Alan DeKok schrieb:
Enrik Berkhan wrote:
But exactly adding the "ok = 1" makes it work. Have you tried it? May be it's a bug though ... :)
Hmm... then I'm not sure I understand what the code is doing.
Currently, it works like so (if/elsif, with if condition evaluating to FALSE): In modcall(), modcall.c lines 362ff the if-condition is evaluated for if and elsif blocks. If the condition evaluates to false, goto unroll. In modcall(), modcall.c lines 564ff (label unroll:), the child->actions[] are used to determine the next step. For MOD_ACTION_RETURN and MOD_ACTION_REJECT, which happen to be default actions in the authenticate action even for if-blocks, goto do_return. So, if an if-condition evaluates to FALSE within the authenticate section, the flow stops after evaluating the if-condition via goto unroll, goto do_return and never ever evaluates the elsif. And yes, the child->actions can be set in the if-block. So, I think, if/elsif/else-blocks either need other defaults for their actions[] or if/elsif/else-blocks need another unroll: mechanism :) But I don't understand enough of the unlang-processing to provide a complete solution, sorry. I could provide very simple example configs to test the behaviour, though, on request. HTH, Enrik