Merge branch 'ballygarvan' into HEAD

Replacing the old 3.0-alpha0 cork mechanism with another one inside the
routing table. This version should be simpler and also quite clear what
it does, why and when.

50 files changed, 1728 insertions, 1190 deletions

diff --git a/proto/babel/Makefile b/proto/babel/Makefile
index 06b58e95..ae6aeaf2 100644
--- a/proto/babel/Makefile
+++ b/proto/babel/Makefile
@@ -2,5 +2,6 @@ src := babel.c packets.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,babel_build)
 
 tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/babel/babel.c b/proto/babel/babel.c
index 03c85b7d..00b9aa79 100644
--- a/proto/babel/babel.c
+++ b/proto/babel/babel.c
@@ -37,6 +37,7 @@
 
 #include <stdlib.h>
 #include "babel.h"
+#include "lib/macro.h"
 
 #define LOG_PKT_AUTH(msg, args...) \
   log_rl(&p->log_pkt_tbf, L_AUTH "%s: " msg, p->p.name, args)
@@ -58,12 +59,14 @@ static void babel_update_cost(struct babel_neighbor *n);
 static inline void babel_kick_timer(struct babel_proto *p);
 static inline void babel_iface_kick_timer(struct babel_iface *ifa);
 
+static struct ea_class ea_babel_metric, ea_babel_router_id, ea_babel_seqno;
+
 /*
  *	Functions to maintain data structures
  */
 
 static void
-babel_init_entry(void *E)
+babel_init_entry(struct fib *f UNUSED, void *E)
 {
   struct babel_entry *e = E;
 
@@ -119,7 +122,7 @@ babel_get_source(struct babel_proto *p, struct babel_entry *e, u64 router_id)
 }
 
 static void
-babel_expire_sources(struct babel_proto *p, struct babel_entry *e)
+babel_expire_sources(struct babel_proto *p UNUSED, struct babel_entry *e)
 {
   struct babel_source *n, *nx;
   btime now_ = current_time();
@@ -129,7 +132,7 @@ babel_expire_sources(struct babel_proto *p, struct babel_entry *e)
     if (n->expires && n->expires <= now_)
     {
       rem_node(NODE n);
-      sl_free(p->source_slab, n);
+      sl_free(n);
     }
   }
 }
@@ -174,7 +177,7 @@ babel_retract_route(struct babel_proto *p, struct babel_route *r)
 }
 
 static void
-babel_flush_route(struct babel_proto *p, struct babel_route *r)
+babel_flush_route(struct babel_proto *p UNUSED, struct babel_route *r)
 {
   DBG("Babel: Flush route %N router_id %lR neigh %I\n",
       r->e->n.addr, r->router_id, r->neigh->addr);
@@ -185,7 +188,7 @@ babel_flush_route(struct babel_proto *p, struct babel_route *r)
   if (r->e->selected == r)
     r->e->selected = NULL;
 
-  sl_free(p->route_slab, r);
+  sl_free(r);
 }
 
 static void
@@ -312,7 +315,9 @@ babel_add_seqno_request(struct babel_proto *p, struct babel_entry *e,
 
       /* Found older */
       rem_node(NODE sr);
-      rem_node(&sr->nbr_node);
+
+      if (sr->nbr)
+        rem_node(&sr->nbr_node);
 
       goto found;
     }
@@ -336,13 +341,13 @@ found:
 }
 
 static void
-babel_remove_seqno_request(struct babel_proto *p, struct babel_seqno_request *sr)
+babel_remove_seqno_request(struct babel_proto *p UNUSED, struct babel_seqno_request *sr)
 {
   if (sr->nbr)
     rem_node(&sr->nbr_node);
 
   rem_node(NODE sr);
-  sl_free(p->seqno_slab, sr);
+  sl_free(sr);
 }
 
 static int
@@ -452,10 +457,7 @@ babel_flush_neighbor(struct babel_proto *p, struct babel_neighbor *nbr)
 
   struct babel_seqno_request *sr;
   WALK_LIST_FIRST2(sr, nbr_node, nbr->requests)
-  {
-    sr->nbr = NULL;
-    rem_node(&sr->nbr_node);
-  }
+    babel_remove_seqno_request(p, sr);
 
   nbr->ifa = NULL;
   rem_node(NODE nbr);
@@ -640,37 +642,14 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
 
   if (r)
   {
-    rta a0 = {
-      .source = RTS_BABEL,
-      .scope = SCOPE_UNIVERSE,
-      .dest = RTD_UNICAST,
-      .pref = c->preference,
-      .from = r->neigh->addr,
-      .nh.gw = r->next_hop,
-      .nh.iface = r->neigh->ifa->iface,
-      .eattrs = alloca(sizeof(ea_list) + 3*sizeof(eattr)),
-    };
-
-    *a0.eattrs = (ea_list) { .count = 3 };
-    a0.eattrs->attrs[0] = (eattr) {
-      .id = EA_BABEL_METRIC,
-      .type = EAF_TYPE_INT,
-      .u.data = r->metric,
-    };
-
-    struct adata *ad = alloca(sizeof(struct adata) + sizeof(u64));
-    ad->length = sizeof(u64);
-    memcpy(ad->data, &(r->router_id), sizeof(u64));
-    a0.eattrs->attrs[1] = (eattr) {
-      .id = EA_BABEL_ROUTER_ID,
-      .type = EAF_TYPE_OPAQUE,
-      .u.ptr = ad,
-    };
-
-    a0.eattrs->attrs[2] = (eattr) {
-      .id = EA_BABEL_SEQNO,
-      .type = EAF_TYPE_INT,
-      .u.data = r->seqno,
+    struct nexthop_adata nhad = {
+      .nh = {
+	.gw = r->next_hop,
+	.iface = r->neigh->ifa->iface,
+      },
+      .ad = {
+	.length = sizeof nhad - sizeof nhad.ad,
+      },
     };
 
     /*
@@ -679,10 +658,26 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
      * have routing work.
      */
     if (!neigh_find(&p->p, r->next_hop, r->neigh->ifa->iface, 0))
-      a0.nh.flags = RNF_ONLINK;
+      nhad.nh.flags = RNF_ONLINK;
+    
+    struct {
+      ea_list l;
+      eattr a[7];
+    } eattrs = {
+      .l.count = ARRAY_SIZE(eattrs.a),
+      .a = {
+	EA_LITERAL_EMBEDDED(&ea_gen_preference, 0, c->preference),
+	EA_LITERAL_STORE_ADATA(&ea_gen_from, 0, &r->neigh->addr, sizeof(r->neigh->addr)),
+	EA_LITERAL_EMBEDDED(&ea_gen_source, 0, RTS_BABEL),
+	EA_LITERAL_STORE_ADATA(&ea_gen_nexthop, 0, nhad.ad.data, nhad.ad.length),
+	EA_LITERAL_EMBEDDED(&ea_babel_metric, 0, r->metric),
+	EA_LITERAL_STORE_ADATA(&ea_babel_router_id, 0, &r->router_id, sizeof(r->router_id)),
+	EA_LITERAL_EMBEDDED(&ea_babel_seqno, 0, r->seqno),
+      }
+    };
 
     rte e0 = {
-      .attrs = &a0,
+      .attrs = &eattrs.l,
       .src = p->p.main_source,
     };
 
@@ -692,15 +687,14 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
   else if (e->valid && (e->router_id != p->router_id))
   {
     /* Unreachable */
-    rta a0 = {
-      .source = RTS_BABEL,
-      .scope = SCOPE_UNIVERSE,
-      .dest = RTD_UNREACHABLE,
-      .pref = 1,
-    };
+    ea_list *ea = NULL;
+
+    ea_set_attr_u32(&ea, &ea_gen_preference, 0, 1);
+    ea_set_attr_u32(&ea, &ea_gen_source, 0, RTS_BABEL);
+    ea_set_dest(&ea, 0, RTD_UNREACHABLE);
 
     rte e0 = {
-      .attrs = &a0,
+      .attrs = ea,
       .src = p->p.main_source,
     };
 
@@ -862,14 +856,14 @@ babel_send_ihus(struct babel_iface *ifa)
 }
 
 static void
-babel_send_hello(struct babel_iface *ifa)
+babel_send_hello(struct babel_iface *ifa, uint interval)
 {
   struct babel_proto *p = ifa->proto;
   union babel_msg msg = {};
 
   msg.type = BABEL_TLV_HELLO;
   msg.hello.seqno = ifa->hello_seqno++;
-  msg.hello.interval = ifa->cf->hello_interval;
+  msg.hello.interval = interval ?: ifa->cf->hello_interval;
 
   TRACE(D_PACKETS, "Sending hello on %s with seqno %d interval %t",
 	ifa->ifname, msg.hello.seqno, (btime) msg.hello.interval);
@@ -1577,7 +1571,7 @@ babel_iface_timer(timer *t)
 
   if (now_ >= ifa->next_hello)
   {
-    babel_send_hello(ifa);
+    babel_send_hello(ifa, 0);
     ifa->next_hello += hello_period * (1 + (now_ - ifa->next_hello) / hello_period);
   }
 
@@ -1624,7 +1618,7 @@ babel_iface_start(struct babel_iface *ifa)
   tm_start(ifa->timer, 100 MS);
   ifa->up = 1;
 
-  babel_send_hello(ifa);
+  babel_send_hello(ifa, 0);
   babel_send_wildcard_retraction(ifa);
   babel_send_wildcard_request(ifa);
   babel_send_update(ifa, 0);	/* Full update */
@@ -1919,7 +1913,7 @@ babel_reconfigure_ifaces(struct babel_proto *p, struct babel_config *cf)
     struct babel_iface *ifa = babel_find_iface(p, iface);
     struct babel_iface_config *ic = (void *) iface_patt_find(&cf->iface_list, iface, NULL);
 
-    if (ic && iface_is_valid(p, iface))
+    if (ic && !iface_is_valid(p, iface))
       ic = NULL;
 
     if (ifa && ic)
@@ -2031,38 +2025,41 @@ static void
 babel_get_route_info(rte *rte, byte *buf)
 {
   u64 rid = 0;
-  eattr *e = ea_find(rte->attrs->eattrs, EA_BABEL_ROUTER_ID);
+  eattr *e = ea_find(rte->attrs, &ea_babel_router_id);
   if (e)
     memcpy(&rid, e->u.ptr->data, sizeof(u64));
 
-  buf += bsprintf(buf, " (%d/%d) [%lR]", rte->attrs->pref,
-      ea_get_int(rte->attrs->eattrs, EA_BABEL_METRIC, BABEL_INFINITY), rid);
+  buf += bsprintf(buf, " (%d/%d) [%lR]",
+      rt_get_preference(rte),
+      ea_get_int(rte->attrs, &ea_babel_metric, BABEL_INFINITY), rid);
 }
 
-static int
-babel_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
+static void
+babel_router_id_format(const eattr *a, byte *buf, uint len)
 {
-  switch (a->id)
-  {
-  case EA_BABEL_SEQNO:
-    return GA_FULL;
+  u64 rid = 0;
+  memcpy(&rid, a->u.ptr->data, sizeof(u64));
+  bsnprintf(buf, len, "%lR", rid);
+}
 
-  case EA_BABEL_METRIC:
-    bsprintf(buf, "metric: %d", a->u.data);
-    return GA_FULL;
+static struct ea_class ea_babel_metric = {
+  .name = "babel_metric",
+  .type = T_INT,
+};
 
-  case EA_BABEL_ROUTER_ID:
-  {
-    u64 rid = 0;
-    memcpy(&rid, a->u.ptr->data, sizeof(u64));
-    bsprintf(buf, "router_id: %lR", rid);
-    return GA_FULL;
-  }
+static struct ea_class ea_babel_router_id = {
+  .name = "babel_router_id",
+  .type = T_OPAQUE,
+  .readonly = 1,
+  .format = babel_router_id_format,
+};
+
+static struct ea_class ea_babel_seqno = {
+  .name = "babel_seqno",
+  .type = T_INT,
+  .readonly = 1,
+};
 
-  default:
-    return GA_UNKNOWN;
-  }
-}
 
 void
 babel_show_interfaces(struct proto *P, const char *iff)
@@ -2260,11 +2257,15 @@ babel_kick_timer(struct babel_proto *p)
 
 
 static int
-babel_preexport(struct channel *c, struct rte *new)
+babel_preexport(struct channel *C, struct rte *new)
 {
-  struct rta *a = new->attrs;
+  if (new->src->proto != C->proto)
+    return 0;
+
   /* Reject our own unreachable routes */
-  if ((a->dest == RTD_UNREACHABLE) && (new->src->proto == c->proto))
+  eattr *ea = ea_find(new->attrs, &ea_gen_nexthop);
+  struct nexthop_adata *nhad = (void *) ea->u.ptr;
+  if (!NEXTHOP_IS_REACHABLE(nhad))
     return -1;
 
   return 0;
@@ -2285,13 +2286,13 @@ babel_rt_notify(struct proto *P, struct channel *c UNUSED, const net_addr *net,
   {
     /* Update */
     uint rt_seqno;
-    uint rt_metric = ea_get_int(new->attrs->eattrs, EA_BABEL_METRIC, 0);
+    uint rt_metric = ea_get_int(new->attrs, &ea_babel_metric, 0);
     u64 rt_router_id = 0;
 
     if (new->src->proto == P)
     {
-      rt_seqno = ea_find(new->attrs->eattrs, EA_BABEL_SEQNO)->u.data;
-      eattr *e = ea_find(new->attrs->eattrs, EA_BABEL_ROUTER_ID);
+      rt_seqno = ea_get_int(new->attrs, &ea_babel_seqno, 0);
+      eattr *e = ea_find(new->attrs, &ea_babel_router_id);
       if (e)
 	memcpy(&rt_router_id, e->u.ptr->data, sizeof(u64));
     }
@@ -2342,16 +2343,16 @@ babel_rt_notify(struct proto *P, struct channel *c UNUSED, const net_addr *net,
 static int
 babel_rte_better(struct rte *new, struct rte *old)
 {
-  uint new_metric = ea_find(new->attrs->eattrs, EA_BABEL_SEQNO)->u.data;
-  uint old_metric = ea_find(old->attrs->eattrs, EA_BABEL_SEQNO)->u.data;
+  uint new_metric = ea_get_int(new->attrs, &ea_babel_metric, BABEL_INFINITY);
+  uint old_metric = ea_get_int(old->attrs, &ea_babel_metric, BABEL_INFINITY);
 
   return new_metric < old_metric;
 }
 
 static u32
-babel_rte_igp_metric(struct rte *rt)
+babel_rte_igp_metric(const rte *rt)
 {
-  return ea_get_int(rt->attrs->eattrs, EA_BABEL_METRIC, BABEL_INFINITY);
+  return ea_get_int(rt->attrs, &ea_babel_metric, BABEL_INFINITY);
 }
 
 
@@ -2435,6 +2436,11 @@ babel_iface_shutdown(struct babel_iface *ifa)
 {
   if (ifa->sk)
   {
+    /*
+     * Retract all our routes and lower the hello interval so peers' neighbour
+     * state expires quickly
+     */
+    babel_send_hello(ifa, BABEL_MIN_INTERVAL);
     babel_send_wildcard_retraction(ifa);
     babel_send_queue(ifa);
   }
@@ -2479,11 +2485,9 @@ babel_reconfigure(struct proto *P, struct proto_config *CF)
   return 1;
 }
 
-
 struct protocol proto_babel = {
   .name =		"Babel",
   .template =		"babel%d",
-  .class =		PROTOCOL_BABEL,
   .preference =		DEF_PREF_BABEL,
   .channel_mask =	NB_IP | NB_IP6_SADR,
   .proto_size =		sizeof(struct babel_proto),
@@ -2495,5 +2499,16 @@ struct protocol proto_babel = {
   .shutdown =		babel_shutdown,
   .reconfigure =	babel_reconfigure,
   .get_route_info =	babel_get_route_info,
-  .get_attr =		babel_get_attr
 };
+
+void
+babel_build(void)
+{
+  proto_build(&proto_babel);
+
+  EA_REGISTER_ALL(
+      &ea_babel_metric,
+      &ea_babel_router_id,
+      &ea_babel_seqno
+      );
+}
diff --git a/proto/babel/babel.h b/proto/babel/babel.h
index 8b6da3c8..a980d1da 100644
--- a/proto/babel/babel.h
+++ b/proto/babel/babel.h
@@ -16,7 +16,7 @@
 #include "nest/bird.h"
 #include "nest/cli.h"
 #include "nest/iface.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/protocol.h"
 #include "nest/locks.h"
 #include "nest/password.h"
@@ -26,10 +26,6 @@
 #include "lib/string.h"
 #include "lib/timer.h"
 
-#define EA_BABEL_METRIC		EA_CODE(PROTOCOL_BABEL, 0)
-#define EA_BABEL_ROUTER_ID	EA_CODE(PROTOCOL_BABEL, 1)
-#define EA_BABEL_SEQNO		EA_CODE(PROTOCOL_BABEL, 2)
-
 #define BABEL_MAGIC		42
 #define BABEL_VERSION		2
 #define BABEL_PORT		6696
diff --git a/proto/babel/config.Y b/proto/babel/config.Y
index 05210fa4..a4350eed 100644
--- a/proto/babel/config.Y
+++ b/proto/babel/config.Y
@@ -24,7 +24,7 @@ CF_DECLS
 
 CF_KEYWORDS(BABEL, INTERFACE, METRIC, RXCOST, HELLO, UPDATE, INTERVAL, PORT,
 	TYPE, WIRED, WIRELESS, RX, TX, BUFFER, PRIORITY, LENGTH, CHECK, LINK,
-	NEXT, HOP, IPV4, IPV6, BABEL_METRIC, SHOW, INTERFACES, NEIGHBORS,
+	NEXT, HOP, IPV4, IPV6, SHOW, INTERFACES, NEIGHBORS,
 	ENTRIES, RANDOMIZE, ROUTER, ID, AUTHENTICATION, NONE, MAC, PERMISSIVE)
 
 CF_GRAMMAR
@@ -163,8 +163,6 @@ babel_iface_opt_list:
 babel_iface:
   babel_iface_start iface_patt_list_nopx babel_iface_opt_list babel_iface_finish;
 
-dynamic_attr: BABEL_METRIC { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_BABEL_METRIC); } ;
-
 CF_CLI_HELP(SHOW BABEL, ..., [[Show information about Babel protocol]]);
 
 CF_CLI(SHOW BABEL INTERFACES, optproto opttext, [<name>] [\"<interface>\"], [[Show information about Babel interfaces]])
diff --git a/proto/babel/packets.c b/proto/babel/packets.c
index f13410e2..d4acc170 100644
--- a/proto/babel/packets.c
+++ b/proto/babel/packets.c
@@ -1318,7 +1318,6 @@ babel_send_to(struct babel_iface *ifa, ip_addr dest)
 static uint
 babel_write_queue(struct babel_iface *ifa, list *queue)
 {
-  struct babel_proto *p = ifa->proto;
   struct babel_write_state state = { .next_hop_ip6 = ifa->addr };
 
   if (EMPTY_LIST(*queue))
@@ -1346,7 +1345,7 @@ babel_write_queue(struct babel_iface *ifa, list *queue)
 
     pos += len;
     rem_node(NODE msg);
-    sl_free(p->msg_slab, msg);
+    sl_free(msg);
   }
 
   pos += babel_auth_add_tlvs(ifa, (struct babel_tlv *) pos, end - pos);
@@ -1507,13 +1506,13 @@ babel_process_packet(struct babel_iface *ifa,
     else if (res == PARSE_IGNORE)
     {
       DBG("Babel: Ignoring TLV of type %d\n", tlv->type);
-      sl_free(p->msg_slab, msg);
+      sl_free(msg);
     }
     else /* PARSE_ERROR */
     {
       LOG_PKT("Bad TLV from %I via %s type %d pos %d - parse error",
 	      saddr, ifa->iface->name, tlv->type, (int) ((byte *)tlv - (byte *)pkt));
-      sl_free(p->msg_slab, msg);
+      sl_free(msg);
       break;
     }
   }
@@ -1525,7 +1524,7 @@ babel_process_packet(struct babel_iface *ifa,
     if (tlv_data[msg->msg.type].handle_tlv)
       tlv_data[msg->msg.type].handle_tlv(&msg->msg, ifa);
     rem_node(NODE msg);
-    sl_free(p->msg_slab, msg);
+    sl_free(msg);
   }
 }
 
@@ -2011,7 +2010,7 @@ babel_auth_sign(struct babel_iface *ifa, ip_addr dest)
   }
 
   DBG("Added MAC signatures (%d bytes) on ifa %s for dest %I\n",
-      tot_len, ifa->ifname, dest);
+      pos - (pkt + len), ifa->ifname, dest);
 
   return pos - (pkt + len);
 }
diff --git a/proto/bfd/Makefile b/proto/bfd/Makefile
index 267dff98..11d639d7 100644
--- a/proto/bfd/Makefile
+++ b/proto/bfd/Makefile
@@ -2,5 +2,6 @@ src := bfd.c packets.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,bfd_build)
 
 tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/bfd/bfd.c b/proto/bfd/bfd.c
index 3964c267..e7d27f74 100644
--- a/proto/bfd/bfd.c
+++ b/proto/bfd/bfd.c
@@ -512,7 +512,7 @@ bfd_remove_session_locked(struct bfd_proto *p, struct bfd_session *s)
 
   TRACE(D_EVENTS, "Session to %I removed", s->addr);
 
-  sl_free(p->session_slab, s);
+  sl_free(s);
 }
 
 static void
@@ -590,6 +590,9 @@ bfd_get_iface(struct bfd_proto *p, ip_addr local, struct iface *iface)
   ifa->sk = bfd_open_tx_sk(p, local, iface);
   ifa->uc = 1;
 
+  if (cf->strict_bind)
+    ifa->rx = bfd_open_rx_sk_bound(p, local, iface);
+
   add_tail(&p->iface_list, &ifa->n);
 
   return ifa;
@@ -607,6 +610,12 @@ bfd_free_iface(struct bfd_iface *ifa)
     rfree(ifa->sk);
   }
 
+  if (ifa->rx)
+  {
+    sk_stop(ifa->rx);
+    rfree(ifa->rx);
+  }
+
   rem_node(&ifa->n);
   mb_free(ifa);
 }
@@ -1035,15 +1044,6 @@ bfd_notify_init(struct bfd_proto *p)
  *	BFD protocol glue
  */
 
-void
-bfd_init_all(void)
-{
-  bfd_global.lock = DOMAIN_NEW(rtable, "BFD Global");
-  init_list(&bfd_global.wait_list);
-  init_list(&bfd_global.pickup_list);
-  init_list(&bfd_global.proto_list);
-}
-
 static struct proto *
 bfd_init(struct proto_config *c)
 {
@@ -1075,17 +1075,20 @@ bfd_start(struct proto *P)
 
   add_tail(&bfd_global.proto_list, &p->bfd_node);
 
-  if (cf->accept_ipv4 && cf->accept_direct)
-    p->rx4_1 = bfd_open_rx_sk(p, 0, SK_IPV4);
+  if (!cf->strict_bind)
+  {
+    if (cf->accept_ipv4 && cf->accept_direct)
+      p->rx4_1 = bfd_open_rx_sk(p, 0, SK_IPV4);
 
-  if (cf->accept_ipv4 && cf->accept_multihop)
-    p->rx4_m = bfd_open_rx_sk(p, 1, SK_IPV4);
+    if (cf->accept_ipv4 && cf->accept_multihop)
+      p->rx4_m = bfd_open_rx_sk(p, 1, SK_IPV4);
 
-  if (cf->accept_ipv6 && cf->accept_direct)
-    p->rx6_1 = bfd_open_rx_sk(p, 0, SK_IPV6);
+    if (cf->accept_ipv6 && cf->accept_direct)
+      p->rx6_1 = bfd_open_rx_sk(p, 0, SK_IPV6);
 
-  if (cf->accept_ipv6 && cf->accept_multihop)
-    p->rx6_m = bfd_open_rx_sk(p, 1, SK_IPV6);
+    if (cf->accept_ipv6 && cf->accept_multihop)
+      p->rx6_m = bfd_open_rx_sk(p, 1, SK_IPV6);
+  }
 
   bfd_take_requests(p);
 
@@ -1130,7 +1133,8 @@ bfd_reconfigure(struct proto *P, struct proto_config *c)
   if ((new->accept_ipv4 != old->accept_ipv4) ||
       (new->accept_ipv6 != old->accept_ipv6) ||
       (new->accept_direct != old->accept_direct) ||
-      (new->accept_multihop != old->accept_multihop))
+      (new->accept_multihop != old->accept_multihop) ||
+      (new->strict_bind != old->strict_bind))
     return 0;
 
   birdloop_mask_wakeups(p->p.loop);
@@ -1205,7 +1209,6 @@ bfd_show_sessions(struct proto *P)
 struct protocol proto_bfd = {
   .name =		"BFD",
   .template =		"bfd%d",
-  .class =		PROTOCOL_BFD,
   .proto_size =		sizeof(struct bfd_proto),
   .config_size =	sizeof(struct bfd_config),
   .init =		bfd_init,
@@ -1214,3 +1217,14 @@ struct protocol proto_bfd = {
   .reconfigure =	bfd_reconfigure,
   .copy_config =	bfd_copy_config,
 };
+
+void
+bfd_build(void)
+{
+  proto_build(&proto_bfd);
+
+  bfd_global.lock = DOMAIN_NEW(rtable, "BFD Global");
+  init_list(&bfd_global.wait_list);
+  init_list(&bfd_global.pickup_list);
+  init_list(&bfd_global.proto_list);
+}
diff --git a/proto/bfd/bfd.h b/proto/bfd/bfd.h
index 8430064b..b9afaf92 100644
--- a/proto/bfd/bfd.h
+++ b/proto/bfd/bfd.h
@@ -13,7 +13,7 @@
 #include "nest/cli.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/password.h"
 #include "conf/conf.h"
 #include "lib/hash.h"
@@ -47,6 +47,7 @@ struct bfd_config
   u8 accept_ipv6;
   u8 accept_direct;
   u8 accept_multihop;
+  u8 strict_bind;
 };
 
 struct bfd_iface_config
@@ -118,6 +119,7 @@ struct bfd_iface
   struct bfd_proto *bfd;
 
   sock *sk;
+  sock *rx;
   u32 uc;
   u8 changed;
 };
@@ -223,6 +225,7 @@ void bfd_show_sessions(struct proto *P);
 /* packets.c */
 void bfd_send_ctl(struct bfd_proto *p, struct bfd_session *s, int final);
 sock * bfd_open_rx_sk(struct bfd_proto *p, int multihop, int inet_version);
+sock * bfd_open_rx_sk_bound(struct bfd_proto *p, ip_addr local, struct iface *ifa);
 sock * bfd_open_tx_sk(struct bfd_proto *p, ip_addr local, struct iface *ifa);
 
 
diff --git a/proto/bfd/config.Y b/proto/bfd/config.Y
index ed5479fb..0d6e33fa 100644
--- a/proto/bfd/config.Y
+++ b/proto/bfd/config.Y
@@ -23,7 +23,8 @@ CF_DECLS
 
 CF_KEYWORDS(BFD, MIN, IDLE, RX, TX, INTERVAL, MULTIPLIER, PASSIVE,
 	INTERFACE, MULTIHOP, NEIGHBOR, DEV, LOCAL, AUTHENTICATION,
-	NONE, SIMPLE, METICULOUS, KEYED, MD5, SHA1, IPV4, IPV6, DIRECT)
+	NONE, SIMPLE, METICULOUS, KEYED, MD5, SHA1, IPV4, IPV6, DIRECT,
+	STRICT, BIND)
 
 %type <iface> bfd_neigh_iface
 %type <a> bfd_neigh_local
@@ -49,6 +50,7 @@ bfd_proto_item:
  | INTERFACE bfd_iface
  | MULTIHOP bfd_multihop
  | NEIGHBOR bfd_neighbor
+ | STRICT BIND bool { BFD_CFG->strict_bind = $3; }
  ;
 
 bfd_proto_opts:
diff --git a/proto/bfd/packets.c b/proto/bfd/packets.c
index 37d77f37..6f0b4eaf 100644
--- a/proto/bfd/packets.c
+++ b/proto/bfd/packets.c
@@ -366,7 +366,9 @@ bfd_rx_hook(sock *sk, uint len)
     if (ps > BFD_STATE_DOWN)
       DROP("invalid init state", ps);
 
-    uint ifindex = (sk->sport == BFD_CONTROL_PORT) ? sk->lifindex : 0;
+    uint ifindex = (sk->sport == BFD_CONTROL_PORT) ?
+      (sk->iface ? sk->iface->index : sk->lifindex) :
+      0;
     s = bfd_find_session_by_addr(p, sk->faddr, ifindex);
 
     /* FIXME: better session matching and message */
@@ -439,6 +441,38 @@ bfd_open_rx_sk(struct bfd_proto *p, int multihop, int af)
 }
 
 sock *
+bfd_open_rx_sk_bound(struct bfd_proto *p, ip_addr local, struct iface *ifa)
+{
+  sock *sk = sk_new(p->tpool);
+  sk->type = SK_UDP;
+  sk->saddr = local;
+  sk->sport = ifa ? BFD_CONTROL_PORT : BFD_MULTI_CTL_PORT;
+  sk->iface = ifa;
+  sk->vrf = p->p.vrf;
+  sk->data = p;
+
+  sk->rbsize = BFD_MAX_LEN;
+  sk->rx_hook = bfd_rx_hook;
+  sk->err_hook = bfd_err_hook;
+
+  /* TODO: configurable ToS and priority */
+  sk->tos = IP_PREC_INTERNET_CONTROL;
+  sk->priority = sk_priority_control;
+  sk->flags = SKF_THREAD | SKF_BIND | (ifa ? SKF_TTL_RX : 0);
+
+  if (sk_open(sk) < 0)
+    goto err;
+
+  sk_start(sk);
+  return sk;
+
+ err:
+  sk_log_error(sk, p->p.name);
+  rfree(sk);
+  return NULL;
+}
+
+sock *
 bfd_open_tx_sk(struct bfd_proto *p, ip_addr local, struct iface *ifa)
 {
   sock *sk = sk_new(p->p.pool);
diff --git a/proto/bgp/Makefile b/proto/bgp/Makefile
index 00aaef5e..2a4cc99c 100644
--- a/proto/bgp/Makefile
+++ b/proto/bgp/Makefile
@@ -2,5 +2,6 @@ src := attrs.c bgp.c packets.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,bgp_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c
index 892b26e3..a7b1a7ed 100644
--- a/proto/bgp/attrs.c
+++ b/proto/bgp/attrs.c
@@ -15,12 +15,13 @@
 #include "nest/bird.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
-#include "nest/attrs.h"
+#include "nest/rt.h"
+#include "lib/attrs.h"
 #include "conf/conf.h"
 #include "lib/resource.h"
 #include "lib/string.h"
 #include "lib/unaligned.h"
+#include "lib/macro.h"
 
 #include "bgp.h"
 
@@ -45,9 +46,9 @@
  *
  * export - Hook that validates and normalizes attribute during export phase.
  * Receives eattr, may modify it (e.g., sort community lists for canonical
- * representation), UNSET() it (e.g., skip empty lists), or WITHDRAW() it if
- * necessary. May assume that eattr has value valid w.r.t. its type, but may be
- * invalid w.r.t. BGP constraints. Optional.
+ * representation), UNSET() it (e.g., skip empty lists), or REJECT() the route
+ * if necessary. May assume that eattr has value valid w.r.t. its type, but may
+ * be invalid w.r.t. BGP constraints. Optional.
  *
  * encode - Hook that converts internal representation to external one during
  * packet writing. Receives eattr and puts it in the buffer (including attribute
@@ -64,37 +65,72 @@
  * format - Optional hook that converts eattr to textual representation.
  */
 
-
-struct bgp_attr_desc {
-  const char *name;
-  uint type;
-  uint flags;
-  void (*export)(struct bgp_export_state *s, eattr *a);
-  int  (*encode)(struct bgp_write_state *s, eattr *a, byte *buf, uint size);
-  void (*decode)(struct bgp_parse_state *s, uint code, uint flags, byte *data, uint len, ea_list **to);
-  void (*format)(const eattr *ea, byte *buf, uint size);
+union bgp_attr_desc {
+  struct ea_class class;
+  struct {
+    EA_CLASS_INSIDE;
+    uint flags;
+    void (*export)(struct bgp_export_state *s, eattr *a);
+    int  (*encode)(struct bgp_write_state *s, eattr *a, byte *buf, uint size);
+    void (*decode)(struct bgp_parse_state *s, uint code, uint flags, byte *data, uint len, ea_list **to);
+  };
 };
 
-static const struct bgp_attr_desc bgp_attr_table[];
+static union bgp_attr_desc bgp_attr_table[];
+static inline const union bgp_attr_desc *bgp_find_attr_desc(eattr *a)
+{
+  const struct ea_class *class = ea_class_find(a->id);
 
-static inline int bgp_attr_known(uint code);
+  if ((class < &bgp_attr_table[0].class) || (class >= &bgp_attr_table[BGP_ATTR_MAX].class))
+    return NULL;
 
-eattr *
-bgp_set_attr(ea_list **attrs, struct linpool *pool, uint code, uint flags, uintptr_t val)
+  return (const union bgp_attr_desc *) class;
+}
+
+#define BGP_EA_ID(code)	(bgp_attr_table[code].id)
+#define EA_BGP_ID(code)	(((union bgp_attr_desc *) ea_class_find(code)) - bgp_attr_table)
+
+void bgp_set_attr_u32(ea_list **to, uint code, uint flags, u32 val)
 {
-  ASSERT(bgp_attr_known(code));
+  const union bgp_attr_desc *desc = &bgp_attr_table[code];
 
