diff --git a/lib/socket.h b/lib/socket.h
index a2857999..e6ce1257 100644
--- a/lib/socket.h
+++ b/lib/socket.h
@@ -36,8 +36,11 @@ typedef struct birdsock {
 
   void (*err_hook)(struct birdsock *, int); /* errno or zero if EOF */
 
-  ip_addr faddr;			/* For packet protocols: source of current packet */
-  unsigned fport;
+  /* Information about received datagrams (UDP, RAW), valid in rx_hook */
+  ip_addr faddr, laddr;			/* src (From) and dst (Local) address of the datagram */
+  unsigned fport;			/* src port of the datagram */
+  unsigned lifindex;			/* local interface that received the datagram */
+  /* laddr and lifindex are valid only if SKF_LADDR_RX flag is set to request it */
 
   int fd;				/* System-dependent data */
   node n;
@@ -77,7 +80,9 @@ sk_send_buffer_empty(sock *sk)
 
 /* Socket flags */
 
-#define SKF_V6ONLY	1	/* Use  IPV6_V6ONLY socket option */
+#define SKF_V6ONLY	1	/* Use IPV6_V6ONLY socket option */
+#define SKF_LADDR_RX	2	/* Report local address for RX packets */
+#define SKF_LADDR_TX	4	/* Allow to specify local address for TX packets */
 
 
 /*
diff --git a/nest/config.Y b/nest/config.Y
index 5a895051..7bb05259 100644
--- a/nest/config.Y
+++ b/nest/config.Y
@@ -181,8 +181,8 @@ iface_patt_node_init:
 
 iface_patt_node_body:
    TEXT { this_ipn->pattern = $1; this_ipn->prefix = IPA_NONE; this_ipn->pxlen = 0; }
- | prefix { this_ipn->pattern = NULL; this_ipn->prefix = $1.addr; this_ipn->pxlen = $1.len; }
- | TEXT prefix { this_ipn->pattern = $1; this_ipn->prefix = $2.addr; this_ipn->pxlen = $2.len; }
+ | prefix_or_ipa { this_ipn->pattern = NULL; this_ipn->prefix = $1.addr; this_ipn->pxlen = $1.len; }
+ | TEXT prefix_or_ipa { this_ipn->pattern = $1; this_ipn->prefix = $2.addr; this_ipn->pxlen = $2.len; }
  ;
 
 iface_negate:
@@ -472,7 +472,7 @@ CF_CLI(RELOAD OUT, proto_patt, <protocol> | \"<pattern>\" | all, [[Reload protoc
 { proto_apply_cmd($3, proto_cmd_reload, 1, CMD_RELOAD_OUT); } ;
 
 CF_CLI_HELP(DEBUG, ..., [[Control protocol debugging via BIRD logs]])
-CF_CLI(DEBUG, proto_patt debug_mask, (<protocol> | <pattern> | all) (all | off | { states | routes | filters | events | packets }), [[Control protocol debugging via BIRD logs]])
+CF_CLI(DEBUG, proto_patt debug_mask, (<protocol> | <pattern> | all) (all | off | { states | routes | filters | interfaces | events | packets }), [[Control protocol debugging via BIRD logs]])
 { proto_apply_cmd($2, proto_cmd_debug, 1, $3); } ;
 
 CF_CLI_HELP(MRTDUMP, ..., [[Control protocol debugging via MRTdump files]])
diff --git a/nest/iface.c b/nest/iface.c
index 82dead35..4d0cf04c 100644
--- a/nest/iface.c
+++ b/nest/iface.c
@@ -566,8 +566,8 @@ if_init(void)
  *	Interface Pattern Lists
  */
 
-static int
-iface_patt_match(struct iface_patt *ifp, struct iface *i)
+int
+iface_patt_match(struct iface_patt *ifp, struct iface *i, struct ifa *a)
 {
   struct iface_patt_node *p;
 
@@ -588,23 +588,32 @@ iface_patt_match(struct iface_patt *ifp, struct iface *i)
 	    continue;
 	}
 
-      if (p->pxlen)
-	if (!i->addr || !ipa_in_net(i->addr->ip, p->prefix, p->pxlen))
-	  continue;
+      if (p->pxlen == 0)
+	return pos;
 
-      return pos;
+      if (!a)
+	continue;
+
+      if (ipa_in_net(a->ip, p->prefix, p->pxlen))
+	return pos;
+
+      if ((a->flags & IA_UNNUMBERED) &&
+	  ipa_in_net(a->opposite, p->prefix, p->pxlen))
+	return pos;
+	  
+      continue;
     }
 
   return 0;
 }
 
 struct iface_patt *
-iface_patt_find(list *l, struct iface *i)
+iface_patt_find(list *l, struct iface *i, struct ifa *a)
 {
   struct iface_patt *p;
 
   WALK_LIST(p, *l)
-    if (iface_patt_match(p, i))
+    if (iface_patt_match(p, i, a))
       return p;
 
   return NULL;
diff --git a/nest/iface.h b/nest/iface.h
index 8fc2567d..c116db8b 100644
--- a/nest/iface.h
+++ b/nest/iface.h
@@ -83,6 +83,15 @@ struct iface *if_find_by_index(unsigned);
 struct iface *if_find_by_name(char *);
 void ifa_recalc_all_primary_addresses(void);
 
+static inline int
+ifa_match_addr(struct ifa *ifa, ip_addr addr)
+{
+  if (ifa->flags & IA_UNNUMBERED)
+    return ipa_equal(addr, ifa->opposite);
+  else
+    return ipa_in_net(addr, ifa->prefix, ifa->pxlen);
+}
+
 /* The Neighbor Cache */
 
 typedef struct neighbor {
@@ -135,7 +144,8 @@ struct iface_patt {
   /* Protocol-specific data follow after this structure */
 };
 
-struct iface_patt *iface_patt_find(list *, struct iface *);
+int iface_patt_match(struct iface_patt *ifp, struct iface *i, struct ifa *a);
+struct iface_patt *iface_patt_find(list *l, struct iface *i, struct ifa *a);
 int iface_patts_equal(list *, list *, int (*)(struct iface_patt *, struct iface_patt *));
 
 #endif
diff --git a/nest/rt-dev.c b/nest/rt-dev.c
index bb8eb8ee..239bd268 100644
--- a/nest/rt-dev.c
+++ b/nest/rt-dev.c
@@ -30,7 +30,7 @@ dev_ifa_notify(struct proto *p, unsigned c, struct ifa *ad)
   struct rt_dev_config *P = (void *) p->cf;
 
   if (!EMPTY_LIST(P->iface_list) &&
-      !iface_patt_find(&P->iface_list, ad->iface))
+      !iface_patt_find(&P->iface_list, ad->iface, ad->iface->addr))
     /* Empty list is automagically treated as "*" */
     return;
 
diff --git a/proto/ospf/dbdes.c b/proto/ospf/dbdes.c
index a249d75f..8cd7c8b2 100644
--- a/proto/ospf/dbdes.c
+++ b/proto/ospf/dbdes.c
@@ -93,8 +93,8 @@ ospf_dbdes_send(struct ospf_neighbor *n, int next)
   {
   case NEIGHBOR_EXSTART:	/* Send empty packets */
     n->myimms.bit.i = 1;
-    pkt = (struct ospf_dbdes_packet *) (ifa->sk->tbuf);
-    op = (struct ospf_packet *) pkt;
+    pkt = ospf_tx_buffer(ifa);
+    op = &pkt->ospf_packet;
     ospf_pkt_fill_hdr(ifa, pkt, DBDES_P);
     pkt->iface_mtu = htons(ifa->iface->mtu);
     pkt->options = hton_opt(oa->options);
@@ -185,10 +185,10 @@ ospf_dbdes_send(struct ospf_neighbor *n, int next)
     }
 
     /* Copy last sent packet again */
-    memcpy(ifa->sk->tbuf, n->ldbdes, length);
+    pkt = ospf_tx_buffer(ifa);
+    memcpy(pkt, n->ldbdes, length);
 
-    OSPF_PACKET(ospf_dump_dbdes, (struct ospf_dbdes_packet *) ifa->sk->tbuf,
-		"DBDES packet sent to %I via %s", n->ip, ifa->iface->name);
+    OSPF_PACKET(ospf_dump_dbdes, pkt, "DBDES packet sent to %I via %s", n->ip, ifa->iface->name);
     ospf_send_to(ifa, n->ip);
 
     if(n->myimms.bit.ms) tm_start(n->rxmt_timer, n->ifa->rxmtint);		/* Restart timer */
diff --git a/proto/ospf/hello.c b/proto/ospf/hello.c
index 2f3a8a81..fedc5236 100644
--- a/proto/ospf/hello.c
+++ b/proto/ospf/hello.c
@@ -47,7 +47,7 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 {
   struct proto_ospf *po = ifa->oa->po;
   struct proto *p = &po->proto;
-  char *beg = "Bad OSPF HELLO packet from ", *rec = " received: ";
+  char *beg = "OSPF: Bad HELLO packet from ";
   unsigned int size, i, twoway, eligible, peers;
   u32 tmp;
   u32 *pnrid;
@@ -55,7 +55,7 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
   size = ntohs(ps_i->length);
   if (size < sizeof(struct ospf_hello_packet))
   {
-    log(L_ERR "%s%I -  too short (%u B)", beg, faddr, size);
+    log(L_ERR "%s%I - too short (%u B)", beg, faddr, size);
     return;
   }
 
@@ -67,38 +67,19 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 #ifdef OSPFv2
   ip_addr mask = ps->netmask;
   ipa_ntoh(mask);
-  if (ifa->type != OSPF_IT_VLINK)
-    {
-      char *msg = L_WARN "Received HELLO packet %s (%I) is inconsistent "
-	"with the primary address of interface %s.";
-
-      if ((ifa->type != OSPF_IT_PTP) &&
-	  !ipa_equal(mask, ipa_mkmask(ifa->iface->addr->pxlen)))
-	{
-	  if (!n) log(msg, "netmask", mask, ifa->iface->name);
-	  return;
-	}
-
-      /* This check is not specified in RFC 2328, but it is needed
-       * to handle the case when there is more IP networks on one
-       * physical network (which is not handled in RFC 2328).
-       * We allow OSPF on primary IP address only and ignore HELLO packets
-       * with secondary addresses (which are sent for example by Quagga.
-       */
-      if ((ifa->iface->addr->flags & IA_UNNUMBERED) ?
-	  !ipa_equal(faddr, ifa->iface->addr->opposite) :
-	  !ipa_equal(ipa_and(faddr,mask), ifa->iface->addr->prefix))
-	{
-	  if (!n) log(msg, "address", faddr, ifa->iface->name);
-	  return;
-	}
-    }
+  if ((ifa->type != OSPF_IT_VLINK) &&
+      (ifa->type != OSPF_IT_PTP) &&
+      !ipa_equal(mask, ipa_mkmask(ifa->addr->pxlen)))
+  {
+    log(L_ERR "%s%I - netmask mismatch (%I)", beg, faddr, mask);
+    return;
+  }
 #endif
 
   tmp = ntohs(ps->helloint);
   if (tmp != ifa->helloint)
   {
-    log(L_ERR "%s%I%shello interval mismatch (%d).", beg, faddr, rec, tmp);
+    log(L_ERR "%s%I - hello interval mismatch (%d)", beg, faddr, tmp);
     return;
   }
 
@@ -109,14 +90,14 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 #endif
   if (tmp != ifa->dead)
   {
-    log(L_ERR "%s%I%sdead interval mismatch (%d).", beg, faddr, rec, tmp);
+    log(L_ERR "%s%I - dead interval mismatch (%d)", beg, faddr, tmp);
     return;
   }
 
   tmp = !(ps->options & OPT_E);
   if (tmp != ifa->oa->stub)
   {
-    log(L_ERR "%s%I%sstub area flag mismatch (%d).", beg, faddr, rec, tmp);
+    log(L_ERR "%s%I - stub area flag mismatch (%d)", beg, faddr, tmp);
     return;
   }
 
@@ -137,7 +118,7 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
       }
       if ((found == 0) && (ifa->strictnbma))
       {
-	log(L_WARN "Ignoring new neighbor: %I on %s.", faddr,
+	log(L_WARN "Ignoring new neighbor: %I on %s", faddr,
 	    ifa->iface->name);
 	return;
       }
@@ -153,7 +134,7 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 	}
       }
     }
-    OSPF_TRACE(D_EVENTS, "New neighbor found: %I on %s.", faddr,
+    OSPF_TRACE(D_EVENTS, "New neighbor found: %I on %s", faddr,
 	       ifa->iface->name);
 
     n = ospf_neighbor_new(ifa);
@@ -273,18 +254,18 @@ ospf_hello_send(timer *timer, int poll, struct ospf_neighbor *dirn)
     return;			/* Don't send any packet on stub iface */
 
   p = (struct proto *) (ifa->oa->po);
-  DBG("%s: Hello/Poll timer fired on interface %s.\n",
-      p->name, ifa->iface->name);
+  DBG("%s: Hello/Poll timer fired on interface %s with IP %I\n",
+      p->name, ifa->iface->name, ifa->addr->ip);
 
   /* Now we should send a hello packet */
-  pkt = (struct ospf_hello_packet *) (ifa->sk->tbuf);
-  op = (struct ospf_packet *) pkt;
+  pkt = ospf_tx_buffer(ifa);
+  op = &pkt->ospf_packet;
 
   /* Now fill ospf_hello header */
   ospf_pkt_fill_hdr(ifa, pkt, HELLO_P);
 
