/src/freeradius-server/src/lib/unlang/edit.c

Source
/*
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */

/**
 * $Id: d8470174f4caf1c41057908e1d4447114831158b $
 *
 * @brief fr_pair_t editing
 *
 * @ingroup AVP
 *
 * @copyright 2021 Network RADIUS SAS (legal@networkradius.com)
 */
RCSID("$Id: d8470174f4caf1c41057908e1d4447114831158b $")

#include <freeradius-devel/server/base.h>
#include <freeradius-devel/server/tmpl_dcursor.h>
#include <freeradius-devel/util/edit.h>
#include <freeradius-devel/util/calc.h>
#include <freeradius-devel/unlang/tmpl.h>
#include <freeradius-devel/unlang/edit.h>
#include <freeradius-devel/unlang/transaction.h>
#include <freeradius-devel/unlang/unlang_priv.h>
#include "edit_priv.h"

#undef XDEBUG
#if 1
#define XDEBUG(...)
#else
#define XDEBUG DEBUG2
#endif

#define RDEBUG_ASSIGN(_name, _op, _box) rdebug_assign(request, _name, _op, _box)

static void rdebug_assign(request_t *request, char const *attr, fr_token_t op, fr_value_box_t const *box)
{
  char const *name;

  switch (box->type) {
  case FR_TYPE_QUOTED:
    RDEBUG2("%s %s %pR", attr, fr_tokens[op], box);
    break;

  case FR_TYPE_INTERNAL:
  case FR_TYPE_STRUCTURAL:
    fr_assert(0);
    break;

  default:
    fr_assert(fr_type_is_leaf(box->type));

    if ((name = fr_value_box_enum_name(box)) != NULL) {
      RDEBUG2("%s %s ::%s", attr, fr_tokens[op], name);
      break;
    }

    RDEBUG2("%s %s %pR", attr, fr_tokens[op], box);
    break;
  }
}

typedef struct {
  fr_value_box_list_t list;     //!< output data
  tmpl_t const    *vpt;     //!< expanded tmpl
  tmpl_t      *to_free;   //!< tmpl to free.
  bool      create;     //!< whether we need to create the VP
  unlang_result_t   result;     //!< result of the xlat expansion
  fr_pair_t   *vp;      //!< VP referenced by tmpl.
  fr_pair_t   *vp_parent;   //!< parent of the current VP
  fr_pair_list_t    pair_list;    //!< for structural attributes
} edit_result_t;

typedef struct edit_map_s edit_map_t;

typedef struct unlang_frame_state_edit_s unlang_frame_state_edit_t;

typedef int (*unlang_edit_expand_t)(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current);

struct edit_map_s {
  fr_edit_list_t    *el;      //!< edit list

  request_t   *request;
  TALLOC_CTX    *ctx;
  edit_map_t    *parent;
  edit_map_t    *child;

  map_list_t const  *map_list;
  map_t const   *map;     //!< the map to evaluate

  bool      temporary_pair_list;

  edit_result_t   lhs;      //!< LHS child entries
  edit_result_t   rhs;      //!< RHS child entries

  unlang_edit_expand_t  func;     //!< for process state
  unlang_edit_expand_t  check_lhs;    //!< for special cases
  unlang_edit_expand_t  expanded_lhs;   //!< for special cases
};

/** State of an edit block
 *
 */
struct unlang_frame_state_edit_s {
  fr_edit_list_t    *el;      //!< edit list
  bool      *success;   //!< whether or not the edit succeeded
  bool      ours;

  rindent_t   indent;

  edit_map_t    *current;   //!< what we're currently doing.
  edit_map_t    first;
};

#define MAP_INFO cf_filename(map->ci), cf_lineno(map->ci)

static fr_pair_t *edit_list_pair_build(fr_pair_t *parent, fr_dcursor_t *cursor, fr_dict_attr_t const *da, void *uctx);

/*
 *  Convert a value-box list to a LHS attribute #tmpl_t
 */
static int tmpl_attr_from_result(TALLOC_CTX *ctx, map_t const *map, edit_result_t *out, request_t *request)
{
  ssize_t slen;
  fr_value_box_t *box = fr_value_box_list_head(&out->list);

  if (!box) {
    RWDEBUG("%s %s ... - Assignment failed - No value on right-hand side", map->lhs->name, fr_tokens[map->op]);
    return -1;
  }

  /*
   *  Mash all of the results together.
   */
  if (fr_value_box_list_concat_in_place(box, box, &out->list, FR_TYPE_STRING, FR_VALUE_BOX_LIST_FREE, true, SIZE_MAX) < 0) {
    RWDEBUG("Failed converting result to string");
    return -1;
  }

  /*
   *  Parse the LHS as an attribute reference.  It can't be
   *  anything else.
   */
  slen = tmpl_afrom_attr_str(ctx, NULL, &out->to_free, box->vb_strvalue,
           &(tmpl_rules_t){
            .attr = {
            .dict_def = request->local_dict,
            .list_def = request_attr_request,
            .ci = map->ci,
          }
           });
  if (slen <= 0) {
    RPEDEBUG("Expansion result \"%s\" is not an attribute reference", box->vb_strvalue);
    return -1;
  }

  out->vpt = out->to_free;
  fr_value_box_list_talloc_free(&out->list);

  return 0;
}


/*
 *  Expand a tmpl.
 */
static int tmpl_to_values(TALLOC_CTX *ctx, edit_result_t *out, request_t *request, tmpl_t const *vpt)
{
  fr_assert(out->vpt == NULL);
  fr_assert(out->to_free == NULL);

  switch (vpt->type) {
  case TMPL_TYPE_DATA:
    return 0;

  case TMPL_TYPE_ATTR:
    out->vpt = vpt;
    return 0;

  case TMPL_TYPE_EXEC:
    if (unlang_tmpl_push(ctx, &out->result, &out->list, request, vpt, NULL, UNLANG_SUB_FRAME) < 0) return -1;
    return 1;

  case TMPL_TYPE_XLAT:
    if (unlang_xlat_push(ctx, &out->result, &out->list, request, tmpl_xlat(vpt), false) < 0) return -1;
    return 1;

  default:
    /*
     *  The other tmpl types MUST have already been
     *  converted to the "realized" types.
     */
    tmpl_debug(stderr, vpt);
    fr_assert(0);
    break;
  }

  return -1;
}

static void edit_debug_attr_list(request_t *request, fr_pair_list_t const *list, map_t const *map);

static void edit_debug_attr_vp(request_t *request, fr_pair_t const *vp, map_t const *map)
{
  fr_assert(vp != NULL);

  if (map) {
    switch (vp->vp_type) {
    case FR_TYPE_STRUCTURAL:
      RDEBUG2("%s = {", map->lhs->name);
      RINDENT();
      edit_debug_attr_list(request, &vp->vp_group, map_list_head(&map->child));
      REXDENT();
      RDEBUG2("}");
      break;

    default:
      RDEBUG_ASSIGN(map->lhs->name, vp->op, &vp->data);
      break;
    }
  } else {
    size_t slen;
    fr_sbuff_t sbuff;
    char buffer[1024];

    sbuff = FR_SBUFF_OUT(buffer, sizeof(buffer));

