add drone pipeline

Reset Extendend Length flag when encoding BGP attributes
Bump version in build script
2021-12-30 13:19:02 +00:00 · 2021-03-27 14:29:55 +00:00 · 2021-03-22 09:09:19 +00:00 · 2021-03-22 09:05:39 +00:00 · 2021-03-22 09:03:24 +00:00 · 2021-03-22 09:03:24 +00:00
216 changed files with 19200 additions and 7845 deletions
--- a/.dir-locals.el
+++ b/.dir-locals.el
@ -0,0 +1,7 @@
+; BIRD project coding conventions
+
+((c-mode
+  (c-file-style . "bsd")
+  (c-basic-offset . 2)
+  (fill-column . 80)
+  (show-trailing-whitespace . t)))
--- a/.drone.yml
+++ b/.drone.yml
@ -0,0 +1,57 @@
+---
+kind: pipeline
+type: docker
+name: deploy
+
+steps:
+
+ - name: build alpine
+   image: c8n.io/simonburblecom/bird-build:alpine
+   commands:
+    - /build.sh
+
+ - name: build ubuntu
+   image: c8n.io/simonburblecom/bird-build:ubuntu
+   commands:
+    - /build.sh
+
+ - name: upload
+   image: plugins/s3
+   settings:
+     bucket: artifacts
+     access_key:
+       from_secret: MINIO_ACCESS_KEY
+     secret_key:
+       from_secret: MINIO_SECRET_KEY
+     endpoint: https://minio.burble.dn42
+     region: uk-lon3
+     path_style: true
+     source: artifacts/**/*
+     strip_prefix: artifacts/
+     target: /bird/${DRONE_BRANCH}
+
+
+image_pull_secrets:
+ - CONFIG_JSON
+
+---
+kind: secret
+name: CONFIG_JSON
+get:  
+  path: burble.dn42/kv/data/drone/docker
+  name: configjson
+
+---
+kind: secret
+name: MINIO_ACCESS_KEY
+get:
+  path: burble.dn42/kv/data/drone/minio
+  name: ACCESS_KEY
+
+---
+kind: secret
+name: MINIO_SECRET_KEY
+get:
+  path: burble.dn42/kv/data/drone/minio
+  name: SECRET_KEY
+
--- a/.gitignore
+++ b/.gitignore
@ -1,5 +1,4 @@
 /autom4te.cache/
-/doc/*.html
 /obj/
 /Makefile
 /bird
@ -12,3 +11,4 @@
 /configure
 /sysdep/autoconf.h.in
 /sysdep/autoconf.h.in~
+/cscope.*
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -4,10 +4,12 @@ variables:
  GIT_STRATEGY: fetch
  DOCKER_CMD: docker --config="$HOME/.docker/$CI_JOB_ID/"
  IMG_BASE: registry.labs.nic.cz/labs/bird
+  TOOLS_DIR: /var/lib/gitlab-runner/bird-tools

 stages:
  - image
  - build
+  - test

 .docker: &docker_build
  stage: image
@ -34,36 +36,46 @@ docker_debian-7-amd64:
    IMG_NAME: "debian-7-amd64"
  <<: *docker_build

-docker_debian-8-amd64:
-  variables:
-    IMG_NAME: "debian-8-amd64"
-  <<: *docker_build
-
-docker_debian-9-amd64:
-  variables:
-    IMG_NAME: "debian-9-amd64"
-  <<: *docker_build
-
-docker_debian-testing-amd64:
-  variables:
-    IMG_NAME: "debian-testing-amd64"
-  <<: *docker_build
-
 docker_debian-7-i386:
  variables:
    IMG_NAME: "debian-7-i386"
  <<: *docker_build

+docker_debian-8-amd64:
+  variables:
+    IMG_NAME: "debian-8-amd64"
+  <<: *docker_build
+
 docker_debian-8-i386:
  variables:
    IMG_NAME: "debian-8-i386"
  <<: *docker_build

+docker_debian-9-amd64:
+  variables:
+    IMG_NAME: "debian-9-amd64"
+  <<: *docker_build
+
 docker_debian-9-i386:
  variables:
    IMG_NAME: "debian-9-i386"
  <<: *docker_build

+docker_debian-10-amd64:
+  variables:
+    IMG_NAME: "debian-10-amd64"
+  <<: *docker_build
+
+docker_debian-10-i386:
+  variables:
+    IMG_NAME: "debian-10-i386"
+  <<: *docker_build
+
+docker_debian-testing-amd64:
+  variables:
+    IMG_NAME: "debian-testing-amd64"
+  <<: *docker_build
+
 docker_debian-testing-i386:
  variables:
    IMG_NAME: "debian-testing-i386"
@ -79,9 +91,29 @@ docker_fedora-26-amd64:
    IMG_NAME: "fedora-26-amd64"
  <<: *docker_build

-docker_centos-6-amd64:
+docker_fedora-27-amd64:
  variables:
-    IMG_NAME: "centos-6-amd64"
+    IMG_NAME: "fedora-27-amd64"
+  <<: *docker_build
+
+docker_fedora-28-amd64:
+  variables:
+    IMG_NAME: "fedora-28-amd64"
+  <<: *docker_build
+
+docker_fedora-29-amd64:
+  variables:
+    IMG_NAME: "fedora-29-amd64"
+  <<: *docker_build
+
+docker_fedora-30-amd64:
+  variables:
+    IMG_NAME: "fedora-30-amd64"
+  <<: *docker_build
+
+docker_fedora-31-amd64:
+  variables:
+    IMG_NAME: "fedora-31-amd64"
  <<: *docker_build

 docker_centos-7-amd64:
@ -89,127 +121,43 @@ docker_centos-7-amd64:
    IMG_NAME: "centos-7-amd64"
  <<: *docker_build

-docker_opensuse-42_3-amd64:
+docker_centos-8-amd64:
  variables:
-    IMG_NAME: "opensuse-42.3-amd64"
+    IMG_NAME: "centos-8-amd64"
  <<: *docker_build

 docker_ubuntu-14_04-amd64:
  variables:
    IMG_NAME: "ubuntu-14.04-amd64"
  <<: *docker_build
-
+ 
 docker_ubuntu-16_04-amd64:
  variables:
    IMG_NAME: "ubuntu-16.04-amd64"
  <<: *docker_build
+ 
+docker_ubuntu-18_04-amd64:
+  variables:
+    IMG_NAME: "ubuntu-18.04-amd64"
+  <<: *docker_build
+ 
+docker_ubuntu-19_10-amd64:
+  variables:
+    IMG_NAME: "ubuntu-19.10-amd64"
+  <<: *docker_build

-.debian-7-i386: &debian-7-i386_env
-  image: registry.labs.nic.cz/labs/bird:debian-7-i386
-  tags:
-  - docker
-  - linux
-  - amd64
+docker_opensuse-15.0-amd64:
+  variables:
+    IMG_NAME: "opensuse-15.0-amd64"
+  <<: *docker_build

-.debian-8-i386: &debian-8-i386_env
-  image: registry.labs.nic.cz/labs/bird:debian-8-i386
-  tags:
-  - docker
-  - linux
-  - amd64
+docker_opensuse-15.1-amd64:
+  variables:
+    IMG_NAME: "opensuse-15.1-amd64"
+  <<: *docker_build

-.debian-9-i386: &debian-9-i386_env
-  image: registry.labs.nic.cz/labs/bird:debian-9-i386
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.debian-testing-i386: &debian-testing-i386_env
-  image: registry.labs.nic.cz/labs/bird:debian-testing-i386
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.debian-7-amd64: &debian-7-amd64_env
-  image: registry.labs.nic.cz/labs/bird:debian-7-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.debian-8-amd64: &debian-8-amd64_env
-  image: registry.labs.nic.cz/labs/bird:debian-8-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.debian-9-amd64: &debian-9-amd64_env
-  image: registry.labs.nic.cz/labs/bird:debian-9-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.debian-testing-amd64: &debian-testing-amd64_env
-  image: registry.labs.nic.cz/labs/bird:debian-testing-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.fedora-25-amd64: &fedora-25-amd64_env
-  image: registry.labs.nic.cz/labs/bird:fedora-25-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.fedora-26-amd64: &fedora-26-amd64_env
-  image: registry.labs.nic.cz/labs/bird:fedora-26-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.centos-6-amd64: &centos-6-amd64_env
-  image: registry.labs.nic.cz/labs/bird:centos-6-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.centos-7-amd64: &centos-7-amd64_env
-  image: registry.labs.nic.cz/labs/bird:centos-7-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.opensuse-42_3-amd64: &opensuse-42_3-amd64_env
-  image: registry.labs.nic.cz/labs/bird:opensuse-42.3-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.ubuntu-14_04-amd64: &ubuntu-14_04-amd64_env
-  image: registry.labs.nic.cz/labs/bird:ubuntu-14.04-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-.ubuntu-16_04-amd64: &ubuntu-16_04-amd64_env
-  image: registry.labs.nic.cz/labs/bird:ubuntu-16.04-amd64
-  tags:
-  - docker
-  - linux
-  - amd64
-
-# TODO We want to copy these BSDs to our own virtual machines, to make sure someone doesn't update them by accident.
+# TODO We want to copy these BSDs to our own virtual machines, to make sure
+# someone doesn't update them by accident.
 .freebsd-11-i386: &freebsd-11-i386_env
  tags:
  - freebsd
@ -223,12 +171,8 @@ docker_ubuntu-16_04-amd64:
  tags:
  - freebsd
  - amd64
-  #only:
-  #- master
-  #- triggers
-  #- tags

-.build: &build_job
+.build: &build-base
  stage: build
  script:
  - autoreconf
@ -240,70 +184,232 @@ docker_ubuntu-16_04-amd64:
  # Run tests if they are available
  - $MAKE check

+.build-linux: &build-linux
+  <<: *build-base
+  tags:
+    - docker
+    - linux
+    - amd64
+
 build-debian-7-amd64:
-  <<: *debian-7-amd64_env
-  <<: *build_job
-
-build-debian-8-amd64:
-  <<: *debian-8-amd64_env
-  <<: *build_job
-
-build-debian-9-amd64:
-  <<: *debian-9-amd64_env
-  <<: *build_job
-
-build-debian-testing-amd64:
-  <<: *debian-testing-amd64_env
-  <<: *build_job
-
-build-fedora-25-amd64:
-  <<: *fedora-25-amd64_env
-  <<: *build_job
-
-build-fedora-26-amd64:
-  <<: *fedora-26-amd64_env
-  <<: *build_job
-
-build-centos-6-amd64:
-  <<: *centos-6-amd64_env
-  <<: *build_job
-
-build-centos-7-amd64:
-  <<: *centos-7-amd64_env
-  <<: *build_job
-
-build-opensuse-42_3-amd64:
-  <<: *opensuse-42_3-amd64_env
-  <<: *build_job
-
-build-ubuntu-14_04-amd64:
-  <<: *ubuntu-14_04-amd64_env
-  <<: *build_job
-
-build-ubuntu-16_04-amd64:
-  <<: *ubuntu-16_04-amd64_env
-  <<: *build_job
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-7-amd64

 build-debian-7-i386:
-  <<: *debian-7-i386_env
-  <<: *build_job
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-7-i386
+
+build-debian-8-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-8-amd64

 build-debian-8-i386:
-  <<: *debian-8-i386_env
-  <<: *build_job
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-8-i386
+
+build-debian-9-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-9-amd64

 build-debian-9-i386:
-  <<: *debian-9-i386_env
-  <<: *build_job
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-9-i386
+
+build-debian-10-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-10-amd64
+
+build-debian-10-i386:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-10-i386
+
+build-debian-testing-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-testing-amd64

 build-debian-testing-i386:
-  <<: *debian-testing-i386_env
-  <<: *build_job
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:debian-testing-i386
+
+build-fedora-25-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-25-amd64
+
+build-fedora-26-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-26-amd64
+
+build-fedora-27-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-27-amd64
+
+build-fedora-28-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-28-amd64
+
+build-fedora-29-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-29-amd64
+
+build-fedora-30-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-30-amd64
+
+build-fedora-31-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:fedora-31-amd64
+
+build-centos-7-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:centos-7-amd64
+
+build-centos-8-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:centos-8-amd64
+
+build-ubuntu-14_04-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:ubuntu-14.04-amd64
+
+build-ubuntu-16_04-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:ubuntu-16.04-amd64
+
+build-ubuntu-18_04-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:ubuntu-18.04-amd64
+
+build-ubuntu-19_04-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:ubuntu-19.04-amd64
+
+build-opensuse-15.0-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:opensuse-15.0-amd64
+
+build-opensuse-15.1-amd64:
+  <<: *build-linux
+  image: registry.labs.nic.cz/labs/bird:opensuse-15.1-amd64

 build-freebsd-11-amd64:
-  <<: *freebsd-11-amd64_env
-  <<: *build_job
+  <<: *build-base
+  tags:
+    - freebsd
+    - amd64

 build-freebsd-11-i386:
-  <<: *freebsd-11-i386_env
-  <<: *build_job
+  <<: *build-base
+  tags:
+    - freebsd
+    - i386
+
+build-birdlab:
+  stage: build
+  tags:
+    - birdlab
+    - amd64
+  script:
+    - DIR=$(pwd)
+    - autoreconf
+    - ./configure
+    - make
+    - cd $TOOLS_DIR
+    - sudo git clean -fx
+    - git pull --ff-only
+    - mv $DIR/bird $DIR/birdc netlab/common
+
+.test: &test-base
+  stage: test
+  needs: [build-birdlab]
+  tags:
+    - birdlab
+    - amd64
+  script:
+    - cd $TOOLS_DIR/netlab
+    - sudo ./stop
+    - sudo ./runtest -m check $TEST_NAME
+
+test-ospf-base:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-base
+
+test-ospf-default:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-default
+
+test-ospf-priority:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-priority
+
+test-ospf-nbma:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-nbma
+
+test-ospf-ptmp:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-ptmp
+
+test-ospf-authentication:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-authentication
+
+test-ospf-bfd:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-bfd
+
+test-ospf-custom:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-custom
+
+test-ospf-vrf:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ospf-vrf
+
+test-bgp-base:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-bgp-base
+
+test-bgp-auth:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-bgp-auth
+
+test-bgp-int:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-bgp-int
+
+test-bgp-merged:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-bgp-merged
+
+test-ebgp-loop:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ebgp-loop
+
+test-ebgp-star:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ebgp-star
+
+test-ibgp-loop:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ibgp-loop
+
+test-ibgp-star:
+  <<: *test-base
+  variables:
+    TEST_NAME: cf-ibgp-flat
--- a/9
+++ b/9
@ -7,13 +7,15 @@ $ make

 Default location for configuration file is /usr/local/etc/bird.conf and
 for control socket is /usr/local/var/run/bird.ctl . You can change that
-by --sysconfdir and --localstatedir configure options.
+by --prefix, --sysconfdir and --runstatedir configure options, e.g.:
+
+$ ./configure --prefix=/usr --sysconfdir=/etc --runstatedir=/run

 To compile current development BIRD source code from Git repository, you
 also need Git (to download the source code) and Autoconf (to generate
 the configure script and associated files using 'autoreconf' tool):

-$ git clone git://git.nic.cz/bird.git
+$ git clone https://gitlab.labs.nic.cz/labs/bird/
 $ cd bird
 $ autoreconf

@ -32,7 +34,8 @@ For compiling BIRD you need these programs and libraries:
 - Flex

 - ncurses library
- - GNU Readline library (2.1 or newer)
+ - GNU Readline library
+ - libssh library (optional, for RPKI-Router protocol)

 For compiling BIRD documentation you also need:

--- a/Makefile.in
+++ b/Makefile.in
@ -9,6 +9,8 @@ MAKEFLAGS += -r
 CPPFLAGS=-I$(objdir) -I$(srcdir) @CPPFLAGS@
 CFLAGS=$(CPPFLAGS) @CFLAGS@
 LDFLAGS=@LDFLAGS@
+M4FLAGS=@M4FLAGS@
+BISONFLAGS=@BISONFLAGS@
 LIBS=@LIBS@
 DAEMON_LIBS=@DAEMON_LIBS@
 CLIENT_LIBS=@CLIENT_LIBS@
@ -21,11 +23,6 @@ INSTALL=@INSTALL@
 INSTALL_PROGRAM=@INSTALL_PROGRAM@
 INSTALL_DATA=@INSTALL_DATA@

-git-label:=$(strip $(shell git describe --always --dirty=-x 2>/dev/null))
-ifneq ($(git-label),)
-        CFLAGS += -DGIT_LABEL="$(git-label)"
-endif
-
 client=$(addprefix $(exedir)/,@CLIENT@)
 daemon=$(exedir)/bird
 protocols=@protocols@
@ -36,12 +33,18 @@ bindir=@bindir@
 sbindir=@sbindir@
 sysconfdir=@sysconfdir@
 localstatedir=@localstatedir@
+runstatedir=@runstatedir@
 docdir=@prefix@/doc

 srcdir := @srcdir@
 objdir := @objdir@
 exedir := @exedir@

+git-label:=$(strip $(shell cd $(srcdir) && [ "$$(git rev-parse --show-toplevel)" = "$$(readlink -f .)" ] && git describe --always --dirty=-x 2>/dev/null))
+ifneq ($(git-label),)
+        CFLAGS += -DGIT_LABEL="$(git-label)"
+endif
+
 ifeq ($(objdir),.)
  objdir := $(realpath .)
 endif
@ -54,11 +57,16 @@ else
  Q:=
 endif

+ifneq ($(COLOR),)
+  CFLAGS += -fdiagnostics-color=always
+endif
+
 # Meta rules
 docgoals := docs userdocs progdocs
 testgoals := check test tests tests_run
 cleangoals := clean distclean testsclean
-.PHONY: all daemon cli $(docgoals) $(testgoals) $(cleangoals) tags
+.PHONY: all daemon cli $(docgoals) $(testgoals) $(cleangoals) tags cscope prepare
+
 all: daemon cli

 daemon: $(daemon)
@ -69,6 +77,8 @@ $(daemon): LIBS += $(DAEMON_LIBS)
 # Include directories
 dirs := client conf doc filter lib nest test $(addprefix proto/,$(protocols)) @sysdep_dirs@

+# conf/Makefile declarations needed for all other modules
+conf-lex-targets := $(addprefix $(objdir)/conf/,cf-lex.o)
 conf-y-targets := $(addprefix $(objdir)/conf/,cf-parse.y keywords.h commands.h)
 cf-local = $(conf-y-targets): $(s)config.Y

@ -92,30 +102,55 @@ endef

 clean = $(eval $(call clean_in,$(1)))

+# Include main Makefiles of the directories
 include $(addsuffix /Makefile,$(addprefix $(srcdir)/,$(dirs)))

 # Generic rules
-
-$(objdir)/%.o: $(srcdir)/%.c $(objdir)/.dir-stamp $(objdir)/sysdep/paths.h
+# Object file rules
+$(objdir)/%.o: $(srcdir)/%.c | prepare
 	$(E)echo CC -o $@ -c $<
 	$(Q)$(CC) $(CFLAGS) -MMD -MP -o $@ -c $<

-$(objdir)/%.o: $(objdir)/%.c $(objdir)/.dir-stamp $(objdir)/sysdep/paths.h
+$(objdir)/%.o: $(objdir)/%.c | prepare
 	$(E)echo CC -o $@ -c $<
 	$(Q)$(CC) $(CFLAGS) -MMD -MP -o $@ -c $<

+# Debug: Preprocessed source rules
+$(objdir)/%.E: $(srcdir)/%.c | prepare
+	$(E)echo CC -o $@ -E $<
+	$(Q)$(CC) $(CFLAGS) -MMD -MP -o $@ -E $<

-$(objdir)/%.S: $(srcdir)/%.c $(objdir)/.dir-stamp $(objdir)/sysdep/paths.h
+$(objdir)/%.E: $(objdir)/%.c | prepare
+	$(E)echo CC -o $@ -E $<
+	$(Q)$(CC) $(CFLAGS) -MMD -MP -o $@ -E $<
+
+# Debug: Assembler object rules
+$(objdir)/%.S: $(srcdir)/%.c | prepare
 	$(E)echo CC -o $@ -S $<
 	$(Q)$(CC) $(CFLAGS) -MMD -MP -o $@ -S $<

-$(objdir)/%.S: $(objdir)/%.c $(objdir)/.dir-stamp $(objdir)/sysdep/paths.h
+$(objdir)/%.S: $(objdir)/%.c | prepare
 	$(E)echo CC -o $@ -S $<
 	$(Q)$(CC) $(CFLAGS) -MMD -MP -o $@ -S $<

+# Finally include the computed dependencies:
+DEPS = $(shell find $(objdir) -name '*.d')

+# ## if there is at least one non-clean goal
+ifneq ($(filter-out $(cleangoals),$(MAKECMDGOALS)),)
+-include $(DEPS)
+endif

-$(objdir)/.dir-stamp:
+# ## if the implicit goal is called
+ifeq ($(MAKECMDGOALS),)
+-include $(DEPS)
+endif
+
+# Rule for pre-generating all generated includables
+# before compiling any C file
+prepare: $(objdir)/sysdep/paths.h | $(objdir)/.dir-stamp
+
+$(objdir)/.dir-stamp: Makefile
 	$(E)echo MKDIR -p $(addprefix $(objdir)/,$(dirs) doc)
 	$(Q)mkdir -p $(addprefix $(objdir)/,$(dirs) doc)
 	$(Q)touch $@
@ -134,7 +169,7 @@ $(objdir)/sysdep/paths.h: Makefile

 tests_targets_ok = $(addsuffix .ok,$(tests_targets))

-$(tests_targets): %: %.o $(tests_objs)
+$(tests_targets): %: %.o $(tests_objs) | prepare
 	$(E)echo LD $(LDFLAGS) -o $@ $< "..." $(LIBS)
 	$(Q)$(CC) $(LDFLAGS) -o $@ $^ $(LIBS)

@ -149,28 +184,28 @@ check: tests tests_run
 tests: $(tests_targets)
 tests_run: $(tests_targets_ok)

-# Finally include the computed dependencies
+STATIC_CHECKERS_ENABLE := nullability.NullableDereferenced nullability.NullablePassedToNonnull nullability.NullableReturnedFromNonnull optin.portability.UnixAPI valist.CopyToSelf valist.Uninitialized valist.Unterminated
+STATIC_CHECKERS_DISABLE := deadcode.DeadStores
+STATIC_SCAN_FLAGS := -o $(objdir)/static-scan/ $(addprefix -enable-checker ,$(STATIC_CHECKERS_ENABLE)) $(addprefix -disable-checker ,$(STATIC_CHECKERS_DISABLE))

-ifneq ($(filter-out $(cleangoals),$(MAKECMDGOALS)),)
-include $(shell find $(objdir) -name "*.d")
-endif
-
-ifeq ($(MAKECMDGOALS),)
-include $(shell find $(objdir) -name "*.d")
-endif
+static-scan:
+	$(E)echo Running static code analysis
+	$(Q)$(MAKE) clean
+	$(Q)scan-build $(STATIC_SCAN_FLAGS) $(MAKE) -$(MAKEFLAGS)

 tags:
-	cd $(srcdir) ; etags -lc `find $(dirs) -name *.[chY]`
+	cd $(srcdir) ; etags -lc `find $(dirs) -name '*.[chY]'`
+
+cscope:
+	cd $(srcdir) ; find $(dirs) -name '*.[chY]' > cscope.files ; cscope -b

 # Install

 install: all
-	$(INSTALL) -d $(DESTDIR)/$(sbindir) $(DESTDIR)/$(sysconfdir) $(DESTDIR)/@runtimedir@
-	$(INSTALL_PROGRAM) $(exedir)/bird $(DESTDIR)/$(sbindir)/bird
-	$(INSTALL_PROGRAM) $(exedir)/birdcl $(DESTDIR)/$(sbindir)/birdcl
-	if test -n "@CLIENT@" ; then								\
-		$(INSTALL_PROGRAM) $(exedir)/birdc $(DESTDIR)/$(sbindir)/birdc ;		\
-	fi
+	$(INSTALL) -d $(DESTDIR)/$(sbindir) $(DESTDIR)/$(sysconfdir) $(DESTDIR)/$(runstatedir)
+	for BIN in bird @CLIENT@ ; do								\
+		$(INSTALL_PROGRAM) $(exedir)/$$BIN $(DESTDIR)/$(sbindir)/$$BIN ;		\
+	done
 	if ! test -f $(DESTDIR)/@CONFIG_FILE@ ; then						\
 		$(INSTALL_DATA) $(srcdir)/doc/bird.conf.example $(DESTDIR)/@CONFIG_FILE@ ;	\
 	else											\
--- a/132
+++ b/132
@ -1,3 +1,135 @@
+Version 2.0.8 (2021-03-18)
+  o Automatic channel reloads based on RPKI changes
+  o Multiple static routes with the same network
+  o Use bitmaps to keep track of exported routes
+  o Per-channel debug flags
+  o CLI commands show info from multiple protocols
+  o Linux: IPv4 routes with IPv6 nexthops
+  o Filter: Optimized redesign of prefix sets
+  o Filter: Improved type checking of user filters
+  o Filter: New src/dst accessors for Flowspec and SADR
+  o Filter: New 'weight' route attribute
+  o Filter: BGP path mask loop operator
+  o Filter: Remove quitbird command
+  o RIP: Demand circuit support (RFC 2091)
+  o BGP: New 'allow as sets' and 'enforce first as' options
+  o BGP: Support for BGP hostname capability
+  o BGP: Support for MD5SIG with dynamic BGP
+  o BFD: Optional separation of IPv4 / IPv6 BFD instances
+  o BFD: Per-peer session options
+  o RPKI: Allow build without libSSH
+  o RPKI: New 'ignore max length' option
+  o OSPF: Redesign of handling of unnumbered PtPs
+  o OSPF: Allow key id 0 in authentication
+  o Babel: Use onlink flag for routes with unreachable next hop
+  o Many bugfixes
+
+  Notes:
+
+  Automatic channel reloads based on RPKI changes are enabled by default,
+  but require import table enabled when used in BGP import filter.
+
+  BIRD now uses bitmaps to keep track of exported routes instead of
+  re-evaluation of export filters. That should improve speed and accuracy in
+  route export handling during reconfiguration, but takes some more memory.
+
+  Per-channel debug logging and some CLI commands (like 'show ospf neighbors')
+  defaulting to all protocol instances lead to some minor changes in log and
+  CLI output. Caution is recommended when logs or CLI output are monitored by
+  scripts.
+
+
+Version 2.0.7 (2019-10-11)
+  o BGP: Accumulated IGP metric (RFC 7311)
+  o Important filter reconfiguration bugfix
+  o Several other bugfixes
+
+Version 2.0.6 (2019-09-10)
+  o RAdv: Solicited unicast RAs
+  o BGP: Optional Adj-RIB-Out
+  o BGP: Extended optional parameters length
+  o Filter: Sets and set expressions in path masks
+  o Several important bugfixes
+
+Version 2.0.5 (2019-08-01)
+  o OSPF Graceful restart (RFC 3623, RFC 5187)
+  o BGP: Dynamic BGP
+  o BGP: Promiscuous ASN mode
+  o BGP: Mandatory option for channels
+  o BFD: Support for VRFs
+  o Graceful restart command
+  o Redesigned filtering code
+  o Many bugfixes
+
+  Notes:
+
+  Previous version introduced an error in handling of OSPF NSSA-LSA, causing
+  compatibility issues with proper implementations. The error is fixed in this
+  version, therefore there are compatibility issues in OSPF NSSA areas between
+  this and previous version.
+
+
+Version 2.0.4 (2019-02-27)
+  o OSPF: Opaque LSAs (RFC 5250)
+  o OSPF: DN-bit handling (RFC 4576)
+  o Preferred route counters are back
+  o Important BGP bugfix
+  o Several bugfixes related to route propagation
+  o some minor bugfixes
+
+Version 2.0.3 (2019-01-05)
+  o MRT table dumps (RFC 6396)
+  o BGP Long-lived graceful restart
+  o BGP: Optional import table (Adj-RIB-In)
+  o BGP: Extend 'next hop keep' and 'next hop self' options
+  o BGP: Improved VRF support
+  o OSPF: Authentication trailer for OSPFv3 (RFC 7166)
+  o Babel: New option to randomize router ID
+  o Filter: Custom route attributes
+  o Filter: Support for src accessor to SADR source prefix
+  o Filter: Support for VPN_RD sets
+  o Filter: Make ifname attribute modifiable
+  o Perf: Protocol to measure BIRD performance internally
+  o More verbose error messages in config processing
+  o Log file size limit / log rotation
+  o Many bugfixes
+
+  Notes:
+
+  Export of routes to RS EBGP (route server) sessions from other sources than
+  RS EBGP sessions was changed that ASN is no longer prepended to BGP_PATH in
+  that case. The change does not affect regular BGP configurations or regular
+  route servers that have only RS EBGP peers.
+
+  For BGP route servers and route reflectors, the default value of option
+  'next hop keep' was changed to a more appropriate value.
+
+  Attributes for OSPF and Babel metrics are no longer reset when exported to
+  these protocols and could be set anywhere in BIRD. As a result, OSPF metric is
+  kept when a route is reannounced between OSPF instances. Also, when route is
+  exported to OSPF with both ospf_metric1 and ospf_metric2 attributes it is now
+  propagated as OSPF-E2 route instead of as OSPF-E1 route.
+
+  Compiling BIRD with --enable-debug no longer automatically activates debug
+  mode (-d option) nor local mode (-l option). Also, debug mode with output to
+  file (-D option) no longer not forces foreground mode (-f option).
+
+  The configure script now uses standard option --runstatedir, the old option
+  --with-runtimedir is deprecated.
+
+
+Version 2.0.2 (2018-03-22)
+  o Source-specific routing support for Linux kernel and Babel
+  o BGP: New option 'disable after cease'
+  o Filter: Allow silent filter execution
+  o Filter: Fixed stack overflow in BGP mask expressions.
+  o Several bugfixes
+
+  Notes:
+
+  Syntax prefix:netmask for IPv4 prefixes was dropped. Just use prefix/pxlen.
+
+
 Version 2.0.1 (2018-01-16)
  o Linux MPLS kernel support
  o Better handling of channels inherited from templates
--- a/18
+++ b/18
@ -6,7 +6,7 @@
                (c) 1998--2008  Martin Mares <mj@ucw.cz>
                (c) 1998--2000  Pavel Machek <pavel@ucw.cz>
                (c) 1998--2008  Ondrej Filip <feela@network.cz>
-                (c) 2009--2017  CZ.NIC z.s.p.o.
+                (c) 2009--2019  CZ.NIC z.s.p.o.

 ================================================================================

@ -48,20 +48,10 @@ How to install BIRD
 	   ftp://bird.network.cz/pub/bird/redhat/
 	o  From source code of the latest stable release version
 	   ftp://bird.network.cz/pub/bird/
-	o  From source code of the actual development version
-	   git://git.nic.cz/bird.git
+	o  From current development code in Git repository
 	   https://gitlab.labs.nic.cz/labs/bird/

-How to install BIRD from source code
------------------------------------
-
-	$  ./configure
-	$  make
-	$  su
-	#  make install
-	#  vi /usr/local/etc/bird.conf
-
-See the file INSTALL for more information about installation from source code.
+See the file INSTALL for information about installation from source code.

 Documentation
 =============
@ -69,7 +59,7 @@ Documentation
 Online documentation is available at http://bird.network.cz/?get_doc or as HTML
 files in the doc directory, you can install it by `make install-docs' and
 rebuild it by `make docs', but you'll need SGMLtools and LaTeX to be installed
-on your machine. You can also download a neatly formatted PostScript version as
+on your machine. You can also download a neatly formatted PDF version as
 a separate archive (bird-doc-*.tar.gz) from ftp://bird.network.cz/pub/bird/

 User support
--- a/aclocal.m4
+++ b/aclocal.m4
@ -1,6 +1,25 @@
 dnl ** Additional Autoconf tests for BIRD configure script
 dnl ** (c) 1999 Martin Mares <mj@ucw.cz>

+AC_DEFUN([BIRD_CHECK_THREAD_LOCAL],
+[
+  AC_CACHE_CHECK(
+    [whether _Thread_local is known],
+    [bird_cv_thread_local],
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM(
+        [
+	  _Thread_local static int x = 42;
+	],
+	[]
+      )
+    ],
+    [bird_cv_thread_local=yes],
+    [bird_cv_thread_local=no]
+    )
+  )
+])
+
 AC_DEFUN([BIRD_CHECK_PTHREADS],
 [
  bird_tmp_cflags="$CFLAGS"
@ -65,6 +84,95 @@ AC_DEFUN([BIRD_CHECK_MPLS_KERNEL],
  )
 ])

+AC_DEFUN([BIRD_CHECK_ANDROID_GLOB],
+[
+  AC_CACHE_CHECK(
+    [for glob.h],
+    [bird_cv_lib_glob],
+    AC_LINK_IFELSE([
+      AC_LANG_PROGRAM(
+        [
+	  #include <glob.h>
+	  #include <stdlib.h>
+	],
+        [ glob(NULL, 0, NULL, NULL); ]
+      )
+    ],
+    [bird_cv_lib_glob=yes],
+      [
+        bird_tmp_libs="$LIBS"
+        LIBS="$LIBS -landroid-glob"
+        AC_LINK_IFELSE([
+          AC_LANG_PROGRAM(
+            [
+	      #include <glob.h>
+	      #include <stdlib.h>
+	    ],
+            [ glob(NULL, 0, NULL, NULL); ]
+          )
+        ],
+        [bird_cv_lib_glob=-landroid-glob],
+        [bird_cv_lib_glob=no]
+        )
+        LIBS="$bird_tmp_libs"
+      ]
+    )
+  )
+])
+
+AC_DEFUN([BIRD_CHECK_ANDROID_LOG],
+[
+  AC_CACHE_CHECK(
+    [for syslog lib flags],
+    [bird_cv_lib_log],
+    AC_LINK_IFELSE([
+      AC_LANG_PROGRAM(
+        [ #include <sys/syslog.h> ],
+        [ syslog(0, ""); ]
+      )
+    ],
+    [bird_cv_lib_log=yes],
+      [
+        bird_tmp_libs="$LIBS"
+        LIBS="$LIBS -llog"
+        AC_LINK_IFELSE([
+          AC_LANG_PROGRAM(
+            [ #include <sys/syslog.h> ],
+            [ syslog(0, ""); ]
+          )
+        ],
+        [bird_cv_lib_log=-llog],
+        [bird_cv_lib_log=no]
+        )
+        LIBS="$bird_tmp_libs"
+      ]
+    )
+  )
+])
+
+AC_DEFUN([BIRD_CHECK_LTO],
+[
+  bird_tmp_cflags="$CFLAGS"
+  bird_tmp_ldflags="$LDFLAGS"
+  CFLAGS="-flto"
+  LDFLAGS="-flto=4"
+
+  AC_CACHE_CHECK(
+    [whether link time optimizer is available],
+    [bird_cv_c_lto],
+    [
+      AC_LINK_IFELSE(
+	[AC_LANG_PROGRAM()],
+	[bird_cv_c_lto=yes],
+	[bird_cv_c_lto=no]
+      )
+    ]
+  )
+
+  CFLAGS="$bird_tmp_cflags"
+  LDFLAGS="$bird_tmp_ldflags"
+])
+

 AC_DEFUN([BIRD_CHECK_GCC_OPTION],
 [
@ -110,3 +218,24 @@ AC_DEFUN([BIRD_CHECK_PROG_FLAVOR_GNU],
  )
  esac
 ])
+
+AC_DEFUN([BIRD_CHECK_BISON_VERSION],
+[
+  $1=`bison --version | ( read line; echo ${line##* } )`
+  case "$$1" in
+    1.* | 2.0* | 2.1* | 2.2* | 2.3*)
+      AC_MSG_ERROR([Provided Bison version $$1 is too old, need at least 2.4])
+      ;;
+    2.*)
+      bird_bison_synclines=no
+      bird_bison_enhanced_error=no
+      ;;
+    3.* | 4.* | 5.* | 6.* | 7.* | 8.* | 9.*)
+      bird_bison_synclines=yes
+      bird_bison_enhanced_error=yes
+      ;;
+    *)
+      AC_MSG_ERROR([Couldn't parse Bison version $$1. Call the developers for help.])
+      ;;
+  esac
+])
--- a/bird-gdb.py
+++ b/bird-gdb.py
@ -0,0 +1,154 @@
+class BIRDPrinter:
+    def __init__(self, val):
+        self.val = val
+
+    @classmethod
+    def lookup(cls, val):
+        if val.type.code != cls.typeCode:
+            return None
+        if val.type.tag != cls.typeTag:
+            return None
+
+        return cls(val)
+
+
+class BIRDFValPrinter(BIRDPrinter):
+    "Print BIRD\s struct f_val"
+    typeCode = gdb.TYPE_CODE_STRUCT
+    typeTag = "f_val"
+
+    codemap = {
+            "T_INT": "i",
+            "T_BOOL": "i",
+            "T_PAIR": "i",
+            "T_QUAD": "i",
+            "T_ENUM_RTS": "i",
+            "T_ENUM_BGP_ORIGIN": "i",
+            "T_ENUM_SCOPE": "i",
+            "T_ENUM_RTC": "i",
+            "T_ENUM_RTD": "i",
+            "T_ENUM_ROA": "i",
+            "T_ENUM_NETTYPE": "i",
+            "T_ENUM_RA_PREFERENCE": "i",
+            "T_ENUM_AF": "i",
+            "T_IP": "ip",
+            "T_NET": "net",
+            "T_STRING": "s",
+            "T_PATH_MASK": "path_mask",
+            "T_PATH": "ad",
+            "T_CLIST": "ad",
+            "T_EC": "ec",
+            "T_ECLIST": "ad",
+            "T_LC": "lc",
+            "T_LCLIST": "ad",
+            "T_RD": "ec",
+            "T_PATH_MASK_ITEM": "pmi",
+            "T_SET": "t",
+            "T_PREFIX_SET": "ti",
+            }
+
+    def to_string(self):
+        code = self.val['type']
+        if code.type.code != gdb.TYPE_CODE_ENUM or code.type.tag != "f_type":
+            raise Exception("Strange 'type' element in f_val")
+
+        if str(code) == "T_VOID":
+            return "T_VOID"
+        else:
+            return "(%(c)s) %(v)s" % { "c": code, "v": self.val['val'][self.codemap[str(code)]] }
+
+    def display_hint(self):
+        return "map"
+
+class BIRDFValStackPrinter(BIRDPrinter):
+    "Print BIRD's struct f_val_stack"
+    typeCode = gdb.TYPE_CODE_STRUCT
+    typeTag = "f_val_stack"
+
+    def to_string(self):
+        cnt = self.val['cnt']
+        return ("Value stack (%(cnt)d):\n\t" % { "cnt": cnt }) + \
+                "\n\t".join([ (".val[%(n) 3d] = " % { "n": n}) + str(self.val['val'][n]) for n in range(cnt-1, -1, -1) ])
+
+    def display_hint(self):
+        return "map"
+
+class BIRDFInstPrinter(BIRDPrinter):
+    "Print BIRD's struct f_inst"
+    typeCode = gdb.TYPE_CODE_STRUCT
+    typeTag = "f_inst"
+
+    def to_string(self):
+        code = self.val['fi_code']
+        if str(code) == "FI_NOP":
+            return str(code) + ": " + str(self.val.cast(gdb.lookup_type("const char [%(siz)d]" % { "siz": self.val.type.sizeof })))
+        return "%(code)s:\t%(lineno) 6dL\t%(size)6dS\tnext = %(next)s: .i_%(code)s = %(union)s" % {
+                "code": str(code),
+                "lineno": self.val['lineno'],
+                "size": self.val['size'],
+                "next": str(self.val['next']),
+                "union": str(self.val['i_' + str(code)])
+                }
+
+# def children(self): # children iterator
+    def display_hint(self):
+        return "map"
+
+class BIRDFLineItemPrinter(BIRDPrinter):
+    "Print BIRD's struct f_line_item"
+    typeCode = gdb.TYPE_CODE_STRUCT
+    typeTag = "f_line_item"
+
+    def to_string(self):
+        code = self.val['fi_code']
+        if str(code) == "FI_NOP":
+            return str(code) + ": " + str(self.val.cast(gdb.lookup_type("const char [%(siz)d]" % { "siz": self.val.type.sizeof })))
+        return "%(code)s:\t%(lineno) 6dL\t%(flags)2dF: .i_%(code)s = %(union)s" % {
+                "code": str(code),
+                "lineno": self.val['lineno'],
+                "flags": self.val['flags'],
+                "union": str(self.val['i_' + str(code)])
+                }
+
+class BIRDFLinePrinter(BIRDPrinter):
+    "Print BIRD's struct f_line"
+    typeCode = gdb.TYPE_CODE_STRUCT
+    typeTag = "f_line"
+
+    def to_string(self):
+        cnt = self.val['len']
+        return ("FLine (%(cnt)d, args=%(args)d): " % { "cnt": cnt, "args" : self.val['args'] } + \
+                ", ".join([
+                    ".items[%(n) 3d] = %(code)s" % {
+                        "n": n,
+                        "code": str(self.val['items'][n]['fi_code']),
+                    } if n % 8 == 0 else str(self.val['items'][n]['fi_code']) for n in range(cnt)]))
+        
+
+class BIRDFExecStackPrinter(BIRDPrinter):
+    "Print BIRD's struct f_exec_stack"
+    typeCode = gdb.TYPE_CODE_STRUCT
+    typeTag = "f_exec_stack"
+
+    def to_string(self):
+        cnt = self.val['cnt']
+        return ("Exec stack (%(cnt)d):\n\t" % { "cnt": cnt }) + \
+                "\n\t".join([ ".item[%(n) 3d] = %(retflag)d V%(ventry) 3d P%(pos) 4d %(line)s" % {
+                    "retflag": self.val['item'][n]['emask'],
+                    "ventry": self.val['item'][n]['ventry'],
+                    "pos": self.val['item'][n]['pos'],
+                    "line": str(self.val['item'][n]['line'].dereference()),
+                    "n": n
+                        } for n in range(cnt-1, -1, -1) ])
+
+def register_printers(objfile):
+    objfile.pretty_printers.append(BIRDFInstPrinter.lookup)
+    objfile.pretty_printers.append(BIRDFValPrinter.lookup)
+    objfile.pretty_printers.append(BIRDFValStackPrinter.lookup)
+    objfile.pretty_printers.append(BIRDFLineItemPrinter.lookup)
+    objfile.pretty_printers.append(BIRDFLinePrinter.lookup)
+    objfile.pretty_printers.append(BIRDFExecStackPrinter.lookup)
+
+register_printers(gdb.current_objfile())
+
+print("BIRD pretty printers loaded OK.")
--- a/bird.conf
+++ b/bird.conf
@ -22,13 +22,14 @@ protocol direct {