-  return ea_set_attr(
-      attrs,
-      pool,
-      EA_CODE(PROTOCOL_BGP, code),
-      flags & ~BAF_EXT_LEN,
-      bgp_attr_table[code].type,
-      val
-  );
+  ea_set_attr(to, EA_LITERAL_EMBEDDED(
+	&desc->class,
+	flags & ~BAF_EXT_LEN,
+	val
+	));
 }
 
+void bgp_set_attr_ptr(ea_list **to, uint code, uint flags, const struct adata *ad)
+{
+  const union bgp_attr_desc *desc = &bgp_attr_table[code];
+
+  ea_set_attr(to, EA_LITERAL_DIRECT_ADATA(
+	&desc->class,
+	flags & ~BAF_EXT_LEN,
+	ad
+	));
+}
+
+void
+bgp_set_attr_data(ea_list **to, uint code, uint flags, void *data, uint len)
+{
+  const union bgp_attr_desc *desc = &bgp_attr_table[code];
+
+  ea_set_attr(to, EA_LITERAL_STORE_ADATA(
+	&desc->class,
+	flags & ~BAF_EXT_LEN,
+	data,
+	len
+	));
+}
 
+void
+bgp_unset_attr(ea_list **to, uint code)
+{
+  const union bgp_attr_desc *desc = &bgp_attr_table[code];
+  ea_unset_attr(to, 0, &desc->class);
+}
 
 #define REPORT(msg, args...) \
   ({ log(L_REMOTE "%s: " msg, s->proto->p.name, ## args); })
@@ -106,7 +142,10 @@ bgp_set_attr(ea_list **attrs, struct linpool *pool, uint code, uint flags, uintp
   ({ REPORT(msg, ## args); s->err_withdraw = 1; return; })
 
 #define UNSET(a) \
-  ({ a->type = EAF_TYPE_UNDEF; return; })
+  ({ a->undef = 1; return; })
+
+#define REJECT(msg, args...) \
+  ({ log(L_ERR "%s: " msg, s->proto->p.name, ## args); s->err_reject = 1; return; })
 
 #define NEW_BGP		"Discarding %s attribute received from AS4-aware neighbor"
 #define BAD_EBGP	"Discarding %s attribute received from EBGP neighbor"
@@ -148,7 +187,7 @@ bgp_encode_u8(struct bgp_write_state *s UNUSED, eattr *a, byte *buf, uint size)
   if (size < (3+1))
     return -1;
 
-  bgp_put_attr_hdr3(buf, EA_ID(a->id), a->flags, 1);
+  bgp_put_attr_hdr3(buf, EA_BGP_ID(a->id), a->flags, 1);
   buf[3] = a->u.data;
 
   return 3+1;
@@ -160,7 +199,7 @@ bgp_encode_u32(struct bgp_write_state *s UNUSED, eattr *a, byte *buf, uint size)
   if (size < (3+4))
     return -1;
 
-  bgp_put_attr_hdr3(buf, EA_ID(a->id), a->flags, 4);
+  bgp_put_attr_hdr3(buf, EA_BGP_ID(a->id), a->flags, 4);
   put_u32(buf+3, a->u.data);
 
   return 3+4;
@@ -174,7 +213,7 @@ bgp_encode_u32s(struct bgp_write_state *s UNUSED, eattr *a, byte *buf, uint size
   if (size < (4+len))
     return -1;
 
-  uint hdr = bgp_put_attr_hdr(buf, EA_ID(a->id), a->flags, len);
+  uint hdr = bgp_put_attr_hdr(buf, EA_BGP_ID(a->id), a->flags, len);
   put_u32s(buf + hdr, (u32 *) a->u.ptr->data, len / 4);
 
   return hdr + len;
@@ -195,7 +234,7 @@ bgp_put_attr(byte *buf, uint size, uint code, uint flags, const byte *data, uint
 static int
 bgp_encode_raw(struct bgp_write_state *s UNUSED, eattr *a, byte *buf, uint size)
 {
-  return bgp_put_attr(buf, size, EA_ID(a->id), a->flags, a->u.ptr->data, a->u.ptr->length);
+  return bgp_put_attr(buf, size, EA_BGP_ID(a->id), a->flags, a->u.ptr->data, a->u.ptr->length);
 }
 
 
@@ -333,26 +372,26 @@ bgp_aigp_set_metric(struct linpool *pool, const struct adata *ad, u64 metric)
 }
 
 int
-bgp_total_aigp_metric_(struct rta *a, u64 *metric, const struct adata **ad)
+bgp_total_aigp_metric_(const rte *e, u64 *metric, const struct adata **ad)
 {
-  eattr *ea = ea_find(a->eattrs, EA_CODE(PROTOCOL_BGP, BA_AIGP));
-  if (!ea)
+  eattr *a = ea_find(e->attrs, BGP_EA_ID(BA_AIGP));
+  if (!a)
     return 0;
 
-  const byte *b = bgp_aigp_get_tlv(ea->u.ptr, BGP_AIGP_METRIC);
+  const byte *b = bgp_aigp_get_tlv(a->u.ptr, BGP_AIGP_METRIC);
   if (!b)
     return 0;
 
   u64 aigp = get_u64(b + 3);
-  u64 step = a->igp_metric;
+  u64 step = rt_get_igp_metric(e);
 
-  if (!rta_resolvable(a) || (step >= IGP_METRIC_UNKNOWN))
+  if (!rte_resolvable(e) || (step >= IGP_METRIC_UNKNOWN))
     step = BGP_AIGP_MAX;
 
   if (!step)
     step = 1;
 
-  *ad = ea->u.ptr;
+  *ad = a->u.ptr;
   *metric = aigp + step;
   if (*metric < aigp)
     *metric = BGP_AIGP_MAX;
@@ -363,7 +402,7 @@ bgp_total_aigp_metric_(struct rta *a, u64 *metric, const struct adata **ad)
 static inline int
 bgp_init_aigp_metric(rte *e, u64 *metric, const struct adata **ad)
 {
-  if (e->attrs->source == RTS_BGP)
+  if (rt_get_source_attr(e) == RTS_BGP)
     return 0;
 
   *metric = rt_get_igp_metric(e);
@@ -372,9 +411,9 @@ bgp_init_aigp_metric(rte *e, u64 *metric, const struct adata **ad)
 }
 
 u32
-bgp_rte_igp_metric(struct rte *rt)
+bgp_rte_igp_metric(const rte *rt)
 {
-  u64 metric = bgp_total_aigp_metric(rt->attrs);
+  u64 metric = bgp_total_aigp_metric(rt);
   return (u32) MIN(metric, (u64) IGP_METRIC_UNKNOWN);
 }
 
@@ -387,7 +426,7 @@ static void
 bgp_export_origin(struct bgp_export_state *s, eattr *a)
 {
   if (a->u.data > 2)
-    WITHDRAW(BAD_VALUE, "ORIGIN", a->u.data);
+    REJECT(BAD_VALUE, "ORIGIN", a->u.data);
 }
 
 static void
@@ -399,7 +438,7 @@ bgp_decode_origin(struct bgp_parse_state *s, uint code UNUSED, uint flags, byte
   if (data[0] > 2)
     WITHDRAW(BAD_VALUE, "ORIGIN", data[0]);
 
-  bgp_set_attr_u32(to, s->pool, BA_ORIGIN, flags, data[0]);
+  bgp_set_attr_u32(to, BA_ORIGIN, flags, data[0]);
 }
 
 static void
@@ -467,7 +506,7 @@ bgp_decode_as_path(struct bgp_parse_state *s, uint code UNUSED, uint flags, byte
       !bgp_as_path_first_as_equal(data, len, p->remote_as))
     WITHDRAW("Malformed AS_PATH attribute - %s", "First AS differs from neigbor AS");
 
-  bgp_set_attr_data(to, s->pool, BA_AS_PATH, flags, data, len);
+  bgp_set_attr_data(to, BA_AS_PATH, flags, data, len);
 }
 
 
@@ -539,7 +578,7 @@ bgp_decode_med(struct bgp_parse_state *s, uint code UNUSED, uint flags, byte *da
     WITHDRAW(BAD_LENGTH, "MULTI_EXIT_DISC", len);
 
   u32 val = get_u32(data);
-  bgp_set_attr_u32(to, s->pool, BA_MULTI_EXIT_DISC, flags, val);
+  bgp_set_attr_u32(to, BA_MULTI_EXIT_DISC, flags, val);
 }
 
 
@@ -560,7 +599,7 @@ bgp_decode_local_pref(struct bgp_parse_state *s, uint code UNUSED, uint flags, b
     WITHDRAW(BAD_LENGTH, "LOCAL_PREF", len);
 
   u32 val = get_u32(data);
-  bgp_set_attr_u32(to, s->pool, BA_LOCAL_PREF, flags, val);
+  bgp_set_attr_u32(to, BA_LOCAL_PREF, flags, val);
 }
 
 
@@ -570,7 +609,7 @@ bgp_decode_atomic_aggr(struct bgp_parse_state *s, uint code UNUSED, uint flags,
   if (len != 0)
     DISCARD(BAD_LENGTH, "ATOMIC_AGGR", len);
 
-  bgp_set_attr_data(to, s->pool, BA_ATOMIC_AGGR, flags, NULL, 0);
+  bgp_set_attr_data(to, BA_ATOMIC_AGGR, flags, NULL, 0);
 }
 
 static int
@@ -604,7 +643,7 @@ bgp_decode_aggregator(struct bgp_parse_state *s, uint code UNUSED, uint flags, b
     len = aggregator_16to32(data, src);
   }
 
-  bgp_set_attr_data(to, s->pool, BA_AGGREGATOR, flags, data, len);
+  bgp_set_attr_data(to, BA_AGGREGATOR, flags, data, len);
 }
 
 static void
@@ -633,7 +672,7 @@ bgp_decode_community(struct bgp_parse_state *s, uint code UNUSED, uint flags, by
 
   struct adata *ad = lp_alloc_adata(s->pool, len);
   get_u32s(data, (u32 *) ad->data, len / 4);
-  bgp_set_attr_ptr(to, s->pool, BA_COMMUNITY, flags, ad);
+  bgp_set_attr_ptr(to, BA_COMMUNITY, flags, ad);
 }
 
 
@@ -654,7 +693,7 @@ bgp_decode_originator_id(struct bgp_parse_state *s, uint code UNUSED, uint flags
     WITHDRAW(BAD_LENGTH, "ORIGINATOR_ID", len);
 
   u32 val = get_u32(data);
-  bgp_set_attr_u32(to, s->pool, BA_ORIGINATOR_ID, flags, val);
+  bgp_set_attr_u32(to, BA_ORIGINATOR_ID, flags, val);
 }
 
 
@@ -679,7 +718,7 @@ bgp_decode_cluster_list(struct bgp_parse_state *s, uint code UNUSED, uint flags,
 
   struct adata *ad = lp_alloc_adata(s->pool, len);
   get_u32s(data, (u32 *) ad->data, len / 4);
-  bgp_set_attr_ptr(to, s->pool, BA_CLUSTER_LIST, flags, ad);
+  bgp_set_attr_ptr(to, BA_CLUSTER_LIST, flags, ad);
 }
 
 static void
@@ -798,7 +837,7 @@ bgp_decode_ext_community(struct bgp_parse_state *s, uint code UNUSED, uint flags
 
   struct adata *ad = lp_alloc_adata(s->pool, len);
   get_u32s(data, (u32 *) ad->data, len / 4);
-  bgp_set_attr_ptr(to, s->pool, BA_EXT_COMMUNITY, flags, ad);
+  bgp_set_attr_ptr(to, BA_EXT_COMMUNITY, flags, ad);
 }
 
 
@@ -811,7 +850,7 @@ bgp_decode_as4_aggregator(struct bgp_parse_state *s, uint code UNUSED, uint flag
   if (len != 8)
     DISCARD(BAD_LENGTH, "AS4_AGGREGATOR", len);
 
-  bgp_set_attr_data(to, s->pool, BA_AS4_AGGREGATOR, flags, data, len);
+  bgp_set_attr_data(to, BA_AS4_AGGREGATOR, flags, data, len);
 }
 
 static void
@@ -841,7 +880,7 @@ bgp_decode_as4_path(struct bgp_parse_state *s, uint code UNUSED, uint flags, byt
     a = as_path_strip_confed(s->pool, a);
   }
 
-  bgp_set_attr_ptr(to, s->pool, BA_AS4_PATH, flags, a);
+  bgp_set_attr_ptr(to, BA_AS4_PATH, flags, a);
 }
 
 
@@ -865,7 +904,7 @@ bgp_decode_aigp(struct bgp_parse_state *s, uint code UNUSED, uint flags, byte *d
   if (!bgp_aigp_valid(data, len, err, sizeof(err)))
     DISCARD("Malformed AIGP attribute - %s", err);
 
-  bgp_set_attr_data(to, s->pool, BA_AIGP, flags, data, len);
+  bgp_set_attr_data(to, BA_AIGP, flags, data, len);
 }
 
 static void
@@ -897,7 +936,7 @@ bgp_decode_large_community(struct bgp_parse_state *s, uint code UNUSED, uint fla
 
   struct adata *ad = lp_alloc_adata(s->pool, len);
   get_u32s(data, (u32 *) ad->data, len / 4);
-  bgp_set_attr_ptr(to, s->pool, BA_LARGE_COMMUNITY, flags, ad);
+  bgp_set_attr_ptr(to, BA_LARGE_COMMUNITY, flags, ad);
 }
 
 static void
@@ -909,20 +948,20 @@ bgp_export_mpls_label_stack(struct bgp_export_state *s, eattr *a)
 
   /* Perhaps we should just ignore it? */
   if (!s->mpls)
-    WITHDRAW("Unexpected MPLS stack");
+    REJECT("Unexpected MPLS stack");
 
   /* Empty MPLS stack is not allowed */
   if (!lnum)
-    WITHDRAW("Malformed MPLS stack - empty");
+    REJECT("Malformed MPLS stack - empty");
 
   /* This is ugly, but we must ensure that labels fit into NLRI field */
   if ((24*lnum + (net_is_vpn(n) ? 64 : 0) + net_pxlen(n)) > 255)
-    WITHDRAW("Malformed MPLS stack - too many labels (%u)", lnum);
+    REJECT("Malformed MPLS stack - too many labels (%u)", lnum);
 
   for (uint i = 0; i < lnum; i++)
   {
     if (labels[i] > 0xfffff)
-      WITHDRAW("Malformed MPLS stack - invalid label (%u)", labels[i]);
+      REJECT("Malformed MPLS stack - invalid label (%u)", labels[i]);
 
     /* TODO: Check for special-purpose label values? */
   }
@@ -970,10 +1009,29 @@ bgp_format_mpls_label_stack(const eattr *a, byte *buf, uint size)
 }
 
 static inline void
-bgp_decode_unknown(struct bgp_parse_state *s, uint code, uint flags, byte *data, uint len, ea_list **to)
+bgp_export_unknown(struct bgp_export_state *s UNUSED, eattr *a)
+{
+  if (!(a->flags & BAF_TRANSITIVE))
+    UNSET(a);
+
+  a->flags |= BAF_PARTIAL;
+}
+
+static inline void
+bgp_decode_unknown(struct bgp_parse_state *s UNUSED, uint code, uint flags, byte *data, uint len, ea_list **to)
 {
+  if (!(flags & BAF_OPTIONAL))
+    WITHDRAW("Unknown attribute (code %u) - conflicting flags (%02x)", code, flags);
+
   /* Cannot use bgp_set_attr_data() as it works on known attributes only */
-  ea_set_attr_data(to, s->pool, EA_CODE(PROTOCOL_BGP, code), flags, EAF_TYPE_OPAQUE, data, len);
+  ea_set_attr_data(to, &bgp_attr_table[code].class, flags, data, len);
+}
+
+static inline void
+bgp_format_unknown(const eattr *a, byte *buf, uint size)
+{
+  if (a->flags & BAF_TRANSITIVE)
+    bsnprintf(buf, size, "(transitive)");
 }
 
 
@@ -981,10 +1039,10 @@ bgp_decode_unknown(struct bgp_parse_state *s, uint code, uint flags, byte *data,
  *	Attribute table
  */
 
-static const struct bgp_attr_desc bgp_attr_table[] = {
+static union bgp_attr_desc bgp_attr_table[BGP_ATTR_MAX] = {
   [BA_ORIGIN] = {
-    .name = "origin",
-    .type = EAF_TYPE_INT,
+    .name = "bgp_origin",
+    .type = T_ENUM_BGP_ORIGIN,
     .flags = BAF_TRANSITIVE,
     .export = bgp_export_origin,
     .encode = bgp_encode_u8,
@@ -992,69 +1050,69 @@ static const struct bgp_attr_desc bgp_attr_table[] = {
     .format = bgp_format_origin,
   },
   [BA_AS_PATH] = {
-    .name = "as_path",
-    .type = EAF_TYPE_AS_PATH,
+    .name = "bgp_path",
+    .type = T_PATH,
     .flags = BAF_TRANSITIVE,
     .encode = bgp_encode_as_path,
     .decode = bgp_decode_as_path,
   },
   [BA_NEXT_HOP] = {
-    .name = "next_hop",
-    .type = EAF_TYPE_IP_ADDRESS,
+    .name = "bgp_next_hop",
+    .type = T_IP,
     .flags = BAF_TRANSITIVE,
     .encode = bgp_encode_next_hop,
     .decode = bgp_decode_next_hop,
     .format = bgp_format_next_hop,
   },
   [BA_MULTI_EXIT_DISC] = {
-    .name = "med",
-    .type = EAF_TYPE_INT,
+    .name = "bgp_med",
+    .type = T_INT,
     .flags = BAF_OPTIONAL,
     .encode = bgp_encode_u32,
     .decode = bgp_decode_med,
   },
   [BA_LOCAL_PREF] = {
-    .name = "local_pref",
-    .type = EAF_TYPE_INT,
+    .name = "bgp_local_pref",
+    .type = T_INT,
     .flags = BAF_TRANSITIVE,
     .export = bgp_export_local_pref,
     .encode = bgp_encode_u32,
     .decode = bgp_decode_local_pref,
   },
   [BA_ATOMIC_AGGR] = {
-    .name = "atomic_aggr",
-    .type = EAF_TYPE_OPAQUE,
+    .name = "bgp_atomic_aggr",
+    .type = T_OPAQUE,
     .flags = BAF_TRANSITIVE,
     .encode = bgp_encode_raw,
     .decode = bgp_decode_atomic_aggr,
   },
   [BA_AGGREGATOR] = {
-    .name = "aggregator",
-    .type = EAF_TYPE_OPAQUE,
+    .name = "bgp_aggregator",
+    .type = T_OPAQUE,
     .flags = BAF_OPTIONAL | BAF_TRANSITIVE,
     .encode = bgp_encode_aggregator,
     .decode = bgp_decode_aggregator,
     .format = bgp_format_aggregator,
   },
   [BA_COMMUNITY] = {
-    .name = "community",
-    .type = EAF_TYPE_INT_SET,
+    .name = "bgp_community",
+    .type = T_CLIST,
     .flags = BAF_OPTIONAL | BAF_TRANSITIVE,
     .export = bgp_export_community,
     .encode = bgp_encode_u32s,
     .decode = bgp_decode_community,
   },
   [BA_ORIGINATOR_ID] = {
-    .name = "originator_id",
-    .type = EAF_TYPE_ROUTER_ID,
+    .name = "bgp_originator_id",
+    .type = T_QUAD,
     .flags = BAF_OPTIONAL,
     .export = bgp_export_originator_id,
     .encode = bgp_encode_u32,
     .decode = bgp_decode_originator_id,
   },
   [BA_CLUSTER_LIST] = {
-    .name = "cluster_list",
-    .type = EAF_TYPE_INT_SET,
+    .name = "bgp_cluster_list",
+    .type = T_CLIST,
     .flags = BAF_OPTIONAL,
     .export = bgp_export_cluster_list,
     .encode = bgp_encode_u32s,
@@ -1062,43 +1120,47 @@ static const struct bgp_attr_desc bgp_attr_table[] = {
     .format = bgp_format_cluster_list,
   },
   [BA_MP_REACH_NLRI] = {
-    .name = "mp_reach_nlri",
-    .type = EAF_TYPE_OPAQUE,
+    .name = "bgp_mp_reach_nlri",
+    .type = T_OPAQUE,
+    .hidden = 1,
     .flags = BAF_OPTIONAL,
     .decode = bgp_decode_mp_reach_nlri,
   },
   [BA_MP_UNREACH_NLRI] = {
-    .name = "mp_unreach_nlri",
-    .type = EAF_TYPE_OPAQUE,
+    .name = "bgp_mp_unreach_nlri",
+    .type = T_OPAQUE,
+    .hidden = 1,
     .flags = BAF_OPTIONAL,
     .decode = bgp_decode_mp_unreach_nlri,
   },
   [BA_EXT_COMMUNITY] = {
-    .name = "ext_community",
-    .type = EAF_TYPE_EC_SET,
+    .name = "bgp_ext_community",
+    .type = T_ECLIST,
     .flags = BAF_OPTIONAL | BAF_TRANSITIVE,
     .export = bgp_export_ext_community,
     .encode = bgp_encode_u32s,
     .decode = bgp_decode_ext_community,
   },
   [BA_AS4_PATH] = {
-    .name = "as4_path",
-    .type = EAF_TYPE_AS_PATH,
+    .name = "bgp_as4_path",
+    .type = T_PATH,
+    .hidden = 1,
     .flags = BAF_OPTIONAL | BAF_TRANSITIVE,
     .encode = bgp_encode_raw,
     .decode = bgp_decode_as4_path,
   },
   [BA_AS4_AGGREGATOR] = {
-    .name = "as4_aggregator",
-    .type = EAF_TYPE_OPAQUE,
+    .name = "bgp_as4_aggregator",
+    .type = T_OPAQUE,
+    .hidden = 1,
     .flags = BAF_OPTIONAL | BAF_TRANSITIVE,
     .encode = bgp_encode_raw,
     .decode = bgp_decode_as4_aggregator,
     .format = bgp_format_aggregator,
   },
   [BA_AIGP] = {
-    .name = "aigp",
-    .type = EAF_TYPE_OPAQUE,
+    .name = "bgp_aigp",
+    .type = T_OPAQUE,
     .flags = BAF_OPTIONAL | BAF_DECODE_FLAGS,
     .export = bgp_export_aigp,
     .encode = bgp_encode_raw,
@@ -1106,16 +1168,17 @@ static const struct bgp_attr_desc bgp_attr_table[] = {
     .format = bgp_format_aigp,
   },
   [BA_LARGE_COMMUNITY] = {
-    .name = "large_community",
-    .type = EAF_TYPE_LC_SET,
+    .name = "bgp_large_community",
+    .type = T_LCLIST,
     .flags = BAF_OPTIONAL | BAF_TRANSITIVE,
     .export = bgp_export_large_community,
     .encode = bgp_encode_u32s,
     .decode = bgp_decode_large_community,
   },
   [BA_MPLS_LABEL_STACK] = {
-    .name = "mpls_label_stack",
-    .type = EAF_TYPE_INT_SET,
+    .name = "bgp_mpls_label_stack",
+    .type = T_CLIST,
+    .readonly = 1,
     .export = bgp_export_mpls_label_stack,
     .encode = bgp_encode_mpls_label_stack,
     .decode = bgp_decode_mpls_label_stack,
@@ -1123,12 +1186,32 @@ static const struct bgp_attr_desc bgp_attr_table[] = {
   },
 };
 
-static inline int
-bgp_attr_known(uint code)
+eattr *
+bgp_find_attr(ea_list *attrs, uint code)
 {
-  return (code < ARRAY_SIZE(bgp_attr_table)) && bgp_attr_table[code].name;
+  return ea_find(attrs, BGP_EA_ID(code));
 }
 
+void
+bgp_register_attrs(void)
+{
+  for (uint i=0; i<ARRAY_SIZE(bgp_attr_table); i++)
+  {
+    if (!bgp_attr_table[i].name)
+      bgp_attr_table[i] = (union bgp_attr_desc) {
+	.name = mb_sprintf(&root_pool, "bgp_unknown_0x%02x", i),
+	.type = T_OPAQUE,
+	.flags = BAF_OPTIONAL,
+	.readonly = 1,
+	.export = bgp_export_unknown,
+	.encode = bgp_encode_raw,
+	.decode = bgp_decode_unknown,
+	.format = bgp_format_unknown,
+      };
+
+    ea_register_init(&bgp_attr_table[i].class);
+  }
+}
 
 /*
  *	Attribute export
@@ -1137,38 +1220,24 @@ bgp_attr_known(uint code)
 static inline void
 bgp_export_attr(struct bgp_export_state *s, eattr *a, ea_list *to)
 {
-  if (EA_PROTO(a->id) != PROTOCOL_BGP)
+  const union bgp_attr_desc *desc = bgp_find_attr_desc(a);
+  if (!desc)
     return;
 
-  uint code = EA_ID(a->id);
+  /* The flags might have been zero if the attr was added locally */
+  a->flags = (a->flags & BAF_PARTIAL) | desc->flags;
 
-  if (bgp_attr_known(code))
-  {
-    const struct bgp_attr_desc *desc = &bgp_attr_table[code];
-
-    /* The flags might have been zero if the attr was added by filters */
-    a->flags = (a->flags & BAF_PARTIAL) | desc->flags;
-
-    /* Set partial bit if new opt-trans attribute is attached to non-local route */
-    if ((s->src != NULL) && (a->type & EAF_ORIGINATED) &&
-	(a->flags & BAF_OPTIONAL) && (a->flags & BAF_TRANSITIVE))
-      a->flags |= BAF_PARTIAL;
-
-    /* Call specific hook */
-    CALL(desc->export, s, a);
+  /* Set partial bit if new opt-trans attribute is attached to non-local route */
+  if ((s->src != NULL) && (a->originated) &&
+      (a->flags & BAF_OPTIONAL) && (a->flags & BAF_TRANSITIVE))
+    a->flags |= BAF_PARTIAL;
 
-    /* Attribute might become undefined in hook */
-    if ((a->type & EAF_TYPE_MASK) == EAF_TYPE_UNDEF)
-      return;
-  }
-  else
-  {
-    /* Don't re-export unknown non-transitive attributes */
-    if (!(a->flags & BAF_TRANSITIVE))
-      return;
+  /* Call specific hook */
+  CALL(desc->export, s, a);
 
-    a->flags |= BAF_PARTIAL;
-  }
+  /* Attribute might become undefined in hook */
+  if (a->undef)
+    return;
 
   /* Append updated attribute */
   to->attrs[to->count++] = *a;
@@ -1188,12 +1257,11 @@ bgp_export_attr(struct bgp_export_state *s, eattr *a, ea_list *to)
  * Result: one sorted attribute list segment, or NULL if attributes are unsuitable.
  */
 static inline ea_list *
-bgp_export_attrs(struct bgp_export_state *s, ea_list *attrs)
+bgp_export_attrs(struct bgp_export_state *s, ea_list *a)
 {
   /* Merge the attribute list */
-  ea_list *new = lp_alloc(s->pool, ea_scan(attrs));
-  ea_merge(attrs, new);
-  ea_sort(new);
+  ea_list *new = ea_normalize(a, 0);
+  ASSERT_DIE(new);
 
   uint i, count;
   count = new->count;
@@ -1203,7 +1271,7 @@ bgp_export_attrs(struct bgp_export_state *s, ea_list *attrs)
   for (i = 0; i < count; i++)
     bgp_export_attr(s, &new->attrs[i], new);
 
-  if (s->err_withdraw)
+  if (s->err_reject)
     return NULL;
 
   return new;
@@ -1217,14 +1285,9 @@ bgp_export_attrs(struct bgp_export_state *s, ea_list *attrs)
 static inline int
 bgp_encode_attr(struct bgp_write_state *s, eattr *a, byte *buf, uint size)
 {
-  ASSERT(EA_PROTO(a->id) == PROTOCOL_BGP);
-
-  uint code = EA_ID(a->id);
-
-  if (bgp_attr_known(code))
-    return bgp_attr_table[code].encode(s, a, buf, size);
-  else
-    return bgp_encode_raw(s, a, buf, size);
+  const union bgp_attr_desc *desc = bgp_find_attr_desc(a);
+  ASSERT_DIE(desc);
+  return desc->encode(s, a, buf, size);
 }
 
 /**
@@ -1289,7 +1352,7 @@ bgp_cluster_list_loopy(struct bgp_proto *p, ea_list *attrs)
 }
 
 static inline void
-bgp_decode_attr(struct bgp_parse_state *s, uint code, uint flags, byte *data, uint len, ea_list **to)
+bgp_decode_attr(struct bgp_parse_state *s, byte code, byte flags, byte *data, uint len, ea_list **to)
 {
   /* Handle duplicate attributes; RFC 7606 3 (g) */
   if (BIT32_TEST(s->attrs_seen, code))
@@ -1301,24 +1364,15 @@ bgp_decode_attr(struct bgp_parse_state *s, uint code, uint flags, byte *data, ui
   }
   BIT32_SET(s->attrs_seen, code);
 
-  if (bgp_attr_known(code))
-  {
-    const struct bgp_attr_desc *desc = &bgp_attr_table[code];
+  ASSERT_DIE(bgp_attr_table[code].id);
+  const union bgp_attr_desc *desc = &bgp_attr_table[code];
 
-    /* Handle conflicting flags; RFC 7606 3 (c) */
-    if (((flags ^ desc->flags) & (BAF_OPTIONAL | BAF_TRANSITIVE)) &&
-	!(desc->flags & BAF_DECODE_FLAGS))
-      WITHDRAW("Malformed %s attribute - conflicting flags (%02x)", desc->name, flags);
+  /* Handle conflicting flags; RFC 7606 3 (c) */
+  if (((flags ^ desc->flags) & (BAF_OPTIONAL | BAF_TRANSITIVE)) &&
+      !(desc->flags & BAF_DECODE_FLAGS))
+    WITHDRAW("Malformed %s attribute - conflicting flags (%02x, expected %02x)", desc->name, flags, desc->flags);
 
-    desc->decode(s, code, flags, data, len, to);
-  }
-  else /* Unknown attribute */
-  {
-    if (!(flags & BAF_OPTIONAL))
-      WITHDRAW("Unknown attribute (code %u) - conflicting flags (%02x)", code, flags);
-
-    bgp_decode_unknown(s, code, flags, data, len, to);
-  }
+  desc->decode(s, code, flags, data, len, to);
 }
 
 /**
@@ -1336,7 +1390,8 @@ bgp_decode_attrs(struct bgp_parse_state *s, byte *data, uint len)
 {
   struct bgp_proto *p = s->proto;
   ea_list *attrs = NULL;
-  uint code, flags, alen;
+  uint alen;
+  byte code, flags;
   byte *pos = data;
 
   /* Parse the attributes */
@@ -1401,23 +1456,23 @@ bgp_decode_attrs(struct bgp_parse_state *s, byte *data, uint len)
 
   /* Reject routes with our ASN in AS_PATH attribute */
   if (bgp_as_path_loopy(p, attrs, p->local_as))
-    goto withdraw;
+    goto loop;
 
   /* Reject routes with our Confederation ID in AS_PATH attribute; RFC 5065 4.0 */
   if ((p->public_as != p->local_as) && bgp_as_path_loopy(p, attrs, p->public_as))
-    goto withdraw;
+    goto loop;
 
   /* Reject routes with our Router ID in ORIGINATOR_ID attribute; RFC 4456 8 */
   if (p->is_internal && bgp_originator_id_loopy(p, attrs))
-    goto withdraw;
+    goto loop;
 
   /* Reject routes with our Cluster ID in CLUSTER_LIST attribute; RFC 4456 8 */
   if (p->rr_client && bgp_cluster_list_loopy(p, attrs))
-    goto withdraw;
+    goto loop;
 
   /* If there is no local preference, define one */
   if (!BIT32_TEST(s->attrs_seen, BA_LOCAL_PREF))
-    bgp_set_attr_u32(&attrs, s->pool, BA_LOCAL_PREF, 0, p->cf->default_local_pref);
+    bgp_set_attr_u32(&attrs, BA_LOCAL_PREF, 0, p->cf->default_local_pref);
 
   return attrs;
 
@@ -1434,16 +1489,20 @@ withdraw:
 
   s->err_withdraw = 1;
   return NULL;
+
+loop:
+  /* Loops are handled as withdraws, but ignored silently. Do not set err_withdraw. */
+  return NULL;
 }
 
 void
-bgp_finish_attrs(struct bgp_parse_state *s, rta *a)
+bgp_finish_attrs(struct bgp_parse_state *s, ea_list **to)
 {
   /* AIGP test here instead of in bgp_decode_aigp() - we need to know channel */
   if (BIT32_TEST(s->attrs_seen, BA_AIGP) && !s->channel->cf->aigp)
   {
     REPORT("Discarding AIGP attribute received on non-AIGP session");
-    bgp_unset_attr(&a->eattrs, s->pool, BA_AIGP);
+    bgp_unset_attr(to, BA_AIGP);
   }
 }
 
@@ -1458,7 +1517,7 @@ bgp_finish_attrs(struct bgp_parse_state *s, rta *a)
 #define RBH_FN(a,h)		h
 