    /*
     *  Squash the names down if necessary.
     */
    if (!RDEBUG_ENABLED3) {
      slen = fr_pair_print_name(&sbuff, NULL, &vp);
    } else {
      slen = fr_sbuff_in_sprintf(&sbuff, "%s %s ", vp->da->name, fr_tokens[vp->op]);
    }
    if (slen <= 0) return;

    switch (vp->vp_type) {
    case FR_TYPE_STRUCTURAL:
                        RDEBUG2("%s{", buffer);
      RINDENT();
      edit_debug_attr_list(request, &vp->vp_group, NULL);
      REXDENT();
      RDEBUG2("}");
      break;

    default:
      if (fr_pair_print_value_quoted(&sbuff, vp, T_DOUBLE_QUOTED_STRING) <= 0) return;
      RDEBUG2("%s", buffer);
      break;
    }
  }
}

static void edit_debug_attr_list(request_t *request, fr_pair_list_t const *list, map_t const *map)
{
  fr_pair_t *vp;
  map_t const *child = NULL;

  if (map) child = map_list_head(&map->child);

  for (vp = fr_pair_list_next(list, NULL);
       vp != NULL;
       vp = fr_pair_list_next(list, vp)) {
    edit_debug_attr_vp(request, vp, child);
    if (map) child = map_list_next(&map->child, child);
  }
}

static int edit_create_lhs_vp(request_t *request, TALLOC_CTX *ctx, edit_map_t *current)
{
  int err;
  fr_pair_t *vp;
  tmpl_dcursor_ctx_t lhs_cc;
  fr_dcursor_t lhs_cursor;

  fr_assert(current->lhs.create);

  /*
   *  Now that we have the RHS values, go create the LHS vp.  We delay creating it until
   *  now, because the RHS might just be nothing.  In which case we don't want to create the
   *  LHS, and then discover that we need to delete it.
   */
  fr_strerror_clear();
  vp = tmpl_dcursor_build_init(&err, ctx, &lhs_cc, &lhs_cursor, request, current->lhs.vpt, edit_list_pair_build, current);
  tmpl_dcursor_clear(&lhs_cc);
  if (!vp) {
    RPEDEBUG("Failed creating attribute %s", current->lhs.vpt->name);
    return -1;
  }

  current->lhs.vp = vp;

  return 0;
}

/*  Apply the edits to a structural attribute..
 *
 *  Figure out what edits to do, and then do them.
 */
static int apply_edits_to_list(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  fr_pair_t *vp;
  fr_pair_list_t *children;
  int rcode;
  map_t const *map = current->map;
  tmpl_dcursor_ctx_t cc;
  fr_dcursor_t cursor;

  XDEBUG("apply_edits_to_list %s", map->lhs->name);

  /*
   *  RHS is a sublist, go apply that.
   */
  if (!map->rhs) {
    children = &current->rhs.pair_list;
    goto apply_list;
  }

  /*
   *  For RHS of data, it should be a string which contains the pairs to use.
   */
  if (!current->rhs.vpt) {
    fr_value_box_t *box;
    fr_dict_attr_t const *da;
    fr_pair_parse_t root, relative;

    if (tmpl_is_data(map->rhs)) {
      box = tmpl_value(map->rhs);

      if (box->type != FR_TYPE_STRING) {
        REDEBUG("Invalid data type for assignment to list");
        return -1;
      }

    } else {
      box = fr_value_box_list_head(&current->rhs.list);

      /*
       *  Can't concatenate empty results.
       */
      if (!box) {
        RWDEBUG("%s %s ... - Assignment failed due to having no value on right-hand side", map->lhs->name, fr_tokens[map->op]);
        return -1;
      }

      /*
       *  Mash all of the results together.
       */
      if (fr_value_box_list_concat_in_place(box, box, &current->rhs.list, FR_TYPE_STRING, FR_VALUE_BOX_LIST_FREE, true, SIZE_MAX) < 0) {
        RWDEBUG("Failed converting result to string");
        return -1;
      }
    }

    children = &current->rhs.pair_list;

    /*
     *  For exec, etc., parse the pair list from a string, in the context of the
     *  parent VP.  Because we're going to be moving them to the parent VP at some
     *  point.  The ones which aren't moved will get deleted in this function.
     */
    da = tmpl_attr_tail_da(current->lhs.vpt);
    if (fr_type_is_group(da->type)) da = fr_dict_root(request->proto_dict);

    root = (fr_pair_parse_t) {
      .ctx = current->ctx,
      .da = da,
      .list = children,
      .dict = request->proto_dict,
      .internal = fr_dict_internal(),
      .allow_compare = true,
      .tainted = box->tainted,
    };
    relative = (fr_pair_parse_t) { };

    if (fr_pair_list_afrom_substr(&root, &relative, &FR_SBUFF_IN(box->vb_strvalue, box->vb_length)) < 0) {
      RPEDEBUG("Failed parsing string %pV as attribute list", box);
      return -1;
    }

    goto apply_list;
  }

  fr_assert(current->rhs.vpt);
  fr_assert(tmpl_is_attr(current->rhs.vpt));

  /*
   *  Doing no modifications to a list is a NOOP.
   */
  vp = tmpl_dcursor_init(NULL, request, &cc, &cursor, request, current->rhs.vpt);
  if (!vp) {
    tmpl_dcursor_clear(&cc);
    return 0;
  }

  /*
   *  Remove an attribute from a list.  The tmpl_dcursor and tmpl_parser ensures that the RHS
   *  references are done in the context of the LHS attribute.
   */
  if (map->op == T_OP_SUB_EQ) {
    fr_pair_t *next;

    /*
     *  Loop over matching attributes, and delete them.
     */
    RDEBUG2("%s %s %s", current->lhs.vpt->name, fr_tokens[T_OP_SUB_EQ], current->rhs.vpt->name);

    for ( ; vp != NULL; vp = next) {
      fr_pair_list_t *list;

      next = fr_dcursor_next(&cursor);

      list = fr_pair_parent_list(vp);
      fr_assert(list != NULL);