 # Feed routes to kernel FIB
 protocol kernel {
-	ipv4 { export all; };
-#	learn;			# Learn all routes from the kernel
+	ipv4 { export all; import all; };
+	learn;			# Learn all routes from the kernel
 #	scan time 10;		# Scan kernel tables every 10 seconds
 }

 protocol kernel {
-	ipv6;
+	ipv6 { import all; };
+	learn;
 }

 # Static route feed
--- a/client/Makefile
+++ b/client/Makefile
@ -2,8 +2,7 @@ src := commands.c util.c client.c
 obj := $(src-o-files)

 $(all-client)
-
-$(o)commands.o: $(objdir)/conf/commands.h
+$(conf-y-targets): $(s)cmds.Y

 $(exedir)/birdc: $(o)birdc.o
 $(exedir)/birdc: LIBS += $(CLIENT_LIBS)
--- a/client/cmds.m4
+++ b/client/cmds.m4
--- a/conf/Makefile
+++ b/conf/Makefile
@ -10,24 +10,25 @@ BISON_DEBUG=-t
 #FLEX_DEBUG=-d
 endif

-$(conf-y-targets): $(s)confbase.Y $(s)flowspec.Y
-	$(M4) -P $| $^ >$@
+$(o)cf-parse.y: $(s)gen_parser.m4
+$(o)keywords.h: $(s)gen_keywords.m4
+$(o)commands.h: $(s)gen_commands.m4

-$(o)cf-parse.y: | $(s)gen_parser.m4
-$(o)keywords.h: | $(s)gen_keywords.m4
-$(o)commands.h: | $(s)gen_commands.m4 $(srcdir)/client/cmds.m4
+$(conf-y-targets): $(s)confbase.Y $(s)flowspec.Y
+	$(M4) $(M4FLAGS) -P $(if $(word 2,$(filter %.m4,$^)),$(error "Too many M4 scripts for one target"),$(filter %.m4,$^)) $(filter %.Y,$^) >$@

 $(o)cf-parse.tab.h: $(o)cf-parse.tab.c

 $(o)cf-parse.tab.c: $(o)cf-parse.y
-	$(BISON) $(BISON_DEBUG) -dv -pcf_ -b $(@:.tab.c=) $<
+	$(BISON) $(BISON_DEBUG) $(BISONFLAGS) -dv -pcf_ -b $(@:.tab.c=) $<

 $(o)cf-lex.c: $(s)cf-lex.l
-	$(FLEX) $(FLEX_DEBUG) -s -B -8 -Pcf_ -o$@ $<
+	$(FLEX) $(FLEX_DEBUG) -f -s -B -8 -Pcf_ -o$@ $<

-$(o)cf-lex.o: $(o)cf-parse.tab.h $(o)keywords.h
 $(o)cf-lex.o: CFLAGS+=-Wno-sign-compare -Wno-unused-function

+prepare: $(o)keywords.h $(o)commands.h $(o)cf-parse.tab.h
+
 $(addprefix $(o), cf-parse.y keywords.h commands.h cf-parse.tab.h cf-parse.tab.c cf-lex.c): $(objdir)/.dir-stamp

 $(call clean,cf-parse.tab.h cf-parse.tab.c cf-parse.y keywords.h commands.h cf-lex.c cf-parse.output)
--- a/conf/cf-lex.l
+++ b/conf/cf-lex.l
@ -45,6 +45,7 @@
 #include "nest/route.h"
 #include "nest/protocol.h"
 #include "filter/filter.h"
+#include "filter/f-inst.h"
 #include "conf/conf.h"
 #include "conf/cf-parse.tab.h"
 #include "lib/string.h"
@ -64,7 +65,7 @@ struct keyword {
 #endif


-static uint cf_hash(byte *c);
+static uint cf_hash(const byte *c);

 #define KW_KEY(n)		n->name
 #define KW_NEXT(n)		n->next
@ -87,7 +88,7 @@ HASH_DEFINE_REHASH_FN(SYM, struct symbol)
 HASH(struct keyword) kw_hash;


-static struct sym_scope *conf_this_scope;
+struct sym_scope *conf_this_scope;

 linpool *cfg_mem;

@ -95,15 +96,27 @@ int (*cf_read_hook)(byte *buf, unsigned int max, int fd);
 struct include_file_stack *ifs;
 static struct include_file_stack *ifs_head;

+#define QUOTED_BUFFER_SIZE  4096
+static BUFFER_(char) quoted_buffer;
+static char quoted_buffer_data[QUOTED_BUFFER_SIZE];
+static inline void quoted_buffer_init(void) {
+  quoted_buffer.used = 0;
+  quoted_buffer.size = QUOTED_BUFFER_SIZE;
+  quoted_buffer.data = quoted_buffer_data;
+}
+
 #define MAX_INCLUDE_DEPTH 8

 #define YY_INPUT(buf,result,max) result = cf_read_hook(buf, max, ifs->fd);
 #define YY_NO_UNPUT
 #define YY_FATAL_ERROR(msg) cf_error(msg)
+#define YY_USER_ACTION ifs->chno += yyleng; ifs->toklen = yyleng;

 static void cf_include(char *arg, int alen);
 static int check_eof(void);

+static enum yytokentype cf_lex_symbol(const char *data);
+
 %}

 %option noyywrap
@ -111,24 +124,26 @@ static int check_eof(void);
 %option nounput
 %option noreject

-%x COMMENT CCOMM CLI
+%x COMMENT CCOMM CLI QUOTED APOSTROPHED INCLUDE

 ALPHA [a-zA-Z_]
 DIGIT [0-9]
 XIGIT [0-9a-fA-F]
 ALNUM [a-zA-Z_0-9]
 WHITE [ \t]
-include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;

 %%
-{include} {
-  char *start, *end;
-
+^{WHITE}*include{WHITE}*\" {
  if (!ifs->depth)
    cf_error("Include not allowed in CLI");

-  start = strchr(yytext, '"');
-  start++;
+  BEGIN(INCLUDE);
+}
+
+<INCLUDE>[^"\n]+["]{WHITE}*; {
+  char *start, *end;
+
+  start = yytext;

  end = strchr(start, '"');
  *end = 0;
@ -137,16 +152,24 @@ include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
    cf_error("Include with empty argument");

  cf_include(start, end-start);
+
+  BEGIN(INITIAL);
 }

+<INCLUDE>["]	        cf_error("Include with empty argument");
+<INCLUDE>.		cf_error("Unterminated include");
+<INCLUDE>\n		cf_error("Unterminated include");
+<INCLUDE><<EOF>>	cf_error("Unterminated include");
+
+
 {DIGIT}+:{DIGIT}+ {
  uint len1 UNUSED, len2;
  u64 l;
  char *e;

  errno = 0;
-  l = strtoul(yytext, &e, 10);
-  if (e && (*e != ':') || (errno == ERANGE) || (l >> 32))
+  l = bstrtoul10(yytext, &e);
+  if (!e || (*e != ':') || (errno == ERANGE) || (l >> 32))
    cf_error("ASN out of range");

  if (l >> 16)
@ -163,8 +186,8 @@ include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
  }

  errno = 0;
-  l = strtoul(e+1, &e, 10);
-  if (e && *e || (errno == ERANGE) || (l >> len2))
+  l = bstrtoul10(e+1, &e);
+  if (!e || *e || (errno == ERANGE) || (l >> len2))
    cf_error("Number out of range");
  cf_lval.i64 |= l;

@ -190,14 +213,14 @@ include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
  }

  errno = 0;
-  l = strtoul(yytext+2, &e, 10);
-  if (e && (*e != ':') || (errno == ERANGE) || (l >> len1))
+  l = bstrtoul10(yytext+2, &e);
+  if (!e || (*e != ':') || (errno == ERANGE) || (l >> len1))
    cf_error("ASN out of range");
  cf_lval.i64 |= ((u64) l) << len2;

  errno = 0;
-  l = strtoul(e+1, &e, 10);
-  if (e && *e || (errno == ERANGE) || (l >> len2))
+  l = bstrtoul10(e+1, &e);
+  if (!e || *e || (errno == ERANGE) || (l >> len2))
    cf_error("Number out of range");
  cf_lval.i64 |= l;

@ -218,8 +241,8 @@ include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
  cf_lval.i64 |= ((u64) ip4_to_u32(ip4)) << 16;

  errno = 0;
-  l = strtoul(e, &e, 10);
-  if (e && *e || (errno == ERANGE) || (l >> 16))
+  l = bstrtoul10(e, &e);
+  if (!e || *e || (errno == ERANGE) || (l >> 16))
    cf_error("Number out of range");
  cf_lval.i64 |= l;

@ -242,8 +265,8 @@ include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
  char *e;
  unsigned long int l;
  errno = 0;
-  l = strtoul(yytext+2, &e, 16);
-  if (e && *e || errno == ERANGE || (unsigned long int)(unsigned int) l != l)
+  l = bstrtoul16(yytext+2, &e);
+  if (!e || *e || errno == ERANGE || (unsigned long int)(unsigned int) l != l)
    cf_error("Number out of range");
  cf_lval.i = l;
  return NUM;
@ -253,8 +276,8 @@ include   ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
  char *e;
  unsigned long int l;
  errno = 0;
-  l = strtoul(yytext, &e, 10);
-  if (e && *e || errno == ERANGE || (unsigned long int)(unsigned int) l != l)
+  l = bstrtoul10(yytext, &e);
+  if (!e || *e || errno == ERANGE || (unsigned long int)(unsigned int) l != l)
    cf_error("Number out of range");
  cf_lval.i = l;
  return NUM;
@ -265,26 +288,23 @@ else: {
  return ELSECOL;
 }

-({ALPHA}{ALNUM}*|[']({ALNUM}|[-]|[\.]|[:])*[']) {
-  if(*yytext == '\'') {
-    yytext[yyleng-1] = 0;
-    yytext++;
-  }
+['] {
+  BEGIN(APOSTROPHED);
+  quoted_buffer_init();
+}

-  struct keyword *k = HASH_FIND(kw_hash, KW, yytext);
-  if (k)
-  {
-    if (k->value > 0)
-      return k->value;
-    else
-    {
-      cf_lval.i = -k->value;
-      return ENUM;
-    }
-  }
+<APOSTROPHED>{ALNUM}|[-]|[.:]	BUFFER_PUSH(quoted_buffer) = yytext[0];
+<APOSTROPHED>\n			cf_error("Unterminated symbol");
+<APOSTROPHED><<EOF>>		cf_error("Unterminated symbol");
+<APOSTROPHED>['] {
+  BEGIN(INITIAL);
+  BUFFER_PUSH(quoted_buffer) = 0;
+  return cf_lex_symbol(quoted_buffer_data);
+}
+<APOSTROPHED>.			cf_error("Invalid character in apostrophed symbol");

-  cf_lval.s = cf_get_symbol(yytext);
-  return SYM;
+({ALPHA}{ALNUM}*) {
+  return cf_lex_symbol(yytext);
 }

 <CLI>(.|\n) {
@ -300,20 +320,27 @@ else: {
  return yytext[0];
 }

-["][^"\n]*["] {
-  yytext[yyleng-1] = 0;
-  cf_lval.t = cfg_strdup(yytext+1);
-  yytext[yyleng-1] = '"';
+["] {
+  BEGIN(QUOTED);
+  quoted_buffer_init();
+}
+
+<QUOTED>\n	cf_error("Unterminated string");
+<QUOTED><<EOF>> cf_error("Unterminated string");
+<QUOTED>["]	{
+  BEGIN(INITIAL);
+  BUFFER_PUSH(quoted_buffer) = 0;
+  cf_lval.t = cfg_strdup(quoted_buffer_data);
  return TEXT;
 }

-["][^"\n]*\n	cf_error("Unterminated string");
+<QUOTED>.	BUFFER_PUSH(quoted_buffer) = yytext[0];

 <INITIAL,COMMENT><<EOF>>	{ if (check_eof()) return END; }

 {WHITE}+

-\n	ifs->lino++;
+\n	ifs->lino++; ifs->chno = 0;

 #	BEGIN(COMMENT);

@ -323,13 +350,14 @@ else: {

 <COMMENT>\n {
  ifs->lino++;
+  ifs->chno = 0;
  BEGIN(INITIAL);
 }

 <COMMENT>.

 <CCOMM>\*\/	BEGIN(INITIAL);
-<CCOMM>\n	ifs->lino++;
+<CCOMM>\n	ifs->lino++; ifs->chno = 0;
 <CCOMM>\/\*	cf_error("Comment nesting not supported");
 <CCOMM><<EOF>>	cf_error("Unterminated comment");
 <CCOMM>.
@ -347,7 +375,7 @@ else: {
 %%

 static uint
-cf_hash(byte *c)
+cf_hash(const byte *c)
 {
  uint h = 13 << 24;

@ -356,7 +384,6 @@ cf_hash(byte *c)
  return h;
 }

-
 /*
 * IFS stack - it contains structures needed for recursive processing
 * of include in config files. On the top of the stack is a structure
@ -517,7 +544,7 @@ check_eof(void)
 }

 static struct symbol *
-cf_new_symbol(byte *c)
+cf_new_symbol(const byte *c)
 {
  struct symbol *s;

@ -525,11 +552,8 @@ cf_new_symbol(byte *c)
  if (l > SYM_MAX_LEN)
    cf_error("Symbol too long");

-  s = cfg_alloc(sizeof(struct symbol) + l);
-  s->scope = conf_this_scope;
-  s->class = SYM_VOID;
-  s->def = NULL;
-  s->aux = 0;
+  s = cfg_allocz(sizeof(struct symbol) + l + 1);
+  *s = (struct symbol) { .scope = conf_this_scope, .class = SYM_VOID, };
  strcpy(s->name, c);

  if (!new_config->sym_hash.data)
@ -537,6 +561,8 @@ cf_new_symbol(byte *c)

  HASH_INSERT2(new_config->sym_hash, SYM, new_config->pool, s);

+  add_tail(&(new_config->symbols), &(s->n));
+
  return s;
 }

@ -552,7 +578,7 @@ cf_new_symbol(byte *c)
 * signify no match.
 */
 struct symbol *
-cf_find_symbol(struct config *cfg, byte *c)
+cf_find_symbol(const struct config *cfg, const byte *c)
 {
  struct symbol *s;

@ -560,6 +586,7 @@ cf_find_symbol(struct config *cfg, byte *c)
      (s = HASH_FIND(cfg->sym_hash, SYM, c, 1)))
    return s;

+  /* In CLI command parsing, fallback points to the current config, otherwise it is NULL. */
  if (cfg->fallback &&
      cfg->fallback->sym_hash.data &&
      (s = HASH_FIND(cfg->fallback->sym_hash, SYM, c, 1)))
@ -578,11 +605,33 @@ cf_find_symbol(struct config *cfg, byte *c)
 * existing symbol is found.
 */
 struct symbol *
-cf_get_symbol(byte *c)
+cf_get_symbol(const byte *c)
 {
  return cf_find_symbol(new_config, c) ?: cf_new_symbol(c);
 }

+/**
+ * cf_localize_symbol - get the local instance of given symbol
+ * @sym: the symbol to localize
+ *
+ * This functions finds the symbol that is local to current scope
+ * for purposes of cf_define_symbol().
+ */
+struct symbol *
+cf_localize_symbol(struct symbol *sym)
+{
+  /* If the symbol type is void, it has been recently allocated just in this scope. */
+  if (!sym->class)
+    return sym;
+  
+  /* If the scope is the current, it is already defined in this scope. */
+  if (sym->scope == conf_this_scope)
+    cf_error("Symbol already defined");
+
+  /* Not allocated here yet, doing it now. */
+  return cf_new_symbol(sym->name);
+}
+
 struct symbol *
 cf_default_name(char *template, int *counter)
 {
@ -602,33 +651,32 @@ cf_default_name(char *template, int *counter)
  cf_error("Unable to generate default name");
 }

-/**
- * cf_define_symbol - define meaning of a symbol
- * @sym: symbol to be defined
- * @type: symbol class to assign
- * @def: class dependent data
- *
- * Defines new meaning of a symbol. If the symbol is an undefined
- * one (%SYM_VOID), it's just re-defined to the new type. If it's defined
- * in different scope, a new symbol in current scope is created and the
- * meaning is assigned to it. If it's already defined in the current scope,
- * an error is reported via cf_error().
- *
- * Result: Pointer to the newly defined symbol. If we are in the top-level
- * scope, it's the same @sym as passed to the function.
- */
-struct symbol *
-cf_define_symbol(struct symbol *sym, int type, void *def)
+static enum yytokentype
+cf_lex_symbol(const char *data)
 {
-  if (sym->class)
+  /* Have we defined such a symbol? */
+  struct symbol *sym = cf_get_symbol(data);
+  cf_lval.s = sym;
+
+  if (sym->class != SYM_VOID)
+    return CF_SYM_KNOWN;
+
+  /* Is it a keyword? */
+  struct keyword *k = HASH_FIND(kw_hash, KW, data);
+  if (k)
+  {
+    if (k->value > 0)
+      return k->value;
+    else
    {
-      if (sym->scope == conf_this_scope)
-	cf_error("Symbol already defined");
-      sym = cf_new_symbol(sym->name);
+      cf_lval.i = -k->value;
+      return ENUM;
    }
-  sym->class = type;
-  sym->def = def;
-  return sym;
+  }
+
+  /* OK, undefined symbol */
+  cf_lval.s = sym;
+  return CF_SYM_UNDEFINED;
 }

 static void
@ -671,7 +719,8 @@ cf_lex_init(int is_cli, struct config *c)
  else
    BEGIN(INITIAL);

-  conf_this_scope = cfg_allocz(sizeof(struct sym_scope));
+  c->root_scope = cfg_allocz(sizeof(struct sym_scope));
+  conf_this_scope = c->root_scope;
  conf_this_scope->active = 1;
 }

@ -688,12 +737,13 @@ cf_lex_init(int is_cli, struct config *c)
 void
 cf_push_scope(struct symbol *sym)
 {
-  struct sym_scope *s = cfg_alloc(sizeof(struct sym_scope));
+  struct sym_scope *s = cfg_allocz(sizeof(struct sym_scope));

  s->next = conf_this_scope;
  conf_this_scope = s;
  s->active = 1;
  s->name = sym;
+  s->slots = 0;
 }

 /**
@ -708,6 +758,7 @@ cf_pop_scope(void)
 {
  conf_this_scope->active = 0;
  conf_this_scope = conf_this_scope->next;
+
  ASSERT(conf_this_scope);
 }

@ -721,9 +772,6 @@ cf_pop_scope(void)
 char *
 cf_symbol_class_name(struct symbol *sym)
 {
-  if (cf_symbol_is_constant(sym))
-    return "constant";
-
  switch (sym->class)
    {
    case SYM_VOID:
@ -738,6 +786,12 @@ cf_symbol_class_name(struct symbol *sym)
      return "filter";
    case SYM_TABLE:
      return "routing table";
+    case SYM_ATTRIBUTE:
+      return "custom attribute";
+    case SYM_CONSTANT_RANGE:
+      return "constant";
+    case SYM_VARIABLE_RANGE:
+      return "variable";
    default:
      return "unknown type";
    }
--- a/conf/conf.c
+++ b/conf/conf.c
@ -55,6 +55,7 @@
 #include "lib/timer.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
+#include "sysdep/unix/unix.h"


 static jmp_buf conf_jmpbuf;
@ -98,6 +99,7 @@ config_alloc(const char *name)
  memcpy(ndup, name, nlen);

  init_list(&c->tests);
+  init_list(&c->symbols);
  c->mrtdump_file = -1; /* Hack, this should be sysdep-specific */
  c->pool = p;
  c->mem = l;
@ -209,13 +211,21 @@ config_del_obstacle(struct config *c)
 {
  DBG("+++ deleting obstacle %d\n", c->obstacle_count);
  c->obstacle_count--;
-  if (!c->obstacle_count)
+  if (!c->obstacle_count && (c != config))
    ev_schedule(config_event);
 }

 static int
 global_commit(struct config *new, struct config *old)
 {
+  if (!new->hostname)
+    {
+      new->hostname = get_hostname(new->mem);
+
+      if (!new->hostname)
+        log(L_WARN "Cannot determine hostname");
+    }
+
  if (!old)
    return 0;

@ -258,6 +268,8 @@ config_do_commit(struct config *c, int type)
  if (old_config)
    old_config->obstacle_count++;

+  DBG("filter_commit\n");
+  filter_commit(c, old_config);
  DBG("sysdep_commit\n");
  int force_restart = sysdep_commit(c, old_config);
  DBG("global_commit\n");
@ -444,6 +456,24 @@ config_undo(void)
  return CONF_PROGRESS;
 }

+int
+config_status(void)
+{
+  if (shutting_down)
+    return CONF_SHUTDOWN;
+
+  if (configuring)
+    return future_cftype ? CONF_QUEUED : CONF_PROGRESS;
+
+  return CONF_DONE;
+}
+
+btime
+config_timer_status(void)
+{
+  return tm_active(config_timer) ? tm_remains(config_timer) : -1;
+}
+
 extern void cmd_reconfig_undo_notify(void);

 static void
@ -474,19 +504,24 @@ config_init(void)
 * for switching to an empty configuration.
 */
 void
-order_shutdown(void)
+order_shutdown(int gr)
 {
  struct config *c;

  if (shutting_down)
    return;

-  log(L_INFO "Shutting down");
+  if (!gr)
+    log(L_INFO "Shutting down");
+  else
+    log(L_INFO "Shutting down for graceful restart");
+
  c = lp_alloc(config->mem, sizeof(struct config));
  memcpy(c, config, sizeof(struct config));
  init_list(&c->protos);
  init_list(&c->tables);
  c->shutdown = 1;
+  c->gr_down = gr;

  config_commit(c, RECONFIG_HARD, 0);
  shutting_down = 1;
@ -512,6 +547,7 @@ cf_error(const char *msg, ...)
  va_end(args);
  new_config->err_msg = cfg_strdup(buf);
  new_config->err_lino = ifs->lino;
+  new_config->err_chno = ifs->chno - ifs->toklen + 1;
  new_config->err_file_name = ifs->file_name;
  cf_lex_unwind();
  longjmp(conf_jmpbuf, 1);
@ -546,6 +582,7 @@ cfg_copy_list(list *dest, list *src, unsigned node_size)
  {
    dn = cfg_alloc(node_size);
    memcpy(dn, sn, node_size);
+    memset(dn, 0, sizeof(node));
    add_tail(dest, dn);
  }
 }
--- a/conf/conf.h
+++ b/conf/conf.h
@ -15,7 +15,6 @@
 #include "lib/resource.h"
 #include "lib/timer.h"

-
 /* Configuration structure */

 struct config {
@ -25,20 +24,23 @@ struct config {
  list tables;				/* Configured routing tables (struct rtable_config) */
  list logfiles;			/* Configured log files (sysdep) */
  list tests;				/* Configured unit tests (f_bt_test_suite) */
+  list symbols;				/* Configured symbols in config order */

  int mrtdump_file;			/* Configured MRTDump file (sysdep, fd in unix) */
-  char *syslog_name;			/* Name used for syslog (NULL -> no syslog) */
+  const char *syslog_name;		/* Name used for syslog (NULL -> no syslog) */
  struct rtable_config *def_tables[NET_MAX]; /* Default routing tables for each network */
  struct iface_patt *router_id_from;	/* Configured list of router ID iface patterns */

  u32 router_id;			/* Our Router ID */
-  unsigned proto_default_debug;		/* Default protocol debug mask */
-  unsigned proto_default_mrtdump;	/* Default protocol mrtdump mask */
+  u32 proto_default_debug;		/* Default protocol debug mask */
+  u32 proto_default_mrtdump;		/* Default protocol mrtdump mask */
+  u32 channel_default_debug;		/* Default channel debug mask */
  struct timeformat tf_route;		/* Time format for 'show route' */
  struct timeformat tf_proto;		/* Time format for 'show protocol' */
  struct timeformat tf_log;		/* Time format for the logfile */
  struct timeformat tf_base;		/* Time format for other purposes */
  u32 gr_wait;				/* Graceful restart wait timeout (sec) */
+  const char *hostname;			/* Hostname */

  int cli_debug;			/* Tracing of CLI connections and commands */
  int latency_debug;			/* I/O loop tracks duration of each event */
@ -47,13 +49,16 @@ struct config {
  u32 watchdog_timeout;			/* Watchdog timeout (in seconds, 0 = disabled) */
  char *err_msg;			/* Parser error message */
  int err_lino;				/* Line containing error */
+  int err_chno;				/* Character where the parser stopped */
  char *err_file_name;			/* File name containing error */
  char *file_name;			/* Name of main configuration file */
  int file_fd;				/* File descriptor of main configuration file */
  HASH(struct symbol) sym_hash;		/* Lexer: symbol hash table */
  struct config *fallback;		/* Link to regular config for CLI parsing */
+  struct sym_scope *root_scope;		/* Scope for root symbols */
  int obstacle_count;			/* Number of items blocking freeing of this config */
  int shutdown;				/* This is a pseudo-config for daemon shutdown */
+  int gr_down;				/* This is a pseudo-config for graceful restart */
  btime load_time;			/* When we've got this configuration */
 };

@ -68,11 +73,13 @@ void config_free(struct config *);
 int config_commit(struct config *, int type, uint timeout);
 int config_confirm(void);
 int config_undo(void);
+int config_status(void);
+btime config_timer_status(void);
 void config_init(void);
 void cf_error(const char *msg, ...) NORET;
 void config_add_obstacle(struct config *);
 void config_del_obstacle(struct config *);
-void order_shutdown(void);
+void order_shutdown(int gr);

 #define RECONFIG_NONE	0
 #define RECONFIG_HARD	1
@ -103,18 +110,29 @@ void cfg_copy_list(list *dest, list *src, unsigned node_size);
 extern int (*cf_read_hook)(byte *buf, uint max, int fd);

 struct symbol {
+  node n;				/* In list of symbols in config */
  struct symbol *next;
  struct sym_scope *scope;
-  int class;
-  int aux;
-  void *aux2;
-  void *def;
-  char name[1];
+  int class;				/* SYM_* */
+  uint flags;				/* SYM_FLAG_* */
+
+  union {
+    struct proto_config *proto;		/* For SYM_PROTO and SYM_TEMPLATE */
+    const struct f_line *function;	/* For SYM_FUNCTION */
+    const struct filter *filter;	/* For SYM_FILTER */
+    struct rtable_config *table;	/* For SYM_TABLE */
+    struct f_dynamic_attr *attribute;	/* For SYM_ATTRIBUTE */
+    struct f_val *val;			/* For SYM_CONSTANT */
+    uint offset;			/* For SYM_VARIABLE */
+  };
+
+  char name[0];
 };

 struct sym_scope {
  struct sym_scope *next;		/* Next on scope stack */
  struct symbol *name;			/* Name of this scope */
+  uint slots;				/* Variable slots */
  int active;				/* Currently entered */
 };

@ -127,18 +145,26 @@ struct sym_scope {
 #define SYM_FUNCTION 3
 #define SYM_FILTER 4
 #define SYM_TABLE 5
+#define SYM_ATTRIBUTE 6

 #define SYM_VARIABLE 0x100	/* 0x100-0x1ff are variable types */
+#define SYM_VARIABLE_RANGE SYM_VARIABLE ... (SYM_VARIABLE | 0xff)
 #define SYM_CONSTANT 0x200	/* 0x200-0x2ff are variable types */
+#define SYM_CONSTANT_RANGE SYM_CONSTANT ... (SYM_CONSTANT | 0xff)

-#define SYM_TYPE(s) (((struct f_val *) (s)->def)->type)
-#define SYM_VAL(s) (((struct f_val *) (s)->def)->val)
+#define SYM_TYPE(s) ((s)->val->type)
+#define SYM_VAL(s) ((s)->val->val)
+
+/* Symbol flags */
+#define SYM_FLAG_SAME 0x1	/* For SYM_FUNCTION and SYM_FILTER */

 struct include_file_stack {
  void *buffer;				/* Internal lexer state */
  char *file_name;			/* File name */
  int fd;				/* File descriptor */
  int lino;				/* Current line num */
+  int chno;				/* Current char num (on current line) */
+  int toklen;				/* Current token length */
  int depth;				/* Include depth, 0 = cannot include */

  struct include_file_stack *prev;	/* Previous record in stack */
@ -147,24 +173,43 @@ struct include_file_stack {

 extern struct include_file_stack *ifs;

+extern struct sym_scope *conf_this_scope;

 int cf_lex(void);
 void cf_lex_init(int is_cli, struct config *c);
 void cf_lex_unwind(void);

-struct symbol *cf_find_symbol(struct config *cfg, byte *c);
+struct symbol *cf_find_symbol(const struct config *cfg, const byte *c);

-struct symbol *cf_get_symbol(byte *c);
+struct symbol *cf_get_symbol(const byte *c);
 struct symbol *cf_default_name(char *template, int *counter);
-struct symbol *cf_define_symbol(struct symbol *symbol, int type, void *def);
+struct symbol *cf_localize_symbol(struct symbol *sym);
+
+/**
+ * cf_define_symbol - define meaning of a symbol
+ * @sym: symbol to be defined
+ * @type: symbol class to assign
+ * @def: class dependent data
+ *
+ * Defines new meaning of a symbol. If the symbol is an undefined
+ * one (%SYM_VOID), it's just re-defined to the new type. If it's defined
+ * in different scope, a new symbol in current scope is created and the
+ * meaning is assigned to it. If it's already defined in the current scope,
+ * an error is reported via cf_error().
+ *
+ * Result: Pointer to the newly defined symbol. If we are in the top-level
+ * scope, it's the same @sym as passed to the function.
+ */
+#define cf_define_symbol(osym_, type_, var_, def_) ({ \
+    struct symbol *sym_ = cf_localize_symbol(osym_); \
+    sym_->class = type_; \
+    sym_->var_ = def_; \
+    sym_; })
+
 void cf_push_scope(struct symbol *);
 void cf_pop_scope(void);
 char *cf_symbol_class_name(struct symbol *sym);

-static inline int cf_symbol_is_constant(struct symbol *sym)
-{ return (sym->class & 0xff00) == SYM_CONSTANT; }
-
-
 /* Parser */

 extern char *cf_text;
--- a/conf/confbase.Y
+++ b/conf/confbase.Y
@ -19,6 +19,7 @@ CF_HDR
 #include "nest/protocol.h"
 #include "nest/iface.h"
 #include "nest/route.h"
+#include "nest/bfd.h"
 #include "nest/cli.h"
 #include "filter/filter.h"

@ -33,6 +34,21 @@ check_u16(uint val)
    cf_error("Value %u out of range (0-65535)", val);
 }

+#define cf_assert(cond, ...) do { if (!(cond)) cf_error(__VA_ARGS__); } while (0)
+static inline void cf_assert_symbol(const struct symbol *sym, uint class) {
+  switch (class) {
+    case SYM_PROTO: cf_assert(sym->class == SYM_PROTO, "Protocol name required"); break;
+    case SYM_TEMPLATE: cf_assert(sym->class == SYM_TEMPLATE, "Protocol template name required"); break;
+    case SYM_FUNCTION: cf_assert(sym->class == SYM_FUNCTION, "Function name required"); break;
+    case SYM_FILTER: cf_assert(sym->class == SYM_FILTER, "Filter name required"); break;
+    case SYM_TABLE: cf_assert(sym->class == SYM_TABLE, "Table name required"); break;
+    case SYM_ATTRIBUTE: cf_assert(sym->class == SYM_ATTRIBUTE, "Custom attribute name required"); break;
+    case SYM_VARIABLE: cf_assert((sym->class & ~0xff) == SYM_VARIABLE, "Variable name required"); break;
+    case SYM_CONSTANT: cf_assert((sym->class & ~0xff) == SYM_CONSTANT, "Constant name required"); break;
+    default: bug("This shall not happen");
+  }
+}
+
 CF_DECLS

 %union {
@ -45,19 +61,29 @@ CF_DECLS
  net_addr net;
  net_addr *net_ptr;
  struct symbol *s;
-  char *t;
+  const char *t;
  struct rtable_config *r;
  struct channel_config *cc;
+  struct channel *c;
  struct f_inst *x;
-  struct filter *f;
+  struct {
+    struct f_inst *begin, *end;
+  } xp;
+  enum filter_return fret;
+  enum ec_subtype ecs;
+  struct f_dynamic_attr fda;
+  struct f_static_attr fsa;
+  struct f_lval flv;
+  struct f_line *fl;
+  const struct filter *f;
  struct f_tree *e;
  struct f_trie *trie;
  struct f_val v;
-  struct f_path_mask *h;
  struct password_item *p;
  struct rt_show_data *ra;
  struct sym_show_data *sd;
  struct lsadb_show_data *ld;
+  struct mrt_dump_data *md;
  struct iface *iface;
  void *g;
  btime time;
@ -75,7 +101,7 @@ CF_DECLS
 %token <ip4> IP4
 %token <ip6> IP6
 %token <i64> VPN_RD
-%token <s> SYM
+%token <s> CF_SYM_KNOWN CF_SYM_UNDEFINED
 %token <t> TEXT
 %type <iface> ipa_scope

@ -83,10 +109,11 @@ CF_DECLS
 %type <time> expr_us time
 %type <a> ipa
 %type <net> net_ip4_ net_ip6_ net_ip6 net_ip_ net_ip net_or_ipa
-%type <net_ptr> net_ net_any net_vpn4_ net_vpn6_ net_vpn_ net_roa4_ net_roa6_ net_roa_ net_mpls_
+%type <net_ptr> net_ net_any net_vpn4_ net_vpn6_ net_vpn_ net_roa4_ net_roa6_ net_roa_ net_ip6_sadr_ net_mpls_
 %type <mls> label_stack_start label_stack

 %type <t> text opttext
+%type <s> symbol

 %nonassoc PREFIX_DUMMY
 %left AND OR
@ -96,7 +123,9 @@ CF_DECLS
 %left '!'
 %nonassoc '.'

-CF_KEYWORDS(DEFINE, ON, OFF, YES, NO, S, MS, US, PORT, VPN, MPLS)
+%start config
+
+CF_KEYWORDS(DEFINE, ON, OFF, YES, NO, S, MS, US, PORT, VPN, MPLS, FROM)

 CF_GRAMMAR

@ -111,36 +140,37 @@ conf_entries:
 | conf_entries conf
 ;

-CF_ADDTO(conf, ';')
+conf: ';' ;


 /* Constant expressions */

-CF_ADDTO(conf, definition)
+conf: definition ;
+
 definition:
-   DEFINE SYM '=' term ';' {
-     struct f_val *val = cfg_alloc(sizeof(struct f_val));
-     *val = f_eval($4, cfg_mem);
-     if (val->type == T_RETURN) cf_error("Runtime error");
-     cf_define_symbol($2, SYM_CONSTANT | val->type, val);
+   DEFINE symbol '=' term ';' {
+     struct f_val *val = cfg_allocz(sizeof(struct f_val));
+     if (f_eval(f_linearize($4), cfg_mem, val) > F_RETURN) cf_error("Runtime error");
+     cf_define_symbol($2, SYM_CONSTANT | val->type, val, val);
   }
 ;

 expr:
   NUM
- | '(' term ')' { $$ = f_eval_int($2); }
- | SYM {
-     if ($1->class != (SYM_CONSTANT | T_INT)) cf_error("Number expected");
+ | '(' term ')' { $$ = f_eval_int(f_linearize($2)); }
+ | CF_SYM_KNOWN {
+     if ($1->class != (SYM_CONSTANT | T_INT)) cf_error("Number constant expected");
     $$ = SYM_VAL($1).i; }
 ;

-
 expr_us:
   expr S  { $$ = $1 S_; }
 | expr MS { $$ = $1 MS_; }
 | expr US { $$ = $1 US_; }
 ;

+symbol: CF_SYM_UNDEFINED | CF_SYM_KNOWN ;
+
 /* Switches */

 bool:
@ -158,15 +188,15 @@ bool:
 ipa:
   IP4 { $$ = ipa_from_ip4($1); }
 | IP6 { $$ = ipa_from_ip6($1); }
- | SYM {
-     if ($1->class != (SYM_CONSTANT | T_IP)) cf_error("IP address expected");
+ | CF_SYM_KNOWN {
+     if ($1->class != (SYM_CONSTANT | T_IP)) cf_error("IP address constant expected");
     $$ = SYM_VAL($1).ip;
   }
 ;

 ipa_scope:
   /* empty */ { $$ = NULL; }
- | '%' SYM { $$ = if_get_by_name($2->name); }
+ | '%' symbol { $$ = if_get_by_name($2->name); }
 ;


@ -177,10 +207,6 @@ pxlen4:
     if ($2 > IP4_MAX_PREFIX_LENGTH) cf_error("Invalid prefix length %u", $2);
     $$ = $2;
   }
- | ':' IP4 {
-     $$ = ip4_masklen($2);
-     if ($$ == 255) cf_error("Invalid netmask %I4", $2);
-   }
 ;

 net_ip4_: IP4 pxlen4
@ -206,6 +232,25 @@ net_ip6_: IP6 '/' NUM
 	     n->prefix, n->pxlen, ip6_and(n->prefix, ip6_mkmask(n->pxlen)), n->pxlen);
 };

+net_ip6_sadr_: IP6 '/' NUM FROM IP6 '/' NUM
+{
+  if ($3 > IP6_MAX_PREFIX_LENGTH)
+    cf_error("Invalid prefix length %u", $3);
+
+  if ($7 > IP6_MAX_PREFIX_LENGTH)
+    cf_error("Invalid prefix length %u", $7);
+
+  $$ = cfg_alloc(sizeof(net_addr_ip6_sadr));
+  net_fill_ip6_sadr($$, $1, $3, $5, $7);
+
+  net_addr_ip6_sadr *n = (void *) $$;
+  if (!net_validate_ip6_sadr(n))
+    cf_error("Invalid SADR IPv6 prefix %I6/%d from %I6/%d, maybe you wanted %I6/%d from %I6/%d",
+	     n->dst_prefix, n->dst_pxlen, n->src_prefix, n->src_pxlen,
+	     ip6_and(n->dst_prefix, ip6_mkmask(n->dst_pxlen)), n->dst_pxlen,
+	     ip6_and(n->src_prefix, ip6_mkmask(n->src_pxlen)), n->src_pxlen);
+};
+
 net_vpn4_: VPN_RD net_ip4_
 {
  $$ = cfg_alloc(sizeof(net_addr_vpn4));
@ -249,6 +294,7 @@ net_:
 | net_vpn_
 | net_roa_
 | net_flow_
+ | net_ip6_sadr_
 | net_mpls_
 ;

@ -257,27 +303,27 @@ net_:

 net_ip6:
   net_ip6_
- | SYM {
+ | CF_SYM_KNOWN {
     if (($1->class != (SYM_CONSTANT | T_NET)) || (SYM_VAL($1).net->type != NET_IP6))
-       cf_error("IPv6 network expected");
+       cf_error("IPv6 network constant expected");
     $$ = * SYM_VAL($1).net;
   }
 ;

 net_ip:
   net_ip_
- | SYM {
+ | CF_SYM_KNOWN {
     if (($1->class != (SYM_CONSTANT | T_NET)) || !net_is_ip(SYM_VAL($1).net))
-       cf_error("IP network expected");
+       cf_error("IP network constant expected");
     $$ = * SYM_VAL($1).net;
   }
 ;

 net_any:
   net_
- | SYM {
+ | CF_SYM_KNOWN {
     if ($1->class != (SYM_CONSTANT | T_NET))
-       cf_error("Network expected");
+       cf_error("Network constant expected");
     $$ = (net_addr *) SYM_VAL($1).net; /* Avoid const warning */
   }
 ;
@ -287,13 +333,13 @@ net_or_ipa:
 | net_ip6_
 | IP4 { net_fill_ip4(&($$), $1, IP4_MAX_PREFIX_LENGTH); }
 | IP6 { net_fill_ip6(&($$), $1, IP6_MAX_PREFIX_LENGTH); }
- | SYM {
+ | CF_SYM_KNOWN {
     if ($1->class == (SYM_CONSTANT | T_IP))
       net_fill_ip_host(&($$), SYM_VAL($1).ip);
     else if (($1->class == (SYM_CONSTANT | T_NET)) && net_is_ip(SYM_VAL($1).net))
       $$ = * SYM_VAL($1).net;
     else
-       cf_error("IP address or network expected");
+       cf_error("IP address or network constant expected");
   }
 ;

@ -324,8 +370,8 @@ time:

 text:
   TEXT
- | SYM {
-     if ($1->class != (SYM_CONSTANT | T_STRING)) cf_error("String expected");
+ | CF_SYM_KNOWN {
+     if ($1->class != (SYM_CONSTANT | T_STRING)) cf_error("String constant expected");
     $$ = SYM_VAL($1).s;
   }
 ;
--- a/conf/gen_keywords.m4
+++ b/conf/gen_keywords.m4
@ -34,9 +34,11 @@ m4_define(CF_CLI, `CF_KEYWORDS(m4_translit($1, [[ ]], [[,]]))
 ')

 # Enums are translated to C initializers: use CF_ENUM(typename, prefix, values)
-m4_define(CF_enum, `m4_divert(1){ "CF_enum_prefix[[]]$1", -((CF_enum_type<<16) | CF_enum_prefix[[]]$1), NULL },
+# For different prefix: CF_ENUM_PX(typename, external prefix, C prefix, values)
+m4_define(CF_enum, `m4_divert(1){ "CF_enum_prefix_ext[[]]$1", -((CF_enum_type<<16) | CF_enum_prefix_int[[]]$1), NULL },
 m4_divert(-1)')
-m4_define(CF_ENUM, `m4_define([[CF_enum_type]],$1)m4_define([[CF_enum_prefix]],$2)CF_iterate([[CF_enum]], [[m4_shift(m4_shift($@))]])DNL')
+m4_define(CF_ENUM, `m4_define([[CF_enum_type]],$1)m4_define([[CF_enum_prefix_ext]],$2)m4_define([[CF_enum_prefix_int]],$2)CF_iterate([[CF_enum]], [[m4_shift(m4_shift($@))]])DNL')
+m4_define(CF_ENUM_PX, `m4_define([[CF_enum_type]],$1)m4_define([[CF_enum_prefix_ext]],$2)m4_define([[CF_enum_prefix_int]],$3)CF_iterate([[CF_enum]], [[m4_shift(m4_shift(m4_shift($@)))]])DNL')

 # After all configuration templates end, we generate the 
 m4_m4wrap(`
--- a/conf/gen_parser.m4
+++ b/conf/gen_parser.m4
@ -34,21 +34,17 @@ m4_define(CF_keywd, `m4_ifdef([[CF_tok_$1]],,[[m4_define([[CF_tok_$1]],1)m4_defi
 m4_define(CF_KEYWORDS, `m4_define([[CF_toks]],[[]])CF_iterate([[CF_keywd]], [[$@]])m4_ifelse(CF_toks,,,%token[[]]CF_toks
 )DNL')

