diff --git a/iproute2/Makefile b/iproute2/Makefile
new file mode 100644
index 000000000..1405f0752
--- /dev/null
+++ b/iproute2/Makefile
@@ -0,0 +1,246 @@
+#
+# Copyright (C) 2006-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=iproute2
+PKG_RELEASE:=$(AUTORELEASE)
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=git://git.kernel.org/pub/scm/network/iproute2/iproute2.git
+PKG_SOURCE_VERSION:=29da83f89f6e1fe528c59131a01f5d43bcd0a000
+PKG_VERSION:=5.16.0-$(PKG_SOURCE_VERSION)
+
+PKG_BUILD_PARALLEL:=1
+PKG_BUILD_DEPENDS:=iptables
+PKG_LICENSE:=GPL-2.0
+PKG_CPE_ID:=cpe:/a:iproute2_project:iproute2
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/iproute2/Default
+  SECTION:=net
+  CATEGORY:=Network
+  URL:=http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
+  SUBMENU:=Routing and Redirection
+  MAINTAINER:=Russell Senior <russell@personaltelco.net>
+endef
+
+define Package/ip-tiny
+$(call Package/iproute2/Default)
+  TITLE:=Routing control utility (minimal)
+  VARIANT:=iptiny
+  DEFAULT_VARIANT:=1
+  PROVIDES:=ip
+  ALTERNATIVES:=200:/sbin/ip:/usr/libexec/ip-tiny
+  DEPENDS:=+libnl-tiny +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/ip-full
+$(call Package/iproute2/Default)
+  TITLE:=Routing control utility (full)
+  VARIANT:=ipfull
+  PROVIDES:=ip
+  ALTERNATIVES:=300:/sbin/ip:/usr/libexec/ip-full
+  DEPENDS:=+libnl-tiny +libbpf +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/tc-tiny
+$(call Package/iproute2/Default)
+  TITLE:=Traffic control utility (minimal)
+  VARIANT:=tctiny
+  DEFAULT_VARIANT:=1
+  PROVIDES:=tc
+  ALTERNATIVES:=200:/sbin/tc:/usr/libexec/tc-tiny
+  DEPENDS:=+kmod-sched-core +libxtables +tc-mod-iptables +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/tc-full
+$(call Package/iproute2/Default)
+  TITLE:=Traffic control utility (full)
+  VARIANT:=tcfull
+  PROVIDES:=tc
+  ALTERNATIVES:=300:/sbin/tc:/usr/libexec/tc-full
+  DEPENDS:=+kmod-sched-core +libxtables +tc-mod-iptables +libbpf +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/tc-mod-iptables
+$(call Package/iproute2/Default)
+  TITLE:=Traffic control module - iptables action
+  DEPENDS:=+libxtables
+endef
+
+define Package/genl
+$(call Package/iproute2/Default)
+  TITLE:=General netlink utility frontend
+  DEPENDS:=+libnl-tiny +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/ip-bridge
+$(call Package/iproute2/Default)
+  TITLE:=Bridge configuration utility from iproute2
+  DEPENDS:=+libnl-tiny +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/ss
+$(call Package/iproute2/Default)
+  TITLE:=Socket statistics utility
+  DEPENDS:=+libnl-tiny +(PACKAGE_devlink||PACKAGE_rdma):libmnl +kmod-netlink-diag
+endef
+
+define Package/nstat
+$(call Package/iproute2/Default)
+  TITLE:=Network statistics utility
+  DEPENDS:=+libnl-tiny +(PACKAGE_devlink||PACKAGE_rdma):libmnl
+endef
+
+define Package/devlink
+$(call Package/iproute2/Default)
+  TITLE:=Network devlink utility
+  DEPENDS:=+libmnl
+endef
+
+define Package/rdma
+$(call Package/iproute2/Default)
+  TITLE:=Network rdma utility
+  DEPENDS:=+libmnl
+endef
+