      /*
       *  @todo - if this attribute is structural, then remove all children which aren't
       *  immutable.  For now, this is good enough.
       */
      if (fr_pair_immutable(vp)) {
        RWDEBUG("Not removing immutable %pP", vp);
        continue;
      }

      if (vp->vp_edit) {
        RWDEBUG("Attribute cannot be removed, as it is being used in a 'foreach' loop - %pP", vp);
        continue;
      }

      if (fr_edit_list_pair_delete(current->el, list, vp) < 0) {
        RPEDEBUG("Failed deleting attribute");
        tmpl_dcursor_clear(&cc);
        return -1;
      }
    }

    tmpl_dcursor_clear(&cc);
    return 0;
  }

  /*
   *  Check the RHS thing we're copying.
   */
  if (fr_type_is_structural(vp->vp_type)) {
    tmpl_dcursor_clear(&cc);

    if (tmpl_attr_tail_num(current->rhs.vpt) == NUM_ALL) {
      REDEBUG("%s[%d] Wildcard for structural attribute %s is not yet implemented.", MAP_INFO, current->rhs.vpt->name);
      return -1;
    }

    children = &vp->vp_group;
    goto apply_list;
  }

  /*
   *  Copy the attributes from the cursor to a temporary pair list.
   */
  fr_pair_list_init(&current->rhs.pair_list);
  while (vp) {
    fr_pair_t *copy;

    copy = fr_pair_copy(request, vp);
    if (!copy) {
      fr_pair_list_free(&current->rhs.pair_list);
      tmpl_dcursor_clear(&cc);
      return -1;
    }
    fr_pair_append(&current->rhs.pair_list, copy);

    vp = fr_dcursor_next(&cursor);
  }
  tmpl_dcursor_clear(&cc);

  children = &current->rhs.pair_list;

  /*
   *  Apply structural thingies!
   */
apply_list:
  fr_assert(children != NULL);

  /*
   *  If we have to create the LHS, then do so now.
   */
  if (current->lhs.create && (edit_create_lhs_vp(request, state, current) < 0)) {
    return -1;
  }

  fr_assert(current->lhs.vp != NULL);

#ifdef STATIC_ANALYZER
  if (!current->lhs.vp) return -1;
#endif

  /*
   *  Print the children before we do the modifications.
   */
  if (!current->parent) {
    RDEBUG2("%s %s {", current->lhs.vpt->name, fr_tokens[map->op]);
    if (fr_debug_lvl >= L_DBG_LVL_2) {
      RINDENT();
      edit_debug_attr_list(request, children, map);
      REXDENT();
    }
    RDEBUG2("}");
  }

  fr_pair_list_foreach(children, child) {
    if (!fr_dict_attr_can_contain(current->lhs.vp->da, child->da)) {
      RDEBUG("Cannot perform assignment: Attribute \"%s\" is not a child of parent \"%s\"",
             child->da->name, current->lhs.vp->da->name);
      rcode = -1;
      goto done;
    }
  }

  if (map->op != T_OP_EQ) {
    fr_assert(current->el != NULL);

    rcode = fr_edit_list_apply_list_assignment(current->el, current->lhs.vp, map->op, children,
                 (children != &current->rhs.pair_list));
    if (rcode < 0) RPEDEBUG("Failed performing list '%s' operation", fr_tokens[map->op]);

  } else {
#if 0
    /*
     *  The RHS list _should_ be a copy of the LHS list.  But for some cases it's not.  We
     *  should spend time tracking this down, but not today.
     *
     *  For now, brute-force copy isn't wrong.
     */
    if (children == &current->rhs.pair_list) {
      fr_pair_list_append(&current->lhs.vp->vp_group, children);
    } else
#endif
    (void) fr_pair_list_copy(current->lhs.vp, &current->lhs.vp->vp_group, children);

    PAIR_VERIFY(current->lhs.vp);
    rcode = 0;
  }

  /*
   *  If the child list wasn't copied, then we just created it, and we need to free it.
   */
done:
  if (children == &current->rhs.pair_list) fr_pair_list_free(children);
  return rcode;
}

static bool pair_is_editable(request_t *request, fr_pair_t *vp)
{
  if (vp->vp_edit) {
    RWDEBUG("Attribute cannot be removed, as it is being used in a 'foreach' loop - %s", vp->da->name);
    return false;
  }

  if (!fr_type_is_structural(vp->vp_type)) return true;

  fr_pair_list_foreach(&vp->vp_group, child) {
    if (!pair_is_editable(request, child)) return false;
  }

  return true;
}

static int edit_delete_lhs(request_t *request, edit_map_t *current, bool delete)
{
  tmpl_dcursor_ctx_t cc;
  fr_dcursor_t cursor;

  /*
   *  These are magic.
   */
  if (delete) {
    fr_dict_attr_t const *da = tmpl_attr_tail_da(current->lhs.vpt);

    if (fr_type_is_structural(da->type) &&
        request_attr_is_list(da)) {
      delete = false;
    }
  }

  while (true) {
    int err;
    fr_pair_t *vp, *parent;

    /*
     *  Reinitialize the cursor for every VP.  This is because fr_dcursor_remove() does not
     *  work with tmpl_dcursors, as the tmpl_dcursor code does not set the "remove" callback.
     *  And the tmpl is NUM_UNSPEC, which means "the first one", whereas for T_OP_SET_EQ, we
     *  really mean "delete all except the first one".
     *
     *  Once that's implemented, we also need to update the edit list API to
     *  allow for "please delete children"?
     */
    vp = tmpl_dcursor_init(&err, current->ctx, &cc, &cursor, request, current->lhs.vpt);
    if (!vp) break;
    tmpl_dcursor_clear(&cc);

    parent = fr_pair_parent(vp);
    fr_assert(parent != NULL);

    if (!pair_is_editable(request, vp)) {
      return -1;
    }

    if (!delete) {
      if (fr_type_is_structural(vp->vp_type)) {

        if (fr_edit_list_free_pair_children(current->el, vp) < 0) return -1;
      } else {
        /*
         *  No need to save value, as fr_edit_list_apply_pair_assignment() will do
         *  that for us.
         */
      }

      current->lhs.vp = vp;
      return 0;
    }

    /*
     *  Delete all of them.  We'll create one later for the SET operation.
     */
    if (fr_edit_list_pair_delete(current->el, &parent->vp_group, vp) < 0) {
      RPWDEBUG("Failed deleting attribute");
      return -1;
    }
  }

