Merge remote-tracking branch 'origin/mq-filter-stack'

14 files changed, 260 insertions, 225 deletions

diff --git a/nest/a-path.c b/nest/a-path.c
index 6f1c40bf..a1b7c42f 100644
--- a/nest/a-path.c
+++ b/nest/a-path.c
@@ -13,7 +13,7 @@
 #include "lib/resource.h"
 #include "lib/unaligned.h"
 #include "lib/string.h"
-#include "filter/filter.h"
+#include "filter/data.h"
 
 // static inline void put_as(byte *data, u32 as) { put_u32(data, as); }
 // static inline u32 get_as(byte *data) { return get_u32(data); }
@@ -77,10 +77,10 @@ bad:
 }
 
 int
-as_path_16to32(byte *dst, byte *src, uint len)
+as_path_16to32(byte *dst, const byte *src, uint len)
 {
   byte *dst0 = dst;
-  byte *end = src + len;
+  const byte *end = src + len;
   uint i, n;
 
   while (src < end)
@@ -101,10 +101,10 @@ as_path_16to32(byte *dst, byte *src, uint len)
 }
 
 int
-as_path_32to16(byte *dst, byte *src, uint len)
+as_path_32to16(byte *dst, const byte *src, uint len)
 {
   byte *dst0 = dst;
-  byte *end = src + len;
+  const byte *end = src + len;
   uint i, n;
 
   while (src < end)
@@ -271,13 +271,12 @@ as_path_to_old(struct linpool *pool, const struct adata *path)
 /*
  * Cut the path to the length @num, measured to the usual path metric. Note that
  * AS_CONFED_* segments have zero length and must be added if they are on edge.
- * In contrast to other as_path_* functions, @path is modified in place.
  */
-void
-as_path_cut(struct adata *path, uint num)
+struct adata *
+as_path_cut(struct linpool *pool, const struct adata *path, uint num)
 {
-  byte *pos = path->data;
-  byte *end = pos + path->length;
+  const byte *pos = path->data;
+  const byte *end = pos + path->length;
 
   while (pos < end)
   {
@@ -297,28 +296,39 @@ as_path_cut(struct adata *path, uint num)
     /* Cannot add whole segment, so try partial one and finish */
     if (num < n)
     {
+      const byte *nend = pos;
+      if (num)
+	nend += 2 + BS * num;
+
+      struct adata *res = lp_alloc_adata(pool, path->length);
+      res->length = nend - (const byte *) path->data;
+      memcpy(res->data, path->data, res->length);
+
       if (num)
       {
-	pos[1] = num;
-	pos += 2 + BS * num;
+	byte *dpos = ((byte *) res->data) + (pos - (const byte *) path->data);
+	dpos[1] = num;
       }
 
-      break;
+      return res;
     }
 
     num -= n;
     pos += 2 + BS * l;
   }
 
-  path->length = pos - path->data;
+  struct adata *res = lp_alloc_adata(pool, path->length);
+  res->length = path->length;
+  memcpy(res->data, path->data, res->length);
+  return res;
 }
 
 /*
  * Merge (concatenate) paths @p1 and @p2 and return the result.
  * In contrast to other as_path_* functions, @p1 and @p2 may be reused.
  */
-struct adata *
-as_path_merge(struct linpool *pool, struct adata *p1, struct adata *p2)
+const struct adata *
+as_path_merge(struct linpool *pool, const struct adata *p1, const struct adata *p2)
 {
   if (p1->length == 0)
     return p2;
@@ -561,7 +571,7 @@ as_path_contains(const struct adata *path, u32 as, int min)
 }
 
 int
-as_path_match_set(const struct adata *path, struct f_tree *set)
+as_path_match_set(const struct adata *path, const struct f_tree *set)
 {
   const u8 *p = path->data;
   const u8 *q = p+path->length;
@@ -574,7 +584,7 @@ as_path_match_set(const struct adata *path, struct f_tree *set)
       for (i=0; i<n; i++)
 	{
 	  struct f_val v = {T_INT, .val.i = get_as(p)};
-	  if (find_tree(set, v))
+	  if (find_tree(set, &v))
 	    return 1;
 	  p += BS;
 	}
@@ -583,8 +593,8 @@ as_path_match_set(const struct adata *path, struct f_tree *set)
   return 0;
 }
 
-struct adata *
-as_path_filter(struct linpool *pool, struct adata *path, struct f_tree *set, u32 key, int pos)
+const struct adata *
+as_path_filter(struct linpool *pool, const struct adata *path, const struct f_tree *set, u32 key, int pos)
 {
   if (!path)
     return NULL;
@@ -612,7 +622,10 @@ as_path_filter(struct linpool *pool, struct adata *path, struct f_tree *set, u32
 	  int match;
 
 	  if (set)
-	    match = !!find_tree(set, (struct f_val){T_INT, .val.i = as});
+	    {
+	      struct f_val v = {T_INT, .val.i = as};
+	      match = !!find_tree(set, &v);
+	    }
 	  else
 	    match = (as == key);
 
@@ -771,7 +784,7 @@ pm_mark(struct pm_pos *pos, int i, int plen, int *nl, int *nh)
  * is marked.
  */
 int
-as_path_match(const struct adata *path, struct f_path_mask *mask)
+as_path_match(const struct adata *path, const struct f_path_mask *mask)
 {
   struct pm_pos pos[2048 + 1];
   int plen = parse_path(path, pos);
@@ -788,12 +801,12 @@ as_path_match(const struct adata *path, struct f_path_mask *mask)
   l = h = 0;
   pos[0].mark = 1;
 
-  while (mask)
+  for (uint m=0; m < mask->len; m++)
     {
       /* We remove this mark to not step after pos[plen] */
       pos[plen].mark = 0;
 
-      switch (mask->kind)
+      switch (mask->item[m].kind)
 	{
 	case PM_ASTERISK:
 	  for (i = l; i <= plen; i++)
@@ -802,13 +815,13 @@ as_path_match(const struct adata *path, struct f_path_mask *mask)
 	  break;
 
 	case PM_ASN:	/* Define single ASN as ASN..ASN - very narrow interval */
-	  val2 = val = mask->val;
+	  val2 = val = mask->item[m].asn;
 	  goto step;
 	case PM_ASN_EXPR:
 	  bug("Expressions should be evaluated on AS path mask construction.");
 	case PM_ASN_RANGE:
-	  val = mask->val;
-	  val2 = mask->val2;
+	  val = mask->item[m].from;
+	  val2 = mask->item[m].to;
 	  goto step;
 	case PM_QUESTION:
 	step:
@@ -817,7 +830,7 @@ as_path_match(const struct adata *path, struct f_path_mask *mask)
 	    if (pos[i].mark)
 	      {
 		pos[i].mark = 0;
-		if ((mask->kind == PM_QUESTION) || pm_match(pos + i, val, val2))
+		if ((mask->item[m].kind == PM_QUESTION) || pm_match(pos + i, val, val2))
 		  pm_mark(pos, i, plen, &nl, &nh);
 	      }
 
@@ -828,8 +841,6 @@ as_path_match(const struct adata *path, struct f_path_mask *mask)
 	  l = nl;
 	  break;
 	}
-
-      mask = mask->next;
     }
 
   return pos[plen].mark;
diff --git a/nest/a-path_test.c b/nest/a-path_test.c
index a71b48ba..9ed0a786 100644
--- a/nest/a-path_test.c
+++ b/nest/a-path_test.c
@@ -34,26 +34,24 @@ t_as_path_match(void)
     first_prepended = last_prepended = 0;
     struct linpool *lp = lp_new_default(&root_pool);
 
