26 files changed, 287 insertions, 187 deletions

diff --git a/babeld/babel_interface.h b/babeld/babel_interface.h
index e9567ab4f8..17d9bfb936 100644
--- a/babeld/babel_interface.h
+++ b/babeld/babel_interface.h
@@ -50,7 +50,7 @@ struct babel_interface {
     char have_buffered_id;
     char have_buffered_nh;
     char have_buffered_prefix;
-    unsigned char buffered_id[16];
+    unsigned char buffered_id[8];
     unsigned char buffered_nh[4];
     unsigned char buffered_prefix[16];
     unsigned char *sendbuf;
diff --git a/babeld/message.c b/babeld/message.c
index ea378240be..1ff4867908 100644
--- a/babeld/message.c
+++ b/babeld/message.c
@@ -1080,7 +1080,7 @@ really_send_update(struct interface *ifp,
             accumulate_bytes(ifp, id, 8);
             end_message(ifp, MESSAGE_ROUTER_ID, 10);
         }
-        memcpy(babel_ifp->buffered_id, id, 16);
+        memcpy(babel_ifp->buffered_id, id, sizeof(babel_ifp->buffered_id));
         babel_ifp->have_buffered_id = 1;
     }
 
diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index 762519715c..0c2a2f6fe9 100644
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -11464,12 +11464,6 @@ void bgp_route_init(void)
 	install_element(BGP_IPV6M_NODE, &ipv6_bgp_network_cmd);
 	install_element(BGP_IPV6M_NODE, &no_ipv6_bgp_network_cmd);
 
-	install_element(BGP_IPV6L_NODE, &bgp_table_map_cmd);
-	install_element(BGP_IPV6L_NODE, &ipv6_bgp_network_cmd);
-	install_element(BGP_IPV6L_NODE, &ipv6_bgp_network_route_map_cmd);
-	install_element(BGP_IPV6L_NODE, &no_bgp_table_map_cmd);
-	install_element(BGP_IPV6L_NODE, &no_ipv6_bgp_network_cmd);
-
 	install_element(BGP_NODE, &bgp_distance_cmd);
 	install_element(BGP_NODE, &no_bgp_distance_cmd);
 	install_element(BGP_NODE, &bgp_distance_source_cmd);
diff --git a/bgpd/bgp_zebra.c b/bgpd/bgp_zebra.c
index 53c5762cea..ddf461f1b1 100644
--- a/bgpd/bgp_zebra.c
+++ b/bgpd/bgp_zebra.c
@@ -224,6 +224,10 @@ static int bgp_interface_delete(int command, struct zclient *zclient,
 	struct interface *ifp;
 	struct bgp *bgp;
 
+	bgp = bgp_lookup_by_vrf_id(vrf_id);
+	if (!bgp)
+		return 0;
+
 	s = zclient->ibuf;
 	ifp = zebra_interface_state_read(s, vrf_id);
 	if (!ifp) /* This may happen if we've just unregistered for a VRF. */
@@ -232,10 +236,6 @@ static int bgp_interface_delete(int command, struct zclient *zclient,
 	if (BGP_DEBUG(zebra, ZEBRA))
 		zlog_debug("Rx Intf del VRF %u IF %s", vrf_id, ifp->name);
 
-	bgp = bgp_lookup_by_vrf_id(vrf_id);
-	if (!bgp)
-		return 0;
-
 	bgp_update_interface_nbrs(bgp, ifp, NULL);
 
 	if_set_index(ifp, IFINDEX_INTERNAL);
@@ -252,6 +252,10 @@ static int bgp_interface_up(int command, struct zclient *zclient,
 	struct listnode *node, *nnode;
 	struct bgp *bgp;
 
+	bgp = bgp_lookup_by_vrf_id(vrf_id);
+	if (!bgp)
+		return 0;
+
 	s = zclient->ibuf;
 	ifp = zebra_interface_state_read(s, vrf_id);
 
@@ -261,10 +265,6 @@ static int bgp_interface_up(int command, struct zclient *zclient,
 	if (BGP_DEBUG(zebra, ZEBRA))
 		zlog_debug("Rx Intf up VRF %u IF %s", vrf_id, ifp->name);
 
-	bgp = bgp_lookup_by_vrf_id(vrf_id);
-	if (!bgp)
-		return 0;
-
 	for (ALL_LIST_ELEMENTS(ifp->connected, node, nnode, c))
 		bgp_connected_add(bgp, c);
 
@@ -284,6 +284,10 @@ static int bgp_interface_down(int command, struct zclient *zclient,
 	struct listnode *node, *nnode;
 	struct bgp *bgp;
 
+	bgp = bgp_lookup_by_vrf_id(vrf_id);
+	if (!bgp)
+		return 0;
+
 	s = zclient->ibuf;
 	ifp = zebra_interface_state_read(s, vrf_id);
 	if (!ifp)
@@ -292,10 +296,6 @@ static int bgp_interface_down(int command, struct zclient *zclient,
 	if (BGP_DEBUG(zebra, ZEBRA))
 		zlog_debug("Rx Intf down VRF %u IF %s", vrf_id, ifp->name);
 
-	bgp = bgp_lookup_by_vrf_id(vrf_id);
-	if (!bgp)
-		return 0;
-
 	for (ALL_LIST_ELEMENTS(ifp->connected, node, nnode, c))
 		bgp_connected_delete(bgp, c);
 
@@ -338,6 +338,11 @@ static int bgp_interface_address_add(int command, struct zclient *zclient,
 				     zebra_size_t length, vrf_id_t vrf_id)
 {
 	struct connected *ifc;
+	struct bgp *bgp;
+
+	bgp = bgp_lookup_by_vrf_id(vrf_id);
+	if (!bgp)
+		return 0;
 
 	ifc = zebra_interface_address_read(command, zclient->ibuf, vrf_id);
 