  return 0;
}

/*
 *  Apply the edits to a leaf attribute.  First we figure out where the results come from:
 *
 *    single value-box (e.g. tmpl_is_data(vpt)
 *    rhs value-box result list (we create a dcursor)
 *    RHS attribute reference (we create a nested dcursor to get the values from the pair list)
 *
 *  Then we figure out what to do with those values.
 *
 *    if it needs to be created, then create it and just mash the results in place
 *    otherwise apply the edits (+=, etc.) to an existing attribute.
 *
 *  @todo - move to using dcursors for all of the values.  The dcursor should exist in current->rhs.  It
 *  should be used even for TMPL_DATA and single value-boxes.  Once that's done, it becomes easier to use
 *  dcursors for xlats, too.
 */
static int apply_edits_to_leaf(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  fr_value_box_t *box = NULL;
  tmpl_dcursor_ctx_t cc;
  fr_dcursor_t cursor;
  fr_dcursor_t pair_cursor;
  bool single = false, pair = false;
  map_t const *map = current->map;

  XDEBUG("apply_edits_to_leaf %s", map->lhs->name);

  if (!tmpl_is_attr(current->lhs.vpt)) {
    REDEBUG("%s[%d] The left side of an assignment must be an attribute reference", MAP_INFO);
    return -1;
  }

  /*
   *  &Foo := { a, b, c }
   *
   *  There should be values in RHS result, all of value boxes.
   */
  if (!map->rhs) {
    fr_assert(current->rhs.vpt == NULL);
    goto rhs_list;

  }

  if (!current->rhs.vpt) {
    /*
     *  There's no RHS tmpl, so the result must be in in the parent RHS tmpl as data, OR in
     *  the RHS result list.
     */
    if (tmpl_is_data(map->rhs)) {
      box = tmpl_value(map->rhs);
      single = true;

    } else if ((map->rhs->quote == T_SINGLE_QUOTED_STRING) || (map->rhs->quote == T_DOUBLE_QUOTED_STRING)) {
      /*
       *  The caller asked for a string, so instead of returning a list, return a string.
       *
       *  If there's no output, then it's an empty string.
       *
       *  We have to check this here, because the quote is part of the tmpl, and we call
       *  xlat_push(), which doesn't know about the quote.
       *
       *  @todo - we should really push the quote into the xlat, too.
       */
      box = fr_value_box_list_head(&current->rhs.list);

      if (!box) {
        MEM(box = fr_value_box_alloc(state, FR_TYPE_STRING, NULL));
        fr_value_box_strdup(box, box, NULL, "", false);
        fr_value_box_list_insert_tail(&current->rhs.list, box);

      } else if (fr_value_box_list_concat_in_place(box, box, &current->rhs.list, FR_TYPE_STRING,
                    FR_VALUE_BOX_LIST_FREE_BOX, true, 8192) < 0) {
        RWDEBUG("Failed converting result to string");
        return -1;
      }
      box = fr_value_box_list_head(&current->rhs.list);
      single = true;

    } else {
    rhs_list:
      if (fr_value_box_list_num_elements(&current->rhs.list) == 1) {
        box = fr_value_box_list_head(&current->rhs.list);
        single = true;
      } else {
        box = fr_dcursor_init(&cursor, fr_value_box_list_dlist_head(&current->rhs.list));
      }
    }
  } else {
    fr_pair_t *vp;
    int err;

    /*
     *  We have a temporary tmpl on the RHS.  It MUST be an attribute, because everything else
     *  was expanded to a value-box list.
     */
    fr_assert(tmpl_is_attr(current->rhs.vpt));

    /*
     *  Get a cursor over the RHS pairs.
     */
    vp = tmpl_dcursor_init(&err, request, &cc, &pair_cursor, request, current->rhs.vpt);
    if (!vp) {
      tmpl_dcursor_clear(&cc);

      if (map->op != T_OP_SET) return 0;

      /*
       *  No RHS pairs means we can finally delete all of the LHS.
       */
      return edit_delete_lhs(request, current, true);
    }

    box = fr_pair_dcursor_nested_init(&cursor, &pair_cursor); // the list is unused
    pair = true;
  }

  if (!box) {
    if (map->op != T_OP_SET) {
      RWDEBUG("%s %s ... - Assignment failed - No value on right-hand side", map->lhs->name, fr_tokens[map->op]);
      return -1;
    }

    /*
     *  Set is "delete, then add".
     */
    RDEBUG2("%s :=", current->lhs.vpt->name);
    goto done;
  }

  /*
   *  The parent is a structural type.  The RHS is a temporary list or attribute, which we can just
   *  add to the parents pair list.  The parent will then take care of merging that pair list into
   *  the appropriate place.
   */
  if (current->temporary_pair_list) {
    fr_pair_list_t *list = &current->parent->rhs.pair_list;
    fr_pair_t *vp;

    if (!current->parent->lhs.vp) {
      if (edit_create_lhs_vp(request, request, current->parent) < 0) return -1;
    }

    while (box) {
      /*
       *  Create (or find) all intermediate attributes.  The LHS map might have multiple
       *  attribute names in it.
       *
       *  @todo - audit other uses of tmpl_attr_tail_da() and fr_pair_afrom_da() in this file.
       */
      if (pair_append_by_tmpl_parent(current->parent->lhs.vp, &vp, list, current->lhs.vpt, true) < 0) {
        RPEDEBUG("Failed creating attribute %s", current->lhs.vpt->name);
        return -1;
      }

      vp->op = map->op;
      PAIR_ALLOCED(vp);

      if (fr_value_box_cast(vp, &vp->data, vp->vp_type, vp->da, box) < 0) return -1;

      if (single) break;

      box = fr_dcursor_next(&cursor);
    }

    goto done;
  }

  /*
   *  If we're supposed to create the LHS, then go do that.
   */
  if (current->lhs.create) {
    fr_dict_attr_t const *da = tmpl_attr_tail_da(current->lhs.vpt);
    fr_pair_t *vp;

    /*
     *  Something went wrong creating the value, it's a failure.  Note that we fail _all_
     *  subsequent assignments, too.
     */
    if (fr_type_is_null(box->type)) goto fail;

    if (edit_create_lhs_vp(request, state, current) < 0) goto fail;

    fr_assert(current->lhs.vp_parent != NULL);
    fr_assert(fr_type_is_structural(current->lhs.vp_parent->vp_type));

    vp = current->lhs.vp;