 #define RBH_REHASH		bgp_rbh_rehash
-#define RBH_PARAMS		/8, *2, 2, 2, 8, 20
+#define RBH_PARAMS		/8, *2, 2, 2, 12, 20
 
 
 HASH_DEFINE_REHASH_FN(RBH, struct bgp_bucket)
@@ -1498,48 +1557,20 @@ bgp_get_bucket(struct bgp_channel *c, ea_list *new)
   if (b)
     return b;
 
-  uint ea_size = sizeof(ea_list) + new->count * sizeof(eattr);
-  uint ea_size_aligned = BIRD_ALIGN(ea_size, CPU_STRUCT_ALIGN);
-  uint size = sizeof(struct bgp_bucket) + ea_size_aligned;
-  uint i;
-  byte *dest;
-
-  /* Gather total size of non-inline attributes */
-  for (i = 0; i < new->count; i++)
-  {
-    eattr *a = &new->attrs[i];
+  /* Scan the list for total size */
+  uint ea_size = BIRD_CPU_ALIGN(ea_list_size(new));
+  uint size = sizeof(struct bgp_bucket) + ea_size;
 
-    if (!(a->type & EAF_EMBEDDED))
-      size += BIRD_ALIGN(sizeof(struct adata) + a->u.ptr->length, CPU_STRUCT_ALIGN);
-  }
-
-  /* Create the bucket */
+  /* Allocate the bucket */
   b = mb_alloc(c->pool, size);
   *b = (struct bgp_bucket) { };
   init_list(&b->prefixes);
   b->hash = hash;
 
-  /* Copy list of extended attributes */
-  memcpy(b->eattrs, new, ea_size);
-  dest = ((byte *) b->eattrs) + ea_size_aligned;
+  /* Copy the ea_list */
+  ea_list_copy(b->eattrs, new, ea_size);
 
-  /* Copy values of non-inline attributes */
-  for (i = 0; i < new->count; i++)
-  {
-    eattr *a = &b->eattrs->attrs[i];
-
-    if (!(a->type & EAF_EMBEDDED))
-    {
-      const struct adata *oa = a->u.ptr;
-      struct adata *na = (struct adata *) dest;
-      memcpy(na, oa, sizeof(struct adata) + oa->length);
-      a->u.ptr = na;
-      dest += BIRD_ALIGN(sizeof(struct adata) + na->length, CPU_STRUCT_ALIGN);
-    }
-  }
-
-  /* Insert the bucket to send queue and bucket hash */
-  add_tail(&c->bucket_queue, &b->send_node);
+  /* Insert the bucket to bucket hash */
   HASH_INSERT2(c->bucket_hash, RBH, c->pool, b);
 
   return b;
@@ -1557,14 +1588,30 @@ bgp_get_withdraw_bucket(struct bgp_channel *c)
   return c->withdraw_bucket;
 }
 
-void
-bgp_free_bucket(struct bgp_channel *c, struct bgp_bucket *b)
+static void
+bgp_free_bucket_xx(struct bgp_channel *c, struct bgp_bucket *b)
 {
-  rem_node(&b->send_node);
   HASH_REMOVE2(c->bucket_hash, RBH, c->pool, b);
   mb_free(b);
 }
 
+int
+bgp_done_bucket(struct bgp_channel *c, struct bgp_bucket *b)
+{
+  /* Won't free the withdraw bucket */
+  if (b == c->withdraw_bucket)
+    return 0;
+
+  if (EMPTY_LIST(b->prefixes))
+    rem_node(&b->send_node);
+
+  if (b->px_uc || !EMPTY_LIST(b->prefixes))
+    return 0;
+
+  bgp_free_bucket_xx(c, b);
+  return 1;
+}
+
 void
 bgp_defer_bucket(struct bgp_channel *c, struct bgp_bucket *b)
 {
@@ -1584,8 +1631,8 @@ bgp_withdraw_bucket(struct bgp_channel *c, struct bgp_bucket *b)
     struct bgp_prefix *px = HEAD(b->prefixes);
 
     log(L_ERR "%s: - withdrawing %N", p->p.name, &px->net);
-    rem_node(&px->buck_node);
-    add_tail(&wb->prefixes, &px->buck_node);
+    rem_node(&px->buck_node_xx);
+    add_tail(&wb->prefixes, &px->buck_node_xx);
   }
 }
 
@@ -1596,11 +1643,11 @@ bgp_withdraw_bucket(struct bgp_channel *c, struct bgp_bucket *b)
 
 #define PXH_KEY(px)		px->net, px->path_id, px->hash
 #define PXH_NEXT(px)		px->next
-#define PXH_EQ(n1,i1,h1,n2,i2,h2) h1 == h2 && i1 == i2 && net_equal(n1, n2)
+#define PXH_EQ(n1,i1,h1,n2,i2,h2) h1 == h2 && (c->add_path_tx ? (i1 == i2) : 1) && net_equal(n1, n2)
 #define PXH_FN(n,i,h)		h
 
 #define PXH_REHASH		bgp_pxh_rehash
-#define PXH_PARAMS		/8, *2, 2, 2, 8, 24
+#define PXH_PARAMS		/8, *2, 2, 2, 12, 24
 
 
 HASH_DEFINE_REHASH_FN(PXH, struct bgp_prefix)
@@ -1626,14 +1673,13 @@ bgp_free_prefix_table(struct bgp_channel *c)
 static struct bgp_prefix *
 bgp_get_prefix(struct bgp_channel *c, const net_addr *net, u32 path_id)
 {
-  u32 hash = net_hash(net) ^ u32_hash(path_id);
-  struct bgp_prefix *px = HASH_FIND(c->prefix_hash, PXH, net, path_id, hash);
+  u32 path_id_hash = c->add_path_tx ? path_id : 0;
+  /* We must use a different hash function than the rtable */
+  u32 hash = u32_hash(net_hash(net) ^ u32_hash(path_id_hash));
+  struct bgp_prefix *px = HASH_FIND(c->prefix_hash, PXH, net, path_id_hash, hash);
 
   if (px)
-  {
-    rem_node(&px->buck_node);
     return px;
-  }
 
   if (c->prefix_slab)
     px = sl_alloc(c->prefix_slab);
@@ -1650,28 +1696,243 @@ bgp_get_prefix(struct bgp_channel *c, const net_addr *net, u32 path_id)
   return px;
 }
 
-void
+static void bgp_free_prefix(struct bgp_channel *c, struct bgp_prefix *px);
+
+static inline int
+bgp_update_prefix(struct bgp_channel *c, struct bgp_prefix *px, struct bgp_bucket *b)
+{
+#define BPX_TRACE(what)	do { \
+  if (c->c.debug & D_ROUTES) log(L_TRACE "%s.%s < %s %N %uG %s", \
+      c->c.proto->name, c->c.name, what, \
+      px->net, px->path_id, (b == c->withdraw_bucket) ? "withdraw" : "update"); } while (0)
+  px->lastmod = current_time();
+
+  /* Already queued for the same bucket */
+  if (px->cur == b)
+  {
+    BPX_TRACE("already queued");
+    return 0;
+  }
+
+  /* Unqueue from the old bucket */
+  if (px->cur)
+  {
+    rem_node(&px->buck_node_xx);
+    bgp_done_bucket(c, px->cur);
+  }
+
+  /* The new bucket is the same as we sent before */
+  if ((px->last == b) || c->c.out_table && !px->last && (b == c->withdraw_bucket))
+  {
+    if (px->cur)
+      BPX_TRACE("reverted");
+    else
+      BPX_TRACE("already sent");
+
+    /* Well, we haven't sent anything yet */
+    if (!px->last)
+      bgp_free_prefix(c, px);
+
+    px->cur = NULL;
+    return 0;
+  }
+
+  /* Enqueue the bucket if it has been empty */
+  if ((b != c->withdraw_bucket) && EMPTY_LIST(b->prefixes))
+    add_tail(&c->bucket_queue, &b->send_node);
+
+  /* Enqueue to the new bucket and indicate the change */
+  add_tail(&b->prefixes, &px->buck_node_xx);
+  px->cur = b;
+
+  BPX_TRACE("queued");
+  return 1;
+
+#undef BPX_TRACE
+}
+
+static void
 bgp_free_prefix(struct bgp_channel *c, struct bgp_prefix *px)
 {
-  rem_node(&px->buck_node);
   HASH_REMOVE2(c->prefix_hash, PXH, c->pool, px);
 
   if (c->prefix_slab)
-    sl_free(c->prefix_slab, px);
+    sl_free(px);
   else
     mb_free(px);
 }
 
+void
+bgp_done_prefix(struct bgp_channel *c, struct bgp_prefix *px, struct bgp_bucket *buck)
+{
+  /* Cleanup: We're called from bucket senders. */
+  ASSERT_DIE(px->cur == buck);
+  rem_node(&px->buck_node_xx);
+
+  /* We may want to store the updates */
+  if (c->c.out_table)
+  {
+    /* Nothing to be sent right now */
+    px->cur = NULL;
+
+    /* Unref the previous sent version */
+    if (px->last)
+      px->last->px_uc--;
+
+    /* Ref the current sent version */
+    if (buck != c->withdraw_bucket)
+    {
+      px->last = buck;
+      px->last->px_uc++;
+      return;
+    }
+
+    /* Prefixes belonging to the withdraw bucket are freed always */
+  }
+
+  bgp_free_prefix(c, px);
+}
+
+
+/*
+ *	Prefix hash table exporter
+ */
+
+static void
+bgp_out_table_feed(void *data)
+{
+  struct rt_export_hook *hook = data;
+  struct bgp_channel *c = SKIP_BACK(struct bgp_channel, prefix_exporter, hook->table);
+
+  int max = 512;
+
+  const net_addr *neq = (hook->req->addr_mode == TE_ADDR_EQUAL) ? hook->req->addr : NULL;
+  const net_addr *cand = NULL;
+
+  do {
+    HASH_WALK_ITER(c->prefix_hash, PXH, n, hook->hash_iter)
+    {
+      switch (hook->req->addr_mode)
+      {
+	case TE_ADDR_IN:
+	  if (!net_in_netX(n->net, hook->req->addr))
+	    continue;
+	  /* fall through */
+	case TE_ADDR_NONE:
+	  /* Splitting only for multi-net exports */
+	  if (--max <= 0)
+	    HASH_WALK_ITER_PUT;
+	  break;
+
+	case TE_ADDR_FOR:
+	  if (!neq)
+	  {
+	    if (net_in_netX(hook->req->addr, n->net) && (!cand || (n->net->length > cand->length)))
+	      cand = n->net;
+	    continue;
+	  }
+	  /* fall through */
+	case TE_ADDR_EQUAL:
+	  if (!net_equal(n->net, neq))
+	    continue;
+	  break;
+      }
+
+      struct bgp_bucket *buck = n->cur ?: n->last;
+      ea_list *ea = NULL;
+      if (buck == c->withdraw_bucket)
+	ea_set_dest(&ea, 0, RTD_UNREACHABLE);
+      else
+      {
+	ea = buck->eattrs;
+	eattr *eanh = bgp_find_attr(ea, BA_NEXT_HOP);
+	ASSERT_DIE(eanh);
+	const ip_addr *nh = (const void *) eanh->u.ptr->data;
+
+	struct nexthop_adata nhad = {
+	  .ad = { .length = sizeof (struct nexthop_adata) - sizeof (struct adata), },
+	  .nh = { .gw = nh[0], },
+	};
+
+	ea_set_attr(&ea, EA_LITERAL_DIRECT_ADATA(&ea_gen_nexthop, 0, tmp_copy_adata(&nhad.ad)));
+      }
+
+      struct rte_storage es = {
+	.rte = {
+	  .attrs = ea,
+	  .net = n->net,
+	  .src = rt_find_source_global(n->path_id),
+	  .sender = NULL,
+	  .lastmod = n->lastmod,
+	  .flags = n->cur ? REF_PENDING : 0,
+	},
+      };
+
+      struct rt_pending_export rpe = {
+	.new = &es, .new_best = &es,
+      };
+
+      if (hook->req->export_bulk)
+      {
+	rte *feed = &es.rte;
+	hook->req->export_bulk(hook->req, n->net, &rpe, &feed, 1);
+      }
+      else if (hook->req->export_one)
+	hook->req->export_one(hook->req, n->net, &rpe);
+      else
+	bug("No export method in export request");
+    }
+    HASH_WALK_ITER_END;
+
+    neq = cand;
+    cand = NULL;
+  } while (neq);
+
+  if (hook->hash_iter)
+    ev_schedule_work(hook->event);
+  else
+    rt_set_export_state(hook, TES_READY);
+}
+
+static struct rt_export_hook *
+bgp_out_table_export_start(struct rt_exporter *re, struct rt_export_request *req UNUSED)
+{
+  struct bgp_channel *c = SKIP_BACK(struct bgp_channel, prefix_exporter, re);
+  pool *p = rp_new(c->c.proto->pool, "Export hook");
+  struct rt_export_hook *hook = mb_allocz(p, sizeof(struct rt_export_hook));
+  hook->pool = p;
+  hook->event = ev_new_init(p, bgp_out_table_feed, hook);
+  hook->feed_type = TFT_HASH;
+
+  return hook;
+}
+
+void
+bgp_setup_out_table(struct bgp_channel *c)
+{
+  ASSERT_DIE(c->c.out_table == NULL);
+
+  c->prefix_exporter = (struct rt_exporter) {
+    .addr_type = c->c.table->addr_type,
+    .start = bgp_out_table_export_start,
+  };
+
+  init_list(&c->prefix_exporter.hooks);
+  init_list(&c->prefix_exporter.pending);
+
+  c->c.out_table = &c->prefix_exporter;
+}
+
 
 /*
  *	BGP protocol glue
  */
 
 int
-bgp_preexport(struct channel *c, rte *e)
+bgp_preexport(struct channel *C, rte *e)
 {
   struct proto *SRC = e->src->proto;
-  struct bgp_proto *p = (struct bgp_proto *) (c->proto);
+  struct bgp_proto *p = (struct bgp_proto *) C->proto;
   struct bgp_proto *src = (SRC->proto == &proto_bgp) ? (struct bgp_proto *) SRC : NULL;
 
   /* Reject our routes */
@@ -1682,6 +1943,22 @@ bgp_preexport(struct channel *c, rte *e)
   if (src == NULL)
     return 0;
 
+  /* Reject flowspec that failed validation */
+  if (net_is_flow(e->net))
+    switch (rt_get_flowspec_valid(e))
+    {
+      case FLOWSPEC_VALID:
+	break;
+      case FLOWSPEC_INVALID:
+	return -1;
+      case FLOWSPEC_UNKNOWN:
+ 	ASSUME((rt_get_source_attr(e) != RTS_BGP) ||
+	    !((struct bgp_channel *) SKIP_BACK(struct channel, in_req, e->sender->req))->base_table);
+	break;
+      case FLOWSPEC__MAX:
+	bug("This never happens.");
+    }
+
   /* IBGP route reflection, RFC 4456 */
   if (p->is_internal && src->is_internal && (p->local_as == src->local_as))
   {
@@ -1691,14 +1968,14 @@ bgp_preexport(struct channel *c, rte *e)
 
     /* Generally, this should be handled when path is received, but we check it
        also here as rr_cluster_id may be undefined or different in src. */
-    if (p->rr_cluster_id && bgp_cluster_list_loopy(p, e->attrs->eattrs))
+    if (p->rr_cluster_id && bgp_cluster_list_loopy(p, e->attrs))
       return -1;
   }
 
   /* Handle well-known communities, RFC 1997 */
   struct eattr *com;
   if (p->cf->interpret_communities &&
-      (com = ea_find(e->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_COMMUNITY))))
+      (com = ea_find(e->attrs, BGP_EA_ID(BA_COMMUNITY))))
   {
     const struct adata *d = com->u.ptr;
 
@@ -1734,7 +2011,7 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
 
   /* ORIGIN attribute - mandatory, attach if missing */
   if (! bgp_find_attr(attrs0, BA_ORIGIN))
-    bgp_set_attr_u32(&attrs, pool, BA_ORIGIN, 0, src ? ORIGIN_INCOMPLETE : ORIGIN_IGP);
+    bgp_set_attr_u32(&attrs, BA_ORIGIN, 0, src ? ORIGIN_INCOMPLETE : ORIGIN_IGP);
 
   /* AS_PATH attribute - mandatory */
   a = bgp_find_attr(attrs0, BA_AS_PATH);
@@ -1749,24 +2026,24 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
   {
     /* IBGP or route server -> just ensure there is one */
     if (!a)
-      bgp_set_attr_ptr(&attrs, pool, BA_AS_PATH, 0, &null_adata);
+      bgp_set_attr_ptr(&attrs, BA_AS_PATH, 0, &null_adata);
   }
   else if (p->is_interior)
   {
     /* Confederation -> prepend ASN as AS_CONFED_SEQUENCE */
     ad = as_path_prepend2(pool, ad, AS_PATH_CONFED_SEQUENCE, p->public_as);
-    bgp_set_attr_ptr(&attrs, pool, BA_AS_PATH, 0, ad);
+    bgp_set_attr_ptr(&attrs, BA_AS_PATH, 0, ad);
   }
   else /* Regular EBGP (no RS, no confederation) */
   {
     /* Regular EBGP -> prepend ASN as regular sequence */
     ad = as_path_prepend2(pool, ad, AS_PATH_SEQUENCE, p->public_as);
-    bgp_set_attr_ptr(&attrs, pool, BA_AS_PATH, 0, ad);
+    bgp_set_attr_ptr(&attrs, BA_AS_PATH, 0, ad);
 
     /* MULTI_EXIT_DESC attribute - accept only if set in export filter */
     a = bgp_find_attr(attrs0, BA_MULTI_EXIT_DISC);
-    if (a && !(a->type & EAF_FRESH))
-      bgp_unset_attr(&attrs, pool, BA_MULTI_EXIT_DISC);
+    if (a && !(a->fresh))
+      bgp_unset_attr(&attrs, BA_MULTI_EXIT_DISC);
   }
 
   /* NEXT_HOP attribute - delegated to AF-specific hook */
@@ -1775,16 +2052,16 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
 
   /* LOCAL_PREF attribute - required for IBGP, attach if missing */
   if (p->is_interior && ! bgp_find_attr(attrs0, BA_LOCAL_PREF))
-    bgp_set_attr_u32(&attrs, pool, BA_LOCAL_PREF, 0, p->cf->default_local_pref);
+    bgp_set_attr_u32(&attrs, BA_LOCAL_PREF, 0, p->cf->default_local_pref);
 
   /* AIGP attribute - accumulate local metric or originate new one */
   u64 metric;
   if (s.local_next_hop &&
-      (bgp_total_aigp_metric_(e->attrs, &metric, &ad) ||
+      (bgp_total_aigp_metric_(e, &metric, &ad) ||
        (c->cf->aigp_originate && bgp_init_aigp_metric(e, &metric, &ad))))
   {
     ad = bgp_aigp_set_metric(pool, ad, metric);
-    bgp_set_attr_ptr(&attrs, pool, BA_AIGP, 0, ad);
+    bgp_set_attr_ptr(&attrs, BA_AIGP, 0, ad);
   }
 
   /* IBGP route reflection, RFC 4456 */
@@ -1792,7 +2069,7 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
   {
     /* ORIGINATOR_ID attribute - attach if not already set */
     if (! bgp_find_attr(attrs0, BA_ORIGINATOR_ID))
-      bgp_set_attr_u32(&attrs, pool, BA_ORIGINATOR_ID, 0, src->remote_id);
+      bgp_set_attr_u32(&attrs, BA_ORIGINATOR_ID, 0, src->remote_id);
 
     /* CLUSTER_LIST attribute - prepend cluster ID */
     a = bgp_find_attr(attrs0, BA_CLUSTER_LIST);
@@ -1807,7 +2084,7 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
       ad = int_set_prepend(pool, ad, p->rr_cluster_id);
 
     /* Should be at least one prepended cluster ID */
-    bgp_set_attr_ptr(&attrs, pool, BA_CLUSTER_LIST, 0, ad);
+    bgp_set_attr_ptr(&attrs, BA_CLUSTER_LIST, 0, ad);
   }
 
   /* AS4_* transition attributes, RFC 6793 4.2.2 */
@@ -1816,15 +2093,15 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
     a = bgp_find_attr(attrs, BA_AS_PATH);
     if (a && as_path_contains_as4(a->u.ptr))
     {
-      bgp_set_attr_ptr(&attrs, pool, BA_AS_PATH, 0, as_path_to_old(pool, a->u.ptr));
-      bgp_set_attr_ptr(&attrs, pool, BA_AS4_PATH, 0, as_path_strip_confed(pool, a->u.ptr));
+      bgp_set_attr_ptr(&attrs, BA_AS_PATH, 0, as_path_to_old(pool, a->u.ptr));
+      bgp_set_attr_ptr(&attrs, BA_AS4_PATH, 0, as_path_strip_confed(pool, a->u.ptr));
     }
 
     a = bgp_find_attr(attrs, BA_AGGREGATOR);
     if (a && aggregator_contains_as4(a->u.ptr))
     {
-      bgp_set_attr_ptr(&attrs, pool, BA_AGGREGATOR, 0, aggregator_to_old(pool, a->u.ptr));
-      bgp_set_attr_ptr(&attrs, pool, BA_AS4_AGGREGATOR, 0, a->u.ptr);
+      bgp_set_attr_ptr(&attrs, BA_AGGREGATOR, 0, aggregator_to_old(pool, a->u.ptr));
+      bgp_set_attr_ptr(&attrs, BA_AS4_AGGREGATOR, 0, a->u.ptr);
     }
   }
 
@@ -1844,18 +2121,19 @@ bgp_rt_notify(struct proto *P, struct channel *C, const net_addr *n, rte *new, c
   struct bgp_proto *p = (void *) P;
   struct bgp_channel *c = (void *) C;
   struct bgp_bucket *buck;
-  struct bgp_prefix *px;
   u32 path;
 
   if (new)
   {
-    struct ea_list *attrs = bgp_update_attrs(p, c, new, new->attrs->eattrs, bgp_linpool2);
+    struct ea_list *attrs = bgp_update_attrs(p, c, new, new->attrs, tmp_linpool);
+
+    /* Error during attribute processing */
+    if (!attrs)
+      log(L_ERR "%s: Invalid route %N withdrawn", p->p.name, n);
 
     /* If attributes are invalid, we fail back to withdraw */
     buck = attrs ? bgp_get_bucket(c, attrs) : bgp_get_withdraw_bucket(c);
     path = new->src->global_id;
-
-    lp_flush(bgp_linpool2);
   }
   else
   {
@@ -1863,17 +2141,15 @@ bgp_rt_notify(struct proto *P, struct channel *C, const net_addr *n, rte *new, c
     path = old->src->global_id;
   }
 
-  px = bgp_get_prefix(c, n, c->add_path_tx ? path : 0);
-  add_tail(&buck->prefixes, &px->buck_node);
-
-  bgp_schedule_packet(p->conn, c, PKT_UPDATE);
+  if (bgp_update_prefix(c, bgp_get_prefix(c, n, path), buck))
+    bgp_schedule_packet(p->conn, c, PKT_UPDATE);
 }
 
 
 static inline u32
 bgp_get_neighbor(rte *r)
 {
-  eattr *e = ea_find(r->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
+  eattr *e = ea_find(r->attrs, BGP_EA_ID(BA_AS_PATH));
   u32 as;
 
   if (e && as_path_get_first_regular(e->u.ptr, &as))
@@ -1894,7 +2170,7 @@ rte_stale(rte *r)
     return 0;
 
   /* If staleness is unknown, compute and cache it */
-  eattr *a = ea_find(r->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_COMMUNITY));
+  eattr *a = ea_find(r->attrs, BGP_EA_ID(BA_COMMUNITY));
   if (a && int_set_contains(a->u.ptr, BGP_COMM_LLGR_STALE))
   {
     r->pflags |= BGP_REF_STALE;
@@ -1924,8 +2200,8 @@ bgp_rte_better(rte *new, rte *old)
     return 1;
 
   /* RFC 4271 9.1.2.1. Route resolvability test */
-  n = rta_resolvable(new->attrs);
-  o = rta_resolvable(old->attrs);
+  n = rte_resolvable(new);
+  o = rte_resolvable(old);
   if (n > o)
     return 1;
   if (n < o)
@@ -1940,8 +2216,8 @@ bgp_rte_better(rte *new, rte *old)
     return 1;
 
  /* Start with local preferences */
-  x = ea_find(new->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_LOCAL_PREF));
-  y = ea_find(old->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_LOCAL_PREF));
+  x = ea_find(new->attrs, BGP_EA_ID(BA_LOCAL_PREF));
+  y = ea_find(old->attrs, BGP_EA_ID(BA_LOCAL_PREF));
   n = x ? x->u.data : new_bgp->cf->default_local_pref;
   o = y ? y->u.data : old_bgp->cf->default_local_pref;
   if (n > o)
@@ -1950,8 +2226,8 @@ bgp_rte_better(rte *new, rte *old)
     return 0;
 
   /* RFC 7311 4.1 - Apply AIGP metric */
-  u64 n2 = bgp_total_aigp_metric(new->attrs);
-  u64 o2 = bgp_total_aigp_metric(old->attrs);
+  u64 n2 = bgp_total_aigp_metric(new);
+  u64 o2 = bgp_total_aigp_metric(old);
   if (n2 < o2)
     return 1;
   if (n2 > o2)
@@ -1960,8 +2236,8 @@ bgp_rte_better(rte *new, rte *old)
   /* RFC 4271 9.1.2.2. a)  Use AS path lengths */
   if (new_bgp->cf->compare_path_lengths || old_bgp->cf->compare_path_lengths)
   {
-    x = ea_find(new->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
-    y = ea_find(old->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
+    x = ea_find(new->attrs, BGP_EA_ID(BA_AS_PATH));
+    y = ea_find(old->attrs, BGP_EA_ID(BA_AS_PATH));
     n = x ? as_path_getlen(x->u.ptr) : AS_PATH_MAXLEN;
     o = y ? as_path_getlen(y->u.ptr) : AS_PATH_MAXLEN;
     if (n < o)
@@ -1971,8 +2247,8 @@ bgp_rte_better(rte *new, rte *old)
   }
 
   /* RFC 4271 9.1.2.2. b) Use origins */
-  x = ea_find(new->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGIN));
-  y = ea_find(old->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGIN));
+  x = ea_find(new->attrs, BGP_EA_ID(BA_ORIGIN));
+  y = ea_find(old->attrs, BGP_EA_ID(BA_ORIGIN));
   n = x ? x->u.data : ORIGIN_INCOMPLETE;
   o = y ? y->u.data : ORIGIN_INCOMPLETE;
   if (n < o)
@@ -1994,8 +2270,8 @@ bgp_rte_better(rte *new, rte *old)
   if (new_bgp->cf->med_metric || old_bgp->cf->med_metric ||
       (bgp_get_neighbor(new) == bgp_get_neighbor(old)))
   {
-    x = ea_find(new->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_MULTI_EXIT_DISC));
-    y = ea_find(old->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_MULTI_EXIT_DISC));
+    x = ea_find(new->attrs, BGP_EA_ID(BA_MULTI_EXIT_DISC));
+    y = ea_find(old->attrs, BGP_EA_ID(BA_MULTI_EXIT_DISC));
     n = x ? x->u.data : new_bgp->cf->default_med;
     o = y ? y->u.data : old_bgp->cf->default_med;
     if (n < o)
@@ -2011,8 +2287,8 @@ bgp_rte_better(rte *new, rte *old)
     return 1;
 
   /* RFC 4271 9.1.2.2. e) Compare IGP metrics */
-  n = new_bgp->cf->igp_metric ? new->attrs->igp_metric : 0;
-  o = old_bgp->cf->igp_metric ? old->attrs->igp_metric : 0;
+  n = new_bgp->cf->igp_metric ? rt_get_igp_metric(new) : 0;
+  o = old_bgp->cf->igp_metric ? rt_get_igp_metric(old) : 0;
   if (n < o)
     return 1;
   if (n > o)
@@ -2020,8 +2296,8 @@ bgp_rte_better(rte *new, rte *old)
 
   /* RFC 4271 9.1.2.2. f) Compare BGP identifiers */
   /* RFC 4456 9. a) Use ORIGINATOR_ID instead of local neighbor ID */
-  x = ea_find(new->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGINATOR_ID));
-  y = ea_find(old->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGINATOR_ID));
+  x = ea_find(new->attrs, BGP_EA_ID(BA_ORIGINATOR_ID));
+  y = ea_find(old->attrs, BGP_EA_ID(BA_ORIGINATOR_ID));
   n = x ? x->u.data : new_bgp->remote_id;
   o = y ? y->u.data : old_bgp->remote_id;
 
@@ -2038,8 +2314,8 @@ bgp_rte_better(rte *new, rte *old)
     return 0;
 
   /* RFC 4456 9. b) Compare cluster list lengths */
-  x = ea_find(new->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_CLUSTER_LIST));
-  y = ea_find(old->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_CLUSTER_LIST));
+  x = ea_find(new->attrs, BGP_EA_ID(BA_CLUSTER_LIST));
+  y = ea_find(old->attrs, BGP_EA_ID(BA_CLUSTER_LIST));
   n = x ? int_set_get_size(x->u.ptr) : 0;
   o = y ? int_set_get_size(y->u.ptr) : 0;
   if (n < o)
@@ -2061,17 +2337,20 @@ bgp_rte_mergable(rte *pri, rte *sec)
   u32 p, s;
 
   /* Skip suppressed routes (see bgp_rte_recalculate()) */
-  /* LLGR draft - depreference stale routes */
-  if (pri->pflags != sec->pflags)
+  if ((pri->pflags ^ sec->pflags) & BGP_REF_SUPPRESSED)
     return 0;
 
   /* RFC 4271 9.1.2.1. Route resolvability test */
-  if (rta_resolvable(pri->attrs) != rta_resolvable(sec->attrs))
+  if (rte_resolvable(pri) != rte_resolvable(sec))
+    return 0;
+
+  /* LLGR draft - depreference stale routes */
+  if (rte_stale(pri) != rte_stale(sec))
     return 0;
 
   /* Start with local preferences */
-  x = ea_find(pri->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_LOCAL_PREF));
-  y = ea_find(sec->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_LOCAL_PREF));
+  x = ea_find(pri->attrs, BGP_EA_ID(BA_LOCAL_PREF));
+  y = ea_find(sec->attrs, BGP_EA_ID(BA_LOCAL_PREF));
   p = x ? x->u.data : pri_bgp->cf->default_local_pref;
   s = y ? y->u.data : sec_bgp->cf->default_local_pref;
   if (p != s)
@@ -2080,8 +2359,8 @@ bgp_rte_mergable(rte *pri, rte *sec)
   /* RFC 4271 9.1.2.2. a)  Use AS path lengths */
   if (pri_bgp->cf->compare_path_lengths || sec_bgp->cf->compare_path_lengths)
   {
-    x = ea_find(pri->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
-    y = ea_find(sec->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
+    x = ea_find(pri->attrs, BGP_EA_ID(BA_AS_PATH));
+    y = ea_find(sec->attrs, BGP_EA_ID(BA_AS_PATH));
     p = x ? as_path_getlen(x->u.ptr) : AS_PATH_MAXLEN;
     s = y ? as_path_getlen(y->u.ptr) : AS_PATH_MAXLEN;
 
@@ -2093,8 +2372,8 @@ bgp_rte_mergable(rte *pri, rte *sec)
   }
 
   /* RFC 4271 9.1.2.2. b) Use origins */
-  x = ea_find(pri->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGIN));
-  y = ea_find(sec->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGIN));
+  x = ea_find(pri->attrs, BGP_EA_ID(BA_ORIGIN));
+  y = ea_find(sec->attrs, BGP_EA_ID(BA_ORIGIN));
   p = x ? x->u.data : ORIGIN_INCOMPLETE;
   s = y ? y->u.data : ORIGIN_INCOMPLETE;
   if (p != s)
@@ -2104,8 +2383,8 @@ bgp_rte_mergable(rte *pri, rte *sec)
   if (pri_bgp->cf->med_metric || sec_bgp->cf->med_metric ||
       (bgp_get_neighbor(pri) == bgp_get_neighbor(sec)))
   {
-    x = ea_find(pri->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_MULTI_EXIT_DISC));
-    y = ea_find(sec->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_MULTI_EXIT_DISC));
+    x = ea_find(pri->attrs, BGP_EA_ID(BA_MULTI_EXIT_DISC));
+    y = ea_find(sec->attrs, BGP_EA_ID(BA_MULTI_EXIT_DISC));
     p = x ? x->u.data : pri_bgp->cf->default_med;
     s = y ? y->u.data : sec_bgp->cf->default_med;
     if (p != s)
@@ -2117,8 +2396,8 @@ bgp_rte_mergable(rte *pri, rte *sec)
     return 0;
 
   /* RFC 4271 9.1.2.2. e) Compare IGP metrics */
-  p = pri_bgp->cf->igp_metric ? pri->attrs->igp_metric : 0;
-  s = sec_bgp->cf->igp_metric ? sec->attrs->igp_metric : 0;
+  p = pri_bgp->cf->igp_metric ? rt_get_igp_metric(pri) : 0;
+  s = sec_bgp->cf->igp_metric ? rt_get_igp_metric(sec) : 0;
   if (p != s)
     return 0;
 