 #ifdef OSPFv2
-  pkt->netmask = ipa_mkmask(ifa->iface->addr->pxlen);
+  pkt->netmask = ipa_mkmask(ifa->addr->pxlen);
   ipa_hton(pkt->netmask);
   if ((ifa->type == OSPF_IT_VLINK) || (ifa->type == OSPF_IT_PTP))
     pkt->netmask = IPA_NONE;
diff --git a/proto/ospf/iface.c b/proto/ospf/iface.c
index 927b8da9..83d591b4 100644
--- a/proto/ospf/iface.c
+++ b/proto/ospf/iface.c
@@ -21,7 +21,6 @@ char *ospf_it[] = { "broadcast", "nbma", "point-to-point", "virtual link" };
 static void
 poll_timer_hook(timer * timer)
 {
-  log("POLL!");
   ospf_hello_send(timer, 1, NULL);
 }
 
@@ -58,63 +57,128 @@ rxbufsize(struct ospf_iface *ifa)
   }
 }
 
-static sock *
-ospf_open_socket(struct ospf_iface *ifa, int mc)
+static int
+ospf_sk_open(struct ospf_iface *ifa)
 {
-  sock *ipsk;
+  sock *sk;
   struct proto *p = &ifa->oa->po->proto;
 
-  ipsk = sk_new(p->pool);
-  ipsk->type = SK_IP;
-  ipsk->dport = OSPF_PROTO;
+  sk = sk_new(p->pool);
+  sk->type = SK_IP;
+  sk->dport = OSPF_PROTO;
 
 #ifdef OSPFv2
   /*
    * In Linux IPv4, binding a raw socket to an IP address of an iface causes
    * that the socket does not receive multicast packets, as they have
    * different (multicast) destination IP address.
-   *
-   * We want such filter in the vlink (non-mc) socket.
    */
-  ipsk->saddr = mc ? IPA_NONE : ifa->iface->addr->ip;
+  sk->saddr = IPA_NONE;
 #else /* OSPFv3 */
-  ipsk->saddr = ifa->lladdr;
+  sk->saddr = ifa->addr->ip; /* link-local addr */
 #endif
 
-  ipsk->tos = IP_PREC_INTERNET_CONTROL;
-  ipsk->ttl = 1;
-  if (ifa->type == OSPF_IT_VLINK)
-    ipsk->ttl = 255;
-  ipsk->rx_hook = ospf_rx_hook;
-  ipsk->tx_hook = ospf_tx_hook;
-  ipsk->err_hook = ospf_err_hook;
-  ipsk->iface = ifa->iface;
-  ipsk->rbsize = rxbufsize(ifa);
-  ipsk->tbsize = ifa->iface->mtu;
-  ipsk->data = (void *) ifa;
-  if (sk_open(ipsk) != 0)
+  sk->tos = IP_PREC_INTERNET_CONTROL;
+  sk->rx_hook = ospf_rx_hook;
+  sk->tx_hook = ospf_tx_hook;
+  sk->err_hook = ospf_err_hook;
+  sk->iface = ifa->iface;
+  sk->rbsize = rxbufsize(ifa);
+  sk->tbsize = ifa->iface->mtu;
+  sk->data = (void *) ifa;
+  sk->flags = SKF_LADDR_RX;
+
+  if (sk_open(sk) != 0)
     goto err;
 
 #ifdef OSPFv3
   /* 12 is an offset of the checksum in an OSPF packet */
-  if (sk_set_ipv6_checksum(ipsk, 12) < 0)
+  if (sk_set_ipv6_checksum(sk, 12) < 0)
     goto err;
 #endif
 
-  if (mc)
-  {
-    if (sk_setup_multicast(ipsk) < 0)
-      goto err;
+  /*
+   * For OSPFv2: When sending a packet, it is important to have a
+   * proper source address. We expect that when we send one-hop
+   * unicast packets, OS chooses a source address according to the
+   * destination address (to be in the same prefix). We also expect
+   * that when we send multicast packets, OS uses the source address
+   * from sk->saddr registered to OS by sk_setup_multicast(). This
+   * behavior is needed to implement multiple virtual ifaces (struct
+   * ospf_iface) on one physical iface and is signalized by
+   * CONFIG_MC_PROPER_SRC.
+   *
+   * If this behavior is not available (for example on BSD), we create
+   * non-stub iface just for the primary IP address (see
+   * ospf_iface_stubby()) and we expect OS to use primary IP address
+   * as a source address for both unicast and multicast packets.
+   *
+   * FIXME: the primary IP address is currently just the
+   * lexicographically smallest address on an interface, it should be
+   * signalized by sysdep code which one is really the primary.
+   */
 
-    if (sk_join_group(ipsk, AllSPFRouters) < 0)
-      goto err;
-  }
+  sk->saddr = ifa->addr->ip;
+  if (sk_setup_multicast(sk) < 0)
+    goto err;
 
-  return ipsk;
+  ifa->sk = sk;
+  ifa->sk_spf = 0;
+  ifa->sk_dr = 0;
+  return 1;
 
  err:
-  rfree(ipsk);
-  return NULL;
+  rfree(sk);
+  return 0;
+}
+
+static inline void
+ospf_sk_join_spf(struct ospf_iface *ifa)
+{
+  if (ifa->sk_spf)
+    return;
+
+  sk_join_group(ifa->sk, AllSPFRouters);
+  ifa->sk_spf = 1;
+}
+
+static inline void
+ospf_sk_join_dr(struct ospf_iface *ifa)
+{
+  if (ifa->sk_dr)
+    return;
+
+  sk_join_group(ifa->sk, AllDRouters);
+  ifa->sk_dr = 1;
+}
+
+static inline void
+ospf_sk_leave_spf(struct ospf_iface *ifa)
+{
+  if (!ifa->sk_spf)
+    return;
+
+  sk_leave_group(ifa->sk, AllSPFRouters);
+  ifa->sk_spf = 0;
+}
+
+static inline void
+ospf_sk_leave_dr(struct ospf_iface *ifa)
+{
+  if (!ifa->sk_dr)
+    return;
+
+  sk_leave_group(ifa->sk, AllDRouters);
+  ifa->sk_dr = 0;
+}
+
+static inline void
+ospf_sk_close(struct ospf_iface *ifa)
+{
+  ASSERT(ifa->sk);
+
+  rfree(ifa->sk);
+  ifa->sk = NULL;
 }
 
 
@@ -143,10 +207,6 @@ ospf_iface_chstate(struct ospf_iface *ifa, u8 state)
       OSPF_TRACE(D_EVENTS,
 		 "Changing state of virtual link %R from \"%s\" into \"%s\".",
 		 ifa->vid, ospf_is[oldstate], ospf_is[state]);
-      if (state == OSPF_IS_PTP)
-      {
-        ifa->sk = ospf_open_socket(ifa, 0);
-      }
     }
     else
     {
@@ -157,19 +217,10 @@ ospf_iface_chstate(struct ospf_iface *ifa, u8 state)
       {
 	if ((ifa->type != OSPF_IT_NBMA) && (ifa->ioprob == OSPF_I_OK) &&
 	    ((state == OSPF_IS_BACKUP) || (state == OSPF_IS_DR)))
-	{
-	  if (!ifa->dr_up == 0)
-	  {
-	    /* FIXME some error handing ? */
-	    sk_join_group(ifa->sk, AllDRouters);
-	    ifa->dr_up = 1;
-	  }
-	}
-	else if (ifa->dr_up)
-	{
-	  sk_leave_group(ifa->sk, AllDRouters);
-	  ifa->dr_up = 0;
-	}
+	  ospf_sk_join_dr(ifa);
+	else
+	  ospf_sk_leave_dr(ifa);
+
 	if ((oldstate == OSPF_IS_DR) && (ifa->net_lsa != NULL))
 	{
 	  ifa->net_lsa->lsa.age = LSA_MAXAGE;
@@ -182,6 +233,7 @@ ospf_iface_chstate(struct ospf_iface *ifa, u8 state)
 	  ifa->net_lsa = NULL;
 	}
       }
+      // FIXME flushling of link LSA
     }
   }
 }
@@ -194,13 +246,15 @@ ospf_iface_down(struct ospf_iface *ifa)
   struct proto *p = &po->proto;
   struct ospf_iface *iff;
 
+  OSPF_TRACE(D_EVENTS, "Removing interface %s", ifa->iface->name);
+
   /* First of all kill all the related vlinks */
   if (ifa->type != OSPF_IT_VLINK)
   {
     WALK_LIST(iff, po->iface_list)
     {
-      if ((iff->type == OSPF_IT_VLINK) && (iff->iface == ifa->iface))
-        ospf_iface_down(iff);
+      if ((iff->type == OSPF_IT_VLINK) && (iff->vifa == ifa))
+	ospf_iface_sm(iff, ISM_DOWN);
     }
   }
 
@@ -210,16 +264,18 @@ ospf_iface_down(struct ospf_iface *ifa)
     ospf_neigh_remove(n);
   }
 
-  rfree(ifa->sk);
-  ifa->sk = NULL;
-
   if (ifa->type == OSPF_IT_VLINK)
   {
+    ifa->vifa = NULL;
     ifa->iface = NULL;
+    ifa->addr = NULL;
+    ifa->sk = NULL;
+    ifa->vip = IPA_NONE;
     return;
   }
   else
   {
+    ospf_sk_close(ifa);
     rfree(ifa->wait_timer);
     rfree(ifa->hello_timer);
     rfree(ifa->poll_timer);
@@ -294,18 +350,16 @@ ospf_iface_sm(struct ospf_iface *ifa, int event)
   case ISM_DOWN:
     ospf_iface_chstate(ifa, OSPF_IS_DOWN);
     ospf_iface_down(ifa);
-    schedule_link_lsa(ifa);
     schedule_rt_lsa(oa);
     break;
-  case ISM_LOOP:		/* Useless? */
+    /*
+  case ISM_LOOP:
     ospf_iface_chstate(ifa, OSPF_IS_LOOP);
-    ospf_iface_down(ifa);
-    schedule_rt_lsa(ifa->oa);
     break;
   case ISM_UNLOOP:
     ospf_iface_chstate(ifa, OSPF_IS_DOWN);
-    schedule_rt_lsa(ifa->oa);
     break;
+    */
   default:
     bug("OSPF_I_SM - Unknown event?");
     break;
@@ -313,49 +367,10 @@ ospf_iface_sm(struct ospf_iface *ifa, int event)
 
 }
 
-#if 0
-static sock *
-ospf_open_mc_socket(struct ospf_iface *ifa)
-{
-  sock *mcsk;
-  struct proto *p = &ifa->oa->po->proto;
-
-  mcsk = sk_new(p->pool);
-  mcsk->type = SK_IP_MC;
-  mcsk->sport = 0;
-  mcsk->dport = OSPF_PROTO;
-
-#ifdef OSPFv2
-  mcsk->saddr = AllSPFRouters;
-#else /* OSPFv3 */
-  // mcsk->saddr = AllSPFRouters;
-  mcsk->saddr = ifa->lladdr;
-#endif
-
-  mcsk->daddr = AllSPFRouters;
-  mcsk->tos = IP_PREC_INTERNET_CONTROL;
-  mcsk->ttl = 1;
-  mcsk->rx_hook = ospf_rx_hook;
-  mcsk->tx_hook = ospf_tx_hook;
-  mcsk->err_hook = ospf_err_hook;
-  mcsk->iface = ifa->iface;
-  mcsk->rbsize = rxbufsize(ifa);
-  mcsk->tbsize = ifa->iface->mtu;
-  mcsk->data = (void *) ifa;
-  if (sk_open(mcsk) != 0)
-  {
-    DBG("%s: SK_OPEN: mc open failed.\n", p->name);
-    return (NULL);
-  }
-  DBG("%s: SK_OPEN: mc opened.\n", p->name);
-  return (mcsk);
-}
-#endif
-
 u8
-ospf_iface_clasify(struct iface * ifa)
+ospf_iface_clasify(struct iface *ifa, struct ifa *addr)
 {
-  if (ifa->addr->flags & IA_UNNUMBERED)
+  if (addr->flags & IA_UNNUMBERED)
     return OSPF_IT_PTP;
 
   if ((ifa->flags & (IF_MULTIACCESS | IF_MULTICAST)) ==
@@ -384,20 +399,19 @@ ospf_iface_add(struct object_lock *lock)
   struct ospf_iface *ifa = lock->data;
   struct proto_ospf *po = ifa->oa->po;
   struct proto *p = &po->proto;
-  struct iface *iface = lock->iface;
 
   ifa->lock = lock;
 
-  ifa->ioprob = OSPF_I_OK;
-
-  ifa->sk = ospf_open_socket(ifa, ifa->type != OSPF_IT_NBMA);
-  if (ifa->sk == NULL)
+  if (ospf_sk_open(ifa))
   {
-    log("%s: Huh? could not open ip socket on interface %s?", p->name,
-	iface->name);
-    log("%s: Declaring as stub.", p->name);
+    if (ifa->type != OSPF_IT_NBMA)
+      ospf_sk_join_spf(ifa);
+  }
+  else
+  {
+    log(L_ERR "%s: Socket open failed on interface %s, declaring as stub", p->name, ifa->iface->name);
+    ifa->ioprob = OSPF_I_SK;
     ifa->stub = 1;
-    ifa->ioprob += OSPF_I_IP;
   }
 
   ifa->state = OSPF_IS_DOWN;
@@ -405,7 +419,7 @@ ospf_iface_add(struct object_lock *lock)
 }
 
 void
-ospf_iface_new(struct proto_ospf *po, struct iface *iface,
+ospf_iface_new(struct proto_ospf *po, struct iface *iface, struct ifa *addr,
 	       struct ospf_area_config *ac, struct ospf_iface_patt *ip)
 {
   struct proto *p = &po->proto;
@@ -414,8 +428,12 @@ ospf_iface_new(struct proto_ospf *po, struct iface *iface,
   struct object_lock *lock;
   struct ospf_area *oa;
 