-# Dynamic syntax rules
-m4_define(CF_dyn_rules,)
-m4_define(CF_ADDTO, `m4_define([[CF_rule_$1]],m4_ifdef([[CF_rule_$1]],CF_rule_$1 | ,[[m4_define([[CF_dyn_rules]],CF_dyn_rules[[CF_RULE($1)
-]])]])$2)DNL')
-
 # CLI commands
 m4_define(CF_CLI, `m4_define([[CF_cmd]], cmd_[[]]m4_translit($1, [[ ]], _))DNL
 m4_divert(2)CF_KEYWORDS(m4_translit($1, [[ ]], [[,]]))
-m4_divert(3)CF_ADDTO(cli_cmd, CF_cmd)
+m4_divert(3)cli_cmd: CF_cmd
 CF_cmd: $1 $2 END')
 m4_define(CF_CLI_CMD, `')
 m4_define(CF_CLI_HELP, `')

 # ENUM declarations are ignored
 m4_define(CF_ENUM, `')
+m4_define(CF_ENUM_PX, `')

 # After all configuration templates end, we finally generate the grammar file.
 m4_m4wrap(`
@ -62,10 +58,6 @@ m4_undivert(2)DNL
 %%
 m4_undivert(3)DNL

-/* Dynamic rules */
-
-m4_define(CF_RULE, [[$1: CF_rule_$1 ;]])
-CF_dyn_rules
 %%
 m4_undivert(4)DNL
 ')
--- a/configure.ac
+++ b/configure.ac
@ -18,6 +18,18 @@ AC_ARG_ENABLE([debug],
  [enable_debug=no]
 )

+AC_ARG_ENABLE([debug-generated],
+  [AS_HELP_STRING([--enable-debug-generated], [enable this to abstain from generating #line @<:@no@:>@])],
+  [],
+  [enable_debug_generated=no]
+)
+
+AC_ARG_ENABLE([debug-expensive],
+  [AS_HELP_STRING([--enable-debug-expensive], [enable expensive consistency checks (implies --enable-debug) @<:@no@:>@])],
+  [],
+  [enable_debug_expensive=no]
+)
+
 AC_ARG_ENABLE([memcheck],
  [AS_HELP_STRING([--enable-memcheck], [check memory allocations when debugging @<:@yes@:>@])],
  [],
@ -31,7 +43,7 @@ AC_ARG_ENABLE([pthreads],
 )

 AC_ARG_ENABLE([libssh],
-  [AS_HELP_STRING([--enable-libssh], [enable LibSSH support together with RPKI @<:@try@:>@])],
+  [AS_HELP_STRING([--enable-libssh], [enable LibSSH support in RPKI @<:@try@:>@])],
  [],
  [enable_libssh=try]
 )
@ -49,14 +61,12 @@ AC_ARG_WITH([protocols],
 )

 AC_ARG_WITH([sysconfig],
-  [AS_HELP_STRING([--with-sysconfig=FILE], [use specified BIRD system configuration file])],
-  []
+  [AS_HELP_STRING([--with-sysconfig=FILE], [use specified BIRD system configuration file])]
 )

 AC_ARG_WITH([runtimedir],
-  [AS_HELP_STRING([--with-runtimedir=PATH], [path for runtime files @<:@LOCALSTATEDIR/run@:>@])],
-  [runtimedir="$with_runtimedir"],
-  [runtimedir="\$(localstatedir)/run"]
+  [AS_HELP_STRING([--with-runtimedir=PATH], [run-state data, obsolete variant of --runstatedir])],
+  [runstatedir="$with_runtimedir"]
 )

 AC_ARG_WITH([iproutedir],
@ -68,6 +78,9 @@ AC_ARG_VAR([FLEX], [location of the Flex program])
 AC_ARG_VAR([BISON], [location of the Bison program])
 AC_ARG_VAR([M4], [location of the M4 program])

+if test "$enable_debug_expensive" = yes; then
+  enable_debug=yes
+fi

 if test "$srcdir" = . ; then
  # Building in current directory => create obj directory holding all objects
@ -82,17 +95,15 @@ exedir=.
 AC_SUBST([objdir])
 AC_SUBST([exedir])
 AC_SUBST([srcdir])
-AC_SUBST([runtimedir])

+# Workaround for older Autoconfs that do not define runstatedir
+AS_IF([test -z "${runstatedir}"], [runstatedir='${localstatedir}/run'])
+AC_SUBST([runstatedir])

-if test "$enable_debug" = yes ; then
-  CONFIG_FILE="bird.conf"
-  CONTROL_SOCKET="bird.ctl"
-else
-  CONFIG_FILE="\$(sysconfdir)/bird.conf"
-  CONTROL_SOCKET="$runtimedir/bird.ctl"
-fi
+CONFIG_FILE="\$(sysconfdir)/bird.conf"
 AC_SUBST([CONFIG_FILE])
+
+CONTROL_SOCKET="\$(runstatedir)/bird.ctl"
 AC_SUBST([CONTROL_SOCKET])

 AC_SEARCH_LIBS([clock_gettime], [rt posix4],
@ -113,6 +124,11 @@ if test -z "$GCC" ; then
  AC_MSG_ERROR([This program requires the GNU C Compiler.])
 fi

+BIRD_CHECK_THREAD_LOCAL
+if test "$bird_cv_thread_local" = yes ; then
+  AC_DEFINE([HAVE_THREAD_LOCAL], [1], [Define to 1 if _Thread_local is available])
+fi
+
 if test "$enable_pthreads" != no ; then
  BIRD_CHECK_PTHREADS

@ -130,21 +146,35 @@ if test "$enable_pthreads" != no ; then
  fi
 fi

+# This is assumed to be necessary for proper BIRD build
+CFLAGS="$CFLAGS -fno-strict-aliasing -fno-strict-overflow"
+
 if test "$bird_cflags_default" = yes ; then
  BIRD_CHECK_GCC_OPTION([bird_cv_c_option_wno_pointer_sign], [-Wno-pointer-sign], [-Wall])
  BIRD_CHECK_GCC_OPTION([bird_cv_c_option_wno_missing_init], [-Wno-missing-field-initializers], [-Wall -Wextra])
-  BIRD_CHECK_GCC_OPTION([bird_cv_c_option_fno_strict_aliasing], [-fno-strict-aliasing])
-  BIRD_CHECK_GCC_OPTION([bird_cv_c_option_fno_strict_overflow], [-fno-strict-overflow])
+
+  if test "$enable_debug" = no; then
+    BIRD_CHECK_LTO
+  fi
+
+  if test "$bird_cv_c_lto" = yes; then
+    CFLAGS="$CFLAGS -flto"
+    LDFLAGS="$LDFLAGS -flto=4 -g"
+  else
+    LDFLAGS="$LDFLAGS -g"
+  fi

  CFLAGS="$CFLAGS -Wall -Wextra -Wstrict-prototypes -Wno-parentheses"
  BIRD_ADD_GCC_OPTION([bird_cv_c_option_wno_pointer_sign], [-Wno-pointer-sign])
  BIRD_ADD_GCC_OPTION([bird_cv_c_option_wno_missing_init], [-Wno-missing-field-initializers])
-  BIRD_ADD_GCC_OPTION([bird_cv_c_option_fno_strict_aliasing], [-fno-strict-aliasing])
-  BIRD_ADD_GCC_OPTION([bird_cv_c_option_fno_strict_overflow], [-fno-strict-overflow])
 fi
+
+
 AC_MSG_CHECKING([CFLAGS])
 AC_MSG_RESULT([$CFLAGS])

+AC_MSG_CHECKING([LDFLAGS])
+AC_MSG_RESULT([$LDFLAGS])

 AC_PROG_CPP
 AC_PROG_INSTALL
@ -157,6 +187,20 @@ test -z "$FLEX"	 && AC_MSG_ERROR([Flex is missing.])
 test -z "$BISON" && AC_MSG_ERROR([Bison is missing.])
 test -z "$M4"	 && AC_MSG_ERROR([M4 is missing.])

+AC_MSG_CHECKING([bison version])
+BIRD_CHECK_BISON_VERSION(BISON_VERSION)
+AC_MSG_RESULT([$BISON_VERSION])
+if test "$bird_bison_synclines" = yes && test "$enable_debug_generated" = no; then
+  M4FLAGS="$M4FLAGS -s"
+fi
+
+if test "$bird_bison_enhanced_error" = yes; then
+  BISONFLAGS="$BISONFLAGS -Dparse.lac=full -Dparse.error=verbose"
+fi
+
+AC_SUBST([M4FLAGS])
+AC_SUBST([BISONFLAGS])
+
 BIRD_CHECK_PROG_FLAVOR_GNU([$M4],
  [],
  [AC_MSG_ERROR([Provided M4 is not GNU M4.])]
@ -236,7 +280,6 @@ if test "$enable_libssh" != no ; then
  if test "$fail" != yes ; then
    AC_DEFINE([HAVE_LIBSSH], [1], [Define to 1 if you have the `ssh' library (-lssh).])
    DAEMON_LIBS="-lssh $DAEMON_LIBS"
-    proto_rpki=rpki
    enable_libssh=yes
  else
    if test "$enable_libssh" = yes ; then
@ -261,7 +304,7 @@ if test "$enable_mpls_kernel" != no ; then
  fi
 fi

-all_protocols="$proto_bfd babel bgp ospf pipe radv rip $proto_rpki static"
+all_protocols="$proto_bfd babel bgp mrt ospf perf pipe radv rip rpki static"

 all_protocols=`echo $all_protocols | sed 's/ /,/g'`

@ -272,6 +315,7 @@ fi
 AH_TEMPLATE([CONFIG_BABEL], 	[Babel protocol])
 AH_TEMPLATE([CONFIG_BFD],	[BFD protocol])
 AH_TEMPLATE([CONFIG_BGP],	[BGP protocol])
+AH_TEMPLATE([CONFIG_MRT],	[MRT protocol])
 AH_TEMPLATE([CONFIG_OSPF],	[OSPF protocol])
 AH_TEMPLATE([CONFIG_PIPE],	[Pipe protocol])
 AH_TEMPLATE([CONFIG_RADV],	[RAdv protocol])
@ -315,10 +359,27 @@ AC_C_BIGENDIAN(
  [AC_MSG_ERROR([Cannot determine CPU endianity.])]
 )

+BIRD_CHECK_ANDROID_GLOB
+if test "$bird_cv_lib_glob" = no ; then
+  AC_MSG_ERROR([glob.h not found.])
+elif test "$bird_cv_lib_glob" != yes ; then
+  LIBS="$LIBS $bird_cv_lib_glob"
+fi
+
+BIRD_CHECK_ANDROID_LOG
+if test "$bird_cv_lib_log" = no ; then
+  AC_MSG_ERROR([don't know how to link syslog.])
+elif test "$bird_cv_lib_log" != yes ; then
+  LIBS="$LIBS $bird_cv_lib_log"
+fi
+
 if test "$enable_debug" = yes ; then
  AC_DEFINE([DEBUGGING], [1], [Define to 1 if debugging is enabled])
  LDFLAGS="$LDFLAGS -rdynamic"
-  CFLAGS="$CFLAGS -O0 -ggdb -g3 -gdwarf-4"
+  CFLAGS="$CFLAGS -O0 -ggdb -g3"
+
+  BIRD_CHECK_GCC_OPTION([bird_cv_c_option_dwarf4], [-gdwarf-4], [])
+  BIRD_ADD_GCC_OPTION([bird_cv_c_option_dwarf4], [-gdwarf-4])

  AC_CHECK_HEADER([execinfo.h],
    [
@ -336,6 +397,10 @@ if test "$enable_debug" = yes ; then
      AC_CHECK_LIB([efence], [malloc])
    fi
  fi
+
+  if test "enable_debug_expensive" = yes ; then
+    AC_DEFINE([ENABLE_EXPENSIVE_CHECKS], [1], [Define to 1 if you want to run expensive consistency checks.])
+  fi
 fi

 CLIENT=birdcl
@ -400,6 +465,7 @@ AC_MSG_RESULT([        System configuration:	$sysdesc])
 AC_MSG_RESULT([        Debugging:		$enable_debug])
 AC_MSG_RESULT([        POSIX threads:		$enable_pthreads])
 AC_MSG_RESULT([        Routing protocols:	$protocols])
+AC_MSG_RESULT([        LibSSH support in RPKI:	$enable_libssh])
 AC_MSG_RESULT([        Kernel MPLS support:	$enable_mpls_kernel])
 AC_MSG_RESULT([        Client:			$enable_client])

--- a/doc/Doc
+++ b/doc/Doc
@ -1 +0,0 @@
-D prog-intro.sgml
--- a/doc/LinuxDocTools.pm
+++ b/doc/LinuxDocTools.pm
@ -242,6 +242,7 @@ sub process_options
  #   removes iso-entites sub directory after doing make install.)
  #
  $ENV{SGML_CATALOG_FILES} .= (defined $ENV{SGML_CATALOG_FILES} ? ":" : "") .
+     "$main::prefix/share/sgml/sgml-iso-entities-8879.1986/catalog:" .
     "$main::prefix/share/sgml/entities/sgml-iso-entities-8879.1986/catalog";
  $ENV{SGML_CATALOG_FILES} .= ":$main::DataDir/linuxdoc-tools.catalog";
  $ENV{SGML_CATALOG_FILES} .= ":$main::/etc/sgml.catalog";
--- a/doc/bird.conf.example
+++ b/doc/bird.conf.example
@ -1,222 +1,204 @@
-/*
- *	This is an example configuration file
- *	(for version 1.x.x, obsolete)
- */
-
-# Yes, even shell-like comments work...
+# This is a basic configuration file, which contains boilerplate options and
+# some basic examples. It allows the BIRD daemon to start but will not cause
+# anything else to happen.
+#
+# Please refer to the BIRD User's Guide documentation, which is also available
+# online at http://bird.network.cz/ in HTML format, for more information on
+# configuring BIRD and adding routing protocols.

 # Configure logging
-#log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
-#log stderr all;
-#log "tmp" all;
+log syslog all;
+# log "/var/log/bird.log" { debug, trace, info, remote, warning, error, auth, fatal, bug };

-# Override router ID
-#router id 198.51.100.1;
+# Set router ID. It is a unique identification of your router, usually one of
+# IPv4 addresses of the router. It is recommended to configure it explicitly.
+# router id 198.51.100.1;

-# You can define your own symbols...
-#define xyzzy = (120+10);
-#define '1a-a1' = (30+40);
-
-# Define a route filter...
-#filter test_filter {
-#	if net ~ 10.0.0.0/16 then accept;
-#	else reject;
-#}
-
-#filter sink { reject; }
-#filter okay { accept; }
-
-#include "filters.conf";
-
-# Define another routing table
-#table testable;
-
-# Turn on global debugging of all protocols
-#debug protocols all;
+# Turn on global debugging of all protocols (all messages or just selected classes)
+# debug protocols all;
+# debug protocols { events, states };

 # Turn on internal watchdog
-#watchdog warning 5 s;
-#watchdog timeout 30 s;
+# watchdog warning 5 s;
+# watchdog timeout 30 s;

-# The direct protocol automatically generates device routes to
-# all network interfaces. Can exist in as many instances as you wish
-# if you want to populate multiple routing tables with device routes.
-#protocol direct {
-#	interface "-eth*", "*";	# Restrict network interfaces it works with
-#}
+# You can define your own constants
+# define my_asn = 65000;
+# define my_addr = 198.51.100.1;

-# This pseudo-protocol performs synchronization between BIRD's routing
-# tables and the kernel. If your kernel supports multiple routing tables
-# (as Linux 2.2.x does), you can run multiple instances of the kernel
-# protocol and synchronize different kernel tables with different BIRD tables.
-protocol kernel {
-#	learn;			# Learn all alien routes from the kernel
-	persist;		# Don't remove routes on bird shutdown
-	scan time 20;		# Scan kernel routing table every 20 seconds
-#	import none;		# Default is import all
-	export all;		# Default is export none
-#	kernel table 5;		# Kernel table to synchronize with (default: main)
-}
+# Tables master4 and master6 are defined by default
+# ipv4 table master4;
+# ipv6 table master6;

-# This pseudo-protocol watches all interface up/down events.
+# Define more tables, e.g. for policy routing or as MRIB
+# ipv4 table mrib4;
+# ipv6 table mrib6;
+
+# The Device protocol is not a real routing protocol. It does not generate any
+# routes and it only serves as a module for getting information about network
+# interfaces from the kernel. It is necessary in almost any configuration.
 protocol device {
-	scan time 10;		# Scan interfaces every 10 seconds
 }

-# Static routes (again, there can be multiple instances, so that you
-# can disable/enable various groups of static routes on the fly).
+# The direct protocol is not a real routing protocol. It automatically generates
+# direct routes to all network interfaces. Can exist in as many instances as you
+# wish if you want to populate multiple routing tables with direct routes.
+protocol direct {
+	disabled;		# Disable by default
+	ipv4;			# Connect to default IPv4 table
+	ipv6;			# ... and to default IPv6 table
+}
+
+# The Kernel protocol is not a real routing protocol. Instead of communicating
+# with other routers in the network, it performs synchronization of BIRD
+# routing tables with the OS kernel. One instance per table.
+protocol kernel {
+	ipv4 {			# Connect protocol to IPv4 table by channel
+#	      table master4;	# Default IPv4 table is master4
+#	      import all;	# Import to table, default is import all
+	      export all;	# Export to protocol. default is export none
+	};
+#	learn;			# Learn alien routes from the kernel
+#	kernel table 10;	# Kernel table to synchronize with (default: main)
+}
+
+# Another instance for IPv6, skipping default options
+protocol kernel {
+	ipv6 { export all; };
+}
+
+# Static routes (Again, there can be multiple instances, for different address
+# families and to disable/enable various groups of static routes on the fly).
 protocol static {
-#	disabled;		# Disable by default
-#	table testable;		# Connect to a non-default table
-#	preference 1000;	# Default preference of routes
-#	debug { states, routes, filters, interfaces, events, packets };
-#	debug all;
-#	route 0.0.0.0/0 via 198.51.100.13;
-#	route 198.51.100.0/25 unreachable;
+	ipv4;			# Again, IPv4 channel with default options
+
+#	route 0.0.0.0/0 via 198.51.100.10;
+#	route 192.0.2.0/24 blackhole;
 #	route 10.0.0.0/8 unreachable;
-#	route 10.1.1.0:255.255.255.0 via 198.51.100.3;
-#	route 10.1.2.0:255.255.255.0 via 198.51.100.3;
-#	route 10.1.3.0:255.255.255.0 via 198.51.100.4;
-#	route 10.2.0.0/24 via "arc0";
+#	route 10.2.0.0/24 via "eth0";
+#	# Static routes can be defined with optional attributes
+#	route 10.1.1.0/24 via 198.51.100.3 { rip_metric = 3; };
+#	route 10.1.2.0/24 via 198.51.100.3 { ospf_metric1 = 100; };
+#	route 10.1.3.0/24 via 198.51.100.4 { ospf_metric2 = 100; };
 }

-# Pipe protocol connects two routing tables... Beware of loops.
-#protocol pipe {
-#	peer table testable;
-# Define what routes do we export to this protocol / import from it.
-#	import all;		# default is all
-#	export all;		# default is none
-#	import none;		# If you wish to disable imports
-#	import filter test_filter;		# Use named filter
-#	import where source = RTS_DEVICE;	# Use explicit filter
-#}
+# Pipe protocol connects two routing tables. Beware of loops.
+# protocol pipe {
+#	table master4;		# No ipv4/ipv6 channel definition like in other protocols
+#	peer table mrib4;
+#	import all;		# Direction peer table -> table
+#	export all;		# Direction table -> peer table
+# }

-# RIP aka Rest In Pieces...
-#protocol rip MyRIP {	# You can also use an explicit name
-#	preference xyzzy;
-#	debug all;
-#	port 1520;
-#	period 7;
-#	infinity 16;
-#	garbage time 60;
-#	interface "*" { mode broadcast; };
-#	honor neighbor;		# To whom do we agree to send the routing table
-#	honor always;
-#	honor never;
-#	passwords {
-#		password "nazdar";
+# RIP example, both RIP and RIPng are supported
+# protocol rip {
+#	ipv4 {
+#		# Export direct, static routes and ones from RIP itself
+#		import all;
+#		export where source ~ [ RTS_DEVICE, RTS_STATIC, RTS_RIP ];
 #	};
-#	authentication none;
-#	import filter { print "importing"; accept; };
-#	export filter { print "exporting"; accept; };
-#}
+#	interface "eth*" {
+#	  	update time 10;			# Default period is 30
+#		timeout time 60;		# Default timeout is 180
+#		authentication cryptographic;	# No authentication by default
+#		password "hello" { algorithm hmac sha256; }; # Default is MD5
+#	};
+# }

-#protocol ospf MyOSPF {
-#       tick 2;
-#	rfc1583compat yes;
-#	area 0.0.0.0 {
-#		stub no;
+# OSPF example, both OSPFv2 and OSPFv3 are supported
+# protocol ospf v3 {
+#  	ipv6 {
+#		import all;
+#		export where source = RTS_STATIC;
+#	};
+#	area 0 {
 #		interface "eth*" {
-#			hello 9;
-#			retransmit 6;
-#			cost 10;
-#			transmit delay 5;
-#			dead count 5;
-#			wait 50;
-#			type broadcast;
-#			authentication simple;
-#			password "pass";
+#			type broadcast;		# Detected by default
+#			cost 10;		# Interface metric
+#			hello 5;		# Default hello perid 10 is too long
 #		};
-#		interface "arc0" {
-#			rx buffer large;
-#			type nonbroadcast;
-#			poll 14;
-#			dead 75;
-#			neighbors {
-#				10.1.1.2 eligible;
-#				10.1.1.4;
-#			};
-#			strict nonbroadcast yes;
+#		interface "tun*" {
+#			type ptp;		# PtP mode, avoids DR selection
+#			cost 100;		# Interface metric
+#			hello 5;		# Default hello perid 10 is too long
 #		};
-#		interface "xxx0" {
-#                       passwords {
-#				password "abc" {
-#					id 1;
-#					generate to "22-04-2003 11:00:06";
-#					accept to "17-01-2004 12:01:05";
-#				};
-#				password "def" {
-#					id 2;
-#					generate from "22-04-2003 11:00:07";
-#					accept from "17-01-2003 12:01:05";
-#				};
-#			};
-#                       authentication cryptographic;
+#		interface "dummy0" {
+#			stub;			# Stub interface, just propagate it
 #		};
 #	};
-#	area 20 {
-#		stub 1;
-#		interface "ppp1" {
-#			hello 8;
-#			authentication none;
-#		};
-#               interface "fr*";
-#               virtual link 192.168.0.1 {
-#                       password "sdsdffsdfg";
-#                       authentication cryptographic;
-#               };
-#	};
 #}

+# Define simple filter as an example for BGP import filter
+# See https://gitlab.labs.nic.cz/labs/bird/wikis/BGP_filtering for more examples
+# filter rt_import
+# {
+#	if bgp_path.first != 64496 then accept;
+#	if bgp_path.len > 64 then accept;
+#	if bgp_next_hop != from then accept;
+#	reject;
+# }

-#protocol bgp {
-#	disabled;
+# BGP example, explicit name 'uplink1' is used instead of default 'bgp1'
+# protocol bgp uplink1 {
 #	description "My BGP uplink";
-#	local as 65000;
-#	neighbor 198.51.100.130 as 64496;
-#	multihop;
-#	hold time 240;
-#	startup hold time 240;
-#	connect retry time 120;
-#	keepalive time 80;	# defaults to hold time / 3
-#	start delay time 5;	# How long do we wait before initial connect
-#	error wait time 60, 300;# Minimum and maximum time we wait after an error (when consecutive
-#				# errors occur, we increase the delay exponentially ...
-#	error forget time 300;	# ... until this timeout expires)
-#	disable after error;	# Disable the protocol automatically when an error occurs
-#	next hop self;		# Disable next hop processing and always advertise our local address as nexthop
-#	path metric 1;		# Prefer routes with shorter paths (like Cisco does)
-#	default bgp_med 0;	# MED value we use for comparison when none is defined
-#	default bgp_local_pref 0;	# The same for local preference
-#	source address 198.51.100.14;	# What local address we use for the TCP connection
+#	local 198.51.100.1 as 65000;
+#	neighbor 198.51.100.10 as 64496;
+#	hold time 90;		# Default is 240
 #	password "secret";	# Password used for MD5 authentication
-#	rr client;		# I am a route reflector and the neighor is my client
-#	rr cluster id 1.0.0.1;	# Use this value for cluster id instead of my router id
-#	export where source=RTS_STATIC;
-#	export filter {
-#		if source = RTS_STATIC then {
-#			bgp_community = -empty-; bgp_community = add(bgp_community,(65000,5678));
-#			bgp_origin = 0;
-#			bgp_community = -empty-; bgp_community.add((65000,5678));
-#			if (65000,64501) ~ bgp_community then
-#				bgp_community.add((0, 1));
-#			if bgp_path ~ [= 65000 =] then
-#				bgp_path.prepend(65000);
-#			accept;
-#		}
-#		reject;
+#
+#	ipv4 {			# regular IPv4 unicast (1/1)
+#		import filter rt_import;
+#		export where source ~ [ RTS_STATIC, RTS_BGP ];
+#	};
+#
+#	ipv6 {			# regular IPv6 unicast (2/1)
+#		import filter rt_import;
+#		export filter {	# The same as 'where' expression above
+#			if source ~ [ RTS_STATIC, RTS_BGP ]
+#			then accept;
+#			else reject;
+#		};
+#	};
+#
+#	ipv4 multicast {	# IPv4 multicast topology (1/2)
+#		table mrib4;	# explicit IPv4 table
+#		import filter rt_import;
+#		export all;
+#	};
+#
+#	ipv6 multicast {	# IPv6 multicast topology (2/2)
+#		table mrib6;	# explicit IPv6 table
+#		import filter rt_import;
+#		export all;
 #	};
 #}
-#
-# Template usage example
-#template bgp rr_client {
-#	disabled;
-#	local as 65000;
-#	multihop;
+
+# Template example. Using templates to define IBGP route reflector clients.
+# template bgp rr_clients {
+#	local 10.0.0.1 as 65000;
+#	neighbor as 65000;
 #	rr client;
 #	rr cluster id 1.0.0.1;
-#}
 #
-#protocol bgp rr_abcd from rr_client {
-#	neighbor 10.1.4.7 as 65000;
-#}
+#	ipv4 {
+#		import all;
+#		export where source = RTS_BGP;
+#	};
+#
+#	ipv6 {
+#		import all;
+#		export where source = RTS_BGP;
+#	};
+# }
+#
+# protocol bgp client1 from rr_clients {
+#	neighbor 10.0.1.1;
+# }
+#
+# protocol bgp client2 from rr_clients {
+#	neighbor 10.0.2.1;
+# }
+#
+# protocol bgp client3 from rr_clients {
+#	neighbor 10.0.3.1;
+# }
--- a/doc/bird.conf.example2
+++ b/doc/bird.conf.example2
@ -1,5 +1,5 @@
 /*
- *	This is an example configuration file for MB-BGP setting
+ *	This is an example configuration file for MP-BGP setting
 */


@ -28,20 +28,15 @@ flow6 table flowtab6;


 protocol device {
-	scan time 10;
 }

 protocol kernel kernel4 {
-	scan time 20;
-
 	ipv4 {
 		export all;
 	};
 }

 protocol kernel kernel6 {
-	scan time 20;
-
 	ipv6 {
 		export all;
 	};
@ -169,8 +164,6 @@ protocol pipe {
 }

 protocol ospf v2 ospf4 {
-#	ecmp;
-
 	ipv4 {
 		import all;
 #		export where source = RTS_STATIC;
@ -186,8 +179,6 @@ protocol ospf v2 ospf4 {


 protocol ospf v3 ospf6 {
-#	ecmp;
-
 	ipv6 {
 		import all;
 #		export where source = RTS_STATIC;
@ -251,7 +242,7 @@ protocol bgp {
 	};

 	# IPv6 with MPLS labels (2/4)
-	ipv6 multicast {
+	ipv6 mpls {
 		# explicit IPv6 table
 		table mtab6;
 		import all;
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
--- a/doc/prog-root
+++ b/doc/prog-root
@ -1,5 +1,5 @@
 D doc/prog-head.sgml
-C doc
+D doc/prog-intro.sgml
 C nest
 C conf
 C filter
--- a/doc/reply_codes
+++ b/doc/reply_codes
@ -33,6 +33,7 @@ Reply codes of BIRD command-line interface
 0022	Undo scheduled
 0023	Evaluation of expression
 0024	Graceful restart status report
+0025	Graceful restart ordered

 1000	BIRD version
 1001	Interface list
--- a/doc/sgml2html
+++ b/doc/sgml2html
@ -34,7 +34,12 @@ $progs = {
  "GROFFMACRO" => "-ms",
  "AWK" => "/usr/share/linuxdoc-tools/awkwhich"
 };
-$ENV{"SGML_CATALOG_FILES"} = "$DataDir/dtd/catalog";
+
+if (! -x $progs->{"NSGMLS"})
+  { $progs->{"NSGMLS"} = "/usr/bin/onsgmls"; }
+
+$ENV{"SGML_CATALOG_FILES"} = "$DataDir/dtd/catalog" .
+  (defined $ENV{SGML_CATALOG_FILES} ? ":$ENV{SGML_CATALOG_FILES}" : "");

 require "$FindBin::Bin/LinuxDocTools.pm";
 &LinuxDocTools::init;
--- a/doc/sgml2latex
+++ b/doc/sgml2latex
@ -34,7 +34,12 @@ $progs = {
  "GROFFMACRO" => "-ms",
  "AWK" => "/usr/share/linuxdoc-tools/awkwhich"
 };
-$ENV{"SGML_CATALOG_FILES"} = "$DataDir/dtd/catalog";
+
+if (! -x $progs->{"NSGMLS"})
+  { $progs->{"NSGMLS"} = "/usr/bin/onsgmls"; }
+
+$ENV{"SGML_CATALOG_FILES"} = "$DataDir/dtd/catalog" .
+  (defined $ENV{SGML_CATALOG_FILES} ? ":$ENV{SGML_CATALOG_FILES}" : "");

 require "$FindBin::Bin/LinuxDocTools.pm";
 &LinuxDocTools::init;
--- a/doc/sgml2txt
+++ b/doc/sgml2txt
@ -34,7 +34,12 @@ $progs = {
  "GROFFMACRO" => "-ms",
  "AWK" => "/usr/share/linuxdoc-tools/awkwhich"
 };
-$ENV{"SGML_CATALOG_FILES"} = "$DataDir/dtd/catalog";
+
+if (! -x $progs->{"NSGMLS"})
+  { $progs->{"NSGMLS"} = "/usr/bin/onsgmls"; }
+
+$ENV{"SGML_CATALOG_FILES"} = "$DataDir/dtd/catalog" .
+  (defined $ENV{SGML_CATALOG_FILES} ? ":$ENV{SGML_CATALOG_FILES}" : "");

 require "$FindBin::Bin/LinuxDocTools.pm";
 &LinuxDocTools::init;
--- a/filter/Makefile
+++ b/filter/Makefile
@ -1,8 +1,24 @@
-src := filter.c f-util.c tree.c trie.c
+src := filter.c data.c f-util.c tree.c trie.c inst-gen.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)