@@ -2131,7 +2410,7 @@ bgp_rte_mergable(rte *pri, rte *sec)
 static inline int
 same_group(rte *r, u32 lpref, u32 lasn)
 {
-  return (r->attrs->pref == lpref) && (bgp_get_neighbor(r) == lasn);
+  return (rt_get_preference(r) == lpref) && (bgp_get_neighbor(r) == lasn);
 }
 
 static inline int
@@ -2145,7 +2424,7 @@ int
 bgp_rte_recalculate(rtable *table, net *net, rte *new, rte *old, rte *old_best)
 {
   rte *key = new ? new : old;
-  u32 lpref = key->attrs->pref;
+  u32 lpref = rt_get_preference(key);
   u32 lasn = bgp_get_neighbor(key);
   int old_suppressed = old ? !!(old->pflags & BGP_REF_SUPPRESSED) : 0;
 
@@ -2212,7 +2491,7 @@ bgp_rte_recalculate(rtable *table, net *net, rte *new, rte *old, rte *old_best)
 
   /* The default case - find a new best-in-group route */
   rte *r = new; /* new may not be in the list */
-  for (struct rte_storage *s = net->routes; rte_is_valid(&s->rte); s = s->next)
+  for (struct rte_storage *s = net->routes; rte_is_valid(RTE_OR_NULL(s)); s = s->next)
     if (use_deterministic_med(s) && same_group(&s->rte, lpref, lasn))
     {
       s->rte.pflags |= BGP_REF_SUPPRESSED;
@@ -2229,7 +2508,7 @@ bgp_rte_recalculate(rtable *table, net *net, rte *new, rte *old, rte *old_best)
     new->pflags &= ~BGP_REF_SUPPRESSED;
 
   /* Found all existing routes mergable with best-in-group */
-  for (struct rte_storage *s = net->routes; rte_is_valid(&s->rte); s = s->next)
+  for (struct rte_storage *s = net->routes; rte_is_valid(RTE_OR_NULL(s)); s = s->next)
     if (use_deterministic_med(s) && same_group(&s->rte, lpref, lasn))
       if ((&s->rte != r) && bgp_rte_mergable(r, &s->rte))
 	s->rte.pflags &= ~BGP_REF_SUPPRESSED;
@@ -2271,40 +2550,53 @@ void
 bgp_rte_modify_stale(struct rt_export_request *req, const net_addr *n, struct rt_pending_export *rpe UNUSED, rte **feed, uint count)
 {
   struct bgp_channel *c = SKIP_BACK(struct bgp_channel, stale_feed, req);
+  struct rt_import_hook *irh = c->c.in_req.hook;
 
-  do {
-    rte *r = feed[--count];
-    if (r->sender != c->c.in_req.hook)
-      continue;
+  /* Find our routes among others */
+  for (uint i=0; i<count; i++)
+  {
+    rte *r = feed[i];
 
-    /* A new route, do not mark as stale */
-    if (r->stale_cycle == c->c.in_req.hook->stale_set)
+    if (
+	!rte_is_valid(r) ||			/* Not a valid route */
+	(r->sender != irh) ||			/* Not our route */
+	(r->stale_cycle == irh->stale_set))	/* A new route, do not mark as stale */
       continue;
 
-    eattr *ea = ea_find(r->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_COMMUNITY));
+    eattr *ea = ea_find(r->attrs, BGP_EA_ID(BA_COMMUNITY));
     const struct adata *ad = ea ? ea->u.ptr : NULL;
     uint flags = ea ? ea->flags : BAF_PARTIAL;
 
-    rte e0 = *r;
-    e0.flags |= REF_USE_STALE;
-
+    /* LLGR not allowed, withdraw the route */
     if (ad && int_set_contains(ad, BGP_COMM_NO_LLGR))
+    {
       rte_import(&c->c.in_req, n, NULL, r->src);
+      continue;
+    }
 
-    else if (ad && int_set_contains(ad, BGP_COMM_LLGR_STALE))
-      rte_import(&c->c.in_req, n, &e0, r->src);
-
-    else {
-      rta *a = e0.attrs = rta_do_cow(r->attrs, bgp_linpool);
+    /* Route already marked as LLGR, do nothing */
+    if (ad && int_set_contains(ad, BGP_COMM_LLGR_STALE))
+      continue;
 
-      bgp_set_attr_ptr(&(a->eattrs), bgp_linpool, BA_COMMUNITY, flags,
-	  int_set_add(bgp_linpool, ad, BGP_COMM_LLGR_STALE));
-      e0.pflags |= BGP_REF_STALE;
+    /* Store the tmp_linpool state to aggresively save memory */
+    struct lp_state tmpp;
+    lp_save(tmp_linpool, &tmpp);
 
-      rte_import(&c->c.in_req, n, &e0, r->src);
-      lp_flush(bgp_linpool);
-    }
-  } while (count);
+    /* Mark the route as LLGR */
+    rte e0 = *r;
+    bgp_set_attr_ptr(&e0.attrs, BA_COMMUNITY, flags, int_set_add(tmp_linpool, ad, BGP_COMM_LLGR_STALE));
+    e0.pflags &= ~BGP_REF_NOT_STALE;
+    e0.pflags |= BGP_REF_STALE;
+
+    /* We need to update the route but keep it stale. */
+    ASSERT_DIE(irh->stale_set == irh->stale_valid + 1);
+    irh->stale_set--;
+    rte_import(&c->c.in_req, n, &e0, r->src);
+    irh->stale_set++;
+
+    /* Restore the memory state */
+    lp_restore(tmp_linpool, &tmpp);
+  }
 }
 
 
@@ -2320,8 +2612,8 @@ bgp_process_as4_attrs(ea_list **attrs, struct linpool *pool)
   eattr *a4 = bgp_find_attr(*attrs, BA_AS4_AGGREGATOR);
 
   /* First, unset AS4_* attributes */
-  if (p4) bgp_unset_attr(attrs, pool, BA_AS4_PATH);
-  if (a4) bgp_unset_attr(attrs, pool, BA_AS4_AGGREGATOR);
+  if (p4) bgp_unset_attr(attrs, BA_AS4_PATH);
+  if (a4) bgp_unset_attr(attrs, BA_AS4_AGGREGATOR);
 
   /* Handle AGGREGATOR attribute */
   if (a2 && a4)
@@ -2354,60 +2646,37 @@ bgp_process_as4_attrs(ea_list **attrs, struct linpool *pool)
   }
 }
 
-int
-bgp_get_attr(const eattr *a, byte *buf, int buflen)
-{
-  uint i = EA_ID(a->id);
-  const struct bgp_attr_desc *d;
-  int len;
-
-  if (bgp_attr_known(i))
-  {
-    d = &bgp_attr_table[i];
-    len = bsprintf(buf, "%s", d->name);
-    buf += len;
-    if (d->format)
-    {
-      *buf++ = ':';
-      *buf++ = ' ';
-      d->format(a, buf, buflen - len - 2);
-      return GA_FULL;
-    }
-    return GA_NAME;
-  }
-
-  bsprintf(buf, "%02x%s", i, (a->flags & BAF_TRANSITIVE) ? " [t]" : "");
-  return GA_NAME;
-}
-
 void
 bgp_get_route_info(rte *e, byte *buf)
 {
-  eattr *p = ea_find(e->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
-  eattr *o = ea_find(e->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGIN));
+  eattr *p = ea_find(e->attrs, BGP_EA_ID(BA_AS_PATH));
+  eattr *o = ea_find(e->attrs, BGP_EA_ID(BA_ORIGIN));
   u32 origas;
 
-  buf += bsprintf(buf, " (%d", e->attrs->pref);
+  buf += bsprintf(buf, " (%d", rt_get_preference(e));
 
-  if (e->pflags & BGP_REF_SUPPRESSED)
-    buf += bsprintf(buf, "-");
+  if (!net_is_flow(e->net))
+  {
+    if (e->pflags & BGP_REF_SUPPRESSED)
+      buf += bsprintf(buf, "-");
 
-  if (rte_stale(e))
-    buf += bsprintf(buf, "s");
+    if (rte_stale(e))
+      buf += bsprintf(buf, "s");
 
-  u64 metric = bgp_total_aigp_metric(e->attrs);
-  if (metric < BGP_AIGP_MAX)
-  {
-    buf += bsprintf(buf, "/%lu", metric);
-  }
-  else if (e->attrs->igp_metric)
-  {
-    if (!rta_resolvable(e->attrs))
-      buf += bsprintf(buf, "/-");
-    else if (e->attrs->igp_metric >= IGP_METRIC_UNKNOWN)
-      buf += bsprintf(buf, "/?");
-    else
-      buf += bsprintf(buf, "/%d", e->attrs->igp_metric);
+    u64 metric = bgp_total_aigp_metric(e);
+    if (metric < BGP_AIGP_MAX)
+    {
+      buf += bsprintf(buf, "/%lu", metric);
+    }
+    else if (metric = rt_get_igp_metric(e))
+    {
+      if (!rte_resolvable(e))
+	buf += bsprintf(buf, "/-");
+      else if (metric >= IGP_METRIC_UNKNOWN)
+	buf += bsprintf(buf, "/?");
+      else
+	buf += bsprintf(buf, "/%d", metric);
+    }
   }
   buf += bsprintf(buf, ") [");
 
diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 96df671f..33849b0b 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -101,6 +101,7 @@
  * RFC 8203 - BGP Administrative Shutdown Communication
  * RFC 8212 - Default EBGP Route Propagation Behavior without Policies
  * RFC 8654 - Extended Message Support for BGP
+ * RFC 9117 - Revised Validation Procedure for BGP Flow Specifications
  * draft-ietf-idr-ext-opt-param-07
  * draft-uttaro-idr-bgp-persistence-04
  * draft-walton-bgp-hostname-capability-02
@@ -113,7 +114,7 @@
 #include "nest/bird.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/cli.h"
 #include "nest/locks.h"
 #include "conf/conf.h"
@@ -125,9 +126,7 @@
 #include "bgp.h"
 
 
-struct linpool *bgp_linpool;		/* Global temporary pool */
-struct linpool *bgp_linpool2;		/* Global temporary pool for bgp_rt_notify() */
-static list bgp_sockets;		/* Global list of listening sockets */
+static list STATIC_LIST_INIT(bgp_sockets);		/* Global list of listening sockets */
 
 
 static void bgp_connect(struct bgp_proto *p);
@@ -141,13 +140,7 @@ static int bgp_incoming_connection(sock *sk, uint dummy UNUSED);
 static void bgp_listen_sock_err(sock *sk UNUSED, int err);
 
 static void bgp_graceful_restart_feed(struct bgp_channel *c);
-static inline void channel_refresh_end_reload(struct channel *c)
-{
-  channel_refresh_end(c);
 
-  if (c->in_table)
-    channel_request_reload(c);
-}
 
 /**
  * bgp_open - open a BGP instance
@@ -166,16 +159,17 @@ bgp_open(struct bgp_proto *p)
   ip_addr addr = p->cf->strict_bind ? p->cf->local_ip :
     (p->ipv4 ? IPA_NONE4 : IPA_NONE6);
   uint port = p->cf->local_port;
-
-  /* FIXME: Add some global init? */
-  if (!bgp_linpool)
-    init_list(&bgp_sockets);
+  uint flags = p->cf->free_bind ? SKF_FREEBIND : 0;
+  uint flag_mask = SKF_FREEBIND;
 
   /* We assume that cf->iface is defined iff cf->local_ip is link-local */
 
   WALK_LIST(bs, bgp_sockets)
-    if (ipa_equal(bs->sk->saddr, addr) && (bs->sk->sport == port) &&
-	(bs->sk->iface == ifa) && (bs->sk->vrf == p->p.vrf))
+    if (ipa_equal(bs->sk->saddr, addr) &&
+	(bs->sk->sport == port) &&
+	(bs->sk->iface == ifa) &&
+	(bs->sk->vrf == p->p.vrf) &&
+	((bs->sk->flags & flag_mask) == flags))
     {
       bs->uc++;
       p->sock = bs;
@@ -189,7 +183,7 @@ bgp_open(struct bgp_proto *p)
   sk->sport = port;
   sk->iface = ifa;
   sk->vrf = p->p.vrf;
-  sk->flags = 0;
+  sk->flags = flags;
   sk->tos = IP_PREC_INTERNET_CONTROL;
   sk->rbsize = BGP_RX_BUFFER_SIZE;
   sk->tbsize = BGP_TX_BUFFER_SIZE;
@@ -207,12 +201,6 @@ bgp_open(struct bgp_proto *p)
 
   add_tail(&bgp_sockets, &bs->n);
 
-  if (!bgp_linpool)
-  {
-    bgp_linpool  = lp_new_default(proto_pool);
-    bgp_linpool2 = lp_new_default(proto_pool);
-  }
-
   return 0;
 
 err:
@@ -241,15 +229,6 @@ bgp_close(struct bgp_proto *p)
   rfree(bs->sk);
   rem_node(&bs->n);
   mb_free(bs);
-
-  if (!EMPTY_LIST(bgp_sockets))
-    return;
-
-  rfree(bgp_linpool);
-  bgp_linpool = NULL;
-
-  rfree(bgp_linpool2);
-  bgp_linpool2 = NULL;
 }
 
 static inline int
@@ -397,6 +376,7 @@ bgp_close_conn(struct bgp_conn *conn)
   conn->keepalive_timer = NULL;
   rfree(conn->hold_timer);
   conn->hold_timer = NULL;
+
   rfree(conn->tx_ev);
   conn->tx_ev = NULL;
   rfree(conn->sk);
@@ -535,6 +515,7 @@ void
 bgp_stop(struct bgp_proto *p, int subcode, byte *data, uint len)
 {
   proto_notify_state(&p->p, PS_STOP);
+  p->uncork_ev->data = NULL;
   bgp_graceful_close_conn(&p->outgoing_conn, subcode, data, len);
   bgp_graceful_close_conn(&p->incoming_conn, subcode, data, len);
   ev_schedule(p->event);
@@ -784,16 +765,16 @@ bgp_handle_graceful_restart(struct bgp_proto *p)
       {
       case BGP_GRS_NONE:
 	c->gr_active = BGP_GRS_ACTIVE;
-	channel_refresh_begin(&c->c);
+	rt_refresh_begin(&c->c.in_req);
 	break;
 
       case BGP_GRS_ACTIVE:
-	channel_refresh_end(&c->c);
-	channel_refresh_begin(&c->c);
+	rt_refresh_end(&c->c.in_req);
+	rt_refresh_begin(&c->c.in_req);
 	break;
 
       case BGP_GRS_LLGR:
-	channel_refresh_begin(&c->c);
+	rt_refresh_begin(&c->c.in_req);
 	bgp_graceful_restart_feed(c);
 	break;
       }
@@ -801,8 +782,8 @@ bgp_handle_graceful_restart(struct bgp_proto *p)
     else
     {
       /* Just flush the routes */
-      channel_refresh_begin(&c->c);
-      channel_refresh_end(&c->c);
+      rt_refresh_begin(&c->c.in_req);
+      rt_refresh_end(&c->c.in_req);
     }
 
     /* Reset bucket and prefix tables */
@@ -861,10 +842,12 @@ bgp_graceful_restart_feed(struct bgp_channel *c)
     .export_one = bgp_graceful_restart_drop_export,
   };
 
-  rt_request_export(c->c.table, &c->stale_feed);
+  rt_request_export(&c->c.table->exporter, &c->stale_feed);
 }
 
 
+
+
 /**
  * bgp_graceful_restart_done - finish active BGP graceful restart
  * @c: BGP channel
@@ -887,11 +870,8 @@ bgp_graceful_restart_done(struct bgp_channel *c)
   if (!p->gr_active_num)
     BGP_TRACE(D_EVENTS, "Neighbor graceful restart done");
 
-  if (c->stale_feed.hook)
-    rt_stop_export(&c->stale_feed, bgp_graceful_restart_feed_done);
-
   tm_stop(c->stale_timer);
-  channel_refresh_end_reload(&c->c);
+  rt_refresh_end(&c->c.in_req);
 }
 
 /**
@@ -971,7 +951,7 @@ bgp_refresh_begin(struct bgp_channel *c)
   { log(L_WARN "%s: BEGIN-OF-RR received before END-OF-RIB, ignoring", p->p.name); return; }
 
   c->load_state = BFS_REFRESHING;
-  channel_refresh_begin(&c->c);
+  rt_refresh_begin(&c->c.in_req);
 }
 
 /**
@@ -992,7 +972,7 @@ bgp_refresh_end(struct bgp_channel *c)
   { log(L_WARN "%s: END-OF-RR received without prior BEGIN-OF-RR, ignoring", p->p.name); return; }
 
   c->load_state = BFS_NONE;
-  channel_refresh_end_reload(&c->c);
+  rt_refresh_end(&c->c.in_req);
 }
 
 
@@ -1459,9 +1439,12 @@ bgp_reload_routes(struct channel *C)
   struct bgp_proto *p = (void *) C->proto;
   struct bgp_channel *c = (void *) C;
 
-  ASSERT(p->conn && (p->route_refresh));
+  ASSERT(p->conn && (p->route_refresh || (C->in_keep & RIK_PREFILTER)));
 
-  bgp_schedule_packet(p->conn, c, PKT_ROUTE_REFRESH);
+  if (C->in_keep & RIK_PREFILTER)
+    channel_schedule_reload(C);
+  else
+    bgp_schedule_packet(p->conn, c, PKT_ROUTE_REFRESH);
 }
 
 static void
@@ -1595,6 +1578,8 @@ bgp_start(struct proto *P)
   p->last_rx_update = 0;
 
   p->event = ev_new_init(p->p.pool, bgp_decision, p);
+  p->uncork_ev = ev_new_init(p->p.pool, bgp_uncork, p);
+
   p->startup_timer = tm_new_init(p->p.pool, bgp_startup_timeout, p, 0, 0);
   p->gr_timer = tm_new_init(p->p.pool, bgp_graceful_restart_timeout, p, 0, 0);
 
@@ -1783,6 +1768,9 @@ bgp_channel_init(struct channel *C, struct channel_config *CF)
 
   if (cf->igp_table_ip6)
     c->igp_table_ip6 = cf->igp_table_ip6->table;
+
+  if (cf->base_table)
+    c->base_table = cf->base_table->table;
 }
 
 static int
@@ -1798,15 +1786,22 @@ bgp_channel_start(struct channel *C)
   if (c->igp_table_ip6)
     rt_lock_table(c->igp_table_ip6);
 
+  if (c->base_table)
+  {
+    rt_lock_table(c->base_table);
+    rt_flowspec_link(c->base_table, c->c.table);
+  }
+
   c->pool = p->p.pool; // XXXX
-  bgp_init_bucket_table(c);
-  bgp_init_prefix_table(c);
 
   if (c->cf->import_table)
-    channel_setup_in_table(C, 0);
+    channel_setup_in_table(C);
 
   if (c->cf->export_table)
-    channel_setup_out_table(C);
+    bgp_setup_out_table(c);
+
+  bgp_init_bucket_table(c);
+  bgp_init_prefix_table(c);
 
   c->stale_timer = tm_new_init(c->pool, bgp_long_lived_stale_timeout, c, 0, 0);
 
@@ -1882,6 +1877,12 @@ bgp_channel_cleanup(struct channel *C)
   if (c->igp_table_ip6)
     rt_unlock_table(c->igp_table_ip6);
 
+  if (c->base_table)
+  {
+    rt_flowspec_unlink(c->base_table, c->c.table);
+    rt_unlock_table(c->base_table);
+  }
+
   c->index = 0;
 
   /* Cleanup rest of bgp_channel starting at pool field */
@@ -1929,6 +1930,25 @@ bgp_default_igp_table(struct bgp_config *cf, struct bgp_channel_config *cc, u32
   cf_error("Undefined IGP table");
 }
 
+static struct rtable_config *
+bgp_default_base_table(struct bgp_config *cf, struct bgp_channel_config *cc)
+{
+  /* Expected table type */
+  u32 type = (cc->afi == BGP_AF_FLOW4) ? NET_IP4 : NET_IP6;
+
+  /* First, try appropriate IP channel */
+  u32 afi2 = BGP_AF(BGP_AFI(cc->afi), BGP_SAFI_UNICAST);
+  struct bgp_channel_config *cc2 = bgp_find_channel_config(cf, afi2);
+  if (cc2 && (cc2->c.table->addr_type == type))
+    return cc2->c.table;
+
+  /* Last, try default table of given type */
+  struct rtable_config *tab = cf->c.global->def_tables[type];
+  if (tab)
+    return tab;
+
+  cf_error("Undefined base table");
+}
 
 void
 bgp_postconfig(struct proto_config *CF)
@@ -2073,6 +2093,14 @@ bgp_postconfig(struct proto_config *CF)
 	cf_error("Mismatched IGP table type");
     }
 
+    /* Default value of base table */
+    if ((BGP_SAFI(cc->afi) == BGP_SAFI_FLOW) && cc->validate && !cc->base_table)
+      cc->base_table = bgp_default_base_table(cf, cc);
+
+    if (cc->base_table && !cc->base_table->trie_used)
+      cf_error("Flowspec validation requires base table (%s) with trie",
+	       cc->base_table->name);
+
     if (cf->multihop && (cc->gw_mode == GW_DIRECT))
       cf_error("Multihop BGP cannot use direct gateway mode");
 
@@ -2141,7 +2169,7 @@ bgp_reconfigure(struct proto *P, struct proto_config *CF)
   return same;
 }
 
-#define IGP_TABLE(cf, sym) ((cf)->igp_table_##sym ? (cf)->igp_table_##sym ->table : NULL )
+#define TABLE(cf, NAME) ((cf)->NAME ? (cf)->NAME->table : NULL )
 
 static int
 bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *import_changed, int *export_changed)
@@ -2152,6 +2180,7 @@ bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *impor
   struct bgp_channel_config *old = c->cf;
 
   if ((new->secondary != old->secondary) ||
+      (new->validate != old->validate) ||
       (new->gr_able != old->gr_able) ||
       (new->llgr_able != old->llgr_able) ||
       (new->llgr_time != old->llgr_time) ||
@@ -2159,8 +2188,9 @@ bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *impor
       (new->add_path != old->add_path) ||
       (new->import_table != old->import_table) ||
       (new->export_table != old->export_table) ||
-      (IGP_TABLE(new, ip4) != IGP_TABLE(old, ip4)) ||
-      (IGP_TABLE(new, ip6) != IGP_TABLE(old, ip6)))
+      (TABLE(new, igp_table_ip4) != TABLE(old, igp_table_ip4)) ||
+      (TABLE(new, igp_table_ip6) != TABLE(old, igp_table_ip6)) ||
+      (TABLE(new, base_table) != TABLE(old, base_table)))
     return 0;
 
   if (new->mandatory && !old->mandatory && (C->channel_state != CS_UP))
@@ -2171,7 +2201,7 @@ bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *impor
       (new->cost != old->cost))
   {
     /* import_changed itself does not force ROUTE_REFRESH when import_table is active */
-    if (c->c.in_table && (c->c.channel_state == CS_UP))
+    if ((c->c.in_keep & RIK_PREFILTER) && (c->c.channel_state == CS_UP))
       bgp_schedule_packet(p->conn, c, PKT_ROUTE_REFRESH);
 
     *import_changed = 1;
@@ -2485,6 +2515,9 @@ bgp_show_proto_info(struct proto *P)
   else
     cli_msg(-1006, "    Neighbor address: %I%J", p->remote_ip, p->cf->iface);
 
+  if ((p->conn == &p->outgoing_conn) && (p->cf->remote_port != BGP_PORT))
+    cli_msg(-1006, "    Neighbor port:    %u", p->cf->remote_port);
+
   cli_msg(-1006, "    Neighbor AS:      %u", p->remote_as);
   cli_msg(-1006, "    Local AS:         %u", p->cf->local_as);
 
@@ -2574,6 +2607,9 @@ bgp_show_proto_info(struct proto *P)
 
       if (c->igp_table_ip6)
 	cli_msg(-1006, "    IGP IPv6 table: %s", c->igp_table_ip6->name);
+
+      if (c->base_table)
+	cli_msg(-1006, "    Base table:     %s", c->base_table->name);
     }
   }
 }
@@ -2591,7 +2627,6 @@ struct channel_class channel_bgp = {
 struct protocol proto_bgp = {
   .name = 		"BGP",
   .template = 		"bgp%d",
-  .class =		PROTOCOL_BGP,
   .preference = 	DEF_PREF_BGP,
   .channel_mask =	NB_IP | NB_VPN | NB_FLOW,
   .proto_size =		sizeof(struct bgp_proto),
@@ -2603,7 +2638,12 @@ struct protocol proto_bgp = {
   .reconfigure = 	bgp_reconfigure,
   .copy_config = 	bgp_copy_config,
   .get_status = 	bgp_get_status,
-  .get_attr = 		bgp_get_attr,
   .get_route_info = 	bgp_get_route_info,
   .show_proto_info = 	bgp_show_proto_info
 };
+
+void bgp_build(void)
+{
+  proto_build(&proto_bgp);
+  bgp_register_attrs();
+}
diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h
index 342dc023..469f0cb9 100644
--- a/proto/bgp/bgp.h
+++ b/proto/bgp/bgp.h
@@ -14,13 +14,12 @@
 #include <stdint.h>
 #include <setjmp.h>
 #include "nest/bird.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/bfd.h"
 //#include "lib/lists.h"
 #include "lib/hash.h"
 #include "lib/socket.h"
 
-struct linpool;
 struct eattr;
 
 
@@ -68,10 +67,10 @@ struct bgp_af_desc {
   u8 no_igp;
   const char *name;
   uint (*encode_nlri)(struct bgp_write_state *s, struct bgp_bucket *buck, byte *buf, uint size);
-  void (*decode_nlri)(struct bgp_parse_state *s, byte *pos, uint len, rta *a);
+  void (*decode_nlri)(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a);
   void (*update_next_hop)(struct bgp_export_state *s, eattr *nh, ea_list **to);
   uint (*encode_next_hop)(struct bgp_write_state *s, eattr *nh, byte *buf, uint size);
-  void (*decode_next_hop)(struct bgp_parse_state *s, byte *pos, uint len, rta *a);
+  void (*decode_next_hop)(struct bgp_parse_state *s, byte *pos, uint len, ea_list **to);
 };
 
 
@@ -86,6 +85,7 @@ struct bgp_config {
   int peer_type;			/* Internal or external BGP (BGP_PT_*, optional) */
   int multihop;				/* Number of hops if multihop */
   int strict_bind;			/* Bind listening socket to local address */
+  int free_bind;			/* Bind listening socket with SKF_FREEBIND */
   int ttl_security;			/* Enable TTL security [RFC 5082] */
   int compare_path_lengths;		/* Use path lengths when selecting best route */
   int med_metric;			/* Compare MULTI_EXIT_DISC even between routes from differen ASes */
@@ -146,6 +146,7 @@ struct bgp_channel_config {
   u8 mandatory;				/* Channel is mandatory in capability negotiation */
   u8 gw_mode;				/* How we compute route gateway from next_hop attr, see GW_* */
   u8 secondary;				/* Accept also non-best routes (i.e. RA_ACCEPTED) */
+  u8 validate;				/* Validate Flowspec per RFC 8955 (6) */
   u8 gr_able;				/* Allow full graceful restart for the channel */
   u8 llgr_able;				/* Allow full long-lived GR for the channel */
   uint llgr_time;			/* Long-lived graceful restart stale time */
@@ -155,10 +156,11 @@ struct bgp_channel_config {
   u8 aigp_originate;			/* AIGP is originated automatically */
   u32 cost;				/* IGP cost for direct next hops */
   u8 import_table;			/* Use c.in_table as Adj-RIB-In */
-  u8 export_table;			/* Use c.out_table as Adj-RIB-Out */
+  u8 export_table;			/* Keep Adj-RIB-Out and export it */
 
   struct rtable_config *igp_table_ip4;	/* Table for recursive IPv4 next hop lookups */
   struct rtable_config *igp_table_ip6;	/* Table for recursive IPv6 next hop lookups */
+  struct rtable_config *base_table;	/* Base table for Flowspec validation */
 };
 
 #define BGP_PT_INTERNAL		1
@@ -317,6 +319,7 @@ struct bgp_proto {
   struct bgp_socket *sock;		/* Shared listening socket */
   struct bfd_request *bfd_req;		/* BFD request, if BFD is used */
   struct birdsock *postponed_sk;	/* Postponed incoming socket for dynamic BGP */
+  event *uncork_ev;			/* Uncork event in case of congestion */
   struct bgp_stats stats;		/* BGP statistics */
   btime last_established;		/* Last time of enter/leave of established state */
   btime last_rx_update;			/* Last time of RX update */
@@ -344,6 +347,7 @@ struct bgp_channel {
 
   rtable *igp_table_ip4;		/* Table for recursive IPv4 next hop lookups */
   rtable *igp_table_ip6;		/* Table for recursive IPv6 next hop lookups */
+  rtable *base_table;			/* Base table for Flowspec validation */
 
   /* Rest are zeroed when down */
   pool *pool;
@@ -354,6 +358,8 @@ struct bgp_channel {
   HASH(struct bgp_prefix) prefix_hash;	/* Prefixes to be sent */
   slab *prefix_slab;			/* Slab holding prefix nodes */
 
+  struct rt_exporter prefix_exporter;	/* Table-like exporter for prefix_hash */
+
   ip_addr next_hop_addr;		/* Local address for NEXT_HOP attribute */
   ip_addr link_addr;			/* Link-local version of next_hop_addr */
 
@@ -376,8 +382,11 @@ struct bgp_channel {
 };
 
 struct bgp_prefix {
-  node buck_node;			/* Node in per-bucket list */
+  node buck_node_xx;			/* Node in per-bucket list */
   struct bgp_prefix *next;		/* Node in prefix hash table */
+  struct bgp_bucket *last;		/* Last bucket sent with this prefix */
+  struct bgp_bucket *cur;		/* Current bucket (cur == last) if no update is required */
+  btime lastmod;			/* Last modification of this prefix */
   u32 hash;
   u32 path_id;
   net_addr net[0];
@@ -386,8 +395,9 @@ struct bgp_prefix {
 struct bgp_bucket {
   node send_node;			/* Node in send queue */
   struct bgp_bucket *next;		/* Node in bucket hash table */
-  list prefixes;			/* Prefixes in this bucket (struct bgp_prefix) */
+  list prefixes;			/* Prefixes to send in this bucket (struct bgp_prefix) */
   u32 hash;				/* Hash over extended attributes */
+  u32 px_uc;				/* How many prefixes are linking this bucket */
   ea_list eattrs[0];			/* Per-bucket extended attributes */
 };
 
@@ -401,7 +411,7 @@ struct bgp_export_state {
   int mpls;
 
   u32 attrs_seen[1];
-  uint err_withdraw;
+  uint err_reject;
   uint local_next_hop;
 };
 
@@ -427,6 +437,7 @@ struct bgp_parse_state {
   int as4_session;
   int add_path;
   int mpls;
+  int reach_nlri_step;
 
   u32 attrs_seen[256/32];
 
@@ -453,13 +464,12 @@ struct bgp_parse_state {
   uint err_subcode;
   jmp_buf err_jmpbuf;
 
-  struct hostentry *hostentry;
   adata *mpls_labels;
 
   /* Cached state for bgp_rte_update() */
   u32 last_id;
   struct rte_src *last_src;
-  rta *cached_rta;
+  ea_list *cached_ea;
 };
 
 #define BGP_PORT		179
@@ -494,9 +504,6 @@ bgp_parse_error(struct bgp_parse_state *s, uint subcode)
   longjmp(s->err_jmpbuf, 1);
 }
 
-extern struct linpool *bgp_linpool;
-extern struct linpool *bgp_linpool2;
-
 
 void bgp_start_timer(timer *t, uint value);
 void bgp_check_config(struct bgp_config *c);
@@ -518,9 +525,14 @@ struct rte_source *bgp_find_source(struct bgp_proto *p, u32 path_id);
 struct rte_source *bgp_get_source(struct bgp_proto *p, u32 path_id);
 
 static inline int
-rta_resolvable(rta *a)
+rte_resolvable(const rte *rt)
 {
-  return a->dest == RTD_UNICAST;
+  eattr *nhea = ea_find(rt->attrs, &ea_gen_nexthop);
+  if (!nhea)
+    return 0;
+
+  struct nexthop_adata *nhad = (void *) nhea->u.ptr;
+  return NEXTHOP_IS_REACHABLE(nhad) || (nhad->dest != RTD_UNREACHABLE);
 }
 
 
@@ -538,75 +550,56 @@ rta_resolvable(rta *a)
 
 /* attrs.c */
 
-static inline eattr *
-bgp_find_attr(ea_list *attrs, uint code)
-{
-  return ea_find(attrs, EA_CODE(PROTOCOL_BGP, code));
-}
-
 eattr *
-bgp_set_attr(ea_list **attrs, struct linpool *pool, uint code, uint flags, uintptr_t val);
-
-static inline void
-bgp_set_attr_u32(ea_list **to, struct linpool *pool, uint code, uint flags, u32 val)
-{ bgp_set_attr(to, pool, code, flags, (uintptr_t) val); }
-
-static inline void
-bgp_set_attr_ptr(ea_list **to, struct linpool *pool, uint code, uint flags, const struct adata *val)
-{ bgp_set_attr(to, pool, code, flags, (uintptr_t) val); }
-
-static inline void
-bgp_set_attr_data(ea_list **to, struct linpool *pool, uint code, uint flags, void *data, uint len)
-{
-  struct adata *a = lp_alloc_adata(pool, len);
-  bmemcpy(a->data, data, len);
-  bgp_set_attr(to, pool, code, flags, (uintptr_t) a);
-}
+bgp_find_attr(ea_list *attrs, uint code);
 
