diff --git a/.criu.metadata b/.criu.metadata
index 32249b0..b909fca 100644
--- a/.criu.metadata
+++ b/.criu.metadata
@@ -1 +1 @@
-511205e8fb4b170e70e3e97073c7d886d382b088 SOURCES/criu-1.6.1.tar.bz2
+975b007ef8824c5a266af58085fca4f9266cd28d SOURCES/criu-2.3.tar.bz2
diff --git a/.gitignore b/.gitignore
index 9571d2a..054b213 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/criu-1.6.1.tar.bz2
+SOURCES/criu-2.3.tar.bz2
diff --git a/SOURCES/2fdef836a59938b169ca3c8f2c813b35258f1ed5.patch b/SOURCES/2fdef836a59938b169ca3c8f2c813b35258f1ed5.patch
new file mode 100644
index 0000000..12abaa8
--- /dev/null
+++ b/SOURCES/2fdef836a59938b169ca3c8f2c813b35258f1ed5.patch
@@ -0,0 +1,115 @@
+From 2fdef836a59938b169ca3c8f2c813b35258f1ed5 Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Tue, 14 Jun 2016 10:13:00 +0300
+Subject: [PATCH] criu: add an option to skip in-flight connections
+
+Trying to migrate containers with tomcat and running ab as a test client
+(ab -n 1000000 -c 20 http://url/to/test) criu sometimes exited with an
+error if in-flight connections were detected. Criu can handle sockets
+listening and with established connection. In-flight connections can
+happen on sockets which do not yet have a full established connection
+(SYN, SYN-ACK, and the last ACK is missing).
+
+This adds a new option to criu:
+
+ --skip-in-flight  this option skips in-flight TCP connections.
+                   if TCP connections are found which are not yet completely
+                   established, criu will ignore these connections in favor
+                   of erroring out.
+
+With this option criu will skip sockets in this state and let's the client
+handle the re-connection.
+
+Signed-off-by: Adrian Reber <areber@redhat.com>
+Acked-by: Andrew Vagin <avagin@virtuozzo.com>
+Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
+---
+ criu/crtools.c            | 9 +++++++++
+ criu/include/cr_options.h | 1 +
+ criu/include/sk-inet.h    | 1 +
+ criu/sk-inet.c            | 7 +++++++
+ 4 files changed, 18 insertions(+)
+
+diff --git a/criu/crtools.c b/criu/crtools.c
+index b527374..e7da5c7 100644
+--- a/criu/crtools.c
++++ b/criu/crtools.c
+@@ -279,6 +279,7 @@ int main(int argc, char *argv[], char *envp[])
+ 		{ "extra",			no_argument,		0, 1077	},
+ 		{ "experimental",		no_argument,		0, 1078	},
+ 		{ "all",			no_argument,		0, 1079	},
++		{ SK_INFLIGHT_PARAM,		no_argument,		0, 1083	},
+ 		{ },
+ 	};
+ 
+@@ -583,6 +584,10 @@ int main(int argc, char *argv[], char *envp[])
+ 			opts.check_extra_features = true;
+ 			opts.check_experimental_features = true;
+ 			break;
++		case 1083:
++			pr_msg("Will skip in-flight TCP connections\n");
++			opts.tcp_skip_in_flight = true;
++			break;
+ 		case 'V':
+ 			pr_msg("Version: %s\n", CRIU_VERSION);
+ 			if (strcmp(CRIU_GITID, "0"))
+@@ -791,6 +796,10 @@ int main(int argc, char *argv[], char *envp[])
+ "* Special resources support:\n"
+ "  -x|--" USK_EXT_PARAM "inode,.." "      allow external unix connections (optionally can be assign socket's inode that allows one-sided dump)\n"
+ "     --" SK_EST_PARAM "  checkpoint/restore established TCP connections\n"
++"     --" SK_INFLIGHT_PARAM "   this option skips in-flight TCP connections.\n"
++"                        if TCP connections are found which are not yet completely\n"
++"                        established, criu will ignore these connections in favor\n"
++"                        of erroring out.\n"
+ "  -r|--root PATH        change the root filesystem (when run in mount namespace)\n"
+ "  --evasive-devices     use any path to a device file if the original one\n"
+ "                        is inaccessible\n"
+diff --git a/criu/include/cr_options.h b/criu/include/cr_options.h
+index 32c9d4f..bf9feee 100644
+--- a/criu/include/cr_options.h
++++ b/criu/include/cr_options.h
+@@ -109,6 +109,7 @@ struct cr_options {
+ 	char			*lsm_profile;
+ 	unsigned int		timeout;
+ 	unsigned int		empty_ns;
++	bool			tcp_skip_in_flight;
+ };
+ 
+ extern struct cr_options opts;
+diff --git a/criu/include/sk-inet.h b/criu/include/sk-inet.h
+index 4707a6e..9d2bda6 100644
+--- a/criu/include/sk-inet.h
++++ b/criu/include/sk-inet.h
+@@ -72,6 +72,7 @@ extern int dump_one_tcp(int sk, struct inet_sk_desc *sd);
+ extern int restore_one_tcp(int sk, struct inet_sk_info *si);
+ 
+ #define SK_EST_PARAM	"tcp-established"
++#define SK_INFLIGHT_PARAM "skip-in-flight"
+ 
+ extern int check_tcp(void);
+ extern mutex_t *inet_get_reuseaddr_lock(struct inet_sk_info *ii);
+diff --git a/criu/sk-inet.c b/criu/sk-inet.c
+index 20c6535..dfcfae6 100644
+--- a/criu/sk-inet.c
++++ b/criu/sk-inet.c
+@@ -144,6 +144,11 @@ static int can_dump_inet_sk(const struct inet_sk_desc *sk)
+ 	switch (sk->state) {
+ 	case TCP_LISTEN:
+ 		if (sk->rqlen != 0) {
++			if (opts.tcp_skip_in_flight) {
++				pr_info("Skipping in-flight connection (l) for %x\n",
++						sk->sd.ino);
++				break;
++			}
+ 			/*
+ 			 * Currently the ICONS nla reports the conn
+ 			 * requests for listen sockets. Need to pick
+@@ -151,6 +156,8 @@ static int can_dump_inet_sk(const struct inet_sk_desc *sk)
+ 			 */
+ 			pr_err("In-flight connection (l) for %x\n",
+ 					sk->sd.ino);
++			pr_err("In-flight connections can be ignored with the"
++					"--%s option.\n", SK_INFLIGHT_PARAM);
+ 			return 0;
+ 		}
+ 		break;
diff --git a/SOURCES/98c8e44f749dd7ed0aa8c540f566bda54d7adfa1.patch b/SOURCES/98c8e44f749dd7ed0aa8c540f566bda54d7adfa1.patch
deleted file mode 100644
index 2e976a1..0000000
--- a/SOURCES/98c8e44f749dd7ed0aa8c540f566bda54d7adfa1.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 98c8e44f749dd7ed0aa8c540f566bda54d7adfa1 Mon Sep 17 00:00:00 2001
-From: Andrey Vagin <avagin@openvz.org>
-Date: Thu, 2 Jul 2015 12:47:07 +0300
-Subject: [PATCH] pipe: don't create a tranport descriptor for inhereted pipes
-
-Otherwise we can get an error like this:
-1: \t\tCreate transport fd /crtools-fd-1-5
-...