+#M4FLAGS_FILTERS=$(filter-out -s,$(M4FLAGS))
+M4FLAGS_FILTERS=$(M4FLAGS)
+
+$(o)inst-gen.h: $(s)decl.m4 $(s)f-inst.c $(objdir)/.dir-stamp
+	$(M4) $(M4FLAGS_FILTERS) -DTARGET=H -P $^ >$@
+
+$(o)inst-gen.c: $(s)decl.m4 $(s)f-inst.c $(objdir)/.dir-stamp
+	$(M4) $(M4FLAGS_FILTERS) -DTARGET=C -P $^ >$@
+
+$(o)inst-interpret.c: $(s)decl.m4 $(s)f-inst.c $(objdir)/.dir-stamp
+	$(M4) $(M4FLAGS_FILTERS) -DTARGET=I -P $^ >$@
+
+prepare: $(o)inst-interpret.c $(o)inst-gen.h
+
 tests_src := tree_test.c filter_test.c trie_test.c
 tests_targets := $(tests_targets) $(tests-target-files)
 tests_objs := $(tests_objs) $(src-o-files)
+
+$(call clean,inst-gen.h inst-gen.c inst-interpret.c)
--- a/filter/config.Y
+++ b/filter/config.Y
--- a/filter/data.c
+++ b/filter/data.c
@ -0,0 +1,601 @@
+/*
+ *	Filters: utility functions
+ *
+ *	(c) 1998 Pavel Machek <pavel@ucw.cz>
+ *	(c) 2019 Maria Matejka <mq@jmq.cz>
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ *
+ */
+
+#include "nest/bird.h"
+#include "lib/lists.h"
+#include "lib/resource.h"
+#include "lib/socket.h"
+#include "lib/string.h"
+#include "lib/unaligned.h"
+#include "lib/net.h"
+#include "lib/ip.h"
+#include "nest/route.h"
+#include "nest/protocol.h"
+#include "nest/iface.h"
+#include "nest/attrs.h"
+#include "conf/conf.h"
+#include "filter/filter.h"
+#include "filter/f-inst.h"
+#include "filter/data.h"
+
+static const char * const f_type_str[] = {
+  [T_VOID]	= "void",
+
+  [T_INT]	= "int",
+  [T_BOOL]	= "bool",
+  [T_PAIR]	= "pair",
+  [T_QUAD]	= "quad",
+
+  [T_ENUM_RTS]	= "enum rts",
+  [T_ENUM_BGP_ORIGIN] = "enum bgp_origin",
+  [T_ENUM_SCOPE] = "enum scope",
+  [T_ENUM_RTC]	= "enum rtc",
+  [T_ENUM_RTD]	= "enum rtd",
+  [T_ENUM_ROA]	= "enum roa",
+  [T_ENUM_NETTYPE] = "enum nettype",
+  [T_ENUM_RA_PREFERENCE] = "enum ra_preference",
+  [T_ENUM_AF]	= "enum af",
+
+  [T_IP]	= "ip",
+  [T_NET]	= "prefix",
+  [T_STRING]	= "string",
+  [T_PATH_MASK]	= "bgpmask",
+  [T_PATH]	= "bgppath",
+  [T_CLIST]	= "clist",
+  [T_EC]	= "ec",
+  [T_ECLIST]	= "eclist",
+  [T_LC]	= "lc",
+  [T_LCLIST]	= "lclist",
+  [T_RD]	= "rd",
+};
+
+const char *
+f_type_name(enum f_type t)
+{
+  if (t < ARRAY_SIZE(f_type_str))
+    return f_type_str[t] ?: "?";
+
+  if ((t == T_SET) || (t == T_PREFIX_SET))
+    return "set";
+
+  return "?";
+}
+
+const struct f_val f_const_empty_path = {
+  .type = T_PATH,
+  .val.ad = &null_adata,
+}, f_const_empty_clist = {
+  .type = T_CLIST,
+  .val.ad = &null_adata,
+}, f_const_empty_eclist = {
+  .type = T_ECLIST,
+  .val.ad = &null_adata,
+}, f_const_empty_lclist = {
+  .type = T_LCLIST,
+  .val.ad = &null_adata,
+};
+
+static struct adata *
+adata_empty(struct linpool *pool, int l)
+{
+  struct adata *res = lp_alloc(pool, sizeof(struct adata) + l);
+  res->length = l;
+  return res;
+}
+
+static void
+pm_format(const struct f_path_mask *p, buffer *buf)
+{
+  int loop = 0;
+
+  buffer_puts(buf, "[= ");
+
+  for (uint i=0; i<p->len; i++)
+  {
+    switch(p->item[i].kind)
+    {
+    case PM_ASN:
+      buffer_print(buf, "%u ", p->item[i].asn);
+      break;
+
+    case PM_QUESTION:
+      buffer_puts(buf, "? ");
+      break;
+
+    case PM_ASTERISK:
+      buffer_puts(buf, "* ");
+      break;
+
+    case PM_LOOP:
+      loop = 1;
+      break;
+
+    case PM_ASN_RANGE:
+      buffer_print(buf, "%u..%u ", p->item[i].from, p->item[i].to);
+      break;
+
+    case PM_ASN_SET:
+      tree_format(p->item[i].set, buf);
+      buffer_puts(buf, " ");
+      break;
+
+    case PM_ASN_EXPR:
+      ASSERT(0);
+    }
+
+    if (loop && (p->item[i].kind != PM_LOOP))
+    {
+      buffer_puts(buf, "+ ");
+      loop = 0;
+    }
+  }
+
+  buffer_puts(buf, "=]");
+}
+
+static inline int
+lcomm_cmp(lcomm v1, lcomm v2)
+{
+  if (v1.asn != v2.asn)
+    return (v1.asn > v2.asn) ? 1 : -1;
+  if (v1.ldp1 != v2.ldp1)
+    return (v1.ldp1 > v2.ldp1) ? 1 : -1;
+  if (v1.ldp2 != v2.ldp2)
+    return (v1.ldp2 > v2.ldp2) ? 1 : -1;
+  return 0;
+}
+
+/**
+ * val_compare - compare two values
+ * @v1: first value
+ * @v2: second value
+ *
+ * Compares two values and returns -1, 0, 1 on <, =, > or F_CMP_ERROR on
+ * error. Tree module relies on this giving consistent results so
+ * that it can be used for building balanced trees.
+ */
+int
+val_compare(const struct f_val *v1, const struct f_val *v2)
+{
+  if (v1->type != v2->type) {
+    if (v1->type == T_VOID)	/* Hack for else */
+      return -1;
+    if (v2->type == T_VOID)
+      return 1;
+
+    /* IP->Quad implicit conversion */
+    if ((v1->type == T_QUAD) && val_is_ip4(v2))
+      return uint_cmp(v1->val.i, ipa_to_u32(v2->val.ip));
+    if (val_is_ip4(v1) && (v2->type == T_QUAD))
+      return uint_cmp(ipa_to_u32(v1->val.ip), v2->val.i);
+
+    debug( "Types do not match in val_compare\n" );
+    return F_CMP_ERROR;
+  }
+
+  switch (v1->type) {
+  case T_VOID:
+    return 0;
+  case T_ENUM:
+  case T_INT:
+  case T_BOOL:
+  case T_PAIR:
+  case T_QUAD:
+    return uint_cmp(v1->val.i, v2->val.i);
+  case T_EC:
+  case T_RD:
+    return u64_cmp(v1->val.ec, v2->val.ec);
+  case T_LC:
+    return lcomm_cmp(v1->val.lc, v2->val.lc);
+  case T_IP:
+    return ipa_compare(v1->val.ip, v2->val.ip);
+  case T_NET:
+    return net_compare(v1->val.net, v2->val.net);
+  case T_STRING:
+    return strcmp(v1->val.s, v2->val.s);
+  default:
+    return F_CMP_ERROR;
+  }
+}
+
+static inline int
+pmi_same(const struct f_path_mask_item *mi1, const struct f_path_mask_item *mi2)
+{
+  if (mi1->kind != mi2->kind)
+    return 0;
+
+  switch (mi1->kind) {
+    case PM_ASN:
+      if (mi1->asn != mi2->asn)
+	return 0;
+      break;
+    case PM_ASN_EXPR:
+      if (!f_same(mi1->expr, mi2->expr))
+	return 0;
+      break;
+    case PM_ASN_RANGE:
+      if (mi1->from != mi2->from)
+	return 0;
+      if (mi1->to != mi2->to)
+	return 0;
+      break;
+    case PM_ASN_SET:
+      if (!same_tree(mi1->set, mi2->set))
+	return 0;
+      break;
+  }
+
+  return 1;
+}
+
+static int
+pm_same(const struct f_path_mask *m1, const struct f_path_mask *m2)
+{
+  if (m1->len != m2->len)
+    return 0;
+
+  for (uint i=0; i<m1->len; i++)
+    if (!pmi_same(&(m1->item[i]), &(m2->item[i])))
+      return 0;
+
+  return 1;
+}
+
+/**
+ * val_same - compare two values
+ * @v1: first value
+ * @v2: second value
+ *
+ * Compares two values and returns 1 if they are same and 0 if not.
+ * Comparison of values of different types is valid and returns 0.
+ */
+int
+val_same(const struct f_val *v1, const struct f_val *v2)
+{
+  int rc;
+
+  rc = val_compare(v1, v2);
+  if (rc != F_CMP_ERROR)
+    return !rc;
+
+  if (v1->type != v2->type)
+    return 0;
+
+  switch (v1->type) {
+  case T_PATH_MASK:
+    return pm_same(v1->val.path_mask, v2->val.path_mask);
+  case T_PATH_MASK_ITEM:
+    return pmi_same(&(v1->val.pmi), &(v2->val.pmi));
+  case T_PATH:
+  case T_CLIST:
+  case T_ECLIST:
+  case T_LCLIST:
+    return adata_same(v1->val.ad, v2->val.ad);
+  case T_SET:
+    return same_tree(v1->val.t, v2->val.t);
+  case T_PREFIX_SET:
+    return trie_same(v1->val.ti, v2->val.ti);
+  default:
+    bug("Invalid type in val_same(): %x", v1->type);
+  }
+}
+
+int
+clist_set_type(const struct f_tree *set, struct f_val *v)
+{
+  switch (set->from.type)
+  {
+  case T_PAIR:
+    v->type = T_PAIR;
+    return 1;
+
+  case T_QUAD:
+    v->type = T_QUAD;
+    return 1;
+
+  case T_IP:
+    if (val_is_ip4(&(set->from)) && val_is_ip4(&(set->to)))
+    {
+      v->type = T_QUAD;
+      return 1;
+    }
+    /* Fall through */
+  default:
+    v->type = T_VOID;
+    return 0;
+  }
+}
+
+static int
+clist_match_set(const struct adata *clist, const struct f_tree *set)
+{
+  if (!clist)
+    return 0;
+
+  struct f_val v;
+  if (!clist_set_type(set, &v))
+    return F_CMP_ERROR;
+
+  u32 *l = (u32 *) clist->data;
+  u32 *end = l + clist->length/4;
+
+  while (l < end) {
+    v.val.i = *l++;
+    if (find_tree(set, &v))
+      return 1;
+  }
+  return 0;
+}
+
+static int
+eclist_match_set(const struct adata *list, const struct f_tree *set)
+{
+  if (!list)
+    return 0;
+
+  if (!eclist_set_type(set))
+    return F_CMP_ERROR;
+
+  struct f_val v;
+  u32 *l = int_set_get_data(list);
+  int len = int_set_get_size(list);
+  int i;
+
+  v.type = T_EC;
+  for (i = 0; i < len; i += 2) {
+    v.val.ec = ec_get(l, i);
+    if (find_tree(set, &v))
+      return 1;
+  }
+
+  return 0;
+}
+
+static int
+lclist_match_set(const struct adata *list, const struct f_tree *set)
+{
+  if (!list)
+    return 0;
+
+  if (!lclist_set_type(set))
+    return F_CMP_ERROR;
+
+  struct f_val v;
+  u32 *l = int_set_get_data(list);
+  int len = int_set_get_size(list);
+  int i;
+
+  v.type = T_LC;
+  for (i = 0; i < len; i += 3) {
+    v.val.lc = lc_get(l, i);
+    if (find_tree(set, &v))
+      return 1;
+  }
+
+  return 0;
+}
+
+const struct adata *
+clist_filter(struct linpool *pool, const struct adata *list, const struct f_val *set, int pos)
+{
+  if (!list)
+    return NULL;
+
+  int tree = (set->type == T_SET);	/* 1 -> set is T_SET, 0 -> set is T_CLIST */
+  struct f_val v;
+  if (tree)
+    clist_set_type(set->val.t, &v);
+  else
+    v.type = T_PAIR;
+
+  int len = int_set_get_size(list);
+  u32 *l = int_set_get_data(list);
+  u32 tmp[len];
+  u32 *k = tmp;
+  u32 *end = l + len;
+
+  while (l < end) {
+    v.val.i = *l++;
+    /* pos && member(val, set) || !pos && !member(val, set),  member() depends on tree */
+    if ((tree ? !!find_tree(set->val.t, &v) : int_set_contains(set->val.ad, v.val.i)) == pos)
+      *k++ = v.val.i;
+  }
+
+  uint nl = (k - tmp) * sizeof(u32);
+  if (nl == list->length)
+    return list;
+
+  struct adata *res = adata_empty(pool, nl);
+  memcpy(res->data, tmp, nl);
+  return res;
+}
+
+const struct adata *
+eclist_filter(struct linpool *pool, const struct adata *list, const struct f_val *set, int pos)
+{
+  if (!list)
+    return NULL;
+
+  int tree = (set->type == T_SET);	/* 1 -> set is T_SET, 0 -> set is T_CLIST */
+  struct f_val v;
+
+  int len = int_set_get_size(list);
+  u32 *l = int_set_get_data(list);
+  u32 tmp[len];
+  u32 *k = tmp;
+  int i;
+
+  v.type = T_EC;
+  for (i = 0; i < len; i += 2) {
+    v.val.ec = ec_get(l, i);
+    /* pos && member(val, set) || !pos && !member(val, set),  member() depends on tree */
+    if ((tree ? !!find_tree(set->val.t, &v) : ec_set_contains(set->val.ad, v.val.ec)) == pos) {
+      *k++ = l[i];
+      *k++ = l[i+1];
+    }
+  }
+
+  uint nl = (k - tmp) * sizeof(u32);
+  if (nl == list->length)
+    return list;
+
+  struct adata *res = adata_empty(pool, nl);
+  memcpy(res->data, tmp, nl);
+  return res;
+}
+
+const struct adata *
+lclist_filter(struct linpool *pool, const struct adata *list, const struct f_val *set, int pos)
+{
+  if (!list)
+    return NULL;
+
+  int tree = (set->type == T_SET);	/* 1 -> set is T_SET, 0 -> set is T_CLIST */
+  struct f_val v;
+
+  int len = int_set_get_size(list);
+  u32 *l = int_set_get_data(list);
+  u32 tmp[len];
+  u32 *k = tmp;
+  int i;
+
+  v.type = T_LC;
+  for (i = 0; i < len; i += 3) {
+    v.val.lc = lc_get(l, i);
+    /* pos && member(val, set) || !pos && !member(val, set),  member() depends on tree */
+    if ((tree ? !!find_tree(set->val.t, &v) : lc_set_contains(set->val.ad, v.val.lc)) == pos)
+      k = lc_copy(k, l+i);
+  }
+
+  uint nl = (k - tmp) * sizeof(u32);
+  if (nl == list->length)
+    return list;
+
+  struct adata *res = adata_empty(pool, nl);
+  memcpy(res->data, tmp, nl);
+  return res;
+}
+
+/**
+ * val_in_range - implement |~| operator
+ * @v1: element
+ * @v2: set
+ *
+ * Checks if @v1 is element (|~| operator) of @v2.
+ */
+int
+val_in_range(const struct f_val *v1, const struct f_val *v2)
+{
+  if ((v1->type == T_PATH) && (v2->type == T_PATH_MASK))
+    return as_path_match(v1->val.ad, v2->val.path_mask);
+
+  if ((v1->type == T_INT) && (v2->type == T_PATH))
+    return as_path_contains(v2->val.ad, v1->val.i, 1);
+
+  if (((v1->type == T_PAIR) || (v1->type == T_QUAD)) && (v2->type == T_CLIST))
+    return int_set_contains(v2->val.ad, v1->val.i);
+  /* IP->Quad implicit conversion */
+  if (val_is_ip4(v1) && (v2->type == T_CLIST))
+    return int_set_contains(v2->val.ad, ipa_to_u32(v1->val.ip));
+
+  if ((v1->type == T_EC) && (v2->type == T_ECLIST))
+    return ec_set_contains(v2->val.ad, v1->val.ec);
+
+  if ((v1->type == T_LC) && (v2->type == T_LCLIST))
+    return lc_set_contains(v2->val.ad, v1->val.lc);
+
+  if ((v1->type == T_STRING) && (v2->type == T_STRING))
+    return patmatch(v2->val.s, v1->val.s);
+
+  if ((v1->type == T_IP) && (v2->type == T_NET))
+    return ipa_in_netX(v1->val.ip, v2->val.net);
+
+  if ((v1->type == T_NET) && (v2->type == T_NET))
+    return net_in_netX(v1->val.net, v2->val.net);
+
+  if ((v1->type == T_NET) && (v2->type == T_PREFIX_SET))
+    return trie_match_net(v2->val.ti, v1->val.net);
+
+  if (v2->type != T_SET)
+    return F_CMP_ERROR;
+
+  /* With integrated Quad<->IP implicit conversion */
+  if ((v1->type == v2->val.t->from.type) ||
+      ((v1->type == T_QUAD) && val_is_ip4(&(v2->val.t->from)) && val_is_ip4(&(v2->val.t->to))))
+    return !!find_tree(v2->val.t, v1);
+
+  if (v1->type == T_CLIST)
+    return clist_match_set(v1->val.ad, v2->val.t);
+
+  if (v1->type == T_ECLIST)
+    return eclist_match_set(v1->val.ad, v2->val.t);
+
+  if (v1->type == T_LCLIST)
+    return lclist_match_set(v1->val.ad, v2->val.t);
+
+  if (v1->type == T_PATH)
+    return as_path_match_set(v1->val.ad, v2->val.t);
+
+  return F_CMP_ERROR;
+}
+
+/*
+ * val_format - format filter value
+ */
+void
+val_format(const struct f_val *v, buffer *buf)
+{
+  char buf2[1024];
+  switch (v->type)
+  {
+  case T_VOID:	buffer_puts(buf, "(void)"); return;
+  case T_BOOL:	buffer_puts(buf, v->val.i ? "TRUE" : "FALSE"); return;
+  case T_INT:	buffer_print(buf, "%u", v->val.i); return;
+  case T_STRING: buffer_print(buf, "%s", v->val.s); return;
+  case T_IP:	buffer_print(buf, "%I", v->val.ip); return;
+  case T_NET:   buffer_print(buf, "%N", v->val.net); return;
+  case T_PAIR:	buffer_print(buf, "(%u,%u)", v->val.i >> 16, v->val.i & 0xffff); return;
+  case T_QUAD:	buffer_print(buf, "%R", v->val.i); return;
+  case T_EC:	ec_format(buf2, v->val.ec); buffer_print(buf, "%s", buf2); return;
+  case T_LC:	lc_format(buf2, v->val.lc); buffer_print(buf, "%s", buf2); return;
+  case T_RD:	rd_format(v->val.ec, buf2, 1024); buffer_print(buf, "%s", buf2); return;
+  case T_PREFIX_SET: trie_format(v->val.ti, buf); return;
+  case T_SET:	tree_format(v->val.t, buf); return;
+  case T_ENUM:	buffer_print(buf, "(enum %x)%u", v->type, v->val.i); return;
+  case T_PATH:	as_path_format(v->val.ad, buf2, 1000); buffer_print(buf, "(path %s)", buf2); return;
+  case T_CLIST:	int_set_format(v->val.ad, 1, -1, buf2, 1000); buffer_print(buf, "(clist %s)", buf2); return;
+  case T_ECLIST: ec_set_format(v->val.ad, -1, buf2, 1000); buffer_print(buf, "(eclist %s)", buf2); return;
+  case T_LCLIST: lc_set_format(v->val.ad, -1, buf2, 1000); buffer_print(buf, "(lclist %s)", buf2); return;
+  case T_PATH_MASK: pm_format(v->val.path_mask, buf); return;
+  default:	buffer_print(buf, "[unknown type %x]", v->type); return;
+  }
+}
+
+char *
+val_format_str(struct linpool *lp, const struct f_val *v) {
+  buffer b;
+  LOG_BUFFER_INIT(b);
+  val_format(v, &b);
+  return lp_strdup(lp, b.start);
+}
+
+
+static char val_dump_buffer[1024];
+const char *
+val_dump(const struct f_val *v) {
+  static buffer b = {
+    .start = val_dump_buffer,
+    .end = val_dump_buffer + 1024,
+  };
+  b.pos = b.start;
+  val_format(v, &b);
+  return val_dump_buffer;
+}
+
--- a/filter/data.h
+++ b/filter/data.h
@ -0,0 +1,224 @@
+/*
+ *	BIRD Internet Routing Daemon -- Dynamic data structures
+ *
+ *	(c) 1999 Pavel Machek <pavel@ucw.cz>
+ *	(c) 2018--2019 Maria Matejka <mq@jmq.cz>
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#ifndef _BIRD_FILTER_DATA_H_
+#define _BIRD_FILTER_DATA_H_
+
+#include "nest/bird.h"
+
+/* Type numbers must be in 0..0xff range */
+#define T_MASK 0xff
+
+/* Internal types */
+enum f_type {
+/* Nothing. Simply nothing. */
+  T_VOID = 0,
+
+/* User visible types, which fit in int */
+  T_INT = 0x10,
+  T_BOOL = 0x11,
+  T_PAIR = 0x12,  /*	Notice that pair is stored as integer: first << 16 | second */
+  T_QUAD = 0x13,
+
+/* Put enumerational types in 0x30..0x3f range */
+  T_ENUM_LO = 0x30,
+  T_ENUM_HI = 0x3f,
+
+  T_ENUM_RTS = 0x30,
+  T_ENUM_BGP_ORIGIN = 0x31,
+  T_ENUM_SCOPE = 0x32,
+  T_ENUM_RTC = 0x33,
+  T_ENUM_RTD = 0x34,
+  T_ENUM_ROA = 0x35,
+  T_ENUM_NETTYPE = 0x36,
+  T_ENUM_RA_PREFERENCE = 0x37,
+  T_ENUM_AF = 0x38,
+
+/* new enums go here */
+  T_ENUM_EMPTY = 0x3f,	/* Special hack for atomic_aggr */
+
+#define T_ENUM T_ENUM_LO ... T_ENUM_HI
+
+/* Bigger ones */
+  T_IP = 0x20,
+  T_NET = 0x21,
+  T_STRING = 0x22,
+  T_PATH_MASK = 0x23,	/* mask for BGP path */
+  T_PATH = 0x24,		/* BGP path */
+  T_CLIST = 0x25,		/* Community list */
+  T_EC = 0x26,		/* Extended community value, u64 */
+  T_ECLIST = 0x27,		/* Extended community list */
+  T_LC = 0x28,		/* Large community value, lcomm */
+  T_LCLIST = 0x29,		/* Large community list */
+  T_RD = 0x2a,		/* Route distinguisher for VPN addresses */
+  T_PATH_MASK_ITEM = 0x2b,	/* Path mask item for path mask constructors */
+
+  T_SET = 0x80,
+  T_PREFIX_SET = 0x81,
+} PACKED;
+
+/* Filter value; size of this affects filter memory consumption */
+struct f_val {
+  enum f_type type;	/* T_*  */
+  union {
+    uint i;
+    u64 ec;
+    lcomm lc;
+    ip_addr ip;
+    const net_addr *net;
+    const char *s;
+    const struct f_tree *t;
+    const struct f_trie *ti;
+    const struct adata *ad;
+    const struct f_path_mask *path_mask;
+    struct f_path_mask_item pmi;
+  } val;
+};
+
+/* Dynamic attribute definition (eattrs) */
+struct f_dynamic_attr {
+  u8 type;		/* EA type (EAF_*) */
+  u8 bit;		/* For bitfield accessors */
+  enum f_type f_type;	/* Filter type */
+  uint ea_code;		/* EA code */
+};
+
+enum f_sa_code {
+  SA_FROM = 1,
+  SA_GW,
+  SA_NET,
+  SA_PROTO,
+  SA_SOURCE,
+  SA_SCOPE,
+  SA_DEST,
+  SA_IFNAME,
+  SA_IFINDEX,
+  SA_WEIGHT,
+} PACKED;
+
+/* Static attribute definition (members of struct rta) */
+struct f_static_attr {
+  enum f_type f_type;		/* Filter type */
+  enum f_sa_code sa_code;	/* Static attribute id */
+  int readonly:1;			/* Don't allow writing */
+};
+
+/* Filter l-value type */
+enum f_lval_type {
+  F_LVAL_VARIABLE,
+  F_LVAL_PREFERENCE,
+  F_LVAL_SA,
+  F_LVAL_EA,
+};
+
+/* Filter l-value */
+struct f_lval {
+  enum f_lval_type type;
+  union {
+    struct symbol *sym;
+    struct f_dynamic_attr da;
+    struct f_static_attr sa;
+  };
+};
+
+/* IP prefix range structure */
+struct f_prefix {
+  net_addr net;		/* The matching prefix must match this net */
+  u8 lo, hi;		/* And its length must fit between lo and hi */
+};
+
+struct f_tree {
+  struct f_tree *left, *right;
+  struct f_val from, to;
+  void *data;
+};
+
+struct f_trie_node4
+{
+  ip4_addr addr, mask, accept;
+  uint plen;
+  struct f_trie_node4 *c[2];
+};
+
+struct f_trie_node6
+{
+  ip6_addr addr, mask, accept;
+  uint plen;
+  struct f_trie_node6 *c[2];
+};
+
+struct f_trie_node
+{
+  union {
+    struct f_trie_node4 v4;
+    struct f_trie_node6 v6;
+  };
+};
+
+struct f_trie
+{
+  linpool *lp;
+  u8 zero;
+  s8 ipv4;				/* -1 for undefined / empty */
+  u16 data_size;			/* Additional data for each trie node */
+  struct f_trie_node root;		/* Root trie node */
+};
+
+struct f_tree *f_new_tree(void);
+struct f_tree *build_tree(struct f_tree *);
+const struct f_tree *find_tree(const struct f_tree *t, const struct f_val *val);
+int same_tree(const struct f_tree *t0, const struct f_tree *t2);
+void tree_format(const struct f_tree *t, buffer *buf);
+void tree_walk(const struct f_tree *t, void (*hook)(const struct f_tree *, void *), void *data);
+
+struct f_trie *f_new_trie(linpool *lp, uint data_size);
+void *trie_add_prefix(struct f_trie *t, const net_addr *n, uint l, uint h);
+int trie_match_net(const struct f_trie *t, const net_addr *n);
+int trie_same(const struct f_trie *t1, const struct f_trie *t2);
+void trie_format(const struct f_trie *t, buffer *buf);
+
+#define F_CMP_ERROR 999
+
+const char *f_type_name(enum f_type t);
+
+int val_same(const struct f_val *v1, const struct f_val *v2);
+int val_compare(const struct f_val *v1, const struct f_val *v2);
+void val_format(const struct f_val *v, buffer *buf);
+char *val_format_str(struct linpool *lp, const struct f_val *v);
+const char *val_dump(const struct f_val *v);
+
+static inline int val_is_ip4(const struct f_val *v)
+{ return (v->type == T_IP) && ipa_is_ip4(v->val.ip); }
+int val_in_range(const struct f_val *v1, const struct f_val *v2);
+
+int clist_set_type(const struct f_tree *set, struct f_val *v);
+static inline int eclist_set_type(const struct f_tree *set)
+{ return set->from.type == T_EC; }
+static inline int lclist_set_type(const struct f_tree *set)
+{ return set->from.type == T_LC; }
+
+const struct adata *clist_filter(struct linpool *pool, const struct adata *list, const struct f_val *set, int pos);
+const struct adata *eclist_filter(struct linpool *pool, const struct adata *list, const struct f_val *set, int pos);
+const struct adata *lclist_filter(struct linpool *pool, const struct adata *list, const struct f_val *set, int pos);
+
+
+/* Special undef value for paths and clists */
+static inline int
+undef_value(struct f_val v)
+{
+  return ((v.type == T_PATH) || (v.type == T_CLIST) ||
+	  (v.type == T_ECLIST) || (v.type == T_LCLIST)) &&
+    (v.val.ad == &null_adata);
+}
+
+extern const struct f_val f_const_empty_path, f_const_empty_clist, f_const_empty_eclist, f_const_empty_lclist;
+
+enum filter_return f_eval(const struct f_line *expr, struct linpool *tmp_pool, struct f_val *pres);
+
+#endif
--- a/filter/decl.m4
+++ b/filter/decl.m4
@ -0,0 +1,673 @@
+m4_divert(-1)m4_dnl
+#
+#	BIRD -- Construction of per-instruction structures
+#
+#	(c) 2018 Maria Matejka <mq@jmq.cz>
+#
+#	Can be freely distributed and used under the terms of the GNU GPL.
+#
+#	THIS IS A M4 MACRO FILE GENERATING 3 FILES ALTOGETHER.
+#	KEEP YOUR HANDS OFF UNLESS YOU KNOW WHAT YOU'RE DOING.
+#	EDITING AND DEBUGGING THIS FILE MAY DAMAGE YOUR BRAIN SERIOUSLY.
+#
+#	But you're welcome to read and edit and debug if you aren't scared.
+#
+#	Uncomment the following line to get exhaustive debug output.
+#	m4_debugmode(aceflqtx)
+#
+#	How it works:
+#	1) Instruction to code conversion (uses diversions 100..199)
+#	2) Code wrapping (uses diversions 1..99)
+#	3) Final preparation (uses diversions 200..299)
+#	4) Shipout
+#
+#	See below for detailed description.
+#
+#
+#	1) Instruction to code conversion
+#	The code provided in f-inst.c between consecutive INST() calls
+#	is interleaved for many different places. It is here processed
+#	and split into separate instances where split-by-instruction
+#	happens. These parts are stored in temporary diversions listed:
+#
+#	101	content of per-inst struct
+#	102	constructor arguments
+#	103	constructor body
+#	104	dump line item content
+#		(there may be nothing in dump-line content and
+#		 it must be handled specially in phase 2)
+#	105	linearize body
+#	106	comparator body
+#	107	struct f_line_item content
+#	108	interpreter body
+#	109	iterator body
+#
+#	Here are macros to allow you to _divert to the right directions.
+m4_define(FID_STRUCT_IN, `m4_divert(101)')
+m4_define(FID_NEW_ARGS, `m4_divert(102)')
+m4_define(FID_NEW_BODY, `m4_divert(103)')
+m4_define(FID_DUMP_BODY, `m4_divert(104)m4_define([[FID_DUMP_BODY_EXISTS]])')
+m4_define(FID_LINEARIZE_BODY, `m4_divert(105)')
+m4_define(FID_SAME_BODY, `m4_divert(106)')
+m4_define(FID_LINE_IN, `m4_divert(107)')
+m4_define(FID_INTERPRET_BODY, `m4_divert(108)')
+m4_define(FID_ITERATE_BODY, `m4_divert(109)')
+
+#	Sometimes you want slightly different code versions in different
+#	outputs.
+#	Use FID_HIC(code for inst-gen.h, code for inst-gen.c, code for inst-interpret.c)
+#	and put it into [[ ]] quotes if it shall contain commas.
+m4_define(FID_HIC, `m4_ifelse(TARGET, [[H]], [[$1]], TARGET, [[I]], [[$2]], TARGET, [[C]], [[$3]])')
+
+#	In interpreter code, this is quite common.
+m4_define(FID_INTERPRET_EXEC, `FID_HIC(,[[FID_INTERPRET_BODY()]],[[m4_divert(-1)]])')
+m4_define(FID_INTERPRET_NEW,  `FID_HIC(,[[m4_divert(-1)]],[[FID_INTERPRET_BODY()]])')
+
+#	If the instruction is never converted to constant, the interpret
+#	code is not produced at all for constructor
+m4_define(NEVER_CONSTANT, `m4_define([[INST_NEVER_CONSTANT]])')
+m4_define(FID_IFCONST, `m4_ifdef([[INST_NEVER_CONSTANT]],[[$2]],[[$1]])')
+
+#	If the instruction has some attributes (here called members),
+#	these are typically carried with the instruction from constructor
+#	to interpreter. This yields a line of code everywhere on the path.
+#	FID_MEMBER is a macro to help with this task.
+m4_define(FID_MEMBER, `m4_dnl
+FID_LINE_IN()m4_dnl
+      $1 $2;
+FID_STRUCT_IN()m4_dnl
+      $1 $2;
+FID_NEW_ARGS()m4_dnl
+  , $1 $2
+FID_NEW_BODY()m4_dnl
+whati->$2 = $2;
+FID_LINEARIZE_BODY()m4_dnl
+item->$2 = whati->$2;
+m4_ifelse($3,,,[[
+FID_SAME_BODY()m4_dnl
+if ($3) return 0;
+]])
+m4_ifelse($4,,,[[
+FID_DUMP_BODY()m4_dnl
+debug("%s" $4 "\n", INDENT, $5);
+]])
+FID_INTERPRET_EXEC()m4_dnl
+const $1 $2 = whati->$2
+FID_INTERPRET_BODY')
+
+#	Instruction arguments are needed only until linearization is done.
+#	This puts the arguments into the filter line to be executed before
+#	the instruction itself.
+#
+#	To achieve this, ARG_ANY must be called before anything writes into
+#	the instruction line as it moves the instruction pointer forward.
+m4_define(ARG_ANY, `
+FID_STRUCT_IN()m4_dnl
+      struct f_inst * f$1;
+FID_NEW_ARGS()m4_dnl
+  , struct f_inst * f$1
+FID_NEW_BODY()m4_dnl
+whati->f$1 = f$1;
+for (const struct f_inst *child = f$1; child; child = child->next) {
+  what->size += child->size;
+FID_IFCONST([[
+  if (child->fi_code != FI_CONSTANT)
+    constargs = 0;
+]])
+}
+FID_LINEARIZE_BODY
+pos = linearize(dest, whati->f$1, pos);
+FID_INTERPRET_BODY()')
+
+#	Some instructions accept variable number of arguments.
+m4_define(VARARG, `
+FID_NEW_ARGS()m4_dnl
+  , struct f_inst * fvar
+FID_STRUCT_IN()m4_dnl
+      struct f_inst * fvar;
+      uint varcount;
+FID_LINE_IN()m4_dnl
+      uint varcount;
+FID_NEW_BODY()m4_dnl
+whati->varcount = 0;
+whati->fvar = fvar;
+for (const struct f_inst *child = fvar; child; child = child->next, whati->varcount++) {
+  what->size += child->size;
+FID_IFCONST([[
+  if (child->fi_code != FI_CONSTANT)
+    constargs = 0;
+]])
+}
+FID_IFCONST([[
+  const struct f_inst **items = NULL;
+  if (constargs && whati->varcount) {
+    items = alloca(whati->varcount * sizeof(struct f_inst *));
+    const struct f_inst *child = fvar;
+    for (uint i=0; child; i++)
+      child = (items[i] = child)->next;
+  }
+]])
+FID_LINEARIZE_BODY()m4_dnl
+  pos = linearize(dest, whati->fvar, pos);
+  item->varcount = whati->varcount;
+FID_DUMP_BODY()m4_dnl
+  debug("%snumber of varargs %u\n", INDENT, item->varcount);
+FID_SAME_BODY()m4_dnl
+  if (f1->varcount != f2->varcount) return 0;
+FID_INTERPRET_BODY()
+FID_HIC(,[[
+  if (fstk->vcnt < whati->varcount) runtime("Stack underflow");
+  fstk->vcnt -= whati->varcount;
+]],)
+')
+
+#	Some arguments need to check their type. After that, ARG_ANY is called.
+m4_define(ARG, `ARG_ANY($1) ARG_TYPE($1,$2)')
+m4_define(ARG_TYPE, `ARG_TYPE_STATIC($1,$2) ARG_TYPE_DYNAMIC($1,$2)')
+
+m4_define(ARG_TYPE_STATIC, `
+FID_NEW_BODY()m4_dnl
+if (f$1->type && (f$1->type != ($2)) && !f_const_promotion(f$1, ($2)))
+  cf_error("Argument $1 of %s must be of type %s, got type %s",
+	   f_instruction_name(what->fi_code), f_type_name($2), f_type_name(f$1->type));
+FID_INTERPRET_BODY()')
+
+m4_define(ARG_TYPE_DYNAMIC, `
+FID_INTERPRET_EXEC()m4_dnl
+if (v$1.type != ($2))
+  runtime("Argument $1 of %s must be of type %s, got type %s",
+	   f_instruction_name(what->fi_code), f_type_name($2), f_type_name(v$1.type));
+FID_INTERPRET_BODY()')
+
+m4_define(ARG_SAME_TYPE, `
+FID_NEW_BODY()m4_dnl
+if (f$1->type && f$2->type && (f$1->type != f$2->type) &&
+   !f_const_promotion(f$2, f$1->type) && !f_const_promotion(f$1, f$2->type))
+  cf_error("Arguments $1 and $2 of %s must be of the same type", f_instruction_name(what->fi_code));
+FID_INTERPRET_BODY()')
+
+#	Executing another filter line. This replaces the recursion
+#	that was needed in the former implementation.
+m4_define(LINEX, `FID_INTERPRET_EXEC()LINEX_($1)FID_INTERPRET_NEW()return $1 FID_INTERPRET_BODY()')
+m4_define(LINEX_, `do {
+  fstk->estk[fstk->ecnt].pos = 0;
+  fstk->estk[fstk->ecnt].line = $1;
+  fstk->estk[fstk->ecnt].ventry = fstk->vcnt;
+  fstk->estk[fstk->ecnt].vbase = fstk->estk[fstk->ecnt-1].vbase;
+  fstk->estk[fstk->ecnt].emask = 0;
+  fstk->ecnt++;
+} while (0)')
+
+m4_define(LINE, `
+FID_LINE_IN()m4_dnl
+      const struct f_line * fl$1;
+FID_STRUCT_IN()m4_dnl
+      struct f_inst * f$1;
+FID_NEW_ARGS()m4_dnl
+  , struct f_inst * f$1
+FID_NEW_BODY()m4_dnl
+whati->f$1 = f$1;
+FID_DUMP_BODY()m4_dnl
+f_dump_line(item->fl$1, indent + 1);
+FID_LINEARIZE_BODY()m4_dnl
+item->fl$1 = f_linearize(whati->f$1);
+FID_SAME_BODY()m4_dnl
+if (!f_same(f1->fl$1, f2->fl$1)) return 0;
+FID_ITERATE_BODY()m4_dnl
+if (whati->fl$1) BUFFER_PUSH(fit->lines) = whati->fl$1;
+FID_INTERPRET_EXEC()m4_dnl
+do { if (whati->fl$1) {
+  LINEX_(whati->fl$1);
+} } while(0)
+FID_INTERPRET_NEW()m4_dnl
+return whati->f$1
+FID_INTERPRET_BODY()')
+
+#	Some of the instructions have a result. These constructions
+#	state the result and put it to the right place.
+m4_define(RESULT, `RESULT_TYPE([[$1]]) RESULT_([[$1]],[[$2]],[[$3]])')
+m4_define(RESULT_, `RESULT_VAL([[ (struct f_val) { .type = $1, .val.$2 = $3 } ]])')
+m4_define(RESULT_VAL, `FID_HIC(, [[do { res = $1; fstk->vcnt++; } while (0)]],
+[[return fi_constant(what, $1)]])')
+m4_define(RESULT_VOID, `RESULT_VAL([[ (struct f_val) { .type = T_VOID } ]])')
+
+m4_define(ERROR,
+       `m4_errprint(m4___file__:m4___line__: $*
+       )m4_m4exit(1)')
+
+#	This macro specifies result type and makes there are no conflicting definitions
+m4_define(RESULT_TYPE,
+	`m4_ifdef([[INST_RESULT_TYPE]],
+		  [[m4_ifelse(INST_RESULT_TYPE,$1,,[[ERROR([[Multiple type definitons]])]])]],
+		  [[m4_define(INST_RESULT_TYPE,$1) RESULT_TYPE_($1)]])')
+
+m4_define(RESULT_TYPE_, `
+FID_NEW_BODY()m4_dnl
+what->type = $1;
+FID_INTERPRET_BODY()')
+
+#	Some common filter instruction members
+m4_define(SYMBOL, `FID_MEMBER(struct symbol *, sym, [[strcmp(f1->sym->name, f2->sym->name) || (f1->sym->class != f2->sym->class)]], "symbol %s", item->sym->name)')
+m4_define(RTC, `FID_MEMBER(struct rtable_config *, rtc, [[strcmp(f1->rtc->name, f2->rtc->name)]], "route table %s", item->rtc->name)')
+m4_define(STATIC_ATTR, `FID_MEMBER(struct f_static_attr, sa, f1->sa.sa_code != f2->sa.sa_code,,)')
+m4_define(DYNAMIC_ATTR, `FID_MEMBER(struct f_dynamic_attr, da, f1->da.ea_code != f2->da.ea_code,,)')
+m4_define(ACCESS_RTE, `FID_HIC(,[[do { if (!fs->rte) runtime("No route to access"); } while (0)]],NEVER_CONSTANT())')
+
+#	2) Code wrapping
+#	The code produced in 1xx temporary diversions is a raw code without
+#	any auxiliary commands and syntactical structures around. When the
+#	instruction is done, INST_FLUSH is called. More precisely, it is called
+#	at the beginning of INST() call and at the end of file.
+#
+#	INST_FLUSH picks all the temporary diversions, wraps their content
+#	into appropriate headers and structures and saves them into global
+#	diversions listed:
+#
+#	4	enum fi_code
+#	5	enum fi_code to string
+#	6	dump line item
+#	7	dump line item callers
+#	8	linearize
+#	9	same (filter comparator)
+#	10	iterate
+#	1	union in struct f_inst
+#	3	constructors + interpreter
+#
+#	These global diversions contain blocks of code that can be directly
+#	put into the final file, yet it still can't be written out now as
+#	every instruction writes to all of these diversions.
+
+#	Code wrapping diversion names. Here we want an explicit newline
+#	after the C comment.
+m4_define(FID_ZONE, `m4_divert($1) /* $2 for INST_NAME() */
+')
+m4_define(FID_INST, `FID_ZONE(1, Instruction structure for config)')
+m4_define(FID_LINE, `FID_ZONE(2, Instruction structure for interpreter)')
+m4_define(FID_NEW, `FID_ZONE(3, Constructor)')
+m4_define(FID_ENUM, `FID_ZONE(4, Code enum)')
+m4_define(FID_ENUM_STR, `FID_ZONE(5, Code enum to string)')
+m4_define(FID_DUMP, `FID_ZONE(6, Dump line)')
+m4_define(FID_DUMP_CALLER, `FID_ZONE(7, Dump line caller)')
+m4_define(FID_LINEARIZE, `FID_ZONE(8, Linearize)')
+m4_define(FID_SAME, `FID_ZONE(9, Comparison)')
+m4_define(FID_ITERATE, `FID_ZONE(10, Iteration)')
+
+#	This macro does all the code wrapping. See inline comments.
+m4_define(INST_FLUSH, `m4_ifdef([[INST_NAME]], [[
+FID_ENUM()m4_dnl			 Contents of enum fi_code { ... }
+  INST_NAME(),
+FID_ENUM_STR()m4_dnl			 Contents of const char * indexed by enum fi_code
+  [INST_NAME()] = "INST_NAME()",
+FID_INST()m4_dnl			 Anonymous structure inside struct f_inst
+    struct {
+m4_undivert(101)m4_dnl
+    } i_[[]]INST_NAME();
+FID_LINE()m4_dnl			 Anonymous structure inside struct f_line_item
+    struct {
+m4_undivert(107)m4_dnl
+    } i_[[]]INST_NAME();
+FID_NEW()m4_dnl				 Constructor and interpreter code together
+FID_HIC(
+[[m4_dnl				 Public declaration of constructor in H file
+struct f_inst *f_new_inst_]]INST_NAME()[[(enum f_instruction_code fi_code
+m4_undivert(102)m4_dnl
+);]],
+[[m4_dnl				 The one case in The Big Switch inside interpreter
+  case INST_NAME():
+  #define whati (&(what->i_]]INST_NAME()[[))
+  m4_ifelse(m4_eval(INST_INVAL() > 0), 1, [[if (fstk->vcnt < INST_INVAL()) runtime("Stack underflow"); fstk->vcnt -= INST_INVAL(); ]])
+  m4_undivert(108)m4_dnl
+  #undef whati
+  break;
+]],
+[[m4_dnl				 Constructor itself
+struct f_inst *f_new_inst_]]INST_NAME()[[(enum f_instruction_code fi_code
+m4_undivert(102)m4_dnl
+)
+  {
+    /* Allocate the structure */
+    struct f_inst *what = fi_new(fi_code);
+    FID_IFCONST([[uint constargs = 1;]])
+
+    /* Initialize all the members */
+  #define whati (&(what->i_]]INST_NAME()[[))
+  m4_undivert(103)m4_dnl
+
+    /* If not constant, return the instruction itself */
+    FID_IFCONST([[if (!constargs)]])
+      return what;
+
+    /* Try to pre-calculate the result */
+    FID_IFCONST([[m4_undivert(108)]])m4_dnl
+  #undef whati
+  }
+]])
+
+FID_DUMP_CALLER()m4_dnl			 Case in another big switch used in instruction dumping (debug)
+case INST_NAME(): f_dump_line_item_]]INST_NAME()[[(item, indent + 1); break;
+
+FID_DUMP()m4_dnl			 The dumper itself
+m4_ifdef([[FID_DUMP_BODY_EXISTS]],
+[[static inline void f_dump_line_item_]]INST_NAME()[[(const struct f_line_item *item_, const int indent)]],
+[[static inline void f_dump_line_item_]]INST_NAME()[[(const struct f_line_item *item UNUSED, const int indent UNUSED)]])
+m4_undefine([[FID_DUMP_BODY_EXISTS]])
+{
+#define item (&(item_->i_]]INST_NAME()[[))
+m4_undivert(104)m4_dnl
+#undef item
+}
+
+FID_LINEARIZE()m4_dnl			 The linearizer
+case INST_NAME(): {
+#define whati (&(what->i_]]INST_NAME()[[))
+#define item (&(dest->items[pos].i_]]INST_NAME()[[))
+  m4_undivert(105)m4_dnl
+#undef whati
+#undef item
+  dest->items[pos].fi_code = what->fi_code;
+  dest->items[pos].lineno = what->lineno;
+  break;
+}
+
+FID_SAME()m4_dnl			 This code compares two f_line"s while reconfiguring
+case INST_NAME():
+#define f1 (&(f1_->i_]]INST_NAME()[[))
+#define f2 (&(f2_->i_]]INST_NAME()[[))
+m4_undivert(106)m4_dnl
+#undef f1
+#undef f2
+break;
+
+FID_ITERATE()m4_dnl			The iterator
+case INST_NAME():
+#define whati (&(what->i_]]INST_NAME()[[))
+m4_undivert(109)m4_dnl
+#undef whati
+break;
+
+m4_divert(-1)FID_FLUSH(101,200)m4_dnl  And finally this flushes all the unused diversions
+]])')
+
+m4_define(INST, `m4_dnl				This macro is called on beginning of each instruction.
+INST_FLUSH()m4_dnl				First, old data is flushed
+m4_define([[INST_NAME]], [[$1]])m4_dnl		Then we store instruction name,
+m4_define([[INST_INVAL]], [[$2]])m4_dnl		instruction input value count,
+m4_undefine([[INST_NEVER_CONSTANT]])m4_dnl	reset NEVER_CONSTANT trigger,
+m4_undefine([[INST_RESULT_TYPE]])m4_dnl		and reset RESULT_TYPE value.
+FID_INTERPRET_BODY()m4_dnl 			By default, every code is interpreter code.
+')
+
+#	3) Final preparation
+#
+#	Now we prepare all the code around the global diversions.
+#	It must be here, not in m4wrap, as we want M4 to mark the code
+#	by #line directives correctly, not to claim that every single line
+#	is at the beginning of the m4wrap directive.
+#
+#	This part is split by the final file.
+#	H for inst-gen.h
+#	I for inst-interpret.c
+#	C for inst-gen.c
+#
+#	So we in cycle:
+#	  A. open a diversion
+#	  B. send there some code
+#	  C. close that diversion
+#	  D. flush a global diversion
+#	  E. open another diversion and goto B.
+#
+#	Final diversions
+#	200+	completed text before it is flushed to output
+
+#	This is a list of output diversions
+m4_define(FID_WR_PUT_LIST)
+
+#	This macro does the steps C to E, see before.
+m4_define(FID_WR_PUT_ALSO, `m4_define([[FID_WR_PUT_LIST]],FID_WR_PUT_LIST()[[FID_WR_DPUT(]]FID_WR_DIDX[[)FID_WR_DPUT(]]$1[[)]])m4_define([[FID_WR_DIDX]],m4_eval(FID_WR_DIDX+1))m4_divert(FID_WR_DIDX)')
+
+#	These macros do the splitting between H/I/C
+m4_define(FID_WR_DIRECT, `m4_ifelse(TARGET,[[$1]],[[FID_WR_INIT()]],[[FID_WR_STOP()]])')
+m4_define(FID_WR_INIT, `m4_define([[FID_WR_DIDX]],200)m4_define([[FID_WR_PUT]],[[FID_WR_PUT_ALSO($]][[@)]])m4_divert(200)')
+m4_define(FID_WR_STOP, `m4_define([[FID_WR_PUT]])m4_divert(-1)')
+
+#	Here is the direct code to be put into the output files
+#	together with the undiversions, being hidden under FID_WR_PUT()
+
+m4_changequote([[,]])
+FID_WR_DIRECT(I)
+FID_WR_PUT(3)
+FID_WR_DIRECT(C)
+
+#if defined(__GNUC__) && __GNUC__ >= 6
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmisleading-indentation"
+#endif
+
+#include "nest/bird.h"
+#include "filter/filter.h"
+#include "filter/f-inst.h"
+
+/* Instruction codes to string */
+static const char * const f_instruction_name_str[] = {
+FID_WR_PUT(5)
+};
+
+const char *
+f_instruction_name_(enum f_instruction_code fi)
+{
+  if (fi < (sizeof(f_instruction_name_str) / sizeof(f_instruction_name_str[0])))
+    return f_instruction_name_str[fi];
+  else
+    bug("Got unknown instruction code: %d", fi);
+}
+
+static inline struct f_inst *
+fi_new(enum f_instruction_code fi_code)
+{
+  struct f_inst *what = cfg_allocz(sizeof(struct f_inst));
+  what->lineno = ifs->lino;
+  what->size = 1;
+  what->fi_code = fi_code;
+  return what;
+}
+
+static inline struct f_inst *
+fi_constant(struct f_inst *what, struct f_val val)
+{
+  what->fi_code = FI_CONSTANT;
+  what->i_FI_CONSTANT.val = val;
+  return what;
+}
+
+static int
+f_const_promotion(struct f_inst *arg, enum f_type want)
+{
+  if (arg->fi_code != FI_CONSTANT)
+    return 0;
+
+  struct f_val *c = &arg->i_FI_CONSTANT.val;
+
+  if ((c->type == T_IP) && ipa_is_ip4(c->val.ip) && (want == T_QUAD)) {
+    *c = (struct f_val) {
+      .type = T_QUAD,
+      .val.i = ipa_to_u32(c->val.ip),
+    };
+    return 1;
+  }
+
+  return 0;
+}
+
+#define v1 whati->f1->i_FI_CONSTANT.val
+#define v2 whati->f2->i_FI_CONSTANT.val
+#define v3 whati->f3->i_FI_CONSTANT.val
+#define vv(i) items[i]->i_FI_CONSTANT.val
+#define runtime(fmt, ...) cf_error("filter preevaluation, line %d: " fmt, ifs->lino, ##__VA_ARGS__)
+#define fpool cfg_mem
+#define falloc(size) cfg_alloc(size)
+/* Instruction constructors */
+FID_WR_PUT(3)
+#undef v1
+#undef v2
+#undef v3
+#undef vv
+
+/* Line dumpers */
+#define INDENT (((const char *) f_dump_line_indent_str) + sizeof(f_dump_line_indent_str) - (indent) - 1)
+static const char f_dump_line_indent_str[] = "                                ";
+
+FID_WR_PUT(6)
+
+void f_dump_line(const struct f_line *dest, uint indent)
+{
+  if (!dest) {
+    debug("%sNo filter line (NULL)\n", INDENT);
+    return;
+  }
+  debug("%sFilter line %p (len=%u)\n", INDENT, dest, dest->len);
+  for (uint i=0; i<dest->len; i++) {
+    const struct f_line_item *item = &dest->items[i];
+    debug("%sInstruction %s at line %u\n", INDENT, f_instruction_name_(item->fi_code), item->lineno);
+    switch (item->fi_code) {
+FID_WR_PUT(7)
+      default: bug("Unknown instruction %x in f_dump_line", item->fi_code);
+    }
+  }
+  debug("%sFilter line %p dump done\n", INDENT, dest);
+}
+
+/* Linearize */
+static uint
+linearize(struct f_line *dest, const struct f_inst *what, uint pos)
+{
+  for ( ; what; what = what->next) {
+    switch (what->fi_code) {
+FID_WR_PUT(8)
+    }
+    pos++;
+  }
+  return pos;
+}
+
+struct f_line *
+f_linearize_concat(const struct f_inst * const inst[], uint count)
+{
+  uint len = 0;
+  for (uint i=0; i<count; i++)
+    for (const struct f_inst *what = inst[i]; what; what = what->next)
+      len += what->size;
+
+  struct f_line *out = cfg_allocz(sizeof(struct f_line) + sizeof(struct f_line_item)*len);
+
+  for (uint i=0; i<count; i++)
+    out->len = linearize(out, inst[i], out->len);
+
+#ifdef LOCAL_DEBUG
+  f_dump_line(out, 0);
+#endif
+  return out;
+}
+
+/* Filter line comparison */
+int
+f_same(const struct f_line *fl1, const struct f_line *fl2)
+{
+  if ((!fl1) && (!fl2))
+    return 1;
+  if ((!fl1) || (!fl2))
+    return 0;
+  if (fl1->len != fl2->len)
+    return 0;
+  for (uint i=0; i<fl1->len; i++) {
+#define f1_ (&(fl1->items[i]))
+#define f2_ (&(fl2->items[i]))
+    if (f1_->fi_code != f2_->fi_code)
+      return 0;
+    if (f1_->flags != f2_->flags)
+      return 0;
+
+    switch(f1_->fi_code) {
+FID_WR_PUT(9)
+    }
+  }
+#undef f1_
+#undef f2_
+  return 1;
+}
+
+
+/* Part of FI_SWITCH filter iterator */
+static void
+f_add_tree_lines(const struct f_tree *t, void *fit_)
+{
+  struct filter_iterator * fit = fit_;
+
+  if (t->data)
+    BUFFER_PUSH(fit->lines) = t->data;
+}
+
+/* Filter line iterator */
+void
+f_add_lines(const struct f_line_item *what, struct filter_iterator *fit)
+{
+  switch(what->fi_code) {
+FID_WR_PUT(10)
+  }
+}
+
+
+#if defined(__GNUC__) && __GNUC__ >= 6
+#pragma GCC diagnostic pop
+#endif
+
+FID_WR_DIRECT(H)
+/* Filter instruction codes */
+enum f_instruction_code {
+FID_WR_PUT(4)m4_dnl
+} PACKED;
+
+/* Filter instruction structure for config */
+struct f_inst {
+  struct f_inst *next;			/* Next instruction */
+  enum f_instruction_code fi_code;	/* Instruction code */
+  enum f_type type;			/* Type of returned value, if known */
+  int size;				/* How many instructions are underneath */
+  int lineno;				/* Line number */
+  union {
+FID_WR_PUT(1)m4_dnl
+  };
+};
+
+/* Filter line item */
+struct f_line_item {
+  enum f_instruction_code fi_code;	/* What to do */
+  enum f_instruction_flags flags;	/* Flags, instruction-specific */
+  uint lineno;				/* Where */
+  union {
+FID_WR_PUT(2)m4_dnl
+  };
+};
+
+/* Instruction constructors */
+FID_WR_PUT(3)
+m4_divert(-1)
+
+#	4) Shipout
+#
+#	Everything is prepared in FID_WR_PUT_LIST now. Let's go!
+
+m4_changequote(`,')
+
+#	Flusher auxiliary macro
+m4_define(FID_FLUSH, `m4_ifelse($1,$2,,[[m4_undivert($1)FID_FLUSH(m4_eval($1+1),$2)]])')
+
+#	Defining the macro used in FID_WR_PUT_LIST
+m4_define(FID_WR_DPUT, `m4_undivert($1)')
+
+#	After the code is read and parsed, we:
+m4_m4wrap(`INST_FLUSH()m4_divert(0)FID_WR_PUT_LIST()m4_divert(-1)FID_FLUSH(1,200)')
+
+m4_changequote([[,]])
+#	And now M4 is going to parse f-inst.c, fill the diversions
+#	and after the file is done, the content of m4_m4wrap (see before)
+#	is executed.
--- a/filter/f-inst.c
+++ b/filter/f-inst.c
--- a/filter/f-inst.h
+++ b/filter/f-inst.h
@ -0,0 +1,112 @@
+/*
+ *	BIRD Internet Routing Daemon -- Filter instructions
+ *
+ *	(c) 1999 Pavel Machek <pavel@ucw.cz>
+ *	(c) 2018--2019 Maria Matejka <mq@jmq.cz>
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ *
+ *	Filter interpreter data structures and internal API.
+ *	See filter/f-inst.c for documentation.
+ */
+
+#ifndef _BIRD_F_INST_H_
+#define _BIRD_F_INST_H_
+
+#include "nest/bird.h"
+#include "conf/conf.h"
+#include "filter/filter.h"
+#include "filter/data.h"
+#include "lib/buffer.h"
+#include "lib/flowspec.h"
+
+/* Flags for instructions */
+enum f_instruction_flags {
+  FIF_PRINTED = 1,		/* FI_PRINT_AND_DIE: message put in buffer */
+} PACKED;
+
+/* Include generated filter instruction declarations */
+#include "filter/inst-gen.h"
+
+#define f_new_inst(...) MACRO_CONCAT_AFTER(f_new_inst_, MACRO_FIRST(__VA_ARGS__))(__VA_ARGS__)
+
+/* Convert the instruction back to the enum name */
+const char *f_instruction_name_(enum f_instruction_code fi);
+static inline const char *f_instruction_name(enum f_instruction_code fi)
+{ return f_instruction_name_(fi) + 3; }
+
+/* Filter structures for execution */
+/* Line of instructions to be unconditionally executed one after another */
+struct f_line {
+  uint len;				/* Line length */
+  u8 args;				/* Function: Args required */
+  u8 vars;
+  struct f_line_item items[0];		/* The items themselves */
+};
+
+/* Convert the f_inst infix tree to the f_line structures */
+struct f_line *f_linearize_concat(const struct f_inst * const inst[], uint count);
+static inline struct f_line *f_linearize(const struct f_inst *root)
+{ return f_linearize_concat(&root, 1); }
+
+void f_dump_line(const struct f_line *, uint indent);
+
+
+/* Recursive iteration over filter instructions */
+
+struct filter_iterator {
+  BUFFER_(const struct f_line *) lines;
+};
+
+void f_add_lines(const struct f_line_item *what, struct filter_iterator *fit);
+
+#define FILTER_ITERATE_INIT(fit, filter, pool)			\
+  ({								\
+    BUFFER_INIT((fit)->lines, (pool), 32);			\
+    BUFFER_PUSH((fit)->lines) = (filter)->root;			\
+  })
+
+#define FILTER_ITERATE(fit, fi) ({				\
+  const struct f_line *fl_;					\
+  while (!BUFFER_EMPTY((fit)->lines))				\
+  {								\
+    BUFFER_POP((fit)->lines);					\
+    fl_ = (fit)->lines.data[(fit)->lines.used];			\
+    for (uint i_ = 0; i_ < fl_->len; i_++)			\
+    {								\
+      const struct f_line_item *fi = &fl_->items[i_];		\
+      f_add_lines(fi, (fit));
+
+#define FILTER_ITERATE_END } } })
+
+#define FILTER_ITERATE_CLEANUP(fit)				\
+  ({								\
+    mb_free((fit)->lines.data);					\
+    memset((fit), 0, sizeof(struct filter_iterator));		\
+  })
+
+
+struct filter *f_new_where(struct f_inst *);
+static inline struct f_dynamic_attr f_new_dynamic_attr(u8 type, enum f_type f_type, uint code) /* Type as core knows it, type as filters know it, and code of dynamic attribute */
+{ return (struct f_dynamic_attr) { .type = type, .f_type = f_type, .ea_code = code }; }   /* f_type currently unused; will be handy for static type checking */
+static inline struct f_dynamic_attr f_new_dynamic_attr_bit(u8 bit, enum f_type f_type, uint code) /* Type as core knows it, type as filters know it, and code of dynamic attribute */
+{ return (struct f_dynamic_attr) { .type = EAF_TYPE_BITFIELD, .bit = bit, .f_type = f_type, .ea_code = code }; }   /* f_type currently unused; will be handy for static type checking */
+static inline struct f_static_attr f_new_static_attr(int f_type, int code, int readonly)
+{ return (struct f_static_attr) { .f_type = f_type, .sa_code = code, .readonly = readonly }; }
+struct f_inst *f_generate_complex(enum f_instruction_code fi_code, struct f_dynamic_attr da, struct f_inst *argument);
+struct f_inst *f_generate_roa_check(struct rtable_config *table, struct f_inst *prefix, struct f_inst *asn);
+
+/* Hook for call bt_assert() function in configuration */
+extern void (*bt_assert_hook)(int result, const struct f_line_item *assert);
+
+/* Bird Tests */
+struct f_bt_test_suite {
+  node n;			/* Node in config->tests */
+  const struct f_line *fn;	/* Root of function */
+  const struct f_line *cmp;	/* Compare to this function */
+  const char *fn_name;		/* Name of test */
+  const char *dsc;		/* Description */
+  int result;			/* Desired result */
+};
+
+#endif
--- a/filter/f-util.c
+++ b/filter/f-util.c
@ -2,6 +2,7 @@
 *	Filters: utility functions
 *
 *	Copyright 1998 Pavel Machek <pavel@ucw.cz>
+ *		  2017 Jan Maria Matejka <mq@ucw.cz>
 *
 *	Can be freely distributed and used under the terms of the GNU GPL.
 */
@ -9,77 +10,174 @@
 #include "nest/bird.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
+#include "filter/f-inst.h"
+#include "lib/idm.h"
+#include "nest/protocol.h"
+#include "nest/route.h"