-static inline void
-bgp_unset_attr(ea_list **to, struct linpool *pool, uint code)
-{ eattr *e = bgp_set_attr(to, pool, code, 0, 0); e->type = EAF_TYPE_UNDEF; }
+void bgp_set_attr_u32(ea_list **to, uint code, uint flags, u32 val);
+void bgp_set_attr_ptr(ea_list **to, uint code, uint flags, const struct adata *ad);
+void bgp_set_attr_data(ea_list **to, uint code, uint flags, void *data, uint len);
+void bgp_unset_attr(ea_list **to, uint code);
 
 int bgp_encode_mp_reach_mrt(struct bgp_write_state *s, eattr *a, byte *buf, uint size);
 
 int bgp_encode_attrs(struct bgp_write_state *s, ea_list *attrs, byte *buf, byte *end);
 ea_list * bgp_decode_attrs(struct bgp_parse_state *s, byte *data, uint len);
-void bgp_finish_attrs(struct bgp_parse_state *s, rta *a);
+void bgp_finish_attrs(struct bgp_parse_state *s, ea_list **to);
+
+void bgp_setup_out_table(struct bgp_channel *c);
 
 void bgp_init_bucket_table(struct bgp_channel *c);
 void bgp_free_bucket_table(struct bgp_channel *c);
-void bgp_free_bucket(struct bgp_channel *c, struct bgp_bucket *b);
-void bgp_defer_bucket(struct bgp_channel *c, struct bgp_bucket *b);
 void bgp_withdraw_bucket(struct bgp_channel *c, struct bgp_bucket *b);
+int bgp_done_bucket(struct bgp_channel *c, struct bgp_bucket *b);
 
 void bgp_init_prefix_table(struct bgp_channel *c);
 void bgp_free_prefix_table(struct bgp_channel *c);
-void bgp_free_prefix(struct bgp_channel *c, struct bgp_prefix *bp);
+void bgp_done_prefix(struct bgp_channel *c, struct bgp_prefix *px, struct bgp_bucket *buck);
 
 int bgp_rte_better(struct rte *, struct rte *);
 int bgp_rte_mergable(rte *pri, rte *sec);
 int bgp_rte_recalculate(rtable *table, net *net, rte *new, rte *old, rte *old_best);
-void bgp_rte_modify_stale(struct rt_export_request *, const net_addr *, struct rt_pending_export *, rte **, uint);
-u32 bgp_rte_igp_metric(struct rte *);
+void bgp_rte_modify_stale(struct rt_export_request *req, const net_addr *n, struct rt_pending_export *rpe UNUSED, rte **feed, uint count);
+u32 bgp_rte_igp_metric(const rte *);
 void bgp_rt_notify(struct proto *P, struct channel *C, const net_addr *n, rte *new, const rte *old);
 int bgp_preexport(struct channel *, struct rte *);
-int bgp_get_attr(const struct eattr *e, byte *buf, int buflen);
 void bgp_get_route_info(struct rte *, byte *);
-int bgp_total_aigp_metric_(rta *a, u64 *metric, const struct adata **ad);
+int bgp_total_aigp_metric_(const rte *e, u64 *metric, const struct adata **ad);
 
 #define BGP_AIGP_METRIC		1
 #define BGP_AIGP_MAX		U64(0xffffffffffffffff)
 
 static inline u64
-bgp_total_aigp_metric(rta *a)
+bgp_total_aigp_metric(const rte *e)
 {
   u64 metric = BGP_AIGP_MAX;
   const struct adata *ad;
 
-  bgp_total_aigp_metric_(a, &metric, &ad);
+  bgp_total_aigp_metric_(e, &metric, &ad);
   return metric;
 }
 
+void bgp_register_attrs(void);
+
 
 /* packets.c */
 
@@ -618,6 +611,7 @@ void bgp_schedule_packet(struct bgp_conn *conn, struct bgp_channel *c, int type)
 void bgp_kick_tx(void *vconn);
 void bgp_tx(struct birdsock *sk);
 int bgp_rx(struct birdsock *sk, uint size);
+void bgp_uncork(void *vp);
 const char * bgp_error_dsc(unsigned code, unsigned subcode);
 void bgp_log_error(struct bgp_proto *p, u8 class, char *msg, unsigned code, unsigned subcode, byte *data, unsigned len);
 
@@ -643,26 +637,31 @@ void bgp_update_next_hop(struct bgp_export_state *s, eattr *a, ea_list **to);
 
 #define BAF_DECODE_FLAGS	0x0100	/* Private flag - attribute flags are handled by the decode hook */
 
-#define BA_ORIGIN		0x01	/* RFC 4271 */		/* WM */
-#define BA_AS_PATH		0x02				/* WM */
-#define BA_NEXT_HOP		0x03				/* WM */
-#define BA_MULTI_EXIT_DISC	0x04				/* ON */
-#define BA_LOCAL_PREF		0x05				/* WD */
-#define BA_ATOMIC_AGGR		0x06				/* WD */
-#define BA_AGGREGATOR		0x07				/* OT */
-#define BA_COMMUNITY		0x08	/* RFC 1997 */		/* OT */
-#define BA_ORIGINATOR_ID	0x09	/* RFC 4456 */		/* ON */
-#define BA_CLUSTER_LIST		0x0a	/* RFC 4456 */		/* ON */
-#define BA_MP_REACH_NLRI	0x0e	/* RFC 4760 */
-#define BA_MP_UNREACH_NLRI	0x0f	/* RFC 4760 */
-#define BA_EXT_COMMUNITY	0x10	/* RFC 4360 */
-#define BA_AS4_PATH             0x11	/* RFC 6793 */
-#define BA_AS4_AGGREGATOR       0x12	/* RFC 6793 */
-#define BA_AIGP			0x1a	/* RFC 7311 */
-#define BA_LARGE_COMMUNITY	0x20	/* RFC 8092 */
+enum bgp_attr_id {
+  BA_ORIGIN		= 0x01,	/* RFC 4271 */		/* WM */
+  BA_AS_PATH		= 0x02,				/* WM */
+  BA_NEXT_HOP		= 0x03,				/* WM */
+  BA_MULTI_EXIT_DISC	= 0x04,				/* ON */
+  BA_LOCAL_PREF		= 0x05,				/* WD */
+  BA_ATOMIC_AGGR	= 0x06,				/* WD */
+  BA_AGGREGATOR		= 0x07,				/* OT */
+  BA_COMMUNITY		= 0x08,	/* RFC 1997 */		/* OT */
+  BA_ORIGINATOR_ID	= 0x09,	/* RFC 4456 */		/* ON */
+  BA_CLUSTER_LIST	= 0x0a,	/* RFC 4456 */		/* ON */
+  BA_MP_REACH_NLRI	= 0x0e,	/* RFC 4760 */
+  BA_MP_UNREACH_NLRI	= 0x0f,	/* RFC 4760 */
+  BA_EXT_COMMUNITY	= 0x10,	/* RFC 4360 */
+  BA_AS4_PATH		= 0x11,	/* RFC 6793 */
+  BA_AS4_AGGREGATOR	= 0x12,	/* RFC 6793 */
+  BA_AIGP		= 0x1a,	/* RFC 7311 */
+  BA_LARGE_COMMUNITY	= 0x20,	/* RFC 8092 */
 
 /* Bird's private internal BGP attributes */
-#define BA_MPLS_LABEL_STACK	0xfe	/* MPLS label stack transfer attribute */
+  BA_MPLS_LABEL_STACK	= 0x100, /* MPLS label stack transfer attribute */
+
+/* Maximum */
+  BGP_ATTR_MAX,
+};
 
 /* BGP connection states */
 
diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y
index 2dfbdca9..24f3ec8f 100644
--- a/proto/bgp/config.Y
+++ b/proto/bgp/config.Y
@@ -19,19 +19,18 @@ CF_DECLS
 
 CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, KEEPALIVE,
 	MULTIHOP, STARTUP, VIA, NEXT, HOP, SELF, DEFAULT, PATH, METRIC, ERROR,
-	START, DELAY, FORGET, WAIT, ENABLE, DISABLE, AFTER, BGP_PATH,
-	BGP_LOCAL_PREF, BGP_MED, BGP_ORIGIN, BGP_NEXT_HOP, BGP_ATOMIC_AGGR,
-	BGP_AGGREGATOR, BGP_COMMUNITY, BGP_EXT_COMMUNITY, BGP_LARGE_COMMUNITY,
+	START, DELAY, FORGET, WAIT, ENABLE, DISABLE, AFTER,
+	BGP_LOCAL_PREF, BGP_MED, 
 	SOURCE, ADDRESS, PASSWORD, RR, RS, CLIENT, CLUSTER, ID, AS4, ADVERTISE,
 	IPV4, CAPABILITIES, LIMIT, PASSIVE, PREFER, OLDER, MISSING, LLADDR,
-	DROP, IGNORE, ROUTE, REFRESH, INTERPRET, COMMUNITIES, BGP_ORIGINATOR_ID,
-	BGP_CLUSTER_LIST, IGP, TABLE, GATEWAY, DIRECT, RECURSIVE, MED, TTL,
+	DROP, IGNORE, ROUTE, REFRESH, INTERPRET, COMMUNITIES,
+	IGP, TABLE, GATEWAY, DIRECT, RECURSIVE, MED, TTL,
 	SECURITY, DETERMINISTIC, SECONDARY, ALLOW, BFD, ADD, PATHS, RX, TX,
 	GRACEFUL, RESTART, AWARE, CHECK, LINK, PORT, EXTENDED, MESSAGES, SETKEY,
 	STRICT, BIND, CONFEDERATION, MEMBER, MULTICAST, FLOW4, FLOW6, LONG,
 	LIVED, STALE, IMPORT, IBGP, EBGP, MANDATORY, INTERNAL, EXTERNAL, SETS,
-	DYNAMIC, RANGE, NAME, DIGITS, BGP_AIGP, AIGP, ORIGINATE, COST, ENFORCE,
-	FIRST)
+	DYNAMIC, RANGE, NAME, DIGITS, AIGP, ORIGINATE, COST, ENFORCE,
+	FIRST, FREE, VALIDATE, BASE)
 
 %type <i> bgp_nh
 %type <i32> bgp_afi
@@ -44,6 +43,8 @@ CF_KEYWORDS(CEASE, PREFIX, LIMIT, HIT, ADMINISTRATIVE, SHUTDOWN, RESET, PEER,
 
 CF_GRAMMAR
 
+toksym: BGP_MED | BGP_LOCAL_PREF | SOURCE ;
+
 proto: bgp_proto '}'  ;
 
 bgp_proto_start: proto_start BGP {
@@ -155,6 +156,7 @@ bgp_proto:
    }
  | bgp_proto DYNAMIC NAME DIGITS expr ';' { BGP_CFG->dynamic_name_digits = $5; if ($5>10) cf_error("Dynamic name digits must be at most 10"); }
  | bgp_proto STRICT BIND bool ';' { BGP_CFG->strict_bind = $4; }
+ | bgp_proto FREE BIND bool ';' { BGP_CFG->free_bind = $4; }
  | bgp_proto PATH METRIC bool ';' { BGP_CFG->compare_path_lengths = $4; }
  | bgp_proto MED METRIC bool ';' { BGP_CFG->med_metric = $4; }
  | bgp_proto IGP METRIC bool ';' { BGP_CFG->igp_metric = $4; }
@@ -255,6 +257,11 @@ bgp_channel_item:
  | GATEWAY DIRECT { BGP_CC->gw_mode = GW_DIRECT; }
  | GATEWAY RECURSIVE { BGP_CC->gw_mode = GW_RECURSIVE; }
  | SECONDARY bool { BGP_CC->secondary = $2; }
+ | VALIDATE bool {
+    BGP_CC->validate = $2;
+    if (BGP_SAFI(BGP_CC->afi) != BGP_SAFI_FLOW)
+      cf_error("Validate option limited to flowspec channels");
+   }
  | GRACEFUL RESTART bool { BGP_CC->gr_able = $3; }
  | LONG LIVED GRACEFUL RESTART bool { BGP_CC->llgr_able = $5; }
  | LONG LIVED STALE TIME expr { BGP_CC->llgr_time = $5; }
@@ -278,6 +285,16 @@ bgp_channel_item:
     else
       cf_error("Mismatched IGP table type");
    }
+ | BASE TABLE rtable {
+    if (BGP_SAFI(BGP_CC->afi) != BGP_SAFI_FLOW)
+      cf_error("Base table option limited to flowspec channels");
+
+    if (((BGP_CC->afi == BGP_AF_FLOW4) && ($3->addr_type == NET_IP4)) ||
+        ((BGP_CC->afi == BGP_AF_FLOW6) && ($3->addr_type == NET_IP6)))
+      BGP_CC->base_table = $3;
+    else
+      cf_error("Mismatched base table type");
+   }
  ;
 
 bgp_channel_opts:
@@ -300,36 +317,6 @@ bgp_channel_end:
 
 bgp_proto_channel: bgp_channel_start bgp_channel_opt_list bgp_channel_end;
 
-
-dynamic_attr: BGP_ORIGIN
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_ENUM_BGP_ORIGIN, EA_CODE(PROTOCOL_BGP, BA_ORIGIN)); } ;
-dynamic_attr: BGP_PATH
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_AS_PATH, T_PATH, EA_CODE(PROTOCOL_BGP, BA_AS_PATH)); } ;
-dynamic_attr: BGP_NEXT_HOP
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_IP_ADDRESS, T_IP, EA_CODE(PROTOCOL_BGP, BA_NEXT_HOP)); } ;
-dynamic_attr: BGP_MED
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_CODE(PROTOCOL_BGP, BA_MULTI_EXIT_DISC)); } ;
-dynamic_attr: BGP_LOCAL_PREF
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_CODE(PROTOCOL_BGP, BA_LOCAL_PREF)); } ;
-dynamic_attr: BGP_ATOMIC_AGGR
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_OPAQUE, T_ENUM_EMPTY, EA_CODE(PROTOCOL_BGP, BA_ATOMIC_AGGR)); } ;
-dynamic_attr: BGP_AGGREGATOR
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_OPAQUE, T_ENUM_EMPTY, EA_CODE(PROTOCOL_BGP, BA_AGGREGATOR)); } ;
-dynamic_attr: BGP_COMMUNITY
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_INT_SET, T_CLIST, EA_CODE(PROTOCOL_BGP, BA_COMMUNITY)); } ;
-dynamic_attr: BGP_ORIGINATOR_ID
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_ROUTER_ID, T_QUAD, EA_CODE(PROTOCOL_BGP, BA_ORIGINATOR_ID)); } ;
-dynamic_attr: BGP_CLUSTER_LIST
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_INT_SET, T_CLIST, EA_CODE(PROTOCOL_BGP, BA_CLUSTER_LIST)); } ;
-dynamic_attr: BGP_EXT_COMMUNITY
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_EC_SET, T_ECLIST, EA_CODE(PROTOCOL_BGP, BA_EXT_COMMUNITY)); } ;
-dynamic_attr: BGP_AIGP
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_OPAQUE, T_ENUM_EMPTY, EA_CODE(PROTOCOL_BGP, BA_AIGP)); } ;
-dynamic_attr: BGP_LARGE_COMMUNITY
-	{ $$ = f_new_dynamic_attr(EAF_TYPE_LC_SET, T_LCLIST, EA_CODE(PROTOCOL_BGP, BA_LARGE_COMMUNITY)); } ;
-
-
-
 CF_ENUM(T_ENUM_BGP_ORIGIN, ORIGIN_, IGP, EGP, INCOMPLETE)
 
 CF_CODE
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 647551e5..de976588 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -15,8 +15,8 @@
 #include "nest/bird.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
-#include "nest/attrs.h"
+#include "nest/rt.h"
+#include "lib/attrs.h"
 #include "proto/mrt/mrt.h"
 #include "conf/conf.h"
 #include "lib/unaligned.h"
@@ -932,14 +932,18 @@ bgp_rx_open(struct bgp_conn *conn, byte *pkt, uint len)
 #define WITHDRAW(msg, args...) \
   ({ REPORT(msg, ## args); s->err_withdraw = 1; return; })
 
+#define REJECT(msg, args...)						\
+  ({ log(L_ERR "%s: " msg, s->proto->p.name, ## args); s->err_reject = 1; return; })
+
 #define BAD_AFI		"Unexpected AF <%u/%u> in UPDATE"
 #define BAD_NEXT_HOP	"Invalid NEXT_HOP attribute"
 #define NO_NEXT_HOP	"Missing NEXT_HOP attribute"
 #define NO_LABEL_STACK	"Missing MPLS stack"
 
+#define MISMATCHED_AF	" - mismatched address family (%I for %s)"
 
 static void
-bgp_apply_next_hop(struct bgp_parse_state *s, rta *a, ip_addr gw, ip_addr ll)
+bgp_apply_next_hop(struct bgp_parse_state *s, ea_list **to, ip_addr gw, ip_addr ll)
 {
   struct bgp_proto *p = s->proto;
   struct bgp_channel *c = s->channel;
@@ -949,67 +953,86 @@ bgp_apply_next_hop(struct bgp_parse_state *s, rta *a, ip_addr gw, ip_addr ll)
     neighbor *nbr = NULL;
 
     /* GW_DIRECT -> single_hop -> p->neigh != NULL */
-    if (ipa_nonzero(gw))
+    if (ipa_nonzero2(gw))
       nbr = neigh_find(&p->p, gw, NULL, 0);
     else if (ipa_nonzero(ll))
       nbr = neigh_find(&p->p, ll, p->neigh->iface, 0);
+    else
+      WITHDRAW(BAD_NEXT_HOP " - zero address");
+
+    if (!nbr)
+      WITHDRAW(BAD_NEXT_HOP " - address %I not directly reachable", ipa_nonzero(gw) ? gw : ll);
+
+    if (nbr->scope == SCOPE_HOST)
+      WITHDRAW(BAD_NEXT_HOP " - address %I is local", nbr->addr);
 
-    if (!nbr || (nbr->scope == SCOPE_HOST))
-      WITHDRAW(BAD_NEXT_HOP);
+    ea_set_attr_u32(to, &ea_gen_igp_metric, 0, c->cf->cost);
 
-    a->dest = RTD_UNICAST;
-    a->nh.gw = nbr->addr;
-    a->nh.iface = nbr->iface;
-    a->igp_metric = c->cf->cost;
+    struct nexthop_adata nhad = {
+      .nh = {
+	.gw = nbr->addr,
+	.iface = nbr->iface,
+      },
+      .ad = {
+	.length = sizeof nhad - sizeof nhad.ad,
+      },
+    };
+    ea_set_attr_data(to, &ea_gen_nexthop, 0, nhad.ad.data, nhad.ad.length);
   }
   else /* GW_RECURSIVE */
   {
-    if (ipa_zero(gw))
-      WITHDRAW(BAD_NEXT_HOP);
+    if (ipa_zero2(gw))
+      WITHDRAW(BAD_NEXT_HOP " - zero address");
 
     rtable *tab = ipa_is_ip4(gw) ? c->igp_table_ip4 : c->igp_table_ip6;
-    s->hostentry = rt_get_hostentry(tab, gw, ll, c->c.table);
-
-    if (!s->mpls)
-      rta_apply_hostentry(a, s->hostentry, NULL);
-
-    /* With MPLS, hostentry is applied later in bgp_apply_mpls_labels() */
+    if (s->mpls)
+    {
+      u32 labels[BGP_MPLS_MAX];
+      ea_set_hostentry(to, c->c.table, tab, gw, ll, BGP_MPLS_MAX, labels);
+    }
+    else
+      ea_set_hostentry(to, c->c.table, tab, gw, ll, 0, NULL);
   }
 }
 
 static void
-bgp_apply_mpls_labels(struct bgp_parse_state *s, rta *a, u32 *labels, uint lnum)
+bgp_apply_mpls_labels(struct bgp_parse_state *s, ea_list **to, u32 lnum, u32 labels[lnum])
 {
   if (lnum > MPLS_MAX_LABEL_STACK)
   {
     REPORT("Too many MPLS labels ($u)", lnum);
 
-    a->dest = RTD_UNREACHABLE;
-    a->hostentry = NULL;
-    a->nh = (struct nexthop) { };
+    ea_set_dest(to, 0, RTD_UNREACHABLE);
     return;
   }
 
   /* Handle implicit NULL as empty MPLS stack */
   if ((lnum == 1) && (labels[0] == BGP_MPLS_NULL))
-    lnum = 0;
+    lnum = s->mpls_labels->length = 0;
 
   if (s->channel->cf->gw_mode == GW_DIRECT)
   {
-    a->nh.labels = lnum;
-    memcpy(a->nh.label, labels, 4*lnum);
+    eattr *e = ea_find(*to, &ea_gen_nexthop);
+    struct {
+      struct nexthop_adata nhad;
+      u32 labels[MPLS_MAX_LABEL_STACK];
+    } nh;
+    
+    memcpy(&nh.nhad, e->u.ptr, sizeof(struct adata) + e->u.ptr->length);
+    nh.nhad.nh.labels = lnum;
+    memcpy(nh.labels, labels, lnum * sizeof(u32));
+    nh.nhad.ad.length = sizeof nh.nhad + lnum * sizeof(u32);
   }
   else /* GW_RECURSIVE */
   {
-    mpls_label_stack ms;
-
-    ms.len = lnum;
-    memcpy(ms.stack, labels, 4*lnum);
-    rta_apply_hostentry(a, s->hostentry, &ms);
+    eattr *e = ea_find(*to, &ea_gen_hostentry);
+    ASSERT_DIE(e);
+    struct hostentry_adata *head = (void *) e->u.ptr;
+    memcpy(&head->labels, labels, lnum * sizeof(u32));
+    head->ad.length = (void *)(&head->labels[lnum]) - (void *) head->ad.data;
   }
 }
 
-
 static int
 bgp_match_src(struct bgp_export_state *s, int mode)
 {
@@ -1039,7 +1062,7 @@ bgp_use_next_hop(struct bgp_export_state *s, eattr *a)
     return 1;
 
   /* Keep it when explicitly set in export filter */
-  if (a->type & EAF_FRESH)
+  if (a->fresh)
     return 1;
 
   /* Check for non-matching AF */
@@ -1056,31 +1079,41 @@ bgp_use_next_hop(struct bgp_export_state *s, eattr *a)
   return p->neigh && (p->neigh->iface == ifa);
 }
 
-static inline int
+static inline struct nexthop *
 bgp_use_gateway(struct bgp_export_state *s)
 {
   struct bgp_proto *p = s->proto;
   struct bgp_channel *c = s->channel;
-  rta *ra = s->route->attrs;
+  ea_list *ra = s->route->attrs;
 
   /* Handle next hop self option - also applies to gateway */
   if (c->cf->next_hop_self && bgp_match_src(s, c->cf->next_hop_self))
-    return 0;
+    return NULL;
+
+  eattr *nhea = ea_find(ra, &ea_gen_nexthop);
+  if (!nhea)
+    return NULL;
 
   /* We need one valid global gateway */
-  if ((ra->dest != RTD_UNICAST) || ra->nh.next || ipa_zero(ra->nh.gw) || ipa_is_link_local(ra->nh.gw))
-    return 0;
+  struct nexthop_adata *nhad = (struct nexthop_adata *) nhea->u.ptr;
+  if (!NEXTHOP_IS_REACHABLE(nhad) ||
+      !NEXTHOP_ONE(nhad) || ipa_zero(nhad->nh.gw) ||
+      ipa_is_link_local(nhad->nh.gw))
+    return NULL;
 
   /* Check for non-matching AF */
-  if ((ipa_is_ip4(ra->nh.gw) != bgp_channel_is_ipv4(c)) && !c->ext_next_hop)
-    return 0;
+  if ((ipa_is_ip4(nhad->nh.gw) != bgp_channel_is_ipv4(c)) && !c->ext_next_hop)
+    return NULL;
 
   /* Use it when exported to internal peers */
   if (p->is_interior)
-    return 1;
+    return &nhad->nh;
 
   /* Use it when forwarded to single-hop BGP peer on on the same iface */
-  return p->neigh && (p->neigh->iface == ra->nh.iface);
+  if (p->neigh && (p->neigh->iface == nhad->nh.iface))
+    return &nhad->nh;
+
+  return NULL;
 }
 
 static void
@@ -1088,31 +1121,31 @@ bgp_update_next_hop_ip(struct bgp_export_state *s, eattr *a, ea_list **to)
 {
   if (!a || !bgp_use_next_hop(s, a))
   {
-    if (bgp_use_gateway(s))
+    struct nexthop *nhloc;
+    if (nhloc = bgp_use_gateway(s))
     {
-      rta *ra = s->route->attrs;
-      ip_addr nh[1] = { ra->nh.gw };
-      bgp_set_attr_data(to, s->pool, BA_NEXT_HOP, 0, nh, 16);
+      ip_addr nh[1] = { nhloc->gw };
+      bgp_set_attr_data(to, BA_NEXT_HOP, 0, nh, 16);
 
       if (s->mpls)
       {
 	u32 implicit_null = BGP_MPLS_NULL;
-	u32 *labels = ra->nh.labels ? ra->nh.label : &implicit_null;
-	uint lnum = ra->nh.labels ? ra->nh.labels : 1;
-	bgp_set_attr_data(to, s->pool, BA_MPLS_LABEL_STACK, 0, labels, lnum * 4);
+	u32 *labels = nhloc->labels ? nhloc->label : &implicit_null;
+	uint lnum = nhloc->labels ? nhloc->labels : 1;
+	bgp_set_attr_data(to, BA_MPLS_LABEL_STACK, 0, labels, lnum * 4);
       }
     }
     else
     {
       ip_addr nh[2] = { s->channel->next_hop_addr, s->channel->link_addr };
-      bgp_set_attr_data(to, s->pool, BA_NEXT_HOP, 0, nh, ipa_nonzero(nh[1]) ? 32 : 16);
+      bgp_set_attr_data(to, BA_NEXT_HOP, 0, nh, ipa_nonzero(nh[1]) ? 32 : 16);
       s->local_next_hop = 1;
 
       /* TODO: Use local MPLS assigned label */
       if (s->mpls)
       {
 	u32 implicit_null = BGP_MPLS_NULL;
-	bgp_set_attr_data(to, s->pool, BA_MPLS_LABEL_STACK, 0, &implicit_null, 4);
+	bgp_set_attr_data(to, BA_MPLS_LABEL_STACK, 0, &implicit_null, 4);
       }
     }
   }
@@ -1120,28 +1153,28 @@ bgp_update_next_hop_ip(struct bgp_export_state *s, eattr *a, ea_list **to)
   /* Check if next hop is valid */
   a = bgp_find_attr(*to, BA_NEXT_HOP);
   if (!a)
-    WITHDRAW(NO_NEXT_HOP);
+    REJECT(NO_NEXT_HOP);
 
   ip_addr *nh = (void *) a->u.ptr->data;
   ip_addr peer = s->proto->remote_ip;
   uint len = a->u.ptr->length;
 
   /* Forbid zero next hop */
-  if (ipa_zero(nh[0]) && ((len != 32) || ipa_zero(nh[1])))
-    WITHDRAW(BAD_NEXT_HOP);
+  if (ipa_zero2(nh[0]) && ((len != 32) || ipa_zero(nh[1])))
+    REJECT(BAD_NEXT_HOP " - zero address");
 
   /* Forbid next hop equal to neighbor IP */
   if (ipa_equal(peer, nh[0]) || ((len == 32) && ipa_equal(peer, nh[1])))
-    WITHDRAW(BAD_NEXT_HOP);
+    REJECT(BAD_NEXT_HOP " - neighbor address %I", peer);
 
   /* Forbid next hop with non-matching AF */
   if ((ipa_is_ip4(nh[0]) != bgp_channel_is_ipv4(s->channel)) &&
       !s->channel->ext_next_hop)
-    WITHDRAW(BAD_NEXT_HOP);
+    REJECT(BAD_NEXT_HOP MISMATCHED_AF, nh[0], s->channel->desc->name);
 
   /* Just check if MPLS stack */
   if (s->mpls && !bgp_find_attr(*to, BA_MPLS_LABEL_STACK))
-    WITHDRAW(NO_LABEL_STACK);
+    REJECT(NO_LABEL_STACK);
 }
 
 static uint
@@ -1175,7 +1208,7 @@ bgp_encode_next_hop_ip(struct bgp_write_state *s, eattr *a, byte *buf, uint size
 }
 
 static void
-bgp_decode_next_hop_ip(struct bgp_parse_state *s, byte *data, uint len, rta *a)
+bgp_decode_next_hop_ip(struct bgp_parse_state *s, byte *data, uint len, ea_list **to)
 {
   struct bgp_channel *c = s->channel;
   struct adata *ad = lp_alloc_adata(s->pool, 32);
@@ -1212,12 +1245,12 @@ bgp_decode_next_hop_ip(struct bgp_parse_state *s, byte *data, uint len, rta *a)
     ad->length = 16;
 
   if ((bgp_channel_is_ipv4(c) != ipa_is_ip4(nh[0])) && !c->ext_next_hop)
-    WITHDRAW(BAD_NEXT_HOP);
+    WITHDRAW(BAD_NEXT_HOP MISMATCHED_AF, nh[0], c->desc->name);
 
   // XXXX validate next hop
 
-  bgp_set_attr_ptr(&(a->eattrs), s->pool, BA_NEXT_HOP, 0, ad);
-  bgp_apply_next_hop(s, a, nh[0], nh[1]);
+  bgp_set_attr_ptr(to, BA_NEXT_HOP, 0, ad);
+  bgp_apply_next_hop(s, to, nh[0], nh[1]);
 }
 
 static uint
@@ -1255,7 +1288,7 @@ bgp_encode_next_hop_vpn(struct bgp_write_state *s, eattr *a, byte *buf, uint siz
 }
 
 static void
-bgp_decode_next_hop_vpn(struct bgp_parse_state *s, byte *data, uint len, rta *a)
+bgp_decode_next_hop_vpn(struct bgp_parse_state *s, byte *data, uint len, ea_list **to)
 {
   struct bgp_channel *c = s->channel;
   struct adata *ad = lp_alloc_adata(s->pool, 32);
@@ -1293,12 +1326,12 @@ bgp_decode_next_hop_vpn(struct bgp_parse_state *s, byte *data, uint len, rta *a)
     bgp_parse_error(s, 9);
 
   if ((bgp_channel_is_ipv4(c) != ipa_is_ip4(nh[0])) && !c->ext_next_hop)
-    WITHDRAW(BAD_NEXT_HOP);
+    WITHDRAW(BAD_NEXT_HOP MISMATCHED_AF, nh[0], c->desc->name);
 
   // XXXX validate next hop
 
-  bgp_set_attr_ptr(&(a->eattrs), s->pool, BA_NEXT_HOP, 0, ad);
-  bgp_apply_next_hop(s, a, nh[0], nh[1]);
+  bgp_set_attr_ptr(to, BA_NEXT_HOP, 0, ad);
+  bgp_apply_next_hop(s, to, nh[0], nh[1]);
 }
 
 
@@ -1310,7 +1343,7 @@ bgp_encode_next_hop_none(struct bgp_write_state *s UNUSED, eattr *a UNUSED, byte
 }
 
 static void
-bgp_decode_next_hop_none(struct bgp_parse_state *s UNUSED, byte *data UNUSED, uint len UNUSED, rta *a UNUSED)
+bgp_decode_next_hop_none(struct bgp_parse_state *s UNUSED, byte *data UNUSED, uint len UNUSED, ea_list **to UNUSED)
 {
   /*
    * Although we expect no next hop and RFC 7606 7.11 states that attribute
@@ -1322,11 +1355,11 @@ bgp_decode_next_hop_none(struct bgp_parse_state *s UNUSED, byte *data UNUSED, ui
 }
 
 static void
-bgp_update_next_hop_none(struct bgp_export_state *s, eattr *a, ea_list **to)
+bgp_update_next_hop_none(struct bgp_export_state *s UNUSED, eattr *a, ea_list **to)
 {
   /* NEXT_HOP shall not pass */
   if (a)
-    bgp_unset_attr(to, s->pool, BA_NEXT_HOP);
+    bgp_unset_attr(to, BA_NEXT_HOP);
 }
 
 
@@ -1335,35 +1368,34 @@ bgp_update_next_hop_none(struct bgp_export_state *s, eattr *a, ea_list **to)
  */
 
 static void
-bgp_rte_update(struct bgp_parse_state *s, net_addr *n, u32 path_id, rta *a0)
+bgp_rte_update(struct bgp_parse_state *s, const net_addr *n, u32 path_id, ea_list *a0)
 {
   if (path_id != s->last_id)
   {
     s->last_src = rt_get_source(&s->proto->p, path_id);
     s->last_id = path_id;
 
-    rta_free(s->cached_rta);
-    s->cached_rta = NULL;
+    ea_free(s->cached_ea);
+    s->cached_ea = NULL;
   }
 
   if (!a0)
   {
+    /* Route update was changed to withdraw */
+    if (s->err_withdraw && s->reach_nlri_step)
+      REPORT("Invalid route %N withdrawn", n);
+
     /* Route withdraw */
     rte_update(&s->channel->c, n, NULL, s->last_src);
     return;
   }
 
   /* Prepare cached route attributes */
-  if (s->cached_rta == NULL)
-  {
-    /* Workaround for rta_lookup() breaking eattrs */
-    ea_list *ea = a0->eattrs;
-    s->cached_rta = rta_lookup(a0);
-    a0->eattrs = ea;
-  }
+  if (s->cached_ea == NULL)
+    s->cached_ea = ea_lookup(a0, 0);
 
   rte e0 = {
-    .attrs = s->cached_rta,
+    .attrs = s->cached_ea,
     .src = s->last_src,
   };
 
