diff --git a/cloud/blockstore/libs/nbd/CMakeLists.linux-aarch64.txt b/cloud/blockstore/libs/nbd/CMakeLists.linux-aarch64.txt
index cc1d2be53e6..089d40fd177 100644
--- a/cloud/blockstore/libs/nbd/CMakeLists.linux-aarch64.txt
+++ b/cloud/blockstore/libs/nbd/CMakeLists.linux-aarch64.txt
@@ -13,6 +13,7 @@ add_library(blockstore-libs-nbd)
 target_link_libraries(blockstore-libs-nbd PUBLIC
   contrib-libs-linux-headers
   contrib-libs-cxxsupp
+  contrib-restricted-libnl-lib-nl-genl-3
   yutil
   blockstore-libs-client
   blockstore-libs-common
@@ -29,23 +30,10 @@ target_sources(blockstore-libs-nbd PRIVATE
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/client.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/client_handler.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/limiter.cpp
+  ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/netlink_device.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/protocol.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/server.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/server_handler.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/utils.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/device.cpp
 )
-if(DEFINED ENV{NETLINK})
-  target_sources(blockstore-libs-nbd PRIVATE
-    ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/netlink_device.cpp
-  )
-  target_compile_options(blockstore-libs-nbd PUBLIC
-    -DNETLINK
-    -I/usr/include/libnl3
-  )
-  target_link_options(blockstore-libs-nbd PUBLIC
-    -L/usr/lib/x86_64-linux-gnu
-    -l:libnl-3.a
-    -l:libnl-genl-3.a
-  )
-endif()
diff --git a/cloud/blockstore/libs/nbd/CMakeLists.linux-x86_64.txt b/cloud/blockstore/libs/nbd/CMakeLists.linux-x86_64.txt
index cc1d2be53e6..089d40fd177 100644
--- a/cloud/blockstore/libs/nbd/CMakeLists.linux-x86_64.txt
+++ b/cloud/blockstore/libs/nbd/CMakeLists.linux-x86_64.txt
@@ -13,6 +13,7 @@ add_library(blockstore-libs-nbd)
 target_link_libraries(blockstore-libs-nbd PUBLIC
   contrib-libs-linux-headers
   contrib-libs-cxxsupp
+  contrib-restricted-libnl-lib-nl-genl-3
   yutil
   blockstore-libs-client
   blockstore-libs-common
@@ -29,23 +30,10 @@ target_sources(blockstore-libs-nbd PRIVATE
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/client.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/client_handler.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/limiter.cpp
+  ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/netlink_device.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/protocol.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/server.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/server_handler.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/utils.cpp
   ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/device.cpp
 )
-if(DEFINED ENV{NETLINK})
-  target_sources(blockstore-libs-nbd PRIVATE