 #define P(a,b) ((a<<8) | b)

-struct f_inst *
-f_new_inst(void)
-{
-  struct f_inst * ret;
-  ret = cfg_alloc(sizeof(struct f_inst));
-  ret->code = ret->aux = 0;
-  ret->arg1 = ret->arg2 = ret->next = NULL;
-  ret->lineno = ifs->lino;
-  return ret;
-}
-
-struct f_inst *
-f_new_dynamic_attr(int type, int f_type UNUSED, int code)
-{
-  /* FIXME: Remove the f_type parameter? */
-  struct f_inst *f = f_new_inst();
-  f->aux = type;
-  f->a2.i = code;
-  return f;
-}
-
-/*
- * Generate set_dynamic( operation( get_dynamic(), argument ) )
- */
-struct f_inst *
-f_generate_complex(int operation, int operation_aux, struct f_inst *dyn, struct f_inst *argument)
-{
-  struct f_inst *set_dyn = f_new_inst(),
-                *oper = f_new_inst(),
-                *get_dyn = dyn;
-
-  *set_dyn = *get_dyn;
-  get_dyn->code = P('e','a');
-  oper->code = operation;
-  oper->aux = operation_aux;
-  oper->a1.p = get_dyn;
-  oper->a2.p = argument;
-  set_dyn->code = P('e','S');
-  set_dyn->a1.p = oper;
-  return set_dyn;
-}
-
-struct f_inst *
-f_generate_roa_check(struct rtable_config *table, struct f_inst *prefix, struct f_inst *asn)
-{
-  struct f_inst_roa_check *ret = cfg_allocz(sizeof(struct f_inst_roa_check));
-  ret->i.code = P('R','C');
-  ret->i.lineno = ifs->lino;
-  ret->i.arg1 = prefix;
-  ret->i.arg2 = asn;
-  /* prefix == NULL <-> asn == NULL */
-
-  if (table->addr_type != NET_ROA4 && table->addr_type != NET_ROA6)
-    cf_error("%s is not a ROA table", table->name);
-  ret->rtc = table;
-
-  return &ret->i;
-}
-
-char *
-filter_name(struct filter *filter)
+const char *
+filter_name(const struct filter *filter)
 {
  if (!filter)
    return "ACCEPT";
  else if (filter == FILTER_REJECT)
    return "REJECT";
-  else if (!filter->name)
+  else if (!filter->sym)
    return "(unnamed)";
  else
-    return filter->name;
+    return filter->sym->name;
 }
+
+struct filter *f_new_where(struct f_inst *where)
+{
+  struct f_inst *cond = f_new_inst(FI_CONDITION, where,
+				   f_new_inst(FI_DIE, F_ACCEPT),
+				   f_new_inst(FI_DIE, F_REJECT));
+
+  struct filter *f = cfg_allocz(sizeof(struct filter));
+  f->root = f_linearize(cond);
+  return f;
+}
+
+#define CA_KEY(n)	n->name, n->fda.type
+#define CA_NEXT(n)	n->next
+#define CA_EQ(na,ta,nb,tb)	(!strcmp(na,nb) && (ta == tb))
+#define CA_FN(n,t)	(mem_hash(n, strlen(n)) ^ (t*0xaae99453U))
+#define CA_ORDER	8 /* Fixed */
+
+struct ca_storage {
+  struct ca_storage *next;
+  struct f_dynamic_attr fda;
+  u32 uc;
+  char name[0];
+};
+
+HASH(struct ca_storage) ca_hash;
+
+static struct idm ca_idm;
+static struct ca_storage **ca_storage;
+static uint ca_storage_max;
+
+static void
+ca_free(resource *r)
+{
+  struct custom_attribute *ca = (void *) r;
+  struct ca_storage *cas = HASH_FIND(ca_hash, CA, ca->name, ca->fda->type);
+  ASSERT(cas);
+
+  ca->name = NULL;
+  ca->fda = NULL;
+  if (!--cas->uc) {
+    uint id = EA_CUSTOM_ID(cas->fda.ea_code);
+    idm_free(&ca_idm, id);
+    HASH_REMOVE(ca_hash, CA, cas);
+    ca_storage[id] = NULL;
+    mb_free(cas);
+  }
+}
+
+static void
+ca_dump(resource *r)
+{
+  struct custom_attribute *ca = (void *) r;
+  debug("name \"%s\" id 0x%04x ea_type 0x%02x f_type 0x%02x\n",
+      ca->name, ca->fda->ea_code, ca->fda->type, ca->fda->f_type);
+}
+
+static struct resclass ca_class = {
+  .name = "Custom attribute",
+  .size = sizeof(struct custom_attribute),
+  .free = ca_free,
+  .dump = ca_dump,
+  .lookup = NULL,
+  .memsize = NULL,
+};
+
+struct custom_attribute *
+ca_lookup(pool *p, const char *name, int f_type)
+{
+  int ea_type;
+
+  switch (f_type) {
+    case T_INT:
+      ea_type = EAF_TYPE_INT;
+      break;
+    case T_IP:
+      ea_type = EAF_TYPE_IP_ADDRESS;
+      break;
+    case T_QUAD:
+      ea_type = EAF_TYPE_ROUTER_ID;
+      break;
+    case T_PATH:
+      ea_type = EAF_TYPE_AS_PATH;
+      break;
+    case T_CLIST:
+      ea_type = EAF_TYPE_INT_SET;
+      break;
+    case T_ECLIST:
+      ea_type = EAF_TYPE_EC_SET;
+      break;
+    case T_LCLIST:
+      ea_type = EAF_TYPE_LC_SET;
+      break;
+    default:
+      cf_error("Custom route attribute of unsupported type");
+  }
+
+  static int inited = 0;
+  if (!inited) {
+    idm_init(&ca_idm, &root_pool, 8);
+    HASH_INIT(ca_hash, &root_pool, CA_ORDER);
+
+    ca_storage_max = 256;
+    ca_storage = mb_allocz(&root_pool, sizeof(struct ca_storage *) * ca_storage_max);
+
+    inited++;
+  }
+
+  struct ca_storage *cas = HASH_FIND(ca_hash, CA, name, ea_type);
+  if (cas) {
+    cas->uc++;
+  } else {
+
+    uint id = idm_alloc(&ca_idm);
+
+    if (id >= EA_CUSTOM_BIT)
+      cf_error("Too many custom attributes.");
+
+    if (id >= ca_storage_max) {
+      ca_storage_max *= 2;
+      ca_storage = mb_realloc(ca_storage, sizeof(struct ca_storage *) * ca_storage_max * 2);
+    }
+
+    cas = mb_allocz(&root_pool, sizeof(struct ca_storage) + strlen(name) + 1);
+    cas->fda = f_new_dynamic_attr(ea_type, f_type, EA_CUSTOM(id));
+    cas->uc = 1;
+
+    strcpy(cas->name, name);
+    ca_storage[id] = cas;
+
+    HASH_INSERT(ca_hash, CA, cas);
+  }
+
+  struct custom_attribute *ca = ralloc(p, &ca_class);
+  ca->fda = &(cas->fda);
+  ca->name = cas->name;
+  return ca;
+}
+
+const char *
+ea_custom_name(uint ea)
+{
+  uint id = EA_CUSTOM_ID(ea);
+  if (id >= ca_storage_max)
+    return NULL;
+
+  if (!ca_storage[id])
+    return NULL;
+
+  return ca_storage[id]->name;
+}
+
--- a/filter/filter.c
+++ b/filter/filter.c
--- a/filter/filter.h
+++ b/filter/filter.h
@ -2,6 +2,7 @@
 *	BIRD Internet Routing Daemon -- Filters
 *
 *	(c) 1999 Pavel Machek <pavel@ucw.cz>
+ *	(c) 2018--2019 Maria Matejka <mq@jmq.cz>
 *
 *	Can be freely distributed and used under the terms of the GNU GPL.
 */
@ -11,213 +12,71 @@

 #include "lib/resource.h"
 #include "lib/ip.h"
+#include "lib/macro.h"
 #include "nest/route.h"
 #include "nest/attrs.h"

-struct f_inst {		/* Instruction */
-  struct f_inst *next;	/* Structure is 16 bytes, anyway */
-  u16 code;		/* Instruction code, see the interpret() function and P() macro */
-  u16 aux;		/* Extension to instruction code, T_*, EA_*, EAF_*  */
-  union {
-    uint i;
-    void *p;
-  } a1;			/* The first argument */
-  union {
-    uint i;
-    void *p;
-  } a2;			/* The second argument */
-  int lineno;
+/* Possible return values of filter execution */
+enum filter_return {
+  F_NOP = 0,
+  F_NONL,
+  F_RETURN,
+  F_ACCEPT,   /* Need to preserve ordering: accepts < rejects! */
+  F_REJECT,
+  F_ERROR,
 };

-#define arg1 a1.p
-#define arg2 a2.p
+static inline const char *filter_return_str(const enum filter_return fret) {
+  switch (fret) {
+#define FRS(x) case x: return #x
+    FRS(F_NOP);
+    FRS(F_NONL);
+    FRS(F_RETURN);
+    FRS(F_ACCEPT);
+    FRS(F_REJECT);
+    FRS(F_ERROR);
+#undef FRS
+    default: bug("This shall not happen");
+  }
+}

-/* Not enough fields in f_inst for three args used by roa_check() */
-struct f_inst_roa_check {
-  struct f_inst i;
-  struct rtable_config *rtc;
-};
-
-struct f_inst3 {
-  struct f_inst i;
-  union {
-    int i;
-    void *p;
-  } a3;
-};
-
-#define INST3(x) (((struct f_inst3 *) x)->a3)
-
-
-struct f_prefix {
-  net_addr net;
-  u8 lo, hi;
-};
-
-struct f_val {
-  int type;		/* T_*  */
-  union {
-    uint i;
-    u64 ec;
-    lcomm lc;
-    ip_addr ip;
-    const net_addr *net;
-    char *s;
-    struct f_tree *t;
-    struct f_trie *ti;
-    struct adata *ad;
-    struct f_path_mask *path_mask;
-  } val;
-};
+struct f_val;

+/* The filter encapsulating structure to be pointed-to from outside */
+struct f_line;
 struct filter {
-  char *name;
-  struct f_inst *root;
+  struct symbol *sym;
+  const struct f_line *root;
 };

-struct f_inst *f_new_inst(void);
-struct f_inst *f_new_dynamic_attr(int type, int f_type, int code);	/* Type as core knows it, type as filters know it, and code of dynamic attribute */
-struct f_tree *f_new_tree(void);
-struct f_inst *f_generate_complex(int operation, int operation_aux, struct f_inst *dyn, struct f_inst *argument);
-struct f_inst *f_generate_roa_check(struct rtable_config *table, struct f_inst *prefix, struct f_inst *asn);
-
-
-struct f_tree *build_tree(struct f_tree *);
-struct f_tree *find_tree(struct f_tree *t, struct f_val val);
-int same_tree(struct f_tree *t1, struct f_tree *t2);
-void tree_format(struct f_tree *t, buffer *buf);
-
-struct f_trie *f_new_trie(linpool *lp, uint node_size);
-void *trie_add_prefix(struct f_trie *t, const net_addr *n, uint l, uint h);
-int trie_match_net(struct f_trie *t, const net_addr *n);
-int trie_same(struct f_trie *t1, struct f_trie *t2);
-void trie_format(struct f_trie *t, buffer *buf);
-
-struct ea_list;
 struct rte;

-int f_run(struct filter *filter, struct rte **rte, struct ea_list **tmp_attrs, struct linpool *tmp_pool, int flags);
-struct f_val f_eval_rte(struct f_inst *expr, struct rte **rte, struct linpool *tmp_pool);
-struct f_val f_eval(struct f_inst *expr, struct linpool *tmp_pool);
-uint f_eval_int(struct f_inst *expr);
-u32 f_eval_asn(struct f_inst *expr);
+enum filter_return f_run(const struct filter *filter, struct rte **rte, struct linpool *tmp_pool, int flags);
+enum filter_return f_eval_rte(const struct f_line *expr, struct rte **rte, struct linpool *tmp_pool);
+uint f_eval_int(const struct f_line *expr);
+enum filter_return f_eval_buf(const struct f_line *expr, struct linpool *tmp_pool, buffer *buf);

-char *filter_name(struct filter *filter);
-int filter_same(struct filter *new, struct filter *old);
+const char *filter_name(const struct filter *filter);
+int filter_same(const struct filter *new, const struct filter *old);
+int f_same(const struct f_line *f1, const struct f_line *f2);

-int i_same(struct f_inst *f1, struct f_inst *f2);
+void filter_commit(struct config *new, struct config *old);

-int val_compare(struct f_val v1, struct f_val v2);
-int val_same(struct f_val v1, struct f_val v2);
-
-void val_format(struct f_val v, buffer *buf);
-
-
-#define F_NOP 0
-#define F_NONL 1
-#define F_ACCEPT 2	/* Need to preserve ordering: accepts < rejects! */
-#define F_REJECT 3
-#define F_ERROR 4
-#define F_QUITBIRD 5
+void filters_dump_all(void);

 #define FILTER_ACCEPT NULL
-#define FILTER_REJECT ((void *) 1)
-#define FILTER_UNDEF  ((void *) 2)	/* Used in BGP */
+#define FILTER_REJECT ((struct filter *) 1)
+#define FILTER_UNDEF  ((struct filter *) 2)	/* Used in BGP */

-/* Type numbers must be in 0..0xff range */
-#define T_MASK 0xff
+#define FF_SILENT 2			/* Silent filter execution */

-/* Internal types */
-/* Do not use type of zero, that way we'll see errors easier. */
-#define T_VOID 1
-
-/* User visible types, which fit in int */
-#define T_INT 0x10
-#define T_BOOL 0x11
-#define T_PAIR 0x12  /*	Notice that pair is stored as integer: first << 16 | second */
-#define T_QUAD 0x13
-
-/* Put enumerational types in 0x30..0x3f range */
-#define T_ENUM_LO 0x30
-#define T_ENUM_HI 0x3f
-
-#define T_ENUM_RTS 0x30
-#define T_ENUM_BGP_ORIGIN 0x31
-#define T_ENUM_SCOPE 0x32
-#define T_ENUM_RTC 0x33
-#define T_ENUM_RTD 0x34
-#define T_ENUM_ROA 0x35
-#define T_ENUM_NETTYPE 0x36
-#define T_ENUM_RA_PREFERENCE 0x37
-
-/* new enums go here */
-#define T_ENUM_EMPTY 0x3f	/* Special hack for atomic_aggr */
-
-#define T_ENUM T_ENUM_LO ... T_ENUM_HI
-
-/* Bigger ones */
-#define T_IP 0x20
-#define T_NET 0x21
-#define T_STRING 0x22
-#define T_PATH_MASK 0x23	/* mask for BGP path */
-#define T_PATH 0x24		/* BGP path */
-#define T_CLIST 0x25		/* Community list */
-#define T_EC 0x26		/* Extended community value, u64 */
-#define T_ECLIST 0x27		/* Extended community list */
-#define T_LC 0x28		/* Large community value, lcomm */
-#define T_LCLIST 0x29		/* Large community list */
-#define T_RD 0x2a		/* Route distinguisher for VPN addresses */
-
-#define T_RETURN 0x40
-#define T_SET 0x80
-#define T_PREFIX_SET 0x81
-
-
-#define SA_FROM		 1
-#define SA_GW		 2
-#define SA_NET		 3
-#define SA_PROTO	 4
-#define SA_SOURCE	 5
-#define SA_SCOPE	 6
-#define SA_DEST    	 7
-#define SA_IFNAME  	 8
-#define SA_IFINDEX    	 9
-
-
-struct f_tree {
-  struct f_tree *left, *right;
-  struct f_val from, to;
-  void *data;
+/* Custom route attributes */
+struct custom_attribute {
+  resource r;
+  struct f_dynamic_attr *fda;
+  const char *name;
 };

-struct f_trie_node
-{
-  ip_addr addr, mask, accept;
-  uint plen;
-  struct f_trie_node *c[2];
-};
-
-struct f_trie
-{
-  linpool *lp;
-  int zero;
-  uint node_size;
-  struct f_trie_node root[0];		/* Root trie node follows */
-};
-
-#define NEW_F_VAL struct f_val * val; val = cfg_alloc(sizeof(struct f_val));
-
-#define FF_FORCE_TMPATTR 1		/* Force all attributes to be temporary */
-
-/* Bird Tests */
-struct f_bt_test_suite {
-  node n;			/* Node in config->tests */
-  struct f_inst *fn;		/* Root of function */
-  const char *fn_name;		/* Name of test */
-  const char *dsc;		/* Description */
-};
-
-/* Hook for call bt_assert() function in configuration */
-extern void (*bt_assert_hook)(int result, struct f_inst *assert);
+struct custom_attribute *ca_lookup(pool *p, const char *name, int ea_type);

 #endif
--- a/filter/filter_test.c
+++ b/filter/filter_test.c
@ -17,44 +17,44 @@
 #include "test/bt-utils.h"

 #include "filter/filter.h"
+#include "filter/data.h"
+#include "filter/f-inst.h"
 #include "conf/conf.h"

 #define BT_CONFIG_FILE "filter/test.conf"


-static struct config *
-parse_config_file(const void *filename_void)
-{
-  bt_bird_init();
-
-  size_t fn_size = strlen((const char *) filename_void) + 1;
-  char *filename = alloca(fn_size);
-  strncpy(filename, filename_void, fn_size);
-
-  struct config *c = bt_config_file_parse(filename);
-  bt_bird_cleanup();
-
-  return c;
-}
-
 static int
-run_function(const void *parsed_fn_def)
+t_reconfig(void)
 {
-  /* XXX: const -> non-const */
-  struct f_inst *f = (struct f_inst *) parsed_fn_def;
-
-  linpool *tmp = lp_new_default(&root_pool);
-  struct f_val res = f_eval(f, tmp);
-  rfree(tmp);
-
-  if (res.type == T_RETURN && res.val.i >= F_REJECT)
+  if (!bt_config_file_parse(BT_CONFIG_FILE))
    return 0;

+  struct symbol *s;
+  WALK_LIST(s, config->symbols)
+    if ((s->class == SYM_FUNCTION) || (s->class == SYM_FILTER))
+      bt_assert_msg((s->flags & SYM_FLAG_SAME), "Symbol %s same check", s->name);
+
  return 1;
 }

+static int
+run_function(const void *arg)
+{
+  const struct f_bt_test_suite *t = arg;
+
+  if (t->cmp)
+    return t->result == f_same(t->fn, t->cmp);
+
+  linpool *tmp = lp_new_default(&root_pool);
+  enum filter_return fret = f_eval(t->fn, tmp, NULL);
+  rfree(tmp);
+
+  return (fret < F_REJECT);
+}
+
 static void
-bt_assert_filter(int result, struct f_inst *assert)
+bt_assert_filter(int result, const struct f_line_item *assert)
 {
  int bt_suit_case_result = 1;
  if (!result)
@ -64,24 +64,28 @@ bt_assert_filter(int result, struct f_inst *assert)
    bt_suit_case_result = 0;
  }

-  bt_log_suite_case_result(bt_suit_case_result, "Assertion at line %d (%s)", assert->lineno, (char *) assert->a2.p);
+  bt_log_suite_case_result(bt_suit_case_result, "Assertion at line %d (%s)",
+      assert->lineno, assert->i_FI_ASSERT.s);
 }

 int
 main(int argc, char *argv[])
 {
  bt_init(argc, argv);
+  bt_bird_init();

-  struct config *c = parse_config_file(BT_CONFIG_FILE);
+  bt_assert_hook = bt_assert_filter;

-  if (c)
-  {
-    bt_assert_hook = bt_assert_filter;
+  /* Initial test.conf parsing, must be done here */
+  if (!bt_config_file_parse(BT_CONFIG_FILE))
+    abort();

-    struct f_bt_test_suite *t;
-    WALK_LIST(t, c->tests)
-      bt_test_suite_base(run_function, t->fn_name, t->fn, BT_FORKING, BT_TIMEOUT, "%s", t->dsc);
-  }
+  bt_test_suite(t_reconfig, "Testing reconfiguration");

+  struct f_bt_test_suite *t;
+  WALK_LIST(t, config->tests)
+    bt_test_suite_base(run_function, t->fn_name, t, BT_FORKING, BT_TIMEOUT, "%s", t->dsc);
+
+  bt_bird_cleanup();
  return bt_exit_value();
 }
--- a/filter/test-reconf-begin.conf
+++ b/filter/test-reconf-begin.conf
@ -0,0 +1,23 @@
+router id 1.1.1.1;
+protocol device {}
+
+function a() {
+  return true;
+}
+
+function b() {
+  return a();
+}
+
+function c() {
+  return b();
+}
+
+filter d {
+  if c() then accept; else reject;
+}
+
+protocol static {
+  ipv4 { import filter d; };
+  route 10.0.0.0/24 unreachable;
+}
--- a/filter/test-reconf-end.conf
+++ b/filter/test-reconf-end.conf
@ -0,0 +1,23 @@
+router id 1.1.1.1;
+protocol device {}
+
+function a() {
+  return false;
+}
+
+function b() {
+  return a();
+}
+
+function c() {
+  return b();
+}
+
+filter d {
+  if c() then accept; else reject;
+}
+
+protocol static {
+  ipv4 { import filter d; };
+  route 10.0.0.0/24 unreachable;
+}
--- a/filter/test.conf
+++ b/filter/test.conf
@ -7,8 +7,7 @@
 router id 62.168.0.1;

 /* We have to setup any protocol */
-protocol static { ipv4; }
-
+protocol device { }



@ -25,8 +24,19 @@ function onef(int a)
 	return 1;
 }

+function twof(int a)
+{
+	return 2;
+}

+function oneg(int a)
+{
+	return 1;
+}

+bt_test_same(onef, onef, 1);
+bt_test_same(onef, oneg, 1);
+bt_test_same(onef, twof, 0);

 /*
 * 	Testing boolean expressions
@ -53,8 +63,8 @@ bool b;
 	bt_assert(! false && ! false && true);
 	bt_assert(1 < 2 && 1 != 3);
 	bt_assert(true && true && ! false);
-	bt_assert(true || 1+"a");
-	bt_assert(!(false && 1+"a"));
+	# bt_assert(true || 1+"a");
+	# bt_assert(!(false && 1+"a"));
 	bt_assert(!(true && false));
 }

@ -62,7 +72,6 @@ bt_test_suite(t_bool, "Testing boolean expressions");



-
 /*
 *	Testing integers
 *	----------------
@ -126,6 +135,7 @@ int set is;
 	bt_assert(2 ~ [ 1, 2, 3 ]);
 	bt_assert(5 ~ [ 4 .. 7 ]);
 	bt_assert(1 !~ [ 2, 3, 4 ]);
+	bt_assert(999 !~ [ 666, 333 ]);

 	is = [ 2, 3, 4, 7..11 ];
 	bt_assert(10 ~ is);
@ -370,6 +380,9 @@ function t_enum()
 {
 	bt_assert(format(RTS_DUMMY)  = "(enum 30)0");
 	bt_assert(format(RTS_STATIC) = "(enum 30)1");
+	bt_assert(format(NET_IP4) = "(enum 36)1");
+	bt_assert(format(NET_VPN6) = "(enum 36)4");
+
 	bt_assert(RTS_STATIC ~ [RTS_STATIC, RTS_DEVICE]);
 	bt_assert(RTS_BGP !~ [RTS_STATIC, RTS_DEVICE]);
 }
@ -448,7 +461,8 @@ function t_prefix_set()
 prefix set pxs;
 {
 	pxs = [ 1.2.0.0/16, 1.4.0.0/16+, 44.66.88.64/30{24,28}, 12.34.56.0/24{8,16} ];
-	bt_assert(format(pxs) = "[1.2.0.0/112{::0.1.0.0}, 1.4.0.0/112{::0.1.255.255}, 12.34.0.0/112{::1.255.0.0}, 44.66.88.64/124{::1f0}]");
+	bt_assert(format(pxs) = "[1.2.0.0/16{0.1.0.0}, 1.4.0.0/16{0.1.255.255}, 12.34.0.0/16{1.255.0.0}, 44.66.88.64/28{0.0.1.240}]");
+
 	bt_assert(1.2.0.0/16 ~ pxs);
 	bt_assert(1.4.0.0/16 ~ pxs);
 	bt_assert(1.4.0.0/18 ~ pxs);
@ -587,11 +601,15 @@ function mkpath(int a; int b)
 	return [= a b 3 2 1 =];
 }

+define set35 = [3 .. 5];
+
 function t_path()
 bgpmask pm1;
 bgppath p2;
+int set set12;
 {
 	pm1 = [= 4 3 2 1 =];
+	set12 = [1, 2];

 	bt_assert(format(pm1) = "[= 4 3 2 1 =]");

@ -616,6 +634,8 @@ bgppath p2;
 	bt_assert(p2 !~ [8, ten..(2*ten)]);
 	bt_assert(p2 ~ [= * 4 3 * 1 =]);
 	bt_assert(p2 ~ [= (3+2) (2*2) 3 2 1 =]);
+	bt_assert(p2 ~ [= 5 [2, 4, 6] 3 [1..2] 1 =]);
+	bt_assert(p2 ~ [= 5 set35 3 set12 set12 =]);
 	bt_assert(p2 ~ mkpath(5, 4));

 	bt_assert(p2.len = 5);
@ -626,7 +646,6 @@ bgppath p2;
 	bt_assert(delete(p2, 3) = prepend(prepend(prepend(prepend(+empty+, 1), 2), 4), 5));
 	bt_assert(filter(p2, [1..3]) = prepend(prepend(prepend(+empty+, 1), 2), 3));

-	pm1 = [= 1 2 * 3 4 5 =];
 	p2 = prepend( + empty +, 5 );
 	p2 = prepend( p2, 4 );
 	p2 = prepend( p2, 3 );
@ -634,9 +653,17 @@ bgppath p2;
 	p2 = prepend( p2, 2 );
 	p2 = prepend( p2, 1 );

-	bt_assert(p2 ~ pm1);
+	bt_assert(p2 !~ [= 1 2 3 4 5 =]);
+	bt_assert(p2 ~ [= 1 2 * 4 5 =]);
+	bt_assert(p2 ~ [= 1 2 * 3 4 5 =]);
+	bt_assert(p2 ~ [= 1 2 3+ 4 5 =]);
+	bt_assert(p2 ~ [= 1 2 3+ 4+ 5 =]);
+	bt_assert(p2 !~ [= 1 2 3+ 5+ 4 5 =]);
+	bt_assert(p2 !~ [= 1 2 3 3 5+ 4 5 =]);
 	bt_assert(delete(p2, 3) = prepend(prepend(prepend(prepend(+empty+, 5), 4), 2), 1));
 	bt_assert(delete(p2, [4..5]) = prepend(prepend(prepend(prepend(+empty+, 3), 3), 2), 1));
+
+	bt_assert(format([= 1 2+ 3 =]) = "[= 1 2 + 3 =]");
 }

 bt_test_suite(t_path, "Testing paths");
@ -1005,6 +1032,60 @@ bt_test_suite(t_lclist_set, "Testing sets of large communities");



+/*
+ * 	Testing Route Distinguishers
+ * 	----------------------------
+ */
+
+function t_rd()
+rd x;
+{
+	x = 12345:20000;
+	bt_assert(format(x) = "12345:20000");
+
+	bt_assert(x = 12345:20000);
+	bt_assert(x < 12345:20010);
+	bt_assert(x != 12346:20000);
+	bt_assert(x != 2:12345:20000);
+	bt_assert(!(x > 12345:200010));
+
+	bt_assert(format(0:1:2) = "1:2");
+	bt_assert(format(10.0.0.1:1000) = "10.0.0.1:1000");
+	bt_assert(format(100000:20000) = "100000:20000");
+	bt_assert(format(2:100000:20000) = "100000:20000");
+	bt_assert(format(2:1000:1000) = "2:1000:1000");
+}
+
+bt_test_suite(t_rd, "Testing route distinguishers");
+
+
+
+
+/*
+ * 	Testing sets of Route Distinguishers
+ * 	------------------------------------
+ */
+
+function t_rd_set()
+rd set rds;
+{
+	rds = [10:20, 100000:100..100000:200];
+	bt_assert(format(rds)  = "[10:20, 100000:100..100000:200]");
+
+	bt_assert(10:20  ~ rds);
+	bt_assert(10:21 !~ rds);
+	bt_assert(100000:90 !~ rds);
+	bt_assert(100000:100 ~ rds);
+	bt_assert(100000:128 ~ rds);
+	bt_assert(100000:200 ~ rds);
+	bt_assert(100010:150 !~ rds);
+}
+
+bt_test_suite(t_rd_set, "Testing sets of route distinguishers");
+
+
+
+
 /*
 * 	Testing defined() function
 * 	--------------------------
@ -1054,6 +1135,11 @@ int i;
 	return 0;
 }

+function callmeagain(int a; int b; int c)
+{
+	return a + b + c;
+}
+
 function fifteen()
 {
 	return 15;
@ -1070,6 +1156,7 @@ function t_call_function()
 	bt_assert(callme(3, 2) = 6);
 	bt_assert(callme(4, 4) = 16);
 	bt_assert(callme(7, 2) = 14);
+	bt_assert(callmeagain(1, 2, 3) = 6);
 }

 bt_test_suite(t_call_function, "Testing calling functions");
@ -1103,6 +1190,10 @@ bt_test_suite(t_include, "Testing including another config file");
 function t_if_else()
 int i;
 {
+	/* Empty blocks regression test */
+	if true then {}
+	else {}
+
 	if true then
 		bt_assert(true);

@ -1112,6 +1203,10 @@ int i;
 		bt_assert(true);
 	else
 		bt_assert(false);
+
+	/* Empty blocks regression test */
+	if true then {}
+	else {}
 }

 bt_test_suite(t_if_else, "Testing if-else statement");
@ -1164,7 +1259,7 @@ int j;

 filter roa_filter
 {
-	if net ~ [ 10.0.0.0/8{16,24}, 2000::/3{16,96} ] then {
+	if net ~ [ 10.0.0.0/8{16,24} ] || net ~ [ 2000::/3{16,96} ] then {
 		accept;
 	}
 	reject;
@ -1188,10 +1283,9 @@ protocol static
  route 2001:0db8:85a3:8a2e::/64 max 96 as 1000;
 }

-function test_roa_check()
+function t_roa_check()
 prefix pfx;
 {
-	# cannot be tested in __startup(), sorry
 	bt_assert(roa_check(r4, 10.10.0.0/16, 1000) = ROA_UNKNOWN);
 	bt_assert(roa_check(r4, 10.0.0.0/8, 1000) = ROA_UNKNOWN);
 	bt_assert(roa_check(r4, 10.110.0.0/16, 1000) = ROA_VALID);
@ -1246,44 +1340,14 @@ prefix pfx;
 	bt_assert(pfx.asn = 1234);
 }

-bt_test_suite(test_roa_check, "Testing ROA");
+bt_test_suite(t_roa_check, "Testing ROA");

-/*
- *      Testing Mixed Net Types
- *      -----------------------
- */

-function t_mixed_prefix()
-prefix set pxs;
-prefix set pxt;
-{
-	pxs = [ 98.45.0.0/16, 128.128.0.0/12+, 2200::/42-, ::ffff:d000:0/100{98,102}];
-	bt_assert(format(pxs) = "[::/0, ::/2{c000::}, 98.45.0.0/112{::0.1.0.0}, 128.128.0.0/108{::0.31.255.255}, 208.0.0.0/100{::124.0.0.0}, 2200::/42{ffff:ffff:ffc0::}]");
-	bt_assert(::fe00:0:0/88  !~ pxs);
-	bt_assert(::fffe:0:0/95  !~ pxs);
-	bt_assert(::ffff:d800:0/101 ~ pxs);
-	bt_assert(216.0.0.0/5 ~ pxs);
-	bt_assert(212.0.0.0/6 ~ pxs);
-	bt_assert(212.0.0.0/7 !~ pxs);
-	bt_assert(::ffff:8080:8080/121 ~ pxs);
-	bt_assert(::/0 ~ pxs);
-	bt_assert(0.0.0.0/0 !~ pxs);
-	bt_assert(128.135.64.17/32 ~ pxs);
-
-#	pxt = [ 0:1:2 10.1.10.0/24, 0:5:10000 10.1.10.0/24 ];
-#	print pxt;
-
-	bt_assert(format(NET_IP4) = "(enum 36)1"); ## if (net.type = NET_IP4) ...
-	bt_assert(format(NET_VPN6) = "(enum 36)4");
-	bt_assert(format(0:1:2) = "1:2");
-}
-
-bt_test_suite(t_mixed_prefix, "Testing mixed net types");


 filter vpn_filter
 {
-	bt_assert(format(net) = "0:1:2 10.1.10.0/24");
+	bt_assert(format(net) = "1:2 10.1.10.0/24");
 	bt_assert(net.type = NET_VPN4);
 	bt_assert(net.type != NET_IP4);
 	bt_assert(net.type != NET_IP6);
@ -1294,6 +1358,13 @@ filter vpn_filter
 	  NET_IP6: print "IPV6";
 	}

+	bt_check_assign(from, 10.20.30.40);
+	bt_check_assign(gw, 55.55.55.44);
+
+	bgp_community.add((3,5));
+	bgp_ext_community.add((ro, 135, 999));
+	bgp_large_community.add((6464156, 89646354, 8675643));
+
 	accept;
 }

@ -1305,3 +1376,9 @@ protocol static
 	vpn4 { table v4; import filter vpn_filter; };
 	route 0:1:2 10.1.10.0/24 unreachable;
 }
+
+protocol static
+{
+	ipv6 { import where false; };
+	route fd01::/48 unreachable;
+}
--- a/filter/test.conf2
+++ b/filter/test.conf2
@ -43,7 +43,6 @@ protocol static {
 			print scope;
 			if !(scope ~ [ SCOPE_HOST, SCOPE_SITE ]) then {
 				print "Failed in test";
-				quitbird;
 			}

 			preference = 15;
@ -55,29 +54,28 @@ protocol static {
 			rip_metric = rip_metric + 5;
 			print rip_metric;

-#
-# TODO: uncomment this part after finishing BGP integration version
-#
-#			bgp_community = -empty-;
-#			print "hi";
-#			bgp_community = add(bgp_community, (1,2));
-#			print "hello";
-#			bgp_community = add(bgp_community, (2,3));
-#			bgp_community.add((4,5));
-#			print "community = ", bgp_community;
-#			bgp_community.delete((2,3));
-#			print "community = ", bgp_community;
-#			bgp_community.empty;
-#			print "community = ", bgp_community;
-#			print "done";
+			bgp_community = -empty-;
+			print "hi";
+			bgp_community = add(bgp_community, (1,2));
+			print "hello";
+			bgp_community = add(bgp_community, (2,3));
+			bgp_community.add((4,5));
+			print "community = ", bgp_community;
+			bgp_community.delete((2,3));
+			print "community = ", bgp_community;
+			bgp_community.empty;
+			print "community = ", bgp_community;
+			print "done";
+
+			accept;
 		};
 	};
 	route 0.0.0.0/0 via 195.113.31.113;
 	route 62.168.0.0/25 reject;
 	route 1.2.3.4/32 via 195.113.31.124;
 	route 10.0.0.0/8 reject;
-	route 10.1.1.0:255.255.255.0 via 62.168.0.3;
-	route 10.1.2.0:255.255.255.0 via 62.168.0.3;
-	route 10.1.3.0:255.255.255.0 via 62.168.0.4;
+	route 10.1.1.0/24 via 62.168.0.3;
+	route 10.1.2.0/24 via 62.168.0.3;
+	route 10.1.3.0/24 via 62.168.0.4;
 	route 10.2.0.0/24 via "arc0";
 }
--- a/filter/tree.c
+++ b/filter/tree.c
@ -10,6 +10,7 @@
 #include "nest/bird.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
+#include "filter/data.h"