-    struct f_path_mask mask[AS_PATH_LENGTH] = {};
-    int i;
-    for (i = 0; i < AS_PATH_LENGTH; i++)
+    struct f_path_mask *mask = alloca(sizeof(struct f_path_mask) + AS_PATH_LENGTH * sizeof(struct f_path_mask_item));
+    mask->len = AS_PATH_LENGTH;
+    for (int i = AS_PATH_LENGTH - 1; i >= 0; i--)
     {
       u32 val = bt_random();
       as_path = as_path_prepend(lp, as_path, val);
       bt_debug("Prepending ASN: %10u \n", val);
 
       if (i == 0)
-	first_prepended = val;
-      if (i == AS_PATH_LENGTH-1)
 	last_prepended = val;
+      if (i == AS_PATH_LENGTH-1)
+	first_prepended = val;
 
-      mask[i].kind = PM_ASN;
-      mask[i].val  = val;
-      if (i)
-	mask[i].next = &mask[i-1];
+      mask->item[i].kind = PM_ASN;
+      mask->item[i].asn  = val;
     }
 
-    bt_assert_msg(as_path_match(as_path, &mask[AS_PATH_LENGTH-1]), "Mask should match with AS path");
+    bt_assert_msg(as_path_match(as_path, mask), "Mask should match with AS path");
 
     u32 asn;
 
diff --git a/nest/a-set.c b/nest/a-set.c
index 048e522d..1186eb56 100644
--- a/nest/a-set.c
+++ b/nest/a-set.c
@@ -34,7 +34,7 @@
  * the buffer to indicate truncation.
  */
 int
-int_set_format(struct adata *set, int way, int from, byte *buf, uint size)
+int_set_format(const struct adata *set, int way, int from, byte *buf, uint size)
 {
   u32 *z = (u32 *) set->data;
   byte *end = buf + size - 24;
@@ -69,18 +69,16 @@ int
 ec_format(byte *buf, u64 ec)
 {
   u32 type, key, val;
-  char tbuf[16], *kind;
+  char tbuf[16];
+  const char *kind;
 
   type = ec >> 48;
-  switch (type & 0xf0ff)
-    {
-    case EC_RT: kind = "rt"; break;
-    case EC_RO: kind = "ro"; break;
+  kind = ec_subtype_str(type & 0xf0ff);
 
-    default:
-      kind = tbuf;
-      bsprintf(kind, "unknown 0x%x", type);
-    }
+  if (!kind) {
+    bsprintf(tbuf, "unknown 0x%x", type);
+    kind = tbuf;
+  }
 
   switch (ec >> 56)
     {
@@ -115,7 +113,7 @@ ec_format(byte *buf, u64 ec)
 }
 
 int
-ec_set_format(struct adata *set, int from, byte *buf, uint size)
+ec_set_format(const struct adata *set, int from, byte *buf, uint size)
 {
   u32 *z = int_set_get_data(set);
   byte *end = buf + size - 64;
@@ -150,7 +148,7 @@ lc_format(byte *buf, lcomm lc)
 }
 
 int
-lc_set_format(struct adata *set, int from, byte *buf, uint bufsize)
+lc_set_format(const struct adata *set, int from, byte *buf, uint bufsize)
 {
   u32 *d = (u32 *) set->data;
   byte *end = buf + bufsize - 64;
@@ -181,7 +179,7 @@ lc_set_format(struct adata *set, int from, byte *buf, uint bufsize)
 }
 
 int
-int_set_contains(struct adata *list, u32 val)
+int_set_contains(const struct adata *list, u32 val)
 {
   if (!list)
     return 0;
@@ -198,7 +196,7 @@ int_set_contains(struct adata *list, u32 val)
 }
 
 int
-ec_set_contains(struct adata *list, u64 val)
+ec_set_contains(const struct adata *list, u64 val)
 {
   if (!list)
     return 0;
@@ -217,7 +215,7 @@ ec_set_contains(struct adata *list, u64 val)
 }
 
 int
-lc_set_contains(struct adata *list, lcomm val)
+lc_set_contains(const struct adata *list, lcomm val)
 {
   if (!list)
     return 0;
@@ -233,8 +231,8 @@ lc_set_contains(struct adata *list, lcomm val)
   return 0;
 }
 
-struct adata *
-int_set_prepend(struct linpool *pool, struct adata *list, u32 val)
+const struct adata *
+int_set_prepend(struct linpool *pool, const struct adata *list, u32 val)
 {
   struct adata *res;
   int len;
@@ -254,8 +252,8 @@ int_set_prepend(struct linpool *pool, struct adata *list, u32 val)
   return res;
 }
 
-struct adata *
-int_set_add(struct linpool *pool, struct adata *list, u32 val)
+const struct adata *
+int_set_add(struct linpool *pool, const struct adata *list, u32 val)
 {
   struct adata *res;
   int len;
@@ -275,8 +273,8 @@ int_set_add(struct linpool *pool, struct adata *list, u32 val)
   return res;
 }
 
-struct adata *
-ec_set_add(struct linpool *pool, struct adata *list, u64 val)
+const struct adata *
+ec_set_add(struct linpool *pool, const struct adata *list, u64 val)
 {
   if (ec_set_contains(list, val))
     return list;
@@ -295,8 +293,8 @@ ec_set_add(struct linpool *pool, struct adata *list, u64 val)
   return res;
 }
 
-struct adata *
-lc_set_add(struct linpool *pool, struct adata *list, lcomm val)
+const struct adata *
+lc_set_add(struct linpool *pool, const struct adata *list, lcomm val)
 {
   if (lc_set_contains(list, val))
     return list;
@@ -313,8 +311,8 @@ lc_set_add(struct linpool *pool, struct adata *list, lcomm val)
   return res;
 }
 
-struct adata *
-int_set_del(struct linpool *pool, struct adata *list, u32 val)
+const struct adata *
+int_set_del(struct linpool *pool, const struct adata *list, u32 val)
 {
   if (!int_set_contains(list, val))
     return list;
@@ -335,8 +333,8 @@ int_set_del(struct linpool *pool, struct adata *list, u32 val)
   return res;
 }
 
-struct adata *
-ec_set_del(struct linpool *pool, struct adata *list, u64 val)
+const struct adata *
+ec_set_del(struct linpool *pool, const struct adata *list, u64 val)
 {
   if (!ec_set_contains(list, val))
     return list;
@@ -362,8 +360,8 @@ ec_set_del(struct linpool *pool, struct adata *list, u64 val)
   return res;
 }
 
-struct adata *
-lc_set_del(struct linpool *pool, struct adata *list, lcomm val)
+const struct adata *
+lc_set_del(struct linpool *pool, const struct adata *list, lcomm val)
 {
   if (!lc_set_contains(list, val))
     return list;
@@ -384,8 +382,8 @@ lc_set_del(struct linpool *pool, struct adata *list, lcomm val)
   return res;
 }
 
-struct adata *
-int_set_union(struct linpool *pool, struct adata *l1, struct adata *l2)
+const struct adata *
+int_set_union(struct linpool *pool, const struct adata *l1, const struct adata *l2)
 {
   if (!l1)
     return l2;
@@ -414,8 +412,8 @@ int_set_union(struct linpool *pool, struct adata *l1, struct adata *l2)
   return res;
 }
 