+  if (ip->type != OSPF_IT_VLINK)
+    OSPF_TRACE(D_EVENTS, "Adding interface %s", iface->name);
+
   ifa = mb_allocz(p->pool, sizeof(struct ospf_iface));
   ifa->iface = iface;
+  ifa->addr = addr;
 
   ifa->cost = ip->cost;
   ifa->rxmtint = ip->rxmtint;
@@ -426,7 +444,9 @@ ospf_iface_new(struct proto_ospf *po, struct iface *iface,
   ifa->strictnbma = ip->strictnbma;
   ifa->waitint = ip->waitint;
   ifa->dead = (ip->dead == 0) ? ip->deadc * ifa->helloint : ip->dead;
-  ifa->stub = ip->stub;
+  ifa->stub = ospf_iface_stubby(ip, addr);
+  ifa->ioprob = OSPF_I_OK;
+  ifa->rxbuf = ip->rxbuf;
 
 #ifdef OSPFv2
   ifa->autype = ip->autype;
@@ -436,34 +456,36 @@ ospf_iface_new(struct proto_ospf *po, struct iface *iface,
 #ifdef OSPFv3
   ifa->instance_id = ip->instance_id;
 
-  ifa->lladdr = IPA_NONE;
-
-  /* Find link-local address */
+  /*
+  addr = NULL;
   if (ifa->type != OSPF_IT_VLINK)
     {
       struct ifa *a;
       WALK_LIST(a, iface->addrs)
 	if (a->scope == SCOPE_LINK)
 	  {
-	    ifa->lladdr = a->ip;
+	    addr = a;
 	    break;
 	  }
 
-      if (! ipa_nonzero(ifa->lladdr))
-	log(L_WARN "%s: Missing link local address on interface %s", p->name,  iface->name);
+      if (!addr)
+      {
+	log(L_ERR "%s: Missing link-local address on interface %s, declaring as stub", p->name,  iface->name);
+	ifa->ioprob = OSPF_I_LL;
+	ifa->stub = 1;
+      }
     }
+  */
 #endif
 
-  ifa->rxbuf = ip->rxbuf;
-
   if (ip->type == OSPF_IT_UNDEF)
-    ifa->type = ospf_iface_clasify(ifa->iface);
+    ifa->type = ospf_iface_clasify(iface, addr);
   else
     ifa->type = ip->type;
 
 #ifdef OSPFv2
   if ((ifa->type != OSPF_IT_PTP) && (ifa->type != OSPF_IT_VLINK) &&
-      (ifa->iface->addr->flags & IA_UNNUMBERED))
+      (addr->flags & IA_UNNUMBERED))
   {
     log(L_WARN "%s: Missing proper IP prefix on interface %s, forcing point-to-point mode",
 	p->name,  iface->name);
@@ -533,8 +555,19 @@ ospf_iface_new(struct proto_ospf *po, struct iface *iface,
     return;			/* Don't lock, don't add sockets */
   }
 
+  /*
+   * In some cases we allow more ospf_ifaces on one physical iface.
+   * In OSPFv2, if they use different IP address prefix.
+   * In OSPFv3, if they use different instance_id.
+   * Therefore, we store such info to lock->addr field.
+   */
+
   lock = olock_new(p->pool);
-  lock->addr = AllSPFRouters;
+#ifdef OSPFv2
+  lock->addr = ifa->addr->prefix;
+#else /* OSPFv3 */
+  lock->addr = _MI(0,0,0,ifa->instance_id);
+#endif
   lock->type = OBJLOCK_IP;
   lock->port = OSPF_PROTO;
   lock->iface = iface;
@@ -544,6 +577,150 @@ ospf_iface_new(struct proto_ospf *po, struct iface *iface,
   olock_acquire(lock);
 }
 
+
+#ifdef OSPFv2
+
+void
+ospf_ifa_notify(struct proto *p, unsigned flags, struct ifa *a)
+{
+  struct proto_ospf *po = (struct proto_ospf *) p;
+  struct ospf_config *cf = (struct ospf_config *) (p->cf);
+
+  if (a->flags & IA_SECONDARY)
+    return;
+
+  if (a->scope <= SCOPE_LINK)
+    return;
+
+  /* In OSPFv2, we create OSPF iface for each address. */
+  if (flags & IF_CHANGE_UP)
+  {
+    int done = 0;
+    struct ospf_area_config *ac;
+    WALK_LIST(ac, cf->area_list)
+    {
+      struct ospf_iface_patt *ip = (struct ospf_iface_patt *)
+	iface_patt_find(&ac->patt_list, a->iface, a);
+
+      if (ip)
+      {
+	if (!done)
+	  ospf_iface_new(po, a->iface, a, ac, ip);
+	done++;
+      }
+    }
+
+    if (done > 1)
+      log(L_WARN "%s: Interface %s (IP %I) matches for multiple areas", p->name,  a->iface->name, a->ip);
+  }
+
+  if (flags & IF_CHANGE_DOWN)
+  {
+    struct ospf_iface *ifa, *ifx;
+    WALK_LIST_DELSAFE(ifa, ifx, po->iface_list)
+    {
+      if ((ifa->type != OSPF_IT_VLINK) && (ifa->addr == a))
+	ospf_iface_sm(ifa, ISM_DOWN);
+      /* See a note in ospf_iface_notify() */
+    }
+  }
+}
+
+#else /* OSPFv3 */
+
+static inline int iflag_test(u32 *a, u8 i)
+{
+  return a[i / 32] & (1u << (i % 32));
+}
+
+static inline void iflag_set(u32 *a, u8 i)
+{
+  a[i / 32] |= (1u << (i % 32));
+}
+
+void
+ospf_ifa_notify(struct proto *p, unsigned flags, struct ifa *a)
+{
+  struct proto_ospf *po = (struct proto_ospf *) p;
+  struct ospf_config *cf = (struct ospf_config *) (p->cf);
+
+  if (a->flags & IA_SECONDARY)
+    return;
+
+  if (a->scope < SCOPE_LINK)
+    return;
+
+  /* In OSPFv3, we create OSPF iface for link-local address,
+     other addresses are used for link-LSA. */
+  if (a->scope == SCOPE_LINK)
+  {
+    if (flags & IF_CHANGE_UP)
+    {
+      u32 found_all[8] = {};
+      struct ospf_area_config *ac;
+
+      WALK_LIST(ac, cf->area_list)
+      {
+	u32 found_new[8] = {};
+	struct iface_patt *p;
+
+	WALK_LIST(p, ac->patt_list)
+	{
+	  if (iface_patt_match(p, i, a))
+	  {
+	    struct ospf_iface_patt *ip = (struct ospf_iface_patt *) p;
+
+	    /* If true, we already assigned that IID and we skip
+	       this to implement first-match behavior */
+	    if (iflag_test(found_new, ip->instance_id))
+	      continue;
+
+	    /* If true, we already assigned that in a different area,
+	       we log collision */
+	    if (iflag_test(found_all, ip->instance_id))
+	    {
+	      log(L_WARN "%s: Interface %s (IID %d) matches for multiple areas",
+		  p->name,  a->iface->name, ip->instance_id);
+	      continue;
+	    }
+
+	    iflag_set(found_all, ip->instance_id);
+	    iflag_set(found_new, ip->instance_id);
+	    ospf_iface_new(po, a->iface, a, ac, ip);
+	  }
+	}
+      }
+    }
+
+    if (flags & IF_CHANGE_DOWN)
+    {
+      struct ospf_iface *ifa, *ifx;
+      WALK_LIST_DELSAFE(ifa, ifx, po->iface_list)
+      {
+	if ((ifa->type != OSPF_IT_VLINK) && (ifa->addr == a))
+	  ospf_iface_sm(ifa, ISM_DOWN);
+	/* See a note in ospf_iface_notify() */
+      }
+    }
+  }
+  else
+  {
+    struct ospf_iface *ifa;
+    WALK_LIST(ifa, po->iface_list)
+    {
+      if (ifa->iface == a->iface)
+      {
+	schedule_rt_lsa(ifa->oa);
+	/* Event 5 from RFC5340 4.4.3. */
+	schedule_link_lsa(ifa);
+	return;
+      }
+    }
+  }
+}
+
+#endif
+
 void
 ospf_iface_change_mtu(struct proto_ospf *po, struct ospf_iface *ifa)
 {
@@ -575,44 +752,29 @@ void
 ospf_iface_notify(struct proto *p, unsigned flags, struct iface *iface)
 {
   struct proto_ospf *po = (struct proto_ospf *) p;
-  struct ospf_config *c = (struct ospf_config *) (p->cf);
-  struct ospf_area_config *ac;
-  struct ospf_iface_patt *ip = NULL;
-  struct ospf_iface *ifa;
-
+    
   DBG("%s: If notify called\n", p->name);
   if (iface->flags & IF_IGNORE)
     return;
 
-  if (flags & IF_CHANGE_UP)
-  {
-    WALK_LIST(ac, c->area_list)
-    {
-      if (ip = (struct ospf_iface_patt *)
-	  iface_patt_find(&ac->patt_list, iface))
-	break;
-    }
-
-    if (ip)
-    {
-      OSPF_TRACE(D_EVENTS, "Using interface %s.", iface->name);
-      ospf_iface_new(po, iface, ac, ip);
-    }
-  }
-
   if (flags & IF_CHANGE_DOWN)
   {
-    if ((ifa = ospf_iface_find((struct proto_ospf *) p, iface)) != NULL)
-    {
-      OSPF_TRACE(D_EVENTS, "Killing interface %s.", iface->name);
-      ospf_iface_sm(ifa, ISM_DOWN);
-    }
+    struct ospf_iface *ifa, *ifx;
+    WALK_LIST_DELSAFE(ifa, ifx, po->iface_list)
+      if ((ifa->type != OSPF_IT_VLINK) && (ifa->iface == iface))
+	ospf_iface_sm(ifa, ISM_DOWN);
+
+    /* We use here that even shutting down iface also shuts down
+       the vlinks, but vlinks are not freed and stays in the
+       iface_list even when down */
   }
 
   if (flags & IF_CHANGE_MTU)
   {
-    if ((ifa = ospf_iface_find((struct proto_ospf *) p, iface)) != NULL)
-      ospf_iface_change_mtu(po, ifa);
+    struct ospf_iface *ifa;
+    WALK_LIST(ifa, po->iface_list)
+      if ((ifa->type != OSPF_IT_VLINK) && (ifa->iface == iface))
+	ospf_iface_change_mtu(po, ifa);
   }
 }
 
@@ -634,8 +796,14 @@ ospf_iface_info(struct ospf_iface *ifa)
   }
   else
   {
-    cli_msg(-1015, "Interface \"%s\":",
-	    (ifa->iface ? ifa->iface->name : "(none)"));
+#ifdef OSPFv2
+    if (ifa->addr->flags & IA_UNNUMBERED)
+      cli_msg(-1015, "Interface %s (peer %I)", ifa->iface->name, ifa->addr->opposite);
+    else
+      cli_msg(-1015, "Interface %s (%I/%d)", ifa->iface->name, ifa->addr->prefix, ifa->addr->pxlen);
+#else /* OSPFv3 */
+    cli_msg(-1015, "Interface %s (IID %d)", ifa->iface->name, ifa->instance_id);
+#endif
     cli_msg(-1015, "\tType: %s %s", ospf_it[ifa->type], strict);
     cli_msg(-1015, "\tArea: %R (%u)", ifa->oa->areaid, ifa->oa->areaid);
   }
@@ -666,4 +834,5 @@ ospf_iface_shutdown(struct ospf_iface *ifa)
 {
   init_list(&ifa->neigh_list);
   hello_timer_hook(ifa->hello_timer);
+  ospf_sk_close(ifa);
 }
diff --git a/proto/ospf/iface.h b/proto/ospf/iface.h
index 55c64bf7..05f3e46e 100644
--- a/proto/ospf/iface.h
+++ b/proto/ospf/iface.h
@@ -14,9 +14,10 @@ void ospf_iface_chstate(struct ospf_iface *ifa, u8 state);
 void ospf_iface_sm(struct ospf_iface *ifa, int event);
 struct ospf_iface *ospf_iface_find(struct proto_ospf *p, struct iface *what);
 void ospf_iface_notify(struct proto *p, unsigned flags, struct iface *iface);
+void ospf_ifa_notify(struct proto *p, unsigned flags, struct ifa *a);
 void ospf_iface_info(struct ospf_iface *ifa);
 void ospf_iface_shutdown(struct ospf_iface *ifa);
-void ospf_iface_new(struct proto_ospf *po, struct iface *iface, struct ospf_area_config *ac, struct ospf_iface_patt *ip);
+void ospf_iface_new(struct proto_ospf *po, struct iface *iface, struct ifa *addr, struct ospf_area_config *ac, struct ospf_iface_patt *ip);
 void ospf_iface_change_mtu(struct proto_ospf *po, struct ospf_iface *ifa);
 void ospf_set_rxbuf_size(struct ospf_iface *ifa, u32 rxbuf);
 
diff --git a/proto/ospf/lsack.c b/proto/ospf/lsack.c
index c740ef69..c05f0196 100644
--- a/proto/ospf/lsack.c
+++ b/proto/ospf/lsack.c
@@ -66,8 +66,8 @@ ospf_lsack_send(struct ospf_neighbor *n, int queue)
   if (EMPTY_LIST(n->ackl[queue]))
     return;
 