@@ -352,13 +357,8 @@ static int bgp_interface_address_add(int command, struct zclient *zclient,
 	}
 
 	if (if_is_operative(ifc->ifp)) {
-		struct bgp *bgp;
-
-		bgp = bgp_lookup_by_vrf_id(vrf_id);
-		if (!bgp)
-			return 0;
-
 		bgp_connected_add(bgp, ifc);
+
 		/* If we have learnt of any neighbors on this interface,
 		 * check to kick off any BGP interface-based neighbors,
 		 * but only if this is a link-local address.
@@ -377,6 +377,10 @@ static int bgp_interface_address_delete(int command, struct zclient *zclient,
 	struct connected *ifc;
 	struct bgp *bgp;
 
+	bgp = bgp_lookup_by_vrf_id(vrf_id);
+	if (!bgp)
+		return 0;
+
 	ifc = zebra_interface_address_read(command, zclient->ibuf, vrf_id);
 
 	if (ifc == NULL)
@@ -390,9 +394,7 @@ static int bgp_interface_address_delete(int command, struct zclient *zclient,
 	}
 
 	if (if_is_operative(ifc->ifp)) {
-		bgp = bgp_lookup_by_vrf_id(vrf_id);
-		if (bgp)
-			bgp_connected_delete(bgp, ifc);
+		bgp_connected_delete(bgp, ifc);
 	}
 
 	connected_free(ifc);
diff --git a/configure.ac b/configure.ac
index 2faaa7fc8e..cae5061122 100755
--- a/configure.ac
+++ b/configure.ac
@@ -185,6 +185,23 @@ CC="${CC% -std=c99}"
 
 AC_C_FLAG([-std=gnu11], [CC="$ac_cc"], [CC="$CC -std=gnu11"])
 
+dnl if the user has specified any CFLAGS, override our settings
+if test "x${enable_dev_build}" = "xyes"; then
+   AC_DEFINE(DEV_BUILD,,Build for development)
+   if test "z$orig_cflags" = "z"; then
+      AC_C_FLAG([-g3])
+      AC_C_FLAG([-O0])
+   fi
+else
+   if test "z$orig_cflags" = "z"; then
+      AC_C_FLAG([-g])
+      AC_C_FLAG([-Os], [
+        AC_C_FLAG([-O2])
+      ])
+   fi
+fi
+AM_CONDITIONAL([DEV_BUILD], [test "x$enable_dev_build" = "xyes"])
+
 dnl always want these CFLAGS
 AC_C_FLAG([-fno-omit-frame-pointer])
 AC_C_FLAG([-funwind-tables])
@@ -428,21 +445,6 @@ fi
 
 AM_CONDITIONAL([FPM], [test "x$enable_fpm" = "xyes"])
 
-if test "x${enable_dev_build}" = "xyes"; then
-   AC_DEFINE(DEV_BUILD,,Build for development)
-   AC_C_FLAG([-g])
-   AC_C_FLAG([-O0])
-else
-   dnl if the user specified any CFLAGS, we don't add "-g -Os/-O2" here
-   if test "z$orig_cflags" = "z"; then
-     AC_C_FLAG([-g])
-     AC_C_FLAG([-Os], [
-       AC_C_FLAG([-O2])
-     ])
-   fi
-fi
-AM_CONDITIONAL([DEV_BUILD], [test "x$enable_dev_build" = "xyes"])
-
 #
 # Python for clippy
 #
diff --git a/doc/install.texi b/doc/install.texi
index 9a98f46733..1930af95e6 100644
--- a/doc/install.texi
+++ b/doc/install.texi
@@ -97,6 +97,10 @@ Controls backtrace support for the crash handlers. This is autodetected by
 default. Using the switch will enforce the requested behaviour, failing with
 an error if support is requested but not available.  On BSD systems, this
 needs libexecinfo, while on glibc support for this is part of libc itself.
+@item --enable-dev-build
+Turn on some options for compiling FRR within a development environment in
+mind.  Specifically turn on -g3 -O0 for compiling options and add inclusion
+of grammar sandbox.
 @end table
 
 You may specify any combination of the above options to the configure
diff --git a/isisd/isis_pdu.c b/isisd/isis_pdu.c
index be989cbabb..9c68fe5966 100644
--- a/isisd/isis_pdu.c
+++ b/isisd/isis_pdu.c
@@ -1546,8 +1546,11 @@ int send_hello(struct isis_circuit *circuit, int level)
 
 	isis_tlvs_add_auth(tlvs, &circuit->passwd);
 
-	if (!listcount(circuit->area->area_addrs))
+	if (!listcount(circuit->area->area_addrs)) {
+		isis_free_tlvs(tlvs);
 		return ISIS_WARNING;
+	}
+
 	isis_tlvs_add_area_addresses(tlvs, circuit->area->area_addrs);
 
 	if (circuit->circ_type == CIRCUIT_T_BROADCAST)
diff --git a/ldpd/lde.c b/ldpd/lde.c
index 648eefa653..a7f933bbe5 100644
--- a/ldpd/lde.c
+++ b/ldpd/lde.c
@@ -185,11 +185,14 @@ lde_shutdown(void)
 	if (iev_ldpe) {
 		msgbuf_clear(&iev_ldpe->ibuf.w);
 		close(iev_ldpe->ibuf.fd);
+		iev_ldpe->ibuf.fd = -1;
 	}
 	msgbuf_clear(&iev_main->ibuf.w);
 	close(iev_main->ibuf.fd);
+	iev_main->ibuf.fd = -1;
 	msgbuf_clear(&iev_main_sync->ibuf.w);
 	close(iev_main_sync->ibuf.fd);
+	iev_main_sync->ibuf.fd = -1;
 