-1: Found id pipe:[122747] (fd 8) in inherit fd list
-1: File pipe:[122747] will be restored from fd 9 duped from inherit
-
-1: Error (util.c:131): fd 5 already in use (called at files.c:872)
-Signed-off-by: Andrey Vagin <avagin@openvz.org>
-Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
----
- files.c |  3 +++
- pipes.c | 20 ++++++++++++--------
- 2 files changed, 15 insertions(+), 8 deletions(-)
-
-diff --git a/files.c b/files.c
-index 4eeb988..3e69be7 100644
---- a/files.c
-+++ b/files.c
-@@ -1394,6 +1394,9 @@ bool inherited_fd(struct file_desc *d, int *fd_p)
- 	if (i_fd < 0)
- 		return false;
- 
-+	if (fd_p == NULL)
-+		return true;
-+
- 	*fd_p = dup(i_fd);
- 	if (*fd_p < 0)
- 		pr_perror("Inherit fd DUP failed");
-diff --git a/pipes.c b/pipes.c
-index 7590472..62f550c 100644
---- a/pipes.c
-+++ b/pipes.c
-@@ -393,18 +393,22 @@ static int collect_one_pipe(void *o, ProtobufCMessage *base)
- 	pr_info("Collected pipe entry ID %#x PIPE ID %#x\n",
- 			pi->pe->id, pi->pe->pipe_id);
- 
--	list_for_each_entry(tmp, &pipes, list)
--		if (pi->pe->pipe_id == tmp->pe->pipe_id)
--			break;
-+	if (file_desc_add(&pi->d, pi->pe->id, &pipe_desc_ops))
-+		return -1;
- 
--	if (&tmp->list == &pipes)
--		INIT_LIST_HEAD(&pi->pipe_list);
--	else
--		list_add(&pi->pipe_list, &tmp->pipe_list);
-+	INIT_LIST_HEAD(&pi->pipe_list);
-+	if (!inherited_fd(&pi->d, NULL)) {
-+		list_for_each_entry(tmp, &pipes, list)
-+			if (pi->pe->pipe_id == tmp->pe->pipe_id)
-+				break;
-+
-+		if (&tmp->list != &pipes)
-+			list_add(&pi->pipe_list, &tmp->pipe_list);
-+	}
- 
- 	list_add_tail(&pi->list, &pipes);
--	return file_desc_add(&pi->d, pi->pe->id, &pipe_desc_ops);
- 
-+	return 0;
- }
- 
- struct collect_image_info pipe_cinfo = {
diff --git a/SOURCES/aio-fix.patch b/SOURCES/aio-fix.patch
index dbe63ed..8589d55 100644
--- a/SOURCES/aio-fix.patch
+++ b/SOURCES/aio-fix.patch
@@ -1,6 +1,6 @@
---- a/aio.c	2015-07-01 11:02:50.360004543 -0400
-+++ b/aio.c	2015-07-01 11:03:33.099757812 -0400
-@@ -61,7 +61,7 @@
+--- a/criu/aio.c	2015-07-01 11:02:50.360004543 -0400
++++ b/criu/aio.c	2015-07-01 11:03:33.099757812 -0400
+@@ -74,7 +74,7 @@
  	 * up back to the k_max_reqs.