-    ${CMAKE_SOURCE_DIR}/cloud/blockstore/libs/nbd/netlink_device.cpp
-  )
-  target_compile_options(blockstore-libs-nbd PUBLIC
-    -DNETLINK
-    -I/usr/include/libnl3
-  )
-  target_link_options(blockstore-libs-nbd PUBLIC
-    -L/usr/lib/x86_64-linux-gnu
-    -l:libnl-3.a
-    -l:libnl-genl-3.a
-  )
-endif()
diff --git a/contrib/libs/linux-headers/linux/if_tunnel.h b/contrib/libs/linux-headers/linux/if_tunnel.h
new file mode 100644
index 00000000000..edaea41cc38
--- /dev/null
+++ b/contrib/libs/linux-headers/linux/if_tunnel.h
@@ -0,0 +1,185 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _IF_TUNNEL_H_
+#define _IF_TUNNEL_H_
+
+#include <linux/types.h>
+#include <linux/if.h>
+#include <linux/ip.h>
+#include <linux/in6.h>
+#include <asm/byteorder.h>
+
+
+#define SIOCGETTUNNEL   (SIOCDEVPRIVATE + 0)
+#define SIOCADDTUNNEL   (SIOCDEVPRIVATE + 1)
+#define SIOCDELTUNNEL   (SIOCDEVPRIVATE + 2)
+#define SIOCCHGTUNNEL   (SIOCDEVPRIVATE + 3)
+#define SIOCGETPRL      (SIOCDEVPRIVATE + 4)
+#define SIOCADDPRL      (SIOCDEVPRIVATE + 5)
+#define SIOCDELPRL      (SIOCDEVPRIVATE + 6)
+#define SIOCCHGPRL      (SIOCDEVPRIVATE + 7)
+#define SIOCGET6RD      (SIOCDEVPRIVATE + 8)
+#define SIOCADD6RD      (SIOCDEVPRIVATE + 9)
+#define SIOCDEL6RD      (SIOCDEVPRIVATE + 10)
+#define SIOCCHG6RD      (SIOCDEVPRIVATE + 11)
+
+#define GRE_CSUM	__cpu_to_be16(0x8000)
+#define GRE_ROUTING	__cpu_to_be16(0x4000)
+#define GRE_KEY		__cpu_to_be16(0x2000)
+#define GRE_SEQ		__cpu_to_be16(0x1000)
+#define GRE_STRICT	__cpu_to_be16(0x0800)
+#define GRE_REC		__cpu_to_be16(0x0700)
+#define GRE_ACK		__cpu_to_be16(0x0080)
+#define GRE_FLAGS	__cpu_to_be16(0x0078)
+#define GRE_VERSION	__cpu_to_be16(0x0007)
+
+#define GRE_IS_CSUM(f)		((f) & GRE_CSUM)
+#define GRE_IS_ROUTING(f)	((f) & GRE_ROUTING)
+#define GRE_IS_KEY(f)		((f) & GRE_KEY)
+#define GRE_IS_SEQ(f)		((f) & GRE_SEQ)
+#define GRE_IS_STRICT(f)	((f) & GRE_STRICT)
+#define GRE_IS_REC(f)		((f) & GRE_REC)
+#define GRE_IS_ACK(f)		((f) & GRE_ACK)
+
+#define GRE_VERSION_0		__cpu_to_be16(0x0000)
+#define GRE_VERSION_1		__cpu_to_be16(0x0001)
+#define GRE_PROTO_PPP		__cpu_to_be16(0x880b)
+#define GRE_PPTP_KEY_MASK	__cpu_to_be32(0xffff)
+
+struct ip_tunnel_parm {
+	char			name[IFNAMSIZ];
+	int			link;
+	__be16			i_flags;
+	__be16			o_flags;
+	__be32			i_key;
+	__be32			o_key;
+	struct iphdr		iph;
+};
+
+enum {
+	IFLA_IPTUN_UNSPEC,
+	IFLA_IPTUN_LINK,
+	IFLA_IPTUN_LOCAL,
+	IFLA_IPTUN_REMOTE,
+	IFLA_IPTUN_TTL,
+	IFLA_IPTUN_TOS,
+	IFLA_IPTUN_ENCAP_LIMIT,
+	IFLA_IPTUN_FLOWINFO,
+	IFLA_IPTUN_FLAGS,
+	IFLA_IPTUN_PROTO,
+	IFLA_IPTUN_PMTUDISC,
+	IFLA_IPTUN_6RD_PREFIX,
+	IFLA_IPTUN_6RD_RELAY_PREFIX,
+	IFLA_IPTUN_6RD_PREFIXLEN,
+	IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
+	IFLA_IPTUN_ENCAP_TYPE,
+	IFLA_IPTUN_ENCAP_FLAGS,
+	IFLA_IPTUN_ENCAP_SPORT,
+	IFLA_IPTUN_ENCAP_DPORT,
+	IFLA_IPTUN_COLLECT_METADATA,
+	IFLA_IPTUN_FWMARK,
+	__IFLA_IPTUN_MAX,
+};
