From 56c8f2f03a8631417dc3b730625c08ffca42ead2 Mon Sep 17 00:00:00 2001
From: Maria Matejka <mq@ucw.cz>
Date: Fri, 1 May 2020 22:26:24 +0200
Subject: Nest: Route generations and explicit tracking route propagion through
 pipes

---
 doc/bird.sgml | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index a2138b55..d1a3b70f 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -4124,6 +4124,14 @@ include standard channel config options; see the example below.
 	<tag><label id="pipe-peer-table">peer table <m/table/</tag>
 	Defines secondary routing table to connect to. The primary one is
 	selected by the <cf/table/ keyword.
+
+	<tag><label id="pipe-max-generation">max generation <m/expr/</tag>
+	Sets maximal generation of route that may pass through this pipe.
+	The generation value is increased by one by each pipe on its path.
+	Not meeting this requirement causes an error message complaining about
+	an overpiped route. If you have long chains of pipes, you probably want
+	to raise this value; anyway the default of 16 should be enough for even
+	most strange uses. Maximum is 254.
 </descrip>
 
 <sect1>Attributes
-- 
cgit v1.2.3


From 00410fd6c17697a5919cb32a44f7117dd3a0834a Mon Sep 17 00:00:00 2001
From: Simon Ruderich <simon@ruderich.org>
Date: Sat, 18 Dec 2021 03:17:48 +0100
Subject: Doc: bgp: remove "advertise ipv4"

The option was removed in d15b0b0a ("BGP redesign", 2016-12-07)
but the documentation wasn't updated.
---
 doc/bird.sgml | 7 -------
 1 file changed, 7 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 39dadaf2..4e4804de 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -2607,13 +2607,6 @@ using the following configuration parameters:
 	disabled. Default: on, with automatic fallback to off when received
 	capability-related error.
 
-	<tag><label id="bgp-advertise-ipv4">advertise ipv4 <m/switch/</tag>
-	Advertise IPv4 multiprotocol capability. This is not a correct behavior
-	according to the strict interpretation of <rfc id="4760">, but it is
-	widespread and required by some BGP implementations (Cisco and Quagga).
-	This option is relevant to IPv4 mode with enabled capability
-	advertisement only. Default: on.
-
 	<tag><label id="bgp-advertise-hostname">advertise hostname <m/switch/</tag>
 	Advertise hostname capability along with the hostname. Default: off.
 
-- 
cgit v1.2.3


From e15e465720c428e765ab88fd587afb4f4f5d70ae Mon Sep 17 00:00:00 2001
From: Alexander Zubkov <green@qrator.net>
Date: Tue, 28 Dec 2021 03:48:42 +0100
Subject: Doc: Document community components access operators

---
 doc/bird.sgml | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 4e4804de..d1059cb1 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -1292,6 +1292,9 @@ in the foot).
 	The same syntax can also be used to construct a pair from two arbitrary
 	integer expressions (for example <cf/(1+2,a)/).
 
+	Operators <cf/.asn/ and <cf/.data/ can be used to extract corresponding
+	components of a pair: <cf>(<m/asn/, <m/data/)</cf>.
+
 	<tag><label id="type-quad">quad</tag>
 	This is a dotted quad of numbers used to represent router IDs (and
 	others). Each component can have a value from 0 to 255. Literals of
@@ -1382,6 +1385,10 @@ in the foot).
 	pairs, LCs can be constructed using expressions for its parts, (e.g.
 	<cf/(myas, 10+20, 3*10)/, where <cf/myas/ is an integer variable).
 
+	Operators <cf/.asn/, <cf/.data1/, and <cf/.data2/ can be used
+	to extract corresponding components of LCs:
+	<cf>(<m/asn/, <m/data1/, <m/data2/)</cf>.
+
 	<tag><label id="type-set">int|pair|quad|ip|prefix|ec|lc|enum set</tag>
 	Filters recognize four types of sets. Sets are similar to strings: you
 	can pass them around but you can't modify them. Literals of type <cf>int
-- 
cgit v1.2.3


From 77042292ff1ebeb5451f3a4119c3cbde0629f5b1 Mon Sep 17 00:00:00 2001
From: Alexander Zubkov <green@qrator.net>
Date: Tue, 28 Dec 2021 04:09:36 +0100
Subject: Doc: Document min/max operators for lists

---
 doc/bird.sgml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index d1059cb1..a63493da 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -1532,7 +1532,7 @@ in the foot).
 	Clist is similar to a set, except that unlike other sets, it can be
 	modified. The type is used for community list (a set of pairs) and for
 	cluster list (a set of quads). There exist no literals of this type.
-	There are three special operators on clists:
+	There are special operators on clists:
 
 	<cf><m/C/.len</cf> returns the length of clist <m/C/.
 
@@ -1559,6 +1559,15 @@ in the foot).
 	<cf><m/C/.add(<m/P/);</cf> if <m/C/ is appropriate route attribute (for
 	example <cf/bgp_community/). Similarly for <cf/delete/ and <cf/filter/.
 
+	<cf><m/C/.min</cf> returns the minimum element of clist <m/C/.
+
+	<cf><m/C/.max</cf> returns the maximum element of clist <m/C/.
+
+	Operators <cf/.min/, <cf/.max/ can be used together with <cf/filter/
+	to extract the community from the specific subset of communities
+	(e.g. localpref or prepend) without the need to check every possible
+	value (e.g. <cf/filter(bgp_community, [(23456, 1000..1099)]).min/).
+
 	<tag><label id="type-eclist">eclist</tag>
 	Eclist is a data type used for BGP extended community lists. Eclists
 	are very similar to clists, but they are sets of ECs instead of pairs.
-- 
cgit v1.2.3


From 60e9def9ef7b5d16f868b0fb4ab1192d59fd7541 Mon Sep 17 00:00:00 2001
From: "Ondrej Zajicek (work)" <santiago@crfreenet.org>
Date: Sun, 9 Jan 2022 02:40:58 +0100
Subject: BGP: Add option 'free bind'

The BGP 'free bind' option applies the IP_FREEBIND/IPV6_FREEBIND
socket option for the BGP listening socket.

Thanks to Alexander Zubkov for the idea.
---
 doc/bird.sgml      |  6 ++++++
 proto/bgp/bgp.c    | 11 ++++++++---
 proto/bgp/bgp.h    |  1 +
 proto/bgp/config.Y |  3 ++-
 4 files changed, 17 insertions(+), 4 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index a63493da..0112622e 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -2412,6 +2412,12 @@ using the following configuration parameters:
 	same address family and using the same local port) should have set
 	<cf/strict bind/, or none of them. Default: disabled.
 
+	<tag><label id="bgp-free-bind">free bind <m/switch/</tag>
+	Use IP_FREEBIND socket option for the listening socket, which allows
+	binding to an IP address not (yet) assigned to an interface. Note that
+	all BGP instances that share a listening socket should have the same
+	value of the <cf/freebind/ option. Default: disabled.
+
 	<tag><label id="bgp-check-link">check link <M>switch</M></tag>
 	BGP could use hardware link state into consideration.  If enabled,
 	BIRD tracks the link state of the associated interface and when link
diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index e4d754b1..b6f21bc6 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -157,6 +157,8 @@ bgp_open(struct bgp_proto *p)
   ip_addr addr = p->cf->strict_bind ? p->cf->local_ip :
     (p->ipv4 ? IPA_NONE4 : IPA_NONE6);
   uint port = p->cf->local_port;
+  uint flags = p->cf->free_bind ? SKF_FREEBIND : 0;
+  uint flag_mask = SKF_FREEBIND;
 
   /* FIXME: Add some global init? */
   if (!bgp_linpool)
@@ -165,8 +167,11 @@ bgp_open(struct bgp_proto *p)
   /* We assume that cf->iface is defined iff cf->local_ip is link-local */
 
   WALK_LIST(bs, bgp_sockets)
-    if (ipa_equal(bs->sk->saddr, addr) && (bs->sk->sport == port) &&
-	(bs->sk->iface == ifa) && (bs->sk->vrf == p->p.vrf))
+    if (ipa_equal(bs->sk->saddr, addr) &&
+	(bs->sk->sport == port) &&
+	(bs->sk->iface == ifa) &&
+	(bs->sk->vrf == p->p.vrf) &&
+	((bs->sk->flags & flag_mask) == flags))
     {
       bs->uc++;
       p->sock = bs;
@@ -180,7 +185,7 @@ bgp_open(struct bgp_proto *p)
   sk->sport = port;
   sk->iface = ifa;
   sk->vrf = p->p.vrf;
-  sk->flags = 0;
+  sk->flags = flags;
   sk->tos = IP_PREC_INTERNET_CONTROL;
   sk->rbsize = BGP_RX_BUFFER_SIZE;
   sk->tbsize = BGP_TX_BUFFER_SIZE;
diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h
index cca4b448..5e025ccd 100644
--- a/proto/bgp/bgp.h
+++ b/proto/bgp/bgp.h
@@ -86,6 +86,7 @@ struct bgp_config {
   int peer_type;			/* Internal or external BGP (BGP_PT_*, optional) */
   int multihop;				/* Number of hops if multihop */
   int strict_bind;			/* Bind listening socket to local address */
+  int free_bind;			/* Bind listening socket with SKF_FREEBIND */
   int ttl_security;			/* Enable TTL security [RFC 5082] */
   int compare_path_lengths;		/* Use path lengths when selecting best route */
   int med_metric;			/* Compare MULTI_EXIT_DISC even between routes from differen ASes */
diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y
index 2dfbdca9..7cbc9985 100644
--- a/proto/bgp/config.Y
+++ b/proto/bgp/config.Y
@@ -31,7 +31,7 @@ CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, KEEPALIVE,
 	STRICT, BIND, CONFEDERATION, MEMBER, MULTICAST, FLOW4, FLOW6, LONG,
 	LIVED, STALE, IMPORT, IBGP, EBGP, MANDATORY, INTERNAL, EXTERNAL, SETS,
 	DYNAMIC, RANGE, NAME, DIGITS, BGP_AIGP, AIGP, ORIGINATE, COST, ENFORCE,
-	FIRST)
+	FIRST, FREE)
 
 %type <i> bgp_nh
 %type <i32> bgp_afi
@@ -155,6 +155,7 @@ bgp_proto:
    }
  | bgp_proto DYNAMIC NAME DIGITS expr ';' { BGP_CFG->dynamic_name_digits = $5; if ($5>10) cf_error("Dynamic name digits must be at most 10"); }
  | bgp_proto STRICT BIND bool ';' { BGP_CFG->strict_bind = $4; }
+ | bgp_proto FREE BIND bool ';' { BGP_CFG->free_bind = $4; }
  | bgp_proto PATH METRIC bool ';' { BGP_CFG->compare_path_lengths = $4; }
  | bgp_proto MED METRIC bool ';' { BGP_CFG->med_metric = $4; }
  | bgp_proto IGP METRIC bool ';' { BGP_CFG->igp_metric = $4; }
-- 
cgit v1.2.3


From 81ee6cda2e60bbd3d97ab63da30657a54b09feda Mon Sep 17 00:00:00 2001
From: "Ondrej Zajicek (work)" <santiago@crfreenet.org>
Date: Mon, 17 Jan 2022 05:11:29 +0100
Subject: Netlink: Add option to specify netlink socket receive buffer size

Add option 'netlink rx buffer' to specify netlink socket receive buffer
size. Uses SO_RCVBUFFORCE, so it can override rmem_max limit.

Thanks to Trisha Biswas and Michal for the original patches.
---
 doc/bird.sgml               |    6 +
 sysdep/linux/krt-sys.h      |    1 +
 sysdep/linux/netlink.Y      |    4 +-
 sysdep/linux/netlink.c      |   54 ++
 sysdep/linux/netlink.c.orig | 2179 +++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 2243 insertions(+), 1 deletion(-)
 create mode 100644 sysdep/linux/netlink.c.orig

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 0112622e..f10b15e2 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -3248,6 +3248,12 @@ channels.
 	allows to specify a limit on maximal number of nexthops in one route. By
 	default, multipath merging is disabled. If enabled, default value of the
 	limit is 16.
+
+	<tag><label id="krt-netlink-rx-buffer">netlink rx buffer <m/number/</tag> (Linux)
+	Set kernel receive buffer size (in bytes) for the netlink socket. The default
+	value is OS-dependent (from the <file>/proc/sys/net/core/rmem_default</file>
+	file), If you get some "Kernel dropped some netlink message ..." warnings,
+	you may increase this value.
 </descrip>
 
 <sect1>Attributes
diff --git a/sysdep/linux/krt-sys.h b/sysdep/linux/krt-sys.h
index a8af4c95..8897f889 100644
--- a/sysdep/linux/krt-sys.h
+++ b/sysdep/linux/krt-sys.h
@@ -69,6 +69,7 @@ static inline struct ifa * kif_get_primary_ip(struct iface *i UNUSED) { return N
 struct krt_params {
   u32 table_id;				/* Kernel table ID we sync with */
   u32 metric;				/* Kernel metric used for all routes */
+  uint netlink_rx_buffer;		/* Rx buffer size for the netlink socket */
 };
 
 struct krt_state {
diff --git a/sysdep/linux/netlink.Y b/sysdep/linux/netlink.Y
index 7097f577..487ad1d8 100644
--- a/sysdep/linux/netlink.Y
+++ b/sysdep/linux/netlink.Y
@@ -10,7 +10,8 @@ CF_HDR
 
 CF_DECLS
 
-CF_KEYWORDS(KERNEL, TABLE, METRIC, KRT_PREFSRC, KRT_REALM, KRT_SCOPE, KRT_MTU, KRT_WINDOW,
+CF_KEYWORDS(KERNEL, TABLE, METRIC, NETLINK, RX, BUFFER,
+	    KRT_PREFSRC, KRT_REALM, KRT_SCOPE, KRT_MTU, KRT_WINDOW,
 	    KRT_RTT, KRT_RTTVAR, KRT_SSTRESH, KRT_CWND, KRT_ADVMSS, KRT_REORDERING,
 	    KRT_HOPLIMIT, KRT_INITCWND, KRT_RTO_MIN, KRT_INITRWND, KRT_QUICKACK,
 	    KRT_LOCK_MTU, KRT_LOCK_WINDOW, KRT_LOCK_RTT, KRT_LOCK_RTTVAR,
@@ -24,6 +25,7 @@ kern_proto: kern_proto kern_sys_item ';' ;
 kern_sys_item:
    KERNEL TABLE expr { THIS_KRT->sys.table_id = $3; }
  | METRIC expr { THIS_KRT->sys.metric = $2; }
+ | NETLINK RX BUFFER expr { THIS_KRT->sys.netlink_rx_buffer = $4; }
  ;
 
 dynamic_attr: KRT_PREFSRC	{ $$ = f_new_dynamic_attr(EAF_TYPE_IP_ADDRESS, T_IP, EA_KRT_PREFSRC); } ;
diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c
index ccd62f26..f662301d 100644
--- a/sysdep/linux/netlink.c
+++ b/sysdep/linux/netlink.c
@@ -174,6 +174,27 @@ nl_set_strict_dump(struct nl_sock *nl, int strict)
 #endif
 }
 
+static void
+nl_set_rcvbuf(int fd, uint val)
+{
+  if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE, &val, sizeof(val)) < 0)
+    log(L_WARN "KRT: Cannot set netlink rx buffer size to %u: %m", val);
+}
+
+static uint
+nl_cfg_rx_buffer_size(struct config *cfg)
+{
+  uint bufsize = 0;
+
+  struct proto_config *pc;
+  WALK_LIST(pc, cfg->protos)
+    if ((pc->protocol == &proto_unix_kernel) && !pc->disabled)
+      bufsize = MAX(bufsize, ((struct krt_config *) pc)->sys.netlink_rx_buffer);
+
+  return bufsize;
+}
+
+
 static void
 nl_open(void)
 {
@@ -1976,6 +1997,8 @@ krt_do_scan(struct krt_proto *p UNUSED)	/* CONFIG_ALL_TABLES_AT_ONCE => p is NUL
 
 static sock *nl_async_sk;		/* BIRD socket for asynchronous notifications */
 static byte *nl_async_rx_buffer;	/* Receive buffer */
+static uint nl_async_bufsize;		/* Kernel rx buffer size for the netlink socket */
+static struct config *nl_last_config;	/* For tracking changes to nl_async_bufsize */
 
 static void
 nl_async_msg(struct nlmsghdr *h)
@@ -2111,6 +2134,32 @@ nl_open_async(void)
     bug("Netlink: sk_open failed");
 }
 
+static void
+nl_update_async_bufsize(void)
+{
+  /* No async socket */
+  if (!nl_async_sk)
+    return;
+
+  /* Already reconfigured */
+  if (nl_last_config == config)
+    return;
+
+  /* Update netlink buffer size */
+  uint bufsize = nl_cfg_rx_buffer_size(config);
+  if (bufsize && (bufsize != nl_async_bufsize))
+  {
+    /* Log message for reconfigurations only */
+    if (nl_last_config)
+      log(L_INFO "KRT: Changing netlink rx buffer size to %u", bufsize);
+
+    nl_set_rcvbuf(nl_async_sk->fd, bufsize);
+    nl_async_bufsize = bufsize;
+  }
+
+  nl_last_config = config;
+}
+
 
 /*
  *	Interface to the UNIX krt module
@@ -2139,6 +2188,7 @@ krt_sys_start(struct krt_proto *p)
 
   nl_open();
   nl_open_async();
+  nl_update_async_bufsize();
 
   return 1;
 }
@@ -2146,12 +2196,16 @@ krt_sys_start(struct krt_proto *p)
 void
 krt_sys_shutdown(struct krt_proto *p)
 {
+  nl_update_async_bufsize();
+
   HASH_REMOVE2(nl_table_map, RTH, krt_pool, p);
 }
 
 int
 krt_sys_reconfigure(struct krt_proto *p UNUSED, struct krt_config *n, struct krt_config *o)
 {
+  nl_update_async_bufsize();
+
   return (n->sys.table_id == o->sys.table_id) && (n->sys.metric == o->sys.metric);
 }
 