    /*
     *  There's always at least one LHS vp created.  So we apply that first.
     */
    RDEBUG_ASSIGN(current->lhs.vpt->name, map->op, box);

    /*
     *  The VP has already been inserted into the edit list, so we don't need to edit it's
     *  value, we can just mash it in place.
     */
    if (fr_value_box_cast(vp, &vp->data, vp->vp_type, vp->da, box) < 0) goto fail;
    vp->op = T_OP_EQ;
    if (vp->da->flags.unsafe) fr_value_box_mark_unsafe(&vp->data);

    if (single) goto done;

    /*
     *  Now that the attribute has been created, go apply the rest of the values to the attribute.
     */
    if (!((map->op == T_OP_EQ) || (map->op == T_OP_SET))) {
      box = fr_dcursor_next(&cursor);
      if (!box) goto done;

      goto apply_op;
    }

    if (current->lhs.vp->da->flags.local) {
      if (fr_dcursor_next_peek(&cursor)) RWDEBUG("Ignoring extra values for local variable");
      goto done;
    }

    /*
     *  Loop over the remaining items, adding the VPs we've just created.
     */
    while ((box = fr_dcursor_next(&cursor)) != NULL) {
      RDEBUG_ASSIGN(current->lhs.vpt->name, map->op, box);

      MEM(vp = fr_pair_afrom_da(current->lhs.vp_parent, da));
      if (fr_value_box_cast(vp, &vp->data, vp->vp_type, vp->da, box) < 0) goto fail;
      if (vp->da->flags.unsafe) fr_value_box_mark_unsafe(&vp->data);

      if (fr_edit_list_insert_pair_tail(state->el, &current->lhs.vp_parent->vp_group, vp) < 0) {
        talloc_free(vp);
        goto fail;
      }
      vp->op = T_OP_EQ;
      PAIR_ALLOCED(vp);
    }

    goto done;
  }

  /*
   *  If we're not creating a temporary list, we must be editing an existing attribute on the LHS.
   *
   *  We have two remaining cases.  One is the attribute was just created with "=" or ":=", so we
   *  can just mash its value.  The second is that the attribute already exists, and we're editing
   *  it's value using something like "+=".
   */
  fr_assert(current->lhs.vp != NULL);

#ifdef STATIC_ANALYZER
  if (!current->lhs.vp) return -1;
#endif

apply_op:
  /*
   *  All other operators are "modify in place", of the existing current->lhs.vp
   */
  while (box) {
    RDEBUG_ASSIGN(current->lhs.vpt->name, map->op, box);
    if (current->lhs.vp->da->flags.unsafe) fr_value_box_mark_unsafe(box);

    /*
     *  The apply function also takes care of doing data type upcasting and conversion.  So we don't
     *  have to check for compatibility of the data types on the LHS and RHS.
     */
    if (fr_edit_list_apply_pair_assignment(current->el,
                   current->lhs.vp,
                   map->op,
                   box) < 0) {
    fail:
      RPEDEBUG("Assigning value to %s failed", map->lhs->name);
      if (pair) tmpl_dcursor_clear(&cc);
      return -1;
    }

    if (single) break;

    box = fr_dcursor_next(&cursor);
  }

done:
  if (pair) tmpl_dcursor_clear(&cc);
  fr_value_box_list_talloc_free(&current->rhs.list);

  return 0;
}


/** Simple pair building callback for use with tmpl_dcursors
 *
 *  Which always appends the new pair to the tail of the list
 *  since it is only called when no matching pairs were found when
 *  walking the list.
 *
 *  Note that this function is called for all intermediate nodes which are built!
 *
 *
 *
 * @param[in] parent    to allocate new pair within.
 * @param[in,out] cursor  to append new pair to.
 * @param[in] da    of new pair.
 * @param[in] uctx    unused.
 * @return
 *  - newly allocated #fr_pair_t.
 *  - NULL on error.
 */
static fr_pair_t *edit_list_pair_build(fr_pair_t *parent, fr_dcursor_t *cursor, fr_dict_attr_t const *da, void *uctx)
{
  fr_pair_t *vp;
  edit_map_t *current = uctx;

  if (!fr_type_is_structural(parent->da->type)) {
    request_t *request = current->request;

    REDEBUG("Cannot create child of leaf data type");
    return NULL;
  }

  vp = fr_pair_afrom_da(parent, da);
  if (!vp) return NULL;

  current->lhs.vp_parent = parent;
  current->lhs.vp = vp;
  PAIR_ALLOCED(vp);

  if (fr_edit_list_insert_pair_tail(current->el, &parent->vp_group, vp) < 0) {
    talloc_free(vp);
    return NULL;
  }

  /*
   *  Tell the cursor that we appended a pair.  This
   *  function only gets called when we've ran off of the
   *  end of the list, and can't find the thing we're
   *  looking for.  So it's safe at set the current one
   *  here.
   *
   *  @todo - mainly only because we don't allow creating
   *  foo[4] when there's <3 matching entries.  i.e. the
   *  "arrays" here are really lists, so we can't create
   *  "holes" in the list.
   */
  fr_dcursor_set_current(cursor, vp);

  return vp;
}

#define DECLARE(_x) static int _x(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)

DECLARE(expand_lhs);
DECLARE(check_lhs);
DECLARE(check_lhs_value);
DECLARE(check_lhs_nested);
DECLARE(expanded_lhs_attribute);
DECLARE(expanded_lhs_value);

/*
 *  Clean up the current state, and go to the next map.
 */
static int next_map(UNUSED request_t *request, UNUSED unlang_frame_state_edit_t *state, edit_map_t *current)
{
  TALLOC_FREE(current->lhs.to_free);
  TALLOC_FREE(current->rhs.to_free);
  fr_pair_list_free(&current->rhs.pair_list);
  current->lhs.vp = NULL;
  current->lhs.vp_parent = NULL;
  current->lhs.vpt = NULL;
  current->rhs.vpt = NULL;

  current->map = map_list_next(current->map_list, current->map);
  current->func = expand_lhs;

  /*
   *  Don't touch the other callbacks.
   */

  return 0;
}

/*
 *  Validate the RHS of an expansion.
 */
static int check_rhs(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  map_t const *map = current->map;

  if (!XLAT_RESULT_SUCCESS(&current->rhs.result)) {
    if (map->rhs) {
      RDEBUG("Failed expanding ... %s", map->rhs->name);
    } else {
      RDEBUG("Failed assigning to %s", map->lhs->name);
    }
    return -1;
  }