-struct adata *
-ec_set_union(struct linpool *pool, struct adata *l1, struct adata *l2)
+const struct adata *
+ec_set_union(struct linpool *pool, const struct adata *l1, const struct adata *l2)
 {
   if (!l1)
     return l2;
@@ -447,8 +445,8 @@ ec_set_union(struct linpool *pool, struct adata *l1, struct adata *l2)
   return res;
 }
 
-struct adata *
-lc_set_union(struct linpool *pool, struct adata *l1, struct adata *l2)
+const struct adata *
+lc_set_union(struct linpool *pool, const struct adata *l1, const struct adata *l2)
 {
   if (!l1)
     return l2;
@@ -479,7 +477,7 @@ lc_set_union(struct linpool *pool, struct adata *l1, struct adata *l2)
 
 
 struct adata *
-ec_set_del_nontrans(struct linpool *pool, struct adata *set)
+ec_set_del_nontrans(struct linpool *pool, const struct adata *set)
 {
   adata *res = lp_alloc_adata(pool, set->length);
   u32 *src = int_set_get_data(set);
@@ -510,7 +508,7 @@ int_set_cmp(const void *X, const void *Y)
 }
 
 struct adata *
-int_set_sort(struct linpool *pool, struct adata *src)
+int_set_sort(struct linpool *pool, const struct adata *src)
 {
   struct adata *dst = lp_alloc_adata(pool, src->length);
   memcpy(dst->data, src->data, src->length);
@@ -528,7 +526,7 @@ ec_set_cmp(const void *X, const void *Y)
 }
 
 struct adata *
-ec_set_sort(struct linpool *pool, struct adata *src)
+ec_set_sort(struct linpool *pool, const struct adata *src)
 {
   struct adata *dst = lp_alloc_adata(pool, src->length);
   memcpy(dst->data, src->data, src->length);
@@ -558,7 +556,7 @@ lc_set_cmp(const void *X, const void *Y)
 }
 
 struct adata *
-lc_set_sort(struct linpool *pool, struct adata *src)
+lc_set_sort(struct linpool *pool, const struct adata *src)
 {
   struct adata *dst = lp_alloc_adata(pool, src->length);
   memcpy(dst->data, src->data, src->length);
diff --git a/nest/a-set_test.c b/nest/a-set_test.c
index a5081f9f..96b6a727 100644
--- a/nest/a-set_test.c
+++ b/nest/a-set_test.c
@@ -15,10 +15,10 @@
 #include "lib/resource.h"
 
 #define SET_SIZE 10
-static struct adata *set_sequence;		/* <0; SET_SIZE) */
-static struct adata *set_sequence_same;		/* <0; SET_SIZE) */
-static struct adata *set_sequence_higher;	/* <SET_SIZE; 2*SET_SIZE) */
-static struct adata *set_random;
+static const struct adata *set_sequence;		/* <0; SET_SIZE) */
+static const struct adata *set_sequence_same;		/* <0; SET_SIZE) */
+static const struct adata *set_sequence_higher;	/* <SET_SIZE; 2*SET_SIZE) */
+static const struct adata *set_random;
 
 #define BUFFER_SIZE 1000
 static byte buf[BUFFER_SIZE] = {};
@@ -34,14 +34,14 @@ enum set_type
 };
 
 static void
-generate_set_sequence(enum set_type type)
+generate_set_sequence(enum set_type type, int len)
 {
   struct adata empty_as_path = {};
   set_sequence = set_sequence_same = set_sequence_higher = set_random = &empty_as_path;
   lp = lp_new_default(&root_pool);
 
   int i;
-  for (i = 0; i < SET_SIZE; i++)
+  for (i = 0; i < len; i++)
   {
     if (type == SET_TYPE_INT)
     {
@@ -72,7 +72,7 @@ t_set_int_contains(void)
   int i;
 
   resource_init();
-  generate_set_sequence(SET_TYPE_INT);
+  generate_set_sequence(SET_TYPE_INT, SET_SIZE);
 
   bt_assert(int_set_get_size(set_sequence) == SET_SIZE);
 
@@ -93,9 +93,9 @@ static int
 t_set_int_union(void)
 {
   resource_init();
-  generate_set_sequence(SET_TYPE_INT);
+  generate_set_sequence(SET_TYPE_INT, SET_SIZE);
 
-  struct adata *set_union;
+  const struct adata *set_union;
   set_union = int_set_union(lp, set_sequence, set_sequence_same);
   bt_assert(int_set_get_size(set_union) == SET_SIZE);
   bt_assert(int_set_format(set_union, 0, 2, buf, BUFFER_SIZE) == 0);
@@ -112,9 +112,8 @@ static int
 t_set_int_format(void)
 {
   resource_init();
-  generate_set_sequence(SET_TYPE_INT);
+  generate_set_sequence(SET_TYPE_INT, SET_SIZE_FOR_FORMAT_OUTPUT);
 
-  set_sequence->length = 4 * SET_SIZE_FOR_FORMAT_OUTPUT; /* dirty */
   bt_assert(int_set_format(set_sequence, 0, 0, buf, BUFFER_SIZE) == 0);
   bt_assert(strcmp(buf, "0.0.0.0 0.0.0.1 0.0.0.2 0.0.0.3 0.0.0.4 0.0.0.5 0.0.0.6 0.0.0.7 0.0.0.8 0.0.0.9") == 0);
 
@@ -134,9 +133,9 @@ static int
 t_set_int_delete(void)
 {
   resource_init();
-  generate_set_sequence(SET_TYPE_INT);
+  generate_set_sequence(SET_TYPE_INT, SET_SIZE);
 
-  struct adata *deleting_sequence = set_sequence;
+  const struct adata *deleting_sequence = set_sequence;
   u32 i;
   for (i = 0; i < SET_SIZE; i++)
   {
@@ -162,7 +161,7 @@ t_set_ec_contains(void)
   u32 i;
 
   resource_init();
-  generate_set_sequence(SET_TYPE_EC);
+  generate_set_sequence(SET_TYPE_EC, SET_SIZE);
 
   bt_assert(ec_set_get_size(set_sequence) == SET_SIZE);
 
@@ -183,9 +182,9 @@ static int
 t_set_ec_union(void)
 {
   resource_init();
-  generate_set_sequence(SET_TYPE_EC);
+  generate_set_sequence(SET_TYPE_EC, SET_SIZE);
 
-  struct adata *set_union;
+  const struct adata *set_union;
   set_union = ec_set_union(lp, set_sequence, set_sequence_same);
   bt_assert(ec_set_get_size(set_union) == SET_SIZE);
   bt_assert(ec_set_format(set_union, 0, buf, BUFFER_SIZE) == 0);
@@ -203,7 +202,7 @@ t_set_ec_format(void)
 {
   resource_init();
 
-  struct adata empty_as_path = {};
+  const struct adata empty_as_path = {};
   set_sequence = set_sequence_same = set_sequence_higher = set_random = &empty_as_path;
   lp = lp_new_default(&root_pool);
 
@@ -224,9 +223,9 @@ static int
 t_set_ec_delete(void)
 {
   resource_init();
-  generate_set_sequence(SET_TYPE_EC);
+  generate_set_sequence(SET_TYPE_EC, SET_SIZE);
 