+#define IFLA_IPTUN_MAX	(__IFLA_IPTUN_MAX - 1)
+
+enum tunnel_encap_types {
+	TUNNEL_ENCAP_NONE,
+	TUNNEL_ENCAP_FOU,
+	TUNNEL_ENCAP_GUE,
+	TUNNEL_ENCAP_MPLS,
+};
+
+#define TUNNEL_ENCAP_FLAG_CSUM		(1<<0)
+#define TUNNEL_ENCAP_FLAG_CSUM6		(1<<1)
+#define TUNNEL_ENCAP_FLAG_REMCSUM	(1<<2)
+
+/* SIT-mode i_flags */
+#define	SIT_ISATAP	0x0001
+
+struct ip_tunnel_prl {
+	__be32			addr;
+	__u16			flags;
+	__u16			__reserved;
+	__u32			datalen;
+	__u32			__reserved2;
+	/* data follows */
+};
+
+/* PRL flags */
+#define	PRL_DEFAULT		0x0001
+
+struct ip_tunnel_6rd {
+	struct in6_addr		prefix;
+	__be32			relay_prefix;
+	__u16			prefixlen;
+	__u16			relay_prefixlen;
+};
+
+enum {
+	IFLA_GRE_UNSPEC,
+	IFLA_GRE_LINK,
+	IFLA_GRE_IFLAGS,
+	IFLA_GRE_OFLAGS,
+	IFLA_GRE_IKEY,
+	IFLA_GRE_OKEY,
+	IFLA_GRE_LOCAL,
+	IFLA_GRE_REMOTE,
+	IFLA_GRE_TTL,
+	IFLA_GRE_TOS,
+	IFLA_GRE_PMTUDISC,
+	IFLA_GRE_ENCAP_LIMIT,
+	IFLA_GRE_FLOWINFO,
+	IFLA_GRE_FLAGS,
+	IFLA_GRE_ENCAP_TYPE,
+	IFLA_GRE_ENCAP_FLAGS,
+	IFLA_GRE_ENCAP_SPORT,
+	IFLA_GRE_ENCAP_DPORT,
+	IFLA_GRE_COLLECT_METADATA,
+	IFLA_GRE_IGNORE_DF,
+	IFLA_GRE_FWMARK,
+	IFLA_GRE_ERSPAN_INDEX,
+	IFLA_GRE_ERSPAN_VER,
+	IFLA_GRE_ERSPAN_DIR,
+	IFLA_GRE_ERSPAN_HWID,
+	__IFLA_GRE_MAX,
+};
+
+#define IFLA_GRE_MAX	(__IFLA_GRE_MAX - 1)
+
+/* VTI-mode i_flags */
+#define VTI_ISVTI ((__be16)0x0001)
+
+enum {
+	IFLA_VTI_UNSPEC,
+	IFLA_VTI_LINK,
+	IFLA_VTI_IKEY,
+	IFLA_VTI_OKEY,
+	IFLA_VTI_LOCAL,
+	IFLA_VTI_REMOTE,
+	IFLA_VTI_FWMARK,
+	__IFLA_VTI_MAX,
+};
+
+#define IFLA_VTI_MAX	(__IFLA_VTI_MAX - 1)
+
+#define TUNNEL_CSUM		__cpu_to_be16(0x01)
+#define TUNNEL_ROUTING		__cpu_to_be16(0x02)
+#define TUNNEL_KEY		__cpu_to_be16(0x04)
+#define TUNNEL_SEQ		__cpu_to_be16(0x08)
+#define TUNNEL_STRICT		__cpu_to_be16(0x10)
+#define TUNNEL_REC		__cpu_to_be16(0x20)
+#define TUNNEL_VERSION		__cpu_to_be16(0x40)
+#define TUNNEL_NO_KEY		__cpu_to_be16(0x80)
+#define TUNNEL_DONT_FRAGMENT    __cpu_to_be16(0x0100)
+#define TUNNEL_OAM		__cpu_to_be16(0x0200)
+#define TUNNEL_CRIT_OPT		__cpu_to_be16(0x0400)
+#define TUNNEL_GENEVE_OPT	__cpu_to_be16(0x0800)
+#define TUNNEL_VXLAN_OPT	__cpu_to_be16(0x1000)
+#define TUNNEL_NOCACHE		__cpu_to_be16(0x2000)
+#define TUNNEL_ERSPAN_OPT	__cpu_to_be16(0x4000)
+#define TUNNEL_GTP_OPT		__cpu_to_be16(0x8000)
+
+#define TUNNEL_OPTIONS_PRESENT \
+		(TUNNEL_GENEVE_OPT | TUNNEL_VXLAN_OPT | TUNNEL_ERSPAN_OPT | \
+		TUNNEL_GTP_OPT)
+
+#endif /* _IF_TUNNEL_H_ */
diff --git a/contrib/libs/linux-headers/linux/ip.h b/contrib/libs/linux-headers/linux/ip.h
new file mode 100644
index 00000000000..9b4dd89ebec
--- /dev/null
+++ b/contrib/libs/linux-headers/linux/ip.h
@@ -0,0 +1,181 @@
+/* SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note */
+/*
+ * INET		An implementation of the TCP/IP protocol suite for the LINUX
+ *		operating system.  INET is implemented using the  BSD Socket
+ *		interface as the means of communication with the user level.