  XDEBUG("%s map %s %s ...", __FUNCTION__, map->lhs->name, fr_tokens[map->op]);

  /*
   *  := is "remove all matching, and then add".  So if even if we don't add anything, we still remove things.
   *
   *  If we deleted the attribute when processing the LHS, then you couldn't reference an attribute
   *  in it's own assignment:
   *
   *    &foo := %tolower(foo)
   *
   *  so we have to delay the deletion until the RHS has been fully expanded.  But we don't always
   *  delete everything. e.g. if the map is:
   *
   *    &foo[1] := %tolower(foo[1])
   *
   *  The we just apply the assignment to the LHS, over-writing it's value.
   */
  if ((map->op == T_OP_SET) &&
      ((tmpl_attr_tail_num(current->lhs.vpt) == NUM_UNSPEC) || (tmpl_attr_tail_num(current->lhs.vpt) > 0) ||
       !current->map->rhs)) {
    if (edit_delete_lhs(request, current,
            (tmpl_attr_tail_num(current->lhs.vpt) == NUM_UNSPEC) || !current->map->rhs) < 0) return -1;
  }

  /*
   *  @todo - Realize the RHS box value.  By moving the code in apply_edits_to_leaf() to a common function,
   *  and getting the box dcursor here.
   *
   *  Then, get a cursor for the LHS vp, and loop over it, applying the edits in the operator, using
   *  the comparisons in the RHS box.
   *
   *  This lets us use array indexes (or more complex things) on the LHS, and means that we don't
   *  have to realize the VPs and use horrible hacks.
   */
  if (current->parent && (current->parent->map->op == T_OP_SUB_EQ)) {
    fr_assert(current->temporary_pair_list);
    fr_assert(tmpl_is_attr(current->lhs.vpt)); /* can only apply edits to real attributes */
    fr_assert(map->rhs);        /* can only filter on leaf attributes */

#if 0
    {
      // dcursor_init over current->lhs.vpt, using children of current->parent.lhs_vp
      //
      // and then use the dcursor from the apply_edits_to_leaf() to get value-boxes
      rcode = fr_value_box_cmp_op(map->op, &vp->data, box);
      if (rcode < 0) return -1;

      if (!rcode) continue;

      if (fr_edit_list_pair_delete(el, list, vp) < 0) return -1;
    }

    return next_map(request, state, current);
#endif
  }

  if (fr_type_is_leaf(tmpl_attr_tail_da(current->lhs.vpt)->type)) {
    if (apply_edits_to_leaf(request, state, current) < 0) return -1;
  } else {
    fr_assert(fr_type_is_structural(tmpl_attr_tail_da(current->lhs.vpt)->type));

    if (apply_edits_to_list(request, state, current) < 0) return -1;
  }

  return next_map(request, state, current);
}

/*
 *  The RHS map is a sublist.  Go expand that by creating a child expansion context, and returning to the
 *  main loop.
 */
static int expand_rhs_list(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  map_t const *map = current->map;
  edit_map_t *child;

  XDEBUG("%s map %s %s ...", __FUNCTION__, map->lhs->name, fr_tokens[map->op]);

  /*
   *  If there's no RHS tmpl, then the RHS is a child list.
   */
  fr_assert(!map->rhs);

  /*
   *  Fast path: child is empty, we don't need to do anything.
   */
  if (fr_dlist_empty(&map->child.head)) {
    if (fr_type_is_leaf(tmpl_attr_tail_da(current->lhs.vpt)->type) && (map->op != T_OP_SET)) {
      REDEBUG("%s[%d] Cannot assign a list to the '%s' data type", MAP_INFO, fr_type_to_str(tmpl_attr_tail_da(current->lhs.vpt)->type));
      return -1;
    }

    return check_rhs(request, state, current);
  }

  /*
   *  Allocate a new child structure if necessary.
   */
  child = current->child;
  if (!child) {
    MEM(child = talloc_zero(state, edit_map_t));
    current->child = child;
    child->parent = current;
  }

  /*
   *  Initialize the child structure.  There's no edit list here, as we're
   *  creating a temporary pair list.  Any edits to this list aren't
   *  tracked, as it only exists in current->parent->rhs.pair_list.
   *
   *  The parent edit_state_t will take care of applying any edits to the
   *  parent vp.  Any child pairs which aren't used will be freed.
   */
  child->el = NULL;
  child->map_list = &map->child;
  child->map = map_list_head(child->map_list);
  child->func = expand_lhs;

  if (fr_type_is_leaf(tmpl_attr_tail_da(current->lhs.vpt)->type)) {
    child->ctx = child;
    child->check_lhs = check_lhs_value;
    child->expanded_lhs = expanded_lhs_value;
    child->temporary_pair_list = false;
  } else {
    fr_assert(fr_type_is_structural(tmpl_attr_tail_da(current->lhs.vpt)->type));

    child->ctx = current->lhs.vp ? (TALLOC_CTX *) current->lhs.vp : (TALLOC_CTX *) child;
    child->check_lhs = check_lhs_nested;
    child->expanded_lhs = expanded_lhs_attribute;
    child->temporary_pair_list = true;
  }

  memset(&child->lhs, 0, sizeof(child->lhs));
  memset(&child->rhs, 0, sizeof(child->rhs));

  fr_pair_list_init(&child->rhs.pair_list);
  fr_value_box_list_init(&child->lhs.list);
  fr_value_box_list_init(&child->rhs.list);

  /*
   *  Continue back with the RHS when we're done processing the
   *  child.  The go process the child.
   */
  current->func = check_rhs;
  state->current = child;
  RINDENT();
  return 0;
}


/*
 *  Expand the RHS of an assignment operation.
 */
static int expand_rhs(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  int rcode;
  map_t const *map = current->map;

  if (!map->rhs) return expand_rhs_list(request, state, current);

  XDEBUG("%s map %s %s %s", __FUNCTION__, map->lhs->name, fr_tokens[map->op], map->rhs->name);

  /*
   *  Turn the RHS into a tmpl_t.  This can involve just referencing an existing
   *  tmpl in map->rhs, or expanding an xlat to get an attribute name.
   */
  rcode = tmpl_to_values(state, &current->rhs, request, map->rhs);
  if (rcode < 0) return -1;

  if (rcode == 1) {
    current->func = check_rhs;
    return 1;
  }

  return check_rhs(request, state, current);
}

/*
 *  The LHS is a value, and the parent is a leaf.  There is no RHS.
 *
 *  Do some validations, and move the value-boxes to the parents result list.
 */
static int check_lhs_value(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  map_t const   *map = current->map;
  fr_value_box_t    *box;
  fr_pair_t   *vp;
  tmpl_t const    *vpt;
  tmpl_dcursor_ctx_t  cc;
  fr_dcursor_t    cursor;

  fr_assert(current->parent);