  	 */
  
diff --git a/SOURCES/criu-check-for-CLONE_NEWUSER-CLONE_NEWPID.patch b/SOURCES/criu-check-for-CLONE_NEWUSER-CLONE_NEWPID.patch
deleted file mode 100644
index 736889d..0000000
--- a/SOURCES/criu-check-for-CLONE_NEWUSER-CLONE_NEWPID.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-check: try to call clone with CLONE_NEWPID and CLONE_PARENT
-
-This combination was forbidden in 3.12
-commit 40a0d32d1eaffe6aac7324ca92604b6b3977eb0e :
-"fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks"
-
-and then it was permited again in 3.13:
-commit 1f7f4dde5c945f41a7abc2285be43d918029ecc5
-fork:  Allow CLONE_PARENT after setns(CLONE_NEWPID)
-
-Cc: Adrian Reber <adrian@lisas.de>
-Signed-off-by: Andrey Vagin <avagin@openvz.org>
----
- cr-check.c | 28 ++++++++++++++++++++++++++++
- 1 file changed, 28 insertions(+)
-
-diff --git a/cr-check.c b/cr-check.c
-index 7cf796a..bf1b729 100644
---- a/cr-check.c
-+++ b/cr-check.c
-@@ -688,6 +688,33 @@ static int check_fdinfo_lock(void)
- 	return 0;
- }
- 
-+struct clone_arg {
-+	/*
-+	 * Reserve some space for clone() to locate arguments
-+	 * and retcode in this place
-+	 */
-+	char stack[128] __attribute__((aligned (8)));
-+	char stack_ptr[0];
-+};
-+
-+static int clone_cb(void *_arg) {
-+	exit(0);
-+}
-+
-+static int check_clone_parent_vs_pid()
-+{
-+	struct clone_arg ca;
-+	pid_t pid;
-+
-+	pid = clone(clone_cb, ca.stack_ptr, CLONE_NEWPID | CLONE_PARENT, &ca);
-+	if (pid < 0) {
-+		pr_err("CLONE_PARENT | CLONE_NEWPID don't work together\n");
-+		return -1;
-+	}
-+
-+	return 0;
-+}
-+
- static int (*chk_feature)(void);
- 
- int cr_check(void)
-@@ -741,6 +768,7 @@ int cr_check(void)
- 	ret |= check_mnt_id();
- 	ret |= check_aio_remap();
- 	ret |= check_fdinfo_lock();
-+	ret |= check_clone_parent_vs_pid();
- 
- out:
- 	if (!ret)
--- 
-2.1.0
-
diff --git a/SOURCES/criu.8 b/SOURCES/criu.8
new file mode 100644
index 0000000..e621b62
--- /dev/null
+++ b/SOURCES/criu.8
@@ -0,0 +1,883 @@
+'\" t
+.\"     Title: criu
+.\"    Author: [see the "AUTHOR" section]
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 06/14/2016
+.\"    Manual: CRIU Manual
+.\"    Source: criu 2.3
+.\"  Language: English
+.\"
+.TH "CRIU" "8" "06/14/2016" "criu 2\&.3" "CRIU Manual"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+criu \- checkpoint/restore in userspace
+.SH "SYNOPSIS"
+.sp
+\fBcriu\fR \fI<command>\fR [\fIoptions\fR]
+.SH "DESCRIPTION"
+.sp
+\fBcriu\fR is a tool for checkpointing and restoring running applications\&. It does this by saving their state as a collection of files (see the \fIdump\fR command) and creating equivalent processes from those files (see the \fIrestore\fR command)\&. The restore operation can be performed at a later time, on a different system, or both\&.
+.SH "OPTIONS"
+.sp
+The options are depending on the \fI<command>\fR \fBcriu\fR run with\&.
+.SS "Common options"
+.sp
+Common options are applied to any \fI<command>\fR\&.
+.PP
+\fB\-v\fR[\fI<num>\fR|\fBv\fR\&...]
+.RS 4
+Set logging level to
+\fI<num>\fR\&. The higer the level, the more output is produced\&. Either numeric values or multiple
+\fBv\fR
+can be used\&.
+
+The following levels are available:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fB\-v1\fR,
+\fB\-v\fR
+only messages and errors;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fB\-v2\fR,
+\fB\-vv\fR
+also warnings (default level);
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fB\-v3\fR,
+\fB\-vvv\fR
+also information messages and timestamps;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fB\-v4\fR,
+\fB\-vvvv\fR
+lots of debug\&.
+.RE
+.RE
+.PP
+\fB\-\-pidfile\fR \fI<file>\fR
+.RS 4
+Write root task, service or page\-server pid into a
+\fI<file>\fR\&.
+.RE
+.PP
+\fB\-o\fR, \fB\-\-log\-file\fR \fI<file>\fR
+.RS 4
+Write logging messages to
+\fI<file>\fR\&.
+.RE
+.PP
+\fB\-\-log\-pid\fR
+.RS 4
+Write separate logging files per each pid\&.
+.RE
+.PP
+\fB\-D\fR, \fB\-\-images\-dir\fR \fI<path>\fR
+.RS 4
+Use path
+\fI<path>\fR
+as a base directory where to look for dump files set\&.
+.RE
+.PP
+\fB\-\-prev\-images\-dir\fR \fI<path>\fR
+.RS 4
+Use path
+\fI<path>\fR
+as a parent directory where to look for dump files set\&. This make sence in case of increment dumps\&.
+.RE
+.PP
+\fB\-W\fR, \fB\-\-work\-dir\fR \fI<dir>\fR
+.RS 4
+Use directory
+\fI<dir>\fR
+for putting logs, pidfiles and statistics\&. If not specified,
+\fI<path>\fR
+from
+\fB\-D\fR
+option is taken\&.
+.RE
+.PP
+\fB\-\-close\fR \fI<fd>\fR
+.RS 4
+Close file with descriptor
+\fI<fd>\fR
+before any actions\&.
+.RE
+.PP
+\fB\-L\fR, \fB\-\-libdir\fR \fI<path>\fR
+.RS 4
+Path to a plugins directory\&.
+.RE
+.PP
+\fB\-\-action\-script\fR \fI<SCRIPT>\fR
+.RS 4
+Add an external action script\&. The environment variable
+\fBCRTOOLS_SCRIPT_ACTION\fR
+contains one of the actions:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBpre\-dump\fR
+run an action prior to beginning a
+\fBdump\fR
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBpost\-dump\fR
+run an action upon
+\fBdump\fR
+completion;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBpre\-restore\fR
+run an action prior to beginning a
+\fBrestore\fR
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBpost\-restore\fR
+run an action upon
+\fBrestore\fR
+completion;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBnetwork\-lock\fR
+lock network in a target network namespace;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBnetwork\-unlock\fR
+unlock network in a target network namespace;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBsetup\-namespaces\fR
+run an action once root task just been created with required namespaces, note it is early stage on restore nothing were restored yet except namespaces themselves\&.
+.RE
+.RE
+.PP
+\fB\-V\fR, \fB\-\-version\fR
+.RS 4
+Print program version and exit\&.
+.RE
+.PP
+\fB\-h\fR, \fB\-\-help\fR
+.RS 4
+Print a commands list and exit\&. The commands list is very short one just for overview and does not match this manual\&.
+.RE
+.SS "pre\-dump"
+.sp
+Launches that named pre\-dump procedure, where \fBcriu\fR does snapshot of memory changes since previous pre\-dump\&. Also \fBcriu\fR forms fsnotify cache which speedup \fBrestore\fR procedure\&. \fBpre\-dump\fR requires at least \fB\-t\fR option (see \fBdump\fR below)\&. Optionally \fBpage\-server\fR options may be specified\&.