+ *
+ *		Definitions for the IP protocol.
+ *
+ * Version:	@(#)ip.h	1.0.2	04/28/93
+ *
+ * Authors:	Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
+ *
+ *		This program is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ */
+#ifndef _LINUX_IP_H
+#define _LINUX_IP_H
+#include <linux/types.h>
+#include <linux/stddef.h>
+#include <asm/byteorder.h>
+
+#define IPTOS_TOS_MASK		0x1E
+#define IPTOS_TOS(tos)		((tos)&IPTOS_TOS_MASK)
+#define	IPTOS_LOWDELAY		0x10
+#define	IPTOS_THROUGHPUT	0x08
+#define	IPTOS_RELIABILITY	0x04
+#define	IPTOS_MINCOST		0x02
+
+#define IPTOS_PREC_MASK		0xE0
+#define IPTOS_PREC(tos)		((tos)&IPTOS_PREC_MASK)
+#define IPTOS_PREC_NETCONTROL           0xe0
+#define IPTOS_PREC_INTERNETCONTROL      0xc0
+#define IPTOS_PREC_CRITIC_ECP           0xa0
+#define IPTOS_PREC_FLASHOVERRIDE        0x80
+#define IPTOS_PREC_FLASH                0x60
+#define IPTOS_PREC_IMMEDIATE            0x40
+#define IPTOS_PREC_PRIORITY             0x20
+#define IPTOS_PREC_ROUTINE              0x00
+
+
+/* IP options */
+#define IPOPT_COPY		0x80
+#define IPOPT_CLASS_MASK	0x60
+#define IPOPT_NUMBER_MASK	0x1f
+
+#define	IPOPT_COPIED(o)		((o)&IPOPT_COPY)
+#define	IPOPT_CLASS(o)		((o)&IPOPT_CLASS_MASK)
+#define	IPOPT_NUMBER(o)		((o)&IPOPT_NUMBER_MASK)
+
+#define	IPOPT_CONTROL		0x00
+#define	IPOPT_RESERVED1		0x20
+#define	IPOPT_MEASUREMENT	0x40
+#define	IPOPT_RESERVED2		0x60
+
+#define IPOPT_END	(0 |IPOPT_CONTROL)
+#define IPOPT_NOOP	(1 |IPOPT_CONTROL)
+#define IPOPT_SEC	(2 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_LSRR	(3 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_TIMESTAMP	(4 |IPOPT_MEASUREMENT)
+#define IPOPT_CIPSO	(6 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_RR	(7 |IPOPT_CONTROL)
+#define IPOPT_SID	(8 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_SSRR	(9 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_RA	(20|IPOPT_CONTROL|IPOPT_COPY)
+
+#define IPVERSION	4
+#define MAXTTL		255
+#define IPDEFTTL	64
+
+#define IPOPT_OPTVAL 0
+#define IPOPT_OLEN   1
+#define IPOPT_OFFSET 2
+#define IPOPT_MINOFF 4
+#define MAX_IPOPTLEN 40
+#define IPOPT_NOP IPOPT_NOOP
+#define IPOPT_EOL IPOPT_END
+#define IPOPT_TS  IPOPT_TIMESTAMP
+
+#define	IPOPT_TS_TSONLY		0		/* timestamps only */
+#define	IPOPT_TS_TSANDADDR	1		/* timestamps and addresses */
+#define	IPOPT_TS_PRESPEC	3		/* specified modules only */
+
+#define IPV4_BEET_PHMAXLEN 8
+
+struct iphdr {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+	__u8	ihl:4,
+		version:4;
+#elif defined (__BIG_ENDIAN_BITFIELD)
+	__u8	version:4,
+  		ihl:4;
+#else
+#error	"Please fix <asm/byteorder.h>"
+#endif
+	__u8	tos;
+	__be16	tot_len;
+	__be16	id;
+	__be16	frag_off;
+	__u8	ttl;
+	__u8	protocol;
+	__sum16	check;
+	__struct_group(/* no tag */, addrs, /* no attrs */,
+		__be32	saddr;
+		__be32	daddr;
+	);
+	/*The options start here. */
+};
+
+
+struct ip_auth_hdr {
+	__u8  nexthdr;
+	__u8  hdrlen;		/* This one is measured in 32 bit units! */
+	__be16 reserved;
+	__be32 spi;
+	__be32 seq_no;		/* Sequence number */
+	__u8  auth_data[];	/* Variable len but >=4. Mind the 64 bit alignment! */
+};
+
+struct ip_esp_hdr {
+	__be32 spi;
+	__be32 seq_no;		/* Sequence number */
+	__u8  enc_data[];	/* Variable len but >=8. Mind the 64 bit alignment! */
+};
+
+struct ip_comp_hdr {
+	__u8 nexthdr;
+	__u8 flags;
+	__be16 cpi;
+};
+
+struct ip_beet_phdr {
+	__u8 nexthdr;
+	__u8 hdrlen;
+	__u8 padlen;
+	__u8 reserved;
+};
+
+/* index values for the variables in ipv4_devconf */
+enum
+{
+	IPV4_DEVCONF_FORWARDING=1,
+	IPV4_DEVCONF_MC_FORWARDING,
+	IPV4_DEVCONF_PROXY_ARP,
+	IPV4_DEVCONF_ACCEPT_REDIRECTS,
+	IPV4_DEVCONF_SECURE_REDIRECTS,
+	IPV4_DEVCONF_SEND_REDIRECTS,
+	IPV4_DEVCONF_SHARED_MEDIA,
+	IPV4_DEVCONF_RP_FILTER,
+	IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE,
+	IPV4_DEVCONF_BOOTP_RELAY,
+	IPV4_DEVCONF_LOG_MARTIANS,
+	IPV4_DEVCONF_TAG,
+	IPV4_DEVCONF_ARPFILTER,
+	IPV4_DEVCONF_MEDIUM_ID,
+	IPV4_DEVCONF_NOXFRM,
+	IPV4_DEVCONF_NOPOLICY,