  XDEBUG("%s map %s", __FUNCTION__, map->lhs->name);

  if (tmpl_is_data(map->lhs)) {
    vpt = map->lhs;

  data:
    MEM(box = fr_value_box_alloc_null(state));
    if (unlikely(fr_value_box_copy(box, box, tmpl_value(vpt)) < 0)) return -1;

    fr_value_box_list_insert_tail(&current->parent->rhs.list, box);

    return next_map(request, state, current);
  }

  if (!current->lhs.vpt) {
    vpt = map->lhs;

    /*
     *  If the LHS is an xlat, then we don't need to do additional checking.  The xlat output
     *  has already been move to the output list.
     */
    if (tmpl_is_xlat(vpt)) return next_map(request,state, current);

  attr:
    fr_assert(tmpl_is_attr(vpt));

    /*
     *  Loop over the attributes, copying their value-boxes to the parent list.
     */
    vp = tmpl_dcursor_init(NULL, request, &cc, &cursor, request, vpt);
    while (vp) {
      MEM(box = fr_value_box_alloc_null(state));
      if (unlikely(fr_value_box_copy(box, box, &vp->data) < 0)) {
        tmpl_dcursor_clear(&cc);
        return -1;
      }

      fr_value_box_list_insert_tail(&current->parent->rhs.list, box);

      vp = fr_dcursor_next(&cursor);
    }
    tmpl_dcursor_clear(&cc);

    return next_map(request, state, current);
  }

  vpt = current->lhs.vpt;

  if (tmpl_is_data(vpt)) goto data;

  goto attr;
}

/*
 *  We've expanded the LHS (xlat or exec) into a value-box list.  The result gets moved to the parent
 *  result list.
 *
 *  There's no RHS, so once the LHS has been expanded, we jump immediately to the next entry.
 */
static int expanded_lhs_value(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  fr_dict_attr_t const *da;
  fr_type_t type;
  fr_value_box_t *box = fr_value_box_list_head(&current->lhs.list);
  fr_value_box_t *dst;
  fr_sbuff_unescape_rules_t const *erules = NULL;

  fr_assert(current->parent);

  if (!box) {
    RWDEBUG("Failed expanding result");
    return -1;
  }

  fr_assert(tmpl_is_attr(current->parent->lhs.vpt));

  /*
   *  There's only one value-box, just use it as-is.  We let the parent handler complain about being
   *  able to parse (or not) the value.
   */
  if (!fr_value_box_list_next(&current->lhs.list, box)) goto done;

  /*
   *  Figure out how to parse the string.
   */
  da = tmpl_attr_tail_da(current->parent->lhs.vpt);
  if (fr_type_is_structural(da->type)) {
    fr_assert(da->type == FR_TYPE_GROUP);

    type = FR_TYPE_STRING;

  } else if (fr_type_is_variable_size(da->type)) {
    type = da->type;

  } else {
    type = FR_TYPE_STRING;
  }

  /*
   *  Mash all of the results together.
   */
  if (fr_value_box_list_concat_in_place(box, box, &current->lhs.list, type, FR_VALUE_BOX_LIST_FREE, true, SIZE_MAX) < 0) {
    RWDEBUG("Failed converting result to '%s' - no memory", fr_type_to_str(type));
    return -1;
  }

  /*
   *  Strings, etc. get assigned to the parent.  Fixed-size things ger parsed according to their values / enums.
   */
  if (!fr_type_is_fixed_size(da->type)) {
  done:
    fr_value_box_list_move(&current->parent->rhs.list, &current->lhs.list);
    return next_map(request, state, current);
  }

  /*
   *  Try to re-parse the box as the destination data type.
   */
  MEM(dst = fr_value_box_alloc(state, type, da));

  erules = fr_value_unescape_by_quote[current->map->lhs->quote];

  if (fr_value_box_from_str(dst, dst, da->type, da, box->vb_strvalue, box->vb_length, erules) < 0) {
    talloc_free(dst);
    RWDEBUG("Failed converting result to '%s' - %s", fr_type_to_str(type), fr_strerror());
    return -1;
  }
  fr_value_box_safety_copy_changed(dst, box);

  fr_value_box_list_talloc_free(&current->lhs.list);
  fr_value_box_list_insert_tail(&current->parent->rhs.list, dst);
  return next_map(request, state, current);
}

/*
 *  Check the LHS of an assignment, for
 *
 *    foo = { bar = baz } LHS bar
 *
 *  There are more limitations here on the attr / op / value format then for the top-level check_lhs().
 */
static int check_lhs_nested(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  map_t const *map = current->map;

  fr_assert(current->parent != NULL);

  XDEBUG("%s map %s", __FUNCTION__, map->lhs->name);

  /*
   *  Don't create the leaf.  The apply_edits_to_leaf() function will create them after the RHS has
   *  been expanded.
   */
  if (fr_type_is_leaf(tmpl_attr_tail_da(current->lhs.vpt)->type)) {
    return expand_rhs(request, state, current);
  }

  fr_assert(fr_type_is_structural(tmpl_attr_tail_da(current->lhs.vpt)->type));

  /*
   *  We have a parent, so we know that attribute exist.  Which means that we don't need to call a
   *  cursor function to create this VP.
   */

  /*
   *  We create this VP in the "current" context, so that it's freed on
   *  error.  If we create it in the LHS VP context, then we have to
   *  manually free rhs.pair_list on any error.  Creating it in the
   *  "current" context means we have to reparent it when we move it to the
   *  parent list, but fr_edit_list_apply_list_assignment() does that
   *  anyways.
   */
  MEM(current->lhs.vp = fr_pair_afrom_da(current->ctx, tmpl_attr_tail_da(current->lhs.vpt)));
  fr_pair_append(&current->parent->rhs.pair_list, current->lhs.vp);
  current->lhs.vp->op = map->op;
  PAIR_ALLOCED(current->lhs.vp);

  return expand_rhs(request, state, current);
}

/*
 *  The LHS tmpl is now an attribute reference.  Do some sanity checks on tmpl_attr_tail_num(), operators, etc.
 *  Once that's done, go expand the RHS.
 */
static int check_lhs(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  map_t const *map = current->map;
  int     err;
  fr_pair_t   *vp;
  tmpl_dcursor_ctx_t  cc;
  fr_dcursor_t    cursor;

  if (!XLAT_RESULT_SUCCESS(&current->lhs.result)) {
    RDEBUG("Failed expanding %s ...", map->lhs->name);
    return -1;
  }

  current->lhs.create = false;
  current->lhs.vp = NULL;