+.PP
+\fB\-\-track\-mem\fR
+.RS 4
+Turn on memory changes tracker in the kernel\&. If the option is not passed the memory tracker get turned on implicitly\&.
+.RE
+.SS "dump"
+.sp
+Starts a checkpoint procedure\&.
+.PP
+\fB\-t\fR, \fB\-\-tree\fR \fI<pid>\fR
+.RS 4
+Checkpoint the whole process tree starting from
+\fI<pid>\fR\&.
+.RE
+.PP
+\fB\-R\fR, \fB\-\-leave\-running\fR
+.RS 4
+Leave tasks in running state after checkpoint instead of killing them\&. This option is pretty dangerous and should be used if and only if you understand what you are doing\&.
+.sp
+If task is about to run after been checkpointed it can modify TCP connections, delete files and do other dangerous actions\&. So that
+\fBcriu\fR
+itself can not guarantee that the next
+\fBrestore\fR
+action will not fail\&. Most likely if a user starts
+\fBcriu\fR
+with this option passed at least the file system snapshot must be done with help of
+\fIpost\-dump\fR
+script\&.
+.sp
+In other words, do not use it until really needed\&.
+.RE
+.PP
+\fB\-s\fR, \fB\-\-leave\-stopped\fR
+.RS 4
+Leave tasks in stopped state after checkpoint instead of killing them\&.
+.RE
+.PP
+\fB\-x\fR, \fB\-\-ext\-unix\-sk\fR [\fI<inode>\fR,<inode>\*(Aq]
+.RS 4
+Dump external unix sockets\&. Optionally passing
+\fI<inode>\fR
+(or comma separated series) it assigns inodes which allowed for one sided dump\&.
+.RE
+.PP
+\fB\-\-freeze\-cgroup\fR
+.RS 4
+Use cgroup freezer to collect processes\&.
+.RE
+.PP
+\fB\-\-manage\-cgroups\fR
+.RS 4
+Collect cgroups into the image thus they gonna be restored then\&. Without this argument
+\fBcriu\fR
+will not save cgroups configuration associated with a task\&.
+.RE
+.PP
+\fB\-\-tcp\-established\fR
+.RS 4
+Checkpoint established TCP connections\&.
+.RE
+.PP
+\fB\-\-veth\-pair\fR \fI<IN>\fR\fB=\fR\fI<OUT>\fR
+.RS 4
+Correspondence between outside and inside names of veth devices\&.
+.RE
+.PP
+\fB\-\-evasive\-devices\fR
+.RS 4
+Use any path to a device file if the original one is inaccessible\&.
+.RE
+.PP
+\fB\-\-page\-server\fR
+.RS 4
+Send pages to a page server (see
+\fBpage\-server\fR
+command)\&.
+.RE
+.PP
+\fB\-\-force\-irmap\fR
+.RS 4
+Force resolving names for inotify and fsnotify watches\&.
+.RE
+.PP
+\fB\-\-auto\-dedup\fR
+.RS 4
+Deduplicate "old" data in pages images of previous
+\fBdump\fR\&. Which implies incremental
+\fBdump\fR
+mode (see
+\fBpre\-dump\fR
+command)\&.
+.RE
+.PP
+\fB\-l\fR, \fB\-\-file\-locks\fR
+.RS 4
+Dump file locks\&. It is necessary to make sure that all file lock users are taken into dump, so it is only safe to use this for enclojured containers where locks are not holed by someone outside of it\&.
+.RE
+.PP
+\fB\-M\fR, \fB\-\-ext\-mount\-map\fR \fI<KEY>\fR\fB:\fR\fI<VAL>\fR
+.RS 4
+Setup mapping for external mounts\&.
+\fI<KEY>\fR
+is a mountpoint inside container and corresponding
+\fI<VAL>\fR
+is a string that will be written into the image as mountpoint\*(Aqs root value\&.
+.RE
+.PP
+\fB\-\-link\-remap\fR
+.RS 4
+Allow one to link unlinked files back when possible (modifies FS till
+\fBrestore\fR)\&.
+.RE
+.PP
+\fB\-\-ghost\-limit\fR \fIsize\fR
+.RS 4
+Allow one to specify maximum allowed size of deleted file to be carried inside image files\&. By default up to 1M file is allowed\&. It is done in a sake to not carry big files inside images\&.
+\fIsize\fR
+may be postfixed with
+\fIK\fR,
+\fIM\fR
+or
+\fIG\fR
+(which stands for kilo, mega and gigabytes accordingly)\&.
+.RE
+.PP
+\fB\-j\fR, \fB\-\-shell\-job\fR
+.RS 4
+Allow one to dump shell jobs\&. This implies the restored task will inherit session and process group ID from the criu itself\&. Also this option allows one to migrate a single external tty connection, in other words this option allows one to migrate such application as "top" and friends\&. If passed on
+\fBdump\fR
+it must be specified on
+\fBrestore\fR
+as well\&.
+.RE
+.PP
+\fB\-\-cpu\-cap\fR [,\fI<cap>\fR]
+.RS 4
+Specify
+\fIcap\fR
+CPU capability to be written into an image file\&. Basically if
+\fI<cap>\fR
+is one of
+\fBall\fR,
+\fBcpu\fR
+or
+\fBins\fR, then
+\fBcriu\fR
+writes CPU related information into image file\&. If the option is omitted or set to
+\fBnone\fR
+then image will not be written\&. By default
+\fBcriu\fR
+do not write this image\&.
+.RE
+.SS "restore"
+.sp
+Restores previously checkpointed processes\&.
+.PP
+\fB\-\-inherit\-fd\fR \fIfd[<num>]:<existing>\fR
+.RS 4
+Inherit file descriptors\&. This allows one to treat file descriptor
+\fI<num>\fR
+as being already opened via
+\fI<existing>\fR
+one and instead of trying to open we inherit it\&.