@@ -1390,9 +1422,10 @@ bgp_encode_mpls_labels(struct bgp_write_state *s UNUSED, const adata *mpls, byte
 }
 
 static void
-bgp_decode_mpls_labels(struct bgp_parse_state *s, byte **pos, uint *len, uint *pxlen, rta *a)
+bgp_decode_mpls_labels(struct bgp_parse_state *s, byte **pos, uint *len, uint *pxlen, ea_list **to)
 {
-  u32 labels[BGP_MPLS_MAX], label;
+  u32 labels[BGP_MPLS_MAX];
+  u32 label;
   uint lnum = 0;
 
   do {
@@ -1406,31 +1439,20 @@ bgp_decode_mpls_labels(struct bgp_parse_state *s, byte **pos, uint *len, uint *p
 
     /* RFC 8277 2.4 - withdraw does not have variable-size MPLS stack but
        fixed-size 24-bit Compatibility field, which MUST be ignored */
-    if (!a && !s->err_withdraw)
+    if (!s->reach_nlri_step)
       return;
   }
   while (!(label & BGP_MPLS_BOS));
 
-  if (!a)
+  if (!*to)
     return;
 
-  /* Attach MPLS attribute unless we already have one */
-  if (!s->mpls_labels)
-  {
-    s->mpls_labels = lp_alloc_adata(s->pool, 4*BGP_MPLS_MAX);
-    bgp_set_attr_ptr(&(a->eattrs), s->pool, BA_MPLS_LABEL_STACK, 0, s->mpls_labels);
-  }
-
-  /* Overwrite data in the attribute */
-  s->mpls_labels->length = 4*lnum;
-  memcpy(s->mpls_labels->data, labels, 4*lnum);
-
   /* Update next hop entry in rta */
-  bgp_apply_mpls_labels(s, a, labels, lnum);
+  bgp_apply_mpls_labels(s, to, lnum, labels);
 
   /* Attributes were changed, invalidate cached entry */
-  rta_free(s->cached_rta);
-  s->cached_rta = NULL;
+  rta_free(s->cached_ea);
+  s->cached_ea = NULL;
 
   return;
 }
@@ -1466,14 +1488,14 @@ bgp_encode_nlri_ip4(struct bgp_write_state *s, struct bgp_bucket *buck, byte *bu
     memcpy(pos, &a, b);
     ADVANCE(pos, size, b);
 
-    bgp_free_prefix(s->channel, px);
+    bgp_done_prefix(s->channel, px, buck);
   }
 
   return pos - buf;
 }
 
 static void
-bgp_decode_nlri_ip4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
+bgp_decode_nlri_ip4(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a)
 {
   while (len)
   {
@@ -1499,7 +1521,7 @@ bgp_decode_nlri_ip4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
 
     /* Decode MPLS labels */
     if (s->mpls)
-      bgp_decode_mpls_labels(s, &pos, &len, &l, a);
+      bgp_decode_mpls_labels(s, &pos, &len, &l, &a);
 
     if (l > IP4_MAX_PREFIX_LENGTH)
       bgp_parse_error(s, 10);
@@ -1551,14 +1573,14 @@ bgp_encode_nlri_ip6(struct bgp_write_state *s, struct bgp_bucket *buck, byte *bu
     memcpy(pos, &a, b);
     ADVANCE(pos, size, b);
 
-    bgp_free_prefix(s->channel, px);
+    bgp_done_prefix(s->channel, px, buck);
   }
 
   return pos - buf;
 }
 
 static void
-bgp_decode_nlri_ip6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
+bgp_decode_nlri_ip6(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a)
 {
   while (len)
   {
@@ -1584,7 +1606,7 @@ bgp_decode_nlri_ip6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
 
     /* Decode MPLS labels */
     if (s->mpls)
-      bgp_decode_mpls_labels(s, &pos, &len, &l, a);
+      bgp_decode_mpls_labels(s, &pos, &len, &l, &a);
 
     if (l > IP6_MAX_PREFIX_LENGTH)
       bgp_parse_error(s, 10);
@@ -1639,14 +1661,14 @@ bgp_encode_nlri_vpn4(struct bgp_write_state *s, struct bgp_bucket *buck, byte *b
     memcpy(pos, &a, b);
     ADVANCE(pos, size, b);
 
-    bgp_free_prefix(s->channel, px);
+    bgp_done_prefix(s->channel, px, buck);
   }
 
   return pos - buf;
 }
 
 static void
-bgp_decode_nlri_vpn4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
+bgp_decode_nlri_vpn4(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a)
 {
   while (len)
   {
@@ -1672,7 +1694,7 @@ bgp_decode_nlri_vpn4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
 
     /* Decode MPLS labels */
     if (s->mpls)
-      bgp_decode_mpls_labels(s, &pos, &len, &l, a);
+      bgp_decode_mpls_labels(s, &pos, &len, &l, &a);
 
     /* Decode route distinguisher */
     if (l < 64)
@@ -1736,14 +1758,14 @@ bgp_encode_nlri_vpn6(struct bgp_write_state *s, struct bgp_bucket *buck, byte *b
     memcpy(pos, &a, b);
     ADVANCE(pos, size, b);
 
-    bgp_free_prefix(s->channel, px);
+    bgp_done_prefix(s->channel, px, buck);
   }
 
   return pos - buf;
 }
 
 static void
-bgp_decode_nlri_vpn6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
+bgp_decode_nlri_vpn6(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a)
 {
   while (len)
   {
@@ -1769,7 +1791,7 @@ bgp_decode_nlri_vpn6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
 
     /* Decode MPLS labels */
     if (s->mpls)
-      bgp_decode_mpls_labels(s, &pos, &len, &l, a);
+      bgp_decode_mpls_labels(s, &pos, &len, &l, &a);
 
     /* Decode route distinguisher */
     if (l < 64)
@@ -1823,14 +1845,14 @@ bgp_encode_nlri_flow4(struct bgp_write_state *s, struct bgp_bucket *buck, byte *
     memcpy(pos, net->data, flen);
     ADVANCE(pos, size, flen);
 
-    bgp_free_prefix(s->channel, px);
+    bgp_done_prefix(s->channel, px, buck);
   }
 
   return pos - buf;
 }
 
 static void
-bgp_decode_nlri_flow4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
+bgp_decode_nlri_flow4(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a)
 {
   while (len)
   {
@@ -1911,14 +1933,14 @@ bgp_encode_nlri_flow6(struct bgp_write_state *s, struct bgp_bucket *buck, byte *
     memcpy(pos, net->data, flen);
     ADVANCE(pos, size, flen);
 
-    bgp_free_prefix(s->channel, px);
+    bgp_done_prefix(s->channel, px, buck);
   }
 
   return pos - buf;
 }
 
 static void
-bgp_decode_nlri_flow6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
+bgp_decode_nlri_flow6(struct bgp_parse_state *s, byte *pos, uint len, ea_list *a)
 {
   while (len)
   {
@@ -2145,6 +2167,8 @@ bgp_create_ip_reach(struct bgp_write_state *s, struct bgp_bucket *buck, byte *bu
    *	var	IPv4 Network Layer Reachability Information
    */
 
+  ASSERT_DIE(s->channel->withdraw_bucket != buck);
+
   int lr, la;
 
   la = bgp_encode_attrs(s, buck->eattrs, buf+4, buf + MAX_ATTRS_LENGTH);
@@ -2166,6 +2190,8 @@ bgp_create_ip_reach(struct bgp_write_state *s, struct bgp_bucket *buck, byte *bu
 static byte *
 bgp_create_mp_reach(struct bgp_write_state *s, struct bgp_bucket *buck, byte *buf, byte *end)
 {
+  ASSERT_DIE(s->channel->withdraw_bucket != buck);
+
   /*
    *	2 B	IPv4 Withdrawn Routes Length (zero)
    *	---	IPv4 Withdrawn Routes NLRI (unused)
@@ -2289,11 +2315,14 @@ bgp_create_update(struct bgp_channel *c, byte *buf)
 
 again: ;
 
+  struct lp_state tmpp;
+  lp_save(tmp_linpool, &tmpp);
+
   /* Initialize write state */
   struct bgp_write_state s = {
     .proto = p,
     .channel = c,
-    .pool = bgp_linpool,
+    .pool = tmp_linpool,
     .mp_reach = (c->afi != BGP_AF_IPV4) || c->ext_next_hop,
     .as4_session = p->as4_session,
     .add_path = c->add_path_tx,
@@ -2316,9 +2345,9 @@ again: ;
     buck = HEAD(c->bucket_queue);
 
     /* Cleanup empty buckets */
-    if (EMPTY_LIST(buck->prefixes))
+    if (bgp_done_bucket(c, buck))
     {
-      bgp_free_bucket(c, buck);
+      lp_restore(tmp_linpool, &tmpp);
       goto again;
     }
 
@@ -2326,13 +2355,13 @@ again: ;
       bgp_create_ip_reach(&s, buck, buf, end):
       bgp_create_mp_reach(&s, buck, buf, end);
 
-    if (EMPTY_LIST(buck->prefixes))
-      bgp_free_bucket(c, buck);
-    else
-      bgp_defer_bucket(c, buck);
+    bgp_done_bucket(c, buck);
 
     if (!res)
+    {
+      lp_restore(tmp_linpool, &tmpp);
       goto again;
+    }
 
     goto done;
   }
@@ -2343,7 +2372,7 @@ again: ;
 done:
   BGP_TRACE_RL(&rl_snd_update, D_PACKETS, "Sending UPDATE");
   p->stats.tx_updates++;
-  lp_flush(s.pool);
+  lp_restore(tmp_linpool, &tmpp);
 
   return res;
 }
@@ -2410,7 +2439,6 @@ static inline void
 bgp_decode_nlri(struct bgp_parse_state *s, u32 afi, byte *nlri, uint len, ea_list *ea, byte *nh, uint nh_len)
 {
   struct bgp_channel *c = bgp_get_channel(s->proto, afi);
-  rta *a = NULL;
 
   if (!c)
     DISCARD(BAD_AFI, BGP_AFI(afi), BGP_SAFI(afi));
@@ -2431,26 +2459,22 @@ bgp_decode_nlri(struct bgp_parse_state *s, u32 afi, byte *nlri, uint len, ea_lis
 
   if (ea)
   {
-    a = allocz(RTA_MAX_SIZE);
-
-    a->source = RTS_BGP;
-    a->scope = SCOPE_UNIVERSE;
-    a->from = s->proto->remote_ip;
-    a->eattrs = ea;
-    a->pref = c->c.preference;
+    ea_set_attr_data(&ea, &ea_gen_from, 0, &s->proto->remote_ip, sizeof(ip_addr));
+    ea_set_attr_u32(&ea, &ea_gen_preference, 0, c->c.preference);
+    ea_set_attr_u32(&ea, &ea_gen_source, 0, RTS_BGP);
 
-    c->desc->decode_next_hop(s, nh, nh_len, a);
-    bgp_finish_attrs(s, a);
+    c->desc->decode_next_hop(s, nh, nh_len, &ea);
+    bgp_finish_attrs(s, &ea);
 
     /* Handle withdraw during next hop decoding */
     if (s->err_withdraw)
-      a = NULL;
+      ea = NULL;
   }
 
-  c->desc->decode_nlri(s, nlri, len, a);
+  c->desc->decode_nlri(s, nlri, len, ea);
 
-  rta_free(s->cached_rta);
-  s->cached_rta = NULL;
+  rta_free(s->cached_ea);
+  s->cached_ea = NULL;
 }
 
 static void
@@ -2472,10 +2496,13 @@ bgp_rx_update(struct bgp_conn *conn, byte *pkt, uint len)
 
   bgp_start_timer(conn->hold_timer, conn->hold_time);
 
+  struct lp_state tmpp;
+  lp_save(tmp_linpool, &tmpp);
+
   /* Initialize parse state */
   struct bgp_parse_state s = {
     .proto = p,
-    .pool = bgp_linpool,
+    .pool = tmp_linpool,
     .as4_session = p->as4_session,
   };
 
@@ -2541,6 +2568,8 @@ bgp_rx_update(struct bgp_conn *conn, byte *pkt, uint len)
   if (s.mp_unreach_len)
     bgp_decode_nlri(&s, s.mp_unreach_af, s.mp_unreach_nlri, s.mp_unreach_len, NULL, NULL, 0);
 
+  s.reach_nlri_step = 1;
+
   if (s.ip_reach_len)
     bgp_decode_nlri(&s, BGP_AF_IPV4, s.ip_reach_nlri, s.ip_reach_len,
 		    ea, s.ip_next_hop_data, s.ip_next_hop_len);
@@ -2550,8 +2579,8 @@ bgp_rx_update(struct bgp_conn *conn, byte *pkt, uint len)
 		    ea, s.mp_next_hop_data, s.mp_next_hop_len);
 
 done:
-  rta_free(s.cached_rta);
-  lp_flush(s.pool);
+  rta_free(s.cached_ea);
+  lp_restore(tmp_linpool, &tmpp);
   return;
 }
 
@@ -2874,7 +2903,11 @@ bgp_schedule_packet(struct bgp_conn *conn, struct bgp_channel *c, int type)
 {
   ASSERT(conn->sk);
 
-  DBG("BGP: Scheduling packet type %d\n", type);
+  struct bgp_proto *p = conn->bgp;
+  if (c)
+    BGP_TRACE(D_PACKETS, "Scheduling packet type %d for channel %s", type, c->c.name);
+  else
+    BGP_TRACE(D_PACKETS, "Scheduling packet type %d", type);
 
   if (c)
   {
@@ -3142,6 +3175,21 @@ bgp_rx_packet(struct bgp_conn *conn, byte *pkt, uint len)
   }
 }
 
+void
+bgp_uncork(void *vp)
+{
+  struct bgp_proto *p = vp;
+
+  if (p && p->conn && (p->conn->state == BS_ESTABLISHED) && !p->conn->sk->rx_hook)
+  {
+    struct birdsock *sk = p->conn->sk;
+    ASSERT_DIE(sk->rpos > sk->rbuf);
+    sk->rx_hook = bgp_rx;
+    bgp_rx(sk, sk->rpos - sk->rbuf);
+    BGP_TRACE(D_PACKETS, "Uncorked");
+  }
+}
+
 /**
  * bgp_rx - handle received data
  * @sk: socket
@@ -3156,6 +3204,7 @@ int
 bgp_rx(sock *sk, uint size)
 {
   struct bgp_conn *conn = sk->data;
+  struct bgp_proto *p = conn->bgp;
   byte *pkt_start = sk->rbuf;
   byte *end = pkt_start + size;
   uint i, len;
@@ -3165,6 +3214,12 @@ bgp_rx(sock *sk, uint size)
     {
       if ((conn->state == BS_CLOSE) || (conn->sk != sk))
 	return 0;
+      if ((conn->state == BS_ESTABLISHED) && rt_cork_check(conn->bgp->uncork_ev))
+      {
+	sk->rx_hook = NULL;
+	BGP_TRACE(D_PACKETS, "Corked");
+	return 0;
+      }
       for(i=0; i<16; i++)
 	if (pkt_start[i] != 0xff)
 	  {
diff --git a/proto/mrt/Makefile b/proto/mrt/Makefile
index 925fb102..000e1c1c 100644
--- a/proto/mrt/Makefile
+++ b/proto/mrt/Makefile
@@ -2,5 +2,6 @@ src := mrt.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,mrt_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/mrt/mrt.c b/proto/mrt/mrt.c
index 5da3c7c6..5ef4cd44 100644
--- a/proto/mrt/mrt.c
+++ b/proto/mrt/mrt.c
@@ -423,7 +423,7 @@ mrt_rib_table_header(struct mrt_table_dump_state *s, net_addr *n)
 static void
 mrt_rib_table_entry_bgp_attrs(struct mrt_table_dump_state *s, rte *r)
 {
-  struct ea_list *eattrs = r->attrs->eattrs;
+  struct ea_list *eattrs = r->attrs;
   buffer *b = &s->buf;
 
   if (!eattrs)
@@ -431,7 +431,7 @@ mrt_rib_table_entry_bgp_attrs(struct mrt_table_dump_state *s, rte *r)
 
   /* Attribute list must be normalized for bgp_encode_attrs() */
   if (!rta_is_cached(r->attrs))
-    ea_normalize(eattrs);
+    eattrs = ea_normalize(eattrs, 0);
 
   mrt_buffer_need(b, MRT_ATTR_BUFFER_SIZE);
   byte *pos = b->pos;
@@ -525,7 +525,7 @@ mrt_rib_table_dump(struct mrt_table_dump_state *s, net *n, int add_path)
     }
 
     rte e = rt->rte;
-    if (f_run(s->filter, &e, s->linpool, 0) <= F_ACCEPT)
+    if (f_run(s->filter, &e, 0) <= F_ACCEPT)
       mrt_rib_table_entry(s, &e);
 
     lp_flush(s->linpool);
@@ -557,8 +557,8 @@ mrt_table_dump_init(pool *pp)
   struct mrt_table_dump_state *s = mb_allocz(pool, sizeof(struct mrt_table_dump_state));
 
   s->pool = pool;
-  s->linpool = lp_new(pool, 4080);
-  s->peer_lp = lp_new(pool, 4080);
+  s->linpool = lp_new(pool);
+  s->peer_lp = lp_new(pool);
   mrt_buffer_init(&s->buf, pool, 2 * MRT_ATTR_BUFFER_SIZE);
 
   /* We lock the current config as we may reference it indirectly by filter */
@@ -703,14 +703,17 @@ mrt_dump_cont(struct cli *c)
 
   cli_printf(c, 0, "");
   mrt_table_dump_free(c->rover);
-  c->cont = c->cleanup = c->rover = NULL;
+  c->cont = NULL;
+  c->cleanup = NULL;
+  c->rover = NULL;
 }
 
-static void
+static int
 mrt_dump_cleanup(struct cli *c)
 {
   mrt_table_dump_free(c->rover);
   c->rover = NULL;
+  return 0;
 }
 
 void
@@ -904,7 +907,6 @@ mrt_copy_config(struct proto_config *dest UNUSED, struct proto_config *src UNUSE
 struct protocol proto_mrt = {
   .name =		"MRT",
   .template =		"mrt%d",
-  .class =		PROTOCOL_MRT,
   .proto_size =		sizeof(struct mrt_proto),
   .config_size =	sizeof(struct mrt_config),
   .init =		mrt_init,
@@ -913,3 +915,9 @@ struct protocol proto_mrt = {
   .reconfigure =	mrt_reconfigure,
   .copy_config =	mrt_copy_config,
 };
+
+void
+mrt_build(void)
+{
+  proto_build(&proto_mrt);
+}
diff --git a/proto/mrt/mrt.h b/proto/mrt/mrt.h
index 4ff94c12..3b83aa39 100644
--- a/proto/mrt/mrt.h
+++ b/proto/mrt/mrt.h
@@ -13,7 +13,7 @@
 #include "nest/bird.h"
 #include "nest/protocol.h"
 #include "lib/lists.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "lib/event.h"
 #include "lib/hash.h"
 
diff --git a/proto/ospf/Makefile b/proto/ospf/Makefile
index 39e74f71..85664543 100644
--- a/proto/ospf/Makefile
+++ b/proto/ospf/Makefile
@@ -2,5 +2,6 @@ src := dbdes.c hello.c iface.c lsack.c lsalib.c lsreq.c lsupd.c neighbor.c ospf.
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,ospf_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/ospf/config.Y b/proto/ospf/config.Y
index 4b7d5a36..bc3df8db 100644
--- a/proto/ospf/config.Y
+++ b/proto/ospf/config.Y
@@ -190,7 +190,7 @@ ospf_check_auth(void)
 
 CF_DECLS
 
-CF_KEYWORDS(OSPF, V2, V3, OSPF_METRIC1, OSPF_METRIC2, OSPF_TAG, OSPF_ROUTER_ID)
+CF_KEYWORDS(OSPF, V2, V3)
 CF_KEYWORDS(AREA, NEIGHBORS, RFC1583COMPAT, STUB, TICK, COST, COST2, RETRANSMIT)
 CF_KEYWORDS(HELLO, TRANSMIT, PRIORITY, DEAD, TYPE, BROADCAST, BCAST, DEFAULT)
 CF_KEYWORDS(NONBROADCAST, NBMA, POINTOPOINT, PTP, POINTOMULTIPOINT, PTMP)
@@ -505,11 +505,6 @@ ospf_iface:
   ospf_iface_start ospf_iface_patt_list ospf_iface_opt_list { ospf_iface_finish(); }
  ;
 
-dynamic_attr: OSPF_METRIC1 { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_OSPF_METRIC1); } ;
-dynamic_attr: OSPF_METRIC2 { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_OSPF_METRIC2); } ;
-dynamic_attr: OSPF_TAG { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_OSPF_TAG); } ;
-dynamic_attr: OSPF_ROUTER_ID { $$ = f_new_dynamic_attr(EAF_TYPE_ROUTER_ID, T_QUAD, EA_OSPF_ROUTER_ID); } ;
-
 CF_CLI_HELP(SHOW OSPF, ..., [[Show information about OSPF protocol]]);
 CF_CLI(SHOW OSPF, optproto, [<name>], [[Show information about OSPF protocol]])
 { PROTO_WALK_CMD($3, &proto_ospf, p) ospf_sh(p); };
diff --git a/proto/ospf/ospf.c b/proto/ospf/ospf.c
index 22150590..9c25f0f0 100644
--- a/proto/ospf/ospf.c
+++ b/proto/ospf/ospf.c
@@ -106,11 +106,12 @@
 
 #include <stdlib.h>
 #include "ospf.h"
+#include "lib/macro.h"
 
 static int ospf_preexport(struct channel *C, rte *new);
 static void ospf_reload_routes(struct channel *C);
 static int ospf_rte_better(struct rte *new, struct rte *old);
-static u32 ospf_rte_igp_metric(struct rte *rt);
+static u32 ospf_rte_igp_metric(const rte *rt);
 static void ospf_disp(timer *timer);
 
 
@@ -299,7 +300,7 @@ ospf_start(struct proto *P)
   p->lsab_size = 256;
   p->lsab_used = 0;
   p->lsab = mb_alloc(P->pool, p->lsab_size);
-  p->nhpool = lp_new(P->pool, 12*sizeof(struct nexthop));
+  p->nhpool = lp_new(P->pool);
   init_list(&(p->iface_list));
   init_list(&(p->area_list));
   fib_init(&p->rtf, P->pool, ospf_get_af(p), sizeof(ort), OFFSETOF(ort, fn), 0, NULL);
@@ -386,23 +387,26 @@ ospf_init(struct proto_config *CF)
 static int
 ospf_rte_better(struct rte *new, struct rte *old)
 {
-  u32 new_metric1 = ea_get_int(new->attrs->eattrs, EA_OSPF_METRIC1, LSINFINITY);
+  u32 new_metric1 = ea_get_int(new->attrs, &ea_ospf_metric1, LSINFINITY);
 
   if (new_metric1 == LSINFINITY)
     return 0;
 
-  if(new->attrs->source < old->attrs->source) return 1;
-  if(new->attrs->source > old->attrs->source) return 0;
+  u32 ns = rt_get_source_attr(new);
+  u32 os = rt_get_source_attr(old);
 
-  if(new->attrs->source == RTS_OSPF_EXT2)
+  if (ns < os) return 1;
+  if (ns > os) return 0;
+
+  if (ns == RTS_OSPF_EXT2)
   {
-    u32 old_metric2 = ea_get_int(old->attrs->eattrs, EA_OSPF_METRIC2, LSINFINITY);
-    u32 new_metric2 = ea_get_int(new->attrs->eattrs, EA_OSPF_METRIC2, LSINFINITY);
-    if(new_metric2 < old_metric2) return 1;
-    if(new_metric2 > old_metric2) return 0;
+    u32 old_metric2 = ea_get_int(old->attrs, &ea_ospf_metric2, LSINFINITY);
+    u32 new_metric2 = ea_get_int(new->attrs, &ea_ospf_metric2, LSINFINITY);
+    if (new_metric2 < old_metric2) return 1;
+    if (new_metric2 > old_metric2) return 0;
   }
 
-  u32 old_metric1 = ea_get_int(old->attrs->eattrs, EA_OSPF_METRIC1, LSINFINITY);
+  u32 old_metric1 = ea_get_int(old->attrs, &ea_ospf_metric1, LSINFINITY);
   if (new_metric1 < old_metric1)
     return 1;
 
@@ -410,12 +414,12 @@ ospf_rte_better(struct rte *new, struct rte *old)
 }
 
 static u32
-ospf_rte_igp_metric(struct rte *rt)
+ospf_rte_igp_metric(const rte *rt)
 {
-  if (rt->attrs->source == RTS_OSPF_EXT2)
+  if (rt_get_source_attr(rt) == RTS_OSPF_EXT2)
     return IGP_METRIC_UNKNOWN;
 
-  return ea_get_int(rt->attrs->eattrs, EA_OSPF_METRIC1, LSINFINITY);
+  return ea_get_int(rt->attrs, &ea_ospf_metric1, LSINFINITY);
 }
 
 void
@@ -482,13 +486,13 @@ ospf_disp(timer * timer)
  * import to the filters.
  */
 static int
-ospf_preexport(struct channel *c, rte *e)
+ospf_preexport(struct channel *C, rte *e)
 {
-  struct ospf_proto *p = (struct ospf_proto *) c->proto;
+  struct ospf_proto *p = (struct ospf_proto *) C->proto;
   struct ospf_area *oa = ospf_main_area(p);
 
   /* Reject our own routes */
-  if (e->src->proto == c->proto)
+  if (e->src->proto == &p->p)
     return -1;
 
   /* Do not export routes to stub areas */
@@ -531,7 +535,7 @@ ospf_shutdown(struct proto *P)
   /* Cleanup locked rta entries */
   FIB_WALK(&p->rtf, ort, nf)
   {
-    rta_free(nf->old_rta);
+    ea_free(nf->old_ea);
   }
   FIB_WALK_END;
 
@@ -570,7 +574,8 @@ ospf_get_route_info(rte * rte, byte * buf)
 {
   char *type = "<bug>";
 
-  switch (rte->attrs->source)
+  uint source = rt_get_source_attr(rte);
+  switch (source)
   {
   case RTS_OSPF:
     type = "I";
@@ -587,42 +592,26 @@ ospf_get_route_info(rte * rte, byte * buf)
   }
 
   buf += bsprintf(buf, " %s", type);
-  buf += bsprintf(buf, " (%d/%d", rte->attrs->pref, ea_get_int(rte->attrs->eattrs, EA_OSPF_METRIC1, LSINFINITY));
-  if (rte->attrs->source == RTS_OSPF_EXT2)
-    buf += bsprintf(buf, "/%d", ea_get_int(rte->attrs->eattrs, EA_OSPF_METRIC2, LSINFINITY));
+  buf += bsprintf(buf, " (%d/%d", rt_get_preference(rte), ea_get_int(rte->attrs, &ea_ospf_metric1, LSINFINITY));
+  if (source == RTS_OSPF_EXT2)
+    buf += bsprintf(buf, "/%d", ea_get_int(rte->attrs, &ea_ospf_metric2, LSINFINITY));
   buf += bsprintf(buf, ")");
-  if (rte->attrs->source == RTS_OSPF_EXT1 || rte->attrs->source == RTS_OSPF_EXT2)
+  if (source == RTS_OSPF_EXT1 || source == RTS_OSPF_EXT2)
   {
-    eattr *ea = ea_find(rte->attrs->eattrs, EA_OSPF_TAG);
+    eattr *ea = ea_find(rte->attrs, &ea_ospf_tag);
     if (ea && (ea->u.data > 0))
       buf += bsprintf(buf, " [%x]", ea->u.data);
   }
   
-  eattr *ea = ea_find(rte->attrs->eattrs, EA_OSPF_ROUTER_ID);
+  eattr *ea = ea_find(rte->attrs, &ea_ospf_router_id);
   if (ea)
     buf += bsprintf(buf, " [%R]", ea->u.data);
 }
 
-static int
-ospf_get_attr(const eattr * a, byte * buf, int buflen UNUSED)
+static void
+ospf_tag_format(const eattr * a, byte * buf, uint buflen)
 {
-  switch (a->id)
-  {
-  case EA_OSPF_METRIC1:
-    bsprintf(buf, "metric1");
-    return GA_NAME;
-  case EA_OSPF_METRIC2:
-    bsprintf(buf, "metric2");
-    return GA_NAME;
-  case EA_OSPF_TAG:
-    bsprintf(buf, "tag: 0x%08x", a->u.data);
-    return GA_FULL;
-  case EA_OSPF_ROUTER_ID:
-    bsprintf(buf, "router_id");
-    return GA_NAME;
-  default:
-    return GA_UNKNOWN;
-  }
+  bsnprintf(buf, buflen, "0x%08x", a->u.data);
 }
 
 static void
@@ -1520,7 +1509,6 @@ ospf_sh_lsadb(struct lsadb_show_data *ld)
 struct protocol proto_ospf = {
   .name =		"OSPF",
   .template =		"ospf%d",
-  .class =		PROTOCOL_OSPF,
   .preference =		DEF_PREF_OSPF,
   .channel_mask =	NB_IP,
   .proto_size =		sizeof(struct ospf_proto),
@@ -1531,6 +1519,39 @@ struct protocol proto_ospf = {
   .shutdown =		ospf_shutdown,
   .reconfigure =	ospf_reconfigure,
   .get_status =		ospf_get_status,
-  .get_attr =		ospf_get_attr,
   .get_route_info =	ospf_get_route_info
 };
+
+struct ea_class ea_ospf_metric1 = {
+  .name = "ospf_metric1",
+  .type = T_INT,
+};
+
+struct ea_class ea_ospf_metric2 = {
+  .name = "ospf_metric2",
+  .type = T_INT,
+};
+
+struct ea_class ea_ospf_tag = {
+  .name = "ospf_tag",
+  .type = T_INT,
+  .format = ospf_tag_format,
+};
+
+struct ea_class ea_ospf_router_id = {
+  .name = "ospf_router_id",
+  .type = T_QUAD,
+};
+
+void
+ospf_build(void)
+{
+  proto_build(&proto_ospf);
+
+  EA_REGISTER_ALL(
+      &ea_ospf_metric1,
+      &ea_ospf_metric2,
+      &ea_ospf_tag,
+      &ea_ospf_router_id
+  );
+}
diff --git a/proto/ospf/ospf.h b/proto/ospf/ospf.h
index 3e704ae8..7bed5c85 100644
--- a/proto/ospf/ospf.h
+++ b/proto/ospf/ospf.h
@@ -22,7 +22,7 @@
 #include "lib/resource.h"
 #include "nest/protocol.h"
 #include "nest/iface.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/cli.h"
 #include "nest/locks.h"
 #include "nest/bfd.h"
@@ -939,12 +939,7 @@ struct lsadb_show_data {
   u32 router;		/* Advertising router, 0 -> all */
 };
 
-
-#define EA_OSPF_METRIC1	EA_CODE(PROTOCOL_OSPF, 0)
-#define EA_OSPF_METRIC2	EA_CODE(PROTOCOL_OSPF, 1)
-#define EA_OSPF_TAG	EA_CODE(PROTOCOL_OSPF, 2)
-#define EA_OSPF_ROUTER_ID EA_CODE(PROTOCOL_OSPF, 3)
-
+extern struct ea_class ea_ospf_metric1, ea_ospf_metric2, ea_ospf_tag, ea_ospf_router_id;
 
 /*
  * For regular networks, neighbor address must match network prefix.
diff --git a/proto/ospf/rt.c b/proto/ospf/rt.c
index 3e208023..69c2907d 100644
--- a/proto/ospf/rt.c
+++ b/proto/ospf/rt.c
@@ -28,24 +28,30 @@ nh_is_vlink(struct nexthop *nhs)
 static inline int
 unresolved_vlink(ort *ort)
 {
-  return ort->n.nhs && nh_is_vlink(ort->n.nhs);
+  return ort->n.nhs && nh_is_vlink(&ort->n.nhs->nh);
 }
 
-static inline struct nexthop *
+static inline struct nexthop_adata *
 new_nexthop(struct ospf_proto *p, ip_addr gw, struct iface *iface, byte weight)
 {
-  struct nexthop *nh = lp_allocz(p->nhpool, sizeof(struct nexthop));
-  nh->gw = gw;
-  nh->iface = iface;
-  nh->weight = weight;
-  return nh;
+  struct nexthop_adata *nhad = lp_alloc(p->nhpool, sizeof(struct nexthop_adata));
+  *nhad = (struct nexthop_adata) {
+    .ad = { .length = sizeof *nhad - sizeof nhad->ad, },
+    .nh = {
+      .gw = gw,
+      .iface = iface,
+      .weight = weight,
+    },
+  };
+
+  return nhad;
 }
 
 /* Returns true if there are device nexthops in n */
 static inline int
-has_device_nexthops(const struct nexthop *n)
+has_device_nexthops(struct nexthop_adata *nhad)
 {
-  for (; n; n = n->next)
+  NEXTHOP_WALK(n, nhad)
     if (ipa_zero(n->gw))
       return 1;
 