-  struct adata *deleting_sequence = set_sequence;
+  const struct adata *deleting_sequence = set_sequence;
   u32 i;
   for (i = 0; i < SET_SIZE; i++)
   {
diff --git a/nest/attrs.h b/nest/attrs.h
index 102f378a..4efcff79 100644
--- a/nest/attrs.h
+++ b/nest/attrs.h
@@ -31,15 +31,15 @@
 struct f_tree;
 
 int as_path_valid(byte *data, uint len, int bs, int confed, char *err, uint elen);
-int as_path_16to32(byte *dst, byte *src, uint len);
-int as_path_32to16(byte *dst, byte *src, uint len);
+int as_path_16to32(byte *dst, const byte *src, uint len);
+int as_path_32to16(byte *dst, const byte *src, uint len);
 int as_path_contains_as4(const struct adata *path);
 int as_path_contains_confed(const struct adata *path);
 struct adata *as_path_strip_confed(struct linpool *pool, const struct adata *op);
 struct adata *as_path_prepend2(struct linpool *pool, const struct adata *op, int seq, u32 as);
 struct adata *as_path_to_old(struct linpool *pool, const struct adata *path);
-void as_path_cut(struct adata *path, uint num);
-struct adata *as_path_merge(struct linpool *pool, struct adata *p1, struct adata *p2);
+struct adata *as_path_cut(struct linpool *pool, const struct adata *path, uint num);
+const struct adata *as_path_merge(struct linpool *pool, const struct adata *p1, const struct adata *p2);
 void as_path_format(const struct adata *path, byte *buf, uint size);
 int as_path_getlen(const struct adata *path);
 int as_path_getlen_int(const struct adata *path, int bs);
@@ -48,8 +48,8 @@ int as_path_get_first_regular(const struct adata *path, u32 *last_as);
 int as_path_get_last(const struct adata *path, u32 *last_as);
 u32 as_path_get_last_nonaggregated(const struct adata *path);
 int as_path_contains(const struct adata *path, u32 as, int min);
-int as_path_match_set(const struct adata *path, struct f_tree *set);
-struct adata *as_path_filter(struct linpool *pool, struct adata *path, struct f_tree *set, u32 key, int pos);
+int as_path_match_set(const struct adata *path, const struct f_tree *set);
+const struct adata *as_path_filter(struct linpool *pool, const struct adata *path, const struct f_tree *set, u32 key, int pos);
 
 static inline struct adata *as_path_prepend(struct linpool *pool, const struct adata *path, u32 as)
 { return as_path_prepend2(pool, path, AS_PATH_SEQUENCE, as); }
@@ -61,20 +61,30 @@ static inline struct adata *as_path_prepend(struct linpool *pool, const struct a
 #define PM_ASN_EXPR	3
 #define PM_ASN_RANGE	4
 
-struct f_path_mask {
-  struct f_path_mask *next;
+struct f_path_mask_item {
+  union {
+    u32 asn; /* PM_ASN */
+    struct f_line *expr; /* PM_ASN_EXPR */
+    struct { /* PM_ASN_RANGE */
+      u32 from;
+      u32 to;
+    };
+  }; 
   int kind;
-  uintptr_t val;
-  uintptr_t val2;
 };
 
-int as_path_match(const struct adata *path, struct f_path_mask *mask);
+struct f_path_mask {
+  uint len;
+  struct f_path_mask_item item[0];
+};
+
+int as_path_match(const struct adata *path, const struct f_path_mask *mask);
 
 
 /* Counterparts to appropriate as_path_* functions */
 
 static inline int
-aggregator_16to32(byte *dst, byte *src)
+aggregator_16to32(byte *dst, const byte *src)
 {
   put_u32(dst, get_u16(src));
   memcpy(dst+4, src+2, 4);
@@ -82,7 +92,7 @@ aggregator_16to32(byte *dst, byte *src)
 }
 
 static inline int
-aggregator_32to16(byte *dst, byte *src)
+aggregator_32to16(byte *dst, const byte *src)
 {
   put_u16(dst, get_u32(src));
   memcpy(dst+2, src+4, 4);
@@ -90,13 +100,13 @@ aggregator_32to16(byte *dst, byte *src)
 }
 
 static inline int
-aggregator_contains_as4(struct adata *a)
+aggregator_contains_as4(const struct adata *a)
 {
   return get_u32(a->data) > 0xFFFF;
 }
 
 static inline struct adata *
-aggregator_to_old(struct linpool *pool, struct adata *a)
+aggregator_to_old(struct linpool *pool, const struct adata *a)
 {
   struct adata *d = lp_alloc_adata(pool, 8);
   put_u32(d->data, 0xFFFF);
@@ -109,26 +119,35 @@ aggregator_to_old(struct linpool *pool, struct adata *a)
 
 
 /* Extended Community subtypes (kinds) */
-#define EC_RT 0x0002
-#define EC_RO 0x0003
+enum ec_subtype {
+  EC_RT = 0x0002,
+  EC_RO = 0x0003,
+  EC_GENERIC = 0xFFFF,
+};
 
-#define EC_GENERIC 0xFFFF
+static inline const char *ec_subtype_str(const enum ec_subtype ecs) {
+  switch (ecs) {
+    case EC_RT: return "rt";
+    case EC_RO: return "ro";
+    default: return NULL;
+  }
+}
 
 /* Transitive bit (for first u32 half of EC) */
 #define EC_TBIT 0x40000000
 
 #define ECOMM_LENGTH 8
 
-static inline int int_set_get_size(struct adata *list)
+static inline int int_set_get_size(const struct adata *list)
 { return list->length / 4; }
 
-static inline int ec_set_get_size(struct adata *list)
+static inline int ec_set_get_size(const struct adata *list)
 { return list->length / 8; }
 
-static inline int lc_set_get_size(struct adata *list)
+static inline int lc_set_get_size(const struct adata *list)
 { return list->length / 12; }
 
-static inline u32 *int_set_get_data(struct adata *list)
+static inline u32 *int_set_get_data(const struct adata *list)
 { return (u32 *) list->data; }
 
 static inline u32 ec_hi(u64 ec) { return ec >> 32; }
@@ -137,16 +156,16 @@ static inline u64 ec_get(const u32 *l, int i)
 { return (((u64) l[i]) << 32) | l[i+1]; }
 
 /* RFC 4360 3.1.  Two-Octet AS Specific Extended Community */
-static inline u64 ec_as2(u64 kind, u64 key, u64 val)
-{ return ((kind | 0x0000) << 48) | (key << 32) | val; }
+static inline u64 ec_as2(enum ec_subtype kind, u64 key, u64 val)
+{ return (((u64) kind | 0x0000) << 48) | (key << 32) | val; }
 
 /* RFC 5668  4-Octet AS Specific BGP Extended Community */
-static inline u64 ec_as4(u64 kind, u64 key, u64 val)
-{ return ((kind | 0x0200) << 48) | (key << 16) | val; }
+static inline u64 ec_as4(enum ec_subtype kind, u64 key, u64 val)
+{ return (((u64) kind | 0x0200) << 48) | (key << 16) | val; }
 
 /* RFC 4360 3.2.  IPv4 Address Specific Extended Community */
-static inline u64 ec_ip4(u64 kind, u64 key, u64 val)
-{ return ((kind | 0x0100) << 48) | (key << 16) | val; }
+static inline u64 ec_ip4(enum ec_subtype kind, u64 key, u64 val)
+{ return (((u64) kind | 0x0100) << 48) | (key << 16) | val; }
 
 static inline u64 ec_generic(u64 key, u64 val)
 { return (key << 32) | val; }
@@ -173,29 +192,29 @@ static inline u32 *lc_copy(u32 *dst, const u32 *src)
 { memcpy(dst, src, LCOMM_LENGTH); return dst + 3; }
 