+ifeq ($(BUILD_VARIANT),iptiny)
+  IP_CONFIG_TINY:=y
+  LIBBPF_FORCE:=off
+endif
+
+ifeq ($(BUILD_VARIANT),ipfull)
+  HAVE_ELF:=y
+  LIBBPF_FORCE:=on
+endif
+
+ifeq ($(BUILD_VARIANT),tctiny)
+  LIBBPF_FORCE:=off
+  SHARED_LIBS:=y
+endif
+
+ifeq ($(BUILD_VARIANT),tcfull)
+  HAVE_ELF:=y
+  LIBBPF_FORCE:=on
+  SHARED_LIBS:=y
+endif
+
+ifdef CONFIG_PACKAGE_devlink
+  HAVE_MNL:=y
+endif
+
+ifdef CONFIG_PACKAGE_rdma
+  HAVE_MNL:=y
+endif
+
+define Build/Configure
+	echo "static const char SNAPSHOT[] = \"$(PKG_VERSION)-$(PKG_RELEASE)-openwrt\";" \
+		> $(PKG_BUILD_DIR)/include/SNAPSHOT.h
+endef
+
+TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto
+TARGET_LDFLAGS += -Wl,--gc-sections -Wl,--as-needed
+TARGET_CPPFLAGS += -I$(STAGING_DIR)/usr/include/libnl-tiny
+
+MAKE_FLAGS += \
+	KERNEL_INCLUDE="$(LINUX_DIR)/user_headers/include" \
+	SHARED_LIBS=$(SHARED_LIBS) \
+	IP_CONFIG_TINY=$(IP_CONFIG_TINY) \
+	BUILD_VARIANT=$(BUILD_VARIANT) \
+	LIBBPF_FORCE=$(LIBBPF_FORCE) \
+	HAVE_ELF=$(HAVE_ELF) \
+	HAVE_MNL=$(HAVE_MNL) \
+	HAVE_CAP=$(HAVE_CAP) \
+	IPT_LIB_DIR=/usr/lib/iptables \
+	XT_LIB_DIR=/usr/lib/iptables \
+	FPIC="$(FPIC)" \
+	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='')
+
+define Build/Compile
+	+$(MAKE_VARS) $(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) $(MAKE_FLAGS)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/iproute2
+	$(CP) $(PKG_BUILD_DIR)/include/bpf_elf.h $(1)/usr/include/iproute2
+	$(CP) $(PKG_BUILD_DIR)/include/{libgenl,libnetlink}.h $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_BUILD_DIR)/lib/libnetlink.a $(1)/usr/lib/
+endef
+
+define Package/ip-tiny/install
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip/ip $(1)/usr/libexec/ip-tiny
+endef
+
+define Package/ip-full/install
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip/ip $(1)/usr/libexec/ip-full
+endef
+
+define Package/tc-tiny/install
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tc/tc $(1)/usr/libexec/tc-tiny
+endef
+
+define Package/tc-full/install
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tc/tc $(1)/usr/libexec/tc-full
+endef
+
+define Package/tc-mod-iptables/install
+	$(INSTALL_DIR) $(1)/usr/lib/tc
+	$(CP) $(PKG_BUILD_DIR)/tc/m_xt.so $(1)/usr/lib/tc
+endef
+
+define Package/genl/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/genl/genl $(1)/usr/sbin/
+endef
+
+define Package/ip-bridge/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/bridge/bridge $(1)/usr/sbin/
+endef
+
+define Package/ss/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/misc/ss $(1)/usr/sbin/
+endef
+
+define Package/nstat/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/misc/nstat $(1)/usr/sbin/
+endef
+
+define Package/devlink/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/devlink/devlink $(1)/usr/sbin/
+endef
+
+define Package/rdma/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/rdma/rdma $(1)/usr/sbin/
+endef
+
+#$(eval $(call BuildPackage,ip-tiny))
+$(eval $(call BuildPackage,ip-full))
+# build tc-mod-iptables before its dependents, to avoid
+# spurious rebuilds when building multiple variants.