 	lde_gc_stop_timer();
 	lde_nbr_clear();
@@ -210,12 +213,16 @@ lde_shutdown(void)
 int
 lde_imsg_compose_parent(int type, pid_t pid, void *data, uint16_t datalen)
 {
+	if (iev_main->ibuf.fd == -1)
+		return (0);
 	return (imsg_compose_event(iev_main, type, 0, pid, -1, data, datalen));
 }
 
 void
 lde_imsg_compose_parent_sync(int type, pid_t pid, void *data, uint16_t datalen)
 {
+	if (iev_main_sync->ibuf.fd == -1)
+		return;
 	imsg_compose_event(iev_main_sync, type, 0, pid, -1, data, datalen);
 	imsg_flush(&iev_main_sync->ibuf);
 }
@@ -224,6 +231,8 @@ int
 lde_imsg_compose_ldpe(int type, uint32_t peerid, pid_t pid, void *data,
     uint16_t datalen)
 {
+	if (iev_ldpe->ibuf.fd == -1)
+		return (0);
 	return (imsg_compose_event(iev_ldpe, type, peerid, pid,
 	     -1, data, datalen));
 }
diff --git a/ldpd/ldpe.c b/ldpd/ldpe.c
index 3c8f8135e9..9d00bcd2b6 100644
--- a/ldpd/ldpe.c
+++ b/ldpd/ldpe.c
@@ -190,15 +190,16 @@ ldpe_shutdown(void)
 
 	/* close pipes */
 	if (iev_lde) {
-		msgbuf_write(&iev_lde->ibuf.w);
 		msgbuf_clear(&iev_lde->ibuf.w);
 		close(iev_lde->ibuf.fd);
+		iev_lde->ibuf.fd = -1;
 	}
-	msgbuf_write(&iev_main->ibuf.w);
 	msgbuf_clear(&iev_main->ibuf.w);
 	close(iev_main->ibuf.fd);
+	iev_main->ibuf.fd = -1;
 	msgbuf_clear(&iev_main_sync->ibuf.w);
 	close(iev_main_sync->ibuf.fd);
+	iev_main_sync->ibuf.fd = -1;
 
 	control_cleanup(ctl_sock_path);
 	config_clear(leconf);
@@ -236,12 +237,16 @@ ldpe_shutdown(void)
 int
 ldpe_imsg_compose_parent(int type, pid_t pid, void *data, uint16_t datalen)
 {
+	if (iev_main->ibuf.fd == -1)
+		return (0);
 	return (imsg_compose_event(iev_main, type, 0, pid, -1, data, datalen));
 }
 
 void
 ldpe_imsg_compose_parent_sync(int type, pid_t pid, void *data, uint16_t datalen)
 {
+	if (iev_main_sync->ibuf.fd == -1)
+		return;
 	imsg_compose_event(iev_main_sync, type, 0, pid, -1, data, datalen);
 	imsg_flush(&iev_main_sync->ibuf);
 }
@@ -250,6 +255,8 @@ int
 ldpe_imsg_compose_lde(int type, uint32_t peerid, pid_t pid, void *data,
     uint16_t datalen)
 {
+	if (iev_lde->ibuf.fd == -1)
+		return (0);
 	return (imsg_compose_event(iev_lde, type, peerid, pid, -1,
 	    data, datalen));
 }
diff --git a/ldpd/packet.c b/ldpd/packet.c
index be7f2ba649..4a4b258b91 100644
--- a/ldpd/packet.c
+++ b/ldpd/packet.c
@@ -494,7 +494,7 @@ session_read(struct thread *thread)
 			msg_len = ntohs(msg->length);
 			if (msg_len < LDP_MSG_LEN ||
 			    (msg_len + LDP_MSG_DEAD_LEN) > pdu_len) {
-				session_shutdown(nbr, S_BAD_TLV_LEN, msg->id,
+				session_shutdown(nbr, S_BAD_MSG_LEN, msg->id,
 				    msg->type);
 				free(buf);
 				return (0);
diff --git a/lib/command.h b/lib/command.h
index 8cccb62de3..e2d31decd4 100644
--- a/lib/command.h
+++ b/lib/command.h
@@ -380,6 +380,13 @@ extern void uninstall_element(enum node_type, struct cmd_element *);
    string with a space between each element (allocated using
    XMALLOC(MTYPE_TMP)).  Returns NULL if shift >= argc. */
 extern char *argv_concat(struct cmd_token **argv, int argc, int shift);
+
+/*
+ * It is preferred that you set the index initial value
+ * to a 0.  This way in the future if you modify the
+ * cli then there is no need to modify the initial
+ * value of the index
+ */
 extern int argv_find(struct cmd_token **argv, int argc, const char *text,
 		     int *index);
 
diff --git a/lib/csv.c b/lib/csv.c
index 136d77ae0b..27d0fe4029 100644
--- a/lib/csv.c
+++ b/lib/csv.c
@@ -284,8 +284,11 @@ csv_record_t *csv_encode_record(csv_t *csv, csv_record_t *rec, int count, ...)
 
 	va_start(list, count);
 	str = csv_field_iter(rec, &fld);
-	if (!fld)
+	if (!fld) {
+		va_end(list);
 		return NULL;
+	}
+
 	for (tempc = 0; tempc < count; tempc++) {
 		col = va_arg(list, char *);
 		for (i = 0; i < fld->field_len; i++) {
diff --git a/lib/workqueue.c b/lib/workqueue.c
index 643ed2d2b8..952012a006 100644
--- a/lib/workqueue.c
+++ b/lib/workqueue.c
@@ -57,6 +57,22 @@ static void work_queue_item_free(struct work_queue_item *item)
 	return;
 }
 
