* @dreq_iss: initial sequence number sent on the Response (RFC 4340, 7.1)
  * @dreq_isr: initial sequence number received on the Request
  * @dreq_service: service code present on the Request (there is just one)
+ * @dreq_featneg: feature negotiation options for this connection
  * The following two fields are analogous to the ones in dccp_sock:
  * @dreq_timestamp_echo: last received timestamp to echo (13.1)
  * @dreq_timestamp_echo: the time of receiving the last @dreq_timestamp_echo
        __u64                    dreq_iss;
        __u64                    dreq_isr;
        __be32                   dreq_service;
+       struct list_head         dreq_featneg;
        __u32                    dreq_timestamp_echo;
        __u32                    dreq_timestamp_time;
 };
  * @dccps_mss_cache - current value of MSS (path MTU minus header sizes)
  * @dccps_rate_last - timestamp for rate-limiting DCCP-Sync (RFC 4340, 7.5.4)
  * @dccps_minisock - associated minisock (accessed via dccp_msk)
+ * @dccps_featneg - tracks feature-negotiation state (mostly during handshake)
  * @dccps_hc_rx_ackvec - rx half connection ack vector
  * @dccps_hc_rx_ccid - CCID used for the receiver (or receiving half-connection)
  * @dccps_hc_tx_ccid - CCID used for the sender (or sending half-connection)
        __u64                           dccps_ndp_count:48;
        unsigned long                   dccps_rate_last;
        struct dccp_minisock            dccps_minisock;
+       struct list_head                dccps_featneg;
        struct dccp_ackvec              *dccps_hc_rx_ackvec;
        struct ccid                     *dccps_hc_rx_ccid;
        struct ccid                     *dccps_hc_tx_ccid;
 
 extern void dccp_set_state(struct sock *sk, const int state);
 extern void dccp_done(struct sock *sk);
 
-extern void dccp_reqsk_init(struct request_sock *req, struct sk_buff *skb);
+extern int  dccp_reqsk_init(struct request_sock *rq, struct dccp_sock const *dp,
+                           struct sk_buff const *skb);
 
 extern int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 
 
        return dccp_feat_table[idx].reconciliation;
 }
 
+/* copy constructor, fval must not already contain allocated memory */
+static int dccp_feat_clone_sp_val(dccp_feat_val *fval, u8 const *val, u8 len)
+{
+       fval->sp.len = len;
+       if (fval->sp.len > 0) {
+               fval->sp.vec = kmemdup(val, len, gfp_any());
+               if (fval->sp.vec == NULL) {
+                       fval->sp.len = 0;
+                       return -ENOBUFS;
+               }
+       }
+       return 0;
+}
+
 static void dccp_feat_val_destructor(u8 feat_num, dccp_feat_val *val)
 {
        if (unlikely(val == NULL))
        memset(val, 0, sizeof(*val));
 }
 
+static struct dccp_feat_entry *
+             dccp_feat_clone_entry(struct dccp_feat_entry const *original)
+{
+       struct dccp_feat_entry *new;
+       u8 type = dccp_feat_type(original->feat_num);
+
+       if (type == FEAT_UNKNOWN)
+               return NULL;
+
+       new = kmemdup(original, sizeof(struct dccp_feat_entry), gfp_any());
+       if (new == NULL)
+               return NULL;
+
+       if (type == FEAT_SP && dccp_feat_clone_sp_val(&new->val,
+                                                     original->val.sp.vec,
+                                                     original->val.sp.len)) {
+               kfree(new);
+               return NULL;
+       }
+       return new;
+}
+
 static void dccp_feat_entry_destructor(struct dccp_feat_entry *entry)
 {
        if (entry != NULL) {
 }
 EXPORT_SYMBOL_GPL(dccp_feat_list_purge);
 
+/* generate @to as full clone of @from - @to must not contain any nodes */
+int dccp_feat_clone_list(struct list_head const *from, struct list_head *to)
+{
+       struct dccp_feat_entry *entry, *new;
+
+       INIT_LIST_HEAD(to);
+       list_for_each_entry(entry, from, node) {
+               new = dccp_feat_clone_entry(entry);
+               if (new == NULL)
+                       goto cloning_failed;
+               list_add_tail(&new->node, to);
+       }
+       return 0;
+
+cloning_failed:
+       dccp_feat_list_purge(to);
+       return -ENOMEM;
+}
+
 int dccp_feat_change(struct dccp_minisock *dmsk, u8 type, u8 feature,
                     u8 *val, u8 len, gfp_t gfp)
 {
 
                                   u8 *val, u8 len);
 extern void dccp_feat_clean(struct dccp_minisock *dmsk);
 extern int  dccp_feat_clone(struct sock *oldsk, struct sock *newsk);
+extern int  dccp_feat_clone_list(struct list_head const *, struct list_head *);
 extern int  dccp_feat_init(struct dccp_minisock *dmsk);
 
 #endif /* _DCCP_FEAT_H */
 
                        if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
                                                                    skb) < 0)
                                return 1;
-
-                       /* FIXME: do congestion control initialization */
                        goto discard;
                }
                if (dh->dccph_type == DCCP_PKT_RESET)
 
        if (req == NULL)
                goto drop;
 
-       dccp_reqsk_init(req, skb);
+       if (dccp_reqsk_init(req, dccp_sk(sk), skb))
+               goto drop_and_free;
 
        dreq = dccp_rsk(req);
        if (dccp_parse_options(sk, dreq, skb))
 
        if (req == NULL)
                goto drop;
 
-       dccp_reqsk_init(req, skb);
+       if (dccp_reqsk_init(req, dccp_sk(sk), skb))
+               goto drop_and_free;
 
        dreq = dccp_rsk(req);
        if (dccp_parse_options(sk, dreq, skb))
 
                newdp->dccps_timestamp_time = dreq->dreq_timestamp_time;
                newicsk->icsk_rto           = DCCP_TIMEOUT_INIT;
 
+               INIT_LIST_HEAD(&newdp->dccps_featneg);
                if (dccp_feat_clone(sk, newsk))
                        goto out_free;
 
 
 EXPORT_SYMBOL_GPL(dccp_reqsk_send_ack);
 
-void dccp_reqsk_init(struct request_sock *req, struct sk_buff *skb)
+int dccp_reqsk_init(struct request_sock *req,
+                   struct dccp_sock const *dp, struct sk_buff const *skb)
 {
        struct dccp_request_sock *dreq = dccp_rsk(req);
 
        inet_rsk(req)->acked      = 0;
        req->rcv_wnd              = sysctl_dccp_feat_sequence_window;
        dreq->dreq_timestamp_echo = 0;
+
+       /* inherit feature negotiation options from listening socket */
+       return dccp_feat_clone_list(&dp->dccps_featneg, &dreq->dreq_featneg);
 }
 
 EXPORT_SYMBOL_GPL(dccp_reqsk_init);
 
 
        dccp_init_xmit_timers(sk);
 
+       INIT_LIST_HEAD(&dp->dccps_featneg);
        /*
         * FIXME: We're hardcoding the CCID, and doing this at this point makes
         * the listening (master) sock get CCID control blocks, which is not