diff -urp v3.3/linux/include/linux/rtnetlink.h linux/include/linux/rtnetlink.h
--- v3.3/linux/include/linux/rtnetlink.h	2012-03-20 00:05:18.000000000 +0200
+++ linux/include/linux/rtnetlink.h	2012-03-20 00:22:27.004378140 +0200
@@ -312,6 +312,8 @@ struct rtnexthop {
 #define RTNH_F_DEAD		1	/* Nexthop is dead (used by multipath)	*/
 #define RTNH_F_PERVASIVE	2	/* Do recursive gateway lookup	*/
 #define RTNH_F_ONLINK		4	/* Gateway is forced on link	*/
+#define RTNH_F_SUSPECT		8	/* We don't know the real state	*/
+#define RTNH_F_BADSTATE		(RTNH_F_DEAD | RTNH_F_SUSPECT)
 
 /* Macros to handle hexthops */
 
diff -urp v3.3/linux/include/net/flow.h linux/include/net/flow.h
--- v3.3/linux/include/net/flow.h	2012-03-20 00:05:18.000000000 +0200
+++ linux/include/net/flow.h	2012-03-20 00:22:27.005378035 +0200
@@ -72,6 +72,7 @@ struct flowi4 {
 #define fl4_ipsec_spi		uli.spi
 #define fl4_mh_type		uli.mht.type
 #define fl4_gre_key		uli.gre_key
+	__be32			fl4_gw;
 } __attribute__((__aligned__(BITS_PER_LONG/8)));
 
 static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
@@ -92,6 +93,7 @@ static inline void flowi4_init_output(st
 	fl4->saddr = saddr;
 	fl4->fl4_dport = dport;
 	fl4->fl4_sport = sport;
+	fl4->fl4_gw = 0;
 }
 
 /* Reset some input parameters after previous lookup */
diff -urp v3.3/linux/include/net/ip_fib.h linux/include/net/ip_fib.h
--- v3.3/linux/include/net/ip_fib.h	2011-07-22 09:43:31.000000000 +0300
+++ linux/include/net/ip_fib.h	2012-03-20 00:22:27.006377284 +0200
@@ -223,6 +223,8 @@ extern int fib_lookup(struct net *n, str
 extern struct fib_table *fib_new_table(struct net *net, u32 id);
 extern struct fib_table *fib_get_table(struct net *net, u32 id);
 
+extern int fib_result_table(struct fib_result *res);
+
 #endif /* CONFIG_IP_MULTIPLE_TABLES */
 
 /* Exported by fib_frontend.c */
@@ -231,7 +233,8 @@ extern void		ip_fib_init(void);
 extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
 			       u8 tos, int oif, struct net_device *dev,
 			       __be32 *spec_dst, u32 *itag);
-extern void fib_select_default(struct fib_result *res);
+extern void fib_select_default(const struct flowi4 *flp,
+			       struct fib_result *res);
 
 /* Exported by fib_semantics.c */
 extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
@@ -239,7 +242,8 @@ extern int fib_sync_down_dev(struct net_
 extern int fib_sync_down_addr(struct net *net, __be32 local);
 extern void fib_update_nh_saddrs(struct net_device *dev);
 extern int fib_sync_up(struct net_device *dev);
-extern void fib_select_multipath(struct fib_result *res);
+extern void fib_select_multipath(const struct flowi4 *flp,
+				 struct fib_result *res);
 
 /* Exported by fib_trie.c */
 extern void fib_trie_init(void);
@@ -282,4 +286,6 @@ static inline void fib_proc_exit(struct 
 }
 #endif
 
+extern rwlock_t fib_nhflags_lock;
+
 #endif  /* _NET_FIB_H */
diff -urp v3.3/linux/include/net/netfilter/nf_nat.h linux/include/net/netfilter/nf_nat.h
--- v3.3/linux/include/net/netfilter/nf_nat.h	2012-03-20 00:05:18.000000000 +0200
+++ linux/include/net/netfilter/nf_nat.h	2012-03-20 00:22:27.006377284 +0200
@@ -48,6 +48,13 @@ struct nf_conn_nat {
 #endif
 };
 
+/* Call input routing for SNAT-ed traffic */
+extern unsigned int ip_nat_route_input(unsigned int hooknum,
+				       struct sk_buff *skb,
+				       const struct net_device *in,
+				       const struct net_device *out,
+				       int (*okfn)(struct sk_buff *));
+
 /* Set up the info structure to map into this range. */
 extern unsigned int nf_nat_setup_info(struct nf_conn *ct,
 				      const struct nf_nat_ipv4_range *range,
diff -urp v3.3/linux/include/net/route.h linux/include/net/route.h
--- v3.3/linux/include/net/route.h	2012-03-20 00:05:18.000000000 +0200
+++ linux/include/net/route.h	2012-03-20 00:22:27.007377293 +0200
@@ -48,6 +48,8 @@ struct rtable {
 	/* Lookup key. */
 	__be32			rt_key_dst;
 	__be32			rt_key_src;
+	__be32			rt_key_lsrc;
+	__be32			rt_key_gw;
 
 	int			rt_genid;
 	unsigned		rt_flags;
@@ -191,6 +193,7 @@ extern void		ip_rt_multicast_event(struc
 extern int		ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
 extern void		ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
 extern int		ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb);
+extern int		ip_route_input_lookup(struct sk_buff*, __be32 dst, __be32 src, u8 tos, struct net_device *devin, __be32 lsrc);
 
 struct in_ifaddr;
 extern void fib_add_ifaddr(struct in_ifaddr *);
diff -urp v3.3/linux/net/bridge/br_netfilter.c linux/net/bridge/br_netfilter.c
--- v3.3/linux/net/bridge/br_netfilter.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/bridge/br_netfilter.c	2012-03-20 00:22:27.008377024 +0200
@@ -436,6 +436,9 @@ static int br_nf_pre_routing_finish(stru
 	struct rtable *rt;
 	int err;
 