 
-int int_set_format(struct adata *set, int way, int from, byte *buf, uint size);
+int int_set_format(const struct adata *set, int way, int from, byte *buf, uint size);
 int ec_format(byte *buf, u64 ec);
-int ec_set_format(struct adata *set, int from, byte *buf, uint size);
+int ec_set_format(const struct adata *set, int from, byte *buf, uint size);
 int lc_format(byte *buf, lcomm lc);
-int lc_set_format(struct adata *set, int from, byte *buf, uint size);
-int int_set_contains(struct adata *list, u32 val);
-int ec_set_contains(struct adata *list, u64 val);
-int lc_set_contains(struct adata *list, lcomm val);
-struct adata *int_set_prepend(struct linpool *pool, struct adata *list, u32 val);
-struct adata *int_set_add(struct linpool *pool, struct adata *list, u32 val);
-struct adata *ec_set_add(struct linpool *pool, struct adata *list, u64 val);
-struct adata *lc_set_add(struct linpool *pool, struct adata *list, lcomm val);
-struct adata *int_set_del(struct linpool *pool, struct adata *list, u32 val);
-struct adata *ec_set_del(struct linpool *pool, struct adata *list, u64 val);
-struct adata *lc_set_del(struct linpool *pool, struct adata *list, lcomm val);
-struct adata *int_set_union(struct linpool *pool, struct adata *l1, struct adata *l2);
-struct adata *ec_set_union(struct linpool *pool, struct adata *l1, struct adata *l2);
-struct adata *lc_set_union(struct linpool *pool, struct adata *l1, struct adata *l2);
-
-struct adata *ec_set_del_nontrans(struct linpool *pool, struct adata *set);
-struct adata *int_set_sort(struct linpool *pool, struct adata *src);
-struct adata *ec_set_sort(struct linpool *pool, struct adata *src);
-struct adata *lc_set_sort(struct linpool *pool, struct adata *src);
+int lc_set_format(const struct adata *set, int from, byte *buf, uint size);
+int int_set_contains(const struct adata *list, u32 val);
+int ec_set_contains(const struct adata *list, u64 val);
+int lc_set_contains(const struct adata *list, lcomm val);
+const struct adata *int_set_prepend(struct linpool *pool, const struct adata *list, u32 val);
+const struct adata *int_set_add(struct linpool *pool, const struct adata *list, u32 val);
+const struct adata *ec_set_add(struct linpool *pool, const struct adata *list, u64 val);
+const struct adata *lc_set_add(struct linpool *pool, const struct adata *list, lcomm val);
+const struct adata *int_set_del(struct linpool *pool, const struct adata *list, u32 val);
+const struct adata *ec_set_del(struct linpool *pool, const struct adata *list, u64 val);
+const struct adata *lc_set_del(struct linpool *pool, const struct adata *list, lcomm val);
+const struct adata *int_set_union(struct linpool *pool, const struct adata *l1, const struct adata *l2);
+const struct adata *ec_set_union(struct linpool *pool, const struct adata *l1, const struct adata *l2);
+const struct adata *lc_set_union(struct linpool *pool, const struct adata *l1, const struct adata *l2);
+
+struct adata *ec_set_del_nontrans(struct linpool *pool, const struct adata *set);
+struct adata *int_set_sort(struct linpool *pool, const struct adata *src);
+struct adata *ec_set_sort(struct linpool *pool, const struct adata *src);
+struct adata *lc_set_sort(struct linpool *pool, const struct adata *src);
 
 void ec_set_sort_x(struct adata *set); /* Sort in place */
 
diff --git a/nest/cli.c b/nest/cli.c
index c421cc7e..24962f10 100644
--- a/nest/cli.c
+++ b/nest/cli.c
@@ -262,6 +262,7 @@ cli_command(struct cli *c)
   bzero(&f, sizeof(f));
   f.mem = c->parser_pool;
   f.pool = rp_new(c->pool, "Config");
+  init_list(&f.symbols);
   cf_read_hook = cli_cmd_read_hook;
   cli_rh_pos = c->rx_buf;
   cli_rh_len = strlen(c->rx_buf);
diff --git a/nest/cmds.c b/nest/cmds.c
index ca601ef2..da4015cf 100644
--- a/nest/cmds.c
+++ b/nest/cmds.c
@@ -95,18 +95,16 @@ cmd_show_memory(void)
 }
 
 void
-cmd_eval(struct f_inst *expr)
+cmd_eval(const struct f_line *expr)
 {
-  struct f_val v = f_eval(expr, this_cli->parser_pool);
+  buffer buf;
+  LOG_BUFFER_INIT(buf);
 
-  if (v.type == T_RETURN)
+  if (f_eval_buf(expr, this_cli->parser_pool, &buf) > F_RETURN)
     {
       cli_msg(8008, "runtime error");
       return;
     }
 
-  buffer buf;
-  LOG_BUFFER_INIT(buf);
-  val_format(v, &buf);
   cli_msg(23, "%s", buf.start);
 }
diff --git a/nest/cmds.h b/nest/cmds.h
index 4cf8fb1b..194a9d7f 100644
--- a/nest/cmds.h
+++ b/nest/cmds.h
@@ -16,4 +16,6 @@ struct f_inst;
 void cmd_show_status(void);
 void cmd_show_symbols(struct sym_show_data *sym);
 void cmd_show_memory(void);
-void cmd_eval(struct f_inst *expr);
+
+struct f_line;
+void cmd_eval(const struct f_line *expr);
diff --git a/nest/config.Y b/nest/config.Y
index 053e5974..4c4b6c33 100644
--- a/nest/config.Y
+++ b/nest/config.Y
@@ -88,7 +88,7 @@ CF_ENUM(T_ENUM_ROA, ROA_, UNKNOWN, VALID, INVALID)
 %type <i32> idval
 %type <f> imexport
 %type <r> rtable
-%type <s> optsym
+%type <s> optproto
 %type <ra> r_args
 %type <sd> sym_args
 %type <i> proto_start echo_mask echo_size debug_mask debug_list debug_flag mrtdump_mask mrtdump_list mrtdump_flag export_mode limit_action net_type table_sorted tos password_algorithm
@@ -112,9 +112,9 @@ rtrid:
 
 idval:
    NUM { $$ = $1; }
- | '(' term ')' { $$ = f_eval_int($2); }
+ | '(' term ')' { $$ = f_eval_int(f_linearize($2)); }
  | IP4 { $$ = ip4_to_u32($1); }
- | SYM {
+ | CF_SYM_KNOWN {
      if ($1->class == (SYM_CONSTANT | T_INT) || $1->class == (SYM_CONSTANT | T_QUAD))
        $$ = SYM_VAL($1).i;
      else if (($1->class == (SYM_CONSTANT | T_IP)) && ipa_is_ip4(SYM_VAL($1).ip))
@@ -156,7 +156,7 @@ table_sorted:
  | SORTED { $$ = 1; }
  ;
 