+$(eval $(call BuildPackage,tc-mod-iptables))
+#$(eval $(call BuildPackage,tc-tiny))
+$(eval $(call BuildPackage,tc-full))
+$(eval $(call BuildPackage,genl))
+$(eval $(call BuildPackage,ip-bridge))
+$(eval $(call BuildPackage,ss))
+$(eval $(call BuildPackage,nstat))
+$(eval $(call BuildPackage,devlink))
+$(eval $(call BuildPackage,rdma))
diff --git a/iproute2/patches/100-configure.patch b/iproute2/patches/100-configure.patch
new file mode 100644
index 000000000..0c19b2086
--- /dev/null
+++ b/iproute2/patches/100-configure.patch
@@ -0,0 +1,12 @@
+--- a/configure
++++ b/configure
+@@ -34,7 +34,8 @@ int main(int argc, char **argv) {
+ }
+ EOF
+ 
+-    if $CC -I$INCLUDE -o $TMPDIR/atmtest $TMPDIR/atmtest.c -latm >/dev/null 2>&1; then
++# OpenWrt: disable ATM support even if present on host system
++    if [ 1 -eq 0 ]; then
+ 	echo "TC_CONFIG_ATM:=y" >>$CONFIG
+ 	echo yes
+     else
diff --git a/iproute2/patches/110-darwin_fixes.patch b/iproute2/patches/110-darwin_fixes.patch
new file mode 100644
index 000000000..1f3eb101e
--- /dev/null
+++ b/iproute2/patches/110-darwin_fixes.patch
@@ -0,0 +1,59 @@
+--- a/netem/maketable.c
++++ b/netem/maketable.c
+@@ -10,7 +10,9 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <math.h>
++#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <malloc.h>
++#endif
+ #include <string.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+--- a/netem/normal.c
++++ b/netem/normal.c
+@@ -8,8 +8,12 @@
+ #include <string.h>
+ #include <limits.h>
+ 
++#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <linux/types.h>
+ #include <linux/pkt_sched.h>
++#else
++#define NETEM_DIST_SCALE        8192
++#endif
+ 
+ #define TABLESIZE 16384
+ #define TABLEFACTOR NETEM_DIST_SCALE
+--- a/netem/pareto.c
++++ b/netem/pareto.c
+@@ -7,8 +7,12 @@
+ #include <math.h>
+ #include <limits.h>
+ 
++#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <linux/types.h>
+ #include <linux/pkt_sched.h>
++#else
++#define NETEM_DIST_SCALE        8192
++#endif
+ 
+ static const double a=3.0;
+ #define TABLESIZE	16384
+--- a/netem/paretonormal.c
++++ b/netem/paretonormal.c
+@@ -14,10 +14,13 @@
+ #include <string.h>
+ #include <math.h>
+ #include <limits.h>
++#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <malloc.h>
+-
+ #include <linux/types.h>
+ #include <linux/pkt_sched.h>
++#else
++#define NETEM_DIST_SCALE        8192
++#endif
+ 
+ #define TABLESIZE	16384
+ #define TABLEFACTOR	NETEM_DIST_SCALE
diff --git a/iproute2/patches/115-add-config-xtlibdir.patch b/iproute2/patches/115-add-config-xtlibdir.patch
new file mode 100644
index 000000000..8702d5fd2
--- /dev/null
+++ b/iproute2/patches/115-add-config-xtlibdir.patch
@@ -0,0 +1,12 @@
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -128,6 +128,9 @@ CFLAGS += -DCONFIG_GACT -DCONFIG_GACT_PR
+ ifneq ($(IPT_LIB_DIR),)
+ 	CFLAGS += -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\"
+ endif
++ifneq ($(XT_LIB_DIR),)
++	CFLAGS += -DXT_LIB_DIR=\"$(XT_LIB_DIR)\"
++endif
+ 
+ LEX := flex
+ CFLAGS += -DYY_NO_INPUT
diff --git a/iproute2/patches/120-no_arpd_ifstat_rtacct_lnstat.patch b/iproute2/patches/120-no_arpd_ifstat_rtacct_lnstat.patch