diff --git a/sysdep/linux/netlink.c.orig b/sysdep/linux/netlink.c.orig
new file mode 100644
index 00000000..7cea5322
--- /dev/null
+++ b/sysdep/linux/netlink.c.orig
@@ -0,0 +1,2179 @@
+/*
+ *	BIRD -- Linux Netlink Interface
+ *
+ *	(c) 1999--2000 Martin Mares <mj@ucw.cz>
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include <alloca.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/uio.h>
+#include <errno.h>
+
+#undef LOCAL_DEBUG
+
+#include "nest/bird.h"
+#include "nest/route.h"
+#include "nest/protocol.h"
+#include "nest/iface.h"
+#include "lib/alloca.h"
+#include "sysdep/unix/unix.h"
+#include "sysdep/unix/krt.h"
+#include "lib/socket.h"
+#include "lib/string.h"
+#include "lib/hash.h"
+#include "conf/conf.h"
+
+#include <asm/types.h>
+#include <linux/if.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+
+#ifdef HAVE_MPLS_KERNEL
+#include <linux/lwtunnel.h>
+#endif
+
+#ifndef MSG_TRUNC			/* Hack: Several versions of glibc miss this one :( */
+#define MSG_TRUNC 0x20
+#endif
+
+#ifndef IFA_FLAGS
+#define IFA_FLAGS 8
+#endif
+
+#ifndef IFF_LOWER_UP
+#define IFF_LOWER_UP 0x10000
+#endif
+
+#ifndef RTA_TABLE
+#define RTA_TABLE  15
+#endif
+
+#ifndef RTA_VIA
+#define RTA_VIA	 18
+#endif
+
+#ifndef RTA_NEWDST
+#define RTA_NEWDST  19
+#endif
+
+#ifndef RTA_ENCAP_TYPE
+#define RTA_ENCAP_TYPE	21
+#endif
+
+#ifndef RTA_ENCAP
+#define RTA_ENCAP  22
+#endif
+
+#define krt_ipv4(p) ((p)->af == AF_INET)
+#define krt_ecmp6(p) ((p)->af == AF_INET6)
+
+const int rt_default_ecmp = 16;
+
+/*
+ * Structure nl_parse_state keeps state of received route processing. Ideally,
+ * we could just independently parse received Netlink messages and immediately
+ * propagate received routes to the rest of BIRD, but older Linux kernel (before
+ * version 4.11) represents and announces IPv6 ECMP routes not as one route with
+ * multiple next hops (like RTA_MULTIPATH in IPv4 ECMP), but as a sequence of
+ * routes with the same prefix. More recent kernels work as with IPv4.
+ *
+ * Therefore, BIRD keeps currently processed route in nl_parse_state structure
+ * and postpones its propagation until we expect it to be final; i.e., when
+ * non-matching route is received or when the scan ends. When another matching
+ * route is received, it is merged with the already processed route to form an
+ * ECMP route. Note that merging is done only for IPv6 (merge == 1), but the
+ * postponing is done in both cases (for simplicity). All IPv4 routes or IPv6
+ * routes with RTA_MULTIPATH set are just considered non-matching.
+ *
+ * This is ignored for asynchronous notifications (every notification is handled
+ * as a separate route). It is not an issue for our routes, as we ignore such
+ * notifications anyways. But importing alien IPv6 ECMP routes does not work
+ * properly with older kernels.
+ *
+ * Whatever the kernel version is, IPv6 ECMP routes are sent as multiple routes
+ * for the same prefix.
+ */
+
+struct nl_parse_state
+{
+  struct linpool *pool;
+  int scan;
+  int merge;
+
+  net *net;
+  rta *attrs;
+  struct krt_proto *proto;
+  s8 new;
+  s8 krt_src;
+  u8 krt_type;
+  u8 krt_proto;
+  u32 krt_metric;
+
+  u32 rta_flow;		/* Used during parsing */
+};
+
+/*
+ *	Synchronous Netlink interface
+ */
+
+struct nl_sock
+{
+  int fd;
+  u32 seq;
+  byte *rx_buffer;			/* Receive buffer */
+  struct nlmsghdr *last_hdr;		/* Recently received packet */
+  uint last_size;
+};
+
+#define NL_RX_SIZE 8192
+
+#define NL_OP_DELETE	0
+#define NL_OP_ADD	(NLM_F_CREATE|NLM_F_EXCL)
+#define NL_OP_REPLACE	(NLM_F_CREATE|NLM_F_REPLACE)
+#define NL_OP_APPEND	(NLM_F_CREATE|NLM_F_APPEND)
+
+static linpool *nl_linpool;
+
+static struct nl_sock nl_scan = {.fd = -1};	/* Netlink socket for synchronous scan */
+static struct nl_sock nl_req  = {.fd = -1};	/* Netlink socket for requests */
+
+static void
+nl_open_sock(struct nl_sock *nl)
+{
+  if (nl->fd < 0)
+    {
+      nl->fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+      if (nl->fd < 0)
+	die("Unable to open rtnetlink socket: %m");
+      nl->seq = (u32) (current_time() TO_S); /* Or perhaps random_u32() ? */
+      nl->rx_buffer = xmalloc(NL_RX_SIZE);
+      nl->last_hdr = NULL;
+      nl->last_size = 0;
+    }
+}
+
+static void
+nl_open(void)
+{
+  nl_open_sock(&nl_scan);
+  nl_open_sock(&nl_req);
+}
+
+static void
+nl_send(struct nl_sock *nl, struct nlmsghdr *nh)
+{
+  struct sockaddr_nl sa;
+
+  memset(&sa, 0, sizeof(sa));
+  sa.nl_family = AF_NETLINK;
+  nh->nlmsg_pid = 0;
+  nh->nlmsg_seq = ++(nl->seq);
+  nh->nlmsg_len = NLMSG_ALIGN(nh->nlmsg_len);
+  if (sendto(nl->fd, nh, nh->nlmsg_len, 0, (struct sockaddr *)&sa, sizeof(sa)) < 0)
+    die("rtnetlink sendto: %m");
+  nl->last_hdr = NULL;
+}
+
+static void
+nl_request_dump(int af, int cmd)
+{
+  struct {
+    struct nlmsghdr nh;
+    struct rtgenmsg g;
+  } req = {
+    .nh.nlmsg_type = cmd,
+    .nh.nlmsg_len = sizeof(req),
+    .nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP,
+    .g.rtgen_family = af
+  };
+  nl_send(&nl_scan, &req.nh);
+}
+
+static struct nlmsghdr *
+nl_get_reply(struct nl_sock *nl)
+{
+  for(;;)
+    {
+      if (!nl->last_hdr)
+	{
+	  struct iovec iov = { nl->rx_buffer, NL_RX_SIZE };
+	  struct sockaddr_nl sa;
+	  struct msghdr m = {
+	    .msg_name = &sa,
+	    .msg_namelen = sizeof(sa),
+	    .msg_iov = &iov,
+	    .msg_iovlen = 1,
+	  };
+	  int x = recvmsg(nl->fd, &m, 0);
+	  if (x < 0)
+	    die("nl_get_reply: %m");
+	  if (sa.nl_pid)		/* It isn't from the kernel */
+	    {
+	      DBG("Non-kernel packet\n");
+	      continue;
+	    }
+	  nl->last_size = x;
+	  nl->last_hdr = (void *) nl->rx_buffer;
+	  if (m.msg_flags & MSG_TRUNC)
+	    bug("nl_get_reply: got truncated reply which should be impossible");
+	}
+      if (NLMSG_OK(nl->last_hdr, nl->last_size))
+	{
+	  struct nlmsghdr *h = nl->last_hdr;
+	  nl->last_hdr = NLMSG_NEXT(h, nl->last_size);
+	  if (h->nlmsg_seq != nl->seq)
+	    {
+	      log(L_WARN "nl_get_reply: Ignoring out of sequence netlink packet (%x != %x)",
+		  h->nlmsg_seq, nl->seq);
+	      continue;
+	    }
+	  return h;
+	}
+      if (nl->last_size)
+	log(L_WARN "nl_get_reply: Found packet remnant of size %d", nl->last_size);
+      nl->last_hdr = NULL;
+    }
+}
+
+static struct tbf rl_netlink_err = TBF_DEFAULT_LOG_LIMITS;
+
+static int
+nl_error(struct nlmsghdr *h, int ignore_esrch)
+{
+  struct nlmsgerr *e;
+  int ec;
+
+  if (h->nlmsg_len < NLMSG_LENGTH(sizeof(struct nlmsgerr)))
+    {
+      log(L_WARN "Netlink: Truncated error message received");
+      return ENOBUFS;
+    }
+  e = (struct nlmsgerr *) NLMSG_DATA(h);
+  ec = -e->error;
+  if (ec && !(ignore_esrch && (ec == ESRCH)))
+    log_rl(&rl_netlink_err, L_WARN "Netlink: %s", strerror(ec));
+  return ec;
+}
+
+static struct nlmsghdr *
+nl_get_scan(void)
+{
+  struct nlmsghdr *h = nl_get_reply(&nl_scan);
+
+  if (h->nlmsg_type == NLMSG_DONE)
+    return NULL;
+  if (h->nlmsg_type == NLMSG_ERROR)
+    {
+      nl_error(h, 0);
+      return NULL;
+    }
+  return h;
+}
+
+static int
+nl_exchange(struct nlmsghdr *pkt, int ignore_esrch)
+{
+  struct nlmsghdr *h;
+
+  nl_send(&nl_req, pkt);
+  for(;;)
+    {
+      h = nl_get_reply(&nl_req);
+      if (h->nlmsg_type == NLMSG_ERROR)
+	break;
+      log(L_WARN "nl_exchange: Unexpected reply received");
+    }
+  return nl_error(h, ignore_esrch) ? -1 : 0;
+}
+
+/*
+ *	Netlink attributes
+ */
+
+static int nl_attr_len;
+
+static void *
+nl_checkin(struct nlmsghdr *h, int lsize)
+{
+  nl_attr_len = h->nlmsg_len - NLMSG_LENGTH(lsize);
+  if (nl_attr_len < 0)
+    {
+      log(L_ERR "nl_checkin: underrun by %d bytes", -nl_attr_len);
+      return NULL;
+    }
+  return NLMSG_DATA(h);
+}
+
+struct nl_want_attrs {
+  u8 defined:1;
+  u8 checksize:1;
+  u8 size;
+};
+
+
+#define BIRD_IFLA_MAX (IFLA_WIRELESS+1)
+
+static struct nl_want_attrs ifla_attr_want[BIRD_IFLA_MAX] = {
+  [IFLA_IFNAME]	  = { 1, 0, 0 },
+  [IFLA_MTU]	  = { 1, 1, sizeof(u32) },
+  [IFLA_MASTER]	  = { 1, 1, sizeof(u32) },
+  [IFLA_WIRELESS] = { 1, 0, 0 },
+};
+
+
+#define BIRD_IFA_MAX  (IFA_FLAGS+1)
+
+static struct nl_want_attrs ifa_attr_want4[BIRD_IFA_MAX] = {
+  [IFA_ADDRESS]	  = { 1, 1, sizeof(ip4_addr) },
+  [IFA_LOCAL]	  = { 1, 1, sizeof(ip4_addr) },
+  [IFA_BROADCAST] = { 1, 1, sizeof(ip4_addr) },
+  [IFA_FLAGS]     = { 1, 1, sizeof(u32) },
+};
+
+static struct nl_want_attrs ifa_attr_want6[BIRD_IFA_MAX] = {
+  [IFA_ADDRESS]	  = { 1, 1, sizeof(ip6_addr) },
+  [IFA_LOCAL]	  = { 1, 1, sizeof(ip6_addr) },
+  [IFA_FLAGS]	  = { 1, 1, sizeof(u32) },
+};
+
+
+#define BIRD_RTA_MAX  (RTA_ENCAP+1)
+
+static struct nl_want_attrs nexthop_attr_want4[BIRD_RTA_MAX] = {
+  [RTA_GATEWAY]	  = { 1, 1, sizeof(ip4_addr) },
+  [RTA_VIA]	  = { 1, 0, 0 },
+  [RTA_FLOW]	  = { 1, 1, sizeof(u32) },
+  [RTA_ENCAP_TYPE]= { 1, 1, sizeof(u16) },
+  [RTA_ENCAP]	  = { 1, 0, 0 },
+};
+
+static struct nl_want_attrs nexthop_attr_want6[BIRD_RTA_MAX] = {
+  [RTA_GATEWAY]	  = { 1, 1, sizeof(ip6_addr) },
+  [RTA_VIA]	  = { 1, 0, 0 },
+  [RTA_FLOW]	  = { 1, 1, sizeof(u32) },
+  [RTA_ENCAP_TYPE]= { 1, 1, sizeof(u16) },
+  [RTA_ENCAP]	  = { 1, 0, 0 },
+};
+
+#ifdef HAVE_MPLS_KERNEL
+static struct nl_want_attrs nexthop_attr_want_mpls[BIRD_RTA_MAX] = {
+  [RTA_VIA]	  = { 1, 0, 0 },
+  [RTA_NEWDST]	  = { 1, 0, 0 },
+};
+
+static struct nl_want_attrs encap_mpls_want[BIRD_RTA_MAX] = {
+  [RTA_DST]       = { 1, 0, 0 },
+};
+#endif
+
+static struct nl_want_attrs rtm_attr_want4[BIRD_RTA_MAX] = {
+  [RTA_DST]	  = { 1, 1, sizeof(ip4_addr) },
+  [RTA_OIF]	  = { 1, 1, sizeof(u32) },
+  [RTA_GATEWAY]	  = { 1, 1, sizeof(ip4_addr) },
+  [RTA_PRIORITY]  = { 1, 1, sizeof(u32) },
+  [RTA_PREFSRC]	  = { 1, 1, sizeof(ip4_addr) },
+  [RTA_METRICS]	  = { 1, 0, 0 },
+  [RTA_MULTIPATH] = { 1, 0, 0 },
+  [RTA_FLOW]	  = { 1, 1, sizeof(u32) },
+  [RTA_TABLE]	  = { 1, 1, sizeof(u32) },
+  [RTA_VIA]	  = { 1, 0, 0 },
+  [RTA_ENCAP_TYPE]= { 1, 1, sizeof(u16) },
+  [RTA_ENCAP]	  = { 1, 0, 0 },
+};
+
+static struct nl_want_attrs rtm_attr_want6[BIRD_RTA_MAX] = {
+  [RTA_DST]	  = { 1, 1, sizeof(ip6_addr) },
+  [RTA_SRC]	  = { 1, 1, sizeof(ip6_addr) },
+  [RTA_IIF]	  = { 1, 1, sizeof(u32) },
+  [RTA_OIF]	  = { 1, 1, sizeof(u32) },
+  [RTA_GATEWAY]	  = { 1, 1, sizeof(ip6_addr) },
+  [RTA_PRIORITY]  = { 1, 1, sizeof(u32) },
+  [RTA_PREFSRC]	  = { 1, 1, sizeof(ip6_addr) },
+  [RTA_METRICS]	  = { 1, 0, 0 },
+  [RTA_MULTIPATH] = { 1, 0, 0 },
+  [RTA_FLOW]	  = { 1, 1, sizeof(u32) },
+  [RTA_TABLE]	  = { 1, 1, sizeof(u32) },
+  [RTA_VIA]	  = { 1, 0, 0 },
+  [RTA_ENCAP_TYPE]= { 1, 1, sizeof(u16) },
+  [RTA_ENCAP]	  = { 1, 0, 0 },
+};
+
+#ifdef HAVE_MPLS_KERNEL
+static struct nl_want_attrs rtm_attr_want_mpls[BIRD_RTA_MAX] = {
+  [RTA_DST]	  = { 1, 1, sizeof(u32) },
+  [RTA_IIF]	  = { 1, 1, sizeof(u32) },
+  [RTA_OIF]	  = { 1, 1, sizeof(u32) },
+  [RTA_PRIORITY]  = { 1, 1, sizeof(u32) },
+  [RTA_METRICS]	  = { 1, 0, 0 },
+  [RTA_MULTIPATH] = { 1, 0, 0 },
+  [RTA_FLOW]	  = { 1, 1, sizeof(u32) },
+  [RTA_TABLE]	  = { 1, 1, sizeof(u32) },
+  [RTA_VIA]	  = { 1, 0, 0 },
+  [RTA_NEWDST]	  = { 1, 0, 0 },
+};
+#endif
+
+
+static int
+nl_parse_attrs(struct rtattr *a, struct nl_want_attrs *want, struct rtattr **k, int ksize)
+{
+  int max = ksize / sizeof(struct rtattr *);
+  bzero(k, ksize);
+
+  for ( ; RTA_OK(a, nl_attr_len); a = RTA_NEXT(a, nl_attr_len))
+    {
+      if ((a->rta_type >= max) || !want[a->rta_type].defined)
+	continue;
+
+      if (want[a->rta_type].checksize && (RTA_PAYLOAD(a) != want[a->rta_type].size))
+	{
+	  log(L_ERR "nl_parse_attrs: Malformed attribute received");
+	  return 0;
+	}
+
+      k[a->rta_type] = a;
+    }
+
+  if (nl_attr_len)
+    {
+      log(L_ERR "nl_parse_attrs: remnant of size %d", nl_attr_len);
+      return 0;
+    }
+
+  return 1;
+}
+
+static inline u16 rta_get_u16(struct rtattr *a)
+{ return *(u16 *) RTA_DATA(a); }
+
+static inline u32 rta_get_u32(struct rtattr *a)
+{ return *(u32 *) RTA_DATA(a); }
+
+static inline ip4_addr rta_get_ip4(struct rtattr *a)
+{ return ip4_ntoh(*(ip4_addr *) RTA_DATA(a)); }
+
+static inline ip6_addr rta_get_ip6(struct rtattr *a)
+{ return ip6_ntoh(*(ip6_addr *) RTA_DATA(a)); }
+
+static inline ip_addr rta_get_ipa(struct rtattr *a)
+{
+  if (RTA_PAYLOAD(a) == sizeof(ip4_addr))
+    return ipa_from_ip4(rta_get_ip4(a));
+  else
+    return ipa_from_ip6(rta_get_ip6(a));
+}
+
+#ifdef HAVE_MPLS_KERNEL
+static inline ip_addr rta_get_via(struct rtattr *a)
+{
+  struct rtvia *v = RTA_DATA(a);
+  switch(v->rtvia_family) {
+    case AF_INET:  return ipa_from_ip4(ip4_ntoh(*(ip4_addr *) v->rtvia_addr));
+    case AF_INET6: return ipa_from_ip6(ip6_ntoh(*(ip6_addr *) v->rtvia_addr));
+  }
+  return IPA_NONE;
+}
+
+static u32 rta_mpls_stack[MPLS_MAX_LABEL_STACK];
+static inline int rta_get_mpls(struct rtattr *a, u32 *stack)
+{
+  if (!a)
+    return 0;
+
+  if (RTA_PAYLOAD(a) % 4)
+    log(L_WARN "KRT: Strange length of received MPLS stack: %u", RTA_PAYLOAD(a));
+
+  int labels = mpls_get(RTA_DATA(a), RTA_PAYLOAD(a) & ~0x3, stack);
+
+  if (labels < 0)
+  {
+    log(L_WARN "KRT: Too long MPLS stack received, ignoring");
+    labels = 0;
+  }
+
+  return labels;
+}
+#endif
+
+struct rtattr *
+nl_add_attr(struct nlmsghdr *h, uint bufsize, uint code, const void *data, uint dlen)
+{
+  uint pos = NLMSG_ALIGN(h->nlmsg_len);
+  uint len = RTA_LENGTH(dlen);
+
+  if (pos + len > bufsize)
+    bug("nl_add_attr: packet buffer overflow");
+
+  struct rtattr *a = (struct rtattr *)((char *)h + pos);
+  a->rta_type = code;
+  a->rta_len = len;
+  h->nlmsg_len = pos + len;
+
+  if (dlen > 0)
+    memcpy(RTA_DATA(a), data, dlen);
+
+  return a;
+}
+
+static inline struct rtattr *
+nl_open_attr(struct nlmsghdr *h, uint bufsize, uint code)
+{
+  return nl_add_attr(h, bufsize, code, NULL, 0);
+}
+
+static inline void
+nl_close_attr(struct nlmsghdr *h, struct rtattr *a)
+{
+  a->rta_len = (void *)h + NLMSG_ALIGN(h->nlmsg_len) - (void *)a;
+}
+
+static inline void
+nl_add_attr_u16(struct nlmsghdr *h, uint bufsize, int code, u16 data)
+{
+  nl_add_attr(h, bufsize, code, &data, 2);
+}
+
+static inline void
+nl_add_attr_u32(struct nlmsghdr *h, uint bufsize, int code, u32 data)
+{
+  nl_add_attr(h, bufsize, code, &data, 4);
+}
+
+static inline void
+nl_add_attr_ip4(struct nlmsghdr *h, uint bufsize, int code, ip4_addr ip4)
+{
+  ip4 = ip4_hton(ip4);
+  nl_add_attr(h, bufsize, code, &ip4, sizeof(ip4));
+}
+
+static inline void
+nl_add_attr_ip6(struct nlmsghdr *h, uint bufsize, int code, ip6_addr ip6)
+{
+  ip6 = ip6_hton(ip6);
+  nl_add_attr(h, bufsize, code, &ip6, sizeof(ip6));
+}
+
+static inline void
+nl_add_attr_ipa(struct nlmsghdr *h, uint bufsize, int code, ip_addr ipa)
+{
+  if (ipa_is_ip4(ipa))
+    nl_add_attr_ip4(h, bufsize, code, ipa_to_ip4(ipa));
+  else
+    nl_add_attr_ip6(h, bufsize, code, ipa_to_ip6(ipa));
+}
+
+#ifdef HAVE_MPLS_KERNEL
+static inline void
+nl_add_attr_mpls(struct nlmsghdr *h, uint bufsize, int code, int len, u32 *stack)
+{
+  char buf[len*4];
+  mpls_put(buf, len, stack);
+  nl_add_attr(h, bufsize, code, buf, len*4);
+}
+
+static inline void
+nl_add_attr_mpls_encap(struct nlmsghdr *h, uint bufsize, int len, u32 *stack)
+{
+  nl_add_attr_u16(h, bufsize, RTA_ENCAP_TYPE, LWTUNNEL_ENCAP_MPLS);
+
+  struct rtattr *nest = nl_open_attr(h, bufsize, RTA_ENCAP);
+  nl_add_attr_mpls(h, bufsize, RTA_DST, len, stack);
+  nl_close_attr(h, nest);
+}
+
+static inline void
+nl_add_attr_via(struct nlmsghdr *h, uint bufsize, ip_addr ipa)
+{
+  struct rtvia *via = alloca(sizeof(struct rtvia) + 16);
+
+  if (ipa_is_ip4(ipa))
+  {
+    via->rtvia_family = AF_INET;
+    put_ip4(via->rtvia_addr, ipa_to_ip4(ipa));
+    nl_add_attr(h, bufsize, RTA_VIA, via, sizeof(struct rtvia) + 4);
+  }
+  else
+  {
+    via->rtvia_family = AF_INET6;
+    put_ip6(via->rtvia_addr, ipa_to_ip6(ipa));
+    nl_add_attr(h, bufsize, RTA_VIA, via, sizeof(struct rtvia) + 16);
+  }
+}
+#endif
+
+static inline struct rtnexthop *
+nl_open_nexthop(struct nlmsghdr *h, uint bufsize)
+{
+  uint pos = NLMSG_ALIGN(h->nlmsg_len);
+  uint len = RTNH_LENGTH(0);
+
+  if (pos + len > bufsize)
+    bug("nl_open_nexthop: packet buffer overflow");
+
+  h->nlmsg_len = pos + len;
+
+  return (void *)h + pos;
+}
+
+static inline void
+nl_close_nexthop(struct nlmsghdr *h, struct rtnexthop *nh)
+{
+  nh->rtnh_len = (void *)h + NLMSG_ALIGN(h->nlmsg_len) - (void *)nh;
+}
+
+static inline void
+nl_add_nexthop(struct nlmsghdr *h, uint bufsize, struct nexthop *nh, int af UNUSED)
+{
+#ifdef HAVE_MPLS_KERNEL
+  if (nh->labels > 0)
+    if (af == AF_MPLS)
+      nl_add_attr_mpls(h, bufsize, RTA_NEWDST, nh->labels, nh->label);
+    else
+      nl_add_attr_mpls_encap(h, bufsize, nh->labels, nh->label);
+
+  if (ipa_nonzero(nh->gw))
+  {
+    if (af == (ipa_is_ip4(nh->gw) ? AF_INET : AF_INET6))
+      nl_add_attr_ipa(h, bufsize, RTA_GATEWAY, nh->gw);
+    else
+      nl_add_attr_via(h, bufsize, nh->gw);
+  }
+#else
+
+  if (ipa_nonzero(nh->gw))
+    nl_add_attr_ipa(h, bufsize, RTA_GATEWAY, nh->gw);
+#endif
+}
+
+static void
+nl_add_multipath(struct nlmsghdr *h, uint bufsize, struct nexthop *nh, int af, ea_list *eattrs)
+{
+  struct rtattr *a = nl_open_attr(h, bufsize, RTA_MULTIPATH);
+  eattr *flow = ea_find(eattrs, EA_KRT_REALM);
+
+  for (; nh; nh = nh->next)
+  {
+    struct rtnexthop *rtnh = nl_open_nexthop(h, bufsize);
+
+    rtnh->rtnh_flags = 0;
+    rtnh->rtnh_hops = nh->weight;
+    rtnh->rtnh_ifindex = nh->iface->index;
+
+    nl_add_nexthop(h, bufsize, nh, af);
+
+    if (nh->flags & RNF_ONLINK)
+      rtnh->rtnh_flags |= RTNH_F_ONLINK;
+
+    /* Our KRT_REALM is per-route, but kernel RTA_FLOW is per-nexthop.
+       Therefore, we need to attach the same attribute to each nexthop. */
+    if (flow)
+      nl_add_attr_u32(h, bufsize, RTA_FLOW, flow->u.data);
+
+    nl_close_nexthop(h, rtnh);
+  }
+
+  nl_close_attr(h, a);
+}
+
+static struct nexthop *
+nl_parse_multipath(struct nl_parse_state *s, struct krt_proto *p, const net_addr *n, struct rtattr *ra, int af, int krt_src)
+{
+  struct rtattr *a[BIRD_RTA_MAX];
+  struct rtnexthop *nh = RTA_DATA(ra);
+  struct nexthop *rv, *first, **last;
+  unsigned len = RTA_PAYLOAD(ra);
+
+  first = NULL;
+  last = &first;
+
+  while (len)
+    {
+      /* Use RTNH_OK(nh,len) ?? */
+      if ((len < sizeof(*nh)) || (len < nh->rtnh_len))
+	goto err;
+
