unlang question

[Enrik Berkhan]

Alan DeKok schrieb:
> Enrik Berkhan wrote:
>> But exactly adding the "ok = 1" makes it work. Have you tried it? May be
>> it's a bug though ... :)
> 
>   Hmm... then I'm not sure I understand what the code is doing.

Currently, it works like so (if/elsif, with if condition evaluating to
FALSE):

In modcall(), modcall.c lines 362ff the if-condition is evaluated for if
and elsif blocks. If the condition evaluates to false, goto unroll.

In modcall(), modcall.c lines 564ff (label unroll:), the
child->actions[] are used to determine the next step. For
MOD_ACTION_RETURN and MOD_ACTION_REJECT, which happen to be default
actions in the authenticate action even for if-blocks, goto do_return.

So, if an if-condition evaluates to FALSE within the authenticate
section, the flow stops after evaluating the if-condition via goto
unroll, goto do_return and never ever evaluates the elsif.

And yes, the child->actions can be set in the if-block.

So, I think, if/elsif/else-blocks either need other defaults for their
actions[] or if/elsif/else-blocks need another unroll: mechanism :)

But I don't understand enough of the unlang-processing to provide a
complete solution, sorry. I could provide very simple example configs to
test the behaviour, though, on request.

HTH,
Enrik