+static void work_queue_item_remove(struct work_queue *wq,
+				   struct work_queue_item *item)
+{
+	assert(item && item->data);
+
+	/* call private data deletion callback if needed */
+	if (wq->spec.del_item_data)
+		wq->spec.del_item_data(wq, item->data);
+
+	work_queue_item_dequeue(wq, item);
+
+	work_queue_item_free(item);
+
+	return;
+}
+
 /* create new work queue */
 struct work_queue *work_queue_new(struct thread_master *m,
 				  const char *queue_name)
@@ -90,6 +106,12 @@ void work_queue_free(struct work_queue *wq)
 	if (wq->thread != NULL)
 		thread_cancel(wq->thread);
 
+	while (!work_queue_empty(wq)) {
+		struct work_queue_item *item = work_queue_last_item(wq);
+
+		work_queue_item_remove(wq, item);
+	}
+
 	listnode_delete(work_queues, wq);
 
 	XFREE(MTYPE_WORK_QUEUE_NAME, wq->name);
@@ -137,22 +159,6 @@ void work_queue_add(struct work_queue *wq, void *data)
 	return;
 }
 
-static void work_queue_item_remove(struct work_queue *wq,
-				   struct work_queue_item *item)
-{
-	assert(item && item->data);
-
-	/* call private data deletion callback if needed */
-	if (wq->spec.del_item_data)
-		wq->spec.del_item_data(wq, item->data);
-
-	work_queue_item_dequeue(wq, item);
-
-	work_queue_item_free(item);
-
-	return;
-}
-
 static void work_queue_item_requeue(struct work_queue *wq, struct work_queue_item *item)
 {
 	work_queue_item_dequeue(wq, item);
diff --git a/ospf6d/ospf6_proto.h b/ospf6d/ospf6_proto.h
index 174b5a4f0f..5919190854 100644
--- a/ospf6d/ospf6_proto.h
+++ b/ospf6d/ospf6_proto.h
@@ -62,6 +62,7 @@ struct ospf6_prefix {
 #define prefix_metric        u._prefix_metric
 #define prefix_refer_lstype  u._prefix_referenced_lstype
 	/* followed by one address_prefix */
+	struct in6_addr addr[];
 };
 
 #define OSPF6_PREFIX_OPTION_NU (1 << 0)  /* No Unicast */
diff --git a/ospfd/ospf_lsa.c b/ospfd/ospf_lsa.c
index 1795225ca7..74d5178f55 100644
--- a/ospfd/ospf_lsa.c
+++ b/ospfd/ospf_lsa.c
@@ -1702,7 +1702,7 @@ static void ospf_install_flood_nssa(struct ospf *ospf, struct ospf_lsa *lsa,
 			not adversited into OSPF as an internal OSPF route and
 			the
 			type-7 LSA's P-bit is set a forwarding address should be
-			selected from one of the router's active OSPF inteface
+			selected from one of the router's active OSPF interface
 			addresses
 			which belong to the NSSA.  If no such addresses exist,
 			then
diff --git a/ospfd/ospf_network.c b/ospfd/ospf_network.c
index d1c1429054..699f2341d5 100644
--- a/ospfd/ospf_network.c
+++ b/ospfd/ospf_network.c
@@ -220,8 +220,10 @@ int ospf_sock_init(struct ospf *ospf)
 	}
 
 	ret = ospf_bind_vrfdevice(ospf, ospf_sock);
-	if (ret < 0)
+	if (ret < 0) {
+		close(ospf_sock);
 		goto out;
+	}
 
 #ifdef IP_HDRINCL
 	/* we will include IP header with packet */
@@ -232,6 +234,7 @@ int ospf_sock_init(struct ospf *ospf)
 
 		zlog_warn("Can't set IP_HDRINCL option for fd %d: %s",
 			  ospf_sock, safe_strerror(save_errno));
+		close(ospf_sock);
 		goto out;
 	}
 #elif defined(IPTOS_PREC_INTERNETCONTROL)
diff --git a/ospfd/ospf_ri.c b/ospfd/ospf_ri.c
index d5769c866e..69f6883186 100644
--- a/ospfd/ospf_ri.c
+++ b/ospfd/ospf_ri.c
@@ -659,6 +659,7 @@ static int ospf_router_info_lsa_originate1(void *arg)
 	if (top == NULL) {
 		zlog_debug("%s: ospf instance not found for vrf id %u",
 			   __PRETTY_FUNCTION__, vrf_id);
+		ospf_lsa_unlock(&new);
 		return rc;
 	}
 
diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 86f7e7a53d..b13e833afd 100644
--- a/ospfd/ospf_te.c
+++ b/ospfd/ospf_te.c
@@ -1167,8 +1167,10 @@ static struct ospf_lsa *ospf_mpls_te_lsa_new(struct ospf *ospf,
 		tmp = SET_OPAQUE_LSID(OPAQUE_TYPE_INTER_AS_LSA, lp->instance);
 		lsa_id.s_addr = htonl(tmp);
 
-		if (!ospf)
+		if (!ospf) {
+			stream_free(s);
 			return NULL;
+		}
 
 		lsa_header_set(s, options, lsa_type, lsa_id, ospf->router_id);
 	} else {
diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
index 087cb6f89e..f53efa4355 100644
--- a/ospfd/ospf_vty.c
+++ b/ospfd/ospf_vty.c
@@ -171,6 +171,18 @@ static struct ospf *ospf_cmd_lookup_ospf(struct vty *vty,
 	return ospf;
 }
 