new file mode 100644
index 000000000..bb6a8d018
--- /dev/null
+++ b/iproute2/patches/120-no_arpd_ifstat_rtacct_lnstat.patch
@@ -0,0 +1,20 @@
+--- a/misc/Makefile
++++ b/misc/Makefile
+@@ -2,13 +2,13 @@
+ SSOBJ=ss.o ssfilter_check.o ssfilter.tab.o
+ LNSTATOBJ=lnstat.o lnstat_util.o
+ 
+-TARGETS=ss nstat ifstat rtacct lnstat
++TARGETS=ss nstat
+ 
+ include ../config.mk
+ 
+-ifeq ($(HAVE_BERKELEY_DB),y)
+-	TARGETS += arpd
+-endif
++#ifeq ($(HAVE_BERKELEY_DB),y)
++#	TARGETS += arpd
++#endif
+ 
+ all: $(TARGETS)
+ 
diff --git a/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch b/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch
new file mode 100644
index 000000000..8ddb31674
--- /dev/null
+++ b/iproute2/patches/130-no_netem_tipc_dcb_man_vdpa.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -55,7 +55,7 @@ WFLAGS += -Wmissing-declarations -Wold-s
+ CFLAGS := $(WFLAGS) $(CCOPTS) -I../include -I../include/uapi $(DEFINES) $(CFLAGS)
+ YACCFLAGS = -d -t -v
+ 
+-SUBDIRS=lib ip tc bridge misc netem genl tipc devlink rdma dcb man vdpa
++SUBDIRS=lib ip tc bridge misc genl devlink rdma
+ 
+ LIBNETLINK=../lib/libutil.a ../lib/libnetlink.a
+ LDLIBS += $(LIBNETLINK)
diff --git a/iproute2/patches/140-allow_pfifo_fast.patch b/iproute2/patches/140-allow_pfifo_fast.patch
new file mode 100644
index 000000000..13de48f41
--- /dev/null
+++ b/iproute2/patches/140-allow_pfifo_fast.patch
@@ -0,0 +1,9 @@
+--- a/tc/q_fifo.c
++++ b/tc/q_fifo.c
+@@ -95,5 +95,6 @@ struct qdisc_util pfifo_head_drop_qdisc_
+ 
+ struct qdisc_util pfifo_fast_qdisc_util = {
+ 	.id = "pfifo_fast",
++	.parse_qopt = fifo_parse_opt,
+ 	.print_qopt = prio_print_opt,
+ };
diff --git a/iproute2/patches/140-keep_libmnl_optional.patch b/iproute2/patches/140-keep_libmnl_optional.patch
new file mode 100644
index 000000000..ff7e9ca4e
--- /dev/null
+++ b/iproute2/patches/140-keep_libmnl_optional.patch
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -387,7 +387,7 @@ check_selinux()
+ 
+ check_mnl()
+ {
+-	if ${PKG_CONFIG} libmnl --exists; then
++	if [ "${HAVE_MNL}" = "y" ] && ${PKG_CONFIG} libmnl --exists; then
+ 		echo "HAVE_MNL:=y" >>$CONFIG
+ 		echo "yes"
+ 
diff --git a/iproute2/patches/145-keep_libelf_optional.patch b/iproute2/patches/145-keep_libelf_optional.patch
new file mode 100644
index 000000000..079ca0512
--- /dev/null
+++ b/iproute2/patches/145-keep_libelf_optional.patch
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -255,7 +255,7 @@ EOF
+ 
+ check_elf()
+ {
+-    if ${PKG_CONFIG} libelf --exists; then
++    if [ "${HAVE_ELF}" = "y" ] && ${PKG_CONFIG} libelf --exists; then
+ 	echo "HAVE_ELF:=y" >>$CONFIG
+ 	echo "yes"
+ 
diff --git a/iproute2/patches/150-keep_libcap_optional.patch b/iproute2/patches/150-keep_libcap_optional.patch
new file mode 100644
index 000000000..68e162416
--- /dev/null
+++ b/iproute2/patches/150-keep_libcap_optional.patch
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -445,7 +445,7 @@ EOF
+ 
+ check_cap()
+ {
+-	if ${PKG_CONFIG} libcap --exists; then
++	if [ "${HAVE_CAP}" = "y" ] && ${PKG_CONFIG} libcap --exists; then
+ 		echo "HAVE_CAP:=y" >>$CONFIG
+ 		echo "yes"
+ 
