3 files changed, 23 insertions, 3 deletions
diff --git a/sysdep/unix/krt.Y b/sysdep/unix/krt.Y
index 40f1af9f..0375a13b 100644
--- a/sysdep/unix/krt.Y
+++ b/sysdep/unix/krt.Y
@@ -17,7 +17,7 @@ CF_DEFINES
 
 CF_DECLS
 
-CF_KEYWORDS(KERNEL, PERSIST, SCAN, TIME, LEARN, DEVICE)
+CF_KEYWORDS(KERNEL, PERSIST, SCAN, TIME, LEARN, DEVICE, ROUTES)
 
 CF_GRAMMAR
 
@@ -56,6 +56,7 @@ kern_item:
 	cf_error("Learning of kernel routes not supported in this configuration");
 #endif
    }
+ | DEVICE ROUTES bool { THIS_KRT->devroutes = $3; }
  ;
 
 /* Kernel interface protocol */
diff --git a/sysdep/unix/krt.c b/sysdep/unix/krt.c
index c8887b72..419bdd94 100644
--- a/sysdep/unix/krt.c
+++ b/sysdep/unix/krt.c
@@ -734,6 +734,25 @@ krt_scan(timer *t UNUSED)
 /*
  *	Updates
  */
+static int
+krt_import_control(struct proto *P, rte **new, ea_list **attrs, struct linpool *pool)
+{
+  struct krt_proto *p = (struct krt_proto *) P;
+  rte *e = *new;
+
+  if (e->attrs->proto == P)
+    return -1;
+
+  if (!KRT_CF->devroutes && 
+      (e->attrs->dest == RTD_DEVICE) && 
+      (e->attrs->source != RTS_STATIC_DEVICE))
+    return -1;
+
+  if (!krt_capable(e))
+    return -1;
+
+  return 0;
+}
 
 static void
 krt_notify(struct proto *P, struct rtable *table UNUSED, net *net,
@@ -743,8 +762,6 @@ krt_notify(struct proto *P, struct rtable *table UNUSED, net *net,
 
   if (shutting_down)
     return;
-  if (new && (!krt_capable(new) || new->attrs->source == RTS_INHERIT))
-    new = NULL;
   if (!(net->n.flags & KRF_INSTALLED))
     old = NULL;
   if (new)
@@ -871,6 +888,7 @@ krt_init(struct proto_config *c)
   struct krt_proto *p = proto_new(c, sizeof(struct krt_proto));
 
   p->p.accept_ra_types = RA_OPTIMAL;
+  p->p.import_control = krt_import_control;
   p->p.rt_notify = krt_notify;
   return &p->p;
 }
diff --git a/sysdep/unix/krt.h b/sysdep/unix/krt.h
index 1d9e1448..ed61621f 100644
--- a/sysdep/unix/krt.h
+++ b/sysdep/unix/krt.h
@@ -47,6 +47,7 @@ struct krt_config {
   int persist;			/* Keep routes when we exit */
   int scan_time;		/* How often we re-scan routes */
   int learn;			/* Learn routes from other sources */
+  int devroutes;		/* Allow export of device routes */
 };
 
 struct krt_proto {