+	IPV4_DEVCONF_FORCE_IGMP_VERSION,
+	IPV4_DEVCONF_ARP_ANNOUNCE,
+	IPV4_DEVCONF_ARP_IGNORE,
+	IPV4_DEVCONF_PROMOTE_SECONDARIES,
+	IPV4_DEVCONF_ARP_ACCEPT,
+	IPV4_DEVCONF_ARP_NOTIFY,
+	IPV4_DEVCONF_ACCEPT_LOCAL,
+	IPV4_DEVCONF_SRC_VMARK,
+	IPV4_DEVCONF_PROXY_ARP_PVLAN,
+	IPV4_DEVCONF_ROUTE_LOCALNET,
+	IPV4_DEVCONF_IGMPV2_UNSOLICITED_REPORT_INTERVAL,
+	IPV4_DEVCONF_IGMPV3_UNSOLICITED_REPORT_INTERVAL,
+	IPV4_DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,
+	IPV4_DEVCONF_DROP_UNICAST_IN_L2_MULTICAST,
+	IPV4_DEVCONF_DROP_GRATUITOUS_ARP,
+	IPV4_DEVCONF_BC_FORWARDING,
+	IPV4_DEVCONF_ARP_EVICT_NOCARRIER,
+	__IPV4_DEVCONF_MAX
+};
+
+#define IPV4_DEVCONF_MAX (__IPV4_DEVCONF_MAX - 1)
+
+#endif /* _LINUX_IP_H */
diff --git a/contrib/libs/linux-headers/linux/stddef.h b/contrib/libs/linux-headers/linux/stddef.h
index 23e025fec04..b3d4a9c170e 100644
--- a/contrib/libs/linux-headers/linux/stddef.h
+++ b/contrib/libs/linux-headers/linux/stddef.h
@@ -1,6 +1,58 @@
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _LINUX_STDDEF_H
+#define _LINUX_STDDEF_H
+
 
 
 #ifndef __always_inline
 #define __always_inline __inline__
 #endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+	union { \
+		struct { MEMBERS } ATTRS; \
+		struct TAG { MEMBERS } ATTRS NAME; \
+	}
+
+#ifdef __cplusplus
+/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */
+#define __DECLARE_FLEX_ARRAY(T, member)	\
+	T member[0]
+#else
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME)	\
+	struct { \
+		struct { } __empty_ ## NAME; \
+		TYPE NAME[]; \
+	}
+#endif
+
+#ifndef __counted_by
+#define __counted_by(m)
+#endif
+
+#endif /* _LINUX_STDDEF_H */
diff --git a/contrib/restricted/CMakeLists.linux-aarch64.txt b/contrib/restricted/CMakeLists.linux-aarch64.txt
index f83a626e833..ba1763c099d 100644
--- a/contrib/restricted/CMakeLists.linux-aarch64.txt
+++ b/contrib/restricted/CMakeLists.linux-aarch64.txt
@@ -15,6 +15,7 @@ add_subdirectory(dragonbox)
 add_subdirectory(fast_float)
 add_subdirectory(google)
 add_subdirectory(googletest)
+add_subdirectory(libnl)
 add_subdirectory(nlohmann_json)
 add_subdirectory(thrift)
 add_subdirectory(uriparser)
diff --git a/contrib/restricted/CMakeLists.linux-x86_64.txt b/contrib/restricted/CMakeLists.linux-x86_64.txt
index f83a626e833..ba1763c099d 100644
--- a/contrib/restricted/CMakeLists.linux-x86_64.txt
+++ b/contrib/restricted/CMakeLists.linux-x86_64.txt
@@ -15,6 +15,7 @@ add_subdirectory(dragonbox)
 add_subdirectory(fast_float)
 add_subdirectory(google)
 add_subdirectory(googletest)
+add_subdirectory(libnl)
 add_subdirectory(nlohmann_json)
 add_subdirectory(thrift)
 add_subdirectory(uriparser)
diff --git a/contrib/restricted/libnl/CMakeLists.txt b/contrib/restricted/libnl/CMakeLists.txt
new file mode 100644
index 00000000000..3ea7a4199b2
--- /dev/null
+++ b/contrib/restricted/libnl/CMakeLists.txt
@@ -0,0 +1 @@
+add_subdirectory(lib)
diff --git a/contrib/restricted/libnl/lib/CMakeLists.txt b/contrib/restricted/libnl/lib/CMakeLists.txt
new file mode 100644
index 00000000000..6c9b2f6d9ca
--- /dev/null
+++ b/contrib/restricted/libnl/lib/CMakeLists.txt
@@ -0,0 +1,6 @@
+add_subdirectory(nl-3)
+add_subdirectory(nl-genl-3)
+add_subdirectory(nl-idiag-3)
+add_subdirectory(nl-nf-3)
+add_subdirectory(nl-route-3)
+add_subdirectory(nl-xfrm-3)
diff --git a/contrib/restricted/libnl/lib/nl-3/CMakeLists.txt b/contrib/restricted/libnl/lib/nl-3/CMakeLists.txt
new file mode 100644
index 00000000000..47950ee438a
--- /dev/null
+++ b/contrib/restricted/libnl/lib/nl-3/CMakeLists.txt
@@ -0,0 +1,30 @@
+add_library(contrib-restricted-libnl-lib-nl-3)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-3 PUBLIC
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/include
+)
+
+target_compile_options(contrib-restricted-libnl-lib-nl-3 PRIVATE
+  -DHAVE_CONFIG_H
+  -DSYSCONFDIR=\"/etc/libnl\"
+)
+