+	/* Old skb->dst is not expected, it is lost in all cases */
+	skb_dst_drop(skb);
+
 	if (nf_bridge->mask & BRNF_PKT_TYPE) {
 		skb->pkt_type = PACKET_OTHERHOST;
 		nf_bridge->mask ^= BRNF_PKT_TYPE;
diff -urp v3.3/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c
--- v3.3/linux/net/ipv4/fib_frontend.c	2011-10-25 23:01:50.000000000 +0300
+++ linux/net/ipv4/fib_frontend.c	2012-03-20 00:22:27.009376876 +0200
@@ -48,6 +48,8 @@
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
 
+#define FIB_RES_TABLE(r) (RT_TABLE_MAIN)
+
 static int __net_init fib4_rules_init(struct net *net)
 {
 	struct fib_table *local_table, *main_table;
@@ -72,6 +74,8 @@ fail:
 }
 #else
 
+#define FIB_RES_TABLE(r) (fib_result_table(r))
+
 struct fib_table *fib_new_table(struct net *net, u32 id)
 {
 	struct fib_table *tb;
@@ -196,6 +200,9 @@ int fib_validate_source(struct sk_buff *
 	struct in_device *in_dev;
 	struct flowi4 fl4;
 	struct fib_result res;
+	int table;
+	unsigned char prefixlen;
+	unsigned char scope;
 	int no_addr, rpf, accept_local;
 	bool dev_match;
 	int ret;
@@ -207,6 +214,7 @@ int fib_validate_source(struct sk_buff *
 	fl4.saddr = dst;
 	fl4.flowi4_tos = tos;
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+	fl4.fl4_gw = 0;
 
 	no_addr = rpf = accept_local = 0;
 	in_dev = __in_dev_get_rcu(dev);
@@ -253,17 +261,24 @@ int fib_validate_source(struct sk_buff *
 	}
 	if (no_addr)
 		goto last_resort;
-	if (rpf == 1)
-		goto e_rpf;
+	table = FIB_RES_TABLE(&res);
+	prefixlen = res.prefixlen;
+	scope = res.scope;
 	fl4.flowi4_oif = dev->ifindex;
 
 	ret = 0;
 	if (fib_lookup(net, &fl4, &res) == 0) {
-		if (res.type == RTN_UNICAST) {
+		if (res.type == RTN_UNICAST &&
+		    ((table == FIB_RES_TABLE(&res) &&
+		      res.prefixlen >= prefixlen && res.scope >= scope) ||
+		     !rpf)) {
 			*spec_dst = FIB_RES_PREFSRC(net, res);
 			ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;
+			return ret;
 		}
 	}
+	if (rpf == 1)
+		goto e_rpf;
 	return ret;
 
 last_resort:
@@ -967,9 +982,7 @@ static int fib_inetaddr_event(struct not
 	switch (event) {
 	case NETDEV_UP:
 		fib_add_ifaddr(ifa);
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
 		fib_sync_up(dev);
-#endif
 		atomic_inc(&net->ipv4.dev_addr_genid);
 		rt_cache_flush(dev_net(dev), -1);
 		break;
@@ -1008,9 +1021,7 @@ static int fib_netdev_event(struct notif
 		for_ifa(in_dev) {
 			fib_add_ifaddr(ifa);
 		} endfor_ifa(in_dev);
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
 		fib_sync_up(dev);
-#endif
 		atomic_inc(&net->ipv4.dev_addr_genid);
 		rt_cache_flush(dev_net(dev), -1);
 		break;
diff -urp v3.3/linux/net/ipv4/fib_lookup.h linux/net/ipv4/fib_lookup.h
--- v3.3/linux/net/ipv4/fib_lookup.h	2011-05-20 10:38:08.000000000 +0300
+++ linux/net/ipv4/fib_lookup.h	2012-03-20 00:22:27.010376647 +0200
@@ -8,6 +8,7 @@
 struct fib_alias {
 	struct list_head	fa_list;
 	struct fib_info		*fa_info;
+	int			fa_last_dflt;
 	u8			fa_tos;
 	u8			fa_type;
 	u8			fa_state;
@@ -38,7 +39,8 @@ extern struct fib_alias *fib_find_alias(
 					u8 tos, u32 prio);
 extern int fib_detect_death(struct fib_info *fi, int order,
 			    struct fib_info **last_resort,
-			    int *last_idx, int dflt);
+			    int *last_idx, int *dflt, int *last_nhsel,
+			    const struct flowi4 *flp);
 
 static inline void fib_result_assign(struct fib_result *res,
 				     struct fib_info *fi)
diff -urp v3.3/linux/net/ipv4/fib_rules.c linux/net/ipv4/fib_rules.c
--- v3.3/linux/net/ipv4/fib_rules.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/ipv4/fib_rules.c	2012-03-20 00:22:27.010376647 +0200
@@ -54,6 +54,11 @@ u32 fib_rules_tclass(const struct fib_re
 }
 #endif
 
+int fib_result_table(struct fib_result *res)
+{
+	return res->r->table;
+}
+
 int fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
 {
 	struct fib_lookup_arg arg = {
diff -urp v3.3/linux/net/ipv4/fib_semantics.c linux/net/ipv4/fib_semantics.c
--- v3.3/linux/net/ipv4/fib_semantics.c	2011-10-25 23:01:50.000000000 +0300
+++ linux/net/ipv4/fib_semantics.c	2012-03-20 00:22:27.012377648 +0200
@@ -51,6 +51,7 @@ static struct hlist_head *fib_info_hash;
 static struct hlist_head *fib_info_laddrhash;
 static unsigned int fib_info_hash_size;
 static unsigned int fib_info_cnt;
+DEFINE_RWLOCK(fib_nhflags_lock);
 