+      if ((nh->rtnh_flags & RTNH_F_DEAD) && (krt_src != KRT_SRC_BIRD))
+	goto next;
+
+      *last = rv = lp_allocz(s->pool, NEXTHOP_MAX_SIZE);
+      last = &(rv->next);
+
+      rv->weight = nh->rtnh_hops;
+      rv->iface = if_find_by_index(nh->rtnh_ifindex);
+      if (!rv->iface)
+	{
+	  log(L_ERR "KRT: Received route %N with unknown ifindex %u", n, nh->rtnh_ifindex);
+	  return NULL;
+	}
+
+      /* Nonexistent RTNH_PAYLOAD ?? */
+      nl_attr_len = nh->rtnh_len - RTNH_LENGTH(0);
+      switch (af)
+        {
+	case AF_INET:
+	  if (!nl_parse_attrs(RTNH_DATA(nh), nexthop_attr_want4, a, sizeof(a)))
+	    goto err;
+	  break;
+
+	case AF_INET6:
+	  if (!nl_parse_attrs(RTNH_DATA(nh), nexthop_attr_want6, a, sizeof(a)))
+	    goto err;
+	  break;
+
+#ifdef HAVE_MPLS_KERNEL
+	case AF_MPLS:
+	  if (!nl_parse_attrs(RTNH_DATA(nh), nexthop_attr_want_mpls, a, sizeof(a)))
+	    goto err;
+
+	  if (a[RTA_NEWDST])
+	    rv->labels = rta_get_mpls(a[RTA_NEWDST], rv->label);
+
+	  break;
+#endif
+
+	default:
+	  goto err;
+	}
+
+      if (a[RTA_GATEWAY])
+	rv->gw = rta_get_ipa(a[RTA_GATEWAY]);
+
+      if (a[RTA_FLOW])
+	s->rta_flow = rta_get_u32(a[RTA_FLOW]);
+
+#ifdef HAVE_MPLS_KERNEL
+      if (a[RTA_VIA])
+	rv->gw = rta_get_via(a[RTA_VIA]);
+#endif
+
+      if (ipa_nonzero(rv->gw))
+	{
+	  if (nh->rtnh_flags & RTNH_F_ONLINK)
+	    rv->flags |= RNF_ONLINK;
+
+	  neighbor *nbr;
+	  nbr = neigh_find(&p->p, rv->gw, rv->iface,
+			   (rv->flags & RNF_ONLINK) ? NEF_ONLINK : 0);
+	  if (!nbr || (nbr->scope == SCOPE_HOST))
+	    {
+	        log(L_ERR "KRT: Received route %N with strange next-hop %I", n, rv->gw);
+	        return NULL;
+	    }
+	}
+
+#ifdef HAVE_MPLS_KERNEL
+      if (a[RTA_ENCAP] && a[RTA_ENCAP_TYPE])
+      {
+	if (rta_get_u16(a[RTA_ENCAP_TYPE]) != LWTUNNEL_ENCAP_MPLS)
+	{
+	  log(L_WARN "KRT: Received route %N with unknown encapsulation method %d",
+	      n, rta_get_u16(a[RTA_ENCAP_TYPE]));
+	  return NULL;
+	}
+
+	struct rtattr *enca[BIRD_RTA_MAX];
+	nl_attr_len = RTA_PAYLOAD(a[RTA_ENCAP]);
+	nl_parse_attrs(RTA_DATA(a[RTA_ENCAP]), encap_mpls_want, enca, sizeof(enca));
+	rv->labels = rta_get_mpls(enca[RTA_DST], rv->label);
+      }
+#endif
+
+    next:
+      len -= NLMSG_ALIGN(nh->rtnh_len);
+      nh = RTNH_NEXT(nh);
+    }
+
+  /* Ensure nexthops are sorted to satisfy nest invariant */
+  if (!nexthop_is_sorted(first))
+    first = nexthop_sort(first);
+
+  return first;
+
+err:
+  log(L_ERR "KRT: Received strange multipath route %N", n);
+  return NULL;
+}
+
+static void
+nl_add_metrics(struct nlmsghdr *h, uint bufsize, u32 *metrics, int max)
+{
+  struct rtattr *a = nl_open_attr(h, bufsize, RTA_METRICS);
+  int t;
+
+  for (t = 1; t < max; t++)
+    if (metrics[0] & (1 << t))
+      nl_add_attr_u32(h, bufsize, t, metrics[t]);
+
+  nl_close_attr(h, a);
+}
+
+static int
+nl_parse_metrics(struct rtattr *hdr, u32 *metrics, int max)
+{
+  struct rtattr *a = RTA_DATA(hdr);
+  int len = RTA_PAYLOAD(hdr);
+
+  metrics[0] = 0;
+  for (; RTA_OK(a, len); a = RTA_NEXT(a, len))
+  {
+    if (a->rta_type == RTA_UNSPEC)
+      continue;
+
+    if (a->rta_type >= max)
+      continue;
+
+    if (RTA_PAYLOAD(a) != 4)
+      return -1;
+
+    metrics[0] |= 1 << a->rta_type;
+    metrics[a->rta_type] = rta_get_u32(a);
+  }
+
+  if (len > 0)
+    return -1;
+
+  return 0;
+}
+
+
+/*
+ *	Scanning of interfaces
+ */
+
+static void
+nl_parse_link(struct nlmsghdr *h, int scan)
+{
+  struct ifinfomsg *i;
+  struct rtattr *a[BIRD_IFLA_MAX];
+  int new = h->nlmsg_type == RTM_NEWLINK;
+  struct iface f = {};
+  struct iface *ifi;
+  char *name;
+  u32 mtu, master = 0;
+  uint fl;
+
+  if (!(i = nl_checkin(h, sizeof(*i))) || !nl_parse_attrs(IFLA_RTA(i), ifla_attr_want, a, sizeof(a)))
+    return;
+  if (!a[IFLA_IFNAME] || (RTA_PAYLOAD(a[IFLA_IFNAME]) < 2) || !a[IFLA_MTU])
+    {
+      /*
+       * IFLA_IFNAME and IFLA_MTU are required, in fact, but there may also come
+       * a message with IFLA_WIRELESS set, where (e.g.) no IFLA_IFNAME exists.
+       * We simply ignore all such messages with IFLA_WIRELESS without notice.
+       */
+
+      if (a[IFLA_WIRELESS])
+	return;
+
+      log(L_ERR "KIF: Malformed message received");
+      return;
+    }
+
+  name = RTA_DATA(a[IFLA_IFNAME]);
+  mtu = rta_get_u32(a[IFLA_MTU]);
+
+  if (a[IFLA_MASTER])
+    master = rta_get_u32(a[IFLA_MASTER]);
+
+  ifi = if_find_by_index(i->ifi_index);
+  if (!new)
+    {
+      DBG("KIF: IF%d(%s) goes down\n", i->ifi_index, name);
+      if (!ifi)
+	return;
+
+      if_delete(ifi);
+    }
+  else
+    {
+      DBG("KIF: IF%d(%s) goes up (mtu=%d,flg=%x)\n", i->ifi_index, name, mtu, i->ifi_flags);
+      if (ifi && strncmp(ifi->name, name, sizeof(ifi->name)-1))
+	if_delete(ifi);
+
+      strncpy(f.name, name, sizeof(f.name)-1);
+      f.index = i->ifi_index;
+      f.mtu = mtu;
+
+      f.master_index = master;
+      f.master = if_find_by_index(master);
+
+      fl = i->ifi_flags;
+      if (fl & IFF_UP)
+	f.flags |= IF_ADMIN_UP;
+      if (fl & IFF_LOWER_UP)
+	f.flags |= IF_LINK_UP;
+      if (fl & IFF_LOOPBACK)		/* Loopback */
+	f.flags |= IF_MULTIACCESS | IF_LOOPBACK | IF_IGNORE;
+      else if (fl & IFF_POINTOPOINT)	/* PtP */
+	f.flags |= IF_MULTICAST;
+      else if (fl & IFF_BROADCAST)	/* Broadcast */
+	f.flags |= IF_MULTIACCESS | IF_BROADCAST | IF_MULTICAST;
+      else
+	f.flags |= IF_MULTIACCESS;	/* NBMA */
+
+      if (fl & IFF_MULTICAST)
+	f.flags |= IF_MULTICAST;
+
+      ifi = if_update(&f);
+
+      if (!scan)
+	if_end_partial_update(ifi);
+    }
+}
+
+static void
+nl_parse_addr4(struct ifaddrmsg *i, int scan, int new)
+{
+  struct rtattr *a[BIRD_IFA_MAX];
+  struct iface *ifi;
+  u32 ifa_flags;
+  int scope;
+
+  if (!nl_parse_attrs(IFA_RTA(i), ifa_attr_want4, a, sizeof(a)))
+    return;
+
+  if (!a[IFA_LOCAL])
+    {
+      log(L_ERR "KIF: Malformed message received (missing IFA_LOCAL)");
+      return;
+    }
+  if (!a[IFA_ADDRESS])
+    {
+      log(L_ERR "KIF: Malformed message received (missing IFA_ADDRESS)");
+      return;
+    }
+
+  ifi = if_find_by_index(i->ifa_index);
+  if (!ifi)
+    {
+      log(L_ERR "KIF: Received address message for unknown interface %d", i->ifa_index);
+      return;
+    }
+
+  if (a[IFA_FLAGS])
+    ifa_flags = rta_get_u32(a[IFA_FLAGS]);
+  else
+    ifa_flags = i->ifa_flags;
+
+  struct ifa ifa;
+  bzero(&ifa, sizeof(ifa));
+  ifa.iface = ifi;
+  if (ifa_flags & IFA_F_SECONDARY)
+    ifa.flags |= IA_SECONDARY;
+
+  ifa.ip = rta_get_ipa(a[IFA_LOCAL]);
+
+  if (i->ifa_prefixlen > IP4_MAX_PREFIX_LENGTH)
+    {
+      log(L_ERR "KIF: Invalid prefix length for interface %s: %d", ifi->name, i->ifa_prefixlen);
+      new = 0;
+    }
+  if (i->ifa_prefixlen == IP4_MAX_PREFIX_LENGTH)
+    {
+      ifa.brd = rta_get_ipa(a[IFA_ADDRESS]);
+      net_fill_ip4(&ifa.prefix, rta_get_ip4(a[IFA_ADDRESS]), i->ifa_prefixlen);
+
+      /* It is either a host address or a peer address */
+      if (ipa_equal(ifa.ip, ifa.brd))
+	ifa.flags |= IA_HOST;
+      else
+	{
+	  ifa.flags |= IA_PEER;
+	  ifa.opposite = ifa.brd;
+	}
+    }
+  else
+    {
+      net_fill_ip4(&ifa.prefix, ipa_to_ip4(ifa.ip), i->ifa_prefixlen);
+      net_normalize(&ifa.prefix);
+
+      if (i->ifa_prefixlen == IP4_MAX_PREFIX_LENGTH - 1)
+	ifa.opposite = ipa_opposite_m1(ifa.ip);
+
+      if (i->ifa_prefixlen == IP4_MAX_PREFIX_LENGTH - 2)
+	ifa.opposite = ipa_opposite_m2(ifa.ip);
+
+      if (ifi->flags & IF_BROADCAST)
+        {
+	  /* If kernel offers us a broadcast address, we trust it */
+	  if (a[IFA_BROADCAST])
+	    ifa.brd = ipa_from_ip4(rta_get_ip4(a[IFA_BROADCAST]));
+	  /* Otherwise we create one (except for /31) */
+	  else if (i->ifa_prefixlen < (IP4_MAX_PREFIX_LENGTH - 1))
+	    ifa.brd = ipa_from_ip4(ip4_or(ipa_to_ip4(ifa.ip),
+					  ip4_not(ip4_mkmask(i->ifa_prefixlen))));
+	}
+    }
+
+  scope = ipa_classify(ifa.ip);
+  if (scope < 0)
+    {
+      log(L_ERR "KIF: Invalid interface address %I for %s", ifa.ip, ifi->name);
+      return;
+    }
+  ifa.scope = scope & IADDR_SCOPE_MASK;
+
+  DBG("KIF: IF%d(%s): %s IPA %I, flg %x, net %N, brd %I, opp %I\n",
+      ifi->index, ifi->name,
+      new ? "added" : "removed",
+      ifa.ip, ifa.flags, &ifa.prefix, ifa.brd, ifa.opposite);
+
+  if (new)
+    ifa_update(&ifa);
+  else
+    ifa_delete(&ifa);
+
+  if (!scan)
+    if_end_partial_update(ifi);
+}
+
+static void
+nl_parse_addr6(struct ifaddrmsg *i, int scan, int new)
+{
+  struct rtattr *a[BIRD_IFA_MAX];
+  struct iface *ifi;
+  u32 ifa_flags;
+  int scope;
+
+  if (!nl_parse_attrs(IFA_RTA(i), ifa_attr_want6, a, sizeof(a)))
+    return;
+
+  if (!a[IFA_ADDRESS])
+    {
+      log(L_ERR "KIF: Malformed message received (missing IFA_ADDRESS)");
+      return;
+    }
+
+  ifi = if_find_by_index(i->ifa_index);
+  if (!ifi)
+    {
+      log(L_ERR "KIF: Received address message for unknown interface %d", i->ifa_index);
+      return;
+    }
+
+  if (a[IFA_FLAGS])
+    ifa_flags = rta_get_u32(a[IFA_FLAGS]);
+  else
+    ifa_flags = i->ifa_flags;
+
+  struct ifa ifa;
+  bzero(&ifa, sizeof(ifa));
+  ifa.iface = ifi;
+  if (ifa_flags & IFA_F_SECONDARY)
+    ifa.flags |= IA_SECONDARY;
+
+  /* Ignore tentative addresses silently */
+  if (ifa_flags & IFA_F_TENTATIVE)
+    return;
+
+  /* IFA_LOCAL can be unset for IPv6 interfaces */
+  ifa.ip = rta_get_ipa(a[IFA_LOCAL] ? : a[IFA_ADDRESS]);
+
+  if (i->ifa_prefixlen > IP6_MAX_PREFIX_LENGTH)
+    {
+      log(L_ERR "KIF: Invalid prefix length for interface %s: %d", ifi->name, i->ifa_prefixlen);
+      new = 0;
+    }
+  if (i->ifa_prefixlen == IP6_MAX_PREFIX_LENGTH)
+    {
+      ifa.brd = rta_get_ipa(a[IFA_ADDRESS]);
+      net_fill_ip6(&ifa.prefix, rta_get_ip6(a[IFA_ADDRESS]), i->ifa_prefixlen);
+
+      /* It is either a host address or a peer address */
+      if (ipa_equal(ifa.ip, ifa.brd))
+	ifa.flags |= IA_HOST;
+      else
+	{
+	  ifa.flags |= IA_PEER;
+	  ifa.opposite = ifa.brd;
+	}
+    }
+  else
+    {
+      net_fill_ip6(&ifa.prefix, ipa_to_ip6(ifa.ip), i->ifa_prefixlen);
+      net_normalize(&ifa.prefix);
+
+      if (i->ifa_prefixlen == IP6_MAX_PREFIX_LENGTH - 1)
+	ifa.opposite = ipa_opposite_m1(ifa.ip);
+    }
+
+  scope = ipa_classify(ifa.ip);
+  if (scope < 0)
+    {
+      log(L_ERR "KIF: Invalid interface address %I for %s", ifa.ip, ifi->name);
+      return;
+    }
+  ifa.scope = scope & IADDR_SCOPE_MASK;
+
+  DBG("KIF: IF%d(%s): %s IPA %I, flg %x, net %N, brd %I, opp %I\n",
+      ifi->index, ifi->name,
+      new ? "added" : "removed",
+      ifa.ip, ifa.flags, &ifa.prefix, ifa.brd, ifa.opposite);
+
+  if (new)
+    ifa_update(&ifa);
+  else
+    ifa_delete(&ifa);
+
+  if (!scan)
+    if_end_partial_update(ifi);
+}
+
+static void
+nl_parse_addr(struct nlmsghdr *h, int scan)
+{
+  struct ifaddrmsg *i;
+
+  if (!(i = nl_checkin(h, sizeof(*i))))
+    return;
+
+  int new = (h->nlmsg_type == RTM_NEWADDR);
+
+  switch (i->ifa_family)
+    {
+      case AF_INET:
+	return nl_parse_addr4(i, scan, new);
+
+      case AF_INET6:
+	return nl_parse_addr6(i, scan, new);
+    }
+}
+
+void
+kif_do_scan(struct kif_proto *p UNUSED)
+{
+  struct nlmsghdr *h;
+
+  if_start_update();
+
+  nl_request_dump(AF_UNSPEC, RTM_GETLINK);
+  while (h = nl_get_scan())
+    if (h->nlmsg_type == RTM_NEWLINK || h->nlmsg_type == RTM_DELLINK)
+      nl_parse_link(h, 1);
+    else
+      log(L_DEBUG "nl_scan_ifaces: Unknown packet received (type=%d)", h->nlmsg_type);
+
+  /* Re-resolve master interface for slaves */
+  struct iface *i;
+  WALK_LIST(i, iface_list)
+    if (i->master_index)
+    {
+      struct iface f = {
+	.flags = i->flags,
+	.mtu = i->mtu,
+	.index = i->index,
+	.master_index = i->master_index,
+	.master = if_find_by_index(i->master_index)
+      };
+
+      if (f.master != i->master)
+      {
+	memcpy(f.name, i->name, sizeof(f.name));
+	if_update(&f);
+      }
+    }
+
+  nl_request_dump(AF_INET, RTM_GETADDR);
+  while (h = nl_get_scan())
+    if (h->nlmsg_type == RTM_NEWADDR || h->nlmsg_type == RTM_DELADDR)
+      nl_parse_addr(h, 1);
+    else
+      log(L_DEBUG "nl_scan_ifaces: Unknown packet received (type=%d)", h->nlmsg_type);
+
+  nl_request_dump(AF_INET6, RTM_GETADDR);
+  while (h = nl_get_scan())
+    if (h->nlmsg_type == RTM_NEWADDR || h->nlmsg_type == RTM_DELADDR)
+      nl_parse_addr(h, 1);
+    else
+      log(L_DEBUG "nl_scan_ifaces: Unknown packet received (type=%d)", h->nlmsg_type);
+
+  if_end_update();
+}
+
+/*
+ *	Routes
+ */
+
+static inline u32
+krt_table_id(struct krt_proto *p)
+{
+  return KRT_CF->sys.table_id;
+}
+
+static HASH(struct krt_proto) nl_table_map;
+
+#define RTH_KEY(p)		p->af, krt_table_id(p)
+#define RTH_NEXT(p)		p->sys.hash_next
+#define RTH_EQ(a1,i1,a2,i2)	a1 == a2 && i1 == i2
+#define RTH_FN(a,i)		a ^ u32_hash(i)
+
+#define RTH_REHASH		rth_rehash
+#define RTH_PARAMS		/8, *2, 2, 2, 6, 20
+
+HASH_DEFINE_REHASH_FN(RTH, struct krt_proto)
+
+int
+krt_capable(rte *e)
+{
+  rta *a = e->attrs;
+
+  switch (a->dest)
+  {
+    case RTD_UNICAST:
+    case RTD_BLACKHOLE:
+    case RTD_UNREACHABLE:
+    case RTD_PROHIBIT:
+      return 1;
+
+    default:
+      return 0;
+  }
+}
+
+static inline int
+nh_bufsize(struct nexthop *nh)
+{
+  int rv = 0;
+  for (; nh != NULL; nh = nh->next)
+    rv += RTNH_LENGTH(RTA_LENGTH(sizeof(ip_addr)));
+  return rv;
+}
+
+static int
+nl_send_route(struct krt_proto *p, rte *e, int op, int dest, struct nexthop *nh)
+{
+  eattr *ea;
+  net *net = e->net;
+  rta *a = e->attrs;
+  ea_list *eattrs = a->eattrs;
+  int bufsize = 128 + KRT_METRICS_MAX*8 + nh_bufsize(&(a->nh));
+  u32 priority = 0;
+
+  struct {
+    struct nlmsghdr h;
+    struct rtmsg r;
+    char buf[0];
+  } *r;
+
+  int rsize = sizeof(*r) + bufsize;
+  r = alloca(rsize);
+
+  DBG("nl_send_route(%N,op=%x)\n", net->n.addr, op);
+
+  bzero(&r->h, sizeof(r->h));
+  bzero(&r->r, sizeof(r->r));
+  r->h.nlmsg_type = op ? RTM_NEWROUTE : RTM_DELROUTE;
+  r->h.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
+  r->h.nlmsg_flags = op | NLM_F_REQUEST | NLM_F_ACK;
+
+  r->r.rtm_family = p->af;
+  r->r.rtm_dst_len = net_pxlen(net->n.addr);
+  r->r.rtm_protocol = RTPROT_BIRD;
+  r->r.rtm_scope = RT_SCOPE_NOWHERE;
+#ifdef HAVE_MPLS_KERNEL
+  if (p->af == AF_MPLS)
+  {
+    /*
+     * Kernel MPLS code is a bit picky. We must:
+     * 1) Always set RT_SCOPE_UNIVERSE and RTN_UNICAST (even for RTM_DELROUTE)
+     * 2) Never use RTA_PRIORITY
+     */
+
+    u32 label = net_mpls(net->n.addr);
+    nl_add_attr_mpls(&r->h, rsize, RTA_DST, 1, &label);
+    r->r.rtm_scope = RT_SCOPE_UNIVERSE;
+    r->r.rtm_type = RTN_UNICAST;
+  }
+  else
+#endif
+  {
+    nl_add_attr_ipa(&r->h, rsize, RTA_DST, net_prefix(net->n.addr));
+
+    /* Add source address for IPv6 SADR routes */
+    if (net->n.addr->type == NET_IP6_SADR)
+    {
+      net_addr_ip6_sadr *a = (void *) &net->n.addr;
+      nl_add_attr_ip6(&r->h, rsize, RTA_SRC, a->src_prefix);
+      r->r.rtm_src_len = a->src_pxlen;
+    }
+  }
+
+  /*
+   * Strange behavior for RTM_DELROUTE:
+   * 1) rtm_family is ignored in IPv6, works for IPv4
+   * 2) not setting RTA_PRIORITY is different from setting default value (on IPv6)
+   * 3) not setting RTA_PRIORITY is equivalent to setting 0, which is wildcard
+   */
+
+  if (krt_table_id(p) < 256)
+    r->r.rtm_table = krt_table_id(p);
+  else
+    nl_add_attr_u32(&r->h, rsize, RTA_TABLE, krt_table_id(p));
+
+  if (p->af == AF_MPLS)
+    priority = 0;
+  else if (a->source == RTS_DUMMY)
+    priority = e->u.krt.metric;
+  else if (KRT_CF->sys.metric)
+    priority = KRT_CF->sys.metric;
+  else if ((op != NL_OP_DELETE) && (ea = ea_find(eattrs, EA_KRT_METRIC)))
+    priority = ea->u.data;
+
+  if (priority)
+    nl_add_attr_u32(&r->h, rsize, RTA_PRIORITY, priority);
+
+  /* For route delete, we do not specify remaining route attributes */
+  if (op == NL_OP_DELETE)
+    goto dest;
+
+  /* Default scope is LINK for device routes, UNIVERSE otherwise */
+  if (p->af == AF_MPLS)
+    r->r.rtm_scope = RT_SCOPE_UNIVERSE;
+  else if (ea = ea_find(eattrs, EA_KRT_SCOPE))
+    r->r.rtm_scope = ea->u.data;
+  else
+    r->r.rtm_scope = (dest == RTD_UNICAST && ipa_zero(nh->gw)) ? RT_SCOPE_LINK : RT_SCOPE_UNIVERSE;
+
+  if (ea = ea_find(eattrs, EA_KRT_PREFSRC))
+    nl_add_attr_ipa(&r->h, rsize, RTA_PREFSRC, *(ip_addr *)ea->u.ptr->data);
+
+  if (ea = ea_find(eattrs, EA_KRT_REALM))
+    nl_add_attr_u32(&r->h, rsize, RTA_FLOW, ea->u.data);
+
+
+  u32 metrics[KRT_METRICS_MAX];
+  metrics[0] = 0;
+
+  struct ea_walk_state ews = { .eattrs = eattrs };
+  while (ea = ea_walk(&ews, EA_KRT_METRICS, KRT_METRICS_MAX))
+  {
+    int id = ea->id - EA_KRT_METRICS;
+    metrics[0] |= 1 << id;
+    metrics[id] = ea->u.data;
+  }
+
+  if (metrics[0])
+    nl_add_metrics(&r->h, rsize, metrics, KRT_METRICS_MAX);
+
+
+dest:
+  switch (dest)
+    {
+    case RTD_UNICAST:
+      r->r.rtm_type = RTN_UNICAST;
+      if (nh->next && !krt_ecmp6(p))
+	nl_add_multipath(&r->h, rsize, nh, p->af, eattrs);
+      else
+      {
+	nl_add_attr_u32(&r->h, rsize, RTA_OIF, nh->iface->index);
+	nl_add_nexthop(&r->h, rsize, nh, p->af);
+
+	if (nh->flags & RNF_ONLINK)
+	  r->r.rtm_flags |= RTNH_F_ONLINK;
+      }
+      break;
+    case RTD_BLACKHOLE:
+      r->r.rtm_type = RTN_BLACKHOLE;
+      break;
+    case RTD_UNREACHABLE:
+      r->r.rtm_type = RTN_UNREACHABLE;
+      break;
+    case RTD_PROHIBIT:
+      r->r.rtm_type = RTN_PROHIBIT;
+      break;
+    case RTD_NONE:
+      break;
+    default:
+      bug("krt_capable inconsistent with nl_send_route");
+    }
+
+  /* Ignore missing for DELETE */
+  return nl_exchange(&r->h, (op == NL_OP_DELETE));
+}
+
+static inline int
+nl_add_rte(struct krt_proto *p, rte *e)
+{
+  rta *a = e->attrs;
+  int err = 0;
+
+  if (krt_ecmp6(p) && a->nh.next)
+  {
+    struct nexthop *nh = &(a->nh);
+
+    err = nl_send_route(p, e, NL_OP_ADD, RTD_UNICAST, nh);
+    if (err < 0)
+      return err;
+
+    for (nh = nh->next; nh; nh = nh->next)
+      err += nl_send_route(p, e, NL_OP_APPEND, RTD_UNICAST, nh);
+
+    return err;
+  }
+
+  return nl_send_route(p, e, NL_OP_ADD, a->dest, &(a->nh));
+}
+
+static inline int
+nl_delete_rte(struct krt_proto *p, rte *e)
+{
+  int err = 0;
+
+  /* For IPv6, we just repeatedly request DELETE until we get error */
+  do
+    err = nl_send_route(p, e, NL_OP_DELETE, RTD_NONE, NULL);