+static void ospf_show_vrf_name(struct ospf *ospf, struct vty *vty,
+			       json_object *json)
+{
+	if (ospf->name) {
+		if (json)
+			json_object_string_add(json, "vrfName", ospf->name);
+		else
+			vty_out(vty, "VRF Name: %s\n", ospf->name);
+	}
+
+}
+
 #ifndef VTYSH_EXTRACT_PL
 #include "ospf_vty_clippy.c"
 #endif
@@ -2891,6 +2903,8 @@ static int show_ip_ospf_common(struct vty *vty, struct ospf *ospf,
 		}
 	}
 
+	ospf_show_vrf_name(ospf, vty, json);
+
 	/* Show Router ID. */
 	if (use_json) {
 		json_object_string_add(json, "routerId",
@@ -3857,6 +3871,8 @@ static int show_ip_ospf_neighbor_common(struct vty *vty, struct ospf *ospf,
 			vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 	}
 
+	ospf_show_vrf_name(ospf, vty, json);
+
 	for (ALL_LIST_ELEMENTS_RO(ospf->oiflist, node, oi))
 		show_ip_ospf_neighbor_sub(vty, oi, json, use_json);
 
@@ -4146,6 +4162,8 @@ static int show_ip_ospf_neighbor_int_common(struct vty *vty, struct ospf *ospf,
 			vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 	}
 
+	ospf_show_vrf_name(ospf, vty, json);
+
 	/*ifp = if_lookup_by_name(argv[arg_base]->arg, ospf->vrf_id);*/
 	ifp = if_lookup_by_name_all_vrf(argv[arg_base]->arg);
 	if (!ifp) {
@@ -4558,6 +4576,8 @@ static int show_ip_ospf_neighbor_id_common(struct vty *vty, struct ospf *ospf,
 			vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 	}
 
+	ospf_show_vrf_name(ospf, vty, json);
+
 	ret = inet_aton(argv[arg_base]->arg, &router_id);
 	if (!ret) {
 		if (!use_json)
@@ -4657,6 +4677,8 @@ static int show_ip_ospf_neighbor_detail_common(struct vty *vty,
 			vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 	}
 
+	ospf_show_vrf_name(ospf, vty, json);
+
 	for (ALL_LIST_ELEMENTS_RO(ospf->oiflist, node, oi)) {
 		struct route_node *rn;
 		struct ospf_neighbor *nbr;
@@ -4781,6 +4803,8 @@ static int show_ip_ospf_neighbor_detail_all_common(struct vty *vty,
 			vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 	}
 
+	ospf_show_vrf_name(ospf, vty, json);
+
 	for (ALL_LIST_ELEMENTS_RO(ospf->oiflist, node, oi)) {
 		struct route_node *rn;
 		struct ospf_neighbor *nbr;
@@ -5591,6 +5615,8 @@ static int show_ip_ospf_database_common(struct vty *vty, struct ospf *ospf,
 	if (ospf->instance)
 		vty_out(vty, "\nOSPF Instance: %d\n", ospf->instance);
 
+	ospf_show_vrf_name(ospf, vty, NULL);
+
 	vty_out(vty, "\n       OSPF Router with ID (%s)\n\n",
 		inet_ntoa(ospf->router_id));
 
@@ -5812,6 +5838,8 @@ static int show_ip_ospf_database_type_adv_router_common(struct vty *vty,
 	if (ospf->instance)
 		vty_out(vty, "\nOSPF Instance: %d\n", ospf->instance);
 
+	ospf_show_vrf_name(ospf, vty, NULL);
+
 	vty_out(vty, "\n       OSPF Router with ID (%s)\n\n",
 		inet_ntoa(ospf->router_id));
 
@@ -8368,6 +8396,8 @@ static int show_ip_ospf_border_routers_common(struct vty *vty,
 	if (ospf->instance)
 		vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 
+	ospf_show_vrf_name(ospf, vty, NULL);
+
 	if (ospf->new_table == NULL) {
 		vty_out(vty, "No OSPF routing information exist\n");
 		return CMD_SUCCESS;
@@ -8460,6 +8490,8 @@ static int show_ip_ospf_route_common(struct vty *vty, struct ospf *ospf)
 	if (ospf->instance)
 		vty_out(vty, "\nOSPF Instance: %d\n\n", ospf->instance);
 
+	ospf_show_vrf_name(ospf, vty, NULL);
+
 	if (ospf->new_table == NULL) {
 		vty_out(vty, "No OSPF routing information exist\n");
 		return CMD_SUCCESS;
diff --git a/ospfd/ospf_zebra.c b/ospfd/ospf_zebra.c
index 3f94e6b4e2..7e6146e0d3 100644
--- a/ospfd/ospf_zebra.c
+++ b/ospfd/ospf_zebra.c
@@ -1133,12 +1133,16 @@ void ospf_distribute_list_update(struct ospf *ospf, int type,
 
 	/* External info does not exist. */
 	ext = ospf_external_lookup(type, instance);
-	if (!ext || !(rt = EXTERNAL_INFO(ext)))
+	if (!ext || !(rt = EXTERNAL_INFO(ext))) {
+		XFREE(MTYPE_OSPF_DIST_ARGS, args);
 		return;
+	}
 
 	/* If exists previously invoked thread, then let it continue. */
-	if (ospf->t_distribute_update)
+	if (ospf->t_distribute_update) {
+		XFREE(MTYPE_OSPF_DIST_ARGS, args);
 		return;
+	}
 
