unlang question

Enrik Berkhan enrik#freeradius at planb.de
Thu Jul 5 17:21:29 CEST 2007

Alan DeKok schrieb:
> Enrik Berkhan wrote:
>> But exactly adding the "ok = 1" makes it work. Have you tried it? May be
>> it's a bug though ... :)
>   Hmm... then I'm not sure I understand what the code is doing.

Currently, it works like so (if/elsif, with if condition evaluating to

In modcall(), modcall.c lines 362ff the if-condition is evaluated for if
and elsif blocks. If the condition evaluates to false, goto unroll.

In modcall(), modcall.c lines 564ff (label unroll:), the
child->actions[] are used to determine the next step. For
MOD_ACTION_RETURN and MOD_ACTION_REJECT, which happen to be default
actions in the authenticate action even for if-blocks, goto do_return.

So, if an if-condition evaluates to FALSE within the authenticate
section, the flow stops after evaluating the if-condition via goto
unroll, goto do_return and never ever evaluates the elsif.

And yes, the child->actions can be set in the if-block.

So, I think, if/elsif/else-blocks either need other defaults for their
actions[] or if/elsif/else-blocks need another unroll: mechanism :)

But I don't understand enough of the unlang-processing to provide a
complete solution, sorry. I could provide very simple example configs to
test the behaviour, though, on request.


More information about the Freeradius-Devel mailing list