-  pk = (struct ospf_lsack_packet *) ifa->sk->tbuf;
-  op = (struct ospf_packet *) ifa->sk->tbuf;
+  pk = ospf_tx_buffer(ifa);
+  op = &pk->ospf_packet;
 
   ospf_pkt_fill_hdr(n->ifa, pk, LSACK_P);
   h = pk->lsh;
@@ -92,8 +92,7 @@ ospf_lsack_send(struct ospf_neighbor *n, int queue)
 	op->length = htons(len);
 	DBG("Sending and continuing! Len=%u\n", len);
 
-	OSPF_PACKET(ospf_dump_lsack, (struct ospf_lsack_packet *) ifa->sk->tbuf,
-		    "LSACK packet sent via %s", ifa->iface->name);
+	OSPF_PACKET(ospf_dump_lsack, pk, "LSACK packet sent via %s", ifa->iface->name);
 
 	if (ifa->type == OSPF_IT_BCAST)
 	{
@@ -120,8 +119,7 @@ ospf_lsack_send(struct ospf_neighbor *n, int queue)
   op->length = htons(len);
   DBG("Sending! Len=%u\n", len);
 
-  OSPF_PACKET(ospf_dump_lsack, (struct ospf_lsack_packet *) ifa->sk->tbuf,
-	      "LSACK packet sent via %s", ifa->iface->name);
+  OSPF_PACKET(ospf_dump_lsack, pk, "LSACK packet sent via %s", ifa->iface->name);
 
   if (ifa->type == OSPF_IT_BCAST)
   {
diff --git a/proto/ospf/lsreq.c b/proto/ospf/lsreq.c
index 0e360d75..1ba4fff9 100644
--- a/proto/ospf/lsreq.c
+++ b/proto/ospf/lsreq.c
@@ -44,8 +44,8 @@ ospf_lsreq_send(struct ospf_neighbor *n)
   int i, j;
   struct proto *p = &n->ifa->oa->po->proto;
 
-  pk = (struct ospf_lsreq_packet *) n->ifa->sk->tbuf;
-  op = (struct ospf_packet *) n->ifa->sk->tbuf;
+  pk = ospf_tx_buffer(n->ifa);
+  op = &pk->ospf_packet;
 
   ospf_pkt_fill_hdr(n->ifa, pk, LSREQ_P);
 
@@ -82,8 +82,7 @@ ospf_lsreq_send(struct ospf_neighbor *n)
 					i) * sizeof(struct ospf_lsreq_header);
   op->length = htons(length);
 
-  OSPF_PACKET(ospf_dump_lsreq, (struct ospf_lsreq_packet *) n->ifa->sk->tbuf,
-	      "LSREQ packet sent to %I via %s", n->ip, n->ifa->iface->name);
+  OSPF_PACKET(ospf_dump_lsreq, pk, "LSREQ packet sent to %I via %s", n->ip, n->ifa->iface->name);
   ospf_send_to(n->ifa, n->ip);
 }
 
diff --git a/proto/ospf/lsupd.c b/proto/ospf/lsupd.c
index 628dca96..7d5d89da 100644
--- a/proto/ospf/lsupd.c
+++ b/proto/ospf/lsupd.c
@@ -269,8 +269,8 @@ ospf_lsupd_flood(struct proto_ospf *po,
       struct ospf_packet *op;
       struct ospf_lsa_header *lh;
 
-      pk = (struct ospf_lsupd_packet *) ifa->sk->tbuf;
-      op = (struct ospf_packet *) ifa->sk->tbuf;
+      pk = ospf_tx_buffer(ifa);
+      op = &pk->ospf_packet;
 
       ospf_pkt_fill_hdr(ifa, pk, LSUPD_P);
       pk->lsano = htonl(1);
@@ -303,8 +303,7 @@ ospf_lsupd_flood(struct proto_ospf *po,
 
       op->length = htons(len);
 
-      OSPF_PACKET(ospf_dump_lsupd,  (struct ospf_lsupd_packet *) ifa->sk->tbuf,
-		  "LSUPD packet flooded via %s", ifa->iface->name);
+      OSPF_PACKET(ospf_dump_lsupd, pk, "LSUPD packet flooded via %s", ifa->iface->name);
 
       switch (ifa->type)
       {
@@ -348,11 +347,11 @@ ospf_lsupd_send_list(struct ospf_neighbor *n, list * l)
   if (EMPTY_LIST(*l))
     return;
 
-  pk = (struct ospf_lsupd_packet *) n->ifa->sk->tbuf;
-  op = (struct ospf_packet *) n->ifa->sk->tbuf;
-
   DBG("LSupd: 1st packet\n");
 
+  pk= ospf_tx_buffer(n->ifa);
+  op = &pk->ospf_packet;
+
   ospf_pkt_fill_hdr(n->ifa, pk, LSUPD_P);
   len = sizeof(struct ospf_lsupd_packet);
   lsano = 0;
@@ -373,8 +372,7 @@ ospf_lsupd_send_list(struct ospf_neighbor *n, list * l)
       pk->lsano = htonl(lsano);
       op->length = htons(len);
 
-      OSPF_PACKET(ospf_dump_lsupd,  (struct ospf_lsupd_packet *) n->ifa->sk->tbuf,
-		  "LSUPD packet sent to %I via %s", n->ip, n->ifa->iface->name);
+      OSPF_PACKET(ospf_dump_lsupd, pk, "LSUPD packet sent to %I via %s", n->ip, n->ifa->iface->name);
       ospf_send_to(n->ifa, n->ip);
 
       DBG("LSupd: next packet\n");
@@ -395,8 +393,7 @@ ospf_lsupd_send_list(struct ospf_neighbor *n, list * l)
     pk->lsano = htonl(lsano);
     op->length = htons(len);
 
-    OSPF_PACKET(ospf_dump_lsupd,  (struct ospf_lsupd_packet *) n->ifa->sk->tbuf,
-		"LSUPD packet sent to %I via %s", n->ip, n->ifa->iface->name);
+    OSPF_PACKET(ospf_dump_lsupd, pk, "LSUPD packet sent to %I via %s", n->ip, n->ifa->iface->name);
     ospf_send_to(n->ifa, n->ip);
   }
 }
@@ -414,7 +411,7 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
   unsigned int size = ntohs(ps_i->length);
   if (size < (sizeof(struct ospf_lsupd_packet) + sizeof(struct ospf_lsa_header)))
   {
-    log(L_ERR "Bad OSPF LSUPD packet from %I -  too short (%u B)", n->ip, size);
+    log(L_ERR "OSPF: Bad LSUPD packet from %I - too short (%u B)", n->ip, size);
     return;
   }
 
@@ -535,7 +532,7 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 	{
 	  if (!nifa->iface)
 	    continue;
-	  if (ipa_equal(nifa->iface->addr->ip, ipa_from_u32(lsatmp.id)))
+	  if (ipa_equal(nifa->addr->ip, ipa_from_u32(lsatmp.id)))
 	  {
 	    self = 1;
 	    break;
diff --git a/proto/ospf/neighbor.c b/proto/ospf/neighbor.c
index 13abc569..69c58806 100644
--- a/proto/ospf/neighbor.c
+++ b/proto/ospf/neighbor.c
@@ -449,13 +449,12 @@ bdr_election(struct ospf_iface *ifa)
   me.state = NEIGHBOR_2WAY;
   me.rid = myid;
   me.priority = ifa->priority;
+  me.ip = ifa->addr->ip;
 
 #ifdef OSPFv2
-  me.ip = ifa->iface->addr->ip;
   me.dr = ipa_to_u32(ifa->drip);
   me.bdr = ipa_to_u32(ifa->bdrip);
 #else /* OSPFv3 */
-  me.ip = ifa->lladdr;
   me.dr = ifa->drid;
   me.bdr = ifa->bdrid;
   me.iface_id = ifa->iface->index;
diff --git a/proto/ospf/ospf.c b/proto/ospf/ospf.c
index 191aa456..d345e49b 100644
--- a/proto/ospf/ospf.c
+++ b/proto/ospf/ospf.c
@@ -42,6 +42,32 @@
  * and deletion. Each LSA is kept in two pieces: header and body. Both of them are
  * kept in the endianity of the CPU.
  *
+ * In OSPFv2 specification, it is implied that there is one IP prefix
+ * for each physical network/interface (unless it is an ptp link). But
+ * in modern systems, there might be more independent IP prefixes
+ * associated with an interface.  To handle this situation, we have
+ * one &ospf_iface for each active IP prefix (instead for each active
+ * iface); This behaves like virtual interface for the purpose of OSPF.
+ * If we receive packet, we associate it with a proper virtual interface
+ * mainly according to its source address.
+ *
+ * OSPF keeps one socket per &ospf_iface. This allows us (compared to
+ * one socket approach) to evade problems with a limit of multicast
+ * groups per socket and with sending multicast packets to appropriate
+ * interface in a portable way. The socket is associated with
+ * underlying physical iface and should not receive packets received
+ * on other ifaces (unfortunately, this is not true on
+ * BSD). Generally, one packet can be received by more sockets (for
+ * example, if there are more &ospf_iface on one physical iface),
+ * therefore we explicitly filter received packets according to
+ * src/dst IP address and received iface.
+ *
+ * Vlinks are implemented using particularly degenerate form of
+ * &ospf_iface, which has several exceptions: it does not have its
+ * iface or socket (it copies these from 'parent' &ospf_iface) and it
+ * is present in iface list even when down (it is not freed in
+ * ospf_iface_down()).
+ *
  * The heart beat of ospf is ospf_disp(). It is called at regular intervals
  * (&proto_ospf->tick). It is responsible for aging and flushing of LSAs in
  * the database, for routing table calculaction and it call area_disp() of every
@@ -79,7 +105,6 @@
 
 static int ospf_reload_routes(struct proto *p);
 static void ospf_rt_notify(struct proto *p, struct rtable *table UNUSED, net * n, rte * new, rte * old UNUSED, ea_list * attrs);
-static void ospf_ifa_notify(struct proto *p, unsigned flags, struct ifa *a);
 static int ospf_rte_better(struct rte *new, struct rte *old);
 static int ospf_rte_same(struct rte *new, struct rte *old);
 static void ospf_disp(timer *timer);
@@ -196,7 +221,7 @@ ospf_start(struct proto *p)
 	  oa->options = OPT_R | OPT_E | OPT_V6;
 #endif
 	}
-        ospf_iface_new(po, NULL, ac, ipatt);
+        ospf_iface_new(po, NULL, NULL, ac, ipatt);
       }
     }
   }
@@ -480,7 +505,9 @@ ospf_shutdown(struct proto *p)
   OSPF_TRACE(D_EVENTS, "Shutdown requested");
 
   /* And send to all my neighbors 1WAY */
-  WALK_LIST(ifa, po->iface_list) ospf_iface_shutdown(ifa);
+  WALK_LIST(ifa, po->iface_list)
+    if (ifa->state > OSPF_IS_DOWN)
+      ospf_iface_shutdown(ifa);
 
   return PS_DOWN;
 }
@@ -501,27 +528,6 @@ ospf_rt_notify(struct proto *p, rtable *tbl UNUSED, net * n, rte * new, rte * ol
     flush_ext_lsa(n, po);
 }
 
-static void
-ospf_ifa_notify(struct proto *p, unsigned flags UNUSED, struct ifa *a)
-{
-  struct proto_ospf *po = (struct proto_ospf *) p;
-  struct ospf_iface *ifa;
-  
-  if ((a->flags & IA_SECONDARY) || (a->flags & IA_UNNUMBERED))
-    return;
-
-  WALK_LIST(ifa, po->iface_list)
-    {
-      if (ifa->iface == a->iface)
-	{
-	  schedule_rt_lsa(ifa->oa);
-	  /* Event 5 from RFC5340 4.4.3. */
-	  schedule_link_lsa(ifa);
-	  return;
-	}
-    }
-}
-
 static void
 ospf_get_status(struct proto *p, byte * buf)
 {
@@ -712,12 +718,17 @@ ospf_reconfigure(struct proto *p, struct proto_config *c)
 
     WALK_LIST(ifa, po->iface_list)
     {
+      /* FIXME: better handling of vlinks */
+      if (ifa->iface == NULL)
+        continue;
+
+      /* FIXME: better matching of interface_id in OSPFv3 */
       if (oldip = (struct ospf_iface_patt *)
-	  iface_patt_find(&oldac->patt_list, ifa->iface))
+	  iface_patt_find(&oldac->patt_list, ifa->iface, ifa->addr))
       {
 	/* Now reconfigure interface */
 	if (!(newip = (struct ospf_iface_patt *)
-	      iface_patt_find(&newac->patt_list, ifa->iface)))
+	      iface_patt_find(&newac->patt_list, ifa->iface, ifa->addr)))
 	  return 0;
 
 	/* HELLO TIMER */
@@ -778,18 +789,17 @@ ospf_reconfigure(struct proto *p, struct proto_config *c)
 	}
 