 /**
 * find_tree
@ -23,15 +24,15 @@
 * Both set matching and |switch() { }| construction is implemented using this function,
 * thus both are as fast as they can be.
 */
-struct f_tree *
-find_tree(struct f_tree *t, struct f_val val)
+const struct f_tree *
+find_tree(const struct f_tree *t, const struct f_val *val)
 {
  if (!t)
    return NULL;
-  if ((val_compare(t->from, val) != 1) &&
-      (val_compare(t->to, val) != -1))
+  if ((val_compare(&(t->from), val) != 1) &&
+      (val_compare(&(t->to), val) != -1))
    return t;
-  if (val_compare(t->from, val) == -1)
+  if (val_compare(&(t->from), val) == -1)
    return find_tree(t->right, val);
  else
    return find_tree(t->left, val);
@ -56,7 +57,7 @@ build_tree_rec(struct f_tree **buf, int l, int h)
 static int 
 tree_compare(const void *p1, const void *p2)
 {
-  return val_compare((* (struct f_tree **) p1)->from, (* (struct f_tree **) p2)->from);
+  return val_compare(&((* (struct f_tree **) p1)->from), &((* (struct f_tree **) p2)->from));
 }

 /**
@ -102,12 +103,7 @@ build_tree(struct f_tree *from)
 struct f_tree *
 f_new_tree(void)
 {
-  struct f_tree * ret;
-  ret = cfg_alloc(sizeof(struct f_tree));
-  ret->left = ret->right = NULL;
-  ret->from.type = ret->to.type = T_VOID;
-  ret->from.val.i = ret->to.val.i = 0;
-  ret->data = NULL;
+  struct f_tree *ret = cfg_allocz(sizeof(struct f_tree));
  return ret;
 }

@ -119,39 +115,39 @@ f_new_tree(void)
 * Compares two trees and returns 1 if they are same
 */
 int
-same_tree(struct f_tree *t1, struct f_tree *t2)
+same_tree(const struct f_tree *t1, const struct f_tree *t2)
 {
  if ((!!t1) != (!!t2))
    return 0;
  if (!t1)
    return 1;
-  if (val_compare(t1->from, t2->from))
+  if (val_compare(&(t1->from), &(t2->from)))
    return 0;
-  if (val_compare(t1->to, t2->to))
+  if (val_compare(&(t1->to), &(t2->to)))
    return 0;
  if (!same_tree(t1->left, t2->left))
    return 0;
  if (!same_tree(t1->right, t2->right))
    return 0;
-  if (!i_same(t1->data, t2->data))
+  if (!f_same(t1->data, t2->data))
    return 0;
  return 1;
 }


 static void
-tree_node_format(struct f_tree *t, buffer *buf)
+tree_node_format(const struct f_tree *t, buffer *buf)
 {
  if (t == NULL)
    return;

  tree_node_format(t->left, buf);

-  val_format(t->from, buf);
-  if (val_compare(t->from, t->to) != 0)
+  val_format(&(t->from), buf);
+  if (val_compare(&(t->from), &(t->to)) != 0)
  {
    buffer_puts(buf, "..");
-    val_format(t->to, buf);
+    val_format(&(t->to), buf);
  }
  buffer_puts(buf, ", ");

@ -159,7 +155,7 @@ tree_node_format(struct f_tree *t, buffer *buf)
 }

 void
-tree_format(struct f_tree *t, buffer *buf)
+tree_format(const struct f_tree *t, buffer *buf)
 {
  buffer_puts(buf, "[");

@ -174,3 +170,14 @@ tree_format(struct f_tree *t, buffer *buf)

  buffer_puts(buf, "]");
 }
+
+void
+tree_walk(const struct f_tree *t, void (*hook)(const struct f_tree *, void *), void *data)
+{
+  if (!t)
+    return;
+
+  tree_walk(t->left, hook, data);
+  hook(t, data);
+  tree_walk(t->right, hook, data);
+}
--- a/filter/tree_test.c
+++ b/filter/tree_test.c
@ -10,6 +10,7 @@
 #include "test/bt-utils.h"

 #include "filter/filter.h"
+#include "filter/data.h"
 #include "conf/conf.h"

 #define MAX_TREE_HEIGHT 13
@ -226,8 +227,8 @@ t_find(void)
    };
    for(looking_up_value.val.i = 0; looking_up_value.val.i < nodes_count; looking_up_value.val.i++)
    {
-      struct f_tree *found_tree = find_tree(tree, looking_up_value);
-      bt_assert((val_compare(looking_up_value, found_tree->from) == 0) && (val_compare(looking_up_value, found_tree->to) == 0));
+      const struct f_tree *found_tree = find_tree(tree, &looking_up_value);
+      bt_assert((val_compare(&looking_up_value, &(found_tree->from)) == 0) && (val_compare(&looking_up_value, &(found_tree->to)) == 0));
    }
  }

@ -278,11 +279,11 @@ t_find_ranges(void)

    for(*i = 0; *i <= max_value; *i += (uint)bt_random()/nodes_count)
    {
-      struct f_tree *found_tree = find_tree(tree, needle);
+      const struct f_tree *found_tree = find_tree(tree, &needle);
      bt_debug("searching: %u \n", *i);
      bt_assert(
-	  (val_compare(needle, found_tree->from) == 0) || (val_compare(needle, found_tree->to) == 0) ||
-	 ((val_compare(needle, found_tree->from) == 1) && (val_compare(needle, found_tree->to) == -1))
+	  (val_compare(&needle, &(found_tree->from)) == 0) || (val_compare(&needle, &(found_tree->to)) == 0) ||
+	 ((val_compare(&needle, &(found_tree->from)) == 1) && (val_compare(&needle, &(found_tree->to)) == -1))
      );
    }
  }
--- a/filter/trie.c
+++ b/filter/trie.c
@ -73,12 +73,14 @@
 #include "lib/string.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
+#include "filter/data.h"


 /*
- * In the trie code, the prefix length is internally treated as for the whole
- * ip_addr, regardless whether it contains an IPv4 or IPv6 address. Therefore,
- * remaining definitions make sense.
+ * In the trie_add_prefix(), we use ip_addr (assuming that it is the same as
+ * ip6_addr) to handle both IPv4 and IPv6 prefixes. In contrast to rest of the
+ * BIRD, IPv4 addresses are just zero-padded from right. That is why we have
+ * ipt_from_ip4() and ipt_to_ip4() macros below.
 */

 #define ipa_mkmask(x) ip6_mkmask(x)
@ -86,26 +88,30 @@
 #define ipa_pxlen(x,y) ip6_pxlen(x,y)
 #define ipa_getbit(x,n) ip6_getbit(x,n)

+#define ipt_from_ip4(x) _MI6(_I(x), 0, 0, 0)
+#define ipt_to_ip4(x) _MI4(_I0(x))
+

 /**
 * f_new_trie - allocates and returns a new empty trie
 * @lp: linear pool to allocate items from
- * @node_size: node size to be used (&f_trie_node and user data)
+ * @data_size: user data attached to node
 */
 struct f_trie *
-f_new_trie(linpool *lp, uint node_size)
+f_new_trie(linpool *lp, uint data_size)
 {
  struct f_trie * ret;
-  ret = lp_allocz(lp, sizeof(struct f_trie) + node_size);
+  ret = lp_allocz(lp, sizeof(struct f_trie) + data_size);
  ret->lp = lp;
-  ret->node_size = node_size;
+  ret->ipv4 = -1;
+  ret->data_size = data_size;
  return ret;
 }

-static inline struct f_trie_node *
-new_node(struct f_trie *t, int plen, ip_addr paddr, ip_addr pmask, ip_addr amask)
+static inline struct f_trie_node4 *
+new_node4(struct f_trie *t, int plen, ip4_addr paddr, ip4_addr pmask, ip4_addr amask)
 {
-  struct f_trie_node *n = lp_allocz(t->lp, t->node_size);
+  struct f_trie_node4 *n = lp_allocz(t->lp, sizeof(struct f_trie_node4) + t->data_size);
  n->plen = plen;
  n->addr = paddr;
  n->mask = pmask;
@ -113,12 +119,51 @@ new_node(struct f_trie *t, int plen, ip_addr paddr, ip_addr pmask, ip_addr amask
  return n;
 }

-static inline void
-attach_node(struct f_trie_node *parent, struct f_trie_node *child)
+static inline struct f_trie_node6 *
+new_node6(struct f_trie *t, int plen, ip6_addr paddr, ip6_addr pmask, ip6_addr amask)
 {
-  parent->c[ipa_getbit(child->addr, parent->plen) ? 1 : 0] = child;
+  struct f_trie_node6 *n = lp_allocz(t->lp, sizeof(struct f_trie_node6) + t->data_size);
+  n->plen = plen;
+  n->addr = paddr;
+  n->mask = pmask;
+  n->accept = amask;
+  return n;
 }

+static inline struct f_trie_node *
+new_node(struct f_trie *t, int plen, ip_addr paddr, ip_addr pmask, ip_addr amask)
+{
+  if (t->ipv4)
+    return (struct f_trie_node *) new_node4(t, plen, ipt_to_ip4(paddr), ipt_to_ip4(pmask), ipt_to_ip4(amask));
+  else
+    return (struct f_trie_node *) new_node6(t, plen, ipa_to_ip6(paddr), ipa_to_ip6(pmask), ipa_to_ip6(amask));
+}
+
+static inline void
+attach_node4(struct f_trie_node4 *parent, struct f_trie_node4 *child)
+{
+  parent->c[ip4_getbit(child->addr, parent->plen) ? 1 : 0] = child;
+}
+
+static inline void
+attach_node6(struct f_trie_node6 *parent, struct f_trie_node6 *child)
+{
+  parent->c[ip6_getbit(child->addr, parent->plen) ? 1 : 0] = child;
+}
+
+static inline void
+attach_node(struct f_trie_node *parent, struct f_trie_node *child, int v4)
+{
+  if (v4)
+    attach_node4(&parent->v4, &child->v4);
+  else
+    attach_node6(&parent->v6, &child->v6);
+}
+
+#define GET_ADDR(N,F,X) ((X) ? ipt_from_ip4((N)->v4.F) : ipa_from_ip6((N)->v6.F))
+#define SET_ADDR(N,F,X,V) ({ if (X) (N)->v4.F =ipt_to_ip4(V); else (N)->v6.F =ipa_to_ip6(V); })
+
+#define GET_CHILD(N,F,X,I) ((X) ? (struct f_trie_node *) (N)->v4.c[I] : (struct f_trie_node *) (N)->v6.c[I])
 /**
 * trie_add_prefix
 * @t: trie to add to
@ -132,21 +177,30 @@ attach_node(struct f_trie_node *parent, struct f_trie_node *child)
 *
 * Returns a pointer to the allocated node. The function can return a pointer to
 * an existing node if @px and @plen are the same. If px/plen == 0/0 (or ::/0),
- * a pointer to the root node is returned.
+ * a pointer to the root node is returned. Returns NULL when called with
+ * mismatched IPv4/IPv6 net type.
 */

 void *
 trie_add_prefix(struct f_trie *t, const net_addr *net, uint l, uint h)
 {
-  ip_addr px = net_prefix(net);
  uint plen = net_pxlen(net);
+  ip_addr px;
+  int v4;

-  if (net->type == NET_IP4)
+  switch (net->type)
  {
-    const uint delta = IP6_MAX_PREFIX_LENGTH - IP4_MAX_PREFIX_LENGTH;
-    plen += delta;
-    l += delta;
-    h += delta;
+  case NET_IP4: px = ipt_from_ip4(net4_prefix(net)); v4 = 1; break;
+  case NET_IP6: px = ipa_from_ip6(net6_prefix(net)); v4 = 0; break;
+  default: bug("invalid type");
+  }
+
+  if (t->ipv4 != v4)
+  {
+    if (t->ipv4 < 0)
+      t->ipv4 = v4;
+    else
+      return NULL;
  }

  if (l == 0)
@ -161,95 +215,136 @@ trie_add_prefix(struct f_trie *t, const net_addr *net, uint l, uint h)
  ip_addr pmask = ipa_mkmask(plen);
  ip_addr paddr = ipa_and(px, pmask);
  struct f_trie_node *o = NULL;
-  struct f_trie_node *n = t->root;
+  struct f_trie_node *n = &t->root;

  while (n)
    {
-      ip_addr cmask = ipa_and(n->mask, pmask);
+      ip_addr naddr = GET_ADDR(n, addr, v4);
+      ip_addr nmask = GET_ADDR(n, mask, v4);
+      ip_addr accept = GET_ADDR(n, accept, v4);
+      ip_addr cmask = ipa_and(nmask, pmask);
+      uint nlen = v4 ? n->v4.plen : n->v6.plen;

-      if (ipa_compare(ipa_and(paddr, cmask), ipa_and(n->addr, cmask)))
-	{
+      if (ipa_compare(ipa_and(paddr, cmask), ipa_and(naddr, cmask)))
+        {
 	  /* We are out of path - we have to add branching node 'b'
 	     between node 'o' and node 'n', and attach new node 'a'
 	     as the other child of 'b'. */
-	  int blen = ipa_pxlen(paddr, n->addr);
+	  int blen = ipa_pxlen(paddr, naddr);
 	  ip_addr bmask = ipa_mkmask(blen);
 	  ip_addr baddr = ipa_and(px, bmask);

 	  /* Merge accept masks from children to get accept mask for node 'b' */
-	  ip_addr baccm = ipa_and(ipa_or(amask, n->accept), bmask);
+	  ip_addr baccm = ipa_and(ipa_or(amask, accept), bmask);

 	  struct f_trie_node *a = new_node(t, plen, paddr, pmask, amask);
 	  struct f_trie_node *b = new_node(t, blen, baddr, bmask, baccm);
-	  attach_node(o, b);
-	  attach_node(b, n);
-	  attach_node(b, a);
+	  attach_node(o, b, v4);
+	  attach_node(b, n, v4);
+	  attach_node(b, a, v4);
 	  return a;
 	}

-      if (plen < n->plen)
+      if (plen < nlen)
 	{
 	  /* We add new node 'a' between node 'o' and node 'n' */
-	  amask = ipa_or(amask, ipa_and(n->accept, pmask));
+	  amask = ipa_or(amask, ipa_and(accept, pmask));
 	  struct f_trie_node *a = new_node(t, plen, paddr, pmask, amask);
-	  attach_node(o, a);
-	  attach_node(a, n);
+	  attach_node(o, a, v4);
+	  attach_node(a, n, v4);
 	  return a;
 	}

-      if (plen == n->plen)
+      if (plen == nlen)
 	{
 	  /* We already found added node in trie. Just update accept mask */
-	  n->accept = ipa_or(n->accept, amask);
+	  accept = ipa_or(accept, amask);
+	  SET_ADDR(n, accept, v4, accept);
 	  return n;
 	}

      /* Update accept mask part M2 and go deeper */
-      n->accept = ipa_or(n->accept, ipa_and(amask, n->mask));
+      accept = ipa_or(accept, ipa_and(amask, nmask));
+      SET_ADDR(n, accept, v4, accept);

      /* n->plen < plen and plen <= 32 (128) */
      o = n;
-      n = n->c[ipa_getbit(paddr, n->plen) ? 1 : 0];
+      n = GET_CHILD(n, c, v4, ipa_getbit(paddr, nlen) ? 1 : 0);
    }

  /* We add new tail node 'a' after node 'o' */
  struct f_trie_node *a = new_node(t, plen, paddr, pmask, amask);
-  attach_node(o, a);
+  attach_node(o, a, v4);

  return a;
 }

 static int
-trie_match_prefix(struct f_trie *t, ip_addr px, uint plen)
+trie_match_net4(const struct f_trie *t, ip4_addr px, uint plen)
 {
-  ip_addr pmask = ipa_mkmask(plen);
-  ip_addr paddr = ipa_and(px, pmask);
+  ip4_addr pmask = ip4_mkmask(plen);
+  ip4_addr paddr = ip4_and(px, pmask);

  if (plen == 0)
    return t->zero;

  int plentest = plen - 1;
-  struct f_trie_node *n = t->root;
+  const struct f_trie_node4 *n = &t->root.v4;

-  while(n)
-    {
-      ip_addr cmask = ipa_and(n->mask, pmask);
+  while (n)
+  {
+    ip4_addr cmask = ip4_and(n->mask, pmask);

-      /* We are out of path */
-      if (ipa_compare(ipa_and(paddr, cmask), ipa_and(n->addr, cmask)))
-	return 0;
+    /* We are out of path */
+    if (ip4_compare(ip4_and(paddr, cmask), ip4_and(n->addr, cmask)))
+      return 0;

-      /* Check accept mask */
-      if (ipa_getbit(n->accept, plentest))
-	return 1;
+    /* Check accept mask */
+    if (ip4_getbit(n->accept, plentest))
+      return 1;

-      /* We finished trie walk and still no match */
-      if (plen <= n->plen)
-	return 0;
+    /* We finished trie walk and still no match */
+    if (plen <= n->plen)
+      return 0;

-      /* Choose children */
-      n =  n->c[(ipa_getbit(paddr, n->plen)) ? 1 : 0];
-    }
+    /* Choose children */
+    n =  n->c[(ip4_getbit(paddr, n->plen)) ? 1 : 0];
+  }
+
+  return 0;
+}
+
+static int
+trie_match_net6(const struct f_trie *t, ip6_addr px, uint plen)
+{
+  ip6_addr pmask = ip6_mkmask(plen);
+  ip6_addr paddr = ip6_and(px, pmask);
+
+  if (plen == 0)
+    return t->zero;
+
+  int plentest = plen - 1;
+  const struct f_trie_node6 *n = &t->root.v6;
+
+  while (n)
+  {
+    ip6_addr cmask = ip6_and(n->mask, pmask);
+
+    /* We are out of path */
+    if (ip6_compare(ip6_and(paddr, cmask), ip6_and(n->addr, cmask)))
+      return 0;
+
+    /* Check accept mask */
+    if (ip6_getbit(n->accept, plentest))
+      return 1;
+
+    /* We finished trie walk and still no match */
+    if (plen <= n->plen)
+      return 0;
+
+    /* Choose children */
+    n =  n->c[(ip6_getbit(paddr, n->plen)) ? 1 : 0];
+  }

  return 0;
 }
@ -264,22 +359,27 @@ trie_match_prefix(struct f_trie *t, ip_addr px, uint plen)
 * is such prefix pattern in the trie.
 */
 int
-trie_match_net(struct f_trie *t, const net_addr *n)
+trie_match_net(const struct f_trie *t, const net_addr *n)
 {
-  uint add = 0;
+  switch (n->type)
+  {
+  case NET_IP4:
+  case NET_VPN4:
+  case NET_ROA4:
+    return t->ipv4 ? trie_match_net4(t, net4_prefix(n), net_pxlen(n)) : 0;

-  switch (n->type) {
-    case NET_IP4:
-    case NET_VPN4:
-    case NET_ROA4:
-      add = IP6_MAX_PREFIX_LENGTH - IP4_MAX_PREFIX_LENGTH;
+  case NET_IP6:
+  case NET_VPN6:
+  case NET_ROA6:
+    return !t->ipv4 ? trie_match_net6(t, net6_prefix(n), net_pxlen(n)) : 0;
+
+  default:
+    return 0;
  }
-
-  return trie_match_prefix(t, net_prefix(n), net_pxlen(n) + add);
 }

 static int
-trie_node_same(struct f_trie_node *t1, struct f_trie_node *t2)
+trie_node_same4(const struct f_trie_node4 *t1, const struct f_trie_node4 *t2)
 {
  if ((t1 == NULL) && (t2 == NULL))
    return 1;
@ -288,11 +388,28 @@ trie_node_same(struct f_trie_node *t1, struct f_trie_node *t2)
    return 0;

  if ((t1->plen != t2->plen) ||
-      (! ipa_equal(t1->addr, t2->addr)) ||
-      (! ipa_equal(t1->accept, t2->accept)))
+      (! ip4_equal(t1->addr, t2->addr)) ||
+      (! ip4_equal(t1->accept, t2->accept)))
    return 0;

-  return trie_node_same(t1->c[0], t2->c[0]) && trie_node_same(t1->c[1], t2->c[1]);
+  return trie_node_same4(t1->c[0], t2->c[0]) && trie_node_same4(t1->c[1], t2->c[1]);
+}
+
+static int
+trie_node_same6(const struct f_trie_node6 *t1, const struct f_trie_node6 *t2)
+{
+  if ((t1 == NULL) && (t2 == NULL))
+    return 1;
+
+  if ((t1 == NULL) || (t2 == NULL))
+    return 0;
+
+  if ((t1->plen != t2->plen) ||
+      (! ip6_equal(t1->addr, t2->addr)) ||
+      (! ip6_equal(t1->accept, t2->accept)))
+    return 0;
+
+  return trie_node_same6(t1->c[0], t2->c[0]) && trie_node_same6(t1->c[1], t2->c[1]);
 }

 /**
@ -303,22 +420,41 @@ trie_node_same(struct f_trie_node *t1, struct f_trie_node *t2)
 * Compares two tries and returns 1 if they are same
 */
 int
-trie_same(struct f_trie *t1, struct f_trie *t2)
+trie_same(const struct f_trie *t1, const struct f_trie *t2)
 {
-  return (t1->zero == t2->zero) && trie_node_same(t1->root, t2->root);
+  if ((t1->zero != t2->zero) || (t1->ipv4 != t2->ipv4))
+    return 0;
+
+  if (t1->ipv4)
+    return trie_node_same4(&t1->root.v4, &t2->root.v4);
+  else
+    return trie_node_same6(&t1->root.v6, &t2->root.v6);
 }

 static void
-trie_node_format(struct f_trie_node *t, buffer *buf)
+trie_node_format4(const struct f_trie_node4 *t, buffer *buf)
 {
  if (t == NULL)
    return;

-  if (ipa_nonzero(t->accept))
-    buffer_print(buf, "%I/%d{%I}, ", t->addr, t->plen, t->accept);
+  if (ip4_nonzero(t->accept))
+    buffer_print(buf, "%I4/%d{%I4}, ", t->addr, t->plen, t->accept);

-  trie_node_format(t->c[0], buf);
-  trie_node_format(t->c[1], buf);
+  trie_node_format4(t->c[0], buf);
+  trie_node_format4(t->c[1], buf);
+}
+
+static void
+trie_node_format6(const struct f_trie_node6 *t, buffer *buf)
+{
+  if (t == NULL)
+    return;
+
+  if (ip6_nonzero(t->accept))
+    buffer_print(buf, "%I6/%d{%I6}, ", t->addr, t->plen, t->accept);
+
+  trie_node_format6(t->c[0], buf);
+  trie_node_format6(t->c[1], buf);
 }

 /**
@ -329,13 +465,17 @@ trie_node_format(struct f_trie_node *t, buffer *buf)
 * Prints the trie to the supplied buffer.
 */
 void
-trie_format(struct f_trie *t, buffer *buf)
+trie_format(const struct f_trie *t, buffer *buf)
 {
  buffer_puts(buf, "[");

  if (t->zero)
-    buffer_print(buf, "%I/%d, ", IPA_NONE, 0);
-  trie_node_format(t->root, buf);
+    buffer_print(buf, "%I/%d, ", t->ipv4 ? IPA_NONE4 : IPA_NONE6, 0);
+
+  if (t->ipv4)
+    trie_node_format4(&t->root.v4, buf);
+  else
+    trie_node_format6(&t->root.v6, buf);

  if (buf->pos == buf->end)
    return;
--- a/filter/trie_test.c
+++ b/filter/trie_test.c
@ -10,6 +10,7 @@
 #include "test/bt-utils.h"

 #include "filter/filter.h"
+#include "filter/data.h"
 #include "conf/conf.h"

 #define TESTS_NUM		10
@ -102,7 +103,7 @@ t_match_net(void)
  {
    list prefixes; /* of structs f_extended_prefix */
    init_list(&prefixes);
-    struct f_trie *trie = f_new_trie(config->mem, sizeof(struct f_trie_node));
+    struct f_trie *trie = f_new_trie(config->mem, 0);

    generate_random_ipv6_prefixes(&prefixes);
    struct f_prefix_node *n;
@ -142,8 +143,8 @@ t_trie_same(void)
  int round;
  for (round = 0; round < TESTS_NUM*4; round++)
  {
-    struct f_trie * trie1 = f_new_trie(config->mem, sizeof(struct f_trie_node));
-    struct f_trie * trie2 = f_new_trie(config->mem, sizeof(struct f_trie_node));
+    struct f_trie * trie1 = f_new_trie(config->mem, 0);
+    struct f_trie * trie2 = f_new_trie(config->mem, 0);

    list prefixes; /* a list of f_extended_prefix structures */
    init_list(&prefixes);
--- a/lib/Makefile
+++ b/lib/Makefile
@ -1,7 +1,7 @@
-src := bitops.c checksum.c event.c flowspec.c idm.c ip.c lists.c mac.c md5.c mempool.c net.c patmatch.c printf.c resource.c sha1.c sha256.c sha512.c slab.c slists.c tbf.c timer.c xmalloc.c
+src := bitmap.c bitops.c checksum.c event.c flowspec.c idm.c ip.c lists.c mac.c md5.c mempool.c net.c patmatch.c printf.c resource.c sha1.c sha256.c sha512.c slab.c slists.c strtoul.c tbf.c timer.c xmalloc.c
 obj := $(src-o-files)
 $(all-daemon)

-tests_src := heap_test.c buffer_test.c event_test.c flowspec_test.c bitops_test.c patmatch_test.c fletcher16_test.c slist_test.c checksum_test.c lists_test.c mac_test.c ip_test.c hash_test.c printf_test.c
+tests_src := bitmap_test.c heap_test.c buffer_test.c event_test.c flowspec_test.c bitops_test.c patmatch_test.c fletcher16_test.c slist_test.c checksum_test.c lists_test.c mac_test.c ip_test.c hash_test.c printf_test.c
 tests_targets := $(tests_targets) $(tests-target-files)
 tests_objs := $(tests_objs) $(src-o-files)
--- a/lib/birdlib.h
+++ b/lib/birdlib.h
@ -38,7 +38,7 @@ struct align_probe { char x; long int y; };
 #define ARRAY_SIZE(a) (sizeof(a)/sizeof(*(a)))
 #define BYTES(n) ((((uint) (n)) + 7) / 8)
 #define CALL(fn, args...) ({ if (fn) fn(args); })
-#define ADVANCE(w, r, l) ({ r -= l; w += l; })
+#define ADVANCE(w, r, l) ({ r -= (l); w += (l); })

 static inline int uint_cmp(uint i1, uint i2)
 { return (int)(i1 > i2) - (int)(i1 < i2); }
@ -56,6 +56,13 @@ static inline int u64_cmp(u64 i1, u64 i2)
 #define BIT32_CLR(b,p)		((b)[(p)/32] &= ~BIT32_VAL(p))
 #define BIT32_ZERO(b,l)		memset((b), 0, (l)/8)

+/* The same, but counting bits from MSB */
+#define BIT32R_VAL(p)		((((u32) 1) << 31) >> ((p) % 32))
+#define BIT32R_TEST(b,p)	((b)[(p)/32] & BIT32R_VAL(p))
+#define BIT32R_SET(b,p)		((b)[(p)/32] |= BIT32R_VAL(p))
+#define BIT32R_CLR(b,p)		((b)[(p)/32] &= ~BIT32R_VAL(p))
+#define BIT32R_ZERO(b,l)	memset((b), 0, (l)/8)
+
 #ifndef NULL
 #define NULL ((void *) 0)
 #endif
@ -65,6 +72,11 @@ static inline int u64_cmp(u64 i1, u64 i2)
 #define NORET __attribute__((noreturn))
 #define UNUSED __attribute__((unused))
 #define PACKED __attribute__((packed))
+#define NONNULL(...) __attribute__((nonnull((__VA_ARGS__))))
+
+#ifndef HAVE_THREAD_LOCAL
+#define _Thread_local
+#endif

 /* Microsecond time */

@ -151,10 +163,30 @@ void debug(const char *msg, ...);	/* Printf to debug output */
 #define DBG(x, y...) do { } while(0)
 #endif

+#define ASSERT_DIE(x) do { if (!(x)) bug("Assertion '%s' failed at %s:%d", #x, __FILE__, __LINE__); } while(0)
+
+#define EXPENSIVE_CHECK(x) /* intentionally left blank */
+
 #ifdef DEBUGGING
-#define ASSERT(x) do { if (!(x)) bug("Assertion '%s' failed at %s:%d", #x, __FILE__, __LINE__); } while(0)
+#define ASSERT(x) ASSERT_DIE(x)
+#define ASSUME(x) ASSERT_DIE(x)
+#ifdef ENABLE_EXPENSIVE_CHECKS
+#undef EXPENSIVE_CHECK
+#define EXPENSIVE_CHECK(x) ASSERT_DIE(x)
+#endif
 #else
 #define ASSERT(x) do { if (!(x)) log(L_BUG "Assertion '%s' failed at %s:%d", #x, __FILE__, __LINE__); } while(0)
+#define ASSUME(x) /* intentionally left blank */
+#endif
+
+
+#ifdef DEBUGGING
+asm(
+    ".pushsection \".debug_gdb_scripts\", \"MS\",@progbits,1\n"
+    ".byte 1\n" /* Python */
+    ".asciz \"bird-gdb.py\"\n"
+    ".popsection\n"
+   );
 #endif

 /* Pseudorandom numbers */
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@ -0,0 +1,197 @@
+/*
+ *	BIRD Library -- Bitmaps
+ *
+ *	(c) 2019 Ondrej Zajicek <santiago@crfreenet.org>
+ *	(c) 2019 CZ.NIC z.s.p.o.
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include <stdlib.h>
+
+#include "nest/bird.h"
+#include "lib/bitmap.h"
+#include "lib/bitops.h"
+#include "lib/resource.h"
+
+
+/*
+ *	Basic bitmap
+ */
+
+void
+bmap_init(struct bmap *b, pool *p, uint size)
+{
+  b->size = BIRD_ALIGN(size, 4);
+  b->data = mb_allocz(p, b->size);
+}
+
+void
+bmap_reset(struct bmap *b, uint size)
+{
+  b->size = BIRD_ALIGN(size, 4);
+  memset(b->data, 0, b->size);
+}
+
+void
+bmap_grow(struct bmap *b, uint need)
+{
+  uint size = b->size * 2;
+  while (size < need)
+    size *= 2;
+
+  uint old_size = b->size;
+  b->size = size;
+  b->data = mb_realloc(b->data, b->size);
+
+  ASSERT(size >= old_size);
+  memset(b->data + (old_size / 4), 0, size - old_size);
+}
+
+void
+bmap_free(struct bmap *b)
+{
+  mb_free(b->data);
+  b->size = 0;
+  b->data = NULL;
+}
+
+
+
+/*
+ *	Hierarchical bitmap
+ */
+
+#define B256_SIZE(b)  BIRD_ALIGN(b, 32)
+#define B256_STEP(b) (BIRD_ALIGN(b, 8192) >> 8)
+
+void
+hmap_init(struct hmap *b, pool *p, uint size)
+{
+  b->size[0] = B256_SIZE(size);
+  b->size[1] = B256_STEP(b->size[0]);
+  b->size[2] = B256_STEP(b->size[1]);
+  b->size[3] = sizeof(b->root);
+
+  b->data[0] = mb_allocz(p, b->size[0]);
+  b->data[1] = mb_allocz(p, b->size[1]);
+  b->data[2] = mb_allocz(p, b->size[2]);
+  b->data[3] = b->root;
+
+  memset(b->root, 0, sizeof(b->root));
+}
+
+static void
+hmap_grow(struct hmap *b, uint need)
+{
+  uint size = b->size[0] * 2;
+  while (size < need)
+    size *= 2;
+
+  for (uint i = 0; i < 3; i++)
+  {
+    uint old_size = b->size[i];
+    b->size[i] = size;
+    b->data[i] = mb_realloc(b->data[i], b->size[i]);
+
+    ASSERT(size >= old_size);
+    memset(b->data[i] + (old_size / 4), 0, size - old_size);
+
+    size = B256_STEP(size);
+  }
+}
+
+void
+hmap_free(struct hmap *b)
+{
+  mb_free(b->data[0]);
+  mb_free(b->data[1]);
+  mb_free(b->data[2]);
+
+  memset(b, 0, sizeof(struct hmap));
+}
+
+static inline int
+b256_and(u32 *p)
+{
+  for (int i = 0; i < 8; i++)
+    if (~p[i])
+      return 0;
+
+  return 1;
+}
+
+void
+hmap_set(struct hmap *b, uint n)
+{
+  if (n >= hmap_max(b))
+    hmap_grow(b, n/8 + 1);
+
+  for (int i = 0; i < 4; i++)
+  {
+    BIT32_SET(b->data[i], n);
+    n = n >> 8;
+
+    /* Continue if all bits in 256-bit block are set */
+    if (! b256_and(b->data[i] + 8*n))
+      break;
+  }
+}
+
+void
+hmap_clear(struct hmap *b, uint n)
+{
+  if (n >= hmap_max(b))
+    return;
+
+  for (int i = 0; i < 4; i++)
+  {
+    BIT32_CLR(b->data[i], n);
+    n = n >> 8;
+  }
+}
+
+static inline int
+b256_first_zero(u32 *p)
+{
+  for (int i = 0; i < 8; i++)
+    if (~p[i])
+      return 32*i + u32_ctz(~p[i]);
+
+  return 256;
+}
+
+u32
+hmap_first_zero(struct hmap *b)
+{
+  u32 n = 0;
+
+  for (int i = 3; i >= 0; i--)
+  {
+    if (32*n >= b->size[i])
+      return hmap_max(b);
+
+    u32 *p = b->data[i] + 8*n;
+
+    n = (n << 8) + b256_first_zero(p);
+  }
+
+  return n;
+}
+
+void
+hmap_check(struct hmap *b)
+{
+  for (int i = 0; i < 2; i++)
+  {
+    int max = b->size[i] / 32;
+
+    for (int j = 0; j < max; j++)
+    {
+      int x = b256_and(b->data[i] + 8*j);
+      int y = !!BIT32_TEST(b->data[i+1], j);
+      if (x != y)
+	bug("Inconsistent data on %d:%d (%d vs %d)", i, j, x, y);
+    }
+  }
+}
--- a/lib/bitmap.h
+++ b/lib/bitmap.h
@ -0,0 +1,63 @@
+/*
+ *	BIRD Library -- Bitmaps
+ *
+ *	(c) 2019 Ondrej Zajicek <santiago@crfreenet.org>
+ *	(c) 2019 CZ.NIC z.s.p.o.
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#ifndef _BIRD_BITMAP_H_
+#define _BIRD_BITMAP_H_
+
+struct bmap
+{
+  u32 size;
+  u32 *data;
+};
+
+void bmap_init(struct bmap *b, pool *p, uint size);
+void bmap_reset(struct bmap *b, uint size);
+void bmap_grow(struct bmap *b, uint need);
+void bmap_free(struct bmap *b);
+
+static inline uint bmap_max(struct bmap *b)
+{ return 8 * b->size; }
+
+static inline int bmap_test(struct bmap *b, uint n)
+{ return (n < bmap_max(b)) && BIT32_TEST(b->data, n); }
+
+static inline void bmap_set(struct bmap *b, uint n)
+{
+  if (n >= bmap_max(b)) bmap_grow(b, n/8 + 1);
+  BIT32_SET(b->data, n);
+}
+
+static inline void bmap_clear(struct bmap *b, uint n)
+{
+  if (n >= bmap_max(b)) return;
+  BIT32_CLR(b->data, n);
+}
+
+
+struct hmap
+{
+  u32 size[4];
+  u32 *data[4];
+  u32 root[8];
+};
+
+static inline uint hmap_max(struct hmap *b)
+{ return 8 * b->size[0]; }
+
+static inline int hmap_test(struct hmap *b, uint n)
+{ return (n < hmap_max(b)) && BIT32_TEST(b->data[0], n); }
+
+void hmap_init(struct hmap *b, pool *p, uint size);
+void hmap_free(struct hmap *b);
+void hmap_set(struct hmap *b, uint n);
+void hmap_clear(struct hmap *b, uint n);
+u32 hmap_first_zero(struct hmap *b);
+void hmap_check(struct hmap *b);
+
+#endif
--- a/lib/bitmap_test.c
+++ b/lib/bitmap_test.c
@ -0,0 +1,186 @@
+/*
+ *	BIRD Library -- Bitmap Tests
+ *
+ *	(c) 2019 Ondrej Zajicek <santiago@crfreenet.org>
+ *	(c) 2019 CZ.NIC z.s.p.o.
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include "test/birdtest.h"
+#include "sysdep/config.h"
+#include "lib/bitmap.h"
+
+#define MAX_NUM (1 << 20)
+#define MAX_SET (1 << 19)
+#define MAX_CLR (1 << 17)
+
+#define STEP_NUM 1000
+#define STEP_SET 1000
+#define STEP_CLR 500
+
+static int
+t_bmap_set_clear_random(void)
+{
+  struct bmap b;
+
+  resource_init();
+  bmap_init(&b, &root_pool, 1024);
+
+  char expected[MAX_NUM] = {};
+  uint i, n;
+
+  for (i = 0; i < MAX_SET; i++)
+  {
+    do n = bt_random() % MAX_NUM;
+    while (expected[n]);
+
+    bmap_set(&b, n);
+    expected[n] = 1;
+  }
+
+  for (i = 0; i < MAX_CLR; i++)
+  {
+    do n = bt_random() % MAX_NUM;
+    while (!expected[n]);
+
+    bmap_clear(&b, n);
+    expected[n] = 0;
+  }
+
+  for (i = 0; i < MAX_NUM; i++)
+    if (bmap_test(&b, i) != expected[i])
+      bt_abort_msg("Bitmap mismatch on %d (should be %d %d)", i, bmap_test(&b, i), expected[i]);
+
+  return 1;
+}
+
+static int
+t_hmap_set_clear_random(void)
+{
+  struct hmap b;
+
+  resource_init();
+  hmap_init(&b, &root_pool, 1024);
+
+  char expected[MAX_NUM] = {};
+  uint i, n;
+
+  for (i = 0; i < MAX_SET; i++)
+  {
+    do n = bt_random() % MAX_NUM;
+    while (expected[n]);
+
+    hmap_set(&b, n);
+    expected[n] = 1;
+  }
+
+  hmap_check(&b);
+
+  for (i = 0; i < MAX_CLR; i++)
+  {
+    do n = bt_random() % MAX_NUM;
+    while (!expected[n]);
+
+    hmap_clear(&b, n);
+    expected[n] = 0;
+  }
+
+  hmap_check(&b);
+
+  for (i = 0; i < MAX_NUM; i++)
+    if (hmap_test(&b, i) != expected[i])
+      bt_abort_msg("Bitmap mismatch on %d (should be %d %d)", i, hmap_test(&b, i), expected[i]);
+
+  for (i = 0; 1; i++)
+  {
+    n = hmap_first_zero(&b);
+    bt_assert(n >= i);
+    bt_assert(n <= MAX_NUM);
+
+    for (; i < n; i++)
+      bt_assert(expected[i]);
+
+    if (n == MAX_NUM)
+      break;
+
+    bt_assert(!expected[i]);
+
+    hmap_set(&b, n);
+  }
+
+  hmap_check(&b);
+
+  return 1;
+}
+
+static int
+t_hmap_set_clear_fill(void)
+{
+  struct hmap b;
+
+  resource_init();
+  hmap_init(&b, &root_pool, 1024);
+
+  char expected[MAX_NUM] = {};
+  uint i, j, n, max = 0;
+
+  for (i = 0; i < STEP_NUM; i++)
+  {
+    uint last = 0;
+    uint step_set = bt_random() % STEP_SET;
+    uint step_clr = bt_random() % STEP_CLR;
+
+    for (j = 0; j < step_set; j++)
+    {
+      n = hmap_first_zero(&b);
+      bt_assert(n > last || !last);
+      bt_assert(n < MAX_NUM);
+
+      if (!last)
+	last = n;
+
+      for (; last < n; last++)
+	bt_assert(expected[last]);
+
+      bt_assert(!expected[n]);
+
+      hmap_set(&b, n);
+      expected[n] = 1;
+      max = MAX(max, n);
+    }
+
+    for (j = 0; j < step_clr; j++)
+    {
+      uint k = 0;
+      do n = bt_random() % max;
+      while (!expected[n] && (k++ < 8));
+
+      if (!expected[n])
+	continue;
+
+      hmap_clear(&b, n);
+      expected[n] = 0;
+    }
+  }
+
+  for (i = 0; i < MAX_NUM; i++)
+    if (hmap_test(&b, i) != expected[i])
+      bt_abort_msg("Bitmap mismatch on %d (should be %d %d)", i, hmap_test(&b, i), expected[i]);
+
+  hmap_check(&b);
+
+  return 1;
+}
+
+int
+main(int argc, char *argv[])
+{
+  bt_init(argc, argv);
+
+  bt_test_suite(t_bmap_set_clear_random, "BMap - random sequence of sets / clears");
+  bt_test_suite(t_hmap_set_clear_random, "HMap - random sequence of sets / clears");
+  bt_test_suite(t_hmap_set_clear_fill, "HMap - linear sets and random clears");
+
+  return bt_exit_value();
+}
--- a/lib/bitops.h
+++ b/lib/bitops.h
@ -29,4 +29,9 @@ static inline u32 u32_hash(u32 v) { return v * 2902958171u; }

 static inline u8 u32_popcount(u32 v) { return __builtin_popcount(v); }

+static inline int u32_clz(u32 v) { return __builtin_clz(v); }
+static inline int u32_ctz(u32 v) { return __builtin_ctz(v); }
+
+static inline int uint_is_pow2(uint n) { return n && !(n & (n-1)); }
+
 #endif
--- a/lib/buffer.h
+++ b/lib/buffer.h
@ -50,6 +50,8 @@

 #define BUFFER_FLUSH(v)		({ (v).used = 0; })

+#define BUFFER_EMPTY(v)		({ (v).used == 0; })
+
 #define BUFFER_WALK(v,n)						\
  for (BUFFER_TYPE(v) *_n = (v).data, n; _n < ((v).data + (v).used) && (n = *_n, 1); _n++)

--- a/lib/event.c
+++ b/lib/event.c
@ -23,6 +23,7 @@
 #include "lib/event.h"

 event_list global_event_list;
+event_list global_work_list;

 inline void
 ev_postpone(event *e)
@ -114,6 +115,22 @@ ev_schedule(event *e)
  ev_enqueue(&global_event_list, e);
 }