 	/* Set timer. */
 	ospf->t_distribute_update = NULL;
diff --git a/ospfd/ospfd.c b/ospfd/ospfd.c
index 25a1ea2c8d..9e1cf81160 100644
--- a/ospfd/ospfd.c
+++ b/ospfd/ospfd.c
@@ -635,6 +635,7 @@ static void ospf_finish_final(struct ospf *ospf)
 	/* Reset interface. */
 	for (ALL_LIST_ELEMENTS(ospf->oiflist, node, nnode, oi))
 		ospf_if_free(oi);
+	list_delete_and_null(&ospf->oiflist);
 
 	/* De-Register VRF */
 	ospf_zebra_vrf_deregister(ospf);
@@ -737,7 +738,6 @@ static void ospf_finish_final(struct ospf *ospf)
 
 	list_delete_and_null(&ospf->areas);
 	list_delete_and_null(&ospf->oi_write_q);
-	list_delete_and_null(&ospf->oiflist);
 
 	for (i = ZEBRA_ROUTE_SYSTEM; i <= ZEBRA_ROUTE_MAX; i++) {
 		struct list *ext_list;
@@ -829,6 +829,8 @@ static void ospf_area_free(struct ospf_area *area)
 	struct route_node *rn;
 	struct ospf_lsa *lsa;
 
+	ospf_opaque_type10_lsa_term(area);
+
 	/* Free LSDBs. */
 	LSDB_LOOP(ROUTER_LSDB(area), rn, lsa)
 	ospf_discard_from_db(area->ospf, area->lsdb, lsa);
diff --git a/pimd/pim_cmd.c b/pimd/pim_cmd.c
index e3fc0b431f..a9239c2835 100644
--- a/pimd/pim_cmd.c
+++ b/pimd/pim_cmd.c
@@ -1054,58 +1054,48 @@ static void pim_show_interfaces_single(struct pim_instance *pim,
 			// FHR
 			for (ALL_LIST_ELEMENTS_RO(pim->upstream_list, upnode,
 						  up)) {
-				if (ifp == up->rpf.source_nexthop.interface) {
-					if (up->flags
-					    & PIM_UPSTREAM_FLAG_MASK_FHR) {
-						if (!json_fhr_sources) {
-							json_fhr_sources =
-								json_object_new_object();
-						}
-
-						pim_inet4_dump("<src?>",
-							       up->sg.src,
-							       src_str,
-							       sizeof(src_str));
-						pim_inet4_dump("<grp?>",
-							       up->sg.grp,
-							       grp_str,
-							       sizeof(grp_str));
-						pim_time_uptime(
-							uptime, sizeof(uptime),
-							now - up->state_transition);
-
-						/* Does this group live in
-						 * json_fhr_sources?  If not
-						 * create it. */
-						json_object_object_get_ex(
-							json_fhr_sources,
-							grp_str, &json_group);
-
-						if (!json_group) {
-							json_group =
-								json_object_new_object();
-							json_object_object_add(
-								json_fhr_sources,
-								grp_str,
-								json_group);
-						}
-
-						json_group_source =
-							json_object_new_object();
-						json_object_string_add(
-							json_group_source,
-							"source", src_str);
-						json_object_string_add(
-							json_group_source,
-							"group", grp_str);
-						json_object_string_add(
-							json_group_source,
-							"upTime", uptime);
-						json_object_object_add(
-							json_group, src_str,
-							json_group_source);
-					}
+				if (ifp != up->rpf.source_nexthop.interface)
+					continue;
+
+				if (!(up->flags & PIM_UPSTREAM_FLAG_MASK_FHR))
+					continue;
+
+				if (!json_fhr_sources)
+					json_fhr_sources =
+						json_object_new_object();
+
+				pim_inet4_dump("<src?>", up->sg.src,
+					       src_str, sizeof(src_str));
+				pim_inet4_dump("<grp?>", up->sg.grp,
+					       grp_str, sizeof(grp_str));
+				pim_time_uptime(uptime, sizeof(uptime),
+						now - up->state_transition);
+
+				/*
+				 * Does this group live in json_fhr_sources?
+				 * If not create it.
+				 */
+				json_object_object_get_ex(json_fhr_sources,
+							  grp_str,
+							  &json_group);
+
+				if (!json_group) {
+					json_group = json_object_new_object();
+					json_object_object_add(
+						json_fhr_sources,
+						grp_str,
+						json_group);
 				}
+
+				json_group_source = json_object_new_object();
+				json_object_string_add(json_group_source,
+						       "source", src_str);
+				json_object_string_add(json_group_source,
+						       "group", grp_str);
+				json_object_string_add(json_group_source,
+						       "upTime", uptime);
+				json_object_object_add(json_group, src_str,
+						       json_group_source);
 			}
 
 			if (json_fhr_sources) {
@@ -1228,37 +1218,33 @@ static void pim_show_interfaces_single(struct pim_instance *pim,
 			print_header = 1;
 			for (ALL_LIST_ELEMENTS_RO(pim->upstream_list, upnode,
 						  up)) {
-				if (strcmp(ifp->name, up->rpf.source_nexthop
-							      .interface->name)
-				    == 0) {
-					if (up->flags
-					    & PIM_UPSTREAM_FLAG_MASK_FHR) {
-
-						if (print_header) {
-							vty_out(vty,
-								"FHR - First Hop Router\n");
-							vty_out(vty,
-								"----------------------\n");
-							print_header = 0;
-						}
-
-						pim_inet4_dump("<src?>",
-							       up->sg.src,
-							       src_str,
-							       sizeof(src_str));
-						pim_inet4_dump("<grp?>",
-							       up->sg.grp,
-							       grp_str,
-							       sizeof(grp_str));
-						pim_time_uptime(
-							uptime, sizeof(uptime),
-							now - up->state_transition);
-						vty_out(vty,
-							"%s : %s is a source, uptime is %s\n",
-							grp_str, src_str,
-							uptime);
-					}
+
+				if (strcmp(ifp->name,
+					   up->rpf.source_nexthop.
+					   interface->name) != 0)
+					continue;
+
+				if (!(up->flags & PIM_UPSTREAM_FLAG_MASK_FHR))
+					continue;
+
+				if (print_header) {
+					vty_out(vty,
+						"FHR - First Hop Router\n");
+					vty_out(vty,
+						"----------------------\n");
+					print_header = 0;
 				}
+
+				pim_inet4_dump("<src?>", up->sg.src,
+					       src_str, sizeof(src_str));
+				pim_inet4_dump("<grp?>", up->sg.grp,
+					       grp_str, sizeof(grp_str));
+				pim_time_uptime(uptime, sizeof(uptime),
+						now - up->state_transition);
+				vty_out(vty,
+					"%s : %s is a source, uptime is %s\n",
+					grp_str, src_str,
+					uptime);
 			}
 