 	/* stub */
-	if ((oldip->stub == 0) && (newip->stub != 0))
+	int old_stub = ospf_iface_stubby(oldip, ifa->addr);
+	int new_stub = ospf_iface_stubby(newip, ifa->addr);
+	if (!old_stub && new_stub)
 	{
-	  ifa->stub = newip->stub;
+	  ifa->stub = 1;
 	  OSPF_TRACE(D_EVENTS, "Interface %s is now stub.", ifa->iface->name);
 	}
-	if ((oldip->stub != 0) && (newip->stub == 0) &&
-	    ((ifa->ioprob & OSPF_I_IP) == 0) &&
-	    (((ifa->ioprob & OSPF_I_MC) == 0) || (ifa->type == OSPF_IT_NBMA)))
+	if (old_stub && !new_stub && (ifa->ioprob == OSPF_I_OK))
 	{
-	  ifa->stub = newip->stub;
-	  OSPF_TRACE(D_EVENTS,
-		     "Interface %s is no longer stub.", ifa->iface->name);
+	  ifa->stub = 0;
+	  OSPF_TRACE(D_EVENTS, "Interface %s is no longer stub.", ifa->iface->name);
 	}
 
 #ifdef OSPFv2	
@@ -1209,7 +1219,7 @@ show_lsa_sum_net(struct top_hash_entry *he)
   lsa_get_ipv6_prefix(ls->prefix, &ip, &pxlen, &pxopts, &rest);
 #endif
 
-  cli_msg(-1016, "\t\txnetwork %I/%d", ip, pxlen);
+  cli_msg(-1016, "\t\txnetwork %I/%d metric %u", ip, pxlen, ls->metric);
 }
 
 static inline void
@@ -1218,7 +1228,7 @@ show_lsa_sum_rt(struct top_hash_entry *he)
   u32 dst_rid, options;
 
 #ifdef OSPFv2
-  //  struct ospf_lsa_sum *ls = he->lsa_body;
+  struct ospf_lsa_sum *ls = he->lsa_body;
   dst_rid = he->lsa.id;
   options = 0;
 #else /* OSPFv3 */
@@ -1227,7 +1237,7 @@ show_lsa_sum_rt(struct top_hash_entry *he)
   options = ls->options & OPTIONS_MASK;
 #endif
 
-  cli_msg(-1016, "\t\txrouter %R", dst_rid);
+  cli_msg(-1016, "\t\txrouter %R metric %u", dst_rid, ls->metric);
 }
 
 
diff --git a/proto/ospf/ospf.h b/proto/ospf/ospf.h
index 78b66ec9..bb0b6afc 100644
--- a/proto/ospf/ospf.h
+++ b/proto/ospf/ospf.h
@@ -159,6 +159,7 @@ struct ospf_iface
 {
   node n;
   struct iface *iface;		/* Nest's iface */
+  struct ifa *addr;		/* IP prefix associated with that OSPF iface */
   struct ospf_area *oa;
   struct object_lock *lock;
   sock *sk;			/* IP socket (for DD ...) */
@@ -170,7 +171,8 @@ struct ospf_iface
   u32 dead;			/* after "deadint" missing hellos is router dead */
   u32 vid;			/* Id of peer of virtual link */
   ip_addr vip;			/* IP of peer of virtual link */
-  struct ospf_area *voa;	/* Area wich the vlink goes through */
+  struct ospf_iface *vifa;	/* OSPF iface which the vlink goes through */
+  struct ospf_area *voa;	/* OSPF area which the vlink goes through */
   u16 inftransdelay;		/* The estimated number of seconds it takes to
 				   transmit a Link State Update Packet over this
 				   interface.  LSAs contained in the update */
@@ -192,7 +194,6 @@ struct ospf_iface
   u32 dr_iface_id;		/* if drid is valid, this is iface_id of DR (for connecting network) */
   u8 instance_id;		/* Used to differentiate between more OSPF
 				   instances on one interface */
-  ip_addr lladdr;		/* Used link-local addr */
 #endif
 
   u8 type;			/* OSPF view of type */
@@ -203,9 +204,6 @@ struct ospf_iface
 #define OSPF_IT_UNDEF 4
   u8 strictnbma;		/* Can I talk with unknown neighbors? */
   u8 stub;			/* Inactive interface */
-#define OSPF_I_OK 0		/* Everything OK */
-#define OSPF_I_MC 1		/* I didn't open MC socket */
-#define OSPF_I_IP 2		/* I didn't open IP socet */
   u8 state;			/* Interface state machine */
 #define OSPF_IS_DOWN 0		/* Not working */
 #define OSPF_IS_LOOP 1		/* Should never happen */
@@ -237,9 +235,13 @@ struct ospf_iface
 #endif
   int fadj;				/* Number of full adjacent neigh */
   list nbma_list;
-  u8 priority;				/* A router priority for DR election */
+  u8 priority;			/* A router priority for DR election */
   u8 ioprob;
-  u8 dr_up;				/* Socket is a member of DRouters group */
+#define OSPF_I_OK 0		/* Everything OK */
+#define OSPF_I_SK 1		/* Socket open failed */
+#define OSPF_I_LL 2		/* Missing link-local address (OSPFv3) */
+  u8 sk_spf;			/* Socket is a member of SPFRouters group */
+  u8 sk_dr; 			/* Socket is a member of DRouters group */
   u32 rxbuf;
 };
 
@@ -675,8 +677,8 @@ struct ospf_neighbor
 #define ISM_WAITF 1		/* Wait timer fired */
 #define ISM_BACKS 2		/* Backup seen */
 #define ISM_NEICH 3		/* Neighbor change */
-#define ISM_LOOP 4		/* Loop indicated */
-#define ISM_UNLOOP 5		/* Unloop indicated */
+// #define ISM_LOOP 4		/* Loop indicated */
+// #define ISM_UNLOOP 5		/* Unloop indicated */
 #define ISM_DOWN 6		/* Interface down */
 
 /* Definitions for neighbor state machine */
@@ -770,6 +772,25 @@ struct ospf_iface_patt
 #endif
 };
 
+#if defined(OSPFv2) && !defined(CONFIG_MC_PROPER_SRC)
+static inline int
+ospf_iface_stubby(struct ospf_iface_patt *ip, struct ifa *addr)
+{
+  /*
+   * We cannot properly support multiple OSPF ifaces on real iface
+   * with multiple prefixes, therefore we force OSPF ifaces with
+   * non-primary IP prefixes to be stub.
+   */
+  return ip->stub || !(addr->flags & IA_PRIMARY);
+}
+#else
+static inline int
+ospf_iface_stubby(struct ospf_iface_patt *ip, struct ifa *addr UNUSED)
+{
+  return ip->stub;
+}
+#endif
+
 int ospf_import_control(struct proto *p, rte **new, ea_list **attrs,
 			struct linpool *pool);
 struct ea_list *ospf_make_tmp_attrs(struct rte *rt, struct linpool *pool);
diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index ea5f7a86..dd8fa5f0 100644
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -140,13 +140,6 @@ ospf_pkt_checkauth(struct ospf_neighbor *n, struct ospf_iface *ifa, struct ospf_
     return 0;
   }
 
-  if (n && (ifa != n->ifa))
-  {
-    OSPF_TRACE(D_PACKETS, "OSPF_auth: received packet from strange interface (%s/%s)",
-      ifa->iface->name, n->ifa->iface->name);
-    return 0;
-  }
-
   switch(ifa->autype)
   {
     case OSPF_AUTH_NONE:
@@ -178,19 +171,13 @@ ospf_pkt_checkauth(struct ospf_neighbor *n, struct ospf_iface *ifa, struct ospf_
         return 0;
       }
 
-      if (ntohs(pkt->length) + OSPF_AUTH_CRYPT_SIZE != size)
+      if (ntohs(pkt->length) + OSPF_AUTH_CRYPT_SIZE > size)
       {
         OSPF_TRACE(D_PACKETS, "OSPF_auth: size mismatch (%d vs %d)",
 	  ntohs(pkt->length) + OSPF_AUTH_CRYPT_SIZE, size);
         return 0;
       }
 
-      if (pkt->u.md5.zero)
-      {
-        OSPF_TRACE(D_PACKETS, "OSPF_auth: \"zero\" area is non-zero");
-        return 0;
-      }
-
       tail = ((void *)pkt) + ntohs(pkt->length);
 
       if (ifa->passwords)
@@ -251,12 +238,13 @@ ospf_pkt_finalize(struct ospf_iface *ifa, struct ospf_packet *pkt)
 static int
 ospf_pkt_checkauth(struct ospf_neighbor *n, struct ospf_iface *ifa, struct ospf_packet *pkt, int size)
 { return 1; }
-
+ 
 #endif
 
+
 /**
  * ospf_rx_hook
- * @sk: socket we received the packet. Its ignored.
+ * @sk: socket we received the packet.
  * @size: size of the packet
  *
  * This is the entry point for messages from neighbors. Many checks (like
@@ -264,21 +252,52 @@ ospf_pkt_checkauth(struct ospf_neighbor *n, struct ospf_iface *ifa, struct ospf_
  * non generic functions.
  */
 int
-ospf_rx_hook(sock * sk, int size)
+ospf_rx_hook(sock *sk, int size)
 {
-  struct ospf_packet *ps;
-  struct ospf_iface *ifa = (struct ospf_iface *) (sk->data);
+  char *mesg = "OSPF: Bad packet from ";
+
+  /* We want just packets from sk->iface. Unfortunately, on BSD we
+     cannot filter out other packets at kernel level and we receive
+     all packets on all sockets */
+  if (sk->lifindex != sk->iface->index)
+    return 1;
+
+  DBG("OSPF: RX hook called (iface %s, src %I, dst %I)\n",
+      sk->iface->name, sk->faddr, sk->laddr);
+
+  /* Initially, the packet is associated with the 'master' iface */
+  struct ospf_iface *ifa = sk->data;
   struct proto_ospf *po = ifa->oa->po;
-  struct proto *p = &po->proto;
-  struct ospf_neighbor *n;
-  int osize;
-  char *mesg = "Bad OSPF packet from ";
-  struct ospf_iface *iff;
+  // struct proto *p = &po->proto;
 
-  if (ifa->stub)
-    return (1);
+  int src_local = ifa_match_addr(ifa->addr, sk->faddr);
+  int dst_local = ipa_equal(sk->laddr, ifa->addr->ip);
+  int dst_mcast = ipa_equal(sk->laddr, AllSPFRouters) || ipa_equal(sk->laddr, AllDRouters);
 
-  ps = (struct ospf_packet *) ip_skip_header(sk->rbuf, &size);
+#ifdef OSPFv2
+  /* First, we eliminate packets with strange address combinations.
+   * In OSPFv2, they might be for other ospf_ifaces (with different IP
+   * prefix) on the same real iface, so we don't log it. We enforce
+   * that (src_local || dst_local), therefore we are eliminating all
+   * such cases. 
+   */
+  if (dst_mcast && !src_local)
+    return 1;
+  if (!dst_mcast && !dst_local)
+    return 1;
+
+#else /* OSPFv3 */
+
+  /* In OSPFv3, src_local and dst_local mean link-local. 
+   * RFC 5340 says that local (non-vlink) packets use
+   * link-local src address, but does not enforce it. Strange.
+   */
+  if (dst_mcast && !src_local)
+    log(L_WARN "OSPF: Received multicast packet from %I (not link-local)", sk->faddr);
+#endif
+
+  /* Second, we check packet size, checksum, and the protocol version */
+  struct ospf_packet *ps = (struct ospf_packet *) ip_skip_header(sk->rbuf, &size);
 
   if (ps == NULL)
   {
@@ -286,34 +305,25 @@ ospf_rx_hook(sock * sk, int size)
     return 1;
   }
 
-  /* We receive packets related to vlinks even on non-vlink sockets */
-  if ((ifa->oa->areaid != 0) && (ntohl(ps->areaid) == 0))
-  {
-    WALK_LIST(iff, po->iface_list)
-    {
-      if ((iff->type == OSPF_IT_VLINK) && (iff->iface == ifa->iface) &&
-          (iff->voa = ifa->oa) && ipa_equal(sk->faddr, iff->vip))
-      {
-        return 1;       /* Packet is for VLINK */
-      }
-    }
-  }
-
-  DBG("%s: RX_Hook called on interface %s.\n", p->name, sk->iface->name);
-
   if ((unsigned) size < sizeof(struct ospf_packet))
   {
     log(L_ERR "%s%I - too short (%u bytes)", mesg, sk->faddr, size);
     return 1;
   }
 
-  osize = ntohs(ps->length);
+  int osize = ntohs(ps->length);
   if ((osize > size) || ((osize % 4) != 0))
   {
     log(L_ERR "%s%I - size field does not match (%d/%d)", mesg, sk->faddr, osize, size);
     return 1;
   }
 
+  if ((unsigned) size > sk->rbsize)
+  {
+    log(L_ERR "%s%I - too large (%d vs %d)", mesg, sk->faddr, size, sk->rbsize);
+    return 1;
+  }
+
   if (ps->version != OSPF_VERSION)
   {
     log(L_ERR "%s%I - version %u", mesg, sk->faddr, ps->version);
@@ -330,48 +340,93 @@ ospf_rx_hook(sock * sk, int size)
   }
 #endif
 
-  if (ntohl(ps->areaid) != ifa->oa->areaid)
-  {
-    log(L_ERR "%s%I - different area (%u)", mesg, sk->faddr, ntohl(ps->areaid));
-    return 1;
-  }
 