+  while (krt_ecmp6(p) && !err);
+
+  return err;
+}
+
+static inline int
+nl_replace_rte(struct krt_proto *p, rte *e)
+{
+  rta *a = e->attrs;
+  return nl_send_route(p, e, NL_OP_REPLACE, a->dest, &(a->nh));
+}
+
+
+void
+krt_replace_rte(struct krt_proto *p, net *n UNUSED, rte *new, rte *old)
+{
+  int err = 0;
+
+  /*
+   * We use NL_OP_REPLACE for IPv4, it has an issue with not checking for
+   * matching rtm_protocol, but that is OK when dedicated priority is used.
+   *
+   * We do not use NL_OP_REPLACE for IPv6, as it has broken semantics for ECMP
+   * and with some kernel versions ECMP replace crashes kernel. Would need more
+   * testing and checks for kernel versions.
+   *
+   * For IPv6, we use NL_OP_DELETE and then NL_OP_ADD. We also do not trust the
+   * old route value, so we do not try to optimize IPv6 ECMP reconfigurations.
+   */
+
+  if (krt_ipv4(p) && old && new)
+  {
+    err = nl_replace_rte(p, new);
+  }
+  else
+  {
+    if (old)
+      nl_delete_rte(p, old);
+
+    if (new)
+      err = nl_add_rte(p, new);
+  }
+
+  if (new)
+  {
+    if (err < 0)
+      bmap_clear(&p->sync_map, new->id);
+    else
+      bmap_set(&p->sync_map, new->id);
+  }
+}
+
+static int
+nl_mergable_route(struct nl_parse_state *s, net *net, struct krt_proto *p, uint priority, uint krt_type, uint rtm_family)
+{
+  /* Route merging is used for IPv6 scans */
+  if (!s->scan || (rtm_family != AF_INET6))
+    return 0;
+
+  /* Saved and new route must have same network, proto/table, and priority */
+  if ((s->net != net) || (s->proto != p) || (s->krt_metric != priority))
+    return 0;
+
+  /* Both must be regular unicast routes */
+  if ((s->krt_type != RTN_UNICAST) || (krt_type != RTN_UNICAST))
+    return 0;
+
+  return 1;
+}
+
+static void
+nl_announce_route(struct nl_parse_state *s)
+{
+  rte *e = rte_get_temp(s->attrs);
+  e->net = s->net;
+  e->u.krt.src = s->krt_src;
+  e->u.krt.proto = s->krt_proto;
+  e->u.krt.seen = 0;
+  e->u.krt.best = 0;
+  e->u.krt.metric = s->krt_metric;
+
+  if (s->scan)
+    krt_got_route(s->proto, e);
+  else
+    krt_got_route_async(s->proto, e, s->new);
+
+  s->net = NULL;
+  s->attrs = NULL;
+  s->proto = NULL;
+  lp_flush(s->pool);
+}
+
+static inline void
+nl_parse_begin(struct nl_parse_state *s, int scan)
+{
+  memset(s, 0, sizeof (struct nl_parse_state));
+  s->pool = nl_linpool;
+  s->scan = scan;
+}
+
+static inline void
+nl_parse_end(struct nl_parse_state *s)
+{
+  if (s->net)
+    nl_announce_route(s);
+}
+
+
+#define SKIP0(ARG, ...) do { DBG("KRT: Ignoring route - " ARG, ##__VA_ARGS__); return; } while(0)
+#define SKIP(ARG, ...)  do { DBG("KRT: Ignoring route %N - " ARG, &dst, ##__VA_ARGS__); return; } while(0)
+
+static void
+nl_parse_route(struct nl_parse_state *s, struct nlmsghdr *h)
+{
+  struct krt_proto *p;
+  struct rtmsg *i;
+  struct rtattr *a[BIRD_RTA_MAX];
+  int new = h->nlmsg_type == RTM_NEWROUTE;
+
+  net_addr dst, src = {};
+  u32 oif = ~0;
+  u32 table_id;
+  u32 priority = 0;
+  u32 def_scope = RT_SCOPE_UNIVERSE;
+  int krt_src;
+
+  if (!(i = nl_checkin(h, sizeof(*i))))
+    return;
+
+  switch (i->rtm_family)
+    {
+    case AF_INET:
+      if (!nl_parse_attrs(RTM_RTA(i), rtm_attr_want4, a, sizeof(a)))
+	return;
+
+      if (a[RTA_DST])
+	net_fill_ip4(&dst, rta_get_ip4(a[RTA_DST]), i->rtm_dst_len);
+      else
+	net_fill_ip4(&dst, IP4_NONE, 0);
+      break;
+
+    case AF_INET6:
+      if (!nl_parse_attrs(RTM_RTA(i), rtm_attr_want6, a, sizeof(a)))
+	return;
+
+      if (a[RTA_DST])
+	net_fill_ip6(&dst, rta_get_ip6(a[RTA_DST]), i->rtm_dst_len);
+      else
+	net_fill_ip6(&dst, IP6_NONE, 0);
+
+      if (a[RTA_SRC])
+	net_fill_ip6(&src, rta_get_ip6(a[RTA_SRC]), i->rtm_src_len);
+      else
+	net_fill_ip6(&src, IP6_NONE, 0);
+      break;
+
+#ifdef HAVE_MPLS_KERNEL
+    case AF_MPLS:
+      if (!nl_parse_attrs(RTM_RTA(i), rtm_attr_want_mpls, a, sizeof(a)))
+	return;
+
+      if (!a[RTA_DST])
+	SKIP0("MPLS route without RTA_DST\n");
+
+      if (rta_get_mpls(a[RTA_DST], rta_mpls_stack) != 1)
+	SKIP0("MPLS route with multi-label RTA_DST\n");
+
+      net_fill_mpls(&dst, rta_mpls_stack[0]);
+      break;
+#endif
+
+    default:
+      return;
+    }
+
+  if (a[RTA_OIF])
+    oif = rta_get_u32(a[RTA_OIF]);
+
+  if (a[RTA_TABLE])
+    table_id = rta_get_u32(a[RTA_TABLE]);
+  else
+    table_id = i->rtm_table;
+
+  if (i->rtm_flags & RTM_F_CLONED)
+    SKIP("cloned\n");
+
+  /* Do we know this table? */
+  p = HASH_FIND(nl_table_map, RTH, i->rtm_family, table_id);
+  if (!p)
+    SKIP("unknown table %u\n", table_id);
+
+  if (a[RTA_SRC] && (p->p.net_type != NET_IP6_SADR))
+    SKIP("src prefix for non-SADR channel\n");
+
+  if (a[RTA_IIF])
+    SKIP("IIF set\n");
+
+  if (i->rtm_tos != 0)			/* We don't support TOS */
+    SKIP("TOS %02x\n", i->rtm_tos);
+
+  if (s->scan && !new)
+    SKIP("RTM_DELROUTE in scan\n");
+
+  if (a[RTA_PRIORITY])
+    priority = rta_get_u32(a[RTA_PRIORITY]);
+
+  int c = net_classify(&dst);
+  if ((c < 0) || !(c & IADDR_HOST) || ((c & IADDR_SCOPE_MASK) <= SCOPE_LINK))
+    SKIP("strange class/scope\n");
+
+  switch (i->rtm_protocol)
+    {
+    case RTPROT_UNSPEC:
+      SKIP("proto unspec\n");
+
+    case RTPROT_REDIRECT:
+      krt_src = KRT_SRC_REDIRECT;
+      break;
+
+    case RTPROT_KERNEL:
+      krt_src = KRT_SRC_KERNEL;
+      return;
+
+    case RTPROT_BIRD:
+      if (!s->scan)
+	SKIP("echo\n");
+      krt_src = KRT_SRC_BIRD;
+      break;
+
+    case RTPROT_BOOT:
+    default:
+      krt_src = KRT_SRC_ALIEN;
+    }
+
+  net_addr *n = &dst;
+  if (p->p.net_type == NET_IP6_SADR)
+  {
+    n = alloca(sizeof(net_addr_ip6_sadr));
+    net_fill_ip6_sadr(n, net6_prefix(&dst), net6_pxlen(&dst),
+		      net6_prefix(&src), net6_pxlen(&src));
+  }
+
+  net *net = net_get(p->p.main_channel->table, n);
+
+  if (s->net && !nl_mergable_route(s, net, p, priority, i->rtm_type, i->rtm_family))
+    nl_announce_route(s);
+
+  rta *ra = lp_allocz(s->pool, RTA_MAX_SIZE);
+  ra->src = p->p.main_source;
+  ra->source = RTS_INHERIT;
+  ra->scope = SCOPE_UNIVERSE;
+
+  if (a[RTA_FLOW])
+    s->rta_flow = rta_get_u32(a[RTA_FLOW]);
+  else
+    s->rta_flow = 0;
+
+  switch (i->rtm_type)
+    {
+    case RTN_UNICAST:
+      ra->dest = RTD_UNICAST;
+
+      if (a[RTA_MULTIPATH])
+        {
+	  struct nexthop *nh = nl_parse_multipath(s, p, n, a[RTA_MULTIPATH], i->rtm_family, krt_src);
+	  if (!nh)
+	    SKIP("strange RTA_MULTIPATH\n");
+
+	  nexthop_link(ra, nh);
+	  break;
+	}
+
+      if ((i->rtm_flags & RTNH_F_DEAD) && (krt_src != KRT_SRC_BIRD))
+	SKIP("ignore RTNH_F_DEAD\n");
+
+      ra->nh.iface = if_find_by_index(oif);
+      if (!ra->nh.iface)
+	{
+	  log(L_ERR "KRT: Received route %N with unknown ifindex %u", net->n.addr, oif);
+	  return;
+	}
+
+      if (a[RTA_GATEWAY])
+	ra->nh.gw = rta_get_ipa(a[RTA_GATEWAY]);
+
+#ifdef HAVE_MPLS_KERNEL
+      if (a[RTA_VIA])
+	ra->nh.gw = rta_get_via(a[RTA_VIA]);
+#endif
+
+      if (ipa_nonzero(ra->nh.gw))
+	{
+	  /* Silently skip strange 6to4 routes */
+	  const net_addr_ip6 sit = NET_ADDR_IP6(IP6_NONE, 96);
+	  if ((i->rtm_family == AF_INET6) && ipa_in_netX(ra->nh.gw, (net_addr *) &sit))
+	    return;
+
+	  if (i->rtm_flags & RTNH_F_ONLINK)
+	    ra->nh.flags |= RNF_ONLINK;
+
+	  neighbor *nbr;
+	  nbr = neigh_find(&p->p, ra->nh.gw, ra->nh.iface,
+			   (ra->nh.flags & RNF_ONLINK) ? NEF_ONLINK : 0);
+	  if (!nbr || (nbr->scope == SCOPE_HOST))
+	    {
+	      log(L_ERR "KRT: Received route %N with strange next-hop %I", net->n.addr,
+                  ra->nh.gw);
+	      return;
+	    }
+	}
+
+      break;
+    case RTN_BLACKHOLE:
+      ra->dest = RTD_BLACKHOLE;
+      break;
+    case RTN_UNREACHABLE:
+      ra->dest = RTD_UNREACHABLE;
+      break;
+    case RTN_PROHIBIT:
+      ra->dest = RTD_PROHIBIT;
+      break;
+    /* FIXME: What about RTN_THROW? */
+    default:
+      SKIP("type %d\n", i->rtm_type);
+      return;
+    }
+
+#ifdef HAVE_MPLS_KERNEL
+  if ((i->rtm_family == AF_MPLS) && a[RTA_NEWDST] && !ra->nh.next)
+    ra->nh.labels = rta_get_mpls(a[RTA_NEWDST], ra->nh.label);
+
+  if (a[RTA_ENCAP] && a[RTA_ENCAP_TYPE] && !ra->nh.next)
+    {
+      switch (rta_get_u16(a[RTA_ENCAP_TYPE]))
+	{
+	  case LWTUNNEL_ENCAP_MPLS:
+	    {
+	      struct rtattr *enca[BIRD_RTA_MAX];
+	      nl_attr_len = RTA_PAYLOAD(a[RTA_ENCAP]);
+	      nl_parse_attrs(RTA_DATA(a[RTA_ENCAP]), encap_mpls_want, enca, sizeof(enca));
+	      ra->nh.labels = rta_get_mpls(enca[RTA_DST], ra->nh.label);
+	      break;
+	    }
+	  default:
+	    SKIP("unknown encapsulation method %d\n", rta_get_u16(a[RTA_ENCAP_TYPE]));
+	    break;
+	}
+    }
+#endif
+
+  if (i->rtm_scope != def_scope)
+    {
+      ea_list *ea = lp_alloc(s->pool, sizeof(ea_list) + sizeof(eattr));
+      ea->next = ra->eattrs;
+      ra->eattrs = ea;
+      ea->flags = EALF_SORTED;
+      ea->count = 1;
+      ea->attrs[0].id = EA_KRT_SCOPE;
+      ea->attrs[0].flags = 0;
+      ea->attrs[0].type = EAF_TYPE_INT;
+      ea->attrs[0].u.data = i->rtm_scope;
+    }
+
+  if (a[RTA_PREFSRC])
+    {
+      ip_addr ps = rta_get_ipa(a[RTA_PREFSRC]);
+
+      ea_list *ea = lp_alloc(s->pool, sizeof(ea_list) + sizeof(eattr));
+      ea->next = ra->eattrs;
+      ra->eattrs = ea;
+      ea->flags = EALF_SORTED;
+      ea->count = 1;
+      ea->attrs[0].id = EA_KRT_PREFSRC;
+      ea->attrs[0].flags = 0;
+      ea->attrs[0].type = EAF_TYPE_IP_ADDRESS;
+
+      struct adata *ad = lp_alloc(s->pool, sizeof(struct adata) + sizeof(ps));
+      ad->length = sizeof(ps);
+      memcpy(ad->data, &ps, sizeof(ps));
+
+      ea->attrs[0].u.ptr = ad;
+    }
+
+  /* Can be set per-route or per-nexthop */
+  if (s->rta_flow)
+    {
+      ea_list *ea = lp_alloc(s->pool, sizeof(ea_list) + sizeof(eattr));
+      ea->next = ra->eattrs;
+      ra->eattrs = ea;
+      ea->flags = EALF_SORTED;
+      ea->count = 1;
+      ea->attrs[0].id = EA_KRT_REALM;
+      ea->attrs[0].flags = 0;
+      ea->attrs[0].type = EAF_TYPE_INT;
+      ea->attrs[0].u.data = s->rta_flow;
+    }
+
+  if (a[RTA_METRICS])
+    {
+      u32 metrics[KRT_METRICS_MAX];
+      ea_list *ea = lp_alloc(s->pool, sizeof(ea_list) + KRT_METRICS_MAX * sizeof(eattr));
+      int t, n = 0;
+
+      if (nl_parse_metrics(a[RTA_METRICS], metrics, ARRAY_SIZE(metrics)) < 0)
+        {
+	  log(L_ERR "KRT: Received route %N with strange RTA_METRICS attribute", net->n.addr);
+	  return;
+	}
+
+      for (t = 1; t < KRT_METRICS_MAX; t++)
+	if (metrics[0] & (1 << t))
+	  {
+	    ea->attrs[n].id = EA_CODE(PROTOCOL_KERNEL, KRT_METRICS_OFFSET + t);
+	    ea->attrs[n].flags = 0;
+	    ea->attrs[n].type = EAF_TYPE_INT; /* FIXME: Some are EAF_TYPE_BITFIELD */
+	    ea->attrs[n].u.data = metrics[t];
+	    n++;
+	  }
+
+      if (n > 0)
+        {
+	  ea->next = ra->eattrs;
+	  ea->flags = EALF_SORTED;
+	  ea->count = n;
+	  ra->eattrs = ea;
+	}
+    }
+
+  /*
+   * Ideally, now we would send the received route to the rest of kernel code.
+   * But IPv6 ECMP routes before 4.11 are sent as a sequence of routes, so we
+   * postpone it and merge next hops until the end of the sequence. Note that
+   * when doing merging of next hops, we expect the new route to be unipath.
+   * Otherwise, we ignore additional next hops in nexthop_insert().
+   */
+
+  if (!s->net)
+  {
+    /* Store the new route */
+    s->net = net;
+    s->attrs = ra;
+    s->proto = p;
+    s->new = new;
+    s->krt_src = krt_src;
+    s->krt_type = i->rtm_type;
+    s->krt_proto = i->rtm_protocol;
+    s->krt_metric = priority;
+  }
+  else
+  {
+    /* Merge next hops with the stored route */
+    rta *oa = s->attrs;
+
+    struct nexthop *nhs = &oa->nh;
+    nexthop_insert(&nhs, &ra->nh);
+
+    /* Perhaps new nexthop is inserted at the first position */
+    if (nhs == &ra->nh)
+    {
+      /* Swap rtas */
+      s->attrs = ra;
+
+      /* Keep old eattrs */
+      ra->eattrs = oa->eattrs;
+    }
+  }
+}
+
+void
+krt_do_scan(struct krt_proto *p UNUSED)	/* CONFIG_ALL_TABLES_AT_ONCE => p is NULL */
+{
+  struct nlmsghdr *h;
+  struct nl_parse_state s;
+
+  nl_parse_begin(&s, 1);
+  nl_request_dump(AF_UNSPEC, RTM_GETROUTE);
+  while (h = nl_get_scan())
+    if (h->nlmsg_type == RTM_NEWROUTE || h->nlmsg_type == RTM_DELROUTE)
+      nl_parse_route(&s, h);
+    else
+      log(L_DEBUG "nl_scan_fire: Unknown packet received (type=%d)", h->nlmsg_type);
+  nl_parse_end(&s);
+}
+
+/*
+ *	Asynchronous Netlink interface
+ */
+
+static sock *nl_async_sk;		/* BIRD socket for asynchronous notifications */
+static byte *nl_async_rx_buffer;	/* Receive buffer */
+
+static void
+nl_async_msg(struct nlmsghdr *h)
+{
+  struct nl_parse_state s;
+
+  switch (h->nlmsg_type)
+    {
+    case RTM_NEWROUTE:
+    case RTM_DELROUTE:
+      DBG("KRT: Received async route notification (%d)\n", h->nlmsg_type);
+      nl_parse_begin(&s, 0);
+      nl_parse_route(&s, h);
+      nl_parse_end(&s);
+      break;
+    case RTM_NEWLINK:
+    case RTM_DELLINK:
+      DBG("KRT: Received async link notification (%d)\n", h->nlmsg_type);
+      if (kif_proto)
+	nl_parse_link(h, 0);
+      break;
+    case RTM_NEWADDR:
+    case RTM_DELADDR:
+      DBG("KRT: Received async address notification (%d)\n", h->nlmsg_type);
+      if (kif_proto)
+	nl_parse_addr(h, 0);
+      break;
+    default:
+      DBG("KRT: Received unknown async notification (%d)\n", h->nlmsg_type);
+    }
+}
+
+static int
+nl_async_hook(sock *sk, uint size UNUSED)
+{
+  struct iovec iov = { nl_async_rx_buffer, NL_RX_SIZE };
+  struct sockaddr_nl sa;
+  struct msghdr m = {
+    .msg_name = &sa,
+    .msg_namelen = sizeof(sa),
+    .msg_iov = &iov,
+    .msg_iovlen = 1,
+  };
+  struct nlmsghdr *h;
+  int x;
+  uint len;
+
+  x = recvmsg(sk->fd, &m, 0);
+  if (x < 0)
+    {
+      if (errno == ENOBUFS)
+	{
+	  /*
+	   *  Netlink reports some packets have been thrown away.
+	   *  One day we might react to it by asking for route table
+	   *  scan in near future.
+	   */
+	  log(L_WARN "Kernel dropped some netlink messages, will resync on next scan.");
+	  return 1;	/* More data are likely to be ready */
+	}
+      else if (errno != EWOULDBLOCK)
+	log(L_ERR "Netlink recvmsg: %m");
+      return 0;
+    }
+  if (sa.nl_pid)		/* It isn't from the kernel */
+    {
+      DBG("Non-kernel packet\n");
+      return 1;
+    }
+  h = (void *) nl_async_rx_buffer;
+  len = x;
+  if (m.msg_flags & MSG_TRUNC)
+    {
+      log(L_WARN "Netlink got truncated asynchronous message");
+      return 1;
+    }
+  while (NLMSG_OK(h, len))
+    {
+      nl_async_msg(h);
+      h = NLMSG_NEXT(h, len);
+    }
+  if (len)
+    log(L_WARN "nl_async_hook: Found packet remnant of size %d", len);
+  return 1;
+}
+
+static void
+nl_async_err_hook(sock *sk, int e UNUSED)
+{
+  nl_async_hook(sk, 0);
+}
+
+static void
+nl_open_async(void)
+{
+  sock *sk;
+  struct sockaddr_nl sa;
+  int fd;
+
+  if (nl_async_sk)
+    return;
+
+  DBG("KRT: Opening async netlink socket\n");
+
+  fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+  if (fd < 0)
+    {
+      log(L_ERR "Unable to open asynchronous rtnetlink socket: %m");
+      return;
+    }
+
+  bzero(&sa, sizeof(sa));
+  sa.nl_family = AF_NETLINK;
+  sa.nl_groups = RTMGRP_LINK |
+    RTMGRP_IPV4_IFADDR | RTMGRP_IPV4_ROUTE |
+    RTMGRP_IPV6_IFADDR | RTMGRP_IPV6_ROUTE;
+
+  if (bind(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0)
+    {
+      log(L_ERR "Unable to bind asynchronous rtnetlink socket: %m");
+      close(fd);
+      return;
+    }
+
+  nl_async_rx_buffer = xmalloc(NL_RX_SIZE);
+
+  sk = nl_async_sk = sk_new(krt_pool);
+  sk->type = SK_MAGIC;
+  sk->rx_hook = nl_async_hook;
+  sk->err_hook = nl_async_err_hook;
+  sk->fd = fd;
+  if (sk_open(sk) < 0)
+    bug("Netlink: sk_open failed");
+}
+
+
+/*
+ *	Interface to the UNIX krt module
+ */
+
+void
+krt_sys_io_init(void)
+{
+  nl_linpool = lp_new_default(krt_pool);
+  HASH_INIT(nl_table_map, krt_pool, 6);
+}
+
+int
+krt_sys_start(struct krt_proto *p)
+{
+  struct krt_proto *old = HASH_FIND(nl_table_map, RTH, p->af, krt_table_id(p));
+
+  if (old)
+    {
+      log(L_ERR "%s: Kernel table %u already registered by %s",
+	  p->p.name, krt_table_id(p), old->p.name);
+      return 0;
+    }
+
+  HASH_INSERT2(nl_table_map, RTH, krt_pool, p);
+
+  nl_open();
+  nl_open_async();
+
+  return 1;
+}
+
+void
+krt_sys_shutdown(struct krt_proto *p)
+{
+  HASH_REMOVE2(nl_table_map, RTH, krt_pool, p);
+}
+
+int
+krt_sys_reconfigure(struct krt_proto *p UNUSED, struct krt_config *n, struct krt_config *o)
+{
+  return (n->sys.table_id == o->sys.table_id) && (n->sys.metric == o->sys.metric);
+}
+
+void
+krt_sys_init_config(struct krt_config *cf)
+{
+  cf->sys.table_id = RT_TABLE_MAIN;
+  cf->sys.metric = 32;
+}
+
+void
+krt_sys_copy_config(struct krt_config *d, struct krt_config *s)
+{
+  d->sys.table_id = s->sys.table_id;
+  d->sys.metric = s->sys.metric;
+}
+
+static const char *krt_metrics_names[KRT_METRICS_MAX] = {
+  NULL, "lock", "mtu", "window", "rtt", "rttvar", "sstresh", "cwnd", "advmss",
+  "reordering", "hoplimit", "initcwnd", "features", "rto_min", "initrwnd", "quickack"
+};
+
+static const char *krt_features_names[KRT_FEATURES_MAX] = {
+  "ecn", NULL, NULL, "allfrag"
+};
+
+int
+krt_sys_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
+{
+  switch (a->id)
+  {
+  case EA_KRT_PREFSRC:
+    bsprintf(buf, "prefsrc");
+    return GA_NAME;
+
+  case EA_KRT_REALM:
+    bsprintf(buf, "realm");
+    return GA_NAME;
+
+  case EA_KRT_SCOPE:
+    bsprintf(buf, "scope");
+    return GA_NAME;
+
+  case EA_KRT_LOCK:
+    buf += bsprintf(buf, "lock:");
+    ea_format_bitfield(a, buf, buflen, krt_metrics_names, 2, KRT_METRICS_MAX);
+    return GA_FULL;
+
+  case EA_KRT_FEATURES:
+    buf += bsprintf(buf, "features:");
+    ea_format_bitfield(a, buf, buflen, krt_features_names, 0, KRT_FEATURES_MAX);
+    return GA_FULL;
+
+  default:;
+    int id = (int)EA_ID(a->id) - KRT_METRICS_OFFSET;
+    if (id > 0 && id < KRT_METRICS_MAX)
+    {
+      bsprintf(buf, "%s", krt_metrics_names[id]);
+      return GA_NAME;
+    }
+
+    return GA_UNKNOWN;
+  }
+}
+
+
+
+void
+kif_sys_start(struct kif_proto *p UNUSED)
+{
+  nl_open();
+  nl_open_async();
+}
+
+void
+kif_sys_shutdown(struct kif_proto *p UNUSED)
+{
+}
+
+int
+kif_update_sysdep_addr(struct iface *i UNUSED)
+{
+  return 0;
+}
-- 
cgit v1.2.3