 			if (!print_header) {
@@ -2384,6 +2370,30 @@ static void pim_show_upstream(struct pim_instance *pim, struct vty *vty,
 			json_object_string_add(
 				json_row, "inboundInterface",
 				up->rpf.source_nexthop.interface->name);
+
+			/*
+			 * The RPF address we use is slightly different
+			 * based upon what we are looking up.
+			 * If we have a S, list that unless
+			 * we are the FHR, else we just put
+			 * the RP as the rpfAddress
+			 */
+			if (up->flags & PIM_UPSTREAM_FLAG_MASK_FHR ||
+			    up->sg.src.s_addr == INADDR_ANY) {
+				char rpf[PREFIX_STRLEN];
+				struct pim_rpf *rpg;
+
+				rpg = RP(pim, up->sg.grp);
+				pim_inet4_dump("<rpf?>",
+					       rpg->rpf_addr.u.prefix4,
+					       rpf, sizeof(rpf));
+				json_object_string_add(json_row,
+						       "rpfAddress", rpf);
+			} else {
+				json_object_string_add(json_row,
+						       "rpfAddress", src_str);
+			}
+
 			json_object_string_add(json_row, "source", src_str);
 			json_object_string_add(json_row, "group", grp_str);
 			json_object_string_add(json_row, "state", state_str);
@@ -3130,12 +3140,12 @@ static void clear_interfaces(struct pim_instance *pim)
 	clear_pim_interfaces(pim);
 }
 
-#define PIM_GET_PIM_INTERFACE(pim_ifp, ifp)                                     \
-	pim_ifp = ifp->info;                                                    \
-	if (!pim_ifp) {                                                         \
-		vty_out(vty,                                                    \
+#define PIM_GET_PIM_INTERFACE(pim_ifp, ifp)				\
+	pim_ifp = ifp->info;						\
+	if (!pim_ifp) {							\
+		vty_out(vty,						\
 			"%% Enable PIM and/or IGMP on this interface first\n"); \
-		return CMD_WARNING_CONFIG_FAILED;                               \
+		return CMD_WARNING_CONFIG_FAILED;			\
 	}
 
 DEFUN (clear_ip_interfaces,
@@ -6478,7 +6488,7 @@ DEFUN(interface_no_ip_pim_boundary_oil,
 {
 	VTY_DECLVAR_CONTEXT(interface, iif);
 	struct pim_interface *pim_ifp;
-	int idx;
+	int idx = 0;
 
 	argv_find(argv, argc, "WORD", &idx);
 
diff --git a/ripngd/ripngd.c b/ripngd/ripngd.c
index 933cb2962f..df3af2a17f 100644
--- a/ripngd/ripngd.c
+++ b/ripngd/ripngd.c
@@ -842,6 +842,8 @@ static void ripng_route_process(struct rte *rte, struct sockaddr_in6 *from,
 		   unusable). */
 		if (rte->metric != RIPNG_METRIC_INFINITY)
 			ripng_ecmp_add(&newinfo);
+		else
+			route_unlock_node(rp);
 	} else {
 		/* If there is an existing route, compare the next hop address
 		   to the address of the router from which the datagram came.
diff --git a/zebra/rt_netlink.c b/zebra/rt_netlink.c
index 0e4ae04330..0cc2e0217f 100644
--- a/zebra/rt_netlink.c
+++ b/zebra/rt_netlink.c
@@ -845,7 +845,7 @@ static void _netlink_route_build_singlepath(const char *routedesc, int bytelen,
 {
 	struct nexthop_label *nh_label;
 	mpls_lse_t out_lse[MPLS_MAX_LABELS];
-	char label_buf[100];
+	char label_buf[256];
 
 	/*
 	 * label_buf is *only* currently used within debugging.
@@ -876,12 +876,13 @@ static void _netlink_route_build_singlepath(const char *routedesc, int bytelen,
 							     0, 0, bos);
 				if (IS_ZEBRA_DEBUG_KERNEL) {
 					if (!num_labels)
-						sprintf(label_buf, "label %d",
+						sprintf(label_buf, "label %u",
 							nh_label->label[i]);
 					else {
-						sprintf(label_buf1, "/%d",
+						sprintf(label_buf1, "/%u",
 							nh_label->label[i]);
-						strcat(label_buf, label_buf1);
+						strlcat(label_buf, label_buf1,
+							sizeof(label_buf));
 					}
 				}
 				num_labels++;
@@ -1044,7 +1045,7 @@ static void _netlink_route_build_multipath(const char *routedesc, int bytelen,
 {
 	struct nexthop_label *nh_label;
 	mpls_lse_t out_lse[MPLS_MAX_LABELS];
-	char label_buf[100];
+	char label_buf[256];
 
