* Fix error in IP shifting (logical_shift_right by 32 is undefined)

* Rationalize matching of IP masks to always call Int32TupleHeader.subseteq.

* Disable fall-through optimization by default, due to poor performance.