+.RE
+.PP
+\fB\-d\fR, \fB\-\-restore\-detached\fR
+.RS 4
+Detach
+\fBcriu\fR
+itself once restore is complete\&.
+.RE
+.PP
+\fB\-S\fR, \fB\-\-restore\-sibling\fR
+.RS 4
+Restore root task as a sibling (make sense with
+\fB\-\-restore\-detached\fR) only\&.
+.RE
+.PP
+\fB\-r\fR, \fB\-\-root\fR \fI<path>\fR
+.RS 4
+Change the root filesystem to <path> (when run in mount namespace)\&.
+.RE
+.PP
+\fB\-\-manage\-cgroups\fR [<mode>]
+.RS 4
+Restore cgroups configuration associated with a task from the image\&. Controllers are always restored in optimistic way \(em if already present in system
+\fBcriu\fR
+reuses it, otherwise it will be created\&.
+.sp
+The
+\fI<mode>\fR
+may be one of below\&.
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBnone\fR\&. Do not restore cgroup properties but require cgroup to pre\-exist at the moment of
+\fBrestore\fR
+procedure\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBprops\fR\&. Restore cgroup properties and require cgroup to pre\-exist\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBsoft\fR\&. Restore cgroup properties if only cgroup has been created by
+\fBcriu\fR, otherwise do not restore properies\&. This is the default if mode is unspecified\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBfull\fR\&. Always restore all cgroups and their properties\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBstrict\fR\&. Restore all cgroups and their properties from the scratch, requiring them to not present in the system\&.
+.RE
+.RE
+.PP
+\fB\-\-cgroup\-root\fR \fI[<controller>:]/<newroot>\fR
+.RS 4
+Change the root cgroup the controller will be installed into\&. No controller means that root is the default for all controllers not specified\&.
+.RE
+.PP
+\fB\-\-tcp\-established\fR
+.RS 4
+Restore previously dumped established TCP connections\&. This implies that the network has been locked between
+\fBdump\fR
+and
+\fBrestore\fR
+phases so other side of a connection simply notice a kind of lag\&.
+.RE
+.PP
+\fB\-\-veth\-pair\fR \fI<IN>\fR\fB=\fR\fI<OUT>\fR
+.RS 4
+Correspondence between outside and inside names of veth devices\&.
+.RE
+.PP
+\fB\-l\fR, \fB\-\-file\-locks\fR
+.RS 4
+Restore file locks from the image\&.
+.RE
+.PP
+\fB\-M\fR, \fB\-\-ext\-mount\-map\fR \fI<KEY>\fR\fB:\fR\fI<VAL>\fR
+.RS 4
+Setup mapping for external mounts\&.
+\fI<KEY>\fR
+is the value from the image (\fI<VAL>\fR
+from dump) and the
+\fI<VAL>\fR
+is the path on host that will be bind\-mounted into container (to the mountpoint path from image)\&.
+.RE
+.PP
+\fB\-\-ext\-mount\-map\fR \fBauto\fR
+.RS 4
+This is a special case\&. If this flag is passed, when an external mount is missing from the command line
+\fI\fB\-\-ext\-mount\-map\fR\fR\fI <KEY>:<VAL>\fR
+syntax, criu attempts to automatically resolve this mount from its namespace\&.
+.RE
+.PP
+\fB\-\-enable\-external\-sharing\fR, \fB\-\-enable\-external\-masters\fR
+.RS 4
+These flags enable external shared or slave mounts to be resolved automatically when
+\fI\fB\-\-ext\-mount\-map auto\fR\fR
+is passed\&.
+.RE
+.PP
+\fB\-\-auto\-dedup\fR
+.RS 4
+As soon as a page is restored it get punched out from image\&.
+.RE
+.PP
+\fB\-j\fR, \fB\-\-shell\-job\fR
+.RS 4
+Restore shell jobs, in other words inherit session and process group ID from the criu itself\&.
+.RE
+.PP
+\fB\-\-cpu\-cap\fR [\fI<cap>\fR,\fI<cap>\fR]
+.RS 4
+Specify
+\fI<cap>\fR
+CPU capability to be present on the CPU the process is restoring\&. To inverse capability prefix it with
+\fB^\fR\&. This option implies that
+\fB\-\-cpu\-cap\fR
+has been passed on
+\fBdump\fR
+as well, except
+\fBfpu\fR
+option case\&.
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBall\fR\&. Require all capabilities\&. This is
+\fBdefault\fR
+mode if
+\fB\-\-cpu\-cap\fR
+is passed without arguments\&. Most safe mode\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBcpu\fR\&. Require the CPU to have all capabilities in image to match runtime CPU\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBfpu\fR\&. Requre the CPU to have comaptible FPU\&. For example the process might be dumped with xsave capability but attempted to restore without it present on target CPU\&. In such case we refuse to procceed\&. This is
+\fBdefault\fR
+mode if
+\fB\-\-cpu\-cap\fR
+is not present in command line\&. Note this argument might be passed even if on the
+\fBdump\fR
+no
+\fB\-\-cpu\-cap\fR
+have been specified becase FPU frames are always encoded into images\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBins\fR\&. Require CPU compatibility on instructions level\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBnone\fR\&. Ignore capabilities\&. Most dangerous mode\&. The behaviour is implementation dependent\&. Try to not use it until really required\&.
+.sp
+One possible need of using this option is when
+\fB\-\-cpu\-cap\fR=\fBcpu\fR
+has been passed on
+\fBdump\fR
+then images are migrated to a less capable processor and one need to
+\fBrestore\fR
+this application, by default
+\fBcriu\fR
+will refuse to proceed without relaxing capability with
+\fB\-\-cpu\-cap\fR=\fBnone\fR
+parameter\&.
+.RE
+.RE
+.SS "check"
+.sp
+Checks whether the kernel supports the features that \fBcriu\fR needs to successfully dump and restore a process tree\&.
+.sp
+There are three categories of kernel support as described below\&. \fBcriu check\fR always checks Category 1 features unless \fB\-\-feature\fR is specified which only checks the specified feature\&.