-table: net_type TABLE SYM table_sorted {
+table: net_type TABLE CF_SYM_VOID table_sorted {
    struct rtable_config *cf;
    cf = rt_new_table($3, $1);
    cf->sorted = $4;
@@ -177,28 +177,30 @@ proto_name:
    /* EMPTY */ {
      struct symbol *s = cf_default_name(this_proto->protocol->template, &this_proto->protocol->name_counter);
      s->class = this_proto->class;
-     s->def = this_proto;
+     s->proto = this_proto;
      this_proto->name = s->name;
      }
- | SYM {
-     cf_define_symbol($1, this_proto->class, this_proto);
+ | CF_SYM_VOID {
+     cf_define_symbol($1, this_proto->class, proto, this_proto);
      this_proto->name = $1->name;
    }
- | FROM SYM {
+ | FROM CF_SYM_KNOWN {
+     if (($2->class != SYM_TEMPLATE) && ($2->class != SYM_PROTO)) cf_error("Template or protocol name expected");
+
      struct symbol *s = cf_default_name(this_proto->protocol->template, &this_proto->protocol->name_counter);
      s->class = this_proto->class;
-     s->def = this_proto;
+     s->proto = this_proto;
      this_proto->name = s->name;
 
-     if (($2->class != SYM_TEMPLATE) && ($2->class != SYM_PROTO)) cf_error("Template or protocol name expected");
-     proto_copy_config(this_proto, $2->def);
+     proto_copy_config(this_proto, $2->proto);
    }
- | SYM FROM SYM {
-     cf_define_symbol($1, this_proto->class, this_proto);
+ | CF_SYM_VOID FROM CF_SYM_KNOWN {
+     if (($3->class != SYM_TEMPLATE) && ($3->class != SYM_PROTO)) cf_error("Template or protocol name expected");
+
+     cf_define_symbol($1, this_proto->class, proto, this_proto);
      this_proto->name = $1->name;
 
-     if (($3->class != SYM_TEMPLATE) && ($3->class != SYM_PROTO)) cf_error("Template or protocol name expected");
-     proto_copy_config(this_proto, $3->def);
+     proto_copy_config(this_proto, $3->proto);
    }
  ;
 
@@ -255,12 +257,7 @@ channel_end:
 proto_channel: channel_start channel_opt_list channel_end;
 
 
-rtable:
-   SYM {
-     if ($1->class != SYM_TABLE) cf_error("Table expected");
-     $$ = $1->def;
-   }
- ;
+rtable: CF_SYM_KNOWN { cf_assert_symbol($1, SYM_TABLE); $$ = $1->table; } ;
 
 imexport:
    FILTER filter { $$ = $2; }
@@ -513,8 +510,8 @@ CF_CLI(SHOW PROTOCOLS, proto_patt2, [<protocol> | \"<pattern>\"], [[Show routing
 CF_CLI(SHOW PROTOCOLS ALL, proto_patt2, [<protocol> | \"<pattern>\"], [[Show routing protocol details]])
 { proto_apply_cmd($4, proto_cmd_show, 0, 1); } ;
 
-optsym:
-   SYM
+optproto:
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_PROTO); $$ = $1; }
  | /* empty */ { $$ = NULL; }
  ;
 
@@ -546,10 +543,10 @@ r_args:
      $$->show_for = 1;
      $$->addr = $3;
    }
- | r_args TABLE SYM {
+ | r_args TABLE CF_SYM_KNOWN {
+     cf_assert_symbol($3, SYM_TABLE);
      $$ = $1;
-     if ($3->class != SYM_TABLE) cf_error("%s is not a table", $3->name);
-     rt_show_add_table($$, ((struct rtable_config *)$3->def)->table);
+     rt_show_add_table($$, $3->table->table);
      $$->tables_defined_by = RSD_TDB_DIRECT;
    }
  | r_args TABLE ALL {
@@ -559,10 +556,11 @@ r_args:
        rt_show_add_table($$, t->table);
      $$->tables_defined_by = RSD_TDB_ALL;
    }
- | r_args IMPORT TABLE SYM '.' r_args_channel {
+ | r_args IMPORT TABLE CF_SYM_KNOWN '.' r_args_channel {
+     cf_assert_symbol($4, SYM_PROTO);
      $$ = $1;
-     struct proto_config *cf = (void *) $4->def;
-     if ($4->class != SYM_PROTO || !cf->proto) cf_error("%s is not a protocol", $4->name);
+     struct proto_config *cf = $4->proto;
+     if (!cf->proto) cf_error("%s is not a protocol", $4->name);
      struct channel *c = proto_find_channel_by_name(cf->proto, $6);
      if (!c) cf_error("Channel %s.%s not found", $4->name, $6);
      if (!c->in_table) cf_error("No import table in channel %s.%s", $4->name, $6);
@@ -591,30 +589,33 @@ r_args:
      $$ = $1;
      $$->filtered = 1;
    }
- | r_args export_mode SYM {
-     struct proto_config *c = (struct proto_config *) $3->def;
+ | r_args export_mode CF_SYM_KNOWN {
+     cf_assert_symbol($3, SYM_PROTO);
+     struct proto_config *c = (struct proto_config *) $3->proto;
      $$ = $1;
      if ($$->export_mode) cf_error("Export specified twice");
-     if ($3->class != SYM_PROTO || !c->proto) cf_error("%s is not a protocol", $3->name);
+     if (!c->proto) cf_error("%s is not a protocol", $3->name);
      $$->export_mode = $2;
      $$->export_protocol = c->proto;
      $$->tables_defined_by = RSD_TDB_INDIRECT;
    }
- | r_args export_mode SYM '.' r_args_channel {
-     struct proto_config *c = (struct proto_config *) $3->def;
+ | r_args export_mode CF_SYM_KNOWN '.' r_args_channel {
+     cf_assert_symbol($3, SYM_PROTO);
+     struct proto_config *c = (struct proto_config *) $3->proto;
      $$ = $1;
      if ($$->export_mode) cf_error("Export specified twice");
-     if ($3->class != SYM_PROTO || !c->proto) cf_error("%s is not a protocol", $3->name);
+     if (!c->proto) cf_error("%s is not a protocol", $3->name);
      $$->export_mode = $2;
      $$->export_channel = proto_find_channel_by_name(c->proto, $5);
      if (!$$->export_channel) cf_error("Export channel not found");
      $$->tables_defined_by = RSD_TDB_INDIRECT;
    }
- | r_args PROTOCOL SYM {
-     struct proto_config *c = (struct proto_config *) $3->def;
+ | r_args PROTOCOL CF_SYM_KNOWN {
+     cf_assert_symbol($3, SYM_PROTO);
+     struct proto_config *c = (struct proto_config *) $3->proto;
      $$ = $1;
      if ($$->show_protocol) cf_error("Protocol specified twice");
-     if ($3->class != SYM_PROTO || !c->proto) cf_error("%s is not a protocol", $3->name);
+     if (!c->proto) cf_error("%s is not a protocol", $3->name);
      $$->show_protocol = c->proto;
      $$->tables_defined_by = RSD_TDB_INDIRECT;
    }
@@ -648,7 +649,7 @@ r_args_for:
     $$ = cfg_alloc(sizeof(net_addr_ip6_sadr));
     net_fill_ip6_sadr($$, $1, IP6_MAX_PREFIX_LENGTH, $3, IP6_MAX_PREFIX_LENGTH);
   }
- | SYM {
+ | CF_SYM_KNOWN {
      if ($1->class == (SYM_CONSTANT | T_IP))
      {
        $$ = cfg_alloc(ipa_is_ip4(SYM_VAL($1).ip) ? sizeof(net_addr_ip4) : sizeof(net_addr_ip6));
@@ -657,7 +658,7 @@ r_args_for:
      else if (($1->class == (SYM_CONSTANT | T_NET)) && net_type_match(SYM_VAL($1).net, NB_IP | NB_VPN))
        $$ = (net_addr *) SYM_VAL($1).net; /* Avoid const warning */
      else
-       cf_error("IP address or network expected");
+       cf_error("IP address or network constant expected");
    }
  ;
 