+/**
+ * ev_schedule_work - schedule a work-event.
+ * @e: an event
+ *
+ * This function schedules an event by enqueueing it to a system-wide work-event
+ * list which is run by the platform dependent code whenever appropriate. This
+ * is designated for work-events instead of regular events. They are executed
+ * less often in order to not clog I/O loop.
+ */
+void
+ev_schedule_work(event *e)
+{
+  if (!ev_active(e))
+    add_tail(&global_work_list, &e->n);
+}
+
 void io_log_event(void *hook, void *data);

 /**
@ -136,10 +153,47 @@ ev_run_list(event_list *l)
      event *e = SKIP_BACK(event, n, n);

      /* This is ugly hack, we want to log just events executed from the main I/O loop */
-      if (l == &global_event_list)
+      if ((l == &global_event_list) || (l == &global_work_list))
 	io_log_event(e->hook, e->data);

      ev_run(e);
    }
+
+  return !EMPTY_LIST(*l);
+}
+
+int
+ev_run_list_limited(event_list *l, uint limit)
+{
+  node *n;
+  list tmp_list;
+
+  init_list(&tmp_list);
+  add_tail_list(&tmp_list, l);
+  init_list(l);
+
+  WALK_LIST_FIRST(n, tmp_list)
+    {
+      event *e = SKIP_BACK(event, n, n);
+
+      if (!limit)
+	break;
+
+      /* This is ugly hack, we want to log just events executed from the main I/O loop */
+      if ((l == &global_event_list) || (l == &global_work_list))
+	io_log_event(e->hook, e->data);
+
+      ev_run(e);
+      limit--;
+    }
+
+  if (!EMPTY_LIST(tmp_list))
+  {
+    /* Attach new items after the unprocessed old items */
+    add_tail_list(&tmp_list, l);
+    init_list(l);
+    add_tail_list(l, &tmp_list);
+  }
+
  return !EMPTY_LIST(*l);
 }
--- a/lib/event.h
+++ b/lib/event.h
@ -21,14 +21,17 @@ typedef struct event {
 typedef list event_list;

 extern event_list global_event_list;
+extern event_list global_work_list;

 event *ev_new(pool *);
 void ev_run(event *);
 #define ev_init_list(el) init_list(el)
 void ev_enqueue(event_list *, event *);
 void ev_schedule(event *);
+void ev_schedule_work(event *);
 void ev_postpone(event *);
 int ev_run_list(event_list *);
+int ev_run_list_limited(event_list *, uint);

 static inline int
 ev_active(event *e)
@ -36,5 +39,14 @@ ev_active(event *e)
  return e->n.next != NULL;
 }

+static inline event*
+ev_new_init(pool *p, void (*hook)(void *), void *data)
+{
+  event *e = ev_new(p);
+  e->hook = hook;
+  e->data = data;
+  return e;
+}
+

 #endif
--- a/lib/fletcher16_test.c
+++ b/lib/fletcher16_test.c
@ -24,24 +24,33 @@ straightforward_fletcher16_compute(const char *data)
    sum2 = (sum2 + sum1) % 255;
  }

-  return (sum2 << 8) | sum1;
+  sum2 = (sum2 + sum1) % 255;
+  sum2 = (sum2 + sum1) % 255;
+
+  return (sum1 << 8) | sum2;
 }

 static u16
 straightforward_fletcher16_checksum(const char *data)
 {
  u16 csum;
-  u8 c0,c1,f0,f1;
+  u16 c0,c1,x,y;

  csum = straightforward_fletcher16_compute(data);
-  f0 = csum & 0xff;
-  f1 = (csum >> 8) & 0xff;
-  c0 = 0xff - ((f0 + f1) % 0xff);
-  c1 = 0xff - ((f0 + c0) % 0xff);
+  c0 = (csum >> 8) & 0xff;
+  c1 = csum & 0xff;

-  return (c1 << 8) | c0;
+  x = (255 +   c0 - c1) % 255;
+  y = (510 - 2*c0 + c1) % 255;
+
+  if (!x) x = 255;
+  if (!y) y = 255;
+
+  return (x << 8) | y;
 }

+const u8 zero16[2] = {};
+
 static int
 test_fletcher16(void *out_, const void *in_, const void *expected_out_)
 {
@ -53,7 +62,8 @@ test_fletcher16(void *out_, const void *in_, const void *expected_out_)

  fletcher16_init(&ctxt);
  fletcher16_update(&ctxt, in, strlen(in));
-  put_u16(out, fletcher16_compute(&ctxt));
+  fletcher16_update(&ctxt, zero16, 2);
+  *out = fletcher16_compute(&ctxt);

  return *out == *expected_out;
 }
@ -70,7 +80,8 @@ test_fletcher16_checksum(void *out_, const void *in_, const void *expected_out_)

  fletcher16_init(&ctxt);
  fletcher16_update(&ctxt, in, len);
-  put_u16(out, fletcher16_final(&ctxt, len, len));
+  fletcher16_update(&ctxt, zero16, 2);
+  *out = fletcher16_final(&ctxt, len+2, len);

  return *out == *expected_out;
 }
@ -81,7 +92,7 @@ t_fletcher16_compute(void)
  struct bt_pair test_vectors[] = {
    {
      .in  = "\001\002",
-      .out = & (const u16) { 0x0403 },
+      .out = & ((const u16) { straightforward_fletcher16_compute("\001\002") }),
    },
    {
      .in  = "",
--- a/lib/flowspec.c
+++ b/lib/flowspec.c
@ -112,7 +112,6 @@ get_value_length(const byte *op)
 }


-
 /*
 *	Flowspec iterators
 */
@ -244,6 +243,69 @@ flow6_next_part(const byte *pos, const byte *end)
  return flow_next_part(pos, end, 1);
 }

+static const byte *
+flow_get_part(const byte *data, uint dlen, uint type, int ipv6)
+{
+  const byte *part;
+
+  for (part = flow_first_part(data);
+       part && (part[0] <= type);
+       part = flow_next_part(part, data+dlen, ipv6))
+    if (part[0] == type)
+      return part;
+
+  return NULL;
+}
+
+const byte *
+flow4_get_part(const net_addr_flow4 *f, uint type)
+{
+  return flow_get_part(f->data, f->length - sizeof(net_addr_flow4), type, 0);
+}
+
+const byte *
+flow6_get_part(const net_addr_flow6 *f, uint type)
+{
+  return flow_get_part(f->data, f->length - sizeof(net_addr_flow6), type, 1);
+}
+
+
+/*
+ *	Flowspec accessors
+ */
+
+static inline ip4_addr
+flow_read_ip4(const byte *px, uint pxlen)
+{
+  ip4_addr ip = IP4_NONE;
+  memcpy(&ip, px, BYTES(pxlen));
+  return ip4_ntoh(ip);
+}
+
+ip4_addr
+flow_read_ip4_part(const byte *part)
+{
+  return flow_read_ip4(part + 2, part[1]);
+}
+
+static inline ip6_addr
+flow_read_ip6(const byte *px, uint pxlen, uint pxoffset)
+{
+  uint floor_offset = BYTES(pxoffset - (pxoffset % 8));
+  uint ceil_len = BYTES(pxlen);
+  ip6_addr ip = IP6_NONE;
+
+  memcpy(((byte *) &ip) + floor_offset, px, ceil_len - floor_offset);
+
+  return ip6_ntoh(ip);
+}
+
+ip6_addr
+flow_read_ip6_part(const byte *part)
+{
+  return flow_read_ip6(part + 3, part[1], part[2]);
+}
+

 /*
 * 	Flowspec validation
@ -374,7 +436,6 @@ flow_validate(const byte *nlri, uint len, int ipv6)
  enum flow_type type = 0;
  const byte *pos = nlri;
  const byte *end = nlri + len;
-  int met_dst_pfx = 0;

  while (pos < end)
  {
@ -386,8 +447,6 @@ flow_validate(const byte *nlri, uint len, int ipv6)
    switch (type)
    {
    case FLOW_TYPE_DST_PREFIX:
-      met_dst_pfx = 1;
-      /* Fall through */
    case FLOW_TYPE_SRC_PREFIX:
    {
      uint pxlen = *pos++;
@ -494,9 +553,6 @@ flow_validate(const byte *nlri, uint len, int ipv6)
  if (pos != end)
    return FLOW_ST_NOT_COMPLETE;

-  if (!ipv6 && !met_dst_pfx)
-    return FLOW_ST_DEST_PREFIX_REQUIRED;
-
  return FLOW_ST_VALID;
 }

@ -779,26 +835,6 @@ flow_builder_set_type(struct flow_builder *fb, enum flow_type type)
  fb->this_type = type;
 }

-static ip4_addr
-flow_read_ip4(const byte *px, uint pxlen)
-{
-  ip4_addr ip = IP4_NONE;
-  memcpy(&ip, px, BYTES(pxlen));
-  return ip4_ntoh(ip);
-}
-
-static ip6_addr
-flow_read_ip6(const byte *px, uint pxlen, uint pxoffset)
-{
-  uint floor_offset = BYTES(pxoffset - (pxoffset % 8));
-  uint ceil_len = BYTES(pxlen);
-  ip6_addr ip = IP6_NONE;
-
-  memcpy(((byte *) &ip) + floor_offset, px, ceil_len - floor_offset);
-
-  return ip6_ntoh(ip);
-}
-
 static void
 builder_write_parts(struct flow_builder *fb, byte *buf)
 {
@ -831,9 +867,9 @@ flow_builder4_finalize(struct flow_builder *fb, linpool *lpool)

  if (fb->parts[FLOW_TYPE_DST_PREFIX].length)
  {
-    byte *p = fb->data.data + fb->parts[FLOW_TYPE_DST_PREFIX].offset + 1;
-    pxlen = *p++;
-    prefix = flow_read_ip4(p, pxlen);
+    byte *part = fb->data.data + fb->parts[FLOW_TYPE_DST_PREFIX].offset;
+    prefix = flow_read_ip4_part(part);
+    pxlen = flow_read_pxlen(part);
  }
  *f = NET_ADDR_FLOW4(prefix, pxlen, data_len);

@ -861,10 +897,9 @@ flow_builder6_finalize(struct flow_builder *fb, linpool *lpool)

  if (fb->parts[FLOW_TYPE_DST_PREFIX].length)
  {
-    byte *p = fb->data.data + fb->parts[FLOW_TYPE_DST_PREFIX].offset + 1;
-    pxlen = *p++;
-    uint pxoffset = *p++;
-    prefix = flow_read_ip6(p, pxlen, pxoffset);
+    byte *part = fb->data.data + fb->parts[FLOW_TYPE_DST_PREFIX].offset;
+    prefix = flow_read_ip6_part(part);
+    pxlen = flow_read_pxlen(part);
  }
  *n = NET_ADDR_FLOW6(prefix, pxlen, data_len);

@ -947,18 +982,18 @@ fragment_val_str(u8 val)
 static void
 net_format_flow_ip(buffer *b, const byte *part, int ipv6)
 {
-  uint pxlen = *(part+1);
+  uint pxlen = part[1];
  if (ipv6)
  {
-    uint pxoffset = *(part+2);
+    uint pxoffset = part[2];
    if (pxoffset)
-      buffer_print(b, "%I6/%u offset %u; ", flow_read_ip6(part+3,pxlen,pxoffset), pxlen, pxoffset);
+      buffer_print(b, "%I6/%u offset %u; ", flow_read_ip6_part(part), pxlen, pxoffset);
    else
-      buffer_print(b, "%I6/%u; ", flow_read_ip6(part+3,pxlen,0), pxlen);
+      buffer_print(b, "%I6/%u; ", flow_read_ip6_part(part), pxlen);
  }
  else
  {
-    buffer_print(b, "%I4/%u; ", flow_read_ip4(part+2,pxlen), pxlen);
+    buffer_print(b, "%I4/%u; ", flow_read_ip4_part(part), pxlen);
  }
 }

--- a/lib/flowspec.h
+++ b/lib/flowspec.h
@ -83,6 +83,17 @@ const byte *flow4_first_part(const net_addr_flow4 *f);
 const byte *flow6_first_part(const net_addr_flow6 *f);
 const byte *flow4_next_part(const byte *pos, const byte *end);
 const byte *flow6_next_part(const byte *pos, const byte *end);
+const byte *flow4_get_part(const net_addr_flow4 *f, uint type);
+const byte *flow6_get_part(const net_addr_flow6 *f, uint type);
+
+
+/*
+ *	Flowspec accessors
+ */
+
+ip4_addr flow_read_ip4_part(const byte *part);
+ip6_addr flow_read_ip6_part(const byte *part);
+static inline int flow_read_pxlen(const byte *part) { return part[1]; }


 /*
--- a/lib/flowspec_test.c
+++ b/lib/flowspec_test.c
@ -137,7 +137,7 @@ static int
 t_iterators6(void)
 {
  net_addr_flow6 *f;
-  NET_ADDR_FLOW6_(f, ip6_build(0,0,0x12345678,0x9a000000), 64, ((byte[]) {
+  NET_ADDR_FLOW6_(f, ip6_build(0,0,0x12345678,0x9a000000), 0x68, ((byte[]) {
    26, /* Length */
    FLOW_TYPE_DST_PREFIX, 0x68, 0x40, 0x12, 0x34, 0x56, 0x78, 0x9a,
    FLOW_TYPE_SRC_PREFIX, 0x08, 0x0, 0xc0,
@ -166,6 +166,56 @@ t_iterators6(void)
  return 1;
 }

+static int
+t_accessors4(void)
+{
+  net_addr_flow4 *f;
+  NET_ADDR_FLOW4_(f, ip4_build(5,6,7,0), 24, ((byte[]) {
+    25, /* Length */
+    FLOW_TYPE_DST_PREFIX, 24, 5, 6, 7,
+    FLOW_TYPE_SRC_PREFIX, 32, 10, 11, 12, 13,
+    FLOW_TYPE_IP_PROTOCOL, 0x81, 0x06,
+    FLOW_TYPE_PORT, 0x03, 0x89, 0x45, 0x8b, 0x91, 0x1f, 0x90,
+    FLOW_TYPE_TCP_FLAGS, 0x80, 0x55,
+  }));
+
+  const byte *p1_dst_px		= &f->data[1];
+  const ip4_addr p1_dst_addr	= ip4_build(5,6,7,0);
+
+  const byte *p2_src_px		= &f->data[6];
+  const ip4_addr p2_src_addr	= ip4_build(10,11,12,13);
+
+  bt_assert(ip4_equal(flow_read_ip4_part(p1_dst_px), p1_dst_addr));
+  bt_assert(ip4_equal(flow_read_ip4_part(p2_src_px), p2_src_addr));
+
+  return 1;
+}
+
+static int
+t_accessors6(void)
+{
+  net_addr_flow6 *f;
+  NET_ADDR_FLOW6_(f, ip6_build(0,0,0x12345678,0x9a000000), 0x68, ((byte[]) {
+    26, /* Length */
+    FLOW_TYPE_DST_PREFIX, 0x68, 0x40, 0x12, 0x34, 0x56, 0x78, 0x9a,
+    FLOW_TYPE_SRC_PREFIX, 0x08, 0x0, 0xc0,
+    FLOW_TYPE_NEXT_HEADER, 0x81, 0x06,
+    FLOW_TYPE_PORT, 0x03, 0x89, 0x45, 0x8b, 0x91, 0x1f, 0x90,
+    FLOW_TYPE_LABEL, 0x80, 0x55,
+  }));
+
+  const byte *p1_dst_px		= &f->data[1];
+  const ip6_addr p1_dst_addr	= ip6_build(0,0,0x12345678,0x9a000000);
+
+  const byte *p2_src_px 	= &f->data[9];
+  const ip6_addr p2_src_addr	= ip6_build(0xc0000000, 0, 0, 0);
+
+  bt_assert(ip6_equal(flow_read_ip6_part(p1_dst_px), p1_dst_addr));
+  bt_assert(ip6_equal(flow_read_ip6_part(p2_src_px), p2_src_addr));
+
+  return 1;
+}
+
 static int
 t_validation4(void)
 {
@ -179,11 +229,9 @@ t_validation4(void)
    FLOW_TYPE_TCP_FLAGS, 0x80, 0x55,
  };

-  /* Isn't included destination prefix */
+  /* Empty NLRI */
  res = flow4_validate(nlri1, 0);
-  bt_assert(res == FLOW_ST_DEST_PREFIX_REQUIRED);
-  res = flow4_validate(&nlri1[5], sizeof(nlri1)-5);
-  bt_assert(res == FLOW_ST_DEST_PREFIX_REQUIRED);
+  bt_assert(res == FLOW_ST_VALID);

  /* Valid / Not Complete testing */
  uint valid_sizes[] = {5, 11, 14, 22, 25, 0};
@ -628,6 +676,8 @@ main(int argc, char *argv[])
  bt_test_suite(t_first_part,   "Searching first part in net_addr_flow");
  bt_test_suite(t_iterators4,   "Testing iterators (IPv4)");
  bt_test_suite(t_iterators6,   "Testing iterators (IPv6)");
+  bt_test_suite(t_accessors4,   "Testing accessors (IPv4)");
+  bt_test_suite(t_accessors6,   "Testing accessors (IPv6)");
  bt_test_suite(t_validation4,  "Testing validation (IPv4)");
  bt_test_suite(t_validation6,  "Testing validation (IPv6)");
  bt_test_suite(t_builder4,     "Inserting components into existing Flow Specification (IPv4)");
--- a/lib/hash.h
+++ b/lib/hash.h
@ -202,7 +202,7 @@ mem_hash_init(u64 *h)
 }

 static inline void
-mem_hash_mix(u64 *h, void *p, uint s)
+mem_hash_mix(u64 *h, const void *p, uint s)
 {
  const u64 multiplier = 0xb38bc09a61202731ULL;
  const char *pp = p;
@ -222,7 +222,7 @@ mem_hash_value(u64 *h)
 }

 static inline uint
-mem_hash(void *p, uint s)
+mem_hash(const void *p, uint s)
 {
  static u64 h;
  mem_hash_init(&h);
@ -230,4 +230,11 @@ mem_hash(void *p, uint s)
  return mem_hash_value(&h);
 }

+static inline uint
+ptr_hash(void *ptr)
+{
+  uintptr_t p = (uintptr_t) ptr;
+  return p ^ (p << 8) ^ (p >> 16);
+}
+
 #endif
--- a/lib/ip.c
+++ b/lib/ip.c
@ -245,7 +245,7 @@ ip4_pton(const char *a, ip4_addr *o)
    char *d, *c = strchr(a, '.');
    if (!c != !i)
      return 0;
-    l = strtoul(a, &d, 10);
+    l = bstrtoul10(a, &d);
    if (((d != c) && *d) || (l > 255))
      return 0;
    ia = (ia << 8) | l;
@ -264,6 +264,9 @@ ip6_pton(const char *a, ip6_addr *o)
  int i, j, k, l, hfil;
  const char *start;

+  if (!a[0])				/* Empty string check */
+    return 0;
+
  if (a[0] == ':')			/* Leading :: */
  {
    if (a[1] != ':')
@ -333,6 +336,8 @@ ip6_pton(const char *a, ip6_addr *o)
    for (; i>=hfil; i--)
      words[i] = 0;
  }
+  else if (i != 8)	/* Incomplete address */
+    return 0;

  /* Convert the address to ip6_addr format */
  for (i=0; i<4; i++)
--- a/lib/ip.h
+++ b/lib/ip.h
@ -48,6 +48,13 @@
 #define UDP_HEADER_LENGTH	8


+/* IANA Address Family Numbers */
+/* https://www.iana.org/assignments/address-family-numbers/address-family-numbers.xhtml */
+/* Would use AF_ prefix, but that collides with POSIX address family numbers */
+#define AFI_IPV4		1
+#define AFI_IPV6		2
+
+
 #ifdef DEBUGGING

 typedef struct ip4_addr {
@ -61,7 +68,7 @@ typedef struct ip4_addr {

 typedef u32 ip4_addr;

-#define _MI4(x) (x)
+#define _MI4(x) ((u32) (x))
 #define _I(x) (x)

 #endif
@ -186,13 +193,7 @@ static inline int ipa_nonzero2(ip_addr a)
 */

 static inline u32 ip4_hash(ip4_addr a)
-{
-  /* Returns a 32-bit value, although low-order bits are not mixed */
-  u32 x = _I(a);
-  x ^= x << 16;
-  x ^= x << 12;
-  return x;
-}
+{ return u32_hash(_I(a)); }

 static inline u32 ip6_hash(ip6_addr a)
 {
@ -241,6 +242,9 @@ static inline int ip6_is_v4mapped(ip6_addr a)
 #define ipa_classify(x) ip6_classify(&(x))
 #define ipa_is_link_local(x) ip6_is_link_local(x)

+static inline int ip4_is_unicast(ip4_addr a)
+{ return _I(a) < 0xe0000000; }
+
 /* XXXX remove */
 static inline int ipa_classify_net(ip_addr a)
 { return ipa_zero2(a) ? (IADDR_HOST | SCOPE_UNIVERSE) : ipa_classify(a); }
@ -357,12 +361,12 @@ mpls_put(char *buf, int len, u32 *stack)
 *	Unaligned data access (in network order)
 */

-static inline ip4_addr get_ip4(void *buf)
+static inline ip4_addr get_ip4(const void *buf)
 {
  return _MI4(get_u32(buf));
 }

-static inline ip6_addr get_ip6(void *buf)
+static inline ip6_addr get_ip6(const void *buf)
 {
  ip6_addr a;
  memcpy(&a, buf, 16);
--- a/lib/ip_test.c
+++ b/lib/ip_test.c
@ -13,25 +13,38 @@
 #define IP4_MAX_LEN		16

 static int
-test_ipa_pton(void *out_, const void *in_, const void *expected_out_)
+test_ip4_pton(void *out_, const void *in_, const void *expected_out_)
+{
+  ip_addr *out = out_;
+  const char *in = in_;
+  const ip_addr *expected_out = expected_out_;
+  ip4_addr ip4;
+
+  if (expected_out)
+  {
+    bt_assert(ip4_pton(in, &ip4));
+    *out = ipa_from_ip4(ip4);
+    return ipa_equal(*out, *expected_out);
+  }
+  else
+    return !ip4_pton(in, &ip4);
+
+}
+
+static int
+test_ip6_pton(void *out_, const void *in_, const void *expected_out_)
 {
  ip_addr *out = out_;
  const char *in = in_;
  const ip_addr *expected_out = expected_out_;

-  if (ipa_is_ip4(*expected_out))
-  {
-    ip4_addr ip4;
-    bt_assert(ip4_pton(in, &ip4));
-    *out = ipa_from_ip4(ip4);
-  }
-  else
+  if (expected_out)
  {
    bt_assert(ip6_pton(in, out));
-    /* ip_addr == ip6_addr */
+    return ipa_equal(*out, *expected_out);
  }
-
-  return ipa_equal(*out, *expected_out);
+  else
+    return !ip6_pton(in, out);
 }

 static int
@ -52,7 +65,7 @@ t_ip4_pton(void)
    },
  };

-  return bt_assert_batch(test_vectors, test_ipa_pton, bt_fmt_str, bt_fmt_ipa);
+  return bt_assert_batch(test_vectors, test_ip4_pton, bt_fmt_str, bt_fmt_ipa);
 }

 static int
@ -87,9 +100,17 @@ t_ip6_pton(void)
      .in  = "2605:2700:0:3::4713:93e3",
      .out = & ipa_build6(0x26052700, 0x00000003, 0x00000000, 0x471393E3),
    },
+    {
+      .in = "2605:2700:0:3:4713:93e3",
+      .out = NULL,
+    },
+    {
+      .in = "2",
+      .out = NULL,
+    },
  };

-  return bt_assert_batch(test_vectors, test_ipa_pton, bt_fmt_str, bt_fmt_ipa);
+  return bt_assert_batch(test_vectors, test_ip6_pton, bt_fmt_str, bt_fmt_ipa);
 }

 static int
--- a/lib/lists.c
+++ b/lib/lists.c
@ -29,6 +29,42 @@
 #include "nest/bird.h"
 #include "lib/lists.h"

+LIST_INLINE int
+check_list(list *l, node *n)
+{
+  if (!l)
+  {
+    ASSERT_DIE(n);
+    ASSERT_DIE(n->prev);
+
+    do { n = n->prev; } while (n->prev);
+
+    l = SKIP_BACK(list, head_node, n);
+  }
+
+  int seen = 0;
+
+  ASSERT_DIE(l->null == NULL);
+  ASSERT_DIE(l->head != NULL);
+  ASSERT_DIE(l->tail != NULL);
+
+  node *prev = &l->head_node, *cur = l->head, *next = l->head->next;
+  while (next)
+  {
+    if (cur == n)
+      seen++;
+    ASSERT_DIE(cur->prev == prev);
+    prev = cur;
+    cur = next;
+    next = next->next;
+  }
+
+  ASSERT_DIE(cur == &(l->tail_node));
+  ASSERT_DIE(!n || (seen == 1));
+
+  return 1;
+}
+
 /**
 * add_tail - append a node to a list
 * @l: linked list
@ -39,6 +75,10 @@
 LIST_INLINE void
 add_tail(list *l, node *n)
 {
+  EXPENSIVE_CHECK(check_list(l, NULL));
+  ASSUME(n->prev == NULL);
+  ASSUME(n->next == NULL);
+
  node *z = l->tail;

  n->next = &l->tail_node;
@ -57,6 +97,10 @@ add_tail(list *l, node *n)
 LIST_INLINE void
 add_head(list *l, node *n)
 {
+  EXPENSIVE_CHECK(check_list(l, NULL));
+  ASSUME(n->prev == NULL);
+  ASSUME(n->next == NULL);
+
  node *z = l->head;

  n->next = z;
@ -76,6 +120,10 @@ add_head(list *l, node *n)
 LIST_INLINE void
 insert_node(node *n, node *after)
 {
+  EXPENSIVE_CHECK(check_list(l, after));
+  ASSUME(n->prev == NULL);
+  ASSUME(n->next == NULL);
+
  node *z = after->next;

  n->next = z;
@ -93,6 +141,8 @@ insert_node(node *n, node *after)
 LIST_INLINE void
 rem_node(node *n)
 {
+  EXPENSIVE_CHECK(check_list(NULL, n));
+
  node *z = n->prev;
  node *x = n->next;

@ -103,24 +153,20 @@ rem_node(node *n)
 }

 /**
- * replace_node - replace a node in a list with another one
- * @old: node to be removed
- * @new: node to be inserted
+ * update_node - update node after calling realloc on it
+ * @n: node to be updated
 *
- * Replaces node @old in the list it's linked in with node @new.  Node
- * @old may be a copy of the original node, which is not accessed
- * through the list. The function could be called with @old == @new,
- * which just fixes neighbors' pointers in the case that the node
- * was reallocated.
+ * Fixes neighbor pointers.
 */
 LIST_INLINE void
-replace_node(node *old, node *new)
+update_node(node *n)
 {
-  old->next->prev = new;
-  old->prev->next = new;
+  ASSUME(n->next->prev == n->prev->next);

-  new->prev = old->prev;
-  new->next = old->next;
+  n->next->prev = n;
+  n->prev->next = n;
+
+  EXPENSIVE_CHECK(check_list(NULL, n));
 }

 /**
@ -149,6 +195,9 @@ init_list(list *l)
 LIST_INLINE void
 add_tail_list(list *to, list *l)
 {
+  EXPENSIVE_CHECK(check_list(to, NULL));
+  EXPENSIVE_CHECK(check_list(l, NULL));
+
  node *p = to->tail;
  node *q = l->head;

@ -157,6 +206,8 @@ add_tail_list(list *to, list *l)
  q = l->tail;
  q->next = &to->tail_node;
  to->tail = q;
+
+  EXPENSIVE_CHECK(check_list(to, NULL));
 }

 LIST_INLINE uint
@ -165,6 +216,8 @@ list_length(list *l)
  uint len = 0;
  node *n;

+  EXPENSIVE_CHECK(check_list(l, NULL));
+
  WALK_LIST(n, *l)
    len++;

--- a/lib/lists_test.c
+++ b/lib/lists_test.c
@ -222,26 +222,29 @@ t_remove_node(void)
 }

 static int
-t_replace_node(void)
+t_update_node(void)
 {
  node head, inside, tail;

  init_list_();
  fill_list();

-  replace_node(&nodes[0], &head);
+  head = nodes[0];
+  update_node(&head);
  bt_assert(l.head == &head);
  bt_assert(head.prev == NODE &l.head);
  bt_assert(head.next == &nodes[1]);
  bt_assert(nodes[1].prev == &head);

-  replace_node(&nodes[MAX_NUM/2], &inside);
+  inside = nodes[MAX_NUM/2];
+  update_node(&inside);
  bt_assert(nodes[MAX_NUM/2-1].next == &inside);
  bt_assert(nodes[MAX_NUM/2+1].prev == &inside);
  bt_assert(inside.prev == &nodes[MAX_NUM/2-1]);
  bt_assert(inside.next == &nodes[MAX_NUM/2+1]);

-  replace_node(&nodes[MAX_NUM-1], &tail);
+  tail = nodes[MAX_NUM-1];
+  update_node(&tail);
  bt_assert(l.tail == &tail);
  bt_assert(tail.prev == &nodes[MAX_NUM-2]);
  bt_assert(tail.next == NODE &l.null);
@ -280,7 +283,7 @@ main(int argc, char *argv[])
  bt_test_suite(t_add_head, "Adding nodes to head of list");
  bt_test_suite(t_insert_node, "Inserting nodes to list");
  bt_test_suite(t_remove_node, "Removing nodes from list");
-  bt_test_suite(t_replace_node, "Replacing nodes in list");
+  bt_test_suite(t_update_node, "Updating nodes in list");
  bt_test_suite(t_add_tail_list, "At the tail of a list adding the another list");

  return bt_exit_value();
--- a/lib/macro.h
+++ b/lib/macro.h
@ -0,0 +1,98 @@
+/* 
+ *	BIRD Macro Tricks
+ *
+ *	(c) 2018 Jan Maria Matejka <mq@jmq.cz>
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ *
+ *	Contains useful but dirty macro tricks:
+ *		MACRO_CONCAT(a, b)	-> concatenates a##b
+ *		MACRO_BOOL(x)		-> convert 0 to 0, anything else to 1
+ *		MACRO_IFELSE(b)(true-branch)(false-branch)
+ *					-> b shall be 0 or 1; expands to the appropriate branch
+ *		MACRO_ISEMPTY(...)	-> 1 for empty argument list, 0 otherwise
+ *		MACRO_FOREACH(func, ...)
+ *					-> calling FOREACH(func, a, b, c, d) expands to
+ *						func(a) func(b) func(c) func(d)
+ *		MACRO_RPACK(func, terminator, ...)
+ *					-> packs the list into recursive calls:
+ *						func(func(func(func(terminator, a), b), c), d)
+ */
+
+#ifndef _BIRD_MACRO_H_
+#define _BIRD_MACRO_H_
+
+/* What to do with args */
+#define MACRO_DROP(...)
+#define MACRO_UNPAREN(...) __VA_ARGS__
+#define MACRO_SEP(a, b, sep)  a sep b
+
+/* Aliases for some special chars */
+#define MACRO_COMMA ,
+#define MACRO_LPAREN (
+#define MACRO_RPAREN )
+#define MACRO_LPAREN_() (
+#define MACRO_RPAREN_() )
+
+/* Multiple expansion trick */
+#define MACRO_EXPAND0(...) __VA_ARGS__
+#define MACRO_EXPAND1(...) MACRO_EXPAND0(MACRO_EXPAND0(__VA_ARGS__))
+#define MACRO_EXPAND2(...) MACRO_EXPAND1(MACRO_EXPAND1(__VA_ARGS__))
+#define MACRO_EXPAND3(...) MACRO_EXPAND2(MACRO_EXPAND2(__VA_ARGS__))
+#define MACRO_EXPAND(...) MACRO_EXPAND3(MACRO_EXPAND3(__VA_ARGS__))
+
+/* Deferring expansion in the expansion trick */
+#define MACRO_EMPTY()
+#define MACRO_DEFER(t) t MACRO_EMPTY()
+#define MACRO_DEFER2(t) t MACRO_EMPTY MACRO_EMPTY()()
+#define MACRO_DEFER3(t) t MACRO_EMPTY MACRO_EMPTY MACRO_EMPTY()()()
+
+/* Token concatenation */
+#define MACRO_CONCAT(prefix, ...) prefix##__VA_ARGS__
+#define MACRO_CONCAT_AFTER(...) MACRO_CONCAT(__VA_ARGS__)
+
+/* Get first or second argument only */
+#define MACRO_FIRST(a, ...) a
+#define MACRO_SECOND(a, b, ...) b
+#define MACRO_SECOND_OR_ZERO(...) MACRO_SECOND(__VA_ARGS__, 0,)
+
+/* Macro Boolean auxiliary macros */
+#define MACRO_BOOL_CHECK_0 ~, 1
+#define MACRO_BOOL_NEG(x) MACRO_SECOND_OR_ZERO(MACRO_CONCAT(MACRO_BOOL_CHECK_, x))
+
+#define MACRO_BOOL_NOT_0  1
+#define MACRO_BOOL_NOT_1  0
+
+/* Macro Boolean negation */
+#define MACRO_NOT(x) MACRO_CONCAT(MACRO_BOOL_NOT_, x)
+
+/* Convert anything to bool (anything -> 1, 0 -> 0) */
+#define MACRO_BOOL(x) MACRO_NOT(MACRO_BOOL_NEG(x))
+
+/*
+ * Macro If/Else condition
+ * Usage: MACRO_IFELSE(condition)(true-branch)(false-branch)
+ * Expands to true-branch if condition is true, otherwise to false-branch.
+ */
+#define MACRO_IFELSE(b) MACRO_CONCAT(MACRO_IFELSE_, b)
+#define MACRO_IFELSE_0(...) MACRO_UNPAREN
+#define MACRO_IFELSE_1(...) __VA_ARGS__ MACRO_DROP
+
+/* Auxiliary macros for MACRO_FOREACH */
+#define MACRO_ISLAST(...) MACRO_BOOL_NEG(MACRO_FIRST(MACRO_ISLAST_CHECK __VA_ARGS__)())
+#define MACRO_ISLAST_CHECK() 0
+
+#define MACRO_FOREACH_EXPAND(call, a, ...) MACRO_IFELSE(MACRO_ISLAST(__VA_ARGS__))(call(a))(call(a) MACRO_DEFER2(MACRO_FOREACH_PAREN)()(call, __VA_ARGS__))
+#define MACRO_FOREACH_PAREN() MACRO_FOREACH_EXPAND
+
+#define MACRO_RPACK_EXPAND(call, terminator, a, ...) MACRO_IFELSE(MACRO_ISLAST(__VA_ARGS__))(call(terminator, a))(call(MACRO_DEFER2(MACRO_RPACK_PAREN)()(call, terminator, __VA_ARGS__), a))
+#define MACRO_RPACK_PAREN() MACRO_RPACK_EXPAND
+/*
+ * Call the first argument for each following:
+ * MACRO_FOREACH(func, a, b, c, d) expands to func(a) func(b) func(c) func(d).
+ * It supports also macros as func.
+ */
+#define MACRO_FOREACH(call, ...) MACRO_EXPAND(MACRO_FOREACH_EXPAND(call, __VA_ARGS__))
+#define MACRO_RPACK(call, terminator, ...) MACRO_EXPAND(MACRO_RPACK_EXPAND(call, terminator, __VA_ARGS__))
+
+#endif
--- a/lib/net.c
+++ b/lib/net.c
@ -6,50 +6,54 @@


 const char * const net_label[] = {
-  [NET_IP4] 	= "ipv4",
-  [NET_IP6] 	= "ipv6",
-  [NET_VPN4] 	= "vpn4",
-  [NET_VPN6] 	= "vpn6",
-  [NET_ROA4] 	= "roa4",
-  [NET_ROA6] 	= "roa6",
-  [NET_FLOW4] 	= "flow4",
-  [NET_FLOW6] 	= "flow6",
+  [NET_IP4]	= "ipv4",
+  [NET_IP6]	= "ipv6",
+  [NET_VPN4]	= "vpn4",
+  [NET_VPN6]	= "vpn6",
+  [NET_ROA4]	= "roa4",
+  [NET_ROA6]	= "roa6",
+  [NET_FLOW4]	= "flow4",
+  [NET_FLOW6]	= "flow6",
+  [NET_IP6_SADR]= "ipv6-sadr",
  [NET_MPLS]	= "mpls",
 };

 const u16 net_addr_length[] = {
-  [NET_IP4] 	= sizeof(net_addr_ip4),
-  [NET_IP6] 	= sizeof(net_addr_ip6),
-  [NET_VPN4] 	= sizeof(net_addr_vpn4),
-  [NET_VPN6] 	= sizeof(net_addr_vpn6),
-  [NET_ROA4] 	= sizeof(net_addr_roa4),
-  [NET_ROA6] 	= sizeof(net_addr_roa6),
-  [NET_FLOW4] 	= 0,
-  [NET_FLOW6] 	= 0,
+  [NET_IP4]	= sizeof(net_addr_ip4),
+  [NET_IP6]	= sizeof(net_addr_ip6),
+  [NET_VPN4]	= sizeof(net_addr_vpn4),
+  [NET_VPN6]	= sizeof(net_addr_vpn6),
+  [NET_ROA4]	= sizeof(net_addr_roa4),
+  [NET_ROA6]	= sizeof(net_addr_roa6),
+  [NET_FLOW4]	= 0,
+  [NET_FLOW6]	= 0,
+  [NET_IP6_SADR]= sizeof(net_addr_ip6_sadr),
  [NET_MPLS]	= sizeof(net_addr_mpls),
 };

 const u8 net_max_prefix_length[] = {
-  [NET_IP4] 	= IP4_MAX_PREFIX_LENGTH,
-  [NET_IP6] 	= IP6_MAX_PREFIX_LENGTH,
-  [NET_VPN4] 	= IP4_MAX_PREFIX_LENGTH,
-  [NET_VPN6] 	= IP6_MAX_PREFIX_LENGTH,
-  [NET_ROA4] 	= IP4_MAX_PREFIX_LENGTH,
-  [NET_ROA6] 	= IP6_MAX_PREFIX_LENGTH,
-  [NET_FLOW4] 	= IP4_MAX_PREFIX_LENGTH,
-  [NET_FLOW6] 	= IP6_MAX_PREFIX_LENGTH,
+  [NET_IP4]	= IP4_MAX_PREFIX_LENGTH,
+  [NET_IP6]	= IP6_MAX_PREFIX_LENGTH,
+  [NET_VPN4]	= IP4_MAX_PREFIX_LENGTH,
+  [NET_VPN6]	= IP6_MAX_PREFIX_LENGTH,
+  [NET_ROA4]	= IP4_MAX_PREFIX_LENGTH,
+  [NET_ROA6]	= IP6_MAX_PREFIX_LENGTH,
+  [NET_FLOW4]	= IP4_MAX_PREFIX_LENGTH,
+  [NET_FLOW6]	= IP6_MAX_PREFIX_LENGTH,
+  [NET_IP6_SADR]= IP6_MAX_PREFIX_LENGTH,
  [NET_MPLS]	= 0,
 };

 const u16 net_max_text_length[] = {
-  [NET_IP4] 	= 18,	/* "255.255.255.255/32" */
-  [NET_IP6] 	= 43,	/* "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128" */
-  [NET_VPN4] 	= 40,	/* "4294967296:4294967296 255.255.255.255/32" */
-  [NET_VPN6] 	= 65,	/* "4294967296:4294967296 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128" */
-  [NET_ROA4] 	= 34,	/* "255.255.255.255/32-32 AS4294967295" */
-  [NET_ROA6] 	= 60,	/* "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128-128 AS4294967295" */
-  [NET_FLOW4] 	= 0,	/* "flow4 { ... }" */
-  [NET_FLOW6] 	= 0,	/* "flow6 { ... }" */
+  [NET_IP4]	= 18,	/* "255.255.255.255/32" */
+  [NET_IP6]	= 43,	/* "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128" */
+  [NET_VPN4]	= 40,	/* "4294967296:4294967296 255.255.255.255/32" */
+  [NET_VPN6]	= 65,	/* "4294967296:4294967296 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128" */
+  [NET_ROA4]	= 34,	/* "255.255.255.255/32-32 AS4294967295" */
+  [NET_ROA6]	= 60,	/* "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128-128 AS4294967295" */
+  [NET_FLOW4]	= 0,	/* "flow4 { ... }" */
+  [NET_FLOW6]	= 0,	/* "flow6 { ... }" */
+  [NET_IP6_SADR]= 92,	/* "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128 from ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128" */
  [NET_MPLS]	= 7,	/* "1048575" */
 };

@ -102,6 +106,8 @@ net_format(const net_addr *N, char *buf, int buflen)
    return flow4_net_format(buf, buflen, &n->flow4);
  case NET_FLOW6:
    return flow6_net_format(buf, buflen, &n->flow6);
+  case NET_IP6_SADR:
+    return bsnprintf(buf, buflen, "%I6/%d from %I6/%d", n->ip6_sadr.dst_prefix, n->ip6_sadr.dst_pxlen, n->ip6_sadr.src_prefix, n->ip6_sadr.src_pxlen);
  case NET_MPLS:
    return bsnprintf(buf, buflen, "%u", n->mpls.label);
  }
@ -124,6 +130,7 @@ net_pxmask(const net_addr *a)
  case NET_VPN6:
  case NET_ROA6:
  case NET_FLOW6:
+  case NET_IP6_SADR:
    return ipa_from_ip6(ip6_mkmask(net6_pxlen(a)));

  case NET_MPLS:
@ -156,6 +163,8 @@ net_compare(const net_addr *a, const net_addr *b)
    return net_compare_flow4((const net_addr_flow4 *) a, (const net_addr_flow4 *) b);
  case NET_FLOW6:
    return net_compare_flow6((const net_addr_flow6 *) a, (const net_addr_flow6 *) b);
+  case NET_IP6_SADR:
+    return net_compare_ip6_sadr((const net_addr_ip6_sadr *) a, (const net_addr_ip6_sadr *) b);
  case NET_MPLS:
    return net_compare_mpls((const net_addr_mpls *) a, (const net_addr_mpls *) b);
  }
@ -177,6 +186,7 @@ net_hash(const net_addr *n)
  case NET_ROA6: return NET_HASH(n, roa6);
  case NET_FLOW4: return NET_HASH(n, flow4);
  case NET_FLOW6: return NET_HASH(n, flow6);
+  case NET_IP6_SADR: return NET_HASH(n, ip6_sadr);
  case NET_MPLS: return NET_HASH(n, mpls);
  default: bug("invalid type");
  }
@ -198,6 +208,7 @@ net_validate(const net_addr *n)
  case NET_ROA6: return NET_VALIDATE(n, roa6);
  case NET_FLOW4: return NET_VALIDATE(n, flow4);
  case NET_FLOW6: return NET_VALIDATE(n, flow6);
+  case NET_IP6_SADR: return NET_VALIDATE(n, ip6_sadr);
  case NET_MPLS: return NET_VALIDATE(n, mpls);
  default: return 0;
  }
@ -222,6 +233,9 @@ net_normalize(net_addr *N)
  case NET_FLOW6:
    return net_normalize_ip6(&n->ip6);