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBCategory 1\fR\&. Absolutely required\&. These are features like
+\fI/proc/<pid>/map_files\fR,
+\fINETLINK_SOCK_DIAG\fR
+socket monitoring,
+\fI/proc/sys/kernel/ns_last_pid\fR, etc\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBCategory 2\fR\&. Required only for specific cases\&. These are features like aio remap,
+\fI/dev/net/tun\fR, etc\&. that are required if the process being dumped or restored is using them\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\fBCategory 3\fR\&. Experimental\&. These are features like task\-diag that are used for experimental purposes (mostly during development)\&.
+.RE
+.sp
+If there are no errors or warnings, \fBcriu\fR prints "Looks good\&." and its exit code will be 0\&.
+.sp
+A missing Category 1 feature causes \fBcriu\fR to print "Does not look good\&." and its exit code will be non\-zero\&.
+.sp
+Missing Category 2 and 3 features cause \fBcriu\fR to print "Looks good but some kernel features are missing which, depending on your process tree, may cause dump or restore failure\&." and its exit code will be non\-zero\&.
+.sp
+Without an argument, \fBcriu check\fR checks Category 1 features\&. This behavior can change with the following options:
+.PP
+\fB\-\-extra\fR
+.RS 4
+Check kernel support for Category 2 features\&.
+.RE
+.PP
+\fB\-\-experimental\fR
+.RS 4
+Check kernel support for Category 3 features\&.
+.RE
+.PP
+\fB\-\-all\fR
+.RS 4
+Check kernel support for Category 1, 2, and 3 features\&.
+.RE
+.PP
+\fB\-\-feature\fR \fI<name>\fR
+.RS 4
+Check a specific feature\&. If
+\fI<name>\fR
+is
+\fIlist\fR, a list of valid kernel feature names that can be checked will be printed\&.
+.RE
+.SS "page\-server"
+.sp
+Launches \fBcriu\fR in page server mode\&.
+.PP
+\fB\-\-daemon\fR
+.RS 4
+Runs page server as a daemon (background process)\&.
+.RE
+.PP
+\fB\-\-address\fR \fI<address>\fR
+.RS 4
+Page server IP address\&.
+.RE
+.PP
+\fB\-\-port\fR \fI<number>\fR
+.RS 4
+Page server port number\&.
+.RE
+.SS "exec"
+.sp
+Executes a system call inside a destination task\*(Aqs context\&.
+.SS "service"
+.sp
+Launches \fBcriu\fR in RPC daemon mode where \fBcriu\fR is listeninп for RPC commands over socket to perform\&. This is convenient for the case where daemon itself is running in a privilege (superuser) mode but clients are not\&.
+.SS "dedup"
+.sp
+Starts pagemap data deduplication procedure, where \fBcriu\fR scans over all pagemap files and tries to minimalize the number of pagemap entries by obtaining the references from a parent pagemap image\&.
+.SS "cpuinfo dump"
+.sp
+Fetches current CPU features and write them into an image file\&.
+.SS "cpuinfo check"
+.sp
+Fetches current CPU features (ie CPU the \fBcriu\fR is running on) and test if they are compatible with ones present in image file\&.
+.SH "SYSCALLS EXECUTION"
+.sp
+To run a system call in another task\*(Aqs context use
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    criu exec \-t pid syscall\-string
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+command\&. The \fIsyscall\-string\fR should look like
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    syscall\-name syscall\-arguments \&.\&.\&.
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+Each command line argument is transformed into the system call argument by the following rules:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+If one starts with
+\fB&\fR, the rest of it gets copied to the target task\*(Aqs address space and the respective syscall argument is the pointer to this string;
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+Otherwise it is treated as a number (converted with strtol) and is directly passed into the system call\&.
+.RE
+.SH "EXAMPLES"
+.sp
+To checkpoint a program with pid of \fB1234\fR and write all image files into directory \fBcheckpoint\fR:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    criu dump \-D checkpoint \-t 1234
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+To restore this program detaching criu itself:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    criu restore \-d \-D checkpoint
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+To close a file descriptor number \fB1\fR in task with pid \fB1234\fR:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    criu exec \-t 1234 close 1
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+To open a file named \fB/foo/bar\fR for read\-write in the task with pid \fB1234\fR:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+    criu exec \-t 1234 open \*(Aq&/foo/bar\*(Aq 2
+.fi
+.if n \{\
+.RE
+.\}
+.SH "AUTHOR"
+.sp
+OpenVZ team\&.
+.SH "COPYRIGHT"
+.sp
+Copyright (C) 2011\-2015, Parallels Inc\&.
diff --git a/SOURCES/ed8fecd12d7ce37d7ebdc35837e184caba7a14b4.patch b/SOURCES/ed8fecd12d7ce37d7ebdc35837e184caba7a14b4.patch
new file mode 100644
index 0000000..d0200e2
--- /dev/null
+++ b/SOURCES/ed8fecd12d7ce37d7ebdc35837e184caba7a14b4.patch
@@ -0,0 +1,105 @@
+From ed8fecd12d7ce37d7ebdc35837e184caba7a14b4 Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Mon, 20 Jun 2016 23:15:00 +0300
+Subject: [PATCH] criu: add RPC interface for skip in-flight connections
+
+For the previously added option to skip in-flight connections this adds
+that option to the RPC interface. The skip in-flight connections is also
+described in criu.txt.
+
+Signed-off-by: Adrian Reber <areber@redhat.com>
+Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
+---
+ Documentation/criu.txt |  7 +++++++
+ criu/cr-service.c      |  3 +++
+ images/rpc.proto       |  1 +
+ lib/c/criu.c           | 11 +++++++++++
+ lib/c/criu.h           |  2 ++
+ 5 files changed, 24 insertions(+)
+
+diff --git a/Documentation/criu.txt b/Documentation/criu.txt
+index 55f05c0..39a6685 100644
+--- a/Documentation/criu.txt
++++ b/Documentation/criu.txt
+@@ -199,6 +199,13 @@ Thus for command line argument the example above will look like:
+ *--tcp-established*::
+     Checkpoint established TCP connections.