@@ -53,38 +59,22 @@ has_device_nexthops(const struct nexthop *n)
 }
 
 /* Replace device nexthops with nexthops to gw */
-static struct nexthop *
-fix_device_nexthops(struct ospf_proto *p, const struct nexthop *n, ip_addr gw)
+static struct nexthop_adata *
+fix_device_nexthops(struct ospf_proto *p, struct nexthop_adata *old, ip_addr gw)
 {
-  struct nexthop *root1 = NULL;
-  struct nexthop *root2 = NULL;
-  struct nexthop **nn1 = &root1;
-  struct nexthop **nn2 = &root2;
-
   if (!p->ecmp)
-    return new_nexthop(p, gw, n->iface, n->weight);
-
-  /* This is a bit tricky. We cannot just copy the list and update n->gw,
-     because the list should stay sorted, so we create two lists, one with new
-     gateways and one with old ones, and then merge them. */
-
-  for (; n; n = n->next)
   {
-    struct nexthop *nn = new_nexthop(p, ipa_zero(n->gw) ? gw : n->gw, n->iface, n->weight);
+    struct nexthop_adata *new = (struct nexthop_adata *) lp_store_adata(p->nhpool, old->ad.data, old->ad.length);
+    new->nh.gw = gw;
+    return new;
+  }
 
+  struct nexthop_adata *tmp = (struct nexthop_adata *) tmp_copy_adata(&old->ad);
+  NEXTHOP_WALK(n, tmp)
     if (ipa_zero(n->gw))
-    {
-      *nn1 = nn;
-      nn1 = &(nn->next);
-    }
-    else
-    {
-      *nn2 = nn;
-      nn2 = &(nn->next);
-    }
-  }
+      n->gw = gw;
 
-  return nexthop_merge(root1, root2, 1, 1, p->ecmp, p->nhpool);
+  return nexthop_sort(tmp, p->nhpool);
 }
 
 
@@ -169,9 +159,9 @@ orta_compare(const struct ospf_proto *p, const orta *new, const orta *old)
     return -1;
   if (!new->nhs)
     return 1;
-  if (nh_is_vlink(new->nhs))
+  if (nh_is_vlink(&new->nhs->nh))
     return -1;
-  if (nh_is_vlink(old->nhs))
+  if (nh_is_vlink(&old->nhs->nh))
     return 1;
 
 
@@ -279,11 +269,7 @@ ort_merge(struct ospf_proto *p, ort *o, const orta *new)
   orta *old = &o->n;
 
   if (old->nhs != new->nhs)
-  {
-    old->nhs = nexthop_merge(old->nhs, new->nhs, old->nhs_reuse, new->nhs_reuse,
-			  p->ecmp, p->nhpool);
-    old->nhs_reuse = 1;
-  }
+    old->nhs = nexthop_merge(old->nhs, new->nhs, p->ecmp, p->nhpool);
 
   if (old->rid < new->rid)
     old->rid = new->rid;
@@ -295,11 +281,7 @@ ort_merge_ext(struct ospf_proto *p, ort *o, const orta *new)
   orta *old = &o->n;
 
   if (old->nhs != new->nhs)
-  {
-    old->nhs = nexthop_merge(old->nhs, new->nhs, old->nhs_reuse, new->nhs_reuse,
-			  p->ecmp, p->nhpool);
-    old->nhs_reuse = 1;
-  }
+    old->nhs = nexthop_merge(old->nhs, new->nhs, p->ecmp, p->nhpool);
 
   if (old->tag != new->tag)
     old->tag = 0;
@@ -1165,7 +1147,7 @@ ospf_check_vlinks(struct ospf_proto *p)
 
       if (tmp && (tmp->color == INSPF) && ipa_nonzero(tmp->lb) && tmp->nhs)
       {
-	struct ospf_iface *nhi = ospf_iface_find(p, tmp->nhs->iface);
+	struct ospf_iface *nhi = ospf_iface_find(p, tmp->nhs->nh.iface);
 
 	if ((ifa->state != OSPF_IS_PTP)
 	    || (ifa->vifa != nhi)
@@ -1579,10 +1561,7 @@ ospf_ext_spf(struct ospf_proto *p)
 
       /* Replace device nexthops with nexthops to forwarding address from LSA */
       if (has_device_nexthops(nfa.nhs))
-      {
 	nfa.nhs = fix_device_nexthops(p, nfa.nhs, rt.fwaddr);
-	nfa.nhs_reuse = 1;
-      }
     }
 
     if (rt.ebit)
@@ -1726,10 +1705,10 @@ ospf_rt_spf(struct ospf_proto *p)
 
 
 static inline int
-inherit_nexthops(struct nexthop *pn)
+inherit_nexthops(struct nexthop_adata *pn)
 {
   /* Proper nexthops (with defined GW) or dummy vlink nexthops (without iface) */
-  return pn && (ipa_nonzero(pn->gw) || !pn->iface);
+  return pn && (ipa_nonzero(pn->nh.gw) || !pn->nh.iface);
 }
 
 static inline ip_addr
@@ -1744,12 +1723,12 @@ link_lsa_lladdr(struct ospf_proto *p, struct top_hash_entry *en)
   return ospf_is_ip4(p) ? ipa_from_ip4(ospf3_6to4(ll)) : ipa_from_ip6(ll);
 }
 
-static struct nexthop *
+static struct nexthop_adata *
 calc_next_hop(struct ospf_area *oa, struct top_hash_entry *en,
 	      struct top_hash_entry *par, int pos, uint data, uint lif, uint nif)
 {
   struct ospf_proto *p = oa->po;
-  struct nexthop *pn = par->nhs;
+  struct nexthop_adata *pn = par->nhs;
   struct top_hash_entry *link = NULL;
   struct ospf_iface *ifa = NULL;
   ip_addr nh = IPA_NONE;
@@ -1827,10 +1806,10 @@ calc_next_hop(struct ospf_area *oa, struct top_hash_entry *en,
 	return NULL;
     }
 
-    struct nexthop *nhs = new_nexthop(p, nh, ifa->iface, ifa->ecmp_weight);
+    struct nexthop_adata *nhs = new_nexthop(p, nh, ifa->iface, ifa->ecmp_weight);
 
     if (ifa->addr->flags & IA_HOST)
-      nhs->flags = RNF_ONLINK;
+      nhs->nh.flags = RNF_ONLINK;
 
     return nhs;
   }
@@ -1851,7 +1830,7 @@ calc_next_hop(struct ospf_area *oa, struct top_hash_entry *en,
       if (ipa_zero(en->lb))
 	goto bad;
 
-      return new_nexthop(p, en->lb, pn->iface, pn->weight);
+      return new_nexthop(p, en->lb, pn->nh.iface, pn->nh.weight);
     }
     else /* OSPFv3 */
     {
@@ -1859,7 +1838,7 @@ calc_next_hop(struct ospf_area *oa, struct top_hash_entry *en,
        * Next-hop is taken from lladdr field of Link-LSA, en->lb_id
        * is computed in link_back().
        */
-      link = ospf_hash_find(p->gr, pn->iface->index, en->lb_id, rid, LSA_T_LINK);
+      link = ospf_hash_find(p->gr, pn->nh.iface->index, en->lb_id, rid, LSA_T_LINK);
       if (!link)
 	return NULL;
 
@@ -1867,7 +1846,7 @@ calc_next_hop(struct ospf_area *oa, struct top_hash_entry *en,
       if (ipa_zero(nh))
 	return NULL;
 
-      return new_nexthop(p, nh, pn->iface, pn->weight);
+      return new_nexthop(p, nh, pn->nh.iface, pn->nh.weight);
     }
   }
 
@@ -1914,7 +1893,7 @@ add_cand(struct ospf_area *oa, struct top_hash_entry *en, struct top_hash_entry
   if (!link_back(oa, en, par, lif, nif))
     return;
 
-  struct nexthop *nhs = calc_next_hop(oa, en, par, pos, data, lif, nif);
+  struct nexthop_adata *nhs = calc_next_hop(oa, en, par, pos, data, lif, nif);
   if (!nhs)
   {
     log(L_WARN "%s: Cannot find next hop for LSA (Type: %04x, Id: %R, Rt: %R)",
@@ -1923,7 +1902,7 @@ add_cand(struct ospf_area *oa, struct top_hash_entry *en, struct top_hash_entry
   }
 
   /* If en->dist > 0, we know that en->color == CANDIDATE and en->nhs is defined. */
-  if ((dist == en->dist) && !nh_is_vlink(en->nhs))
+  if ((dist == en->dist) && !nh_is_vlink(&en->nhs->nh))
   {
     /*
      * For multipath, we should merge nexthops. We merge regular nexthops only.
@@ -1947,13 +1926,11 @@ add_cand(struct ospf_area *oa, struct top_hash_entry *en, struct top_hash_entry
      */
 
     /* Keep old ones */
-    if (!p->ecmp || nh_is_vlink(nhs) || (nhs == en->nhs))
+    if (!p->ecmp || nh_is_vlink(&nhs->nh) || (nhs == en->nhs))
       return;
 
     /* Merge old and new */
-    int new_reuse = (par->nhs != nhs);
-    en->nhs = nexthop_merge(en->nhs, nhs, en->nhs_reuse, new_reuse, p->ecmp, p->nhpool);
-    en->nhs_reuse = 1;
+    en->nhs = nexthop_merge(en->nhs, nhs, p->ecmp, p->nhpool);
     return;
   }
 
@@ -1967,7 +1944,6 @@ add_cand(struct ospf_area *oa, struct top_hash_entry *en, struct top_hash_entry
   en->nhs = nhs;
   en->dist = dist;
   en->color = CANDIDATE;
-  en->nhs_reuse = (par->nhs != nhs);
 
   prev = NULL;
 
@@ -2001,14 +1977,34 @@ add_cand(struct ospf_area *oa, struct top_hash_entry *en, struct top_hash_entry
 }
 
 static inline int
-ort_changed(ort *nf, rta *nr)
+ort_changed(ort *nf, ea_list *nr)
 {
-  rta *or = nf->old_rta;
-  return !or ||
+  ea_list *or = nf->old_ea;
+
+  if (!or ||
     (nf->n.metric1 != nf->old_metric1) || (nf->n.metric2 != nf->old_metric2) ||
-    (nf->n.tag != nf->old_tag) || (nf->n.rid != nf->old_rid) ||
-    (nr->source != or->source) || (nr->dest != or->dest) ||
-    !nexthop_same(&(nr->nh), &(or->nh));
+    (nf->n.tag != nf->old_tag) || (nf->n.rid != nf->old_rid))
+    return 1;
+
+  eattr *nhea_n = ea_find(nr, &ea_gen_nexthop);
+  eattr *nhea_o = ea_find(or, &ea_gen_nexthop);
+  if (!nhea_n != !nhea_o)
+    return 1;
+
+  if (nhea_n && nhea_o)
+  {
+    struct nexthop_adata *nhad_n = (struct nexthop_adata *) nhea_n->u.ptr;
+    struct nexthop_adata *nhad_o = (struct nexthop_adata *) nhea_o->u.ptr;
+
+    if (!nexthop_same(nhad_n, nhad_o))
+      return 1;
+  }
+
+  if (	ea_get_int(nr, &ea_gen_source, 0)
+     != ea_get_int(or, &ea_gen_source, 0))
+    return 1;
+
+  return 0;
 }
 
 static void
@@ -2030,10 +2026,9 @@ again1:
   FIB_ITERATE_START(fib, &fit, ort, nf)
   {
     /* Sanity check of next-hop addresses, failure should not happen */
-    if (nf->n.type)
+    if (nf->n.type && nf->n.nhs)
     {
-      struct nexthop *nh;
-      for (nh = nf->n.nhs; nh; nh = nh->next)
+      NEXTHOP_WALK(nh, nf->n.nhs)
 	if (ipa_nonzero(nh->gw))
 	{
 	  neighbor *nbr = neigh_find(&p->p, nh->gw, nh->iface,
@@ -2052,69 +2047,67 @@ again1:
 
     if (nf->n.type) /* Add the route */
     {
-      rta a0 = {
-	.source = nf->n.type,
-	.scope = SCOPE_UNIVERSE,
-	.dest = RTD_UNICAST,
-	.nh = *(nf->n.nhs),
-	.pref = p->p.main_channel->preference,
-      };
-
-      if (reload || ort_changed(nf, &a0))
-      {
-	a0.eattrs = alloca(sizeof(ea_list) + 4 * sizeof(eattr));
-	memset(a0.eattrs, 0, sizeof(ea_list));
+      struct {
+	ea_list l;
+	eattr a[7];
+      } eattrs;
 
+      eattrs.l = (ea_list) {};
+
+      eattrs.a[eattrs.l.count++] =
+	EA_LITERAL_EMBEDDED(&ea_gen_preference, 0, p->p.main_channel->preference);
+
+      eattrs.a[eattrs.l.count++] = 
+	EA_LITERAL_EMBEDDED(&ea_gen_source, 0, nf->n.type);
+
+      eattrs.a[eattrs.l.count++] =
+	EA_LITERAL_DIRECT_ADATA(&ea_gen_nexthop, 0, &nf->n.nhs->ad);
+
+      if (reload || ort_changed(nf, &eattrs.l))
+      {
 	nf->old_metric1 = nf->n.metric1;
 	nf->old_metric2 = nf->n.metric2;
 	nf->old_tag = nf->n.tag;
 	nf->old_rid = nf->n.rid;
 
-	a0.eattrs->attrs[a0.eattrs->count++] = (eattr) {
-	  .id = EA_OSPF_METRIC1,
-	  .type = EAF_TYPE_INT,
-	  .u.data = nf->n.metric1,
-	};
+	eattrs.a[eattrs.l.count++] =
+	  EA_LITERAL_EMBEDDED(&ea_ospf_metric1, 0, nf->n.metric1);
 
 	if (nf->n.type == RTS_OSPF_EXT2)
-	  a0.eattrs->attrs[a0.eattrs->count++] = (eattr) {
-	    .id = EA_OSPF_METRIC2,
-	    .type = EAF_TYPE_INT,
-	    .u.data = nf->n.metric2,
-	  };
+	  eattrs.a[eattrs.l.count++] =
+	    EA_LITERAL_EMBEDDED(&ea_ospf_metric2, 0, nf->n.metric2);
 
 	if ((nf->n.type == RTS_OSPF_EXT1) || (nf->n.type == RTS_OSPF_EXT2))
-	  a0.eattrs->attrs[a0.eattrs->count++] = (eattr) {
-	    .id = EA_OSPF_TAG,
-	    .type = EAF_TYPE_INT,
-	    .u.data = nf->n.tag,
-	  };
-
-	a0.eattrs->attrs[a0.eattrs->count++] = (eattr) {
-	  .id = EA_OSPF_ROUTER_ID,
-	  .type = EAF_TYPE_ROUTER_ID,
-	  .u.data = nf->n.rid,
-	};
+	  eattrs.a[eattrs.l.count++] =
+	    EA_LITERAL_EMBEDDED(&ea_ospf_tag, 0, nf->n.tag);
+
+	eattrs.a[eattrs.l.count++] =
+	  EA_LITERAL_EMBEDDED(&ea_ospf_router_id, 0, nf->n.rid);
 
-	rta_free(nf->old_rta);
-	nf->old_rta = rta_lookup(&a0);
+	ASSERT_DIE(ARRAY_SIZE(eattrs.a) >= eattrs.l.count);
+
+	ea_list *eal = ea_lookup(&eattrs.l, 0);
+	ea_free(nf->old_ea);
+	nf->old_ea = eal;
 
 	rte e0 = {
-	  .attrs = nf->old_rta,
+	  .attrs = eal,
 	  .src = p->p.main_source,
 	};
 
+	/*
 	DBG("Mod rte type %d - %N via %I on iface %s, met %d\n",
 	    a0.source, nf->fn.addr, a0.gw, a0.iface ? a0.iface->name : "(none)", nf->n.metric1);
+	    */
 
 	rte_update(p->p.main_channel, nf->fn.addr, &e0, p->p.main_source);
       }
     }
-    else if (nf->old_rta)
+    else if (nf->old_ea)
     {
       /* Remove the route */
-      rta_free(nf->old_rta);
-      nf->old_rta = NULL;
+      rta_free(nf->old_ea);
+      nf->old_ea = NULL;
 
       rte_update(p->p.main_channel, nf->fn.addr, NULL, p->p.main_source);
     }
diff --git a/proto/ospf/rt.h b/proto/ospf/rt.h
index 094e125b..88eefef9 100644
--- a/proto/ospf/rt.h
+++ b/proto/ospf/rt.h
@@ -18,8 +18,6 @@
 typedef struct orta
 {
   u8 type;			/* RTS_OSPF_* */
-  u8 nhs_reuse;			/* Whether nhs nodes can be reused during merging.
-				   See a note in rt.c:add_cand() */
   u32 options;
   /*
    * For ORT_ROUTER routes, options field are router-LSA style
@@ -53,7 +51,7 @@ typedef struct orta
   struct ospf_area *oa;
   struct ospf_area *voa;	/* Used when route is replaced in ospf_rt_sum_tr(),
 				   NULL otherwise */
-  struct nexthop *nhs;		/* Next hops computed during SPF */
+  struct nexthop_adata *nhs;	/* Next hops computed during SPF */
   struct top_hash_entry *en;	/* LSA responsible for this orta */
 }
 orta;
@@ -80,7 +78,7 @@ typedef struct ort
    */
   orta n;
   u32 old_metric1, old_metric2, old_tag, old_rid;
-  rta *old_rta;
+  ea_list *old_ea;
   u32 lsa_id;
   u8 external_rte;
   u8 area_net;
diff --git a/proto/ospf/topology.c b/proto/ospf/topology.c
index bb88d20a..85bce03d 100644
--- a/proto/ospf/topology.c
+++ b/proto/ospf/topology.c
@@ -1337,9 +1337,9 @@ ospf_rt_notify(struct proto *P, struct channel *ch UNUSED, const net_addr *n, rt
   ASSERT(p->asbr);
 
   /* Get route attributes */
-  rta *a = new->attrs;
-  eattr *m1a = ea_find(a->eattrs, EA_OSPF_METRIC1);
-  eattr *m2a = ea_find(a->eattrs, EA_OSPF_METRIC2);
+  ea_list *a = new->attrs;
+  eattr *m1a = ea_find(a, &ea_ospf_metric1);
+  eattr *m2a = ea_find(a, &ea_ospf_metric2);
   uint m1 = m1a ? m1a->u.data : 0;
   uint m2 = m2a ? m2a->u.data : 10000;
 
@@ -1363,11 +1363,14 @@ ospf_rt_notify(struct proto *P, struct channel *ch UNUSED, const net_addr *n, rt
 
   uint ebit = m2a || !m1a;
   uint metric = ebit ? m2 : m1;
-  uint tag = ea_get_int(a->eattrs, EA_OSPF_TAG, 0);
+  uint tag = ea_get_int(a, &ea_ospf_tag, 0);
 
   ip_addr fwd = IPA_NONE;
-  if ((a->dest == RTD_UNICAST) && use_gw_for_fwaddr(p, a->nh.gw, a->nh.iface))
-    fwd = a->nh.gw;
+  eattr *nhea = ea_find(a, &ea_gen_nexthop);
+  struct nexthop_adata *nhad = (struct nexthop_adata *) nhea->u.ptr;
+  if (NEXTHOP_IS_REACHABLE(nhad))
+    if (use_gw_for_fwaddr(p, nhad->nh.gw, nhad->nh.iface))
+      fwd = nhad->nh.gw;
 
   /* NSSA-LSA with P-bit set must have non-zero forwarding address */
   if (oa && ipa_zero(fwd))
@@ -2135,7 +2138,7 @@ ospf_hash_delete(struct top_graph *f, struct top_hash_entry *e)
     if (*ee == e)
     {
       *ee = e->next;
-      sl_free(f->hash_slab, e);
+      sl_free(e);
       if (f->hash_entries-- < f->hash_entries_min)
 	ospf_top_rehash(f, -HASH_LO_STEP);
       return;
diff --git a/proto/ospf/topology.h b/proto/ospf/topology.h
index c36d0b50..3c92b431 100644
--- a/proto/ospf/topology.h
+++ b/proto/ospf/topology.h
@@ -28,7 +28,7 @@ struct top_hash_entry
   u16 next_lsa_opts;		/* For postponed LSA origination */
   btime inst_time;		/* Time of installation into DB */
   struct ort *nf;		/* Reference fibnode for sum and ext LSAs, NULL for otherwise */
-  struct nexthop *nhs;		/* Computed nexthops - valid only in ospf_rt_spf() */
+  struct nexthop_adata *nhs;	/* Computed nexthops - valid only in ospf_rt_spf() */
   ip_addr lb;			/* In OSPFv2, link back address. In OSPFv3, any global address in the area useful for vlinks */
   u32 lb_id;			/* Interface ID of link back iface (for bcast or NBMA networks) */
   u32 dist;			/* Distance from the root */
@@ -39,8 +39,6 @@ struct top_hash_entry
 #define CANDIDATE 1
 #define INSPF 2
   u8 mode;			/* LSA generated during RT calculation (LSA_RTCALC or LSA_STALE)*/
-  u8 nhs_reuse;			/* Whether nhs nodes can be reused during merging.
-				   See a note in rt.c:add_cand() */
 };
 
 
diff --git a/proto/perf/Makefile b/proto/perf/Makefile
index 7877fb19..42051f43 100644
--- a/proto/perf/Makefile
+++ b/proto/perf/Makefile
@@ -2,5 +2,6 @@ src := perf.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,perf_build)
 
 tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/perf/perf.c b/proto/perf/perf.c
index 8b2cb69f..d82ac8aa 100644
--- a/proto/perf/perf.c
+++ b/proto/perf/perf.c
@@ -18,7 +18,7 @@
 #include "nest/bird.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/cli.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
@@ -85,7 +85,7 @@ random_net_ip4(void)
 }
 
 struct perf_random_routes {
-  struct rta *a;
+  ea_list *a;
   net_addr net;
 };
 
@@ -142,17 +142,21 @@ perf_loop(void *data)
     *((net_addr_ip4 *) &(p->data[i].net)) = random_net_ip4();
 
     if (!p->attrs_per_rte || !(i % p->attrs_per_rte)) {
-      struct rta a0 = {
-	.source = RTS_PERF,
-	.scope = SCOPE_UNIVERSE,
-	.dest = RTD_UNICAST,
-	.pref = p->p.main_channel->preference,
+      ea_list *ea = NULL;
+
+      ea_set_attr_u32(&ea, &ea_gen_preference, 0, p->p.main_channel->preference);
+      ea_set_attr_u32(&ea, &ea_gen_source, 0, RTS_PERF);
+
+      struct nexthop_adata nhad = {
 	.nh.iface = p->ifa->iface,
 	.nh.gw = gw,
 	.nh.weight = 1,
       };
 
-      p->data[i].a = rta_lookup(&a0);
+      ea_set_attr_data(&ea, &ea_gen_nexthop, 0,
+	  &nhad.ad.data, sizeof nhad - sizeof nhad.ad);
+
+      p->data[i].a = rta_lookup(ea, 0);
     }
     else
       p->data[i].a = rta_clone(p->data[i-1].a);
@@ -305,7 +309,6 @@ perf_copy_config(struct proto_config *dest UNUSED, struct proto_config *src UNUS
 struct protocol proto_perf = {
   .name = 		"Perf",
   .template =		"perf%d",
-  .class =		PROTOCOL_PERF,
   .channel_mask = 	NB_IP,
   .proto_size =		sizeof(struct perf_proto),
   .config_size = 	sizeof(struct perf_config),
@@ -314,3 +317,9 @@ struct protocol proto_perf = {
   .reconfigure = 	perf_reconfigure,
   .copy_config =	perf_copy_config,
 };
+
+void
+perf_build(void)
+{
+  proto_build(&proto_perf);
+}
diff --git a/proto/pipe/Makefile b/proto/pipe/Makefile
index 5093da98..ba66027f 100644
--- a/proto/pipe/Makefile
+++ b/proto/pipe/Makefile
@@ -2,5 +2,6 @@ src := pipe.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,pipe_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/pipe/config.Y b/proto/pipe/config.Y
index c869de9f..0990168e 100644
--- a/proto/pipe/config.Y
+++ b/proto/pipe/config.Y
@@ -41,6 +41,12 @@ pipe_proto:
    pipe_proto_start '{'
  | pipe_proto proto_item ';'
  | pipe_proto channel_item_ ';'
+ | pipe_proto IMPORT IN net_any imexport ';' {
+    if (this_channel->net_type && ($4->type != this_channel->net_type))
+      cf_error("Incompatible export prefilter type");
+    PIPE_CFG->in_subprefix = $4;
+    this_channel->in_filter = $5;
+  }
  | pipe_proto PEER TABLE rtable ';' { PIPE_CFG->peer = $4; }
  | pipe_proto MAX GENERATION expr ';' {
     if (($4 < 1) || ($4 > 254)) cf_error("Max generation must be in range 1..254, got %u", $4);
diff --git a/proto/pipe/pipe.c b/proto/pipe/pipe.c
index bbcd8f0d..8af6de81 100644
--- a/proto/pipe/pipe.c
+++ b/proto/pipe/pipe.c
@@ -35,7 +35,7 @@
 #include "nest/bird.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/cli.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
@@ -58,18 +58,14 @@ pipe_rt_notify(struct proto *P, struct channel *src_ch, const net_addr *n, rte *
 
   if (new)
     {
-      rta *a = alloca(rta_size(new->attrs));
-      memcpy(a, new->attrs, rta_size(new->attrs));
-
-      a->cached = 0;
-      a->hostentry = NULL;
-
       rte e0 = {
-	.attrs = a,
+	.attrs = new->attrs,
 	.src = new->src,
 	.generation = new->generation + 1,
       };
 
+      ea_unset_attr(&e0.attrs, 0, &ea_gen_hostentry);
+
       rte_update(dst, n, &e0, new->src);
     }
   else
@@ -77,12 +73,12 @@ pipe_rt_notify(struct proto *P, struct channel *src_ch, const net_addr *n, rte *
 }
 
 static int
-pipe_preexport(struct channel *c, rte *e)
+pipe_preexport(struct channel *C, rte *e)
 {
-  struct pipe_proto *p = (void *) c->proto;
+  struct pipe_proto *p = (void *) C->proto;
 
   /* Avoid direct loopbacks */
-  if (e->sender == c->in_req.hook)
+  if (e->sender == C->in_req.hook)
     return -1;
 
   /* Indirection check */
@@ -90,8 +86,8 @@ pipe_preexport(struct channel *c, rte *e)
   if (e->generation >= max_generation)
   {
     log_rl(&p->rl_gen, L_ERR "Route overpiped (%u hops of %u configured in %s) in table %s: %N %s/%u:%u",
-	e->generation, max_generation, c->proto->name,
-	c->table->name, e->net, e->src->proto->name, e->src->private_id, e->src->global_id);
+	e->generation, max_generation, C->proto->name,
+	C->table->name, e->net, e->src->proto->name, e->src->private_id, e->src->global_id);
 
     return -1;
   }
@@ -127,10 +123,16 @@ pipe_postconfig(struct proto_config *CF)
   if (cc->table->addr_type != cf->peer->addr_type)
     cf_error("Primary table and peer table must have the same type");
 
+  if (cc->out_subprefix && (cc->table->addr_type != cc->out_subprefix->type))
+    cf_error("Export subprefix must match table type");
+
+  if (cf->in_subprefix && (cc->table->addr_type != cf->in_subprefix->type))
+    cf_error("Import subprefix must match table type");
+
   if (cc->rx_limit.action)
     cf_error("Pipe protocol does not support receive limits");
 
-  if (cc->in_keep_filtered)
+  if (cc->in_keep)
     cf_error("Pipe protocol prohibits keeping filtered routes");
 
   cc->debug = cf->c.debug;
@@ -146,6 +148,7 @@ pipe_configure_channels(struct pipe_proto *p, struct pipe_config *cf)
     .channel = cc->channel,
     .table = cc->table,
     .out_filter = cc->out_filter,
+    .out_subprefix = cc->out_subprefix,
     .in_limit = cc->in_limit,
     .ra_mode = RA_ANY,
     .debug = cc->debug,
@@ -157,6 +160,7 @@ pipe_configure_channels(struct pipe_proto *p, struct pipe_config *cf)
     .channel = cc->channel,
     .table = cf->peer,
     .out_filter = cc->in_filter,
+    .out_subprefix = cf->in_subprefix,
     .in_limit = cc->out_limit,
     .ra_mode = RA_ANY,
     .debug = cc->debug,
@@ -299,7 +303,6 @@ pipe_update_debug(struct proto *P)
 struct protocol proto_pipe = {
   .name =		"Pipe",
   .template =		"pipe%d",
-  .class =		PROTOCOL_PIPE,
   .proto_size =		sizeof(struct pipe_proto),
   .config_size =	sizeof(struct pipe_config),
   .postconfig =		pipe_postconfig,
@@ -309,3 +312,9 @@ struct protocol proto_pipe = {
   .get_status = 	pipe_get_status,
   .show_proto_info = 	pipe_show_proto_info
 };
+
+void
+pipe_build(void)
+{
+  proto_build(&proto_pipe);
+}
diff --git a/proto/pipe/pipe.h b/proto/pipe/pipe.h
index 60c857eb..a6534e1c 100644
--- a/proto/pipe/pipe.h
+++ b/proto/pipe/pipe.h
@@ -12,6 +12,7 @@
 struct pipe_config {
   struct proto_config c;
   struct rtable_config *peer;		/* Table we're connected to */
+  const net_addr *in_subprefix;
   u8 max_generation;
 };
 
diff --git a/proto/radv/Makefile b/proto/radv/Makefile
index 05317eff..4780bee3 100644
--- a/proto/radv/Makefile
+++ b/proto/radv/Makefile
@@ -2,5 +2,6 @@ src := packets.c radv.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,radv_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/radv/config.Y b/proto/radv/config.Y
index 8d4a3ab9..fb68d2e5 100644
--- a/proto/radv/config.Y
+++ b/proto/radv/config.Y
@@ -33,7 +33,7 @@ CF_KEYWORDS(RADV, PREFIX, INTERFACE, MIN, MAX, RA, DELAY, INTERVAL, SOLICITED,
 	RETRANS, TIMER, CURRENT, HOP, LIMIT, DEFAULT, VALID, PREFERRED, MULT,
 	LIFETIME, SKIP, ONLINK, AUTONOMOUS, RDNSS, DNSSL, NS, DOMAIN, LOCAL,
 	TRIGGER, SENSITIVE, PREFERENCE, LOW, MEDIUM, HIGH, PROPAGATE, ROUTE,
-	ROUTES, RA_PREFERENCE, RA_LIFETIME)
+	ROUTES)
 
 CF_ENUM(T_ENUM_RA_PREFERENCE, RA_PREF_, LOW, MEDIUM, HIGH)
 
@@ -336,9 +336,6 @@ radv_sensitive:
  | SENSITIVE bool { $$ = $2; }
  ;
 
-dynamic_attr: RA_PREFERENCE { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_ENUM_RA_PREFERENCE, EA_RA_PREFERENCE); } ;
-dynamic_attr: RA_LIFETIME { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_RA_LIFETIME); } ;
-
 CF_CODE
 
 CF_END
diff --git a/proto/radv/radv.c b/proto/radv/radv.c
index fa228c69..10d5e3ed 100644
--- a/proto/radv/radv.c
+++ b/proto/radv/radv.c
@@ -10,6 +10,7 @@
 
 #include <stdlib.h>
 #include "radv.h"
+#include "lib/macro.h"
 
 /**
  * DOC: Router Advertisements
@@ -42,6 +43,8 @@
  * RFC 6106 - DNS extensions (RDDNS, DNSSL)
  */
 
+static struct ea_class ea_radv_preference, ea_radv_lifetime;
+
 static void radv_prune_prefixes(struct radv_iface *ifa);
 static void radv_prune_routes(struct radv_proto *p);
 
@@ -391,10 +394,10 @@ radv_net_match_trigger(struct radv_config *cf, const net_addr *n)
 }
 
 int
-radv_preexport(struct channel *c, rte *new)
+radv_preexport(struct channel *C, rte *new)
 {
   // struct radv_proto *p = (struct radv_proto *) P;
-  struct radv_config *cf = (struct radv_config *) (c->proto->cf);
+  struct radv_config *cf = (struct radv_config *) (C->proto->cf);
 
   if (radv_net_match_trigger(cf, new->net))
     return RIC_PROCESS;
@@ -444,11 +447,11 @@ radv_rt_notify(struct proto *P, struct channel *ch UNUSED, const net_addr *n, rt
   {
     /* Update */
 
-    ea = ea_find(new->attrs->eattrs, EA_RA_PREFERENCE);
+    ea = ea_find(new->attrs, &ea_radv_preference);
     uint preference = ea ? ea->u.data : RA_PREF_MEDIUM;
     uint preference_set = !!ea;
 
-    ea = ea_find(new->attrs->eattrs, EA_RA_LIFETIME);
+    ea = ea_find(new->attrs, &ea_radv_lifetime);
     uint lifetime = ea ? ea->u.data : 0;
     uint lifetime_set = !!ea;
 
@@ -738,27 +741,26 @@ radv_pref_str(u32 pref)
   }
 }
 
-/* The buffer has some minimal size */
-static int
-radv_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
+static void
+radv_preference_format(const eattr *a, byte *buf, uint buflen)
 {
-  switch (a->id)
-  {
-  case EA_RA_PREFERENCE:
-    bsprintf(buf, "preference: %s", radv_pref_str(a->u.data));
-    return GA_FULL;
-  case EA_RA_LIFETIME:
-    bsprintf(buf, "lifetime");
-    return GA_NAME;
-  default:
-    return GA_UNKNOWN;
-  }
+  bsnprintf(buf, buflen, "%s", radv_pref_str(a->u.data));
 }
 