@@ -710,7 +711,7 @@ sym_args:
  | sym_args FILTER { $$ = $1; $$->type = SYM_FILTER; }
  | sym_args PROTOCOL { $$ = $1; $$->type = SYM_PROTO; }
  | sym_args TEMPLATE { $$ = $1; $$->type = SYM_TEMPLATE; }
- | sym_args SYM { $$ = $1; $$->sym = $2; }
+ | sym_args symbol { $$ = $1; $$->sym = $2; }
  ;
 
 
@@ -731,9 +732,11 @@ CF_CLI(DUMP ROUTES,,, [[Dump routing table]])
 { rt_dump_all(); cli_msg(0, ""); } ;
 CF_CLI(DUMP PROTOCOLS,,, [[Dump protocol information]])
 { protos_dump_all(); cli_msg(0, ""); } ;
+CF_CLI(DUMP FILTER ALL,,, [[Dump all filters in linearized form]])
+{ filters_dump_all(); cli_msg(0, ""); } ;
 
 CF_CLI(EVAL, term, <expr>, [[Evaluate an expression]])
-{ cmd_eval($2); } ;
+{ cmd_eval(f_linearize($2)); } ;
 
 CF_CLI_HELP(ECHO, ..., [[Control echoing of log messages]])
 CF_CLI(ECHO, echo_mask echo_size, (all | off | { debug|trace|info|remote|warning|error|auth [, ...] }) [<buffer-size>], [[Control echoing of log messages]]) {
@@ -780,13 +783,13 @@ CF_CLI(RESTRICT,,,[[Restrict current CLI session to safe commands]])
 { this_cli->restricted = 1; cli_msg(16, "Access restricted"); } ;
 
 proto_patt:
-   SYM  { $$.ptr = $1; $$.patt = 0; }
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_PROTO); $$.ptr = $1; $$.patt = 0; }
  | ALL  { $$.ptr = NULL; $$.patt = 1; }
  | TEXT { $$.ptr = $1; $$.patt = 1; }
  ;
 
 proto_patt2:
-   SYM  { $$.ptr = $1; $$.patt = 0; }
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_PROTO); $$.ptr = $1; $$.patt = 0; }
  |      { $$.ptr = NULL; $$.patt = 1; }
  | TEXT { $$.ptr = $1; $$.patt = 1; }
  ;
diff --git a/nest/proto.c b/nest/proto.c
index 69661650..2fb4e96f 100644
--- a/nest/proto.c
+++ b/nest/proto.c
@@ -885,7 +885,7 @@ proto_clone_config(struct symbol *sym, struct proto_config *parent)
   cf->parent = parent;
 
   sym->class = cf->class;
-  sym->def = cf;
+  sym->proto = cf;
 }
 
 static void
@@ -894,7 +894,7 @@ proto_undef_clone(struct symbol *sym, struct proto_config *cf)
   rem_node(&cf->n);
 
   sym->class = SYM_VOID;
-  sym->def = NULL;
+  sym->proto = NULL;
 }
 
 /**
@@ -1009,7 +1009,7 @@ protos_commit(struct config *new, struct config *old, int force_reconfig, int ty
 	  cfg_mem = new->mem;
 	  conf_this_scope = new->root_scope;
 	  sym = cf_get_symbol(oc->name);
-	  proto_clone_config(sym, parsym->def);
+	  proto_clone_config(sym, parsym->proto);
 	  new_config = NULL;
 	  cfg_mem = NULL;
 	}
@@ -1019,7 +1019,7 @@ protos_commit(struct config *new, struct config *old, int force_reconfig, int ty
       {
 	/* Found match, let's check if we can smoothly switch to new configuration */
 	/* No need to check description */
-	nc = sym->def;
+	nc = sym->proto;
 	nc->proto = p;
 
 	/* We will try to reconfigure protocol p */
@@ -1968,7 +1968,7 @@ proto_apply_cmd_symbol(struct symbol *s, void (* cmd)(struct proto *, uintptr_t,
     return;
   }
 
-  cmd(((struct proto_config *)s->def)->proto, arg, 0);
+  cmd(s->proto->proto, arg, 0);
   cli_msg(0, "");
 }
 
@@ -2011,7 +2011,7 @@ proto_get_named(struct symbol *sym, struct protocol *pr)
     if (sym->class != SYM_PROTO)
       cf_error("%s: Not a protocol", sym->name);
 
-    p = ((struct proto_config *) sym->def)->proto;
+    p = sym->proto->proto;
     if (!p || p->proto != pr)
       cf_error("%s: Not a %s protocol", sym->name, pr->name);
   }
diff --git a/nest/protocol.h b/nest/protocol.h
index c8110f3c..da12c771 100644
--- a/nest/protocol.h
+++ b/nest/protocol.h
@@ -483,7 +483,7 @@ struct channel_config {
 
   struct proto_config *parent;		/* Where channel is defined (proto or template) */
   struct rtable_config *table;		/* Table we're attached to */
-  struct filter *in_filter, *out_filter; /* Attached filters */
+  const struct filter *in_filter, *out_filter; /* Attached filters */
   struct channel_limit rx_limit;	/* Limit for receiving routes from protocol
 					   (relevant when in_keep_filtered is active) */
   struct channel_limit in_limit;	/* Limit for importing routes from protocol */
@@ -505,8 +505,8 @@ struct channel {
   struct proto *proto;
 
   struct rtable *table;
-  struct filter *in_filter;		/* Input filter */
-  struct filter *out_filter;		/* Output filter */
+  const struct filter *in_filter;	/* Input filter */
+  const struct filter *out_filter;	/* Output filter */
   struct channel_limit rx_limit;	/* Receive limit (for in_keep_filtered) */
   struct channel_limit in_limit;	/* Input limit */
   struct channel_limit out_limit;	/* Output limit */
diff --git a/nest/route.h b/nest/route.h
index e356f686..8d799454 100644
--- a/nest/route.h
+++ b/nest/route.h
@@ -297,7 +297,7 @@ rte *rte_find(net *net, struct rte_src *src);
 rte *rte_get_temp(struct rta *);
 void rte_update2(struct channel *c, const net_addr *n, rte *new, struct rte_src *src);
 /* rte_update() moved to protocol.h to avoid dependency conflicts */
-int rt_examine(rtable *t, net_addr *a, struct proto *p, struct filter *filter);
+int rt_examine(rtable *t, net_addr *a, struct proto *p, const struct filter *filter);
 rte *rt_export_merged(struct channel *c, net *net, rte **rt_free, linpool *pool, int silent);
 void rt_refresh_begin(rtable *t, struct channel *c);
 void rt_refresh_end(rtable *t, struct channel *c);
@@ -339,7 +339,7 @@ struct rt_show_data {
   struct rt_show_data_rtable *last_table; /* Last table in output */
   struct fib_iterator fit;		/* Iterator over networks in table */
   int verbose, tables_defined_by;
-  struct filter *filter;
+  const struct filter *filter;
   struct proto *show_protocol;
   struct proto *export_protocol;
   struct channel *export_channel;
@@ -477,7 +477,7 @@ typedef struct eattr {
   byte type;				/* Attribute type and several flags (EAF_...) */
   union {
     u32 data;
-    struct adata *ptr;			/* Attribute data elsewhere */
+    const struct adata *ptr;			/* Attribute data elsewhere */
   } u;
 } eattr;
 