+ 
++*--skip-in-flight*::
++    This option skips in-flight TCP connections. If TCP connections
++    are found which are not yet completely established, criu will
++    ignore these connections in favor of erroring out.
++    The TCP stack on the client side is expected to handle the
++    re-connect gracefully.
++
+ *--veth-pair* '<IN>'*=*'<OUT>'::
+     Correspondence between outside and inside names of veth devices.
+ 
+diff --git a/criu/cr-service.c b/criu/cr-service.c
+index 0dc9c0c..0672a83 100644
+--- a/criu/cr-service.c
++++ b/criu/cr-service.c
+@@ -322,6 +322,9 @@ static int setup_opts_from_req(int sk, CriuOpts *req)
+ 	if (req->has_tcp_established)
+ 		opts.tcp_established_ok = req->tcp_established;
+ 
++	if (req->has_tcp_skip_in_flight)
++		opts.tcp_skip_in_flight = req->tcp_skip_in_flight;
++
+ 	if (req->has_evasive_devices)
+ 		opts.evasive_devices = req->evasive_devices;
+ 
+diff --git a/images/rpc.proto b/images/rpc.proto
+index 1f74dcf..27583c1 100644
+--- a/images/rpc.proto
++++ b/images/rpc.proto
+@@ -104,6 +104,7 @@ message criu_opts {
+ 	repeated string			external	= 37;
+ 	optional uint32			empty_ns	= 38;
+ 	repeated join_namespace		join_ns		= 39;
++	optional bool			tcp_skip_in_flight	= 46;
+ }
+ 
+ message criu_dump_resp {
+diff --git a/lib/c/criu.c b/lib/c/criu.c
+index 05425a3..e75268c 100644
+--- a/lib/c/criu.c
++++ b/lib/c/criu.c
+@@ -309,6 +309,17 @@ void criu_set_tcp_established(bool tcp_established)
+ 	criu_local_set_tcp_established(global_opts, tcp_established);
+ }
+ 
++void criu_local_set_tcp_skip_in_flight(criu_opts *opts, bool tcp_skip_in_flight)
++{
++	opts->rpc->has_tcp_skip_in_flight	= true;
++	opts->rpc->tcp_skip_in_flight		= tcp_skip_in_flight;
++}
++
++void criu_set_tcp_skip_in_flight(bool tcp_skip_in_flight)
++{
++	criu_local_set_tcp_skip_in_flight(global_opts, tcp_skip_in_flight);
++}
++
+ void criu_local_set_evasive_devices(criu_opts *opts, bool evasive_devices)
+ {
+ 	opts->rpc->has_evasive_devices	= true;
+diff --git a/lib/c/criu.h b/lib/c/criu.h
+index 7ed1750..c28369f 100644
+--- a/lib/c/criu.h
++++ b/lib/c/criu.h
+@@ -65,6 +65,7 @@ void criu_set_leave_running(bool leave_running);
+ void criu_set_ext_unix_sk(bool ext_unix_sk);
+ int criu_add_unix_sk(unsigned int inode);
+ void criu_set_tcp_established(bool tcp_established);
++void criu_set_tcp_skip_in_flight(bool tcp_skip_in_flight);
+ void criu_set_evasive_devices(bool evasive_devices);
+ void criu_set_shell_job(bool shell_job);
+ void criu_set_file_locks(bool file_locks);
+@@ -169,6 +170,7 @@ void criu_local_set_leave_running(criu_opts *opts, bool leave_running);
+ void criu_local_set_ext_unix_sk(criu_opts *opts, bool ext_unix_sk);
+ int criu_local_add_unix_sk(criu_opts *opts, unsigned int inode);
+ void criu_local_set_tcp_established(criu_opts *opts, bool tcp_established);
++void criu_local_set_tcp_skip_in_flight(criu_opts *opts, bool tcp_skip_in_flight);
+ void criu_local_set_evasive_devices(criu_opts *opts, bool evasive_devices);
+ void criu_local_set_shell_job(criu_opts *opts, bool shell_job);
+ void criu_local_set_file_locks(criu_opts *opts, bool file_locks);
diff --git a/SOURCES/tech-preview-info-bz1243521.patch b/SOURCES/tech-preview-info-bz1243521.patch
deleted file mode 100644
index baaaefe..0000000
--- a/SOURCES/tech-preview-info-bz1243521.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- criu-1.6.1/crtools.c	2015-08-12 10:30:50.000000000 +0200
-+++ crtools.c	2015-08-28 15:22:08.231877095 +0200
-@@ -42,6 +42,8 @@
- 
- #include "setproctitle.h"
- 
-+#include<syslog.h>
-+
- struct cr_options opts;
- 
- void init_opts(void)
-@@ -524,6 +526,17 @@
- 	if (log_init(opts.output))
- 		return 1;
- 
-+	/*
-+	 * Mark criu as tech preview for RHEL7.2
-+	 */
-+	pr_msg("TECH PREVIEW: criu may not be fully supported.\n");
-+	pr_msg("Please review provided documentation for limitations.\n\n");
-+
-+	openlog("criu", LOG_PID, LOG_USER);
-+	syslog(LOG_NOTICE, "TECH PREVIEW: criu may not be fully supported.");
-+	syslog(LOG_NOTICE, "Please review provided documentation for limitations.");
-+	closelog();
-+
- 	if (!list_empty(&opts.inherit_fds)) {
- 		if (strcmp(argv[optind], "restore")) {
- 			pr_err("--inherit-fd is restore-only option\n");
diff --git a/SPECS/criu.spec b/SPECS/criu.spec
index 6d06261..fceff83 100644
--- a/SPECS/criu.spec
+++ b/SPECS/criu.spec
@@ -1,6 +1,6 @@
 Name: criu
-Version: 1.6.1
-Release: 3%{?dist}
+Version: 2.3
+Release: 2%{?dist}
 Provides: crtools = %{version}-%{release}
 Obsoletes: crtools <= 1.0-2
 Summary: Tool for Checkpoint/Restore in User-space
@@ -11,18 +11,18 @@ Source0: http://download.openvz.org/criu/criu-%{version}.tar.bz2
 # The patch aio-fix.patch is needed as RHEL7
 # doesn't do "nr_events *= 2" in ioctx_alloc().
 Patch0: aio-fix.patch
-# This patch fixes criu check to correctly detect if
-# the kernel supports all required clone arguments.