 #define DEVINDEX_HASHBITS 8
 #define DEVINDEX_HASHSIZE (1U << DEVINDEX_HASHBITS)
@@ -199,7 +200,7 @@ static inline int nh_comp(const struct f
 #ifdef CONFIG_IP_ROUTE_CLASSID
 		    nh->nh_tclassid != onh->nh_tclassid ||
 #endif
-		    ((nh->nh_flags ^ onh->nh_flags) & ~RTNH_F_DEAD))
+		    ((nh->nh_flags ^ onh->nh_flags) & ~RTNH_F_BADSTATE))
 			return -1;
 		onh++;
 	} endfor_nexthops(fi);
@@ -251,7 +252,7 @@ static struct fib_info *fib_find_info(co
 		    nfi->fib_priority == fi->fib_priority &&
 		    memcmp(nfi->fib_metrics, fi->fib_metrics,
 			   sizeof(u32) * RTAX_MAX) == 0 &&
-		    ((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_F_DEAD) == 0 &&
+		    ((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_F_BADSTATE) == 0 &&
 		    (nfi->fib_nhs == 0 || nh_comp(fi, nfi) == 0))
 			return fi;
 	}
@@ -362,26 +363,70 @@ struct fib_alias *fib_find_alias(struct 
 }
 
 int fib_detect_death(struct fib_info *fi, int order,
-		     struct fib_info **last_resort, int *last_idx, int dflt)
+		     struct fib_info **last_resort, int *last_idx, int *dflt,
+		     int *last_nhsel, const struct flowi4 *flp)
 {
 	struct neighbour *n;
-	int state = NUD_NONE;
+	int nhsel;
+	int state;
+	struct fib_nh * nh;
+	__be32 dst;
+	int flag, dead = 1;
+
+	/* change_nexthops(fi) { */
+	for (nhsel = 0, nh = fi->fib_nh; nhsel < fi->fib_nhs; nh++, nhsel++) {
+		if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
+			continue;
+		if (flp->fl4_gw && flp->fl4_gw != nh->nh_gw && nh->nh_gw &&
+		    nh->nh_scope == RT_SCOPE_LINK)
+			continue;
+		if (nh->nh_flags & RTNH_F_DEAD)
+			continue;
 
-	n = neigh_lookup(&arp_tbl, &fi->fib_nh[0].nh_gw, fi->fib_dev);
-	if (n) {
-		state = n->nud_state;
-		neigh_release(n);
-	}
-	if (state == NUD_REACHABLE)
-		return 0;
-	if ((state & NUD_VALID) && order != dflt)
-		return 0;
-	if ((state & NUD_VALID) ||
-	    (*last_idx < 0 && order > dflt)) {
-		*last_resort = fi;
-		*last_idx = order;
+		flag = 0;
+		if (nh->nh_dev->flags & IFF_NOARP) {
+			dead = 0;
+			goto setfl;
+		}
+
+		dst = nh->nh_gw;
+		if (!nh->nh_gw || nh->nh_scope != RT_SCOPE_LINK)
+			dst = flp->daddr;
+
+		state = NUD_NONE;
+		n = neigh_lookup(&arp_tbl, &dst, nh->nh_dev);
+		if (n) {
+			state = n->nud_state;
+			neigh_release(n);
+		}
+		if (state == NUD_REACHABLE ||
+		    ((state & NUD_VALID) && order != *dflt)) {
+			dead = 0;
+			goto setfl;
+		}
+		if (!(state & NUD_VALID))
+			flag = 1;
+		if (!dead)
+			goto setfl;
+		if ((state & NUD_VALID) ||
+		    (*last_idx < 0 && order >= *dflt)) {
+			*last_resort = fi;
+			*last_idx = order;
+			*last_nhsel = nhsel;
+		}
+
+		setfl:
+
+		read_lock_bh(&fib_nhflags_lock);
+		if (flag)
+			nh->nh_flags |= RTNH_F_SUSPECT;
+		else
+			nh->nh_flags &= ~RTNH_F_SUSPECT;
+		read_unlock_bh(&fib_nhflags_lock);
 	}
-	return 1;
+	/* } endfor_nexthops(fi) */
+
+	return dead;
 }
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -550,8 +595,11 @@ static int fib_check_nh(struct fib_confi
 			dev = __dev_get_by_index(net, nh->nh_oif);
 			if (!dev)
 				return -ENODEV;
-			if (!(dev->flags & IFF_UP))
-				return -ENETDOWN;
+			if (!(dev->flags & IFF_UP)) {
+				if (fi->fib_protocol != RTPROT_STATIC)
+					return -ENETDOWN;
+				nh->nh_flags |= RTNH_F_DEAD;
+			}
 			nh->nh_dev = dev;
 			dev_hold(dev);
 			nh->nh_scope = RT_SCOPE_LINK;
@@ -569,21 +617,41 @@ static int fib_check_nh(struct fib_confi
 			if (fl4.flowi4_scope < RT_SCOPE_LINK)
 				fl4.flowi4_scope = RT_SCOPE_LINK;
 			err = fib_lookup(net, &fl4, &res);
-			if (err) {
-				rcu_read_unlock();
-				return err;
+		}
+		if (err) {
+			struct in_device *in_dev;
+
+			if (err != -ENETUNREACH ||
+			    fi->fib_protocol != RTPROT_STATIC)
+				goto out;
+
+			in_dev = inetdev_by_index(net, nh->nh_oif);
+			if (in_dev == NULL ||
+			    in_dev->dev->flags & IFF_UP)
+				goto out;
+			nh->nh_flags |= RTNH_F_DEAD;
+			nh->nh_scope = RT_SCOPE_LINK;
+			nh->nh_dev = in_dev->dev;
+			dev_hold(nh->nh_dev);
+		} else {
+			err = -EINVAL;
+			if (res.type != RTN_UNICAST && res.type != RTN_LOCAL)
+				goto out;
+			nh->nh_scope = res.scope;
+			nh->nh_oif = FIB_RES_OIF(res);
+			nh->nh_dev = dev = FIB_RES_DEV(res);
+			if (!dev)
+				goto out;
+			dev_hold(dev);
+			if (!(nh->nh_dev->flags & IFF_UP)) {
+				if (fi->fib_protocol != RTPROT_STATIC) {
+					err = -ENETDOWN;
+					goto out;
+				}
+				nh->nh_flags |= RTNH_F_DEAD;
 			}
+			err = 0;
 		}
-		err = -EINVAL;
-		if (res.type != RTN_UNICAST && res.type != RTN_LOCAL)
-			goto out;
-		nh->nh_scope = res.scope;
-		nh->nh_oif = FIB_RES_OIF(res);
-		nh->nh_dev = dev = FIB_RES_DEV(res);
-		if (!dev)
-			goto out;
-		dev_hold(dev);
-		err = (dev->flags & IFF_UP) ? 0 : -ENETDOWN;
 	} else {
 		struct in_device *in_dev;
 