-  /* FIXME - handling of instance id should be better */
+  /* Third, we resolve associated iface and handle vlinks. */
+
+  u32 areaid = ntohl(ps->areaid);
+  u32 rid = ntohl(ps->routerid);
+
+  if ((areaid == ifa->oa->areaid)
 #ifdef OSPFv3
-  if (ps->instance_id != ifa->instance_id)
+      && (ps->instance_id != ifa->instance_id)
+#endif
+      )
   {
-    log(L_ERR "%s%I - different instance (%u)", mesg, sk->faddr, ps->instance_id);
+    /* It is real iface, source should be local (in OSPFv2) */
+#ifdef OSPFv2
+    if (!src_local)
+      return 1;
+#endif
+  }
+  else if (dst_mcast || (areaid != 0))
+  {
+    /* Obvious mismatch */
+
+#ifdef OSPFv2
+    /* We ignore mismatch in OSPFv3, because there might be
+       other instance with different instance ID */
+    log(L_ERR "%s%I - area does not match (%R vs %R)",
+	mesg, sk->faddr, areaid, ifa->oa->areaid);
+#endif
     return 1;
   }
-#endif
+  else
+  {
+    /* Some vlink? */
+    struct ospf_iface *iff = NULL;
 
-  if (ntohl(ps->routerid) == po->router_id)
+    WALK_LIST(iff, po->iface_list)
+    {
+      if ((iff->type == OSPF_IT_VLINK) && 
+	  (iff->voa == ifa->oa) &&
+#ifdef OSPFv3
+	  (iff->instance_id == ps->instance_id) &&
+#endif
+	  (iff->vid == rid))
+	{
+	  /* Vlink should be UP */
+	  if (iff->state != OSPF_IS_PTP)
+	    return 1;
+	  
+	  ifa = iff;
+	  goto found;
+	}
+    }
+
+#ifdef OSPFv2
+    log(L_WARN "OSPF: Received packet for uknown vlink (ID %R, IP %I)", rid, sk->faddr);
+#endif
+    return 1;
+  }
+
+ found:
+  if (ifa->stub)	    /* This shouldn't happen */
+    return 1;
+
+  if (ipa_equal(sk->laddr, AllDRouters) && (ifa->sk_dr == 0))
+    return 1;
+
+  if (rid == po->router_id)
   {
     log(L_ERR "%s%I - received my own router ID!", mesg, sk->faddr);
     return 1;
   }
 
-  if (ntohl(ps->routerid) == 0)
+  if (rid == 0)
   {
     log(L_ERR "%s%I - router id = 0.0.0.0", mesg, sk->faddr);
     return 1;
   }
 
-  if ((unsigned) size > sk->rbsize)
-  {
-    log(L_ERR "%s%I - packet is too large (%d vs %d)",
-	mesg, sk->faddr, size, sk->rbsize);
-    return 1;
-  }
-
   /* This is deviation from RFC 2328 - neighbours should be identified by
    * IP address on broadcast and NBMA networks.
    */
-  n = find_neigh(ifa, ntohl(ps->routerid));
+  struct ospf_neighbor *n = find_neigh(ifa, rid);
 
   if(!n && (ps->type != HELLO_P))
   {
-    OSPF_TRACE(D_PACKETS, "Received non-hello packet from uknown neighbor (%I)", sk->faddr);
+    log(L_WARN "OSPF: Received non-hello packet from uknown neighbor (src %I, iface %s)",
+	sk->faddr, ifa->iface->name);
     return 1;
   }
 
@@ -421,18 +476,17 @@ ospf_rx_hook(sock * sk, int size)
 void
 ospf_tx_hook(sock * sk)
 {
-  struct ospf_iface *ifa= (struct ospf_iface *) (sk->data);
-  struct proto *p = (struct proto *) (ifa->oa->po);
-  log(L_ERR "%s: TX_Hook called on interface %s\n", p->name, sk->iface->name);
+//  struct ospf_iface *ifa= (struct ospf_iface *) (sk->data);
+//  struct proto *p = (struct proto *) (ifa->oa->po);
+  log(L_ERR "OSPF: TX_Hook called");
 }
 
 void
 ospf_err_hook(sock * sk, int err)
 {
-  struct ospf_iface *ifa= (struct ospf_iface *) (sk->data);
-  struct proto *p = (struct proto *) (ifa->oa->po);
-  log(L_ERR "%s: Err_Hook called on interface %s with err=%d\n",
-    p->name, sk->iface->name, err);
+//  struct ospf_iface *ifa= (struct ospf_iface *) (sk->data);
+//  struct proto *p = (struct proto *) (ifa->oa->po);
+  log(L_ERR "OSPF: Socket error: %m", err);
 }
 
 void
@@ -440,8 +494,9 @@ ospf_send_to_agt(struct ospf_iface *ifa, u8 state)
 {
   struct ospf_neighbor *n;
 
-  WALK_LIST(n, ifa->neigh_list) if (n->state >= state)
-    ospf_send_to(ifa, n->ip);
+  WALK_LIST(n, ifa->neigh_list)
+    if (n->state >= state)
+      ospf_send_to(ifa, n->ip);
 }
 
 void
@@ -454,7 +509,7 @@ ospf_send_to_bdr(struct ospf_iface *ifa)
 }
 
 void
-ospf_send_to(struct ospf_iface *ifa, ip_addr ip)
+ospf_send_to(struct ospf_iface *ifa, ip_addr dst)
 {
   sock *sk = ifa->sk;
   struct ospf_packet *pkt = (struct ospf_packet *) sk->tbuf;
@@ -467,11 +522,8 @@ ospf_send_to(struct ospf_iface *ifa, ip_addr ip)
 
   ospf_pkt_finalize(ifa, pkt);
   if (sk->tbuf != sk->tpos)
-    log(L_ERR "Aiee, old packet was overwritted in TX buffer");
+    log(L_ERR "Aiee, old packet was overwritten in TX buffer");
 
-  if (ipa_equal(ip, IPA_NONE))
-    sk_send(sk, len);
-  else
-    sk_send_to(sk, len, ip, OSPF_PROTO);
+  sk_send_to(sk, len, dst, 0);
 }
 
diff --git a/proto/ospf/packet.h b/proto/ospf/packet.h
index 4d5612ff..1c74a703 100644
--- a/proto/ospf/packet.h
+++ b/proto/ospf/packet.h
@@ -19,5 +19,6 @@ void ospf_send_to_agt(struct ospf_iface *ifa, u8 state);
 void ospf_send_to_bdr(struct ospf_iface *ifa);
 void ospf_send_to(struct ospf_iface *ifa, ip_addr ip);
 
+static inline void * ospf_tx_buffer(struct ospf_iface *ifa) { return ifa->sk->tbuf; }
 
 #endif /* _BIRD_OSPF_PACKET_H_ */
diff --git a/proto/ospf/rt.c b/proto/ospf/rt.c
index c856eea1..b589459b 100644
--- a/proto/ospf/rt.c
+++ b/proto/ospf/rt.c
@@ -266,9 +266,10 @@ ospf_rt_spfa_rtlinks(struct ospf_area *oa, struct top_hash_entry *act, struct to
 
 	      WALK_LIST(iff, po->iface_list)	/* Try to find corresponding interface */
 		{
+		  // FIXME this is broken
 		  if (iff->iface && (iff->type != OSPF_IT_VLINK) &&
-		      (rtl->id == (ipa_to_u32(ipa_mkmask(iff->iface->addr->pxlen))
-				   & ipa_to_u32(iff->iface->addr->prefix))))	/* No VLINK and IP must match */
+		      (rtl->id == (ipa_to_u32(ipa_mkmask(iff->addr->pxlen))
+				   & ipa_to_u32(iff->addr->prefix))))	/* No VLINK and IP must match */
 		    {
 		      nf.ifa = iff;
 		      break;
@@ -423,11 +424,14 @@ ospf_rt_spfa(struct ospf_area *oa)
       if ((tmp = ospf_hash_find_rt(po->gr, oa->areaid, iface->vid)) &&
 	  (!ipa_equal(tmp->lb, IPA_NONE)))
       {
-        if ((iface->state != OSPF_IS_PTP) || (iface->iface != tmp->nhi->iface) || (!ipa_equal(iface->vip, tmp->lb)))
+        if ((iface->state != OSPF_IS_PTP) || (iface->vifa != tmp->nhi) || (!ipa_equal(iface->vip, tmp->lb)))
         {
           OSPF_TRACE(D_EVENTS, "Vlink peer %R found", tmp->lsa.id);
           ospf_iface_sm(iface, ISM_DOWN);
+	  iface->vifa = tmp->nhi;
           iface->iface = tmp->nhi->iface;
+	  iface->addr = tmp->nhi->addr;
+	  iface->sk = tmp->nhi->sk;
           iface->vip = tmp->lb;
           ospf_iface_sm(iface, ISM_UP);
         }
@@ -437,7 +441,7 @@ ospf_rt_spfa(struct ospf_area *oa)
         if (iface->state > OSPF_IS_DOWN)
         {
           OSPF_TRACE(D_EVENTS, "Vlink peer %R lost", iface->vid);
-          ospf_iface_sm(iface, ISM_DOWN);
+	  ospf_iface_sm(iface, ISM_DOWN);
         }
       }
     }
@@ -569,7 +573,7 @@ ospf_rt_sum_tr(struct ospf_area *oa)
       metric = ls->metric & METRIC_MASK;
       options = 0;
       type = ORT_NET;
-      re = (ort *) fib_find(&po->rtf, &ip, pxlen);
+      re = fib_find(&po->rtf, &ip, pxlen);
     }
     else // en->lsa.type == LSA_T_SUM_RT
     {
@@ -588,7 +592,7 @@ ospf_rt_sum_tr(struct ospf_area *oa)
       metric = ls->metric & METRIC_MASK;
       options |= ORTA_ASBR;
       type = ORT_ROUTER;
-      re = (ort *) fib_find(&bb->rtr, &ip, pxlen);
+      re = fib_find(&bb->rtr, &ip, pxlen);
     }
 
     /* 16.3 (1b) */ 
@@ -596,14 +600,14 @@ ospf_rt_sum_tr(struct ospf_area *oa)
       continue; 
 
     /* 16.3 (3) */
-    if (!re) continue;
+    if (!re || !re->n.type) continue;
     if (re->n.oa->areaid != 0) continue;
     if ((re->n.type != RTS_OSPF) && (re->n.type != RTS_OSPF_IA)) continue;
 
     /* 16.3. (4) */
     abrip = ipa_from_rid(en->lsa.rt);
     abr = fib_find(&oa->rtr, &abrip, MAX_PREFIX_LENGTH);
-    if (!abr) continue;
+    if (!abr || !abr->n.type) continue;
 
     nf.type = re->n.type;
     nf.options = options;
@@ -711,7 +715,9 @@ ospf_rt_sum(struct ospf_area *oa)
 
     /* Page 169 (4) */
     abrip = ipa_from_rid(en->lsa.rt);
-    if (!(abr = (ort *) fib_find(&oa->rtr, &abrip, MAX_PREFIX_LENGTH))) continue;
+
+    abr = (ort *) fib_find(&oa->rtr, &abrip, MAX_PREFIX_LENGTH);
+    if (!abr || !abr->n.type) continue;
     if (abr->n.metric1 == LSINFINITY) continue;
     if (!(abr->n.options & ORTA_ABR)) continue;
 
@@ -901,7 +907,7 @@ ospf_ext_spf(struct proto_ospf *po)
     WALK_LIST(atmp, po->area_list)
     {
       nfh = fib_find(&atmp->rtr, &rtid, MAX_PREFIX_LENGTH);
-      if (nfh == NULL) continue;
+      if (!nfh || !nfh->n.type) continue;    
       if (nf1 == NULL) nf1 = nfh;
       else if (ri_better(po, &nfh->n, NULL, &nf1->n, NULL, po->rfc1583)) nf1 = nfh;
     }
diff --git a/proto/ospf/topology.c b/proto/ospf/topology.c
index 54701192..885c39ba 100644
--- a/proto/ospf/topology.c
+++ b/proto/ospf/topology.c
@@ -205,7 +205,7 @@ originate_rt_lsa_body(struct ospf_area *oa, u16 *length)
 
   WALK_LIST(ifa, po->iface_list)
   {
-    int master = 0;
+    int net_lsa = 0;
 
     if ((ifa->type == OSPF_IT_VLINK) && (ifa->voa == oa) &&
 	(!EMPTY_LIST(ifa->neigh_list)))
@@ -230,12 +230,11 @@ originate_rt_lsa_body(struct ospf_area *oa, u16 *length)
 	  ln = lsab_alloc(po, sizeof(struct ospf_lsa_rt_link));
 	  ln->type = LSART_PTP;
 	  ln->id = neigh->rid;
-	  ln->data = (ifa->iface->addr->flags & IA_UNNUMBERED) ?
-	    ifa->iface->index : ipa_to_u32(ifa->iface->addr->ip);
+	  ln->data = (ifa->addr->flags & IA_UNNUMBERED) ?
+	    ifa->iface->index : ipa_to_u32(ifa->addr->ip);
 	  ln->metric = ifa->cost;
 	  ln->padding = 0;
 	  i++;
-	  master = 1;
 	}
 	break;
 
@@ -246,11 +245,11 @@ originate_rt_lsa_body(struct ospf_area *oa, u16 *length)
 	    ln = lsab_alloc(po, sizeof(struct ospf_lsa_rt_link));
 	    ln->type = LSART_NET;
 	    ln->id = ipa_to_u32(ifa->drip);
-	    ln->data = ipa_to_u32(ifa->iface->addr->ip);
+	    ln->data = ipa_to_u32(ifa->addr->ip);
 	    ln->metric = ifa->cost;
 	    ln->padding = 0;
 	    i++;
-	    master = 1;
+	    net_lsa = 1;
 	  }
 	break;
 