diff --git a/iproute2/patches/160-libnetlink-pic.patch b/iproute2/patches/160-libnetlink-pic.patch
new file mode 100644
index 000000000..145ec7a9e
--- /dev/null
+++ b/iproute2/patches/160-libnetlink-pic.patch
@@ -0,0 +1,11 @@
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
+ 
+-CFLAGS += -fPIC
++CFLAGS += $(FPIC)
+ 
+ UTILOBJ = utils.o utils_math.o rt_names.o ll_map.o ll_types.o ll_proto.o ll_addr.o \
+ 	inet_proto.o namespace.o json_writer.o json_print.o json_print_math.o \
diff --git a/iproute2/patches/175-reduce-dynamic-syms.patch b/iproute2/patches/175-reduce-dynamic-syms.patch
new file mode 100644
index 000000000..c3892e5a0
--- /dev/null
+++ b/iproute2/patches/175-reduce-dynamic-syms.patch
@@ -0,0 +1,45 @@
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -114,7 +114,7 @@ LDLIBS += -L. -lm
+ 
+ ifeq ($(SHARED_LIBS),y)
+ LDLIBS += -ldl
+-LDFLAGS += -Wl,-export-dynamic
++LDFLAGS += -Wl,--dynamic-list=dynsyms.list
+ endif
+ 
+ TCLIB := tc_core.o
+@@ -144,7 +144,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
+ all: tc $(TCSO)
+ 
+ tc: $(TCOBJ) $(LIBNETLINK) libtc.a
+-	$(QUIET_LINK)$(CC) $^ $(LDFLAGS) $(LDLIBS) -o $@
++	$(QUIET_LINK)$(CC) $(filter-out dynsyms.list, $^) $(LDFLAGS) $(LDLIBS) -o $@
+ 
+ libtc.a: $(TCLIB)
+ 	$(QUIET_AR)$(AR) rcs $@ $^
+@@ -166,6 +166,7 @@ install: all
+ clean:
+ 	rm -f $(TCOBJ) $(TCLIB) libtc.a tc *.so emp_ematch.tab.h; \
+ 	rm -f emp_ematch.tab.*
++	rm -f dynsyms.list
+ 
+ q_atm.so: q_atm.c
+ 	$(QUIET_CC)$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -shared -fpic -o q_atm.so q_atm.c -latm
+@@ -205,4 +206,16 @@ static-syms.h: $(wildcard *.c)
+ 		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:extern char \1[] __attribute__((weak)); if (!strcmp(sym, "\1")) return \1;:;p}' $$files ; \
+ 	done > $@
+ 
++else
++
++tc: dynsyms.list
++m_xt.so: dynsyms.list
++dynsyms.list: $(wildcard *.c)
++	files="$(filter-out $(patsubst %.so,%.c,$(TCSO)), $^)" ; \
++	echo "{" > $@ ; \
++	for s in `grep -B 3 '\<dlsym' $$files | sed -n '/snprintf/{s:.*"\([^"]*\)".*:\1:;s:%s::;p}'` ; do \
++		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:\1;:;p}' $$files ; \
++	done >> $@ ; \
++	echo "show_stats; print_nl; print_tm; parse_rtattr; parse_rtattr_flags; get_u32; matches; addattr_l; addattr_nest; addattr_nest_end; };" >> $@
++
+ endif
diff --git a/iproute2/patches/180-drop_FAILED_POLICY.patch b/iproute2/patches/180-drop_FAILED_POLICY.patch
new file mode 100644
index 000000000..07d5230a6
--- /dev/null
+++ b/iproute2/patches/180-drop_FAILED_POLICY.patch
@@ -0,0 +1,41 @@
+From 4e7dbf76227e8c7be7897dc81def3011f637864d Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Thu, 30 May 2013 11:54:04 +0200
+Subject: [PATCH] add support for dropping with FAILED_POLICY
+
+---
+ include/linux/fib_rules.h |    4 ++++
+ include/linux/rtnetlink.h |    1 +
+ ip/rtm_map.c              |    4 ++++
+ 3 files changed, 9 insertions(+)
+
+--- a/ip/rtm_map.c
++++ b/ip/rtm_map.c
+@@ -54,6 +54,8 @@ char *rtnl_rtntype_n2a(int id, char *buf
+ 		return "nat";
+ 	case RTN_XRESOLVE:
+ 		return "xresolve";
++	case RTN_FAILED_POLICY:
++		return "failed_policy";
+ 	default:
+ 		snprintf(buf, len, "%d", id);
+ 		return buf;
+@@ -89,6 +91,8 @@ int rtnl_rtntype_a2n(int *id, char *arg)
+ 		res = RTN_UNICAST;
+ 	else if (strcmp(arg, "throw") == 0)
+ 		res = RTN_THROW;
++	else if (strcmp(arg, "failed_policy") == 0)
++		res = RTN_FAILED_POLICY;
+ 	else {
+ 		res = strtoul(arg, &end, 0);
+ 		if (!end || end == arg || *end || res > 255)
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -256,6 +256,7 @@ enum {
+ 	RTN_THROW,		/* Not in this table		*/
+ 	RTN_NAT,		/* Translate this address	*/
+ 	RTN_XRESOLVE,		/* Use external resolver	*/
++	RTN_FAILED_POLICY,      /* Source address failed policy */
+ 	__RTN_MAX
+ };
+ 
diff --git a/iproute2/patches/190-fix-nls-rpath-link.patch b/iproute2/patches/190-fix-nls-rpath-link.patch
new file mode 100644
index 000000000..92d02b9a4
--- /dev/null
+++ b/iproute2/patches/190-fix-nls-rpath-link.patch
@@ -0,0 +1,20 @@
+--- a/configure
++++ b/configure
+@@ -279,7 +279,7 @@ int main(int argc, char **argv) {
+ }
+ EOF
+ 
+-    $CC -o $TMPDIR/libbpf_test $TMPDIR/libbpf_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS >/dev/null 2>&1
++    $CC -o $TMPDIR/libbpf_test $TMPDIR/libbpf_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS $LDFLAGS >/dev/null 2>&1
+     local ret=$?
+ 
+     rm -f $TMPDIR/libbpf_test.c $TMPDIR/libbpf_test
+@@ -297,7 +297,7 @@ int main(int argc, char **argv) {
+ }
+ EOF
+ 
+-    $CC -o $TMPDIR/libbpf_sec_test $TMPDIR/libbpf_sec_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS >/dev/null 2>&1
++    $CC -o $TMPDIR/libbpf_sec_test $TMPDIR/libbpf_sec_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS $LDFLAGS >/dev/null 2>&1
+     local ret=$?
+ 
+     rm -f $TMPDIR/libbpf_sec_test.c $TMPDIR/libbpf_sec_test
diff --git a/iproute2/patches/200-drop_libbsd_dependency.patch b/iproute2/patches/200-drop_libbsd_dependency.patch
new file mode 100644
index 000000000..12a1ccfa3
--- /dev/null
+++ b/iproute2/patches/200-drop_libbsd_dependency.patch
@@ -0,0 +1,19 @@
+--- a/configure
++++ b/configure
+@@ -431,14 +431,8 @@ EOF
+     if $CC -I$INCLUDE -o $TMPDIR/strtest $TMPDIR/strtest.c >/dev/null 2>&1; then
+ 	echo "no"
+     else
+-	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'CFLAGS += -DHAVE_LIBBSD' `${PKG_CONFIG} libbsd --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libbsd --libs` >> $CONFIG
+-		echo "no"
+-	else
+-		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+-		echo "yes"
+-	fi
++	echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
++	echo "yes"
+     fi
+     rm -f $TMPDIR/strtest.c $TMPDIR/strtest
+ }
diff --git a/iproute2/patches/300-selinux-configurable.patch b/iproute2/patches/300-selinux-configurable.patch
new file mode 100644
index 000000000..b7e61fd3b
--- /dev/null
+++ b/iproute2/patches/300-selinux-configurable.patch
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -374,7 +374,7 @@ check_libbpf()
+ check_selinux()
+ # SELinux is a compile time option in the ss utility
+ {
+-	if ${PKG_CONFIG} libselinux --exists; then
++	if [ "${HAVE_SELINUX}" = "y" ] && ${PKG_CONFIG} libselinux --exists; then
+ 		echo "HAVE_SELINUX:=y" >>$CONFIG
+ 		echo "yes"
+