+  case NET_IP6_SADR:
+    return net_normalize_ip6_sadr(&n->ip6_sadr);
+
  case NET_MPLS:
    return;
  }
@ -246,6 +260,9 @@ net_classify(const net_addr *N)
  case NET_FLOW6:
    return ip6_zero(n->ip6.prefix) ? (IADDR_HOST | SCOPE_UNIVERSE) : ip6_classify(&n->ip6.prefix);

+  case NET_IP6_SADR:
+    return ip6_zero(n->ip6_sadr.dst_prefix) ? (IADDR_HOST | SCOPE_UNIVERSE) : ip6_classify(&n->ip6_sadr.dst_prefix);
+
  case NET_MPLS:
    return IADDR_HOST | SCOPE_UNIVERSE;
  }
@ -274,6 +291,11 @@ ipa_in_netX(const ip_addr a, const net_addr *n)
    return ip6_zero(ip6_and(ip6_xor(ipa_to_ip6(a), net6_prefix(n)),
 			    ip6_mkmask(net6_pxlen(n))));

+  case NET_IP6_SADR:
+    if (ipa_is_ip4(a)) return 0;
+    return ip6_zero(ip6_and(ip6_xor(ipa_to_ip6(a), net6_prefix(n)),
+			    ip6_mkmask(net6_pxlen(n))));
+
  case NET_MPLS:
  default:
    return 0;
@ -304,5 +326,6 @@ net_init(void)
  CHECK_NET(net_addr_roa6,	28);
  CHECK_NET(net_addr_flow4,	 8);
  CHECK_NET(net_addr_flow6,	20);
+  CHECK_NET(net_addr_ip6_sadr,	40);
  CHECK_NET(net_addr_mpls,	 8);
 }
--- a/lib/net.h
+++ b/lib/net.h
@ -21,8 +21,9 @@
 #define NET_ROA6	6
 #define NET_FLOW4	7
 #define NET_FLOW6	8
-#define NET_MPLS	9
-#define NET_MAX		10
+#define NET_IP6_SADR	9
+#define NET_MPLS	10
+#define NET_MAX		11

 #define NB_IP4		(1 << NET_IP4)
 #define NB_IP6		(1 << NET_IP6)
@ -32,12 +33,13 @@
 #define NB_ROA6		(1 << NET_ROA6)
 #define NB_FLOW4	(1 << NET_FLOW4)
 #define NB_FLOW6	(1 << NET_FLOW6)
+#define NB_IP6_SADR	(1 << NET_IP6_SADR)
 #define NB_MPLS		(1 << NET_MPLS)

 #define NB_IP		(NB_IP4 | NB_IP6)
 #define NB_VPN		(NB_VPN4 | NB_VPN6)
 #define NB_FLOW		(NB_FLOW4 | NB_FLOW6)
-#define NB_DEST		(NB_IP | NB_VPN | NB_MPLS)
+#define NB_DEST		(NB_IP | NB_IP6_SADR | NB_VPN | NB_MPLS)
 #define NB_ANY		0xffffffff


@ -121,6 +123,15 @@ typedef struct net_addr_mpls {
  u32 label;
 } net_addr_mpls;

+typedef struct net_addr_ip6_sadr {
+  u8 type;
+  u8 dst_pxlen;
+  u16 length;
+  ip6_addr dst_prefix;
+  s32 src_pxlen; /* s32 to avoid padding */
+  ip6_addr src_prefix;
+} net_addr_ip6_sadr;
+
 typedef union net_addr_union {
  net_addr n;
  net_addr_ip4 ip4;
@ -131,6 +142,7 @@ typedef union net_addr_union {
  net_addr_roa6 roa6;
  net_addr_flow4 flow4;
  net_addr_flow6 flow6;
+  net_addr_ip6_sadr ip6_sadr;
  net_addr_mpls mpls;
 } net_addr_union;

@ -162,10 +174,13 @@ extern const u16 net_max_text_length[];
  ((net_addr_roa6) { NET_ROA6, pxlen, sizeof(net_addr_roa6), prefix, max_pxlen, asn })

 #define NET_ADDR_FLOW4(prefix,pxlen,dlen) \
-  ((net_addr_flow4) { NET_FLOW4, pxlen, sizeof(net_addr_ip4) + dlen, prefix })
+  ((net_addr_flow4) { NET_FLOW4, pxlen, sizeof(net_addr_flow4) + dlen, prefix })

 #define NET_ADDR_FLOW6(prefix,pxlen,dlen) \
-  ((net_addr_flow6) { NET_FLOW6, pxlen, sizeof(net_addr_ip6) + dlen, prefix })
+  ((net_addr_flow6) { NET_FLOW6, pxlen, sizeof(net_addr_flow6) + dlen, prefix })
+
+#define NET_ADDR_IP6_SADR(dst_prefix,dst_pxlen,src_prefix,src_pxlen) \
+  ((net_addr_ip6_sadr) { NET_IP6_SADR, dst_pxlen, sizeof(net_addr_ip6_sadr), dst_prefix, src_pxlen, src_prefix })

 #define NET_ADDR_MPLS(label) \
  ((net_addr_mpls) { NET_MPLS, 20, sizeof(net_addr_mpls), label })
@ -189,6 +204,9 @@ static inline void net_fill_roa4(net_addr *a, ip4_addr prefix, uint pxlen, uint
 static inline void net_fill_roa6(net_addr *a, ip6_addr prefix, uint pxlen, uint max_pxlen, u32 asn)
 { *(net_addr_roa6 *)a = NET_ADDR_ROA6(prefix, pxlen, max_pxlen, asn); }

+static inline void net_fill_ip6_sadr(net_addr *a, ip6_addr dst_prefix, uint dst_pxlen, ip6_addr src_prefix, uint src_pxlen)
+{ *(net_addr_ip6_sadr *)a = NET_ADDR_IP6_SADR(dst_prefix, dst_pxlen, src_prefix, src_pxlen); }
+
 static inline void net_fill_mpls(net_addr *a, u32 label)
 { *(net_addr_mpls *)a = NET_ADDR_MPLS(label); }

@ -222,6 +240,16 @@ static inline void net_fill_flow6(net_addr *a, ip6_addr prefix, uint pxlen, byte
  memcpy(f->data, data, dlen);
 }

+/* Make NET_IP6_SADR from NET_IP6, assuming there is enough space */
+static inline void net_make_ip6_sadr(net_addr *a)
+{
+  net_addr_ip6_sadr *n = (void *) a;
+  n->type = NET_IP6_SADR;
+  n->length = sizeof(net_addr_ip6_sadr);
+  n->src_pxlen = 0;
+  n->src_prefix = IP6_NONE;
+}
+
 static inline int net_val_match(u8 type, u32 mask)
 { return !!((1 << type) & mask); }

@ -240,6 +268,8 @@ static inline int net_is_roa(const net_addr *a)
 static inline int net_is_flow(const net_addr *a)
 { return (a->type == NET_FLOW4) || (a->type == NET_FLOW6); }

+static inline int net_is_sadr(const net_addr *a)
+{ return (a->type == NET_IP6_SADR); }

 static inline ip4_addr net4_prefix(const net_addr *a)
 { return ((net_addr_ip4 *) a)->prefix; }
@ -261,6 +291,7 @@ static inline ip_addr net_prefix(const net_addr *a)
  case NET_VPN6:
  case NET_ROA6:
  case NET_FLOW6:
+  case NET_IP6_SADR:
    return ipa_from_ip6(net6_prefix(a));

  case NET_MPLS:
@ -328,6 +359,9 @@ static inline int net_equal_flow4(const net_addr_flow4 *a, const net_addr_flow4
 static inline int net_equal_flow6(const net_addr_flow6 *a, const net_addr_flow6 *b)
 { return net_equal((const net_addr *) a, (const net_addr *) b); }

+static inline int net_equal_ip6_sadr(const net_addr_ip6_sadr *a, const net_addr_ip6_sadr *b)
+{ return !memcmp(a, b, sizeof(net_addr_ip6_sadr)); }
+
 static inline int net_equal_mpls(const net_addr_mpls *a, const net_addr_mpls *b)
 { return !memcmp(a, b, sizeof(net_addr_mpls)); }

@ -338,6 +372,12 @@ static inline int net_equal_prefix_roa4(const net_addr_roa4 *a, const net_addr_r
 static inline int net_equal_prefix_roa6(const net_addr_roa6 *a, const net_addr_roa6 *b)
 { return ip6_equal(a->prefix, b->prefix) && (a->pxlen == b->pxlen); }

+static inline int net_equal_dst_ip6_sadr(const net_addr_ip6_sadr *a, const net_addr_ip6_sadr *b)
+{ return ip6_equal(a->dst_prefix, b->dst_prefix) && (a->dst_pxlen == b->dst_pxlen); }
+
+static inline int net_equal_src_ip6_sadr(const net_addr_ip6_sadr *a, const net_addr_ip6_sadr *b)
+{ return ip6_equal(a->src_prefix, b->src_prefix) && (a->src_pxlen == b->src_pxlen); }
+

 static inline int net_zero_ip4(const net_addr_ip4 *a)
 { return !a->pxlen && ip4_zero(a->prefix); }
@ -391,6 +431,13 @@ static inline int net_compare_flow4(const net_addr_flow4 *a, const net_addr_flow
 static inline int net_compare_flow6(const net_addr_flow6 *a, const net_addr_flow6 *b)
 { return ip6_compare(a->prefix, b->prefix) ?: uint_cmp(a->pxlen, b->pxlen) ?: uint_cmp(a->length, b->length) ?: memcmp(a->data, b->data, a->length - sizeof(net_addr_flow6)); }

+static inline int net_compare_ip6_sadr(const net_addr_ip6_sadr *a, const net_addr_ip6_sadr *b)
+{
+  return
+    ip6_compare(a->dst_prefix, b->dst_prefix) ?: uint_cmp(a->dst_pxlen, b->dst_pxlen) ?:
+    ip6_compare(a->src_prefix, b->src_prefix) ?: uint_cmp(a->src_pxlen, b->src_pxlen);
+}
+
 static inline int net_compare_mpls(const net_addr_mpls *a, const net_addr_mpls *b)
 { return uint_cmp(a->label, b->label); }

@ -424,6 +471,9 @@ static inline void net_copy_flow4(net_addr_flow4 *dst, const net_addr_flow4 *src
 static inline void net_copy_flow6(net_addr_flow6 *dst, const net_addr_flow6 *src)
 { memcpy(dst, src, src->length); }

+static inline void net_copy_ip6_sadr(net_addr_ip6_sadr *dst, const net_addr_ip6_sadr *src)
+{ memcpy(dst, src, sizeof(net_addr_ip6_sadr)); }
+
 static inline void net_copy_mpls(net_addr_mpls *dst, const net_addr_mpls *src)
 { memcpy(dst, src, sizeof(net_addr_mpls)); }

@ -456,6 +506,9 @@ static inline u32 net_hash_flow4(const net_addr_flow4 *n)
 static inline u32 net_hash_flow6(const net_addr_flow6 *n)
 { return ip6_hash(n->prefix) ^ ((u32) n->pxlen << 26); }

+static inline u32 net_hash_ip6_sadr(const net_addr_ip6_sadr *n)
+{ return net_hash_ip6((net_addr_ip6 *) n); }
+
 static inline u32 net_hash_mpls(const net_addr_mpls *n)
 { return n->label; }

@ -508,6 +561,9 @@ static inline int net_validate_flow6(const net_addr_flow6 *n)
 static inline int net_validate_mpls(const net_addr_mpls *n)
 { return n->label < (1 << 20); }

+static inline int net_validate_ip6_sadr(const net_addr_ip6_sadr *n)
+{ return net_validate_px6(n->dst_prefix, n->dst_pxlen) && net_validate_px6(n->src_prefix, n->src_pxlen); }
+
 int net_validate(const net_addr *N);


@ -523,6 +579,12 @@ static inline void net_normalize_vpn4(net_addr_vpn4 *n)
 static inline void net_normalize_vpn6(net_addr_vpn6 *n)
 { net_normalize_ip6((net_addr_ip6 *) n); }

+static inline void net_normalize_ip6_sadr(net_addr_ip6_sadr *n)
+{
+  n->dst_prefix = ip6_and(n->dst_prefix, ip6_mkmask(n->dst_pxlen));
+  n->src_prefix = ip6_and(n->src_prefix, ip6_mkmask(n->src_pxlen));
+}
+
 void net_normalize(net_addr *N);


@ -530,17 +592,29 @@ int net_classify(const net_addr *N);
 int net_format(const net_addr *N, char *buf, int buflen);
 int rd_format(const u64 rd, char *buf, int buflen);

-static inline int ipa_in_net_ip4(ip4_addr a, const net_addr_ip4 *n)
-{ return ip4_zero(ip4_and(ip4_xor(a, n->prefix), ip4_mkmask(n->pxlen))); }
+static inline int ipa_in_px4(ip4_addr a, ip4_addr prefix, uint pxlen)
+{ return ip4_zero(ip4_and(ip4_xor(a, prefix), ip4_mkmask(pxlen))); }

-static inline int net_in_net_ip4(const net_addr_ip4 *a, const net_addr_ip4 *b)
-{ return (a->pxlen >= b->pxlen) && ipa_in_net_ip4(a->prefix, b); }
+static inline int ipa_in_px6(ip6_addr a, ip6_addr prefix, uint pxlen)
+{ return ip6_zero(ip6_and(ip6_xor(a, prefix), ip6_mkmask(pxlen))); }
+
+static inline int ipa_in_net_ip4(ip4_addr a, const net_addr_ip4 *n)
+{ return ipa_in_px4(a, n->prefix, n->pxlen); }

 static inline int ipa_in_net_ip6(ip6_addr a, const net_addr_ip6 *n)
-{ return ip6_zero(ip6_and(ip6_xor(a, n->prefix), ip6_mkmask(n->pxlen))); }
+{ return ipa_in_px6(a, n->prefix, n->pxlen); }
+
+static inline int net_in_net_ip4(const net_addr_ip4 *a, const net_addr_ip4 *b)
+{ return (a->pxlen >= b->pxlen) && ipa_in_px4(a->prefix, b->prefix, b->pxlen); }

 static inline int net_in_net_ip6(const net_addr_ip6 *a, const net_addr_ip6 *b)
-{ return (a->pxlen >= b->pxlen) && ipa_in_net_ip6(a->prefix, b); }
+{ return (a->pxlen >= b->pxlen) && ipa_in_px6(a->prefix, b->prefix, b->pxlen); }
+
+static inline int net_in_net_dst_ip6_sadr(const net_addr_ip6_sadr *a, const net_addr_ip6_sadr *b)
+{ return (a->dst_pxlen >= b->dst_pxlen) && ipa_in_px6(a->dst_prefix, b->dst_prefix, b->dst_pxlen); }
+
+static inline int net_in_net_src_ip6_sadr(const net_addr_ip6_sadr *a, const net_addr_ip6_sadr *b)
+{ return (a->src_pxlen >= b->src_pxlen) && ipa_in_px6(a->src_prefix, b->src_prefix, b->src_pxlen); }

 int ipa_in_netX(const ip_addr A, const net_addr *N);
 int net_in_netX(const net_addr *A, const net_addr *N);
--- a/lib/printf.c
+++ b/lib/printf.c
@ -34,13 +34,7 @@ static int skip_atoi(const char **s)
 #define SPECIAL	32		/* 0x */
 #define LARGE	64		/* use 'ABCDEF' instead of 'abcdef' */

-#define do_div(n,base) ({ \
-int __res; \
-__res = ((unsigned long) n) % (unsigned) base; \
-n = ((unsigned long) n) / (unsigned) base; \
-__res; })
-
-static char * number(char * str, long num, int base, int size, int precision,
+static char * number(char * str, u64 num, uint base, int size, int precision,
 	int type, int remains)
 {
 	char c,sign,tmp[66];
@ -58,7 +52,7 @@ static char * number(char * str, long num, int base, int size, int precision,
 	c = (type & ZEROPAD) ? '0' : ' ';
 	sign = 0;
 	if (type & SIGN) {
-		if (num < 0) {
+		if (num > (u64) INT64_MAX) {
 			sign = '-';
 			num = -num;
 			size--;
@ -79,8 +73,11 @@ static char * number(char * str, long num, int base, int size, int precision,
 	i = 0;
 	if (num == 0)
 		tmp[i++]='0';
-	else while (num != 0)
-		tmp[i++] = digits[do_div(num,base)];
+	else while (num != 0) {
+		uint res = num % base;
+		num = num / base;
+		tmp[i++] = digits[res];
+	}
 	if (i > precision)
 		precision = i;
 	size -= precision;
@ -128,16 +125,17 @@ static char * number(char * str, long num, int base, int size, int precision,
 * value printed as eight :-separated octets), |%t| for time values (btime) with
 * specified subsecond precision, and |%m| resp. |%M| for error messages (uses
 * strerror() to translate @errno code to message text). On the other hand, it
- * doesn't support floating point numbers.
+ * doesn't support floating point numbers. The bvsnprintf() supports |%h| and
+ * |%l| qualifiers, but |%l| is used for s64/u64 instead of long/ulong.
 *
 * Result: number of characters of the output string or -1 if
 * the buffer space was insufficient.
 */
 int bvsnprintf(char *buf, int size, const char *fmt, va_list args)
 {
-	int len;
-	unsigned long num;
-	int i, base;
+	int len, i;
+	u64 num;
+	uint base;
 	u32 x;
 	u64 X;
 	btime t;
@ -152,7 +150,7 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)
 	int field_width;	/* width of output field */
 	int precision;		/* min. # of digits for integers; max
 				   number of chars for from string */
-	int qualifier;		/* 'h', 'l', or 'L' for integer fields */
+	int qualifier;		/* 'h' or 'l' for integer fields */

 	for (start=str=buf ; *fmt ; ++fmt, size-=(str-start), start=str) {
 		if (*fmt != '%') {
@ -270,21 +268,31 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)
 				*str++ = ' ';
 			continue;

+		case 'V': {
+			const char *vfmt = va_arg(args, const char *);
+			va_list *vargs = va_arg(args, va_list *);
+			int res = bvsnprintf(str, size, vfmt, *vargs);
+			if (res < 0)
+				return -1;
+			str += res;
+			size -= res;
+			continue;
+			}
+
 		case 'p':
 			if (field_width == -1) {
 				field_width = 2*sizeof(void *);
 				flags |= ZEROPAD;
 			}
-			str = number(str,
-				(unsigned long) va_arg(args, void *), 16,
-				field_width, precision, flags, size);
+			str = number(str, (uintptr_t) va_arg(args, void *), 16,
+				     field_width, precision, flags, size);
 			if (!str)
 				return -1;
 			continue;

 		case 'n':
 			if (qualifier == 'l') {
-				long * ip = va_arg(args, long *);
+				s64 * ip = va_arg(args, s64 *);
 				*ip = (str - buf);
 			} else {
 				int * ip = va_arg(args, int *);
@ -345,14 +353,14 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)
 			if (qualifier == 'l') {
 				X = va_arg(args, u64);
 				bsprintf(ipbuf, "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
-					((X >> 56) & 0xff),
-					((X >> 48) & 0xff),
-					((X >> 40) & 0xff),
-					((X >> 32) & 0xff),
-					((X >> 24) & 0xff),
-					((X >> 16) & 0xff),
-					((X >> 8) & 0xff),
-					(X & 0xff));
+					 (uint) ((X >> 56) & 0xff),
+					 (uint) ((X >> 48) & 0xff),
+					 (uint) ((X >> 40) & 0xff),
+					 (uint) ((X >> 32) & 0xff),
+					 (uint) ((X >> 24) & 0xff),
+					 (uint) ((X >> 16) & 0xff),
+					 (uint) ((X >> 8) & 0xff),
+					 (uint) (X & 0xff));
 			}
 			else
 			{
@ -382,7 +390,7 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)

 			/* Print seconds */
 			flags |= SIGN;
-			str = number(str, t1, 10, field_width, 0, flags, size);
+			str = number(str, (u64) t1, 10, field_width, 0, flags, size);
 			if (!str)
 			  return -1;

@ -400,7 +408,7 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)

 			  /* Print sub-seconds */
 			  *str++ = '.';
-			  str = number(str, t2, 10, precision, 0, ZEROPAD, size - 1);
+			  str = number(str, (u64) t2, 10, precision, 0, ZEROPAD, size - 1);
 			  if (!str)
 			    return -1;
 			}
@ -413,6 +421,7 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)

 		case 'X':
 			flags |= LARGE;
+			/* fallthrough */
 		case 'x':
 			base = 16;
 			break;
@ -434,16 +443,22 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)
 				--fmt;
 			continue;
 		}
-		if (qualifier == 'l')
-			num = va_arg(args, unsigned long);
-		else if (qualifier == 'h') {
-			num = (unsigned short) va_arg(args, int);
-			if (flags & SIGN)
-				num = (short) num;
-		} else if (flags & SIGN)
-			num = va_arg(args, int);
-		else
-			num = va_arg(args, uint);
+		if (flags & SIGN) {
+			/* Conversions valid per ISO C99 6.3.1.3 (2) */
+			if (qualifier == 'l')
+				num = (u64) va_arg(args, s64);
+			else if (qualifier == 'h')
+				num = (u64) (short) va_arg(args, int);
+			else
+				num = (u64) va_arg(args, int);
+		} else {
+			if (qualifier == 'l')
+				num = va_arg(args, u64);
+			else if (qualifier == 'h')
+				num = (unsigned short) va_arg(args, int);
+			else
+				num = va_arg(args, uint);
+		}
 		str = number(str, num, base, field_width, precision, flags, size);
 		if (!str)
 			return -1;
--- a/lib/printf_test.c
+++ b/lib/printf_test.c
@ -45,7 +45,7 @@ t_simple(void)
  else
    BSPRINTF(16, "00000fee1a15600d", buf, "%p", (void *) 0xfee1a15600d);

-  long ln = 0;
+  s64 ln = 0;
  BSPRINTF(10, "TeStStRiNg", buf, "TeStS%lntRiNg", &ln);
  bt_assert_msg(ln == 5, "fmt=\"TeStS%%lntRiNg\", &ln makes ln=%ld, want 5", ln);

@ -54,7 +54,40 @@ t_simple(void)
  BSPRINTF(2, "+1", buf, "%+d", 1);
  BSPRINTF(2, " 1", buf, "% d", 1);
  BSPRINTF(2, "-1", buf, "%d", -1);
-  BSPRINTF(11, "-2147483648", buf, "%d", -2147483648);
+  BSPRINTF(11, "-2147483648", buf, "%d", INT32_MIN);
+  BSPRINTF(10,  "2147483647", buf, "%d", INT32_MAX);
+
+  BSPRINTF(1,  "0", buf, "%u", 0x0);
+  BSPRINTF(10, "4294967295", buf, "%u", 0xFFFFFFFF);
+
+  BSPRINTF(4,  "-100", buf, "%ld", (s64) -100);
+  BSPRINTF(3,   "100", buf, "%ld", (s64)  100);
+  BSPRINTF(20, "-9223372036854775808", buf, "%ld", INT64_MIN);
+  BSPRINTF(19,  "9223372036854775807", buf, "%ld", INT64_MAX);
+
+  BSPRINTF(3,  "0 8", buf, "%lu %lu", U64(0), U64(8));
+  BSPRINTF(20, "18446744073709551615", buf, "%lu", UINT64_MAX);
+
+  return 1;
+}
+
+static int
+t_router_id(void)
+{
+  char buf[256];
+
+  BSPRINTF(7, "1.2.3.4", buf, "%R", (u32) 0x01020304);
+  BSPRINTF(15, "240.224.208.192", buf, "%R", (u32) 0xF0E0D0C0);
+  BSPRINTF(23, "01:02:03:04:05:06:07:08", buf, "%lR", (u64) 0x0102030405060708);
+  BSPRINTF(23, "f0:e0:d0:c0:b0:a0:90:80", buf, "%lR", (u64) 0xF0E0D0C0B0A09080);
+
+  return 1;
+}
+
+static int
+t_time(void)
+{
+  char buf[256];

  BSPRINTF(7, "123.456", buf, "%t", (btime) 123456789);
  BSPRINTF(7, "123.456", buf, "%2t", (btime) 123456789);
@ -68,12 +101,28 @@ t_simple(void)
  return 1;
 }

+static int
+t_bstrcmp(void)
+{
+  bt_assert(bstrcmp("aa", "aa") == 0);
+  bt_assert(bstrcmp("aa", "bb") == -1);
+  bt_assert(bstrcmp("bb", "aa") == 1);
+  bt_assert(bstrcmp(NULL, NULL) == 0);
+  bt_assert(bstrcmp(NULL, "bb") == -1);
+  bt_assert(bstrcmp("bb", NULL) == 1);
+
+  return 1;
+}
+
 int
 main(int argc, char *argv[])
 {
  bt_init(argc, argv);

  bt_test_suite(t_simple, "printf without varargs");
+  bt_test_suite(t_router_id, "print router id");
+  bt_test_suite(t_time, "print time");
+  bt_test_suite(t_bstrcmp, "bstrcmp");

  return bt_exit_value();
 }
--- a/lib/resource.c
+++ b/lib/resource.c
@ -340,6 +340,7 @@ mb_alloc(pool *p, unsigned size)
  struct mblock *b = xmalloc(sizeof(struct mblock) + size);

  b->r.class = &mb_class;
+  b->r.n = (node) {};
  add_tail(&p->inside, &b->r.n);
  b->size = size;
  return b->data;
@ -387,7 +388,7 @@ mb_realloc(void *m, unsigned size)
  struct mblock *b = SKIP_BACK(struct mblock, data, m);

  b = xrealloc(b, sizeof(struct mblock) + size);
-  replace_node(&b->r.n, &b->r.n);
+  update_node(&b->r.n);
  b->size = size;
  return b->data;
 }
--- a/lib/resource.h
+++ b/lib/resource.h
@ -83,6 +83,7 @@ typedef struct slab slab;

 slab *sl_new(pool *, unsigned size);
 void *sl_alloc(slab *);
+void *sl_allocz(slab *);
 void sl_free(slab *, void *);

 /*
@ -101,9 +102,13 @@ void buffer_realloc(void **buf, unsigned *size, unsigned need, unsigned item_siz
 */
 #define DMALLOC_DISABLE
 #include <dmalloc.h>
-#define xmalloc(size) _xmalloc_leap(__FILE__, __LINE__, size)
-#define xrealloc(size) _xrealloc_leap(__FILE__, __LINE__, size)
-#define xfree(ptr) _xfree_leap(__FILE__, __LINE__, ptr)
+#define xmalloc(size) \
+  dmalloc_malloc(__FILE__, __LINE__, (size), DMALLOC_FUNC_MALLOC, 0, 1)
+#define xrealloc(ptr, size) \
+  dmalloc_realloc(__FILE__, __LINE__, (ptr), (size), DMALLOC_FUNC_REALLOC, 1)
+#define xfree(ptr) \
+  dmalloc_free(__FILE__, __LINE__, (ptr), DMALLOC_FUNC_FREE)
+
 #else
 /*
 * Unfortunately, several libraries we might want to link to define
--- a/lib/slab.c
+++ b/lib/slab.c
@ -88,6 +88,14 @@ sl_alloc(slab *s)
  return o->data;
 }

+void *
+sl_allocz(slab *s)
+{
+  void *obj = sl_alloc(s);
+  memset(obj, 0, s->size);
+  return obj;
+}
+
 void
 sl_free(slab *s, void *oo)
 {
@ -216,8 +224,11 @@ sl_new_head(slab *s)
  struct sl_obj *no;
  uint n = s->objs_per_slab;

-  h->first_free = o;
-  h->num_full = 0;
+  *h = (struct sl_head) {
+    .first_free = o,
+    .num_full = 0,
+  };
+
  while (n--)
    {
      o->slab = h;
@ -275,6 +286,22 @@ no_partial:
  goto okay;
 }

+/**
+ * sl_allocz - allocate an object from Slab and zero it
+ * @s: slab
+ *
+ * sl_allocz() allocates space for a single object from the
+ * Slab and returns a pointer to the object after zeroing out
+ * the object memory.
+ */
+void *
+sl_allocz(slab *s)
+{
+  void *obj = sl_alloc(s);
+  memset(obj, 0, s->data_size);
+  return obj;
+}
+
 /**
 * sl_free - return a free object back to a Slab
 * @s: slab
--- a/lib/socket.h
+++ b/lib/socket.h
@ -76,7 +76,7 @@ typedef struct birdsock {
  int rcv_ttl;				/* TTL of last received datagram */
  node n;
  void *rbuf_alloc, *tbuf_alloc;
-  char *password;			/* Password for MD5 authentication */
+  const char *password;			/* Password for MD5 authentication */
  const char *err;			/* Error message */
  struct ssh_sock *ssh;			/* Used in SK_SSH */
 } sock;
@ -97,7 +97,7 @@ void sk_dump_all(void);
 int sk_is_ipv4(sock *s);		/* True if socket is IPv4 */
 int sk_is_ipv6(sock *s);		/* True if socket is IPv6 */

-static inline int sk_send_buffer_empty(sock *sk)
+static inline int sk_tx_buffer_empty(sock *sk)
 { return sk->tbuf == sk->tpos; }

 int sk_setup_multicast(sock *s);	/* Prepare UDP or IP socket for multicasting */
@ -106,7 +106,7 @@ int sk_leave_group(sock *s, ip_addr maddr);	/* Leave multicast group on sk iface
 int sk_setup_broadcast(sock *s);
 int sk_set_ttl(sock *s, int ttl);	/* Set transmit TTL for given socket */
 int sk_set_min_ttl(sock *s, int ttl);	/* Set minimal accepted TTL for given socket */
-int sk_set_md5_auth(sock *s, ip_addr local, ip_addr remote, struct iface *ifa, char *passwd, int setkey);
+int sk_set_md5_auth(sock *s, ip_addr local, ip_addr remote, int pxlen, struct iface *ifa, const char *passwd, int setkey);
 int sk_set_ipv6_checksum(sock *s, int offset);
 int sk_set_icmp6_filter(sock *s, int p1, int p2);
 void sk_log_error(sock *s, const char *p);
--- a/lib/string.h
+++ b/lib/string.h
@ -24,6 +24,9 @@ int buffer_vprint(buffer *buf, const char *fmt, va_list args);
 int buffer_print(buffer *buf, const char *fmt, ...);
 void buffer_puts(buffer *buf, const char *str);

+u64 bstrtoul10(const char *str, char **end);
+u64 bstrtoul16(const char *str, char **end);
+
 int patmatch(const byte *pat, const byte *str);

 static inline char *xbasename(const char *str)
@ -60,6 +63,24 @@ memset32(void *D, u32 val, uint n)
    dst[i] = val;
 }

+static inline int
+bstrcmp(const char *s1, const char *s2)
+{
+  if (s1 && s2)
+    return strcmp(s1, s2);
+  else
+    return !s2 - !s1;
+}
+
+static inline void *
+bmemcpy(void *dest, const void *src, size_t n)
+{
+  if (n)
+    return memcpy(dest, src, n);
+  else
+    return dest;
+}
+
 #define ROUTER_ID_64_LENGTH 23

 #endif
--- a/lib/strtoul.c
+++ b/lib/strtoul.c
@ -0,0 +1,61 @@
+/*
+ *	BIRD Library -- Parse numbers
+ *
+ *	(c) 2019 Maria Matejka <mq@jmq.cz>
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include "nest/bird.h"
+#include "lib/string.h"
+
+#include <errno.h>
+
+#define ULI_MAX_DIV10 (UINT64_MAX / 10)
+#define ULI_MAX_MOD10 (UINT64_MAX % 10)
+
+u64
+bstrtoul10(const char *str, char **end)
+{
+  u64 out = 0;
+  for (*end = (char *) str; (**end >= '0') && (**end <= '9'); (*end)++) {
+    u64 digit = **end - '0';
+    if ((out > ULI_MAX_DIV10) ||
+	(out == ULI_MAX_DIV10) && (digit > ULI_MAX_MOD10)) {
+      errno = ERANGE;
+      return UINT64_MAX;
+    }
+    
+    out *= 10;
+    out += (**end) - '0';
+  }
+  return out;
+}
+
+u64
+bstrtoul16(const char *str, char **end)
+{
+  u64 out = 0;
+  for (int i=0; i<=(64/4); i++) {
+    switch (str[i]) {
+      case '0' ... '9':
+	out *= 16;
+	out += str[i] - '0';
+	break;
+      case 'a' ... 'f':
+	out *= 16;
+	out += str[i] + 10 - 'a';
+	break;
+      case 'A' ... 'F':
+	out *= 16;
+	out += str[i] + 10 - 'A';
+	break;
+      default:
+	*end = (char *) &(str[i]);
+	return out;
+    }
+  }
+
+  errno = ERANGE;
+  return UINT64_MAX;
+}
--- a/lib/timer.c
+++ b/lib/timer.c
@ -253,9 +253,9 @@ timer_init(void)
 * type &btime.
 */
 btime
-tm_parse_time(char *x)
+tm_parse_time(const char *x)
 {
-  struct tm tm;
+  struct tm tm = {};
  int usec, n1, n2, n3, r;

  r = sscanf(x, "%d-%d-%d%n %d:%d:%d%n.%d%n",
@ -305,7 +305,8 @@ tm_format_time(char *x, struct timeformat *fmt, btime t)
  btime rt = current_real_time() - dt;
  int v1 = !fmt->limit || (dt < fmt->limit);

-  tm_format_real_time(x, v1 ? fmt->fmt1 : fmt->fmt2, rt);
+  if (!tm_format_real_time(x, TM_DATETIME_BUFFER_SIZE, v1 ? fmt->fmt1 : fmt->fmt2, rt))
+    strcpy(x, "<error>");
 }

 /* Replace %f in format string with usec scaled to requested precision */
@ -353,8 +354,8 @@ strfusec(char *buf, int size, const char *fmt, uint usec)
  return str - buf;
 }

-void
-tm_format_real_time(char *x, const char *fmt, btime t)
+int
+tm_format_real_time(char *x, size_t max, const char *fmt, btime t)
 {
  s64 t1 = t TO_S;
  s64 t2 = t - t1 S;
@ -362,17 +363,14 @@ tm_format_real_time(char *x, const char *fmt, btime t)
  time_t ts = t1;
  struct tm tm;
  if (!localtime_r(&ts, &tm))
-    goto err;
+    return 0;

  byte tbuf[TM_DATETIME_BUFFER_SIZE];
-  if (!strfusec(tbuf, TM_DATETIME_BUFFER_SIZE, fmt, t2))
-    goto err;
+  if (!strfusec(tbuf, max, fmt, t2))
+    return 0;

-  if (!strftime(x, TM_DATETIME_BUFFER_SIZE, tbuf, &tm))
-    goto err;
+  if (!strftime(x, max, tbuf, &tm))
+    return 0;

-  return;
-
-err:
-  strcpy(x, "<error>");
+  return 1;
 }
--- a/lib/timer.h
+++ b/lib/timer.h
@ -106,7 +106,7 @@ void timer_init(void);


 struct timeformat {
-  char *fmt1, *fmt2;
+  const char *fmt1, *fmt2;
  btime limit;
 };

@ -120,8 +120,8 @@ struct timeformat {

 #define TM_DATETIME_BUFFER_SIZE 32	/* Buffer size required by tm_format_time() */

-btime tm_parse_time(char *x);
+btime tm_parse_time(const char *x);
 void tm_format_time(char *x, struct timeformat *fmt, btime t);
-void tm_format_real_time(char *x, const char *fmt, btime t);
+int tm_format_real_time(char *x, size_t max, const char *fmt, btime t);

 #endif
--- a/lib/unaligned.h
+++ b/lib/unaligned.h
@ -20,6 +20,12 @@
 #include "sysdep/unix/endian.h"
 #include "lib/string.h"

+static inline u8
+get_u8(const void *p)
+{
+  return * (u8 *) p;
+}
+
 static inline u16
 get_u16(const void *p)
 {
@ -52,6 +58,12 @@ get_u64(const void *p)
  return (((u64) ntohl(xh)) << 32) | ntohl(xl);
 }

+static inline void
+put_u8(void *p, u8 x)
+{
+  memcpy(p, &x, 1);
+}
+
 static inline void
 put_u16(void *p, u16 x)
 {
--- a/misc/bird.spec
+++ b/misc/bird.spec
@ -1,6 +1,6 @@
 Summary: BIRD Internet Routing Daemon
 Name: bird
-Version: 2.0.1
+Version: 2.0.8
 Release: 1
 Copyright: GPL
 Group: Networking/Daemons
--- a/misc/docker/centos-8-amd64/Dockerfile
+++ b/misc/docker/centos-8-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM centos:8
+RUN yum -y upgrade
+RUN yum -y install \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	'readline-devel' \
+	'pkgconfig(ncurses)' \
+	gcc \
+	make
--- a/misc/docker/debian-10-amd64/Dockerfile
+++ b/misc/docker/debian-10-amd64/Dockerfile
@ -0,0 +1,12 @@
+FROM debian:buster-slim
+ENV DEBIAN_FRONTEND noninteractive
+RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list
+RUN apt-get -y update
+RUN apt-get -y upgrade
+RUN apt-get -y install \
+	autoconf \
+	build-essential \
+	flex \
+	bison \
+	ncurses-dev \
+	libreadline-dev
--- a/misc/docker/debian-10-i386/Dockerfile
+++ b/misc/docker/debian-10-i386/Dockerfile
@ -0,0 +1,12 @@
+FROM i386/debian:stretch-slim
+ENV DEBIAN_FRONTEND noninteractive
+RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list
+RUN apt-get -y update
+RUN apt-get -y upgrade
+RUN apt-get -y install \
+	autoconf \
+	build-essential \
+	flex \
+	bison \
+	ncurses-dev \
+	libreadline-dev
--- a/misc/docker/debian-7-amd64/Dockerfile
+++ b/misc/docker/debian-7-amd64/Dockerfile
@ -1,7 +1,8 @@
 FROM debian:wheezy-slim
 ENV DEBIAN_FRONTEND noninteractive
-RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list
-RUN apt-get -y update
+RUN echo 'deb http://archive.debian.org/debian/ wheezy main' > /etc/apt/sources.list
+RUN echo 'deb http://archive.debian.org/debian-security/ wheezy/updates main' >> /etc/apt/sources.list
+RUN apt-get -y update -o Acquire::Check-Valid-Until=false
 RUN apt-get -y upgrade
 RUN apt-get -y install \
 	autoconf \
--- a/misc/docker/debian-7-i386/Dockerfile
+++ b/misc/docker/debian-7-i386/Dockerfile
@ -1,7 +1,8 @@
 FROM i386/debian:wheezy-slim
 ENV DEBIAN_FRONTEND noninteractive
-RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list
-RUN apt-get -y update
+RUN echo 'deb http://archive.debian.org/debian/ wheezy main' > /etc/apt/sources.list
+RUN echo 'deb http://archive.debian.org/debian-security/ wheezy/updates main' >> /etc/apt/sources.list
+RUN apt-get -y update -o Acquire::Check-Valid-Until=false
 RUN apt-get -y upgrade
 RUN apt-get -y install \
 	autoconf \
--- a/misc/docker/fedora-25-amd64/Dockerfile
+++ b/misc/docker/fedora-25-amd64/Dockerfile
@ -1,6 +1,7 @@
 FROM fedora:25
 RUN dnf -y upgrade
 RUN dnf -y install \
+	make \
 	autoconf \
 	flex \
 	bison \
--- a/misc/docker/fedora-26-amd64/Dockerfile
+++ b/misc/docker/fedora-26-amd64/Dockerfile
@ -1,6 +1,7 @@
 FROM fedora:26
 RUN dnf -y upgrade
 RUN dnf -y install \
+	make \
 	autoconf \
 	flex \
 	bison \
--- a/misc/docker/fedora-27-amd64/Dockerfile
+++ b/misc/docker/fedora-27-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM fedora:27
+RUN dnf -y upgrade
+RUN dnf -y install \
+	make \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	'readline-devel' \
+	'pkgconfig(ncurses)' \
+	gcc
--- a/misc/docker/fedora-28-amd64/Dockerfile
+++ b/misc/docker/fedora-28-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM fedora:28
+RUN dnf -y upgrade
+RUN dnf -y install \
+	make \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	'readline-devel' \
+	'pkgconfig(ncurses)' \
+	gcc
--- a/misc/docker/fedora-29-amd64/Dockerfile
+++ b/misc/docker/fedora-29-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM fedora:29
+RUN dnf -y upgrade
+RUN dnf -y install \
+	make \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	'readline-devel' \
+	'pkgconfig(ncurses)' \
+	gcc
--- a/misc/docker/fedora-30-amd64/Dockerfile
+++ b/misc/docker/fedora-30-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM fedora:30
+RUN dnf -y upgrade
+RUN dnf -y install \
+	make \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	'readline-devel' \
+	'pkgconfig(ncurses)' \
+	gcc
--- a/misc/docker/fedora-31-amd64/Dockerfile
+++ b/misc/docker/fedora-31-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM fedora:31
+RUN dnf -y upgrade
+RUN dnf -y install \
+	make \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	'readline-devel' \
+	'pkgconfig(ncurses)' \
+	gcc
--- a/misc/docker/opensuse-15.0-amd64/Dockerfile
+++ b/misc/docker/opensuse-15.0-amd64/Dockerfile
@ -1,4 +1,4 @@
-FROM opensuse:42.3
+FROM opensuse/leap:15.0
 RUN zypper -n up
 RUN zypper -n install \
 	autoconf \
--- a/misc/docker/opensuse-15.1-amd64/Dockerfile
+++ b/misc/docker/opensuse-15.1-amd64/Dockerfile
@ -0,0 +1,11 @@
+FROM opensuse/leap:15.1
+RUN zypper -n up
+RUN zypper -n install \
+	autoconf \
+	flex \
+	bison \
+	pkgconfig \
+	readline-devel \
+	ncurses-devel \
+	gcc \
+	gmake
--- a/misc/docker/ubuntu-18.04-amd64/Dockerfile
+++ b/misc/docker/ubuntu-18.04-amd64/Dockerfile
@ -0,0 +1,12 @@
+FROM ubuntu:18.04
+ENV DEBIAN_FRONTEND noninteractive
+RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list
+RUN apt-get -y update
+RUN apt-get -y upgrade
+RUN apt-get -y install \
+	autoconf \
+	build-essential \
+	flex \
+	bison \
+	ncurses-dev \
+	libreadline-dev
--- a/misc/docker/ubuntu-19.10-amd64/Dockerfile
+++ b/misc/docker/ubuntu-19.10-amd64/Dockerfile
@ -0,0 +1,12 @@
+FROM ubuntu:19.10
+ENV DEBIAN_FRONTEND noninteractive
+RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list
+RUN apt-get -y update
+RUN apt-get -y upgrade
+RUN apt-get -y install \
+	autoconf \
+	build-essential \
+	flex \
+	bison \
+	ncurses-dev \
+	libreadline-dev
--- a/Show More
+++ b/Show More