@@ -261,11 +260,10 @@ originate_rt_lsa_body(struct ospf_area *oa, u16 *length)
 	  ln = lsab_alloc(po, sizeof(struct ospf_lsa_rt_link));
 	  ln->type = LSART_VLNK;
 	  ln->id = neigh->rid;
-	  ln->data = ipa_to_u32(ifa->iface->addr->ip);
+	  ln->data = ipa_to_u32(ifa->addr->ip);
 	  ln->metric = ifa->cost;
 	  ln->padding = 0;
 	  i++;
-	  master = 1;
         }
         break;
 
@@ -274,25 +272,20 @@ originate_rt_lsa_body(struct ospf_area *oa, u16 *length)
         break;
       }
 
-    /* Now we will originate stub areas for interfaces addresses */
-    struct ifa *a;
-    WALK_LIST(a, ifa->iface->addrs)
-      {
-	if (((a == ifa->iface->addr) && master) ||
-	    (a->flags & IA_SECONDARY) ||
-	    (a->flags & IA_UNNUMBERED) ||
-	    configured_stubnet(oa, a))
-	  continue;
+    /* Now we will originate stub area if there is no primary */
+    if (net_lsa ||
+	(ifa->type == OSPF_IT_VLINK) ||
+	(ifa->addr->flags & IA_UNNUMBERED) ||
+	configured_stubnet(oa, ifa->addr))
+      continue;
 
-
-	ln = lsab_alloc(po, sizeof(struct ospf_lsa_rt_link));
-	ln->type = LSART_STUB;
-	ln->id = ipa_to_u32(a->prefix);
-	ln->data = ipa_to_u32(ipa_mkmask(a->pxlen));
-	ln->metric = ifa->cost;
-	ln->padding = 0;
-	i++;
-      }
+    ln = lsab_alloc(po, sizeof(struct ospf_lsa_rt_link));
+    ln->type = LSART_STUB;
+    ln->id = ipa_to_u32(ifa->addr->prefix);
+    ln->data = ipa_to_u32(ipa_mkmask(ifa->addr->pxlen));
+    ln->metric = ifa->cost;
+    ln->padding = 0;
+    i++;
   }
 
   struct ospf_stubnet_config *sn;
@@ -483,7 +476,7 @@ originate_net_lsa_body(struct ospf_iface *ifa, u16 *length,
 		 + nodes * sizeof(u32));
 
 #ifdef OSPFv2
-  net->netmask = ipa_mkmask(ifa->iface->addr->pxlen);
+  net->netmask = ipa_mkmask(ifa->addr->pxlen);
 #endif
 
 #ifdef OSPFv3
@@ -547,7 +540,7 @@ originate_net_lsa(struct ospf_iface *ifa)
 
 #ifdef OSPFv2
   lsa.options = ifa->oa->options;
-  lsa.id = ipa_to_u32(ifa->iface->addr->ip);
+  lsa.id = ipa_to_u32(ifa->addr->ip);
 #else /* OSPFv3 */
   lsa.id = ifa->iface->index;
 #endif
@@ -749,12 +742,13 @@ originate_sum_rt_lsa(struct ospf_area *oa, struct fib_node *fn, int metric, u32
   struct proto_ospf *po = oa->po;
   struct proto *p = &po->proto;
   struct top_hash_entry *en;
-  u32 dom = oa->areaid;  
+  u32 dom = oa->areaid;
+  u32 rid = ipa_to_rid(fn->prefix);
   struct ospf_lsa_header lsa;
   void *body;
 
   OSPF_TRACE(D_EVENTS, "Originating rt-summary-LSA for %R (metric %d)",
-	     lsa.id, metric);
+	     rid, metric);
 
   lsa.age = 0;
 #ifdef OSPFv2
@@ -762,7 +756,7 @@ originate_sum_rt_lsa(struct ospf_area *oa, struct fib_node *fn, int metric, u32
 #endif
   lsa.type = LSA_T_SUM_RT;
   /* In OSPFv3, LSA ID is meaningless, but we still use Router ID of ASBR */
-  lsa.id = ipa_to_rid(fn->prefix);
+  lsa.id = rid;
   lsa.rt = po->router_id;
   lsa.sn = LSA_INITSEQNO;
 
@@ -900,6 +894,7 @@ originate_ext_lsa_body(net *n, rte *e, u16 *length, struct proto_ospf *po,
   int gw = 0;
   int size = sizeof(struct ospf_lsa_ext);
 
+  // FIXME check for gw should be per ifa, not per iface
   if ((e->attrs->dest == RTD_ROUTER) &&
       !ipa_equal(e->attrs->gw, IPA_NONE) &&
       !ipa_has_link_scope(e->attrs->gw) &&
@@ -1050,7 +1045,7 @@ originate_link_lsa_body(struct ospf_iface *ifa, u16 *length)
   ASSERT(po->lsab_used == 0);
   ll = lsab_allocz(po, sizeof(struct ospf_lsa_link));
   ll->options = ifa->oa->options | (ifa->priority << 24);
-  ll->lladdr = ifa->lladdr;
+  ll->lladdr = ifa->addr->ip;
   ll = NULL; /* buffer might be reallocated later */
 
   struct ifa *a;
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 3b95a3ed..0e5320c8 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -761,7 +761,7 @@ rip_real_if_add(struct object_lock *lock)
   struct iface *iface = lock->iface;
   struct proto *p = lock->data;
   struct rip_interface *rif;
-  struct iface_patt *k = iface_patt_find(&P_CF->iface_list, iface);
+  struct iface_patt *k = iface_patt_find(&P_CF->iface_list, iface, iface->addr);
 
   if (!k)
     bug("This can not happen! It existed few seconds ago!" );
@@ -790,7 +790,7 @@ rip_if_notify(struct proto *p, unsigned c, struct iface *iface)
     }
   }
   if (c & IF_CHANGE_UP) {
-    struct iface_patt *k = iface_patt_find(&P_CF->iface_list, iface);
+    struct iface_patt *k = iface_patt_find(&P_CF->iface_list, iface, iface->addr);
     struct object_lock *lock;
     struct rip_patt *PATT = (struct rip_patt *) k;
 
diff --git a/sysdep/bsd/sysio.h b/sysdep/bsd/sysio.h
index 80f8f942..9ee4ade3 100644
--- a/sysdep/bsd/sysio.h
+++ b/sysdep/bsd/sysio.h
@@ -11,21 +11,39 @@
 static inline void
 set_inaddr(struct in6_addr * ia, ip_addr a)
 {
-	ipa_hton(a);
-	memcpy(ia, &a, sizeof(a));
+  ipa_hton(a);
+  memcpy(ia, &a, sizeof(a));
+}
+
+static inline void
+get_inaddr(ip_addr *a, struct in6_addr *ia)
+{
+  memcpy(a, ia, sizeof(*a));
+  ipa_ntoh(*a);
 }
 
 #else
 
 #include <net/if.h>
+#include <net/if_dl.h>
 
 static inline void
 set_inaddr(struct in_addr * ia, ip_addr a)
 {
-	ipa_hton(a);
-	memcpy(&ia->s_addr, &a, sizeof(a));
+  ipa_hton(a);
+  memcpy(&ia->s_addr, &a, sizeof(a));
 }
 
+static inline void
+get_inaddr(ip_addr *a, struct in_addr *ia)
+{
+  memcpy(a, &ia->s_addr, sizeof(*a));
+  ipa_ntoh(*a);
+}
+
+
+/* BSD Multicast handling for IPv4 */
+
 static inline char *
 sysio_setup_multicast(sock *s)
 {
@@ -80,6 +98,90 @@ sysio_leave_group(sock *s, ip_addr maddr)
 	return NULL;
 }
 
+
+/* BSD RX/TX packet info handling for IPv4 */
+/* it uses IP_RECVDSTADDR / IP_RECVIF socket options instead of IP_PKTINFO */
+
+#define CMSG_RX_SPACE (CMSG_SPACE(sizeof(struct in_addr)) + CMSG_SPACE(sizeof(struct sockaddr_dl)))
+#define CMSG_TX_SPACE CMSG_SPACE(sizeof(struct in_addr))
+
+static char *
+sysio_register_cmsgs(sock *s)
+{
+  int ok = 1;
+  if (s->flags & SKF_LADDR_RX)
+    {
+      if (setsockopt(s->fd, IPPROTO_IP, IP_RECVDSTADDR, &ok, sizeof(ok)) < 0)
+	return "IP_RECVDSTADDR";
+
+      if (setsockopt(s->fd, IPPROTO_IP, IP_RECVIF, &ok, sizeof(ok)) < 0)
+	return "IP_RECVIF";
+    }
+
+  return NULL;
+}
+
+static void
+sysio_process_rx_cmsgs(sock *s, struct msghdr *msg)
+{
+  struct cmsghdr *cm;
+
+  if (!(s->flags & SKF_LADDR_RX))
+    return;
+
+  s->laddr = IPA_NONE;
+  s->lifindex = 0;
+
+  for (cm = CMSG_FIRSTHDR(msg); cm != NULL; cm = CMSG_NXTHDR(msg, cm))
+    {
+      if (cm->cmsg_level == IPPROTO_IP && cm->cmsg_type == IP_RECVDSTADDR)
+	{
+	  struct in_addr *ra = (struct in_addr *) CMSG_DATA(cm);
+	  get_inaddr(&s->laddr, ra);
+	}
+
+      if (cm->cmsg_level == IPPROTO_IP && cm->cmsg_type == IP_RECVIF)
+	{
+	  struct sockaddr_dl *ri = (struct sockaddr_dl *) CMSG_DATA(cm);
+	  s->lifindex = ri->sdl_index;
+	}
+    }
+
+  // log(L_WARN "RX %I %d", s->laddr, s->lifindex);
+}
+
+
+void
+sysio_prepare_tx_cmsgs(sock *s, struct msghdr *msg)
+{
+  struct cmsghdr *cm;
+  struct in_addr *sa;
+
+  if (!(s->flags & SKF_LADDR_TX))
+    {
+      msg->msg_controllen = 0;
+      return;
+    }
+
+  if (s->iface)
+    {
+      struct in_addr m;
+//      set_inaddr(&m, s->iface->addr->ip);
+      set_inaddr(&m, s->saddr);
+      setsockopt(s->fd, IPPROTO_IP, IP_MULTICAST_IF, &m, sizeof(m));
+    }
+
+  cm = CMSG_FIRSTHDR(msg);
+  cm->cmsg_level = IPPROTO_IP;
+  cm->cmsg_type = IP_SENDSRCADDR;
+  cm->cmsg_len = CMSG_LEN(sizeof(*sa));
+
+  sa = (struct in_addr *) CMSG_DATA(cm);
+  set_inaddr(sa, s->saddr);
+
+  msg->msg_controllen = cm->cmsg_len;
+}
+
 #endif
 
 
diff --git a/sysdep/cf/README b/sysdep/cf/README
index deed866d..15a45a65 100644
--- a/sysdep/cf/README
+++ b/sysdep/cf/README
@@ -5,6 +5,7 @@ CONFIG_AUTO_ROUTES	Device routes are added automagically by the kernel
 CONFIG_SELF_CONSCIOUS	We're able to recognize whether route was installed by us
 CONFIG_MULTIPLE_TABLES	The kernel supports multiple routing tables
 CONFIG_ALL_TABLES_AT_ONCE	Kernel scanner wants to process all tables at once
+CONFIG_MC_PROPER_SRC	Multicast packets have source address according to socket saddr field
 
 CONFIG_UNIX_IFACE	Use Unix interface scanner
 CONFIG_UNIX_SET		Use Unix route setting
diff --git a/sysdep/cf/linux-22.h b/sysdep/cf/linux-22.h
index 92ffb4ca..9ccab648 100644
--- a/sysdep/cf/linux-22.h
+++ b/sysdep/cf/linux-22.h
@@ -10,6 +10,7 @@
 #define CONFIG_SELF_CONSCIOUS
 #define CONFIG_MULTIPLE_TABLES
 #define CONFIG_ALL_TABLES_AT_ONCE
+#define CONFIG_MC_PROPER_SRC
 
 #undef CONFIG_SKIP_MC_BIND
 
diff --git a/sysdep/linux/sysio.h b/sysdep/linux/sysio.h
index 7fe3566b..91cbdcd8 100644
--- a/sysdep/linux/sysio.h
+++ b/sysdep/linux/sysio.h
@@ -21,6 +21,13 @@ set_inaddr(struct in6_addr *ia, ip_addr a)
   memcpy(ia, &a, sizeof(a));
 }
 
+static inline void
+get_inaddr(ip_addr *a, struct in6_addr *ia)
+{
+  memcpy(a, ia, sizeof(*a));
+  ipa_ntoh(*a);
+}
+
 #else
 
 #include <net/if.h>
@@ -32,6 +39,13 @@ set_inaddr(struct in_addr *ia, ip_addr a)
   memcpy(&ia->s_addr, &a, sizeof(a));
 }
 
+static inline void
+get_inaddr(ip_addr *a, struct in_addr *ia)
+{
+  memcpy(a, &ia->s_addr, sizeof(*a));
+  ipa_ntoh(*a);
+}
+
 /*
  *  Multicasting in Linux systems is a real mess. Not only different kernels
  *  have different interfaces, but also different libc's export it in different
@@ -48,18 +62,18 @@ set_inaddr(struct in_addr *ia, ip_addr a)
 
 #define MREQ_IFA struct in_addr
 #define MREQ_GRP struct ip_mreq
-static inline void fill_mreq_ifa(struct in_addr *m, struct iface *ifa, UNUSED ip_addr maddr)
+static inline void fill_mreq_ifa(struct in_addr *m, struct iface *ifa UNUSED, ip_addr saddr, ip_addr maddr UNUSED)
 {
-  set_inaddr(m, ifa->addr->ip);
+  set_inaddr(m, saddr);
 }
 