@@ -596,8 +664,11 @@ static int fib_check_nh(struct fib_confi
 		if (in_dev == NULL)
 			goto out;
 		err = -ENETDOWN;
-		if (!(in_dev->dev->flags & IFF_UP))
-			goto out;
+		if (!(in_dev->dev->flags & IFF_UP)) {
+			if (fi->fib_protocol != RTPROT_STATIC)
+				goto out;
+			nh->nh_flags |= RTNH_F_DEAD;
+		}
 		nh->nh_dev = in_dev->dev;
 		dev_hold(nh->nh_dev);
 		nh->nh_scope = RT_SCOPE_HOST;
@@ -1050,18 +1121,29 @@ int fib_sync_down_dev(struct net_device 
 		prev_fi = fi;
 		dead = 0;
 		change_nexthops(fi) {
-			if (nexthop_nh->nh_flags & RTNH_F_DEAD)
-				dead++;
-			else if (nexthop_nh->nh_dev == dev &&
-				 nexthop_nh->nh_scope != scope) {
-				nexthop_nh->nh_flags |= RTNH_F_DEAD;
+			if (nexthop_nh->nh_flags & RTNH_F_DEAD) {
+				if (fi->fib_protocol != RTPROT_STATIC ||
+				    nexthop_nh->nh_dev == NULL ||
+				    __in_dev_get_rtnl(nexthop_nh->nh_dev) == NULL ||
+				    nexthop_nh->nh_dev->flags&IFF_UP)
+					dead++;
+			} else if (nexthop_nh->nh_dev == dev &&
+				   nexthop_nh->nh_scope != scope) {
+				write_lock_bh(&fib_nhflags_lock);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-				spin_lock_bh(&fib_multipath_lock);
+				spin_lock(&fib_multipath_lock);
+				nexthop_nh->nh_flags |= RTNH_F_DEAD;
 				fi->fib_power -= nexthop_nh->nh_power;
 				nexthop_nh->nh_power = 0;
-				spin_unlock_bh(&fib_multipath_lock);
+				spin_unlock(&fib_multipath_lock);
+#else
+				nexthop_nh->nh_flags |= RTNH_F_DEAD;
 #endif
-				dead++;
+				write_unlock_bh(&fib_nhflags_lock);
+				if (fi->fib_protocol!=RTPROT_STATIC ||
+				    force ||
+				    __in_dev_get_rtnl(dev) == NULL)
+					dead++;
 			}
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
 			if (force > 1 && nexthop_nh->nh_dev == dev) {
@@ -1080,12 +1162,12 @@ int fib_sync_down_dev(struct net_device 
 }
 
 /* Must be invoked inside of an RCU protected region.  */
-void fib_select_default(struct fib_result *res)
+void fib_select_default(const struct flowi4 *flp, struct fib_result *res)
 {
 	struct fib_info *fi = NULL, *last_resort = NULL;
 	struct list_head *fa_head = res->fa_head;
-	struct fib_table *tb = res->table;
-	int order = -1, last_idx = -1;
+	int order = -1, last_idx = -1, last_dflt = -2, last_nhsel = 0;
+	struct fib_alias *first_fa = NULL;
 	struct fib_alias *fa;
 
 	list_for_each_entry_rcu(fa, fa_head, fa_list) {
@@ -1095,21 +1177,21 @@ void fib_select_default(struct fib_resul
 		    fa->fa_type != RTN_UNICAST)
 			continue;
 
+		if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
+			continue;
 		if (next_fi->fib_priority > res->fi->fib_priority)
 			break;
-		if (!next_fi->fib_nh[0].nh_gw ||
-		    next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
-			continue;
 
 		fib_alias_accessed(fa);
 
-		if (fi == NULL) {
-			if (next_fi != res->fi)
-				break;
-		} else if (!fib_detect_death(fi, order, &last_resort,
-					     &last_idx, tb->tb_default)) {
+		if (!first_fa) {
+			last_dflt = fa->fa_last_dflt;
+			first_fa = fa;
+		}
+		if (fi && !fib_detect_death(fi, order, &last_resort,
+		    &last_idx, &last_dflt, &last_nhsel, flp)) {
 			fib_result_assign(res, fi);
-			tb->tb_default = order;
+			first_fa->fa_last_dflt = order;
 			goto out;
 		}
 		fi = next_fi;
@@ -1117,29 +1199,38 @@ void fib_select_default(struct fib_resul
 	}
 
 	if (order <= 0 || fi == NULL) {
-		tb->tb_default = -1;
+		if (fi && fi->fib_nhs > 1 &&
+		    fib_detect_death(fi, order, &last_resort, &last_idx,
+				     &last_dflt, &last_nhsel, flp) &&
+		    last_resort == fi) {
+			read_lock_bh(&fib_nhflags_lock);
+			fi->fib_nh[last_nhsel].nh_flags &= ~RTNH_F_SUSPECT;
+			read_unlock_bh(&fib_nhflags_lock);
+		}
+		if (first_fa) first_fa->fa_last_dflt = -1;
 		goto out;
 	}
 
 	if (!fib_detect_death(fi, order, &last_resort, &last_idx,
-				tb->tb_default)) {
+				&last_dflt, &last_nhsel, flp)) {
 		fib_result_assign(res, fi);
-		tb->tb_default = order;
+		first_fa->fa_last_dflt = order;
 		goto out;
 	}
 
-	if (last_idx >= 0)
+	if (last_idx >= 0) {
 		fib_result_assign(res, last_resort);
-	tb->tb_default = last_idx;
+		read_lock_bh(&fib_nhflags_lock);
+		last_resort->fib_nh[last_nhsel].nh_flags &= ~RTNH_F_SUSPECT;
+		read_unlock_bh(&fib_nhflags_lock);
+		first_fa->fa_last_dflt = last_idx;
+	}
 out:
 	return;
 }
 