From 1f2eb2aca8e348fefc1822ec2adcad0cc97768d8 Mon Sep 17 00:00:00 2001
From: "Ondrej Zajicek (work)" <santiago@crfreenet.org>
Date: Mon, 20 Dec 2021 20:25:35 +0100
Subject: BGP: Implement flowspec validation procedure

Implement flowspec validation procedure as described in RFC 8955 sec. 6
and RFC 9117. The Validation procedure enforces that only routers in the
forwarding path for a network can originate flowspec rules for that
network.

The patch adds new mechanism for tracking inter-table dependencies, which
is necessary as the flowspec validation depends on IP routes, and flowspec
rules must be revalidated when best IP routes change.

The validation procedure is disabled by default and requires that
relevant IP table uses trie, as it uses interval queries for subnets.
---
 doc/bird.sgml       |  28 +++-
 nest/route.h        |  15 +++
 nest/rt-table.c     | 358 +++++++++++++++++++++++++++++++++++++++++++++++++---
 proto/bgp/attrs.c   |   4 +
 proto/bgp/bgp.c     |  54 +++++++-
 proto/bgp/bgp.h     |   6 +-
 proto/bgp/config.Y  |  17 ++-
 proto/bgp/packets.c |  28 ++++
 proto/pipe/pipe.c   |   3 +
 9 files changed, 487 insertions(+), 26 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 39dadaf2..d1d2bdae 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -2274,6 +2274,7 @@ avoid routing loops.
 <item> <rfc id="8092"> - BGP Large Communities Attribute
 <item> <rfc id="8203"> - BGP Administrative Shutdown Communication
 <item> <rfc id="8212"> - Default EBGP Route Propagation Behavior without Policies
+<item> <rfc id="9117"> - Revised Validation Procedure for BGP Flow Specifications
 </itemize>
 
 <sect1>Route selection rules
@@ -2659,7 +2660,7 @@ using the following configuration parameters:
 
 	<tag><label id="bgp-error-wait-time">error wait time <m/number/,<m/number/</tag>
 	Minimum and maximum delay in seconds between a protocol failure (either
-	local or reported by the peer) and automatic restart. Doesn't apply
+	local or reported by the peer) and automatic restart. Doesn not apply
 	when <cf/disable after error/ is configured. If consecutive errors
 	happen, the delay is increased exponentially until it reaches the
 	maximum. Default: 60, 300.
@@ -2837,6 +2838,31 @@ be used in explicit configuration.
 	explicitly (to conserve memory). This option requires that the connected
 	routing table is <ref id="dsc-table-sorted" name="sorted">. Default: off.
 
+	<tag><label id="bgp-validate">validate <m/switch/</tag>
+	Apply flowspec validation procedure as described in <rfc id="8955">
+	section 6 and <rfc id="9117">. The Validation procedure enforces that
+	only routers in the forwarding path for a network can originate flowspec
+	rules for that network. The validation procedure should be used for EBGP
+	to prevent injection of malicious flowspec rules from outside, but it
+	should also be used for IBGP to ensure that selected flowspec rules are
+	consistent with selected IP routes. The validation procedure uses an IP
+	routing table (<ref id="bgp-base-table" name="base table">, see below)
+	against which flowspec rules are validated. This option is limited to
+	flowspec channels. Default: off (for compatibility reasons).
+
+	Note that currently the flowspec validation does not work reliably
+	together with <ref id="bgp-import-table" name="import table"> option
+	enabled on flowspec channels.
+
+	<tag><label id="bgp-base-table">base table <m/name/</tag>
+	Specifies an IP table used for the flowspec validation procedure. The
+	table must have enabled <cf/trie/ option, otherwise the validation
+	procedure would not work. The type of the table must be <cf/ipv4/ for
+	<cf/flow4/ channels and <cf/ipv6/ for <cf/flow6/ channels. This option
+	is limited to flowspec channels. Default: the main table of the
+	<cf/ipv4/ / <cf/ipv6/ channel of the same BGP instance, or the
+	<cf/master4/ / <cf/master6/ table if there is no such channel.
+
 	<tag><label id="bgp-extended-next-hop">extended next hop <m/switch/</tag>
 	BGP expects that announced next hops have the same address family as
 	associated network prefixes. This option provides an extension to use
diff --git a/nest/route.h b/nest/route.h
index a1732bc7..102ea0ea 100644
--- a/nest/route.h
+++ b/nest/route.h
@@ -192,6 +192,8 @@ typedef struct rtable {
 
   list subscribers;			/* Subscribers for notifications */
   struct timer *settle_timer;		/* Settle time for notifications */
+  list flowspec_links;			/* List of flowspec links, src for NET_IPx and dst for NET_FLOWx */
+  struct f_trie *flowspec_trie;		/* Trie for evaluation of flowspec notifications */
 } rtable;
 
 struct rt_subscription {
@@ -201,6 +203,13 @@ struct rt_subscription {
   void *data;
 };
 
+struct rt_flowspec_link {
+  node n;
+  rtable *src;
+  rtable *dst;
+  u32 uc;
+};
+
 #define NHU_CLEAN	0
 #define NHU_SCHEDULED	1
 #define NHU_RUNNING	2
@@ -267,6 +276,7 @@ typedef struct rte {
     struct {
       u8 suppressed;			/* Used for deterministic MED comparison */
       s8 stale;				/* Route is LLGR_STALE, -1 if unknown */
+      struct rtable *base_table;	/* Base table for Flowspec validation */
     } bgp;
 #endif
 #ifdef CONFIG_BABEL
@@ -322,6 +332,8 @@ void rt_lock_table(rtable *);
 void rt_unlock_table(rtable *);
 void rt_subscribe(rtable *tab, struct rt_subscription *s);
 void rt_unsubscribe(struct rt_subscription *s);
+void rt_flowspec_link(rtable *src, rtable *dst);
+void rt_flowspec_unlink(rtable *src, rtable *dst);
 rtable *rt_setup(pool *, struct rtable_config *);
 static inline void rt_shutdown(rtable *r) { rfree(r->rp); }
 
@@ -743,6 +755,9 @@ rta_set_recursive_next_hop(rtable *dep, rta *a, rtable *tab, ip_addr gw, ip_addr
 static inline void rt_lock_hostentry(struct hostentry *he) { if (he) he->uc++; }
 static inline void rt_unlock_hostentry(struct hostentry *he) { if (he) he->uc--; }
 
+int rt_flowspec_check(rtable *tab_ip, rtable *tab_flow, const net_addr *n, rta *a, int interior);
+
+
 /*
  *	Default protocol preferences
  */
diff --git a/nest/rt-table.c b/nest/rt-table.c
index 94ae987b..ee679898 100644
--- a/nest/rt-table.c
+++ b/nest/rt-table.c
@@ -26,6 +26,66 @@
  * (see the route attribute module for a precise explanation) holding the
  * remaining route attributes which are expected to be shared by multiple
  * routes in order to conserve memory.
+ *
+ * There are several mechanisms that allow automatic update of routes in one
+ * routing table (dst) as a result of changes in another routing table (src).
+ * They handle issues of recursive next hop resolving, flowspec validation and
+ * RPKI validation.
+ *
+ * The first such mechanism is handling of recursive next hops. A route in the
+ * dst table has an indirect next hop address, which is resolved through a route
+ * in the src table (which may also be the same table) to get an immediate next
+ * hop. This is implemented using structure &hostcache attached to the src
+ * table, which contains &hostentry structures for each tracked next hop
+ * address. These structures are linked from recursive routes in dst tables,
+ * possibly multiple routes sharing one hostentry (as many routes may have the
+ * same indirect next hop). There is also a trie in the hostcache, which matches
+ * all prefixes that may influence resolving of tracked next hops.
+ *
+ * When a best route changes in the src table, the hostcache is notified using
+ * rt_notify_hostcache(), which immediately checks using the trie whether the
+ * change is relevant and if it is, then it schedules asynchronous hostcache
+ * recomputation. The recomputation is done by rt_update_hostcache() (called
+ * from rt_event() of src table), it walks through all hostentries and resolves
+ * them (by rt_update_hostentry()). It also updates the trie. If a change in
+ * hostentry resolution was found, then it schedules asynchronous nexthop
+ * recomputation of associated dst table. That is done by rt_next_hop_update()
+ * (called from rt_event() of dst table), it iterates over all routes in the dst
+ * table and re-examines their hostentries for changes. Note that in contrast to
+ * hostcache update, next hop update can be interrupted by main loop. These two
+ * full-table walks (over hostcache and dst table) are necessary due to absence
+ * of direct lookups (route -> affected nexthop, nexthop -> its route).
+ *
+ * The second mechanism is for flowspec validation, where validity of flowspec
+ * routes depends of resolving their network prefixes in IP routing tables. This
+ * is similar to the recursive next hop mechanism, but simpler as there are no
+ * intermediate hostcache and hostentries (because flows are less likely to
+ * share common net prefix than routes sharing a common next hop). In src table,
+ * there is a list of dst tables (list flowspec_links), this list is updated by
+ * flowpsec channels (by rt_flowspec_link() and rt_flowspec_unlink() during
+ * channel start/stop). Each dst table has its own trie of prefixes that may
+ * influence validation of flowspec routes in it (flowspec_trie).
+ *
+ * When a best route changes in the src table, rt_flowspec_notify() immediately
+ * checks all dst tables from the list using their tries to see whether the
+ * change is relevant for them. If it is, then an asynchronous re-validation of
+ * flowspec routes in the dst table is scheduled. That is also done by function
+ * rt_next_hop_update(), like nexthop recomputation above. It iterates over all
+ * flowspec routes and re-validates them. It also recalculates the trie.
+ *
+ * Note that in contrast to the hostcache update, here the trie is recalculated
+ * during the rt_next_hop_update(), which may be interleaved with IP route
+ * updates. The trie is flushed at the beginning of recalculation, which means
+ * that such updates may use partial trie to see if they are relevant. But it
+ * works anyway! Either affected flowspec was already re-validated and added to
+ * the trie, then IP route change would match the trie and trigger a next round
+ * of re-validation, or it was not yet re-validated and added to the trie, but
+ * will be re-validated later in this round anyway.
+ *
+ * The third mechanism is used for RPKI re-validation of IP routes and it is the
+ * simplest. It is just a list of subscribers in src table, who are notified
+ * when any change happened, but only after a settle time. Also, in RPKI case
+ * the dst is not a table, but a channel, who refeeds routes through a filter.
  */
 
 #undef LOCAL_DEBUG
@@ -44,6 +104,7 @@
 #include "lib/hash.h"
 #include "lib/string.h"
 #include "lib/alloca.h"
+#include "lib/flowspec.h"
 
 #ifdef CONFIG_BGP
 #include "proto/bgp/bgp.h"
@@ -62,6 +123,7 @@ static void rt_update_hostcache(rtable *tab);
 static void rt_next_hop_update(rtable *tab);
 static inline void rt_prune_table(rtable *tab);
 static inline void rt_schedule_notify(rtable *tab);
+static void rt_flowspec_notify(rtable *tab, net *net);
 
 
 static void
@@ -1193,6 +1255,9 @@ rte_announce(rtable *tab, uint type, net *net, rte *new, rte *old,
 
     if (tab->hostcache)
       rt_notify_hostcache(tab, net);
+
+    if (!EMPTY_LIST(tab->flowspec_links))
+      rt_flowspec_notify(tab, net);
   }
 
   rt_schedule_notify(tab);
@@ -1254,6 +1319,10 @@ rte_validate(rte *e)
 
   if (net_type_match(n->n.addr, NB_DEST) == !e->attrs->dest)
   {
+    /* Exception for flowspec that failed validation */
+    if (net_is_flow(n->n.addr) && (e->attrs->dest == RTD_UNREACHABLE))
+      return 1;
+
     log(L_WARN "Ignoring route %N with invalid dest %d received via %s",
 	n->n.addr, e->attrs->dest, e->sender->proto->name);
     return 0;
@@ -2097,6 +2166,90 @@ rt_unsubscribe(struct rt_subscription *s)
   rt_unlock_table(s->tab);
 }
 
+static struct rt_flowspec_link *
+rt_flowspec_find_link(rtable *src, rtable *dst)
+{
+  struct rt_flowspec_link *ln;
+  WALK_LIST(ln, src->flowspec_links)
+    if ((ln->src == src) && (ln->dst == dst))
+      return ln;
+
+  return NULL;
+}
+
+void
+rt_flowspec_link(rtable *src, rtable *dst)
+{
+  ASSERT(rt_is_ip(src));
+  ASSERT(rt_is_flow(dst));
+
+  struct rt_flowspec_link *ln = rt_flowspec_find_link(src, dst);
+
+  if (!ln)
+  {
+    rt_lock_table(src);
+    rt_lock_table(dst);
+
+    ln = mb_allocz(src->rp, sizeof(struct rt_flowspec_link));
+    ln->src = src;
+    ln->dst = dst;
+    add_tail(&src->flowspec_links, &ln->n);
+  }
+
+  ln->uc++;
+}
+
+void
+rt_flowspec_unlink(rtable *src, rtable *dst)
+{
+  struct rt_flowspec_link *ln = rt_flowspec_find_link(src, dst);
+
+  ASSERT(ln && (ln->uc > 0));
+
+  ln->uc--;
+
+  if (!ln->uc)
+  {
+    rem_node(&ln->n);
+    mb_free(ln);
+
+    rt_unlock_table(src);
+    rt_unlock_table(dst);
+  }
+}
+
+static void
+rt_flowspec_notify(rtable *src, net *net)
+{
+  /* Only IP tables are src links */
+  ASSERT(rt_is_ip(src));
+
+  struct rt_flowspec_link *ln;
+  WALK_LIST(ln, src->flowspec_links)
+  {
+    rtable *dst = ln->dst;
+    ASSERT(rt_is_flow(dst));
+
+    /* No need to inspect it further if recalculation is already active */
+    if ((dst->nhu_state == NHU_SCHEDULED) || (dst->nhu_state == NHU_DIRTY))
+      continue;
+
+    if (trie_match_net(dst->flowspec_trie, net->n.addr))
+      rt_schedule_nhu(dst);
+  }
+}
+
+static void
+rt_flowspec_reset_trie(rtable *tab)
+{
+  linpool *lp = tab->flowspec_trie->lp;
+  int ipv4 = tab->flowspec_trie->ipv4;
+
+  lp_flush(lp);
+  tab->flowspec_trie = f_new_trie(lp, 0);
+  tab->flowspec_trie->ipv4 = ipv4;
+}
+
 static void
 rt_free(resource *_r)
 {
@@ -2167,16 +2320,23 @@ rt_setup(pool *pp, struct rtable_config *cf)
     t->fib.init = net_init_with_trie;
   }
 
+  init_list(&t->channels);
+  init_list(&t->flowspec_links);
+  init_list(&t->subscribers);
+
   if (!(t->internal = cf->internal))
   {
-    init_list(&t->channels);
     hmap_init(&t->id_map, p, 1024);
     hmap_set(&t->id_map, 0);
 
-    init_list(&t->subscribers);
-
     t->rt_event = ev_new_init(p, rt_event, t);
     t->last_rt_change = t->gc_time = current_time();
+
+    if (rt_is_flow(t))
+    {
+      t->flowspec_trie = f_new_trie(lp_new_default(p), 0);
+      t->flowspec_trie->ipv4 = (t->addr_type == NET_FLOW4);
+    }
   }
 
   return t;
@@ -2331,21 +2491,6 @@ rt_preconfig(struct config *c)
  * triggered by rt_schedule_nhu().
  */
 
-static inline int
-rta_next_hop_outdated(rta *a)
-{
-  struct hostentry *he = a->hostentry;
-
-  if (!he)
-    return 0;
-
-  if (!he->src)
-    return a->dest != RTD_UNREACHABLE;
-
-  return (a->dest != he->dest) || (a->igp_metric != he->igp_metric) ||
-    (!he->nexthop_linkable) || !nexthop_same(&(a->nh), &(he->src->nh));
-}
-
 void
 rta_apply_hostentry(rta *a, struct hostentry *he, mpls_label_stack *mls)
 {
@@ -2437,9 +2582,27 @@ no_nexthop:
     }
 }
 
+static inline int
+rta_next_hop_outdated(rta *a)
+{
+  struct hostentry *he = a->hostentry;
+
+  if (!he)
+    return 0;
+
+  if (!he->src)
+    return a->dest != RTD_UNREACHABLE;
+
+  return (a->dest != he->dest) || (a->igp_metric != he->igp_metric) ||
+    (!he->nexthop_linkable) || !nexthop_same(&(a->nh), &(he->src->nh));
+}
+
 static inline rte *
 rt_next_hop_update_rte(rtable *tab UNUSED, rte *old)
 {
+  if (!rta_next_hop_outdated(old->attrs))
+    return NULL;
+
   rta *a = alloca(RTA_MAX_SIZE);
   memcpy(a, old->attrs, rta_size(old->attrs));
 
@@ -2456,6 +2619,152 @@ rt_next_hop_update_rte(rtable *tab UNUSED, rte *old)
   return e;
 }
 
+
+#ifdef CONFIG_BGP
+
+static inline int
+net_flow_has_dst_prefix(const net_addr *n)
+{
+  ASSUME(net_is_flow(n));
+
+  if (n->pxlen)
+    return 1;
+
+  if (n->type == NET_FLOW4)
+  {
+    const net_addr_flow4 *n4 = (void *) n;
+    return (n4->length > sizeof(net_addr_flow4)) && (n4->data[0] == FLOW_TYPE_DST_PREFIX);
+  }
+  else
+  {
+    const net_addr_flow6 *n6 = (void *) n;
+    return (n6->length > sizeof(net_addr_flow6)) && (n6->data[0] == FLOW_TYPE_DST_PREFIX);
+  }
+}
+
+static inline int
+rta_as_path_is_empty(rta *a)
+{
+  eattr *e = ea_find(a->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
+  return !e || (as_path_getlen(e->u.ptr) == 0);
+}
+
+static inline u32
+rta_get_first_asn(rta *a)
+{
+  eattr *e = ea_find(a->eattrs, EA_CODE(PROTOCOL_BGP, BA_AS_PATH));
+  u32 asn;
+
+  return (e && as_path_get_first_regular(e->u.ptr, &asn)) ? asn : 0;
+}
+
+int
+rt_flowspec_check(rtable *tab_ip, rtable *tab_flow, const net_addr *n, rta *a, int interior)
+{
+  ASSERT(rt_is_ip(tab_ip));
+  ASSERT(rt_is_flow(tab_flow));
+  ASSERT(tab_ip->trie);
+
+  /* RFC 8955 6. a) Flowspec has defined dst prefix */
+  if (!net_flow_has_dst_prefix(n))
+    return 0;
+
+  /* RFC 9117 4.1. Accept  AS_PATH is empty (fr */
+  if (interior && rta_as_path_is_empty(a))
+    return 1;
+
+
+  /* RFC 8955 6. b) Flowspec and its best-match route have the same originator */
+
+  /* Find flowspec dst prefix */
+  net_addr dst;
+  if (n->type == NET_FLOW4)
+    net_fill_ip4(&dst, net4_prefix(n), net4_pxlen(n));
+  else
+    net_fill_ip6(&dst, net6_prefix(n), net6_pxlen(n));
+
+  /* Find best-match BGP unicast route for flowspec dst prefix */
+  net *nb = net_route(tab_ip, &dst);
+  rte *rb = nb ? nb->routes : NULL;
+
+  /* Register prefix to trie for tracking further changes */
+  int max_pxlen = (n->type == NET_FLOW4) ? IP4_MAX_PREFIX_LENGTH : IP6_MAX_PREFIX_LENGTH;
+  trie_add_prefix(tab_flow->flowspec_trie, &dst, (nb ? nb->n.addr->pxlen : 0), max_pxlen);
+
+  /* No best-match BGP route -> no flowspec */
+  if (!rb || (rb->attrs->source != RTS_BGP))
+    return 0;
+
+  /* Find ORIGINATOR_ID values */
+  u32 orig_a = ea_get_int(a->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGINATOR_ID), 0);
+  u32 orig_b = ea_get_int(rb->attrs->eattrs, EA_CODE(PROTOCOL_BGP, BA_ORIGINATOR_ID), 0);
+
+  /* Originator is either ORIGINATOR_ID (if present), or BGP neighbor address (if not) */
+  if ((orig_a != orig_b) || (!orig_a && !orig_b && !ipa_equal(a->from, rb->attrs->from)))
+    return 0;
+
+
+  /* Find ASN of the best-match route, for use in next checks */
+  u32 asn_b = rta_get_first_asn(rb->attrs);
+  if (!asn_b)
+    return 0;
+
+  /* RFC 9117 4.2. For EBGP, flowspec and its best-match route are from the same AS */
+  if (!interior && (rta_get_first_asn(a) != asn_b))
+    return 0;
+
+  /* RFC 8955 6. c) More-specific routes are from the same AS as the best-match route */
+  TRIE_WALK(tab_ip->trie, subnet, &dst)
+  {
+    net *nc = net_find_valid(tab_ip, &subnet);
+    if (!nc)
+      continue;
+
+    rte *rc = nc->routes;
+    if (rc->attrs->source != RTS_BGP)
+      return 0;
+
+    if (rta_get_first_asn(rc->attrs) != asn_b)
+      return 0;
+  }
+  TRIE_WALK_END;
+
+  return 1;
+}
+
+#endif /* CONFIG_BGP */
+
+static rte *
+rt_flowspec_update_rte(rtable *tab, rte *r)
+{
+#ifdef CONFIG_BGP
+  if ((r->attrs->source != RTS_BGP) || !r->u.bgp.base_table)
+    return NULL;
+
+  const net_addr *n = r->net->n.addr;
+  struct bgp_proto *p = (void *) r->attrs->src->proto;
+  int valid = rt_flowspec_check(r->u.bgp.base_table, tab, n, r->attrs, p->is_interior);
+  int dest = valid ? RTD_NONE : RTD_UNREACHABLE;
+
+  if (dest == r->attrs->dest)
+    return NULL;
+
+  rta *a = alloca(RTA_MAX_SIZE);
+  memcpy(a, r->attrs, rta_size(r->attrs));
+  a->dest = dest;
+  a->aflags = 0;
+
+  rte *new = sl_alloc(rte_slab);
+  memcpy(new, r, sizeof(rte));
+  new->attrs = rta_lookup(a);
+
+  return new;
+#else
+  return NULL;
+#endif
+}
+
+
 static inline int
 rt_next_hop_update_net(rtable *tab, net *n)
 {
@@ -2468,9 +2777,14 @@ rt_next_hop_update_net(rtable *tab, net *n)
     return 0;
 
   for (k = &n->routes; e = *k; k = &e->next)
-    if (rta_next_hop_outdated(e->attrs))
+  {
+    if (!net_is_flow(n->n.addr))
+      new = rt_next_hop_update_rte(tab, e);
+    else
+      new = rt_flowspec_update_rte(tab, e);
+
+    if (new)
       {
-	new = rt_next_hop_update_rte(tab, e);
 	*k = new;
 
 	rte_trace_in(D_ROUTES, new->sender, new, "updated");
@@ -2489,6 +2803,7 @@ rt_next_hop_update_net(rtable *tab, net *n)
 	e = new;
 	count++;
       }
+  }
 
   if (!count)
     return 0;
@@ -2536,6 +2851,9 @@ rt_next_hop_update(rtable *tab)
     {
       FIB_ITERATE_INIT(fit, &tab->fib);
       tab->nhu_state = NHU_RUNNING;
+
+      if (tab->flowspec_trie)
+	rt_flowspec_reset_trie(tab);
     }
 