+target_sources(contrib-restricted-libnl-lib-nl-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/addr.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/attr.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/cache.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/cache_mngr.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/cache_mngt.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/data.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/error.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/handlers.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/hash.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/hashtable.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/mpls.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/msg.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/nl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/object.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/socket.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/utils.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/version.c
+)
diff --git a/contrib/restricted/libnl/lib/nl-genl-3/CMakeLists.txt b/contrib/restricted/libnl/lib/nl-genl-3/CMakeLists.txt
new file mode 100644
index 00000000000..5e88b483266
--- /dev/null
+++ b/contrib/restricted/libnl/lib/nl-genl-3/CMakeLists.txt
@@ -0,0 +1,21 @@
+add_library(contrib-restricted-libnl-lib-nl-genl-3)
+
+target_link_libraries(contrib-restricted-libnl-lib-nl-genl-3 PRIVATE
+  contrib-restricted-libnl-lib-nl-3
+)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-genl-3 PUBLIC
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/include
+)
+
+target_compile_options(contrib-restricted-libnl-lib-nl-genl-3 PRIVATE
+  -DHAVE_CONFIG_H
+  -DSYSCONFDIR=\"/etc/libnl\"
+)
+
+target_sources(contrib-restricted-libnl-lib-nl-genl-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/genl/ctrl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/genl/family.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/genl/genl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/genl/mngt.c
+)
diff --git a/contrib/restricted/libnl/lib/nl-idiag-3/CMakeLists.txt b/contrib/restricted/libnl/lib/nl-idiag-3/CMakeLists.txt
new file mode 100644
index 00000000000..fdfdd9386c3
--- /dev/null
+++ b/contrib/restricted/libnl/lib/nl-idiag-3/CMakeLists.txt
@@ -0,0 +1,22 @@
+add_library(contrib-restricted-libnl-lib-nl-idiag-3)
+
+target_link_libraries(contrib-restricted-libnl-lib-nl-idiag-3 PRIVATE
+  contrib-restricted-libnl-lib-nl-3
+)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-idiag-3 PUBLIC
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/include
+)
+
+target_compile_options(contrib-restricted-libnl-lib-nl-idiag-3 PRIVATE
+  -DHAVE_CONFIG_H
+  -DSYSCONFDIR=\"/etc/libnl\"
+)
+
+target_sources(contrib-restricted-libnl-lib-nl-idiag-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/idiag/idiag.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/idiag/idiag_meminfo_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/idiag/idiag_msg_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/idiag/idiag_req_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/idiag/idiag_vegasinfo_obj.c
+)
diff --git a/contrib/restricted/libnl/lib/nl-nf-3/CMakeLists.txt b/contrib/restricted/libnl/lib/nl-nf-3/CMakeLists.txt
new file mode 100644
index 00000000000..9b0e613deb1
--- /dev/null
+++ b/contrib/restricted/libnl/lib/nl-nf-3/CMakeLists.txt
@@ -0,0 +1,31 @@
+add_library(contrib-restricted-libnl-lib-nl-nf-3)
+
+target_link_libraries(contrib-restricted-libnl-lib-nl-nf-3 PRIVATE
+  contrib-restricted-libnl-lib-nl-3
+)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-nf-3 PUBLIC
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/include
+)
+
+target_compile_options(contrib-restricted-libnl-lib-nl-nf-3 PRIVATE
+  -DHAVE_CONFIG_H
+  -DSYSCONFDIR=\"/etc/libnl\"
+)
+