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
-
 /*
- * Dead device goes up. We wake up dead nexthops.
- * It takes sense only on multipath routes.
++   Dead device goes up or new address is added. We wake up dead nexthops.
  */
 int fib_sync_up(struct net_device *dev)
 {
@@ -1148,8 +1239,10 @@ int fib_sync_up(struct net_device *dev)
 	struct hlist_head *head;
 	struct hlist_node *node;
 	struct fib_nh *nh;
-	int ret;
+	struct fib_result res;
+	int ret, rep;
 
+repeat:
 	if (!(dev->flags & IFF_UP))
 		return 0;
 
@@ -1157,6 +1250,7 @@ int fib_sync_up(struct net_device *dev)
 	hash = fib_devindex_hashfn(dev->ifindex);
 	head = &fib_info_devhash[hash];
 	ret = 0;
+	rep = 0;
 
 	hlist_for_each_entry(nh, node, head, nh_hash) {
 		struct fib_info *fi = nh->nh_parent;
@@ -1169,21 +1263,44 @@ int fib_sync_up(struct net_device *dev)
 		prev_fi = fi;
 		alive = 0;
 		change_nexthops(fi) {
-			if (!(nexthop_nh->nh_flags & RTNH_F_DEAD)) {
-				alive++;
+			if (!(nexthop_nh->nh_flags & RTNH_F_DEAD))
 				continue;
-			}
 			if (nexthop_nh->nh_dev == NULL ||
 			    !(nexthop_nh->nh_dev->flags & IFF_UP))
 				continue;
 			if (nexthop_nh->nh_dev != dev ||
 			    !__in_dev_get_rtnl(dev))
 				continue;
+			if (nexthop_nh->nh_gw && fi->fib_protocol == RTPROT_STATIC) {
+				struct flowi4 fl4 = {
+					.daddr = nexthop_nh->nh_gw,
+					.flowi4_scope = nexthop_nh->nh_scope,
+					.flowi4_oif = nexthop_nh->nh_oif,
+				};
+
+				rcu_read_lock();
+				if (fib_lookup(dev_net(dev), &fl4, &res) != 0) {
+					rcu_read_unlock();
+					continue;
+				}
+				if (res.type != RTN_UNICAST &&
+				    res.type != RTN_LOCAL) {
+					rcu_read_unlock();
+					continue;
+				}
+				nexthop_nh->nh_scope = res.scope;
+				rcu_read_unlock();
+				rep = 1;
+			}
 			alive++;
+#ifdef CONFIG_IP_ROUTE_MULTIPATH
 			spin_lock_bh(&fib_multipath_lock);
 			nexthop_nh->nh_power = 0;
+#endif
 			nexthop_nh->nh_flags &= ~RTNH_F_DEAD;
+#ifdef CONFIG_IP_ROUTE_MULTIPATH
 			spin_unlock_bh(&fib_multipath_lock);
+#endif
 		} endfor_nexthops(fi)
 
 		if (alive > 0) {
@@ -1191,35 +1308,61 @@ int fib_sync_up(struct net_device *dev)
 			ret++;
 		}
 	}
+	if (rep)
+		goto repeat;
 
 	return ret;
 }
 
+#ifdef CONFIG_IP_ROUTE_MULTIPATH
+
 /*
  * The algorithm is suboptimal, but it provides really
  * fair weighted route distribution.
  */
-void fib_select_multipath(struct fib_result *res)
+void fib_select_multipath(const struct flowi4 *flp, struct fib_result *res)
 {
 	struct fib_info *fi = res->fi;
-	int w;
+	int w, alive;
 
 	spin_lock_bh(&fib_multipath_lock);
+	if (flp->flowi4_oif) {
+		int sel = -1;
+		w = -1;
+		change_nexthops(fi) {
+			if (flp->flowi4_oif != nexthop_nh->nh_oif)
+				continue;
+			if (flp->fl4_gw && flp->fl4_gw != nexthop_nh->nh_gw &&
+			    nexthop_nh->nh_gw &&
+			    nexthop_nh->nh_scope == RT_SCOPE_LINK)
+				continue;
+			if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE)) {
+				if (nexthop_nh->nh_power > w) {
+					w = nexthop_nh->nh_power;
+					sel = nhsel;
+				}
+			}
+		} endfor_nexthops(fi);
+		if (sel >= 0) {
+			spin_unlock_bh(&fib_multipath_lock);
+			res->nh_sel = sel;
+			return;
+		}
+		goto last_resort;
+	}
+
+repeat:
 	if (fi->fib_power <= 0) {
 		int power = 0;
 		change_nexthops(fi) {
-			if (!(nexthop_nh->nh_flags & RTNH_F_DEAD)) {
+			if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE)) {
 				power += nexthop_nh->nh_weight;
 				nexthop_nh->nh_power = nexthop_nh->nh_weight;
 			}
 		} endfor_nexthops(fi);
 		fi->fib_power = power;
-		if (power <= 0) {
-			spin_unlock_bh(&fib_multipath_lock);
-			/* Race condition: route has just become dead. */
-			res->nh_sel = 0;
-			return;
-		}
+		if (power <= 0)
+			goto last_resort;
 	}
 
 
@@ -1229,8 +1372,9 @@ void fib_select_multipath(struct fib_res
 
 	w = jiffies % fi->fib_power;
 
+	alive = 0;
 	change_nexthops(fi) {
-		if (!(nexthop_nh->nh_flags & RTNH_F_DEAD) &&
+		if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE) &&
 		    nexthop_nh->nh_power) {
 			w -= nexthop_nh->nh_power;
 			if (w <= 0) {
@@ -1240,11 +1384,29 @@ void fib_select_multipath(struct fib_res
 				spin_unlock_bh(&fib_multipath_lock);
 				return;
 			}
+			alive = 1;
+		}
+	} endfor_nexthops(fi);
+	if (alive) {
+		fi->fib_power = 0;
+		goto repeat;
+	}
+
+last_resort:
+	for_nexthops(fi) {
+		if (!(nh->nh_flags & RTNH_F_DEAD)) {
+			if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
+				continue;
+			if (flp->fl4_gw && flp->fl4_gw != nh->nh_gw &&
+			    nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK)
+				continue;
+			spin_unlock_bh(&fib_multipath_lock);
+			res->nh_sel = nhsel;
+			return;
 		}
 	} endfor_nexthops(fi);
 