 	rtnh->rtnh_len = sizeof(*rtnh);
 	rtnh->rtnh_flags = 0;
@@ -1080,12 +1081,13 @@ static void _netlink_route_build_multipath(const char *routedesc, int bytelen,
 							     0, 0, bos);
 				if (IS_ZEBRA_DEBUG_KERNEL) {
 					if (!num_labels)
-						sprintf(label_buf, "label %d",
+						sprintf(label_buf, "label %u",
 							nh_label->label[i]);
 					else {
-						sprintf(label_buf1, "/%d",
+						sprintf(label_buf1, "/%u",
 							nh_label->label[i]);
-						strcat(label_buf, label_buf1);
+						strlcat(label_buf, label_buf1,
+							sizeof(label_buf));
 					}
 				}
 				num_labels++;
diff --git a/zebra/zebra_rib.c b/zebra/zebra_rib.c
index 1a9bd5a58e..d46e0730ee 100644
--- a/zebra/zebra_rib.c
+++ b/zebra/zebra_rib.c
@@ -325,9 +325,11 @@ static void nexthop_set_resolved(afi_t afi, struct nexthop *newhop,
 
 	resolved_hop = nexthop_new();
 	SET_FLAG(resolved_hop->flags, NEXTHOP_FLAG_ACTIVE);
-	/* If the resolving route specifies a gateway, use it */
-	if (newhop->type == NEXTHOP_TYPE_IPV4
-	    || newhop->type == NEXTHOP_TYPE_IPV4_IFINDEX) {
+
+	switch (newhop->type) {
+	case NEXTHOP_TYPE_IPV4:
+	case NEXTHOP_TYPE_IPV4_IFINDEX:
+		/* If the resolving route specifies a gateway, use it */
 		resolved_hop->type = newhop->type;
 		resolved_hop->gate.ipv4 = newhop->gate.ipv4;
 
@@ -337,9 +339,9 @@ static void nexthop_set_resolved(afi_t afi, struct nexthop *newhop,
 			if (newhop->flags & NEXTHOP_FLAG_ONLINK)
 				resolved_hop->flags |= NEXTHOP_FLAG_ONLINK;
 		}
-	}
-	if (newhop->type == NEXTHOP_TYPE_IPV6
-	    || newhop->type == NEXTHOP_TYPE_IPV6_IFINDEX) {
+		break;
+	case NEXTHOP_TYPE_IPV6:
+	case NEXTHOP_TYPE_IPV6_IFINDEX:
 		resolved_hop->type = newhop->type;
 		resolved_hop->gate.ipv6 = newhop->gate.ipv6;
 
@@ -347,18 +349,17 @@ static void nexthop_set_resolved(afi_t afi, struct nexthop *newhop,
 			resolved_hop->type = NEXTHOP_TYPE_IPV6_IFINDEX;
 			resolved_hop->ifindex = newhop->ifindex;
 		}
-	}
-
-	/* If the resolving route is an interface route,
-	 * it means the gateway we are looking up is connected
-	 * to that interface. (The actual network is _not_ onlink).
-	 * Therefore, the resolved route should have the original
-	 * gateway as nexthop as it is directly connected.
-	 *
-	 * On Linux, we have to set the onlink netlink flag because
-	 * otherwise, the kernel won't accept the route.
-	 */
-	if (newhop->type == NEXTHOP_TYPE_IFINDEX) {
+		break;
+	case NEXTHOP_TYPE_IFINDEX:
+		/* If the resolving route is an interface route,
+		 * it means the gateway we are looking up is connected
+		 * to that interface. (The actual network is _not_ onlink).
+		 * Therefore, the resolved route should have the original
+		 * gateway as nexthop as it is directly connected.
+		 *
+		 * On Linux, we have to set the onlink netlink flag because
+		 * otherwise, the kernel won't accept the route.
+		 */
 		resolved_hop->flags |= NEXTHOP_FLAG_ONLINK;
 		if (afi == AFI_IP) {
 			resolved_hop->type = NEXTHOP_TYPE_IPV4_IFINDEX;
@@ -368,12 +369,13 @@ static void nexthop_set_resolved(afi_t afi, struct nexthop *newhop,
 			resolved_hop->gate.ipv6 = nexthop->gate.ipv6;
 		}
 		resolved_hop->ifindex = newhop->ifindex;
-	}
-
-	if (newhop->type == NEXTHOP_TYPE_BLACKHOLE) {
+		break;
+	case NEXTHOP_TYPE_BLACKHOLE:
 		resolved_hop->type = NEXTHOP_TYPE_BLACKHOLE;
 		resolved_hop->bh_type = nexthop->bh_type;
+		break;
 	}
+
 	resolved_hop->rparent = nexthop;
 	nexthop_add(&nexthop->resolved, resolved_hop);
 }
diff --git a/zebra/zserv.c b/zebra/zserv.c
index 390ff62b19..cbc9f2bed9 100644
--- a/zebra/zserv.c
+++ b/zebra/zserv.c
@@ -825,6 +825,7 @@ static int zserv_fec_register(struct zserv *client, int sock, u_short length)
 
 	while (l < length) {
 		flags = stream_getw(s);
+		memset(&p, 0, sizeof(p));
 		p.family = stream_getw(s);
 		if (p.family != AF_INET && p.family != AF_INET6) {
 			zlog_err(
@@ -875,6 +876,7 @@ static int zserv_fec_unregister(struct zserv *client, int sock, u_short length)
 	while (l < length) {
 		// flags = stream_getw(s);
 		(void)stream_getw(s);
+		memset(&p, 0, sizeof(p));
 		p.family = stream_getw(s);
 		if (p.family != AF_INET && p.family != AF_INET6) {
 			zlog_err(