+target_sources(contrib-restricted-libnl-lib-nl-nf-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/ct.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/ct_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/exp.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/exp_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/log.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/log_msg.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/log_msg_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/log_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/netfilter.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/nfnl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/queue.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/queue_msg.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/queue_msg_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/netfilter/queue_obj.c
+)
diff --git a/contrib/restricted/libnl/lib/nl-route-3/CMakeLists.txt b/contrib/restricted/libnl/lib/nl-route-3/CMakeLists.txt
new file mode 100644
index 00000000000..d805cf060f3
--- /dev/null
+++ b/contrib/restricted/libnl/lib/nl-route-3/CMakeLists.txt
@@ -0,0 +1,112 @@
+add_library(contrib-restricted-libnl-lib-nl-route-3)
+
+target_link_libraries(contrib-restricted-libnl-lib-nl-route-3 PRIVATE
+  contrib-libs-linux-headers
+  contrib-restricted-libnl-lib-nl-3
+)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-route-3 PUBLIC
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/include
+)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-route-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls
+)
+
+target_compile_options(contrib-restricted-libnl-lib-nl-route-3 PRIVATE
+  -DHAVE_CONFIG_H
+  -DSYSCONFDIR=\"/etc/libnl\"
+)
+
+target_sources(contrib-restricted-libnl-lib-nl-route-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/fib_lookup/lookup.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/fib_lookup/request.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/act.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/act/gact.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/act/mirred.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/act/nat.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/act/skbedit.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/act/vlan.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/addr.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/class.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/classid.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/basic.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/cgroup.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch/cmp.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch/container.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch/meta.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch/nbyte.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch/text.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch_grammar.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/ematch_syntax.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/flower.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/fw.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/mall.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/police.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/cls/u32.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/api.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/bonding.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/bridge.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/bridge_info.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/can.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/dummy.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/geneve.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ifb.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/inet.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/inet6.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ip6gre.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ip6tnl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ip6vti.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ipgre.