 	/* Race condition: route has just become dead. */
-	res->nh_sel = 0;
 	spin_unlock_bh(&fib_multipath_lock);
 }
 #endif
diff -urp v3.3/linux/net/ipv4/fib_trie.c linux/net/ipv4/fib_trie.c
--- v3.3/linux/net/ipv4/fib_trie.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/ipv4/fib_trie.c	2012-03-20 00:22:27.015376153 +0200
@@ -1281,6 +1281,7 @@ int fib_table_insert(struct fib_table *t
 			fi_drop = fa->fa_info;
 			new_fa->fa_tos = fa->fa_tos;
 			new_fa->fa_info = fi;
+			new_fa->fa_last_dflt = -1;
 			new_fa->fa_type = cfg->fc_type;
 			state = fa->fa_state;
 			new_fa->fa_state = state & ~FA_S_ACCESSED;
@@ -1319,6 +1320,7 @@ int fib_table_insert(struct fib_table *t
 	new_fa->fa_tos = tos;
 	new_fa->fa_type = cfg->fc_type;
 	new_fa->fa_state = 0;
+	new_fa->fa_last_dflt = -1;
 	/*
 	 * Insert new entry to the list.
 	 */
@@ -1391,6 +1393,9 @@ static int check_leaf(struct fib_table *
 					continue;
 				if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
 					continue;
+				if (flp->fl4_gw && flp->fl4_gw != nh->nh_gw &&
+				    nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK)
+					continue;
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
 				t->stats.semantic_match_passed++;
diff -urp v3.3/linux/net/ipv4/netfilter/ipt_MASQUERADE.c linux/net/ipv4/netfilter/ipt_MASQUERADE.c
--- v3.3/linux/net/ipv4/netfilter/ipt_MASQUERADE.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/ipv4/netfilter/ipt_MASQUERADE.c	2012-03-20 00:23:51.811375069 +0200
@@ -51,7 +51,7 @@ masquerade_tg(struct sk_buff *skb, const
 	enum ip_conntrack_info ctinfo;
 	struct nf_nat_ipv4_range newrange;
 	const struct nf_nat_ipv4_multi_range_compat *mr;
-	const struct rtable *rt;
+	struct rtable *rt;
 	__be32 newsrc;
 
 	NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
@@ -69,13 +69,27 @@ masquerade_tg(struct sk_buff *skb, const
 		return NF_ACCEPT;
 
 	mr = par->targinfo;
-	rt = skb_rtable(skb);
-	newsrc = inet_select_addr(par->out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
-	if (!newsrc) {
-		pr_info("%s ate my IP address\n", par->out->name);
-		return NF_DROP;
+
+	{
+		struct flowi4 fl4 = { .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
+				      .flowi4_mark = skb->mark,
+				      .flowi4_oif = par->out->ifindex,
+				      .daddr = ip_hdr(skb)->daddr,
+				      .fl4_gw = skb_rtable(skb)->rt_gateway };
+		rt = ip_route_output_key(dev_net(par->out), &fl4);
+		if (IS_ERR(rt)) {
+			/* Funky routing can do this. */
+			if (net_ratelimit())
+				pr_info("%s:"
+				       " No route: Rusty's brain broke!\n",
+				       par->out->name);
+			return NF_DROP;
+		}
 	}
 
+	newsrc = rt->rt_src;
+	ip_rt_put(rt);
+
 	nat->masq_index = par->out->ifindex;
 
 	/* Transfer from original range. */
diff -urp v3.3/linux/net/ipv4/netfilter/nf_nat_core.c linux/net/ipv4/netfilter/nf_nat_core.c
--- v3.3/linux/net/ipv4/netfilter/nf_nat_core.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/ipv4/netfilter/nf_nat_core.c	2012-03-20 00:22:27.016376831 +0200
@@ -686,6 +686,52 @@ static struct pernet_operations nf_nat_n
 	.exit = nf_nat_net_exit,
 };
 