@@ -498,6 +498,7 @@ const char *ea_custom_name(uint ea);
 #define EA_CUSTOM_BIT 0x8000
 #define EA_ALLOW_UNDEF 0x10000		/* ea_find: allow EAF_TYPE_UNDEF */
 #define EA_BIT(n) ((n) << 24)		/* Used in bitfield accessors */
+#define EA_BIT_GET(ea) ((ea) >> 24)
 
 #define EAF_TYPE_MASK 0x1f		/* Mask with this to get type */
 #define EAF_TYPE_INT 0x01		/* 32-bit unsigned integer number */
@@ -520,6 +521,8 @@ typedef struct adata {
   byte data[0];
 } adata;
 
+extern const adata null_adata;		/* adata of length 0 */
+
 static inline struct adata *
 lp_alloc_adata(struct linpool *pool, uint len)
 {
@@ -528,7 +531,7 @@ lp_alloc_adata(struct linpool *pool, uint len)
   return ad;
 }
 
-static inline int adata_same(struct adata *a, struct adata *b)
+static inline int adata_same(const struct adata *a, const struct adata *b)
 { return (a->length == b->length && !memcmp(a->data, b->data, a->length)); }
 
 
diff --git a/nest/rt-attr.c b/nest/rt-attr.c
index 1803db92..8620d321 100644
--- a/nest/rt-attr.c
+++ b/nest/rt-attr.c
@@ -58,6 +58,8 @@
 
 #include <stddef.h>
 
+const adata null_adata;		/* adata of length 0 */
+
 const char * const rta_src_names[RTS_MAX] = {
   [RTS_DUMMY]		= "",
   [RTS_STATIC]		= "static",
@@ -777,7 +779,7 @@ ea_free(ea_list *o)
 	{
 	  eattr *a = &o->attrs[i];
 	  if (!(a->type & EAF_EMBEDDED))
-	    mb_free(a->u.ptr);
+	    mb_free((void *) a->u.ptr);
 	}
       mb_free(o);
     }
@@ -822,7 +824,7 @@ ea_format_bitfield(struct eattr *a, byte *buf, int bufsize, const char **names,
 }
 
 static inline void
-opaque_format(struct adata *ad, byte *buf, uint size)
+opaque_format(const struct adata *ad, byte *buf, uint size)
 {
   byte *bound = buf + size - 10;
   uint i;
@@ -845,7 +847,7 @@ opaque_format(struct adata *ad, byte *buf, uint size)
 }
 
 static inline void
-ea_show_int_set(struct cli *c, struct adata *ad, int way, byte *pos, byte *buf, byte *end)
+ea_show_int_set(struct cli *c, const struct adata *ad, int way, byte *pos, byte *buf, byte *end)
 {
   int i = int_set_format(ad, way, 0, pos, end - pos);
   cli_printf(c, -1012, "\t%s", buf);
@@ -857,7 +859,7 @@ ea_show_int_set(struct cli *c, struct adata *ad, int way, byte *pos, byte *buf,
 }
 
 static inline void
-ea_show_ec_set(struct cli *c, struct adata *ad, byte *pos, byte *buf, byte *end)
+ea_show_ec_set(struct cli *c, const struct adata *ad, byte *pos, byte *buf, byte *end)
 {
   int i = ec_set_format(ad, 0, pos, end - pos);
   cli_printf(c, -1012, "\t%s", buf);
@@ -869,7 +871,7 @@ ea_show_ec_set(struct cli *c, struct adata *ad, byte *pos, byte *buf, byte *end)
 }
 
 static inline void
-ea_show_lc_set(struct cli *c, struct adata *ad, byte *pos, byte *buf, byte *end)
+ea_show_lc_set(struct cli *c, const struct adata *ad, byte *pos, byte *buf, byte *end)
 {
   int i = lc_set_format(ad, 0, pos, end - pos);
   cli_printf(c, -1012, "\t%s", buf);
@@ -896,7 +898,7 @@ ea_show(struct cli *c, eattr *e)
 {
   struct protocol *p;
   int status = GA_UNKNOWN;
-  struct adata *ad = (e->type & EAF_EMBEDDED) ? NULL : e->u.ptr;
+  const struct adata *ad = (e->type & EAF_EMBEDDED) ? NULL : e->u.ptr;
   byte buf[CLI_MSG_SIZE];
   byte *pos = buf, *end = buf + sizeof(buf);
 
@@ -1035,7 +1037,7 @@ ea_hash(ea_list *e)
 	    h ^= a->u.data;
 	  else
 	    {
-	      struct adata *d = a->u.ptr;
+	      const struct adata *d = a->u.ptr;
 	      h ^= mem_hash(d->data, d->length);
 	    }
 	  h *= mul;
diff --git a/nest/rt-table.c b/nest/rt-table.c
index 327156c8..53f5d979 100644
--- a/nest/rt-table.c
+++ b/nest/rt-table.c
@@ -39,6 +39,7 @@
 #include "lib/string.h"
 #include "conf/conf.h"
 #include "filter/filter.h"
+#include "filter/data.h"
 #include "lib/hash.h"
 #include "lib/string.h"
 #include "lib/alloca.h"
@@ -567,7 +568,7 @@ static rte *
 export_filter_(struct channel *c, rte *rt0, rte **rt_free, linpool *pool, int silent)
 {
   struct proto *p = c->proto;
-  struct filter *filter = c->out_filter;
+  const struct filter *filter = c->out_filter;
   struct proto_stats *stats = &c->stats;
   rte *rt;
   int v;
@@ -1534,7 +1535,7 @@ rte_update2(struct channel *c, const net_addr *n, rte *new, struct rte_src *src)
 {
   struct proto *p = c->proto;
   struct proto_stats *stats = &c->stats;
-  struct filter *filter = c->in_filter;
+  const struct filter *filter = c->in_filter;
   rte *dummy = NULL;
   net *nn;
 
@@ -1676,7 +1677,7 @@ rte_modify(rte *old)
 
 /* Check rtable for best route to given net whether it would be exported do p */
 int
-rt_examine(rtable *t, net_addr *a, struct proto *p, struct filter *filter)
+rt_examine(rtable *t, net_addr *a, struct proto *p, const struct filter *filter)
 {
   net *n = net_find(t, a);
   rte *rt = n ? n->routes : NULL;
@@ -2279,13 +2280,13 @@ rt_new_table(struct symbol *s, uint addr_type)
 {
   /* Hack that allows to 'redefine' the master table */
   if ((s->class == SYM_TABLE) &&
-      (s->def == new_config->def_tables[addr_type]) &&
+      (s->table == new_config->def_tables[addr_type]) &&
       ((addr_type == NET_IP4) || (addr_type == NET_IP6)))
-    return s->def;
+    return s->table;
 
   struct rtable_config *c = cfg_allocz(sizeof(struct rtable_config));
 
-  cf_define_symbol(s, SYM_TABLE, c);
+  cf_define_symbol(s, SYM_TABLE, table, c);
   c->name = s->name;
   c->addr_type = addr_type;
   c->gc_max_ops = 1000;
@@ -2344,7 +2345,7 @@ static struct rtable_config *
 rt_find_table_config(struct config *cf, char *name)
 {
   struct symbol *sym = cf_find_symbol(cf, name);
-  return (sym && (sym->class == SYM_TABLE)) ? sym->def : NULL;
+  return (sym && (sym->class == SYM_TABLE)) ? sym->table : NULL;
 }
 
 /**