   FIB_ITERATE_START(&tab->fib, fit, net, n)
diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c
index 24ba00ba..b28cbd55 100644
--- a/proto/bgp/attrs.c
+++ b/proto/bgp/attrs.c
@@ -1676,6 +1676,10 @@ bgp_preexport(struct proto *P, rte **new, struct linpool *pool UNUSED)
   if (src == NULL)
     return 0;
 
+  /* Reject flowspec that failed validation */
+  if ((e->attrs->dest == RTD_UNREACHABLE) && net_is_flow(e->net->n.addr))
+      return -1;
+
   /* IBGP route reflection, RFC 4456 */
   if (p->is_internal && src->is_internal && (p->local_as == src->local_as))
   {
diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index e4d754b1..58084136 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -101,6 +101,7 @@
  * RFC 8203 - BGP Administrative Shutdown Communication
  * RFC 8212 - Default EBGP Route Propagation Behavior without Policies
  * RFC 8654 - Extended Message Support for BGP
+ * RFC 9117 - Revised Validation Procedure for BGP Flow Specifications
  * draft-ietf-idr-ext-opt-param-07
  * draft-uttaro-idr-bgp-persistence-04
  * draft-walton-bgp-hostname-capability-02
@@ -1735,6 +1736,9 @@ bgp_channel_init(struct channel *C, struct channel_config *CF)
 
   if (cf->igp_table_ip6)
     c->igp_table_ip6 = cf->igp_table_ip6->table;
+
+  if (cf->base_table)
+    c->base_table = cf->base_table->table;
 }
 
 static int
@@ -1750,6 +1754,12 @@ bgp_channel_start(struct channel *C)
   if (c->igp_table_ip6)
     rt_lock_table(c->igp_table_ip6);
 
+  if (c->base_table)
+  {
+    rt_lock_table(c->base_table);
+    rt_flowspec_link(c->base_table, c->c.table);
+  }
+
   c->pool = p->p.pool; // XXXX
   bgp_init_bucket_table(c);
   bgp_init_prefix_table(c);
@@ -1834,6 +1844,12 @@ bgp_channel_cleanup(struct channel *C)
   if (c->igp_table_ip6)
     rt_unlock_table(c->igp_table_ip6);
 
+  if (c->base_table)
+  {
+    rt_flowspec_unlink(c->base_table, c->c.table);
+    rt_unlock_table(c->base_table);
+  }
+
   c->index = 0;
 
   /* Cleanup rest of bgp_channel starting at pool field */
@@ -1881,6 +1897,25 @@ bgp_default_igp_table(struct bgp_config *cf, struct bgp_channel_config *cc, u32
   cf_error("Undefined IGP table");
 }
 
+static struct rtable_config *
+bgp_default_base_table(struct bgp_config *cf, struct bgp_channel_config *cc)
+{
+  /* Expected table type */
+  u32 type = (cc->afi == BGP_AF_FLOW4) ? NET_IP4 : NET_IP6;
+
+  /* First, try appropriate IP channel */
+  u32 afi2 = BGP_AF(BGP_AFI(cc->afi), BGP_SAFI_UNICAST);
+  struct bgp_channel_config *cc2 = bgp_find_channel_config(cf, afi2);
+  if (cc2 && (cc2->c.table->addr_type == type))
+    return cc2->c.table;
+
+  /* Last, try default table of given type */
+  struct rtable_config *tab = cf->c.global->def_tables[type];
+  if (tab)
+    return tab;
+
+  cf_error("Undefined base table");
+}
 
 void
 bgp_postconfig(struct proto_config *CF)
@@ -2025,6 +2060,14 @@ bgp_postconfig(struct proto_config *CF)
 	cf_error("Mismatched IGP table type");
     }
 
+    /* Default value of base table */
+    if ((BGP_SAFI(cc->afi) == BGP_SAFI_FLOW) && cc->validate && !cc->base_table)
+      cc->base_table = bgp_default_base_table(cf, cc);
+
+    if (cc->base_table && !cc->base_table->trie_used)
+      cf_error("Flowspec validation requires base table (%s) with trie",
+	       cc->base_table->name);
+
     if (cf->multihop && (cc->gw_mode == GW_DIRECT))
       cf_error("Multihop BGP cannot use direct gateway mode");
 
@@ -2093,7 +2136,7 @@ bgp_reconfigure(struct proto *P, struct proto_config *CF)
   return same;
 }
 
-#define IGP_TABLE(cf, sym) ((cf)->igp_table_##sym ? (cf)->igp_table_##sym ->table : NULL )
+#define TABLE(cf, NAME) ((cf)->NAME ? (cf)->NAME->table : NULL )
 
 static int
 bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *import_changed, int *export_changed)
@@ -2104,6 +2147,7 @@ bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *impor
   struct bgp_channel_config *old = c->cf;
 
   if ((new->secondary != old->secondary) ||
+      (new->validate != old->validate) ||
       (new->gr_able != old->gr_able) ||
       (new->llgr_able != old->llgr_able) ||
       (new->llgr_time != old->llgr_time) ||
@@ -2111,8 +2155,9 @@ bgp_channel_reconfigure(struct channel *C, struct channel_config *CC, int *impor
       (new->add_path != old->add_path) ||
       (new->import_table != old->import_table) ||
       (new->export_table != old->export_table) ||
-      (IGP_TABLE(new, ip4) != IGP_TABLE(old, ip4)) ||
-      (IGP_TABLE(new, ip6) != IGP_TABLE(old, ip6)))
+      (TABLE(new, igp_table_ip4) != TABLE(old, igp_table_ip4)) ||
+      (TABLE(new, igp_table_ip6) != TABLE(old, igp_table_ip6)) ||
+      (TABLE(new, base_table) != TABLE(old, base_table)))
     return 0;
 
   if (new->mandatory && !old->mandatory && (C->channel_state != CS_UP))
@@ -2526,6 +2571,9 @@ bgp_show_proto_info(struct proto *P)
 
       if (c->igp_table_ip6)
 	cli_msg(-1006, "    IGP IPv6 table: %s", c->igp_table_ip6->name);
+
+      if (c->base_table)
+	cli_msg(-1006, "    Base table:     %s", c->base_table->name);
     }
   }
 }
diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h
index cca4b448..e894d632 100644
--- a/proto/bgp/bgp.h
+++ b/proto/bgp/bgp.h
@@ -146,6 +146,7 @@ struct bgp_channel_config {
   u8 mandatory;				/* Channel is mandatory in capability negotiation */
   u8 gw_mode;				/* How we compute route gateway from next_hop attr, see GW_* */
   u8 secondary;				/* Accept also non-best routes (i.e. RA_ACCEPTED) */
+  u8 validate;				/* Validate Flowspec per RFC 8955 (6) */
   u8 gr_able;				/* Allow full graceful restart for the channel */
   u8 llgr_able;				/* Allow full long-lived GR for the channel */
   uint llgr_time;			/* Long-lived graceful restart stale time */
@@ -159,6 +160,7 @@ struct bgp_channel_config {
 
   struct rtable_config *igp_table_ip4;	/* Table for recursive IPv4 next hop lookups */
   struct rtable_config *igp_table_ip6;	/* Table for recursive IPv6 next hop lookups */
+  struct rtable_config *base_table;	/* Base table for Flowspec validation */
 };
 
 #define BGP_PT_INTERNAL		1
@@ -340,6 +342,7 @@ struct bgp_channel {
 
   rtable *igp_table_ip4;		/* Table for recursive IPv4 next hop lookups */
   rtable *igp_table_ip6;		/* Table for recursive IPv6 next hop lookups */
+  rtable *base_table;			/* Base table for Flowspec validation */
 
   /* Rest are zeroed when down */
   pool *pool;
@@ -449,6 +452,7 @@ struct bgp_parse_state {
   jmp_buf err_jmpbuf;
 
   struct hostentry *hostentry;
+  struct rtable *base_table;
   adata *mpls_labels;
 
   /* Cached state for bgp_rte_update() */
@@ -515,7 +519,7 @@ struct rte_source *bgp_get_source(struct bgp_proto *p, u32 path_id);
 static inline int
 rte_resolvable(rte *rt)
 {
-  return rt->attrs->dest == RTD_UNICAST;
+  return rt->attrs->dest != RTD_UNREACHABLE;
 }
 
 
diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y
index 2dfbdca9..27c352c5 100644
--- a/proto/bgp/config.Y
+++ b/proto/bgp/config.Y
@@ -31,7 +31,7 @@ CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, KEEPALIVE,
 	STRICT, BIND, CONFEDERATION, MEMBER, MULTICAST, FLOW4, FLOW6, LONG,
 	LIVED, STALE, IMPORT, IBGP, EBGP, MANDATORY, INTERNAL, EXTERNAL, SETS,
 	DYNAMIC, RANGE, NAME, DIGITS, BGP_AIGP, AIGP, ORIGINATE, COST, ENFORCE,
-	FIRST)
+	FIRST, VALIDATE, BASE)
 
 %type <i> bgp_nh
 %type <i32> bgp_afi
@@ -255,6 +255,11 @@ bgp_channel_item:
  | GATEWAY DIRECT { BGP_CC->gw_mode = GW_DIRECT; }
  | GATEWAY RECURSIVE { BGP_CC->gw_mode = GW_RECURSIVE; }
  | SECONDARY bool { BGP_CC->secondary = $2; }
+ | VALIDATE bool {
+    BGP_CC->validate = $2;
+    if (BGP_SAFI(BGP_CC->afi) != BGP_SAFI_FLOW)
+      cf_error("Validate option limited to flowspec channels");
+   }
  | GRACEFUL RESTART bool { BGP_CC->gr_able = $3; }
  | LONG LIVED GRACEFUL RESTART bool { BGP_CC->llgr_able = $5; }
  | LONG LIVED STALE TIME expr { BGP_CC->llgr_time = $5; }
@@ -278,6 +283,16 @@ bgp_channel_item:
     else
       cf_error("Mismatched IGP table type");
    }
+ | BASE TABLE rtable {
+    if (BGP_SAFI(BGP_CC->afi) != BGP_SAFI_FLOW)
+      cf_error("Base table option limited to flowspec channels");
+
+    if (((BGP_CC->afi == BGP_AF_FLOW4) && ($3->addr_type == NET_IP4)) ||
+        ((BGP_CC->afi == BGP_AF_FLOW6) && ($3->addr_type == NET_IP6)))
+      BGP_CC->base_table = $3;
+    else
+      cf_error("Mismatched base table type");
+   }
  ;
 
 bgp_channel_opts:
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 99b5d5b4..e536f873 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -1009,6 +1009,23 @@ bgp_apply_mpls_labels(struct bgp_parse_state *s, rta *a, u32 *labels, uint lnum)
   }
 }
 
+static void
+bgp_apply_flow_validation(struct bgp_parse_state *s, const net_addr *n, rta *a)
+{
+  struct bgp_channel *c = s->channel;
+  int valid = rt_flowspec_check(c->base_table, c->c.table, n, a, s->proto->is_interior);
+  a->dest = valid ? RTD_NONE : RTD_UNREACHABLE;
+
+  /* Set rte.bgp.base_table later from this state variable */
+  s->base_table = c->base_table;
+
+  /* Invalidate cached rta if dest changes */
+  if (s->cached_rta && (s->cached_rta->dest != a->dest))
+  {
+    rta_free(s->cached_rta);
+    s->cached_rta = NULL;
+  }
+}
 
 static int
 bgp_match_src(struct bgp_export_state *s, int mode)
@@ -1370,6 +1387,7 @@ bgp_rte_update(struct bgp_parse_state *s, net_addr *n, u32 path_id, rta *a0)
   e->pflags = 0;
   e->u.bgp.suppressed = 0;
   e->u.bgp.stale = -1;
+  e->u.bgp.base_table = s->base_table;
   rte_update3(&s->channel->c, n, e, s->last_src);
 }
 
@@ -1884,6 +1902,10 @@ bgp_decode_nlri_flow4(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
     net_fill_flow4(n, px, pxlen, pos, flen);
     ADVANCE(pos, len, flen);
 
+    /* Apply validation procedure per RFC 8955 (6) */
+    if (a && s->channel->cf->validate)
+      bgp_apply_flow_validation(s, n, a);
+
     bgp_rte_update(s, n, path_id, a);
   }
 }
@@ -1972,6 +1994,10 @@ bgp_decode_nlri_flow6(struct bgp_parse_state *s, byte *pos, uint len, rta *a)
     net_fill_flow6(n, px, pxlen, pos, flen);
     ADVANCE(pos, len, flen);
 
+    /* Apply validation procedure per RFC 8955 (6) */
+    if (a && s->channel->cf->validate)
+      bgp_apply_flow_validation(s, n, a);
+
     bgp_rte_update(s, n, path_id, a);
   }
 }
@@ -2425,6 +2451,8 @@ bgp_decode_nlri(struct bgp_parse_state *s, u32 afi, byte *nlri, uint len, ea_lis
   s->last_id = 0;
   s->last_src = s->proto->p.main_source;
 
+  s->base_table = NULL;
+
   /*
    * IPv4 BGP and MP-BGP may be used together in one update, therefore we do not
    * add BA_NEXT_HOP in bgp_decode_attrs(), but we add it here independently for
diff --git a/proto/pipe/pipe.c b/proto/pipe/pipe.c
index 3532f114..f991d09a 100644
--- a/proto/pipe/pipe.c
+++ b/proto/pipe/pipe.c
@@ -81,7 +81,10 @@ pipe_rt_notify(struct proto *P, struct channel *src_ch, net *n, rte *new, rte *o
 #ifdef CONFIG_BGP
       /* Hack to cleanup cached value */
       if (e->attrs->src->proto->proto == &proto_bgp)
+      {
 	e->u.bgp.stale = -1;
+	e->u.bgp.base_table = NULL;
+      }
 #endif
 
       src = a->src;
-- 
cgit v1.2.3


From d0f9a77f641d44472679caf85b7bef6e13ce926a Mon Sep 17 00:00:00 2001
From: "Ondrej Zajicek (work)" <santiago@crfreenet.org>
Date: Fri, 31 Dec 2021 18:42:50 +0100
Subject: Doc: Describe routing table options

---
 doc/bird.sgml | 80 +++++++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 64 insertions(+), 16 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index d1d2bdae..4d1db33f 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -252,16 +252,9 @@ The global best route selection algorithm is (roughly) as follows:
 </itemize>
 
 <p><label id="dsc-table-sorted">Usually, a routing table just chooses a selected
-route from a list of entries for one network. But if the <cf/sorted/ option is
-activated, these lists of entries are kept completely sorted (according to
-preference or some protocol-dependent metric). This is needed for some features
-of some protocols (e.g. <cf/secondary/ option of BGP protocol, which allows to
-accept not just a selected route, but the first route (in the sorted list) that
-is accepted by filters), but it is incompatible with some other features (e.g.
-<cf/deterministic med/ option of BGP protocol, which activates a way of choosing
-selected route that cannot be described using comparison and ordering). Minor
-advantage is that routes are shown sorted in <cf/show route/, minor disadvantage
-is that it is slightly more computationally expensive.
+route from a list of entries for one network. Optionally, these lists of entries
+are kept completely sorted (according to preference or some protocol-dependent
+metric). See <ref id="rtable-sorted" name="sorted"> table option for details.
 
 <sect>Routes and network types
 <label id="routes">
@@ -628,18 +621,73 @@ include "tablename.conf";;
 	<cf/protocol/ times, and the <cf/iso long ms/ format for <cf/base/ and
 	<cf/log/ times.
 
-	<tag><label id="opt-table"><m/nettype/ table <m/name/ [sorted]</tag>
-	Create a new routing table. The default routing tables <cf/master4/ and
-	<cf/master6/ are created implicitly, other routing tables have to be
-	added by this command.  Option <cf/sorted/ can be used to enable sorting
-	of routes, see <ref id="dsc-table-sorted" name="sorted table">
-	description for details.
+	<tag><label id="opt-table"><m/nettype/ table <m/name/ [ { <m/option/; [<m/.../] } ]</tag>
+	Define a new routing table. The default routing tables <cf/master4/ and
+	<cf/master6/ are defined implicitly, other routing tables have to be
+	defined by this option. See the <ref id="rtable-opts"
+	name="routing table configuration section"> for routing table options.
 
 	<tag><label id="opt-eval">eval <m/expr/</tag>
 	Evaluates given filter expression. It is used by the developers for testing of filters.
 </descrip>
 
 
+<sect>Routing table options
+<label id="rtable-opts">
+
+<p>Most routing tables do not need any options and are defined without an option
+block, but there are still some options to tweak routing table behavior. Note
+that implicit tables (<cf/master4/ and <cf/master6/) can be redefined in order
+to set options.
+
+<descrip>
+	<tag><label id="rtable-sorted">sorted <m/switch/</tag>
+	Usually, a routing table just chooses the selected (best) route from a
+	list of routes for each network, while keeping remaining routes unsorted.
+	If enabled, these lists of routes are kept completely sorted (according
+	to preference or some protocol-dependent metric).
+
+	This is needed for some protocol features (e.g. <cf/secondary/ option of
+	BGP protocol, which allows to accept not just a selected route, but the
+	first route (in the sorted list) that is accepted by filters), but it is
+	incompatible with some other features (e.g. <cf/deterministic med/
+	option of BGP protocol, which activates a way of choosing selected route
+	that cannot be described using comparison and ordering). Minor advantage
+	is that routes are shown sorted in <cf/show route/, minor disadvantage
+	is that it is slightly more computationally expensive. Default: off.
+
+	<tag><label id="rtable-trie">trie <m/switch/</tag>
+	BIRD routing tables are implemented with hash tables, which is efficient
+	for exact-match lookups, but inconvenient for longest-match lookups or
+	interval lookups (finding superprefix or subprefixes). This option
+	activates additional trie structure that is used to accelerate these
+	lookups, while using the hash table for exact-match lookups.
+
+	This has advantage for <ref id="rpki" name="RPKI"> (on ROA tables),
+	for <ref id="bgp-gateway" name="recursive next-hops"> (on IGP tables),
+	and is required for <ref id="bgp-validate" name="flowspec validation">
+	(on base IP tables). Another advantage is that interval results (like
+	from <cf/show route in .../ command) are lexicographically sorted. The
+	disadvantage is that trie-enabled routing tables require more memory,
+	which may be an issue especially in multi-table setups. Default: off.
+
+	<tag><label id="rtable-min-settle-time">min settle time <m/time/</tag>
+	Specify a minimum value of the settle time. When a ROA table changes,
+	automatic <ref id="proto-rpki-reload" name="RPKI reload"> may be
+	triggered, after a short settle time. Minimum settle time is a delay
+	from the last ROA table change to wait for more updates. Default: 1 s.
+
+
+	<tag><label id="rtable-max-settle-time">max settle time <m/time/</tag>
+	Specify a maximum value of the settle time. When a ROA table changes,
+	automatic <ref id="proto-rpki-reload" name="RPKI reload"> may be
+	triggered, after a short settle time. Maximum settle time is an upper
+	limit to the settle time from the initial ROA table change even if
+	there are consecutive updates gradually renewing the settle time.
+	Default: 20 s.
+</descrip>
+
+
 <sect>Protocol options
 <label id="protocol-opts">
 
-- 
cgit v1.2.3


From 9b13fa4d9c3cd8894f61ed84a38ef3c69fe4fe6f Mon Sep 17 00:00:00 2001
From: Ondrej Filip <feela@network.cz>
Date: Sun, 20 Feb 2022 14:28:06 +0100
Subject: Small changes related to the new release

---
 doc/bird.sgml      | 9 ++++-----
 doc/prog-head.sgml | 2 +-
 tools/gendist      | 3 +--
 tools/linuxdoc     | 3 ++-
 4 files changed, 8 insertions(+), 9 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 6d9847dc..1d5ae056 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -14,7 +14,7 @@ configuration - something in config which is not keyword.
 
     (set-fill-column 80)
 
-    Copyright 1999,2000 Pavel Machek <pavel@ucw.cz>, distribute under GPL version 2 or later.
+    Copyright 1999 - 2022 CZ.NIC, z.s.p.o , distribute under GPL version 2 or later.
 