+unsigned int
+ip_nat_route_input(unsigned int hooknum,
+		struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		int (*okfn)(struct sk_buff *))
+{
+	struct iphdr *iph;
+	struct nf_conn *conn;
+	enum ip_conntrack_info ctinfo;
+	enum ip_conntrack_dir dir;
+	unsigned long statusbit;
+	__be32 saddr;
+
+	if (!(conn = nf_ct_get(skb, &ctinfo)))
+		return NF_ACCEPT;
+
+	if (!(conn->status & IPS_NAT_DONE_MASK))
+		return NF_ACCEPT;
+	dir = CTINFO2DIR(ctinfo);
+	statusbit = IPS_SRC_NAT;
+	if (dir == IP_CT_DIR_REPLY)
+		statusbit ^= IPS_NAT_MASK;
+	if (!(conn->status & statusbit))
+		return NF_ACCEPT;
+
+	if (skb_dst(skb))
+		return NF_ACCEPT;
+
+	if (skb->len < sizeof(struct iphdr))
+		return NF_ACCEPT;
+
+	/* use daddr in other direction as masquerade address (lsrc) */
+	iph = ip_hdr(skb);
+	saddr = conn->tuplehash[!dir].tuple.dst.u3.ip;
+	if (saddr == iph->saddr)
+		return NF_ACCEPT;
+
+	if (ip_route_input_lookup(skb, iph->daddr, iph->saddr, iph->tos,
+	    skb->dev, saddr))
+		return NF_DROP;
+
+	return NF_ACCEPT;
+}
+EXPORT_SYMBOL_GPL(ip_nat_route_input);
+
 static int __init nf_nat_init(void)
 {
 	size_t i;
diff -urp v3.3/linux/net/ipv4/netfilter/nf_nat_standalone.c linux/net/ipv4/netfilter/nf_nat_standalone.c
--- v3.3/linux/net/ipv4/netfilter/nf_nat_standalone.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/ipv4/netfilter/nf_nat_standalone.c	2012-03-20 00:22:27.017377011 +0200
@@ -250,6 +250,14 @@ static struct nf_hook_ops nf_nat_ops[] _
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},
+	/* Before routing, route before mangling */
+	{
+		.hook		= ip_nat_route_input,
+		.owner		= THIS_MODULE,
+		.pf		= NFPROTO_IPV4,
+		.hooknum	= NF_INET_PRE_ROUTING,
+		.priority	= NF_IP_PRI_LAST-1,
+	},
 	/* After packet filtering, change source */
 	{
 		.hook		= nf_nat_out,
diff -urp v3.3/linux/net/ipv4/route.c linux/net/ipv4/route.c
--- v3.3/linux/net/ipv4/route.c	2012-03-20 00:05:19.000000000 +0200
+++ linux/net/ipv4/route.c	2012-03-20 00:22:27.020376129 +0200
@@ -737,6 +737,8 @@ static inline int compare_keys(struct rt
 	return (((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
 		((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
 		(rt1->rt_mark ^ rt2->rt_mark) |
+		((__force u32)rt1->rt_key_lsrc ^ (__force u32)rt2->rt_key_lsrc) |
+		((__force u32)rt1->rt_key_gw ^ (__force u32)rt2->rt_key_gw) |
 		(rt1->rt_key_tos ^ rt2->rt_key_tos) |
 		(rt1->rt_route_iif ^ rt2->rt_route_iif) |
 		(rt1->rt_oif ^ rt2->rt_oif)) == 0;
@@ -1414,6 +1416,8 @@ static void check_peer_redir(struct dst_
 		rt->rt_gateway = orig_gw;
 		return;
 	}
+	if (rt->rt_key_gw)
+		rt->rt_key_gw = rt->rt_gateway;
 	old_n = xchg(&rt->dst._neighbour, n);
 	if (old_n)
 		neigh_release(old_n);
@@ -1957,6 +1961,8 @@ static void rt_init_metrics(struct rtabl
 		if (peer->redirect_learned.a4 &&
 		    peer->redirect_learned.a4 != rt->rt_gateway) {
 			rt->rt_gateway = peer->redirect_learned.a4;
+			if (rt->rt_key_gw)
+				rt->rt_key_gw = rt->rt_gateway;
 			rt->rt_flags |= RTCF_REDIRECTED;
 		}
 	} else {
@@ -2048,6 +2054,8 @@ static int ip_route_input_mc(struct sk_b
 
 	rth->rt_key_dst	= daddr;
 	rth->rt_key_src	= saddr;
+	rth->rt_key_lsrc = 0;
+	rth->rt_key_gw	= daddr;
 	rth->rt_genid	= rt_genid(dev_net(dev));
 	rth->rt_flags	= RTCF_MULTICAST;
 	rth->rt_type	= RTN_MULTICAST;
@@ -2122,7 +2130,7 @@ static int __mkroute_input(struct sk_buf
 			   const struct fib_result *res,
 			   struct in_device *in_dev,
 			   __be32 daddr, __be32 saddr, u32 tos,
-			   struct rtable **result)
+			   __be32 lsrc, struct rtable **result)
 {
 	struct rtable *rth;
 	int err;
@@ -2154,6 +2162,7 @@ static int __mkroute_input(struct sk_buf
 		flags |= RTCF_DIRECTSRC;
 
 	if (out_dev == in_dev && err &&
+	    !lsrc &&
 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
 		flags |= RTCF_DOREDIRECT;
@@ -2183,6 +2192,8 @@ static int __mkroute_input(struct sk_buf
 
 	rth->rt_key_dst	= daddr;
 	rth->rt_key_src	= saddr;
+	rth->rt_key_lsrc = lsrc;
+	rth->rt_key_gw	= 0;
 	rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
 	rth->rt_flags = flags;
 	rth->rt_type = res->type;
@@ -2212,21 +2223,23 @@ static int __mkroute_input(struct sk_buf
 
 static int ip_mkroute_input(struct sk_buff *skb,
 			    struct fib_result *res,
+			    struct net *net,
 			    const struct flowi4 *fl4,
 			    struct in_device *in_dev,
-			    __be32 daddr, __be32 saddr, u32 tos)
+			    __be32 daddr, __be32 saddr, u32 tos, __be32 lsrc)
 {
 	struct rtable* rth = NULL;
 	int err;
 	unsigned hash;
 
+	fib_select_default(fl4, res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
 	if (res->fi && res->fi->fib_nhs > 1)
-		fib_select_multipath(res);
+		fib_select_multipath(fl4, res);
 #endif
 
 	/* create a routing cache entry */
-	err = __mkroute_input(skb, res, in_dev, daddr, saddr, tos, &rth);
+	err = __mkroute_input(skb, res, in_dev, daddr, saddr, tos, lsrc, &rth);
 	if (err)
 		return err;
 
@@ -2251,7 +2264,7 @@ static int ip_mkroute_input(struct sk_bu
  */
 
 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-			       u8 tos, struct net_device *dev)
+			       u8 tos, struct net_device *dev, __be32 lsrc)
 {
 	struct fib_result res;
 	struct in_device *in_dev = __in_dev_get_rcu(dev);
@@ -2289,22 +2302,32 @@ static int ip_route_input_slow(struct sk
 	if (ipv4_is_zeronet(daddr) || ipv4_is_loopback(daddr))
 		goto martian_destination;
 
+	if (lsrc) {
+		if (ipv4_is_multicast(lsrc) || ipv4_is_lbcast(lsrc) ||
+		    ipv4_is_zeronet(lsrc) || ipv4_is_loopback(lsrc))
+			goto e_inval;
+	}
+
 	/*
 	 *	Now we are ready to route packet.
 	 */
 	fl4.flowi4_oif = 0;
-	fl4.flowi4_iif = dev->ifindex;
+	fl4.flowi4_iif = lsrc ?
+			 dev_net(dev)->loopback_dev->ifindex : dev->ifindex;
 	fl4.flowi4_mark = skb->mark;
 	fl4.flowi4_tos = tos;
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
 	fl4.daddr = daddr;
-	fl4.saddr = saddr;
+	fl4.saddr = lsrc? : saddr;
+	fl4.fl4_gw = 0;
 	err = fib_lookup(net, &fl4, &res);
 	if (err != 0) {
 		if (!IN_DEV_FORWARD(in_dev))
 			goto e_hostunreach;
 		goto no_route;
 	}
+	fl4.flowi4_iif = dev->ifindex;
+	fl4.saddr = saddr;
 
