diff --git a/includes/tree.h b/includes/tree.h
index e4a62841..ffd909c8 100644
--- a/includes/tree.h
+++ b/includes/tree.h
@@ -53,35 +53,54 @@ typedef struct _pair {
 #define TREE_LIMIT		4
 #define TREE_DATA_EXPR		5
 
+/* A data buffer with a reference count. */
+struct buffer {
+	int refcnt;
+	char data [1];
+};
+
+/* XXX The mechanism by which data strings are returned is currently
+   XXX broken: rather than returning an ephemeral pointer, we create
+   XXX a reference to the data in the caller's space, which the caller
+   XXX then has to dereference - instead, the reference should be
+   XXX ephemeral by default and be made a persistent reference explicitly. */
+
 /* A string of data bytes, possibly accompanied by a larger buffer. */
 struct data_string {
-	unsigned char *data, *buffer;
+	struct buffer *buffer;
+	unsigned char *data;
 	int len;
 	int terminated;
 };
 
 /* Expression tree structure. */
 
+enum expr_op {
+	expr_none,
+	expr_match,
+	expr_check,
+	expr_equal,
+	expr_substring,
+	expr_suffix,
+	expr_concat,
+	expr_host_lookup,
+	expr_and,
+	expr_or,
+	expr_not,
+	expr_option,
+	expr_hardware,
+	expr_packet,
+	expr_const_data,
+	expr_extract_int8,
+	expr_extract_int16,
+	expr_extract_int32,
+	expr_const_int,
+	expr_exists,
+};
+
 struct expression {
-	enum {
-		expr_check,
-		expr_equal,
-		expr_substring,
-		expr_suffix,
-		expr_concat,
-		expr_host_lookup,
-		expr_and,
-		expr_or,
-		expr_not,
-		expr_option,
-		expr_hardware,
-		expr_packet,
-		expr_const_data,
-		expr_extract_int8,
-		expr_extract_int16,
-		expr_extract_int32,
-		expr_const_int,
-	} op;
+	int refcnt;
+	enum expr_op op;
 	union {
 		struct {
 			struct expression *expr;
@@ -103,13 +122,11 @@ struct expression {
 			struct expression *len;
 		} packet;
 		struct data_string const_data;
-		struct {
-			struct expression *expr;
-			struct expression *width;
-		} extract_int;
+		struct expression *extract_int;
 		unsigned long const_int;
 		struct expression *concat [2];
 		struct dns_host_entry *host_lookup;
+		struct option *exists;
 	} data;
 	int flags;
 #	define EXPR_EPHEMERAL	1
@@ -117,26 +134,24 @@ struct expression {
 
 /* DNS host entry structure... */
 struct dns_host_entry {
-	char *hostname;
-	char *buffer;
-	int buf_len;
-	int data_len;
+	int refcnt;
 	TIME timeout;
+	struct data_string data;
+	char hostname [1];
 };
 
-struct option_cache {
-	struct expression *expression;
-	struct option *option;
-};
-
+struct option_cache; /* forward */
 struct data_string; /* forward */
 struct packet; /* forward */
 struct option_state; /* forward */
+struct decoded_option_state; /* forward */
 enum statement_op; /* forward */
 
 struct universe {
 	char *name;
-	struct data_string (*lookup_func) PROTO ((struct packet *, int));
+	int (*lookup_func)
+		PROTO ((struct data_string *,
+			struct option_state *, int));
 	void (*set_func) PROTO ((struct option_state *,
 				 struct option_cache *,
 				 enum statement_op));
@@ -150,3 +165,10 @@ struct option {
 	struct universe *universe;
 	unsigned char code;
 };
+
+enum expression_context {
+	context_any,
+	context_boolean,
+	context_data,
+	context_numeric
+};