  -->
 
@@ -23,7 +23,6 @@ configuration - something in config which is not keyword.
 <title>BIRD 2.0 User's Guide
 <author>
 Ondrej Filip <it/&lt;feela@network.cz&gt;/,
-Pavel Machek <it/&lt;pavel@ucw.cz&gt;/,
 Martin Mares <it/&lt;mj@ucw.cz&gt;/,
 Maria Matejka <it/&lt;mq@jmq.cz&gt;/,
 Ondrej Zajicek <it/&lt;santiago@crfreenet.org&gt;/
@@ -5436,15 +5435,15 @@ name="atrey.karlin.mff.cuni.cz:/pub/rfc">).
 </book>
 
 <!--
-LocalWords:  GPL IPv GateD BGPv RIPv OSPFv Linux sgml html dvi sgmltools Pavel
+LocalWords:  GPL IPv GateD BGPv RIPv OSPFv Linux sgml html dvi sgmltools
 LocalWords:  linuxdoc dtd descrip config conf syslog stderr auth ospf bgp Mbps
 LocalWords:  router's eval expr num birdc ctl UNIX if's enums bool int ip GCC
 LocalWords:  len ipaddress pxlen netmask enum bgppath bgpmask clist gw md eth
-LocalWords:  RTS printn quitbird iBGP AS'es eBGP RFC multiprotocol IGP Machek
+LocalWords:  RTS printn quitbird iBGP AS'es eBGP RFC multiprotocol IGP
 LocalWords:  EGP misconfigurations keepalive pref aggr aggregator BIRD's RTC
 LocalWords:  OS'es AS's multicast nolisten misconfigured UID blackhole MRTD MTU
 LocalWords:  uninstalls ethernets IP binutils ANYCAST anycast dest RTD ICMP rfc
 LocalWords:  compat multicasts nonbroadcast pointopoint loopback sym stats
 LocalWords:  Perl SIGHUP dd mm yy HH MM SS EXT IA UNICAST multihop Discriminator txt
-LocalWords:  proto wildcard Ondrej Filip
+LocalWords:  proto wildcard
 -->
diff --git a/doc/prog-head.sgml b/doc/prog-head.sgml
index 0eec367e..4daca3a3 100644
--- a/doc/prog-head.sgml
+++ b/doc/prog-head.sgml
@@ -12,9 +12,9 @@
 <title>BIRD Programmer's Documentation
 <author>
 Ondrej Filip <it/&lt;feela@network.cz&gt;/,
-Pavel Machek <it/&lt;pavel@ucw.cz&gt;/,
 Martin Mares <it/&lt;mj@ucw.cz&gt;/,
 Ondrej Zajicek <it/&lt;santiago@crfreenet.org&gt;/
+Maria Matejka <it/&lt;mq@jmq.cz&gt;/,
 </author>
 
 <abstract>
diff --git a/tools/gendist b/tools/gendist
index 2ac59030..2dc42ba9 100755
--- a/tools/gendist
+++ b/tools/gendist
@@ -2,6 +2,7 @@
 #
 #  Generate BIRD Distribution Archive
 #  (c) 2000--2004 Martin Mares <mj@ucw.cz>
+#  (c) 2005--2022 Ondrej Filip <feela@network.cz>
 #
 
 VERSION=`grep 'BIRD_VERSION \"' sysdep/config.h | sed '/BIRD_VERSION/!d;s/^.*"\(.*\)"$/\1/'`
@@ -33,8 +34,6 @@ rm -rf `find $T/$REL -name CVS -o -name tmp` $T/$REL/{misc,rfc,doc/slides,doc/sl
 rm -rf $T/$REL $T/$DREL
 echo -n "OK? "
 read OK
-echo Uploading to Atrey...
-scp $T/$REL.tar.gz $T/$DREL.tar.gz atrey.karlin.mff.cuni.cz:~ftp/pub/bird/
 echo Uploading to Trubka...
 scp $T/$REL.tar.gz $T/$DREL.tar.gz bird.network.cz:~ftp/pub/bird/
 echo Done.
diff --git a/tools/linuxdoc b/tools/linuxdoc
index 51110e79..045aa93b 100755
--- a/tools/linuxdoc
+++ b/tools/linuxdoc
@@ -25,7 +25,8 @@ use FindBin;
 $prefix             = "/usr";
 $isoentities_prefix = "/usr";
 $DataDir            = "$FindBin::Bin/../doc/sbase";
-$AuxBinDir          = "/usr/lib/linuxdoc-tools";
+#$AuxBinDir          = "/usr/lib/linuxdoc-tools";
+$AuxBinDir          = "/usr/bin";
 
 use lib "$FindBin::Bin/linuxdoc-tools";
 
-- 
cgit v1.2.3


From 692055e3df6cc9f0d428d3b0dd8cdd8e825eb6f4 Mon Sep 17 00:00:00 2001
From: "Ondrej Zajicek (work)" <santiago@crfreenet.org>
Date: Thu, 7 Apr 2022 19:33:40 +0200
Subject: BFD: Add 'strict bind' option

Add BFD protocol option 'strict bind' to use separate listening socket
for each BFD interface bound to its address instead of using shared
listening sockets.
---
 doc/bird.sgml       |  7 +++++++
 proto/bfd/bfd.c     | 31 ++++++++++++++++++++++---------
 proto/bfd/bfd.h     |  3 +++
 proto/bfd/config.Y  |  4 +++-
 proto/bfd/packets.c | 36 +++++++++++++++++++++++++++++++++++-
 5 files changed, 70 insertions(+), 11 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 1d5ae056..9c4a6f68 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -2153,6 +2153,13 @@ protocol bfd [&lt;name&gt;] {
 	to configure separate BFD protocol instances for IPv4 and for IPv6
 	sessions.
 
+	<tag><label id="bfd-strict-bind">strict bind <m/switch/</tag>
+	Specify whether each BFD interface should use a separate listening
+	socket bound to its local address, or just use a shared listening socket
+	accepting all addresses. Binding to a specific address could be useful
+	in cases like running multiple BIRD instances on a machine, each
+	handling a different set of interfaces. Default: disabled.
+
 	<tag><label id="bfd-iface">interface <m/pattern/ [, <m/.../] { <m/options/ }</tag>
 	Interface definitions allow to specify options for sessions associated
 	with such interfaces and also may contain interface specific options.
diff --git a/proto/bfd/bfd.c b/proto/bfd/bfd.c
index dac184c5..cc941695 100644
--- a/proto/bfd/bfd.c
+++ b/proto/bfd/bfd.c
@@ -582,6 +582,9 @@ bfd_get_iface(struct bfd_proto *p, ip_addr local, struct iface *iface)
   ifa->sk = bfd_open_tx_sk(p, local, iface);
   ifa->uc = 1;
 
+  if (cf->strict_bind)
+    ifa->rx = bfd_open_rx_sk_bound(p, local, iface);
+
   add_tail(&p->iface_list, &ifa->n);
 
   return ifa;
@@ -599,6 +602,12 @@ bfd_free_iface(struct bfd_iface *ifa)
     rfree(ifa->sk);
   }
 
+  if (ifa->rx)
+  {
+    sk_stop(ifa->rx);
+    rfree(ifa->rx);
+  }
+
   rem_node(&ifa->n);
   mb_free(ifa);
 }
@@ -1038,17 +1047,20 @@ bfd_start(struct proto *P)
 
   birdloop_enter(p->loop);
 
-  if (cf->accept_ipv4 && cf->accept_direct)
-    p->rx4_1 = bfd_open_rx_sk(p, 0, SK_IPV4);
+  if (!cf->strict_bind)
+  {
+    if (cf->accept_ipv4 && cf->accept_direct)
+      p->rx4_1 = bfd_open_rx_sk(p, 0, SK_IPV4);
 
-  if (cf->accept_ipv4 && cf->accept_multihop)
-    p->rx4_m = bfd_open_rx_sk(p, 1, SK_IPV4);
+    if (cf->accept_ipv4 && cf->accept_multihop)
+      p->rx4_m = bfd_open_rx_sk(p, 1, SK_IPV4);
 
-  if (cf->accept_ipv6 && cf->accept_direct)
-    p->rx6_1 = bfd_open_rx_sk(p, 0, SK_IPV6);
+    if (cf->accept_ipv6 && cf->accept_direct)
+      p->rx6_1 = bfd_open_rx_sk(p, 0, SK_IPV6);
 
-  if (cf->accept_ipv6 && cf->accept_multihop)
-    p->rx6_m = bfd_open_rx_sk(p, 1, SK_IPV6);
+    if (cf->accept_ipv6 && cf->accept_multihop)
+      p->rx6_m = bfd_open_rx_sk(p, 1, SK_IPV6);
+  }
 
   birdloop_leave(p->loop);
 
@@ -1102,7 +1114,8 @@ bfd_reconfigure(struct proto *P, struct proto_config *c)
   if ((new->accept_ipv4 != old->accept_ipv4) ||
       (new->accept_ipv6 != old->accept_ipv6) ||
       (new->accept_direct != old->accept_direct) ||
-      (new->accept_multihop != old->accept_multihop))
+      (new->accept_multihop != old->accept_multihop) ||
+      (new->strict_bind != old->strict_bind))
     return 0;
 
   birdloop_mask_wakeups(p->loop);
diff --git a/proto/bfd/bfd.h b/proto/bfd/bfd.h
index 91fdaa60..7caf9f66 100644
--- a/proto/bfd/bfd.h
+++ b/proto/bfd/bfd.h
@@ -47,6 +47,7 @@ struct bfd_config
   u8 accept_ipv6;
   u8 accept_direct;
   u8 accept_multihop;
+  u8 strict_bind;
 };
 
 struct bfd_iface_config
@@ -116,6 +117,7 @@ struct bfd_iface
   struct bfd_proto *bfd;
 
   sock *sk;
+  sock *rx;
   u32 uc;
   u8 changed;
 };
@@ -221,6 +223,7 @@ void bfd_show_sessions(struct proto *P);
 /* packets.c */
 void bfd_send_ctl(struct bfd_proto *p, struct bfd_session *s, int final);
 sock * bfd_open_rx_sk(struct bfd_proto *p, int multihop, int inet_version);
+sock * bfd_open_rx_sk_bound(struct bfd_proto *p, ip_addr local, struct iface *ifa);
 sock * bfd_open_tx_sk(struct bfd_proto *p, ip_addr local, struct iface *ifa);
 
 
diff --git a/proto/bfd/config.Y b/proto/bfd/config.Y
index df1cba42..70461872 100644
--- a/proto/bfd/config.Y
+++ b/proto/bfd/config.Y
@@ -23,7 +23,8 @@ CF_DECLS
 
 CF_KEYWORDS(BFD, MIN, IDLE, RX, TX, INTERVAL, MULTIPLIER, PASSIVE,
 	INTERFACE, MULTIHOP, NEIGHBOR, DEV, LOCAL, AUTHENTICATION,
-	NONE, SIMPLE, METICULOUS, KEYED, MD5, SHA1, IPV4, IPV6, DIRECT)
+	NONE, SIMPLE, METICULOUS, KEYED, MD5, SHA1, IPV4, IPV6, DIRECT,
+	STRICT, BIND)
 
 %type <iface> bfd_neigh_iface
 %type <a> bfd_neigh_local
@@ -48,6 +49,7 @@ bfd_proto_item:
  | INTERFACE bfd_iface
  | MULTIHOP bfd_multihop
  | NEIGHBOR bfd_neighbor
+ | STRICT BIND bool { BFD_CFG->strict_bind = $3; }
  ;
 
 bfd_proto_opts:
diff --git a/proto/bfd/packets.c b/proto/bfd/packets.c
index 7618e20f..5f10734c 100644
--- a/proto/bfd/packets.c
+++ b/proto/bfd/packets.c
@@ -366,7 +366,9 @@ bfd_rx_hook(sock *sk, uint len)
     if (ps > BFD_STATE_DOWN)
       DROP("invalid init state", ps);
 
-    uint ifindex = (sk->sport == BFD_CONTROL_PORT) ? sk->lifindex : 0;
+    uint ifindex = (sk->sport == BFD_CONTROL_PORT) ?
+      (sk->iface ? sk->iface->index : sk->lifindex) :
+      0;
     s = bfd_find_session_by_addr(p, sk->faddr, ifindex);
 
     /* FIXME: better session matching and message */
@@ -438,6 +440,38 @@ bfd_open_rx_sk(struct bfd_proto *p, int multihop, int af)
   return NULL;
 }
 
+sock *
+bfd_open_rx_sk_bound(struct bfd_proto *p, ip_addr local, struct iface *ifa)
+{
+  sock *sk = sk_new(p->tpool);
+  sk->type = SK_UDP;
+  sk->saddr = local;
+  sk->sport = ifa ? BFD_CONTROL_PORT : BFD_MULTI_CTL_PORT;
+  sk->iface = ifa;
+  sk->vrf = p->p.vrf;
+  sk->data = p;
+
+  sk->rbsize = BFD_MAX_LEN;
+  sk->rx_hook = bfd_rx_hook;
+  sk->err_hook = bfd_err_hook;
+
+  /* TODO: configurable ToS and priority */
+  sk->tos = IP_PREC_INTERNET_CONTROL;
+  sk->priority = sk_priority_control;
+  sk->flags = SKF_THREAD | SKF_BIND | (ifa ? SKF_TTL_RX : 0);
+
+  if (sk_open(sk) < 0)
+    goto err;
+
+  sk_start(sk);
+  return sk;
+
+ err:
+  sk_log_error(sk, p->p.name);
+  rfree(sk);
+  return NULL;
+}
+
 sock *
 bfd_open_tx_sk(struct bfd_proto *p, ip_addr local, struct iface *ifa)
 {
-- 
cgit v1.2.3


From 207ac4853316ceffa6d56ff06f8904320d3bf45f Mon Sep 17 00:00:00 2001
From: Vincent Bernat <vincent@bernat.ch>
Date: Fri, 22 Apr 2022 17:06:27 +0200
Subject: Doc: fix mating -> matching in flowspec section

---
 doc/bird.sgml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 9c4a6f68..1580facd 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -5251,7 +5251,7 @@ Note that for negated matches, value must be either zero or equal to bitmask
 	<cf>port 1..1023,1194,3306</cf>).
 
 	<tag><label id="flow-dport">dport <m/numbers-match/</tag>
-	Set a mating destination port numbers (e.g. <cf>dport 49151</cf>).
+	Set a matching destination port numbers (e.g. <cf>dport 49151</cf>).
 
 	<tag><label id="flow-sport">sport <m/numbers-match/</tag>
 	Set a matching source port numbers (e.g. <cf>sport = 0</cf>).
-- 
cgit v1.2.3


From 337c04c45e1472d6d9b531a3c55f1f2d30ebf308 Mon Sep 17 00:00:00 2001
From: Maria Matejka <mq@ucw.cz>
Date: Wed, 20 Apr 2022 12:24:26 +0200
Subject: Moved route preference to eattrs

---
 doc/bird.sgml         |  3 +--
 filter/config.Y       |  2 --
 filter/data.h         |  1 -
 filter/f-inst.c       |  5 -----
 lib/route.h           | 24 +++++++++++++++++-------
 nest/rt-attr.c        | 11 ++++++++---
 nest/rt-dev.c         |  3 ++-
 nest/rt-show.c        |  2 +-
 nest/rt-table.c       |  9 ++++++---
 nest/rt.h             |  1 +
 proto/babel/babel.c   | 12 +++++++-----
 proto/bgp/attrs.c     |  6 +++---
 proto/bgp/packets.c   |  2 +-
 proto/ospf/ospf.c     |  2 +-
 proto/ospf/rt.c       |  6 ++++--
 proto/perf/perf.c     |  3 ++-
 proto/rip/rip.c       |  8 ++++----
 proto/rpki/rpki.c     |  3 ++-
 proto/static/static.c |  7 ++++---
 sysdep/unix/krt.c     |  2 +-
 20 files changed, 65 insertions(+), 47 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 4df1d94f..a71624aa 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -1732,8 +1732,7 @@ Common route attributes are:
 	default value for new routes is <cf/SCOPE_UNIVERSE/.
 
 	<tag><label id="rta-preference"><m/int/ preference</tag>
-	Preference of the route. Valid values are 0-65535. (See the chapter
-	about routing tables.)
+	Preference of the route.
 
 	<tag><label id="rta-from"><m/ip/ from</tag>
 	The router which the route has originated from.
diff --git a/filter/config.Y b/filter/config.Y
index f21f1c8e..dcfae788 100644
--- a/filter/config.Y
+++ b/filter/config.Y
@@ -286,7 +286,6 @@ CF_KEYWORDS(FUNCTION, PRINT, PRINTN, UNSET, RETURN,
 	IF, THEN, ELSE, CASE,
 	TRUE, FALSE, RT, RO, UNKNOWN, GENERIC,
 	FROM, GW, NET, MASK, PROTO, SOURCE, SCOPE, DEST, IFNAME, IFINDEX, WEIGHT, GW_MPLS,
-	PREFERENCE,
 	ROA_CHECK, ASN, SRC, DST,
 	IS_V4, IS_V6,
 	LEN, MAXLEN,
@@ -773,7 +772,6 @@ static_attr:
  | IFNAME  { $$ = f_new_static_attr(T_STRING,     SA_IFNAME,	0); }
  | IFINDEX { $$ = f_new_static_attr(T_INT,        SA_IFINDEX,	1); }
  | WEIGHT  { $$ = f_new_static_attr(T_INT,        SA_WEIGHT,	0); }
- | PREFERENCE { $$ = f_new_static_attr(T_INT,	  SA_PREF,	0); }
  | GW_MPLS { $$ = f_new_static_attr(T_INT,        SA_GW_MPLS,	0); }
  ;
 
diff --git a/filter/data.h b/filter/data.h
index 4d2622ab..0e25ccd9 100644
--- a/filter/data.h
+++ b/filter/data.h
@@ -32,7 +32,6 @@ enum f_sa_code {
   SA_IFNAME,
   SA_IFINDEX,
   SA_WEIGHT,
-  SA_PREF,
   SA_GW_MPLS,
 } PACKED;
 
diff --git a/filter/f-inst.c b/filter/f-inst.c
index c5947955..9530d9ad 100644
--- a/filter/f-inst.c
+++ b/filter/f-inst.c
@@ -543,7 +543,6 @@
       case SA_IFNAME:	RESULT(sa.type, s, rta->nh.iface ? rta->nh.iface->name : ""); break;
       case SA_IFINDEX:	RESULT(sa.type, i, rta->nh.iface ? rta->nh.iface->index : 0); break;
       case SA_WEIGHT:	RESULT(sa.type, i, rta->nh.weight + 1); break;
-      case SA_PREF:	RESULT(sa.type, i, rta->pref); break;
       case SA_GW_MPLS:	RESULT(sa.type, i, rta->nh.labels ? rta->nh.label[0] : MPLS_NULL); break;
 
       default:
@@ -648,10 +647,6 @@
         }
 	break;
 
-      case SA_PREF:
-	rta->pref = v1.val.i;
-	break;
-
       default:
 	bug("Invalid static attribute access (%u/%u)", sa.type, sa.sa_code);
       }
diff --git a/lib/route.h b/lib/route.h
index 3b368696..be72bb16 100644
--- a/lib/route.h
+++ b/lib/route.h
@@ -89,7 +89,6 @@ typedef struct rta {
   u16 source:7;				/* Route source (RTS_...) */
   u16 scope:4;				/* Route scope (SCOPE_... -- see ip.h) */
   u16 dest:4;				/* Route destination type (RTD_...) */
-  word pref;
   struct nexthop nh;			/* Next hop */
 } rta;
 
@@ -181,10 +180,6 @@ struct ea_class_ref {
   struct ea_class *class;
 };
 
-#define IGP_METRIC_UNKNOWN 0x80000000	/* Default igp_metric used when no other
-					   protocol-specific metric is availabe */
-extern struct ea_class ea_gen_igp_metric;
-
 void ea_register_init(struct ea_class *);
 struct ea_class_ref *ea_register_alloc(pool *, struct ea_class);
 
@@ -290,6 +285,23 @@ static inline void
 ea_set_attr_data(ea_list **to, const struct ea_class *def, uint flags, void *data, uint len)
 { ea_set_attr(to, EA_LITERAL_STORE_ADATA(def, flags, data, len)); }
 
+/*
+ *	Common route attributes
+ */
+
+/* Preference: first-order comparison */
+extern struct ea_class ea_gen_preference;
+static inline u32 rt_get_preference(rte *rt)
+{ return ea_get_int(rt->attrs->eattrs, &ea_gen_preference, 0); }
+
+/* IGP metric: second-order comparison */
+extern struct ea_class ea_gen_igp_metric;
+u32 rt_get_igp_metric(rte *rt);
+#define IGP_METRIC_UNKNOWN 0x80000000	/* Default igp_metric used when no other
+					   protocol-specific metric is availabe */
+
+
+/* Next hop structures */
 
 #define NEXTHOP_MAX_SIZE (sizeof(struct nexthop) + sizeof(u32)*MPLS_MAX_LABEL_STACK)
 
@@ -319,6 +331,4 @@ void rta_dump(rta *);
 void rta_dump_all(void);
 void rta_show(struct cli *, rta *);
 
-u32 rt_get_igp_metric(rte *rt);
-
 #endif
diff --git a/nest/rt-attr.c b/nest/rt-attr.c
index 6bb27623..e5d87b53 100644
--- a/nest/rt-attr.c
+++ b/nest/rt-attr.c
@@ -65,6 +65,11 @@ struct ea_class ea_gen_igp_metric = {
   .type = T_INT,
 };
 
+struct ea_class ea_gen_preference = {
+  .name = "preference",
+  .type = T_INT,
+};
+
 const char * const rta_src_names[RTS_MAX] = {
   [RTS_STATIC]		= "static",
   [RTS_INHERIT]		= "inherit",
@@ -1228,7 +1233,6 @@ rta_hash(rta *a)
   BMIX(source);
   BMIX(scope);
   BMIX(dest);
-  MIX(pref);
 #undef MIX
 
   return mem_hash_value(&h) ^ nexthop_hash(&(a->nh)) ^ ea_hash(a->eattrs);
@@ -1389,8 +1393,8 @@ rta_dump(rta *a)
 			 "RTS_OSPF_EXT2", "RTS_BGP", "RTS_PIPE", "RTS_BABEL" };
   static char *rtd[] = { "", " DEV", " HOLE", " UNREACH", " PROHIBIT" };
 
-  debug("pref=%d uc=%d %s %s%s h=%04x",
-	a->pref, a->uc, rts[a->source], ip_scope_text(a->scope),
+  debug("uc=%d %s %s%s h=%04x",
+	a->uc, rts[a->source], ip_scope_text(a->scope),
 	rtd[a->dest], a->hash_key);
   if (!a->cached)
     debug(" !CACHED");
@@ -1469,6 +1473,7 @@ rta_init(void)
   rte_src_init();
   ea_class_init();
 
+  ea_register_init(&ea_gen_preference);
   ea_register_init(&ea_gen_igp_metric);
 }
 
diff --git a/nest/rt-dev.c b/nest/rt-dev.c
index bdf8584d..696b37b8 100644
--- a/nest/rt-dev.c
+++ b/nest/rt-dev.c
@@ -83,13 +83,14 @@ dev_ifa_notify(struct proto *P, uint flags, struct ifa *ad)
       struct rte_src *src = rt_get_source(P, ad->iface->index);
 
       rta a0 = {
-	.pref = c->preference,
 	.source = RTS_DEVICE,
 	.scope = SCOPE_UNIVERSE,
 	.dest = RTD_UNICAST,
 	.nh.iface = ad->iface,
       };
 
+      ea_set_attr_u32(&a0.eattrs, &ea_gen_preference, 0, c->preference);
+
       a = rta_lookup(&a0);
       e = rte_get_temp(a, src);
       e->pflags = 0;
diff --git a/nest/rt-show.c b/nest/rt-show.c
index 7d02f52e..1c764d8c 100644
--- a/nest/rt-show.c
+++ b/nest/rt-show.c
@@ -61,7 +61,7 @@ rt_show_rte(struct cli *c, byte *ia, rte *e, struct rt_show_data *d, int primary
   if (get_route_info)
     get_route_info(e, info);
   else
-    bsprintf(info, " (%d)", a->pref);
+    bsprintf(info, " (%d)", rt_get_preference(e));
 
   if (d->last_table != d->tab)
     rt_show_table(c, d);
diff --git a/nest/rt-table.c b/nest/rt-table.c
index 01194e02..919576bd 100644
--- a/nest/rt-table.c
+++ b/nest/rt-table.c
@@ -652,9 +652,12 @@ rte_better(rte *new, rte *old)
   if (!rte_is_valid(new))
     return 0;
 
-  if (new->attrs->pref > old->attrs->pref)
+  u32 np = rt_get_preference(new);
+  u32 op = rt_get_preference(old);
+
+  if (np > op)
     return 1;
-  if (new->attrs->pref < old->attrs->pref)
+  if (np < op)
     return 0;
   if (new->src->proto->proto != old->src->proto->proto)
     {
@@ -678,7 +681,7 @@ rte_mergable(rte *pri, rte *sec)
   if (!rte_is_valid(pri) || !rte_is_valid(sec))
     return 0;
 
-  if (pri->attrs->pref != sec->attrs->pref)
+  if (rt_get_preference(pri) != rt_get_preference(sec))
     return 0;
 
   if (pri->src->proto->proto != sec->src->proto->proto)
diff --git a/nest/rt.h b/nest/rt.h
index 7451a261..6bd9cd38 100644
--- a/nest/rt.h
+++ b/nest/rt.h
@@ -329,6 +329,7 @@ int rt_flowspec_check(rtable *tab_ip, rtable *tab_flow, const net_addr *n, rta *
 #define DEF_PREF_BGP		100	/* BGP */
 #define DEF_PREF_RPKI		100	/* RPKI */
 #define DEF_PREF_INHERITED	10	/* Routes inherited from other routing daemons */
+#define DEF_PREF_UNKNOWN	0	/* Routes with no preference set */
 