 	RT_CACHE_STAT_INC(in_slow_tot);
 
@@ -2328,12 +2351,15 @@ static int ip_route_input_slow(struct sk
 	if (res.type != RTN_UNICAST)
 		goto martian_destination;
 
-	err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
+	err = ip_mkroute_input(skb, &res, net, &fl4, in_dev, daddr, saddr,
+		tos, lsrc);
 out:	return err;
 
 brd_input:
 	if (skb->protocol != htons(ETH_P_IP))
 		goto e_inval;
+	if (lsrc)
+		goto e_inval;
 
 	if (ipv4_is_zeronet(saddr))
 		spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
@@ -2363,6 +2389,8 @@ local_input:
 
 	rth->rt_key_dst	= daddr;
 	rth->rt_key_src	= saddr;
+	rth->rt_key_lsrc = 0;
+	rth->rt_key_gw	= 0;
 	rth->rt_genid = rt_genid(net);
 	rth->rt_flags 	= flags|RTCF_LOCAL;
 	rth->rt_type	= res.type;
@@ -2431,8 +2459,9 @@ martian_source_keep_err:
 	goto out;
 }
 
-int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-			   u8 tos, struct net_device *dev, bool noref)
+int ip_route_input_cached(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			   u8 tos, struct net_device *dev, bool noref,
+			   __be32 lsrc)
 {
 	struct rtable * rth;
 	unsigned	hash;
@@ -2455,6 +2484,7 @@ int ip_route_input_common(struct sk_buff
 		if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
 		     ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
 		     (rth->rt_route_iif ^ iif) |
+		     (rth->rt_key_lsrc ^ lsrc) |
 		     (rth->rt_key_tos ^ tos)) == 0 &&
 		    rth->rt_mark == skb->mark &&
 		    net_eq(dev_net(rth->dst.dev), net) &&
@@ -2508,12 +2538,25 @@ skip_cache:
 		rcu_read_unlock();
 		return -EINVAL;
 	}
-	res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
+	res = ip_route_input_slow(skb, daddr, saddr, tos, dev, lsrc);
 	rcu_read_unlock();
 	return res;
 }
+
+int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			  u8 tos, struct net_device *dev, bool noref)
+{
+	return ip_route_input_cached(skb, daddr, saddr, tos, dev, noref, 0);
+}
 EXPORT_SYMBOL(ip_route_input_common);
 
+int ip_route_input_lookup(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			  u8 tos, struct net_device *dev, __be32 lsrc)
+{
+	return ip_route_input_cached(skb, daddr, saddr, tos, dev, true, lsrc);
+}
+EXPORT_SYMBOL(ip_route_input_lookup);
+
 /* called with rcu_read_lock() */
 static struct rtable *__mkroute_output(const struct fib_result *res,
 				       const struct flowi4 *fl4,
@@ -2570,6 +2613,8 @@ static struct rtable *__mkroute_output(c
 
 	rth->rt_key_dst	= orig_daddr;
 	rth->rt_key_src	= orig_saddr;
+	rth->rt_key_lsrc = 0;
+	rth->rt_key_gw	= fl4->fl4_gw;
 	rth->rt_genid = rt_genid(dev_net(dev_out));
 	rth->rt_flags	= flags;
 	rth->rt_type	= type;
@@ -2730,6 +2775,7 @@ static struct rtable *ip_route_output_sl
 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
 		dev_out = net->loopback_dev;
 		fl4->flowi4_oif = net->loopback_dev->ifindex;
+		fl4->fl4_gw = 0;
 		res.type = RTN_LOCAL;
 		flags |= RTCF_LOCAL;
 		goto make_route;
@@ -2775,20 +2821,18 @@ static struct rtable *ip_route_output_sl
 		}
 		dev_out = net->loopback_dev;
 		fl4->flowi4_oif = dev_out->ifindex;
+		fl4->fl4_gw = 0;
 		res.fi = NULL;
 		flags |= RTCF_LOCAL;
 		goto make_route;
 	}
 
+	if (res.type == RTN_UNICAST)
+		fib_select_default(fl4, &res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-	if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
-		fib_select_multipath(&res);
-	else
+	if (res.fi->fib_nhs > 1)
+		fib_select_multipath(fl4, &res);
 #endif
-	if (!res.prefixlen &&
-	    res.table->tb_num_default > 1 &&
-	    res.type == RTN_UNICAST && !fl4->flowi4_oif)
-		fib_select_default(&res);
 
 	if (!fl4->saddr)
 		fl4->saddr = FIB_RES_PREFSRC(net, res);
@@ -2830,6 +2874,7 @@ struct rtable *__ip_route_output_key(str
 		    rth->rt_key_src == flp4->saddr &&
 		    rt_is_output_route(rth) &&
 		    rth->rt_oif == flp4->flowi4_oif &&
+		    rth->rt_key_gw == flp4->fl4_gw &&
 		    rth->rt_mark == flp4->flowi4_mark &&
 		    !((rth->rt_key_tos ^ flp4->flowi4_tos) &
 			    (IPTOS_RT_MASK | RTO_ONLINK)) &&
@@ -2907,6 +2952,8 @@ struct dst_entry *ipv4_blackhole_route(s
 
 		rt->rt_key_dst = ort->rt_key_dst;
 		rt->rt_key_src = ort->rt_key_src;
+		rt->rt_key_lsrc = ort->rt_key_lsrc;
+		rt->rt_key_gw = ort->rt_key_gw ? ort->rt_gateway : 0;
 		rt->rt_key_tos = ort->rt_key_tos;
 		rt->rt_route_iif = ort->rt_route_iif;
 		rt->rt_iif = ort->rt_iif;