-Patch1: criu-check-for-CLONE_NEWUSER-CLONE_NEWPID.patch
-# This patches prints to the console and syslog
-# that criu is still a tech preview and unsupported.
-# https://bugzilla.redhat.com/show_bug.cgi?id=1243521
-Patch2: tech-preview-info-bz1243521.patch
-Patch3: 98c8e44f749dd7ed0aa8c540f566bda54d7adfa1.patch
+Patch1: https://github.com/xemul/criu/commit/2fdef836a59938b169ca3c8f2c813b35258f1ed5.patch
+Patch2: https://github.com/xemul/criu/commit/ed8fecd12d7ce37d7ebdc35837e184caba7a14b4.patch
 
 BuildRequires: systemd
 
-BuildRequires: protobuf-devel protobuf-c-devel python2-devel
+%if 0%{?rhel}
+# RHEL has no asciidoc; take man-page from Fedora 24
+# zcat /usr/share/man/man8/criu.8.gz > criu.8
+Source1: criu.8
+%endif
+
+BuildRequires: protobuf-devel protobuf-c-devel python2-devel libnl3-devel libcap-devel
 %if 0%{?fedora}
 BuildRequires: asciidoc xmlto
 %endif
@@ -31,7 +31,11 @@ BuildRequires: asciidoc xmlto
 # code is very architecture specific
 # once imported in RCS it needs a bug openend explaining the ExclusiveArch
 # https://bugzilla.redhat.com/show_bug.cgi?id=902875
-ExclusiveArch: x86_64 %{arm}
+%if 0%{?fedora}
+ExclusiveArch: x86_64 %{arm} ppc64le aarch64
+%else
+ExclusiveArch: x86_64 ppc64le
+%endif
 
 %description
 criu is the user-space part of Checkpoint/Restore in User-space
@@ -70,7 +74,6 @@ their content in human-readable form.
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
-%patch3 -p1
 
 %build
 # %{?_smp_mflags} does not work
@@ -82,40 +85,30 @@ make docs V=1
 
 
 %install
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
-%if 0%{?rhel}
-# disable documentation as it requires asciidoc (which is not available on RHEL7)
-sed -i -e 's,$(CRIU-LIB) install-man,$(CRIU-LIB),g' Makefile
+make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+%if 0%{?fedora}
+# ony install documentation on Fedora as it requires asciidoc,
+# which is not available on RHEL7
+make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+%else
+install -p -m 644  -D %{SOURCE1} $RPM_BUILD_ROOT%{_mandir}/man8/%{name}.8
 %endif
-make install DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} LOGROTATEDIR=%{_sysconfdir}/logrotate.d
 
 %if 0%{?rhel}
-# remove criu daemon related files
-rm $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/criu-service
-rm $RPM_BUILD_ROOT%{_unitdir}/criu.service
-rm $RPM_BUILD_ROOT%{_unitdir}/criu.socket
 # remove devel package
 rm -rf $RPM_BUILD_ROOT%{_includedir}/criu
 rm $RPM_BUILD_ROOT%{_libdir}/*.so*
 rm -rf $RPM_BUILD_ROOT%{_libdir}/pkgconfig
 %endif
 
-%if 0%{?fedora}
-# upstream renamed to binary to criu
-ln -s %{_sbindir}/criu $RPM_BUILD_ROOT%{_sbindir}/crtools
-%endif
-
 %post -p /sbin/ldconfig
 %postun -p /sbin/ldconfig
 
 %files
 %{_sbindir}/%{name}
-%if 0%{?fedora}
-%{_sbindir}/crtools
 %doc %{_mandir}/man8/criu.8*
-%{_unitdir}/criu.service
-%{_unitdir}/criu.socket
-%{_sysconfdir}/logrotate.d/%{name}-service
+%if 0%{?fedora}
 %{_libdir}/*.so.*
 %endif
 %doc README.md COPYING
@@ -136,6 +129,43 @@ ln -s %{_sbindir}/criu $RPM_BUILD_ROOT%{_sbindir}/crtools
 
 
 %changelog
+* Tue Jun 14 2016 Adrian Reber <areber@redhat.com> - 2.3-2
+- Added patches to handle in-flight TCP connections
+
+* Tue Jun 14 2016 Adrian Reber <areber@redhat.com> - 2.3-1
+- Update to 2.3
+- Copy man-page from Fedora 24 for RHEL
+
+* Mon May 23 2016 Adrian Reber <adrian@lisas.de> - 2.2-1
+- Update to 2.2
+
+* Tue Apr 12 2016 Adrian Reber <adrian@lisas.de> - 2.1-2
+- Remove crtools symbolic link
+
+* Mon Apr 11 2016 Adrian Reber <adrian@lisas.de> - 2.1-1
+- Update to 2.1
+
+* Fri Apr 08 2016 Adrian Reber <areber@redhat.com> - 2.0-3
+- Exclude arm and aarch64 from build
+
+* Wed Apr 06 2016 Adrian Reber <areber@redhat.com> - 2.0-2
+- Merge changes from Fedora
+
+* Thu Mar 10 2016 Andrey Vagin <avagin@openvz.org> - 2.0-1
+- Update to 2.0
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Mon Dec 07 2015 Adrian Reber <adrian@lisas.de> - 1.8-1
+- Update to 1.8
+
+* Mon Nov 02 2015 Adrian Reber <adrian@lisas.de> - 1.7.2-1
+- Update to 1.7.2
+
+* Mon Sep 7 2015 Andrey Vagin <avagin@openvz.org> - 1.7-1
+- Update to 1.7
+
 * Mon Aug 31 2015 Adrian Reber <areber@redhat.com> - 1.6.1-3
 - added patch to fix broken docker checkpoint/restore (#1258539)