-static inline void fill_mreq_grp(struct ip_mreq *m, struct iface *ifa, ip_addr maddr)
+static inline void fill_mreq_grp(struct ip_mreq *m, struct iface *ifa, ip_addr saddr, ip_addr maddr)
 {
   bzero(m, sizeof(*m));
 #ifdef CONFIG_LINUX_MC_MREQ_BIND
   m->imr_interface.s_addr = INADDR_ANY;
 #else
-  set_inaddr(&m->imr_interface, ifa->addr->ip);
+  set_inaddr(&m->imr_interface, saddr);
 #endif
   set_inaddr(&m->imr_multiaddr, maddr);
 }
@@ -87,11 +101,11 @@ struct ip_mreqn
 #define fill_mreq_ifa fill_mreq
 #define fill_mreq_grp fill_mreq
 
-static inline void fill_mreq(struct ip_mreqn *m, struct iface *ifa, ip_addr maddr)
+static inline void fill_mreq(struct ip_mreqn *m, struct iface *ifa, ip_addr saddr, ip_addr maddr)
 {
   bzero(m, sizeof(*m));
   m->imr_ifindex = ifa->index;
-  set_inaddr(&m->imr_address, ifa->addr->ip);
+  set_inaddr(&m->imr_address, saddr);
   set_inaddr(&m->imr_multiaddr, maddr);
 }
 #endif
@@ -109,7 +123,7 @@ sysio_setup_multicast(sock *s)
     return "IP_MULTICAST_TTL";
 
   /* This defines where should we send _outgoing_ multicasts */
-  fill_mreq_ifa(&m, s->iface, IPA_NONE);
+  fill_mreq_ifa(&m, s->iface, s->saddr, IPA_NONE);
   if (setsockopt(s->fd, SOL_IP, IP_MULTICAST_IF, &m, sizeof(m)) < 0)
     return "IP_MULTICAST_IF";
 
@@ -131,7 +145,7 @@ sysio_join_group(sock *s, ip_addr maddr)
   MREQ_GRP m;
 
   /* And this one sets interface for _receiving_ multicasts from */
-  fill_mreq_grp(&m, s->iface, maddr);
+  fill_mreq_grp(&m, s->iface, s->saddr, maddr);
   if (setsockopt(s->fd, SOL_IP, IP_ADD_MEMBERSHIP, &m, sizeof(m)) < 0)
     return "IP_ADD_MEMBERSHIP";
 
@@ -144,7 +158,7 @@ sysio_leave_group(sock *s, ip_addr maddr)
   MREQ_GRP m;
 
   /* And this one sets interface for _receiving_ multicasts from */
-  fill_mreq_grp(&m, s->iface, maddr);
+  fill_mreq_grp(&m, s->iface, s->saddr, maddr);
   if (setsockopt(s->fd, SOL_IP, IP_DROP_MEMBERSHIP, &m, sizeof(m)) < 0)
     return "IP_DROP_MEMBERSHIP";
 
@@ -209,3 +223,76 @@ sk_set_md5_auth_int(sock *s, sockaddr *sa, char *passwd)
 
   return rv;
 }
+
+
+#ifndef IPV6
+
+/* RX/TX packet info handling for IPv4 */
+/* Mostly similar to standardized IPv6 code */
+
+#define CMSG_RX_SPACE CMSG_SPACE(sizeof(struct in_pktinfo))
+#define CMSG_TX_SPACE CMSG_SPACE(sizeof(struct in_pktinfo))
+
+static char *
+sysio_register_cmsgs(sock *s)
+{
+  int ok = 1;
+  if ((s->flags & SKF_LADDR_RX) &&
+      setsockopt(s->fd, IPPROTO_IP, IP_PKTINFO, &ok, sizeof(ok)) < 0)
+    return "IP_PKTINFO";
+
+  return NULL;
+}
+
+static void
+sysio_process_rx_cmsgs(sock *s, struct msghdr *msg)
+{
+  struct cmsghdr *cm;
+  struct in_pktinfo *pi = NULL;
+
+  if (!(s->flags & SKF_LADDR_RX))
+    return;
+
+  for (cm = CMSG_FIRSTHDR(msg); cm != NULL; cm = CMSG_NXTHDR(msg, cm))
+    {
+      if (cm->cmsg_level == IPPROTO_IP && cm->cmsg_type == IP_PKTINFO)
+	pi = (struct in_pktinfo *) CMSG_DATA(cm);
+    }
+
+  if (!pi)
+    {
+      s->laddr = IPA_NONE;
+      s->lifindex = 0;
+      return;
+    }
+
+  get_inaddr(&s->laddr, &pi->ipi_addr);
+  s->lifindex = pi->ipi_ifindex;
+  return;
+}
+
+
+void
+sysio_prepare_tx_cmsgs(sock *s, struct msghdr *msg)
+{
+  struct cmsghdr *cm;
+  struct in_pktinfo *pi;
+
+  if (!(s->flags & SKF_LADDR_TX))
+    {
+      msg->msg_controllen = 0;
+      return;
+    }
+
+  cm = CMSG_FIRSTHDR(msg);
+  cm->cmsg_level = IPPROTO_IP;
+  cm->cmsg_type = IP_PKTINFO;
+  cm->cmsg_len = CMSG_LEN(sizeof(*pi));
+
+  pi = (struct in_pktinfo *) CMSG_DATA(cm);
+  set_inaddr(&pi->ipi_spec_dst, s->saddr);
+  pi->ipi_ifindex = s->iface ? s->iface->index : 0;
+
+  msg->msg_controllen = cm->cmsg_len;
+}
+#endif
diff --git a/sysdep/unix/io.c b/sysdep/unix/io.c
index d86c8cb8..e9d78b61 100644
--- a/sysdep/unix/io.c
+++ b/sysdep/unix/io.c
@@ -685,7 +685,7 @@ static char *
 sk_setup(sock *s)
 {
   int fd = s->fd;
-  char *err;
+  char *err = NULL;
 
   if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
     ERR("fcntl(O_NONBLOCK)");
@@ -704,9 +704,8 @@ sk_setup(sock *s)
 
   if (s->ttl >= 0)
     err = sk_set_ttl_int(s);
-  else
-    err = NULL;
 
+  sysio_register_cmsgs(s);
 bad:
   return err;
 }
@@ -857,6 +856,72 @@ sk_leave_group(sock *s, ip_addr maddr)
   return 0;
 }
 
+/* PKTINFO handling is also standardized in IPv6 */
+#define CMSG_RX_SPACE CMSG_SPACE(sizeof(struct in6_pktinfo))
+
+static char *
+sysio_register_cmsgs(sock *s)
+{
+  int ok = 1;
+  if ((s->flags & SKF_LADDR_RX) &&
+      setsockopt(s->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &ok, sizeof(ok)) < 0)
+    return "IPV6_RECVPKTINFO";
+
+  return NULL;
+}
+
+void
+sysio_process_rx_cmsgs(sock *s, struct msghdr *msg)
+{
+  struct cmsghdr *cm;
+  struct in6_pktinfo *pi = NULL;
+
+  if (!(s->flags & SKF_LADDR_RX))
+    return;
+
+  for (cm = CMSG_FIRSTHDR(msg); cm != NULL; cm = CMSG_NXTHDR(msg, cm))
+    {
+      if (cm->cmsg_level == IPPROTO_IPV6 && cm->cmsg_type == IPV6_PKTINFO)
+	pi = (struct in6_pktinfo *) CMSG_DATA(cm);
+    }
+
+  if (!pi)
+    {
+      s->laddr = IPA_NONE;
+      s->lifindex = 0;
+      return;
+    }
+
+  get_inaddr(&s->laddr, &pi->ipi6_addr);
+  s->lifindex = pi->ipi6_ifindex;
+  return;
+}
+
+void
+sysio_prepare_tx_cmsgs(sock *s, struct msghdr *msg)
+{
+  struct cmsghdr *cm;
+  struct in6_pktinfo *pi;
+
+  if (!(s->flags & SKF_LADDR_TX))
+    {
+      msg->msg_controllen = 0;
+      return;
+    }
+
+  cm = CMSG_FIRSTHDR(msg);
+  cm->cmsg_level = IPPROTO_IPV6;
+  cm->cmsg_type = PIV6_PKTINFO;
+  cm->cmsg_len = CMSG_LEN(sizeof(*pi));
+
+  pi = (struct in6_pktinfo *) CMSG_DATA(cm);
+  set_inaddr(&pi->ipi6_addr, s->saddr);
+  pi->ipi6_ifindex = s->iface ? s->iface->index : 0;
+
+  msg->msg_controllen = cmsg->cmsg_len;
+  return;
+}
+
 #else /* IPV4 */
 
 int
@@ -1105,6 +1170,8 @@ sk_open_unix(sock *s, char *name)
   die("Unable to create control socket %s", name);
 }
 
+static inline void reset_tx_buffer(sock *s) { s->ttx = s->tpos = s->tbuf; }
+
 static int
 sk_maybe_write(sock *s)
 {
@@ -1122,7 +1189,7 @@ sk_maybe_write(sock *s)
 	    {
 	      if (errno != EINTR && errno != EAGAIN)
 		{
-                  s->ttx = s->tpos;	/* empty tx buffer */
+		  reset_tx_buffer(s);
 		  s->err_hook(s, errno);
 		  return -1;
 		}
@@ -1130,30 +1197,44 @@ sk_maybe_write(sock *s)
 	    }
 	  s->ttx += e;
 	}
-      s->ttx = s->tpos = s->tbuf;
+      reset_tx_buffer(s);
       return 1;
     case SK_UDP:
     case SK_IP:
       {
-	sockaddr sa;
-
 	if (s->tbuf == s->tpos)
 	  return 1;
 
-	fill_in_sockaddr(&sa, s->faddr, s->fport);
+	sockaddr sa;
+	fill_in_sockaddr(&sa, s->daddr, s->dport);
 	fill_in_sockifa(&sa, s->iface);
-	e = sendto(s->fd, s->tbuf, s->tpos - s->tbuf, 0, (struct sockaddr *) &sa, sizeof(sa));
+
+	struct iovec iov = {s->tbuf, s->tpos - s->tbuf};
+	byte cmsg_buf[CMSG_TX_SPACE];
+
+	struct msghdr msg = {
+	  .msg_name = &sa,
+	  .msg_namelen = sizeof(sa),
+	  .msg_iov = &iov,
+	  .msg_iovlen = 1,
+	  .msg_control = cmsg_buf,
+	  .msg_controllen = sizeof(cmsg_buf),
+	  .msg_flags = 0};
+
+	sysio_prepare_tx_cmsgs(s, &msg);
+	e = sendmsg(s->fd, &msg, 0);
+
 	if (e < 0)
 	  {
 	    if (errno != EINTR && errno != EAGAIN)
 	      {
-                s->ttx = s->tpos;	/* empty tx buffer */
+		reset_tx_buffer(s);
 		s->err_hook(s, errno);
 		return -1;
 	      }
 	    return 0;
 	  }
-	s->tpos = s->tbuf;
+	reset_tx_buffer(s);
 	return 1;
       }
     default:
@@ -1199,8 +1280,6 @@ sk_rx_ready(sock *s)
 int
 sk_send(sock *s, unsigned len)
 {
-  s->faddr = s->daddr;
-  s->fport = s->dport;
   s->ttx = s->tbuf;
   s->tpos = s->tbuf + len;
   return sk_maybe_write(s);
@@ -1219,13 +1298,28 @@ sk_send(sock *s, unsigned len)
 int
 sk_send_to(sock *s, unsigned len, ip_addr addr, unsigned port)
 {
-  s->faddr = addr;
-  s->fport = port;
+  s->daddr = addr;
+  s->dport = port;
   s->ttx = s->tbuf;
   s->tpos = s->tbuf + len;
   return sk_maybe_write(s);
 }
 
+/*
+int
+sk_send_full(sock *s, unsigned len, struct iface *ifa,
+	     ip_addr saddr, ip_addr daddr, unsigned dport)
+{
+  s->iface = ifa;
+  s->saddr = saddr;
+  s->daddr = daddr;
+  s->dport = dport;
+  s->ttx = s->tbuf;
+  s->tpos = s->tbuf + len;
+  return sk_maybe_write(s);
+}
+*/
+
 static int
 sk_read(sock *s)
 {
@@ -1271,8 +1365,21 @@ sk_read(sock *s)
     default:
       {
 	sockaddr sa;
-	int al = sizeof(sa);
-	int e = recvfrom(s->fd, s->rbuf, s->rbsize, 0, (struct sockaddr *) &sa, &al);
+	int e;
+
+	struct iovec iov = {s->rbuf, s->rbsize};
+	byte cmsg_buf[CMSG_RX_SPACE];
+
+	struct msghdr msg = {
+	  .msg_name = &sa,
+	  .msg_namelen = sizeof(sa),
+	  .msg_iov = &iov,
+	  .msg_iovlen = 1,
+	  .msg_control = cmsg_buf,
+	  .msg_controllen = sizeof(cmsg_buf),
+	  .msg_flags = 0};
+
+	e = recvmsg(s->fd, &msg, 0);
 
 	if (e < 0)
 	  {
@@ -1282,6 +1389,8 @@ sk_read(sock *s)
 	  }
 	s->rpos = s->rbuf + e;
 	get_sockaddr(&sa, &s->faddr, &s->fport, 1);
+	sysio_process_rx_cmsgs(s, &msg);
+
 	s->rx_hook(s, e);
 	return 1;
       }