+static struct ea_class ea_radv_preference = {
+  .name = "radv_preference",
+  .type = T_ENUM_RA_PREFERENCE,
+  .format = radv_preference_format,
+};
+
+static struct ea_class ea_radv_lifetime = {
+  .name = "radv_lifetime",
+  .type = T_INT,
+};
+
 struct protocol proto_radv = {
   .name =		"RAdv",
   .template =		"radv%d",
-  .class =		PROTOCOL_RADV,
   .channel_mask =	NB_IP6,
   .proto_size =		sizeof(struct radv_proto),
   .config_size =	sizeof(struct radv_config),
@@ -769,5 +771,15 @@ struct protocol proto_radv = {
   .reconfigure =	radv_reconfigure,
   .copy_config =	radv_copy_config,
   .get_status =		radv_get_status,
-  .get_attr =		radv_get_attr
 };
+
+void
+radv_build(void)
+{
+  proto_build(&proto_radv);
+
+  EA_REGISTER_ALL(
+      &ea_radv_preference,
+      &ea_radv_lifetime
+      );
+}
diff --git a/proto/radv/radv.h b/proto/radv/radv.h
index 14d40f8a..c9219bda 100644
--- a/proto/radv/radv.h
+++ b/proto/radv/radv.h
@@ -19,7 +19,7 @@
 #include "lib/resource.h"
 #include "nest/protocol.h"
 #include "nest/iface.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/cli.h"
 #include "nest/locks.h"
 #include "conf/conf.h"
@@ -195,10 +195,6 @@ struct radv_iface
 #define RA_PREF_HIGH	0x08
 #define RA_PREF_MASK	0x18
 
-/* Attributes */
-#define EA_RA_PREFERENCE	EA_CODE(PROTOCOL_RADV, 0)
-#define EA_RA_LIFETIME		EA_CODE(PROTOCOL_RADV, 1)
-
 #ifdef LOCAL_DEBUG
 #define RADV_FORCE_DEBUG 1
 #else
diff --git a/proto/rip/Makefile b/proto/rip/Makefile
index 7feabcd8..b9ff62d6 100644
--- a/proto/rip/Makefile
+++ b/proto/rip/Makefile
@@ -2,5 +2,6 @@ src := packets.c rip.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,rip_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/rip/config.Y b/proto/rip/config.Y
index 28ee9609..3c0973b1 100644
--- a/proto/rip/config.Y
+++ b/proto/rip/config.Y
@@ -37,7 +37,7 @@ CF_KEYWORDS(RIP, NG, ECMP, LIMIT, WEIGHT, INFINITY, METRIC, UPDATE, TIMEOUT,
 	    PASSIVE, VERSION, SPLIT, HORIZON, POISON, REVERSE, CHECK, ZERO,
 	    TIME, BFD, AUTHENTICATION, NONE, PLAINTEXT, CRYPTOGRAPHIC, MD5,
 	    TTL, SECURITY, RX, TX, BUFFER, LENGTH, PRIORITY, ONLY, LINK,
-	    DEMAND, CIRCUIT, RIP_METRIC, RIP_TAG)
+	    DEMAND, CIRCUIT)
 
 %type <i> rip_variant rip_auth
 
@@ -190,9 +190,6 @@ rip_iface:
   rip_iface_start iface_patt_list_nopx rip_iface_opt_list rip_iface_finish;
 
 
-dynamic_attr: RIP_METRIC { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_RIP_METRIC); } ;
-dynamic_attr: RIP_TAG { $$ = f_new_dynamic_attr(EAF_TYPE_INT, T_INT, EA_RIP_TAG); } ;
-
 CF_CLI_HELP(SHOW RIP, ..., [[Show information about RIP protocol]]);
 
 CF_CLI(SHOW RIP INTERFACES, optproto opttext, [<name>] [\"<interface>\"], [[Show information about RIP interfaces]])
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 0a9844f3..f5c01380 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -78,6 +78,7 @@
 
 #include <stdlib.h>
 #include "rip.h"
+#include "lib/macro.h"
 
 
 static inline void rip_lock_neighbor(struct rip_neighbor *n);
@@ -88,6 +89,7 @@ static inline void rip_iface_kick_timer(struct rip_iface *ifa);
 static void rip_iface_timer(timer *timer);
 static void rip_trigger_update(struct rip_proto *p);
 
+static struct ea_class ea_rip_metric, ea_rip_tag, ea_rip_from;
 
 /*
  *	RIP routes
@@ -108,14 +110,14 @@ rip_add_rte(struct rip_proto *p, struct rip_rte **rp, struct rip_rte *src)
 }
 
 static inline void
-rip_remove_rte(struct rip_proto *p, struct rip_rte **rp)
+rip_remove_rte(struct rip_proto *p UNUSED, struct rip_rte **rp)
 {
   struct rip_rte *rt = *rp;
 
   rip_unlock_neighbor(rt->from);
 
   *rp = rt->next;
-  sl_free(p->rte_slab, rt);
+  sl_free(rt);
 }
 
 static inline int rip_same_rte(struct rip_rte *a, struct rip_rte *b)
@@ -124,6 +126,11 @@ static inline int rip_same_rte(struct rip_rte *a, struct rip_rte *b)
 static inline int rip_valid_rte(struct rip_rte *rt)
 { return rt->from->ifa != NULL; }
 
+struct rip_iface_adata {
+  struct adata ad;
+  struct iface *iface;
+};
+
 /**
  * rip_announce_rte - announce route from RIP routing table to the core
  * @p: RIP instance
@@ -144,71 +151,87 @@ rip_announce_rte(struct rip_proto *p, struct rip_entry *en)
   if (rt)
   {
     /* Update */
-    rta a0 = {
-      .pref = p->p.main_channel->preference,
-      .source = RTS_RIP,
-      .scope = SCOPE_UNIVERSE,
-      .dest = RTD_UNICAST,
+    struct {
+      ea_list l;
+      eattr a[3];
+    } ea_block = {
+      .l.count = ARRAY_SIZE(ea_block.a),
+      .a = {
+	EA_LITERAL_EMBEDDED(&ea_gen_preference, 0, p->p.main_channel->preference),
+	EA_LITERAL_EMBEDDED(&ea_gen_source, 0, RTS_RIP),
+	EA_LITERAL_EMBEDDED(&ea_rip_metric, 0, rt->metric),
+      },
     };
 
-    u8 rt_metric = rt->metric;
+    ea_list *ea = &ea_block.l;
+
     u16 rt_tag = rt->tag;
+    struct iface *rt_from = NULL;
 
     if (p->ecmp)
     {
       /* ECMP route */
-      struct nexthop *nhs = NULL;
       int num = 0;
 
       for (rt = en->routes; rt && (num < p->ecmp); rt = rt->next)
+	if (rip_valid_rte(rt))
+	  num++;
+
+      struct nexthop_adata *nhad = (struct nexthop_adata *) tmp_alloc_adata((num+1) * sizeof(struct nexthop));
+      struct nexthop *nh = &nhad->nh;
+
+      for (rt = en->routes; rt && (num < p->ecmp); rt = rt->next)
       {
 	if (!rip_valid_rte(rt))
-	    continue;
+	  continue;
 
-	struct nexthop *nh = allocz(sizeof(struct nexthop));
+	*nh = (struct nexthop) {
+	  .gw = rt->next_hop,
+	  .iface = rt->from->ifa->iface,
+	  .weight = rt->from->ifa->cf->ecmp_weight,
+	};
 
-	nh->gw = rt->next_hop;
-	nh->iface = rt->from->ifa->iface;
-	nh->weight = rt->from->ifa->cf->ecmp_weight;
+	if (!rt_from)
+	  rt_from = rt->from->ifa->iface;
 
-	nexthop_insert(&nhs, nh);
-	num++;
+	nh = NEXTHOP_NEXT(nh);
 
 	if (rt->tag != rt_tag)
 	  rt_tag = 0;
       }
 
-      a0.nh = *nhs;
+      nhad->ad.length = ((void *) nh - (void *) nhad->ad.data);
+
+      ea_set_attr(&ea,
+	  EA_LITERAL_DIRECT_ADATA(&ea_gen_nexthop, 0,
+	    &(nexthop_sort(nhad, tmp_linpool)->ad)));
     }
     else
     {
       /* Unipath route */
-      a0.from = rt->from->nbr->addr;
-      a0.nh.gw = rt->next_hop;
-      a0.nh.iface = rt->from->ifa->iface;
+      rt_from = rt->from->ifa->iface;
+
+      struct nexthop_adata nhad = {
+	.nh.gw = rt->next_hop,
+	.nh.iface = rt->from->ifa->iface,
+      };
+
+      ea_set_attr_data(&ea, &ea_gen_nexthop, 0,
+	  &nhad.ad.data, sizeof nhad - sizeof nhad.ad);
+      ea_set_attr_data(&ea, &ea_gen_from, 0, &rt->from->nbr->addr, sizeof(ip_addr));
     }
 
-    a0.eattrs = alloca(sizeof(ea_list) + 3*sizeof(eattr));
-    memset(a0.eattrs, 0, sizeof(ea_list)); /* Zero-ing only the ea_list header */
-    a0.eattrs->count = 3;
-    a0.eattrs->attrs[0] = (eattr) {
-      .id = EA_RIP_METRIC,
-      .type = EAF_TYPE_INT,
-      .u.data = rt_metric,
-    };
-    a0.eattrs->attrs[1] = (eattr) {
-      .id = EA_RIP_TAG,
-      .type = EAF_TYPE_INT,
-      .u.data = rt_tag,
-    };
-    a0.eattrs->attrs[2] = (eattr) {
-      .id = EA_RIP_FROM,
-      .type = EAF_TYPE_PTR,
-      .u.data = (uintptr_t) a0.nh.iface,
+    ea_set_attr_u32(&ea, &ea_rip_tag, 0, rt_tag);
+
+    struct rip_iface_adata riad = {
+      .ad = { .length = sizeof(struct rip_iface_adata) - sizeof(struct adata) },
+      .iface = rt_from,
     };
+    ea_set_attr(&ea,
+	EA_LITERAL_DIRECT_ADATA(&ea_rip_from, 0, &riad.ad));
 
     rte e0 = {
-      .attrs = &a0,
+      .attrs = ea,
       .src = p->p.main_source,
     };
 
@@ -320,9 +343,10 @@ rip_rt_notify(struct proto *P, struct channel *ch UNUSED, const net_addr *net, s
   if (new)
   {
     /* Update */
-    u32 rt_tag = ea_get_int(new->attrs->eattrs, EA_RIP_TAG, 0);
-    u32 rt_metric = ea_get_int(new->attrs->eattrs, EA_RIP_METRIC, 1);
-    struct iface *rt_from = (struct iface *) ea_get_int(new->attrs->eattrs, EA_RIP_FROM, 0);
+    u32 rt_tag = ea_get_int(new->attrs, &ea_rip_tag, 0);
+    u32 rt_metric = ea_get_int(new->attrs, &ea_rip_metric, 1);
+    const eattr *rie = ea_find(new->attrs, &ea_rip_from);
+    struct iface *rt_from = rie ? ((struct rip_iface_adata *) rie->u.ptr)->iface : NULL;
 
     if (rt_metric > p->infinity)
     {
@@ -354,8 +378,14 @@ rip_rt_notify(struct proto *P, struct channel *ch UNUSED, const net_addr *net, s
     en->metric = rt_metric;
     en->tag = rt_tag;
     en->from = (new->src->proto == P) ? rt_from : NULL;
-    en->iface = new->attrs->nh.iface;
-    en->next_hop = new->attrs->nh.gw;
+
+    eattr *nhea = ea_find(new->attrs, &ea_gen_nexthop);
+    if (nhea)
+    {
+      struct nexthop_adata *nhad = (struct nexthop_adata *) nhea->u.ptr;
+      en->iface = nhad->nh.iface;
+      en->next_hop = nhad->nh.gw;
+    }
   }
   else
   {
@@ -1088,16 +1118,16 @@ rip_rte_better(struct rte *new, struct rte *old)
   ASSERT_DIE(new->src == old->src);
   struct rip_proto *p = (struct rip_proto *) new->src->proto;
 
-  u32 new_metric = ea_get_int(new->attrs->eattrs, EA_RIP_METRIC, p->infinity);
-  u32 old_metric = ea_get_int(old->attrs->eattrs, EA_RIP_METRIC, p->infinity);
+  u32 new_metric = ea_get_int(new->attrs, &ea_rip_metric, p->infinity);
+  u32 old_metric = ea_get_int(old->attrs, &ea_rip_metric, p->infinity);
 
   return new_metric < old_metric;
 }
 
 static u32
-rip_rte_igp_metric(struct rte *rt)
+rip_rte_igp_metric(const rte *rt)
 {
-  return ea_get_int(rt->attrs->eattrs, EA_RIP_METRIC, IGP_METRIC_UNKNOWN);
+  return ea_get_int(rt->attrs, &ea_rip_metric, IGP_METRIC_UNKNOWN);
 }
 
 static void
@@ -1198,32 +1228,37 @@ static void
 rip_get_route_info(rte *rte, byte *buf)
 {
   struct rip_proto *p = (struct rip_proto *) rte->src->proto;
-  u32 rt_metric = ea_get_int(rte->attrs->eattrs, EA_RIP_METRIC, p->infinity);
-  u32 rt_tag = ea_get_int(rte->attrs->eattrs, EA_RIP_TAG, 0);
+  u32 rt_metric = ea_get_int(rte->attrs, &ea_rip_metric, p->infinity);
+  u32 rt_tag = ea_get_int(rte->attrs, &ea_rip_tag, 0);
 
-  buf += bsprintf(buf, " (%d/%d)", rte->attrs->pref, rt_metric);
+  buf += bsprintf(buf, " (%d/%d)", rt_get_preference(rte), rt_metric);
 
   if (rt_tag)
     bsprintf(buf, " [%04x]", rt_tag);
 }
 
-static int
-rip_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
+static void
+rip_tag_format(const eattr *a, byte *buf, uint buflen)
 {
-  switch (a->id)
-  {
-  case EA_RIP_METRIC:
-    bsprintf(buf, "metric: %d", a->u.data);
-    return GA_FULL;
+  bsnprintf(buf, buflen, "%04x", a->u.data);
+}
 
-  case EA_RIP_TAG:
-    bsprintf(buf, "tag: %04x", a->u.data);
-    return GA_FULL;
+static struct ea_class ea_rip_metric = {
+  .name = "rip_metric",
+  .type = T_INT,
+};
 
-  default:
-    return GA_UNKNOWN;
-  }
-}
+static struct ea_class ea_rip_tag = {
+  .name = "rip_tag",
+  .type = T_INT,
+  .format = rip_tag_format,
+};
+
+static struct ea_class ea_rip_from = {
+  .name = "rip_from",
+  .type = T_IFACE,
+  .readonly = 1,
+};
 
 void
 rip_show_interfaces(struct proto *P, const char *iff)
@@ -1327,7 +1362,6 @@ rip_dump(struct proto *P)
 struct protocol proto_rip = {
   .name =		"RIP",
   .template =		"rip%d",
-  .class =		PROTOCOL_RIP,
   .preference =		DEF_PREF_RIP,
   .channel_mask =	NB_IP,
   .proto_size =		sizeof(struct rip_proto),
@@ -1339,5 +1373,16 @@ struct protocol proto_rip = {
   .shutdown =		rip_shutdown,
   .reconfigure =	rip_reconfigure,
   .get_route_info =	rip_get_route_info,
-  .get_attr =		rip_get_attr
 };
+
+void
+rip_build(void)
+{
+  proto_build(&proto_rip);
+
+  EA_REGISTER_ALL(
+      &ea_rip_metric,
+      &ea_rip_tag,
+      &ea_rip_from
+      );
+}
diff --git a/proto/rip/rip.h b/proto/rip/rip.h
index f8713c4a..a01f8d3b 100644
--- a/proto/rip/rip.h
+++ b/proto/rip/rip.h
@@ -16,7 +16,7 @@
 #include "nest/cli.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/password.h"
 #include "nest/locks.h"
 #include "nest/bfd.h"
@@ -195,10 +195,6 @@ struct rip_rte
 #define RIP_ENTRY_VALID		1	/* Valid outgoing route */
 #define RIP_ENTRY_STALE		2	/* Stale outgoing route, waiting for GC */
 
-#define EA_RIP_METRIC		EA_CODE(PROTOCOL_RIP, 0)
-#define EA_RIP_TAG		EA_CODE(PROTOCOL_RIP, 1)
-#define EA_RIP_FROM		EA_CODE(PROTOCOL_RIP, 2)
-
 static inline int rip_is_v2(struct rip_proto *p)
 { return p->rip2; }
 
diff --git a/proto/rpki/Makefile b/proto/rpki/Makefile
index eb09b7df..8e3a2761 100644
--- a/proto/rpki/Makefile
+++ b/proto/rpki/Makefile
@@ -2,5 +2,6 @@ src := rpki.c packets.c tcp_transport.c ssh_transport.c transport.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,rpki_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/rpki/packets.c b/proto/rpki/packets.c
index 897edc09..108da61b 100644
--- a/proto/rpki/packets.c
+++ b/proto/rpki/packets.c
@@ -737,6 +737,33 @@ rpki_handle_prefix_pdu(struct rpki_cache *cache, const struct pdu_header *pdu)
   net_addr_union addr = {};
   rpki_prefix_pdu_2_net_addr(pdu, &addr);
 
+  if (type == IPV4_PREFIX)
+  {
+    if ((addr.roa4.pxlen > addr.roa4.max_pxlen) ||
+	(addr.roa4.max_pxlen > IP4_MAX_PREFIX_LENGTH))
+    {
+      RPKI_WARN(cache->p, "Received corrupt packet from RPKI cache server: invalid pxlen or max_pxlen");
+      byte tmp[pdu->len];
+      const struct pdu_header *hton_pdu = rpki_pdu_back_to_network_byte_order((void *) tmp, (const void *) pdu);
+      rpki_send_error_pdu(cache, CORRUPT_DATA, pdu->len, hton_pdu, "Corrupted PDU: invalid pxlen or max_pxlen");
+      rpki_cache_change_state(cache, RPKI_CS_ERROR_FATAL);
+      return RPKI_ERROR;
+    }
+  }
+  else
+  {
+    if ((addr.roa6.pxlen > addr.roa6.max_pxlen) ||
+	(addr.roa6.max_pxlen > IP6_MAX_PREFIX_LENGTH))
+    {
+      RPKI_WARN(cache->p, "Received corrupt packet from RPKI cache server: invalid pxlen or max_pxlen");
+      byte tmp[pdu->len];
+      const struct pdu_header *hton_pdu = rpki_pdu_back_to_network_byte_order((void *) tmp, (const void *) pdu);
+      rpki_send_error_pdu(cache, CORRUPT_DATA, pdu->len, hton_pdu, "Corrupted PDU: invalid pxlen or max_pxlen");
+      rpki_cache_change_state(cache, RPKI_CS_ERROR_FATAL);
+      return RPKI_ERROR;
+    }
+  }
+
   if (cf->ignore_max_length)
   {
     if (type == IPV4_PREFIX)
diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c
index 95066499..56615e36 100644
--- a/proto/rpki/rpki.c
+++ b/proto/rpki/rpki.c
@@ -120,14 +120,11 @@ rpki_table_add_roa(struct rpki_cache *cache, struct channel *channel, const net_
 {
   struct rpki_proto *p = cache->p;
 
-  rta a0 = {
-    .pref = channel->preference,
-    .source = RTS_RPKI,
-    .scope = SCOPE_UNIVERSE,
-    .dest = RTD_NONE,
-  };
+  ea_list *ea = NULL;
+  ea_set_attr_u32(&ea, &ea_gen_preference, 0, channel->preference);
+  ea_set_attr_u32(&ea, &ea_gen_source, 0, RTS_RPKI);
 
-  rte e0 = { .attrs = &a0, .src = p->p.main_source, };
+  rte e0 = { .attrs = ea, .src = p->p.main_source, };
 
   rte_update(channel, &pfxr->n, &e0, p->p.main_source);
 }
@@ -834,16 +831,27 @@ rpki_show_proto_info(struct proto *P)
   if (cache)
   {
     const char *transport_name = "---";
+    uint default_port = 0;
 
     switch (cf->tr_config.type)
     {
 #if HAVE_LIBSSH
-    case RPKI_TR_SSH: transport_name = "SSHv2"; break;
+    case RPKI_TR_SSH:
+      transport_name = "SSHv2";
+      default_port = RPKI_SSH_PORT;
+      break;
 #endif
-    case RPKI_TR_TCP: transport_name = "Unprotected over TCP"; break;
+    case RPKI_TR_TCP:
+      transport_name = "Unprotected over TCP";
+      default_port = RPKI_TCP_PORT;
+      break;
     };
 
     cli_msg(-1006, "  Cache server:     %s", cf->hostname);
+
+    if (cf->port != default_port)
+      cli_msg(-1006, "  Cache port:       %u", cf->port);
+
     cli_msg(-1006, "  Status:           %s", rpki_cache_state_to_str(cache->state));
     cli_msg(-1006, "  Transport:        %s", transport_name);
     cli_msg(-1006, "  Protocol version: %u", cache->version);
@@ -941,7 +949,6 @@ rpki_copy_config(struct proto_config *dest UNUSED, struct proto_config *src UNUS
 struct protocol proto_rpki = {
   .name = 		"RPKI",
   .template = 		"rpki%d",
-  .class =		PROTOCOL_RPKI,
   .preference = 	DEF_PREF_RPKI,
   .proto_size = 	sizeof(struct rpki_proto),
   .config_size =	sizeof(struct rpki_config),
@@ -955,3 +962,9 @@ struct protocol proto_rpki = {
   .reconfigure = 	rpki_reconfigure,
   .get_status = 	rpki_get_status,
 };
+
+void
+rpki_build(void)
+{
+  proto_build(&proto_rpki);
+}
diff --git a/proto/rpki/rpki.h b/proto/rpki/rpki.h
index 8a5c38fd..26fbb46e 100644
--- a/proto/rpki/rpki.h
+++ b/proto/rpki/rpki.h
@@ -13,7 +13,7 @@
 #define _BIRD_RPKI_H_
 
 #include "nest/bird.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/protocol.h"
 #include "lib/socket.h"
 #include "lib/ip.h"
diff --git a/proto/rpki/transport.c b/proto/rpki/transport.c
index a1ac7587..81bd6dd8 100644
--- a/proto/rpki/transport.c
+++ b/proto/rpki/transport.c
@@ -85,6 +85,7 @@ rpki_tr_open(struct rpki_tr_sock *tr)
   sk->rbsize = RPKI_RX_BUFFER_SIZE;
   sk->tbsize = RPKI_TX_BUFFER_SIZE;
   sk->tos = IP_PREC_INTERNET_CONTROL;
+  sk->vrf = cache->p->p.vrf;
 
   if (ipa_zero(sk->daddr) && sk->host)
   {
diff --git a/proto/static/Makefile b/proto/static/Makefile
index e38f9b74..26aed31f 100644
--- a/proto/static/Makefile
+++ b/proto/static/Makefile
@@ -2,5 +2,6 @@ src := static.c
 obj := $(src-o-files)
 $(all-daemon)
 $(cf-local)
+$(call proto-build,static_build)
 
-tests_objs := $(tests_objs) $(src-o-files)
\ No newline at end of file
+tests_objs := $(tests_objs) $(src-o-files)
diff --git a/proto/static/config.Y b/proto/static/config.Y
index 41e10dbf..9d26ee82 100644
--- a/proto/static/config.Y
+++ b/proto/static/config.Y
@@ -40,7 +40,7 @@ static_route_finish(void)
   if (net_type_match(this_srt->net, NB_DEST) == !this_srt->dest)
     cf_error("Unexpected or missing nexthop/type");
 
-  this_srt->cmds = f_linearize(this_srt_cmds);
+  this_srt->cmds = f_linearize(this_srt_cmds, 0);
 }
 
 CF_DECLS
diff --git a/proto/static/static.c b/proto/static/static.c
index f8ac9c81..f0a514f7 100644
--- a/proto/static/static.c
+++ b/proto/static/static.c
@@ -38,7 +38,7 @@
 #include "nest/bird.h"
 #include "nest/iface.h"
 #include "nest/protocol.h"
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/cli.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
@@ -47,74 +47,81 @@
 
 #include "static.h"
 
-static linpool *static_lp;
-
 static inline struct rte_src * static_get_source(struct static_proto *p, uint i)
 { return i ? rt_get_source(&p->p, i) : p->p.main_source; }
 
 static void
 static_announce_rte(struct static_proto *p, struct static_route *r)
 {
-  rta *a = allocz(RTA_MAX_SIZE);
+  ea_list *ea = NULL;
   struct rte_src *src = static_get_source(p, r->index);
-  a->source = RTS_STATIC;
-  a->scope = SCOPE_UNIVERSE;
-  a->dest = r->dest;
-  a->pref = p->p.main_channel->preference;
+  ea_set_attr_u32(&ea, &ea_gen_preference, 0, p->p.main_channel->preference);
+  ea_set_attr_u32(&ea, &ea_gen_source, 0, RTS_STATIC);
 
   if (r->dest == RTD_UNICAST)
   {
-    struct static_route *r2;
-    struct nexthop *nhs = NULL;
+    uint sz = 0;
+    for (struct static_route *r2 = r; r2; r2 = r2->mp_next)
+      if (r2->active)
+	sz += NEXTHOP_SIZE_CNT(r2->mls ? r2->mls->length / sizeof(u32) : 0);
 
-    for (r2 = r; r2; r2 = r2->mp_next)
+    if (!sz)
+      goto withdraw;
+
+    struct nexthop_adata *nhad = allocz(sz + sizeof *nhad);
+    struct nexthop *nh = &nhad->nh;
+
+    for (struct static_route *r2 = r; r2; r2 = r2->mp_next)
     {
       if (!r2->active)
 	continue;
 
-      struct nexthop *nh = allocz(NEXTHOP_MAX_SIZE);
-      nh->gw = r2->via;
-      nh->iface = r2->neigh->iface;
-      nh->flags = r2->onlink ? RNF_ONLINK : 0;
-      nh->weight = r2->weight;
+      *nh = (struct nexthop) {
+	.gw = r2->via,
+	.iface = r2->neigh->iface,
+	.flags = r2->onlink ? RNF_ONLINK : 0,
+	.weight = r2->weight,
+      };
+
       if (r2->mls)
       {
-	nh->labels = r2->mls->len;
-	memcpy(nh->label, r2->mls->stack, r2->mls->len * sizeof(u32));
+	nh->labels = r2->mls->length / sizeof(u32);
+	memcpy(nh->label, r2->mls->data, r2->mls->length);
       }
 
-      nexthop_insert(&nhs, nh);
+      nh = NEXTHOP_NEXT(nh);
     }
 
-    if (!nhs)
-      goto withdraw;
-
-    nexthop_link(a, nhs);
+    ea_set_attr_data(&ea, &ea_gen_nexthop, 0,
+	nhad->ad.data, (void *) nh - (void *) nhad->ad.data);
   }
 
-  if (r->dest == RTDX_RECURSIVE)
+  else if (r->dest == RTDX_RECURSIVE)
   {
     rtable *tab = ipa_is_ip4(r->via) ? p->igp_table_ip4 : p->igp_table_ip6;
-    rta_set_recursive_next_hop(p->p.main_channel->table, a, tab, r->via, IPA_NONE, r->mls);
+    u32 *labels = r->mls ? (void *) r->mls->data : NULL;
+    u32 lnum = r->mls ? r->mls->length / sizeof(u32) : 0;
+
+    ea_set_hostentry(&ea, p->p.main_channel->table, tab,
+	r->via, IPA_NONE, lnum, labels);
   }
 
+  else if (r->dest)
+    ea_set_dest(&ea, 0, r->dest);
+
   /* Already announced */
   if (r->state == SRS_CLEAN)
     return;
 
   /* We skip rta_lookup() here */
-  rte e0 = { .attrs = a, .src = src, .net = r->net, }, *e = &e0;
+  rte e0 = { .attrs = ea, .src = src, .net = r->net, }, *e = &e0;
 
   /* Evaluate the filter */
   if (r->cmds)
-    f_eval_rte(r->cmds, e, static_lp);
+    f_eval_rte(r->cmds, e);
 
   rte_update(p->p.main_channel, r->net, e, src);
   r->state = SRS_CLEAN;
-
-  if (r->cmds)
-    lp_flush(static_lp);
-
   return;
 
 withdraw:
@@ -310,31 +317,17 @@ static_same_dest(struct static_route *x, struct static_route *y)
 	  (x->weight != y->weight) ||
 	  (x->use_bfd != y->use_bfd) ||
 	  (!x->mls != !y->mls) ||
-	  ((x->mls) && (y->mls) && (x->mls->len != y->mls->len)))
+	  ((x->mls) && (y->mls) && adata_same(x->mls, y->mls)))
 	return 0;
-
-      if (!x->mls)
-	continue;
-
-      for (uint i = 0; i < x->mls->len; i++)
-	if (x->mls->stack[i] != y->mls->stack[i])
-	  return 0;
     }
     return !x && !y;
 
   case RTDX_RECURSIVE:
     if (!ipa_equal(x->via, y->via) ||
 	(!x->mls != !y->mls) ||
-	((x->mls) && (y->mls) && (x->mls->len != y->mls->len)))
+	((x->mls) && (y->mls) && adata_same(x->mls, y->mls)))
       return 0;
 
-    if (!x->mls)
-      return 1;
-
-    for (uint i = 0; i < x->mls->len; i++)
-      if (x->mls->stack[i] != y->mls->stack[i])
-	return 0;
-
     return 1;
 
   default:
@@ -403,16 +396,16 @@ static_reload_routes(struct channel *C)
 static int
 static_rte_better(rte *new, rte *old)
 {
-  u32 n = ea_get_int(new->attrs->eattrs, EA_GEN_IGP_METRIC, IGP_METRIC_UNKNOWN);
-  u32 o = ea_get_int(old->attrs->eattrs, EA_GEN_IGP_METRIC, IGP_METRIC_UNKNOWN);
+  u32 n = ea_get_int(new->attrs, &ea_gen_igp_metric, IGP_METRIC_UNKNOWN);
+  u32 o = ea_get_int(old->attrs, &ea_gen_igp_metric, IGP_METRIC_UNKNOWN);
   return n < o;
 }
 
 static int
 static_rte_mergable(rte *pri, rte *sec)
 {
-  u32 a = ea_get_int(pri->attrs->eattrs, EA_GEN_IGP_METRIC, IGP_METRIC_UNKNOWN);
-  u32 b = ea_get_int(sec->attrs->eattrs, EA_GEN_IGP_METRIC, IGP_METRIC_UNKNOWN);
+  u32 a = ea_get_int(pri->attrs, &ea_gen_igp_metric, IGP_METRIC_UNKNOWN);
+  u32 b = ea_get_int(sec->attrs, &ea_gen_igp_metric, IGP_METRIC_UNKNOWN);
   return a == b;
 }
 
@@ -474,9 +467,6 @@ static_start(struct proto *P)
   struct static_config *cf = (void *) P->cf;
   struct static_route *r;
 
-  if (!static_lp)
-    static_lp = lp_new(&root_pool, LP_GOOD_SIZE(1024));
-
   if (p->igp_table_ip4)
     rt_lock_table(p->igp_table_ip4);
 
@@ -703,11 +693,12 @@ static_copy_config(struct proto_config *dest, struct proto_config *src)
 static void
 static_get_route_info(rte *rte, byte *buf)
 {
-  eattr *a = ea_find(rte->attrs->eattrs, EA_GEN_IGP_METRIC);
-  if (a)
-    buf += bsprintf(buf, " (%d/%u)", rte->attrs->pref, a->u.data);
+  eattr *a = ea_find(rte->attrs, &ea_gen_igp_metric);
+  u32 pref = rt_get_preference(rte);
+  if (a && (a->u.data < IGP_METRIC_UNKNOWN))
+    buf += bsprintf(buf, " (%d/%u)", pref, a->u.data);
   else
-    buf += bsprintf(buf, " (%d)", rte->attrs->pref);
+    buf += bsprintf(buf, " (%d)", pref);
 }
 
 static void
@@ -761,7 +752,6 @@ static_show(struct proto *P)
 struct protocol proto_static = {
   .name =		"Static",
   .template =		"static%d",
-  .class =		PROTOCOL_STATIC,
   .preference =		DEF_PREF_STATIC,
   .channel_mask =	NB_ANY,
   .proto_size =		sizeof(struct static_proto),
@@ -775,3 +765,9 @@ struct protocol proto_static = {
   .copy_config =	static_copy_config,
   .get_route_info =	static_get_route_info,
 };
+
+void
+static_build(void)
+{
+  proto_build(&proto_static);
+}
diff --git a/proto/static/static.h b/proto/static/static.h
index fc91f71c..ea7ca33b 100644
--- a/proto/static/static.h
+++ b/proto/static/static.h
@@ -9,7 +9,7 @@
 #ifndef _BIRD_STATIC_H_
 #define _BIRD_STATIC_H_
 
-#include "nest/route.h"
+#include "nest/rt.h"
 #include "nest/bfd.h"
 #include "lib/buffer.h"
 
@@ -49,7 +49,7 @@ struct static_route {
   byte weight;				/* Multipath next hop weight */
   byte use_bfd;				/* Configured to use BFD */
   struct bfd_request *bfd_req;		/* BFD request, if BFD is used */
-  mpls_label_stack *mls;		/* MPLS label stack; may be NULL */
+  struct adata *mls;			/* MPLS label stack; may be NULL */
 };
 
 /*