.NLM_F_ACK)

+	req := h.newNetlinkRequest(cmd, unix.NLM_F_ACK)

-	msg := nl.NewIfInfomsg(syscall.AF_BRIDGE)

+	msg := nl.NewIfInfomsg(unix.AF_BRIDGE)

 	msg.Index = int32(base.Index)

 	req.AddData(msg)

-	br := nl.NewRtAttr(nl.IFLA_AF_SPEC, nil)

+	br := nl.NewRtAttr(unix.IFLA_AF_SPEC, nil)

 	var flags uint16

 	if self {

 		flags |= nl.BRIDGE_FLAGS_SELF

@@ -107,7 +107,7 @@ func (h *Handle) bridgeVlanModify(cmd int, link Link, vid uint16, pvid, untagged

 	}

 	nl.NewRtAttrChild(br, nl.IFLA_BRIDGE_VLAN_INFO, vlanInfo.Serialize())

 	req.AddData(br)

-	_, err := req.Execute(syscall.NETLINK_ROUTE, 0)

+	_, err := req.Execute(unix.NETLINK_ROUTE, 0)

 	if err != nil {

 		return err

 	}

@@ -5,6 +5,7 @@ import (

 	"syscall"

 	"github.com/vishvananda/netlink/nl"

+	"golang.org/x/sys/unix"

 )

 // NOTE: function is in here because it uses other linux functions

@@ -50,7 +51,7 @@ func ClassDel(class Class) error {

 // ClassDel will delete a class from the system.

 // Equivalent to: `tc class del $class`

 func (h *Handle) ClassDel(class Class) error {

-	return h.classModify(syscall.RTM_DELTCLASS, 0, class)

+	return h.classModify(unix.RTM_DELTCLASS, 0, class)

 }

 // ClassChange will change a class in place

@@ -64,7 +65,7 @@ func ClassChange(class Class) error {

 // Equivalent to: `tc class change $class`

 // The parent and handle MUST NOT be changed.

 func (h *Handle) ClassChange(class Class) error {

-	return h.classModify(syscall.RTM_NEWTCLASS, 0, class)

+	return h.classModify(unix.RTM_NEWTCLASS, 0, class)

 }

 // ClassReplace will replace a class to the system.

@@ -82,7 +83,7 @@ func ClassReplace(class Class) error {

 // If a class already exist with this parent/handle pair, the class is changed.

 // If a class does not already exist with this parent/handle, a new class is created.

 func (h *Handle) ClassReplace(class Class) error {

-	return h.classModify(syscall.RTM_NEWTCLASS, syscall.NLM_F_CREATE, class)

+	return h.classModify(unix.RTM_NEWTCLASS, unix.NLM_F_CREATE, class)

 }

 // ClassAdd will add a class to the system.

@@ -95,14 +96,14 @@ func ClassAdd(class Class) error {

 // Equivalent to: `tc class add $class`

 func (h *Handle) ClassAdd(class Class) error {

 	return h.classModify(

-		syscall.RTM_NEWTCLASS,

-		syscall.NLM_F_CREATE|syscall.NLM_F_EXCL,

+		unix.RTM_NEWTCLASS,

+		unix.NLM_F_CREATE|unix.NLM_F_EXCL,

 		class,

 	)

 }

 func (h *Handle) classModify(cmd, flags int, class Class) error {

-	req := h.newNetlinkRequest(cmd, flags|syscall.NLM_F_ACK)

+	req := h.newNetlinkRequest(cmd, flags|unix.NLM_F_ACK)

 	base := class.Attrs()

 	msg := &nl.TcMsg{

 		Family:  nl.FAMILY_ALL,

@@ -112,12 +113,12 @@ func (h *Handle) classModify(cmd, flags int, class Class) error {

 	}

 	req.AddData(msg)

-	if cmd != syscall.RTM_DELTCLASS {

+	if cmd != unix.RTM_DELTCLASS {

 		if err := classPayload(req, class); err != nil {

 			return err

 		}

 	}

-	_, err := req.Execute(syscall.NETLINK_ROUTE, 0)

+	_, err := req.Execute(unix.NETLINK_ROUTE, 0)

 	return err

 }

@@ -141,12 +142,12 @@ func classPayload(req *nl.NetlinkRequest, class Class) error {

 		var rtab [256]uint32

 		var ctab [256]uint32

 		tcrate := nl.TcRateSpec{Rate: uint32(htb.Rate)}

-		if CalcRtable(&tcrate, rtab, cellLog, uint32(mtu), linklayer) < 0 {

+		if CalcRtable(&tcrate, rtab[:], cellLog, uint32(mtu), linklayer) < 0 {

 			return errors.New("HTB: failed to calculate rate table")

 		}

 		opt.Rate = tcrate

 		tcceil := nl.TcRateSpec{Rate: uint32(htb.Ceil)}

-		if CalcRtable(&tcceil, ctab, ccellLog, uint32(mtu), linklayer) < 0 {

+		if CalcRtable(&tcceil, ctab[:], ccellLog, uint32(mtu), linklayer) < 0 {

 			return errors.New("HTB: failed to calculate ceil rate table")

 		}

 		opt.Ceil = tcceil

@@ -169,7 +170,7 @@ func ClassList(link Link, parent uint32) ([]Class, error) {

 // Equivalent to: `tc class show`.

 // Generally returns nothing if link and parent are not specified.

 func (h *Handle) ClassList(link Link, parent uint32) ([]Class, error) {

-	req := h.newNetlinkRequest(syscall.RTM_GETTCLASS, syscall.NLM_F_DUMP)

+	req := h.newNetlinkRequest(unix.RTM_GETTCLASS, unix.NLM_F_DUMP)

 	msg := &nl.TcMsg{

 		Family: nl.FAMILY_ALL,

 		Parent: parent,

@@ -181,7 +182,7 @@ func (h *Handle) ClassList(link Link, parent uint32) ([]Class, error) {