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ipip.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ipvlan.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ipvti.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/macsec.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/macvlan.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/ppp.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/sit.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/sriov.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/team.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/veth.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/vlan.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/vrf.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/vxlan.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/link/xfrmi.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/mdb.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/neigh.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/neightbl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/netconf.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/nexthop.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/nexthop_encap.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/nh.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/nh_encap_mpls.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/pktloc.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/pktloc_grammar.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/pktloc_syntax.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/blackhole.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/cbq.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/dsmark.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/fifo.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/fq_codel.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/hfsc.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/htb.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/ingress.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/mqprio.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/netem.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/plug.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/prio.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/red.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/sfq.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/qdisc/tbf.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/route.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/route_obj.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/route_utils.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/rtnl.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/rule.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/route/tc.c
+)
diff --git a/contrib/restricted/libnl/lib/nl-xfrm-3/CMakeLists.txt b/contrib/restricted/libnl/lib/nl-xfrm-3/CMakeLists.txt
new file mode 100644
index 00000000000..cd462385dbf
--- /dev/null
+++ b/contrib/restricted/libnl/lib/nl-xfrm-3/CMakeLists.txt
@@ -0,0 +1,24 @@
+add_library(contrib-restricted-libnl-lib-nl-xfrm-3)
+
+target_link_libraries(contrib-restricted-libnl-lib-nl-xfrm-3 PUBLIC
+  contrib-libs-linux-headers
+  contrib-restricted-libnl-lib-nl-3
+)
+
+target_include_directories(contrib-restricted-libnl-lib-nl-xfrm-3 PUBLIC
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/include
+)
+
+target_compile_options(contrib-restricted-libnl-lib-nl-xfrm-3 PRIVATE
+    -DHAVE_CONFIG_H
+    -DSYSCONFDIR=\"/etc/libnl\"
+)
+
+target_sources(contrib-restricted-libnl-lib-nl-xfrm-3 PRIVATE
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/xfrm/ae.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/xfrm/lifetime.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/xfrm/sa.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/xfrm/selector.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/xfrm/sp.c
+  ${CMAKE_SOURCE_DIR}/contrib/restricted/libnl/lib/xfrm/template.c
+)