 /*
  *	Route Origin Authorization
diff --git a/proto/babel/babel.c b/proto/babel/babel.c
index 97dca4ac..afd0b1e1 100644
--- a/proto/babel/babel.c
+++ b/proto/babel/babel.c
@@ -645,10 +645,11 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
   {
     struct {
       ea_list l;
-      eattr a[3];
+      eattr a[4];
     } eattrs = {
-      .l.count = 3,
+      .l.count = ARRAY_SIZE(eattrs.a),
       .a = {
+	EA_LITERAL_EMBEDDED(&ea_gen_preference, 0, c->preference),
 	EA_LITERAL_EMBEDDED(&ea_babel_metric, 0, r->metric),
 	EA_LITERAL_STORE_ADATA(&ea_babel_router_id, 0, &r->router_id, sizeof(r->router_id)),
 	EA_LITERAL_EMBEDDED(&ea_babel_seqno, 0, r->seqno),
@@ -659,7 +660,6 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
       .source = RTS_BABEL,
       .scope = SCOPE_UNIVERSE,
       .dest = RTD_UNICAST,
-      .pref = c->preference,
       .from = r->neigh->addr,
       .nh.gw = r->next_hop,
       .nh.iface = r->neigh->ifa->iface,
@@ -687,9 +687,10 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
       .source = RTS_BABEL,
       .scope = SCOPE_UNIVERSE,
       .dest = RTD_UNREACHABLE,
-      .pref = 1,
     };
 
+    ea_set_attr_u32(&a0.eattrs, &ea_gen_preference, 0, 1);
+
     rta *a = rta_lookup(&a0);
     rte *rte = rte_get_temp(a, p->p.main_source);
     rte->pflags = 0;
@@ -2025,7 +2026,8 @@ babel_get_route_info(rte *rte, byte *buf)
   if (e)
     memcpy(&rid, e->u.ptr->data, sizeof(u64));
 
-  buf += bsprintf(buf, " (%d/%d) [%lR]", rte->attrs->pref,
+  buf += bsprintf(buf, " (%d/%d) [%lR]",
+      rt_get_preference(rte),
       ea_get_int(rte->attrs->eattrs, &ea_babel_metric, BABEL_INFINITY), rid);
 }
 
diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c
index 597cf96c..097ba9a2 100644
--- a/proto/bgp/attrs.c
+++ b/proto/bgp/attrs.c
@@ -2169,7 +2169,7 @@ bgp_rte_mergable(rte *pri, rte *sec)
 static inline int
 same_group(rte *r, u32 lpref, u32 lasn)
 {
-  return (r->attrs->pref == lpref) && (bgp_get_neighbor(r) == lasn);
+  return (rt_get_preference(r) == lpref) && (bgp_get_neighbor(r) == lasn);
 }
 
 static inline int
@@ -2184,7 +2184,7 @@ bgp_rte_recalculate(rtable *table, net *net, rte *new, rte *old, rte *old_best)
 {
   rte *r, *s;
   rte *key = new ? new : old;
-  u32 lpref = key->attrs->pref;
+  u32 lpref = rt_get_preference(key);
   u32 lasn = bgp_get_neighbor(key);
   int old_suppressed = old ? !!(old->pflags & BGP_REF_SUPPRESSED) : 0;
 
@@ -2381,7 +2381,7 @@ bgp_get_route_info(rte *e, byte *buf)
   eattr *o = ea_find(e->attrs->eattrs, BGP_EA_ID(BA_ORIGIN));
   u32 origas;
 
-  buf += bsprintf(buf, " (%d", e->attrs->pref);
+  buf += bsprintf(buf, " (%d", rt_get_preference(e));
 
   if (e->pflags & BGP_REF_SUPPRESSED)
     buf += bsprintf(buf, "-");
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 5c9bb8ba..45a4b1de 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -2478,7 +2478,7 @@ bgp_decode_nlri(struct bgp_parse_state *s, u32 afi, byte *nlri, uint len, ea_lis
     a->scope = SCOPE_UNIVERSE;
     a->from = s->proto->remote_ip;
     a->eattrs = ea;
-    a->pref = c->c.preference;
+    ea_set_attr_u32(&a->eattrs, &ea_gen_preference, 0, c->c.preference);
 
     c->desc->decode_next_hop(s, nh, nh_len, a);
     bgp_finish_attrs(s, a);
diff --git a/proto/ospf/ospf.c b/proto/ospf/ospf.c
index 66d0eba6..427c2c86 100644
--- a/proto/ospf/ospf.c
+++ b/proto/ospf/ospf.c
@@ -588,7 +588,7 @@ ospf_get_route_info(rte * rte, byte * buf)
   }
 
   buf += bsprintf(buf, " %s", type);
-  buf += bsprintf(buf, " (%d/%d", rte->attrs->pref, ea_get_int(rte->attrs->eattrs, &ea_ospf_metric1, LSINFINITY));
+  buf += bsprintf(buf, " (%d/%d", rt_get_preference(rte), ea_get_int(rte->attrs->eattrs, &ea_ospf_metric1, LSINFINITY));
   if (rte->attrs->source == RTS_OSPF_EXT2)
     buf += bsprintf(buf, "/%d", ea_get_int(rte->attrs->eattrs, &ea_ospf_metric2, LSINFINITY));
   buf += bsprintf(buf, ")");
diff --git a/proto/ospf/rt.c b/proto/ospf/rt.c
index 55bad599..3d8cf22c 100644
--- a/proto/ospf/rt.c
+++ b/proto/ospf/rt.c
@@ -2057,7 +2057,6 @@ again1:
 	.scope = SCOPE_UNIVERSE,
 	.dest = RTD_UNICAST,
 	.nh = *(nf->n.nhs),
-	.pref = p->p.main_channel->preference,
       };
 
       if (reload || ort_changed(nf, &a0))
@@ -2069,11 +2068,14 @@ again1:
 
 	struct {
 	  ea_list l;
-	  eattr a[4];
+	  eattr a[5];
 	} eattrs;
 
 	eattrs.l = (ea_list) {};
 
+	eattrs.a[eattrs.l.count++] =
+	  EA_LITERAL_EMBEDDED(&ea_gen_preference, 0, p->p.main_channel->preference);
+
 	eattrs.a[eattrs.l.count++] =
 	  EA_LITERAL_EMBEDDED(&ea_ospf_metric1, 0, nf->n.metric1);
 
diff --git a/proto/perf/perf.c b/proto/perf/perf.c
index 2978100b..7b18866c 100644
--- a/proto/perf/perf.c
+++ b/proto/perf/perf.c
@@ -146,12 +146,13 @@ perf_loop(void *data)
 	.source = RTS_PERF,
 	.scope = SCOPE_UNIVERSE,
 	.dest = RTD_UNICAST,
-	.pref = p->p.main_channel->preference,
 	.nh.iface = p->ifa->iface,
 	.nh.gw = gw,
 	.nh.weight = 1,
       };
 
+      ea_set_attr_u32(&a0.eattrs, &ea_gen_preference, 0, p->p.main_channel->preference);
+
       p->data[i].a = rta_lookup(&a0);
     }
     else
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 52a3bd2c..244bcd0a 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -152,7 +152,6 @@ rip_announce_rte(struct rip_proto *p, struct rip_entry *en)
   {
     /* Update */
     rta a0 = {
-      .pref = p->p.main_channel->preference,
       .source = RTS_RIP,
       .scope = SCOPE_UNIVERSE,
       .dest = RTD_UNICAST,
@@ -197,11 +196,12 @@ rip_announce_rte(struct rip_proto *p, struct rip_entry *en)
 
     struct {
       ea_list l;
-      eattr a[3];
+      eattr a[4];
       struct rip_iface_adata riad;
     } ea_block = {
-      .l.count = 3,
+      .l.count = ARRAY_SIZE(ea_block.a),
       .a = {
+	EA_LITERAL_EMBEDDED(&ea_gen_preference, 0, p->p.main_channel->preference),
 	EA_LITERAL_EMBEDDED(&ea_rip_metric, 0, rt_metric),
 	EA_LITERAL_EMBEDDED(&ea_rip_tag, 0, rt_tag),
 	EA_LITERAL_DIRECT_ADATA(&ea_rip_from, 0, &ea_block.riad.ad),
@@ -1210,7 +1210,7 @@ rip_get_route_info(rte *rte, byte *buf)
   u32 rt_metric = ea_get_int(rte->attrs->eattrs, &ea_rip_metric, p->infinity);
   u32 rt_tag = ea_get_int(rte->attrs->eattrs, &ea_rip_tag, 0);
 
-  buf += bsprintf(buf, " (%d/%d)", rte->attrs->pref, rt_metric);
+  buf += bsprintf(buf, " (%d/%d)", rt_get_preference(rte), rt_metric);
 
   if (rt_tag)
     bsprintf(buf, " [%04x]", rt_tag);
diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c
index d4e95a83..710764e2 100644
--- a/proto/rpki/rpki.c
+++ b/proto/rpki/rpki.c
@@ -121,12 +121,13 @@ rpki_table_add_roa(struct rpki_cache *cache, struct channel *channel, const net_
   struct rpki_proto *p = cache->p;
 
   rta a0 = {
-    .pref = channel->preference,
     .source = RTS_RPKI,
     .scope = SCOPE_UNIVERSE,
     .dest = RTD_NONE,
   };
 
+  ea_set_attr_u32(&a0.eattrs, &ea_gen_preference, 0, channel->preference);
+
   rta *a = rta_lookup(&a0);
   rte *e = rte_get_temp(a, p->p.main_source);
 
diff --git a/proto/static/static.c b/proto/static/static.c
index 090ec875..d4b1c5f3 100644
--- a/proto/static/static.c
+++ b/proto/static/static.c
@@ -58,7 +58,7 @@ static_announce_rte(struct static_proto *p, struct static_route *r)
   a->source = RTS_STATIC;
   a->scope = SCOPE_UNIVERSE;
   a->dest = r->dest;
-  a->pref = p->p.main_channel->preference;
+  ea_set_attr_u32(&a->eattrs, &ea_gen_preference, 0, p->p.main_channel->preference);
 
   if (r->dest == RTD_UNICAST)
   {
@@ -712,10 +712,11 @@ static void
 static_get_route_info(rte *rte, byte *buf)
 {
   eattr *a = ea_find(rte->attrs->eattrs, &ea_gen_igp_metric);
+  u32 pref = rt_get_preference(rte);
   if (a)
-    buf += bsprintf(buf, " (%d/%u)", rte->attrs->pref, a->u.data);
+    buf += bsprintf(buf, " (%d/%u)", pref, a->u.data);
   else
-    buf += bsprintf(buf, " (%d)", rte->attrs->pref);
+    buf += bsprintf(buf, " (%d)", pref);
 }
 
 static void
diff --git a/sysdep/unix/krt.c b/sysdep/unix/krt.c
index 4da51ce2..b8e7670e 100644
--- a/sysdep/unix/krt.c
+++ b/sysdep/unix/krt.c
@@ -438,7 +438,7 @@ krt_learn_async(struct krt_proto *p, rte *e, int new)
   rte *g, **gg, *best, **bestp, *old_best;
 
   ASSERT(!e->attrs->cached);
-  e->attrs->pref = p->p.main_channel->preference;
+  ea_set_attr_u32(&e->attrs->eattrs, &ea_gen_preference, 0, p->p.main_channel->preference);
 
   e->attrs = rta_lookup(e->attrs);
 
-- 
cgit v1.2.3


From 702c04fbef222e802ca4dfac645dc75ede522db6 Mon Sep 17 00:00:00 2001
From: Maria Matejka <mq@ucw.cz>
Date: Wed, 4 May 2022 12:41:54 +0200
Subject: Removing the route scope attribute. Use custom attributes instead.

The route scope attribute was used for simple user route marking. As
there is a better tool for this (custom attributes), the old and limited
way can be dropped.
---
 doc/bird.sgml          | 8 --------
 filter/config.Y        | 1 -
 filter/data.h          | 1 -
 filter/f-inst.c        | 5 -----
 filter/test.conf2      | 6 ------
 lib/route.h            | 1 -
 nest/rt-attr.c         | 8 +++-----
 nest/rt-dev.c          | 1 -
 proto/babel/babel.c    | 2 --
 proto/bgp/packets.c    | 1 -
 proto/ospf/rt.c        | 1 -
 proto/perf/perf.c      | 1 -
 proto/rip/rip.c        | 1 -
 proto/rpki/rpki.c      | 1 -
 proto/static/static.c  | 1 -
 sysdep/bsd/krt-sock.c  | 1 -
 sysdep/linux/netlink.c | 1 -
 17 files changed, 3 insertions(+), 38 deletions(-)

(limited to 'doc')

diff --git a/doc/bird.sgml b/doc/bird.sgml
index a71624aa..aa058b37 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -1723,14 +1723,6 @@ Common route attributes are:
 	primary key of the routing table. Read-only. (See the <ref id="routes"
 	name="chapter about routes">.)
 
-	<tag><label id="rta-scope"><m/enum/ scope</tag>
-	The scope of the route. Possible values: <cf/SCOPE_HOST/ for routes
-	local to this host, <cf/SCOPE_LINK/ for those specific for a physical
-	link, <cf/SCOPE_SITE/ and <cf/SCOPE_ORGANIZATION/ for private routes and
-	<cf/SCOPE_UNIVERSE/ for globally visible routes. This attribute is not
-	interpreted by BIRD and can be used to mark routes in filters. The
-	default value for new routes is <cf/SCOPE_UNIVERSE/.
-
 	<tag><label id="rta-preference"><m/int/ preference</tag>
 	Preference of the route.
 
diff --git a/filter/config.Y b/filter/config.Y
index 7dcdb779..6af39c10 100644
--- a/filter/config.Y
+++ b/filter/config.Y
@@ -766,7 +766,6 @@ static_attr:
  | NET     { $$ = f_new_static_attr(T_NET,	  SA_NET,	1); }
  | PROTO   { $$ = f_new_static_attr(T_STRING,     SA_PROTO,	1); }
  | SOURCE  { $$ = f_new_static_attr(T_ENUM_RTS,   SA_SOURCE,	1); }
- | SCOPE   { $$ = f_new_static_attr(T_ENUM_SCOPE, SA_SCOPE,	0); }
  | DEST    { $$ = f_new_static_attr(T_ENUM_RTD,   SA_DEST,	0); }
  | IFNAME  { $$ = f_new_static_attr(T_STRING,     SA_IFNAME,	0); }
  | IFINDEX { $$ = f_new_static_attr(T_INT,        SA_IFINDEX,	1); }
diff --git a/filter/data.h b/filter/data.h
index a0a164ed..49b29499 100644
--- a/filter/data.h
+++ b/filter/data.h
@@ -26,7 +26,6 @@ enum f_sa_code {
   SA_NET,
   SA_PROTO,
   SA_SOURCE,
-  SA_SCOPE,
   SA_DEST,
   SA_IFNAME,
   SA_IFINDEX,
diff --git a/filter/f-inst.c b/filter/f-inst.c
index 7158d22e..5eacc716 100644
--- a/filter/f-inst.c
+++ b/filter/f-inst.c
@@ -537,7 +537,6 @@
       case SA_NET:	RESULT(sa.type, net, (*fs->rte)->net->n.addr); break;
       case SA_PROTO:	RESULT(sa.type, s, (*fs->rte)->src->proto->name); break;
       case SA_SOURCE:	RESULT(sa.type, i, rta->source); break;
-      case SA_SCOPE:	RESULT(sa.type, i, rta->scope); break;
       case SA_DEST:	RESULT(sa.type, i, rta->dest); break;
       case SA_IFNAME:	RESULT(sa.type, s, rta->nh.iface ? rta->nh.iface->name : ""); break;
       case SA_IFINDEX:	RESULT(sa.type, i, rta->nh.iface ? rta->nh.iface->index : 0); break;
@@ -579,10 +578,6 @@
 	}
 	break;
 
-      case SA_SCOPE:
-	rta->scope = v1.val.i;
-	break;
-
       case SA_DEST:
 	{
 	  int i = v1.val.i;
diff --git a/filter/test.conf2 b/filter/test.conf2
index e95f9563..9fc8330f 100644
--- a/filter/test.conf2
+++ b/filter/test.conf2
@@ -38,12 +38,6 @@ protocol static {
 			print from;
 			from = 1.2.3.4;
 			print from;
-			print scope;
-			scope = SCOPE_HOST;
-			print scope;
-			if !(scope ~ [ SCOPE_HOST, SCOPE_SITE ]) then {
-				print "Failed in test";
-			}
 
 			preference = 15;
 			print preference;
diff --git a/lib/route.h b/lib/route.h
index e02c63b3..40ba150d 100644
--- a/lib/route.h
+++ b/lib/route.h
@@ -86,7 +86,6 @@ typedef struct rta {
   struct hostentry *hostentry;		/* Hostentry for recursive next-hops */
   u16 cached:1;				/* Are attributes cached? */
   u16 source:7;				/* Route source (RTS_...) */
-  u16 scope:4;				/* Route scope (SCOPE_... -- see ip.h) */
   u16 dest:4;				/* Route destination type (RTD_...) */
   struct nexthop nh;			/* Next hop */
 } rta;
diff --git a/nest/rt-attr.c b/nest/rt-attr.c
index 87f54b0d..a892bfd5 100644
--- a/nest/rt-attr.c
+++ b/nest/rt-attr.c
@@ -1235,7 +1235,6 @@ rta_hash(rta *a)
 #define BMIX(f) mem_hash_mix_num(&h, a->f);
   MIX(hostentry);
   BMIX(source);
-  BMIX(scope);
   BMIX(dest);
 #undef MIX
 
@@ -1246,7 +1245,6 @@ static inline int
 rta_same(rta *x, rta *y)
 {
   return (x->source == y->source &&
-	  x->scope == y->scope &&
 	  x->dest == y->dest &&
 	  x->hostentry == y->hostentry &&
 	  nexthop_same(&(x->nh), &(y->nh)) &&
@@ -1396,8 +1394,8 @@ rta_dump(rta *a)
 			 "RTS_OSPF_EXT2", "RTS_BGP", "RTS_PIPE", "RTS_BABEL" };
   static char *rtd[] = { "", " DEV", " HOLE", " UNREACH", " PROHIBIT" };
 
-  debug("uc=%d %s %s%s h=%04x",
-	a->uc, rts[a->source], ip_scope_text(a->scope),
+  debug("uc=%d %s %s h=%04x",
+	a->uc, rts[a->source],
 	rtd[a->dest], a->hash_key);
   if (!a->cached)
     debug(" !CACHED");
@@ -1443,7 +1441,7 @@ rta_dump_all(void)
 void
 rta_show(struct cli *c, rta *a)
 {
-  cli_printf(c, -1008, "\tType: %s %s", rta_src_names[a->source], ip_scope_text(a->scope));
+  cli_printf(c, -1008, "\tType: %s", rta_src_names[a->source]);
 
   for(ea_list *eal = a->eattrs; eal; eal=eal->next)
     for(int i=0; i<eal->count; i++)
diff --git a/nest/rt-dev.c b/nest/rt-dev.c
index 696b37b8..ffd5afd5 100644
--- a/nest/rt-dev.c
+++ b/nest/rt-dev.c
@@ -84,7 +84,6 @@ dev_ifa_notify(struct proto *P, uint flags, struct ifa *ad)
 
       rta a0 = {
 	.source = RTS_DEVICE,
-	.scope = SCOPE_UNIVERSE,
 	.dest = RTD_UNICAST,
 	.nh.iface = ad->iface,
       };
diff --git a/proto/babel/babel.c b/proto/babel/babel.c
index f4503b99..cd221c7b 100644
--- a/proto/babel/babel.c
+++ b/proto/babel/babel.c
@@ -659,7 +659,6 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
 
     rta a0 = {
       .source = RTS_BABEL,
-      .scope = SCOPE_UNIVERSE,
       .dest = RTD_UNICAST,
       .nh.gw = r->next_hop,
       .nh.iface = r->neigh->ifa->iface,
@@ -685,7 +684,6 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
     /* Unreachable */
     rta a0 = {
       .source = RTS_BABEL,
-      .scope = SCOPE_UNIVERSE,
       .dest = RTD_UNREACHABLE,
     };
 
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 9760ebee..62d60e9a 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -2475,7 +2475,6 @@ bgp_decode_nlri(struct bgp_parse_state *s, u32 afi, byte *nlri, uint len, ea_lis
     a = allocz(RTA_MAX_SIZE);
 
     a->source = RTS_BGP;
-    a->scope = SCOPE_UNIVERSE;
     a->eattrs = ea;
 
     ea_set_attr_data(&a->eattrs, &ea_gen_from, 0, &s->proto->remote_ip, sizeof(ip_addr));
diff --git a/proto/ospf/rt.c b/proto/ospf/rt.c
index 3d8cf22c..ddc5b162 100644
--- a/proto/ospf/rt.c
+++ b/proto/ospf/rt.c
@@ -2054,7 +2054,6 @@ again1:
     {
       rta a0 = {
 	.source = nf->n.type,
-	.scope = SCOPE_UNIVERSE,
 	.dest = RTD_UNICAST,
 	.nh = *(nf->n.nhs),
       };
diff --git a/proto/perf/perf.c b/proto/perf/perf.c
index 7b18866c..47a2867d 100644
--- a/proto/perf/perf.c
+++ b/proto/perf/perf.c
@@ -144,7 +144,6 @@ perf_loop(void *data)
     if (!p->attrs_per_rte || !(i % p->attrs_per_rte)) {
       struct rta a0 = {
 	.source = RTS_PERF,
-	.scope = SCOPE_UNIVERSE,
 	.dest = RTD_UNICAST,
 	.nh.iface = p->ifa->iface,
 	.nh.gw = gw,
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 7c097a92..f5442606 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -153,7 +153,6 @@ rip_announce_rte(struct rip_proto *p, struct rip_entry *en)
     /* Update */
     rta a0 = {
       .source = RTS_RIP,
-      .scope = SCOPE_UNIVERSE,
       .dest = RTD_UNICAST,
     };
 
diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c
index 710764e2..af963f49 100644
--- a/proto/rpki/rpki.c
+++ b/proto/rpki/rpki.c
@@ -122,7 +122,6 @@ rpki_table_add_roa(struct rpki_cache *cache, struct channel *channel, const net_
 
   rta a0 = {
     .source = RTS_RPKI,
-    .scope = SCOPE_UNIVERSE,
     .dest = RTD_NONE,
   };
 
diff --git a/proto/static/static.c b/proto/static/static.c
index d4b1c5f3..ff833b16 100644
--- a/proto/static/static.c
+++ b/proto/static/static.c
@@ -56,7 +56,6 @@ static_announce_rte(struct static_proto *p, struct static_route *r)
   rta *a = allocz(RTA_MAX_SIZE);
   struct rte_src *src = static_get_source(p, r->index);
   a->source = RTS_STATIC;
-  a->scope = SCOPE_UNIVERSE;
   a->dest = r->dest;
   ea_set_attr_u32(&a->eattrs, &ea_gen_preference, 0, p->p.main_channel->preference);
 
diff --git a/sysdep/bsd/krt-sock.c b/sysdep/bsd/krt-sock.c
index 844b9f83..bc6b1839 100644
--- a/sysdep/bsd/krt-sock.c
+++ b/sysdep/bsd/krt-sock.c
@@ -521,7 +521,6 @@ krt_read_route(struct ks_msg *msg, struct krt_proto *p, int scan)
   rta a = {
     .src = p->p.main_source,
     .source = RTS_INHERIT,
-    .scope = SCOPE_UNIVERSE,
   };
 
   /* reject/blackhole routes have also set RTF_GATEWAY,
diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c
index 23d41b56..c506c71c 100644
--- a/sysdep/linux/netlink.c
+++ b/sysdep/linux/netlink.c
@@ -1855,7 +1855,6 @@ nl_parse_route(struct nl_parse_state *s, struct nlmsghdr *h)
 
   rta *ra = lp_allocz(s->pool, RTA_MAX_SIZE);
   ra->source = RTS_INHERIT;
-  ra->scope = SCOPE_UNIVERSE;
 
   if (a[RTA_FLOW])
     s->rta_flow = rta_get_u32(a[RTA_FLOW]);
-- 
cgit v1.2.3