  XDEBUG("%s map %s %s ...", __FUNCTION__, map->lhs->name, fr_tokens[map->op]);

  /*
   *  Create the attribute, including any necessary parents.
   */
  if ((map->op == T_OP_EQ) ||
      (fr_type_is_leaf(tmpl_attr_tail_da(current->lhs.vpt)->type) && fr_comparison_op[map->op])) {
    if (tmpl_attr_tail_num(current->lhs.vpt) == NUM_UNSPEC) {
      current->lhs.create = true;

      /*
       *  Don't go to expand_rhs(), as we have to see if the attribute exists.
       */
    }

  } else if (map->op == T_OP_SET) {
    if (tmpl_attr_tail_num(current->lhs.vpt) == NUM_UNSPEC) {
      current->lhs.create = true;
      return expand_rhs(request, state, current);
    }

    /*
     *  Else we're doing something like:
     *
     *    &foo[1] := bar
     *
     *  the attribute has to exist, and we modify its value as a leaf.
     *
     *  If the RHS is a list, we can set the children for a LHS structural type.
     *  But if the LHS is a leaf, then we can't do:
     *
     *    &foo[3] := { a, b, c}
     *
     *  because foo[3] is a single leaf value, not a list.
     */
    if (!map->rhs && fr_type_is_leaf(tmpl_attr_tail_da(current->lhs.vpt)->type) &&
        (map_list_num_elements(&map->child) > 0)) {
      RWDEBUG("Cannot set one entry to multiple values for %s", current->lhs.vpt->name);
      return -1;
    }

  } else if (map->op == T_OP_ADD_EQ) {
    /*
     *  For "+=", if there's no existing attribute, create one, and rewrite the operator we
     *  apply to ":=".  Which also means moving the operator be in edit_map_t, and then updating the
     *  "apply" functions above to use that for the operations, but map->op for printing.
     *
     *  This allows "foo += 4" to set "foo := 4" when the attribute doesn't exist.  It also allows us
     *  to do list appending to an empty list.  But likely only for strings, octets, and numbers.
     *  Nothing much else makes sense.
     */

    switch (tmpl_attr_tail_da(current->lhs.vpt)->type) {
    case FR_TYPE_NUMERIC:
    case FR_TYPE_OCTETS:
    case FR_TYPE_STRING:
    case FR_TYPE_STRUCTURAL:
      current->lhs.create = true;
      break;

    default:
      break;
    }
  }

  /*
   *  Find the VP.  If the operation is "=" or ":=", then it's OK for the VP to not exist.
   *
   *  @todo - put the cursor into the LHS, and then set lhs.vp == NULL
   *  use the cursor in apply_edits_to_leaf()
   */
  fr_strerror_clear();
  vp = tmpl_dcursor_init(&err, current->ctx, &cc, &cursor, request, current->lhs.vpt);
  tmpl_dcursor_clear(&cc);
  if (!vp) {
    if (!current->lhs.create) {
      RWDEBUG("Failed finding %s", current->lhs.vpt->name);
      return -1;
    }

    /*
     *  Else we need to create it.
     */
    return expand_rhs(request, state, current);

  } else if (current->lhs.create) {
    /*
     *  &foo[1] := bar
     *  &foo = bar
     */
    current->lhs.create = false;

    if (map->rhs && fr_type_is_structural(vp->vp_type) && tmpl_is_exec(map->rhs)) {
      int rcode;

      current->lhs.vp = vp;
      current->lhs.vp_parent = fr_pair_parent(vp);

      rcode = tmpl_to_values(state, &current->rhs, request, map->rhs);
      if (rcode < 0) return -1;

      if (rcode == 1) {
        current->func = check_rhs;
        return 1;
      }

      return expand_rhs(request, state, current);
    }

    /*
     *  We found it, but the attribute already exists.  This
     *  is a NOOP, where we ignore this assignment.
     */
    if (map->op == T_OP_EQ) {
      return next_map(request, state, current);
    }

    /*
     *  &foo[1] exists, don't bother deleting it.  Just over-write its value.
     */
    fr_assert((map->op == T_OP_SET) || (map->op == T_OP_ADD_EQ) || fr_comparison_op[map->op]);
//    fr_assert((map->op == T_OP_ADD_EQ) || tmpl_attr_tail_num(map->lhs) != NUM_UNSPEC);

    // &control := ...
  }

  /*
   *  We forbid operations on immutable leaf attributes.
   *
   *  If a list contains an immutable attribute, then we can still operate on the list, but instead
   *  we look at each VP we're operating on.
   */
  if (fr_type_is_leaf(vp->vp_type) && vp->vp_immutable) {
    RWDEBUG("Cannot modify immutable value for %s", current->lhs.vpt->name);
    return -1;
  }

  /*
   *  We found an existing attribute, with a modification operator.
   */
  current->lhs.vp = vp;
  current->lhs.vp_parent = fr_pair_parent(current->lhs.vp);
  return expand_rhs(request, state, current);
}

/*
 *  We've expanding the LHS into a string.  Now convert it to an attribute.
 *
 *    foo := bar    LHS foo
 *    foo = { bar = baz } LHS bar
 */
static int expanded_lhs_attribute(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  REXDENT();

  if (tmpl_attr_from_result(state, current->map, &current->lhs, request) < 0) return -1;

  return current->check_lhs(request, state, current);
}

/*
 *  Take the LHS of a map, and figure out what it is.  Data and attributes are immediately processed.
 *  xlats and execs are expanded, and then their expansion is checked.
 *
 *  This function is called for all variants of the LHS:
 *
 *    foo := bar    LHS foo
 *    foo = { bar = baz } LHS bar
 *    foo = { 1, 2, 3, 4 }  LHS 1, 2, etc.
 *
 */
static int expand_lhs(request_t *request, unlang_frame_state_edit_t *state, edit_map_t *current)
{
  int rcode;
  map_t const *map = current->map;

  XDEBUG("%s map %s %s ...", __FUNCTION__, map->lhs->name, fr_tokens[map->op]);

  fr_assert(fr_value_box_list_empty(&current->lhs.list));  /* Should have been consumed */
  fr_assert(fr_value_box_list_empty(&current->rhs.list));  /* Should have been consumed */

  rcode = tmpl_to_values(state, &current->lhs, request, map->lhs);
  if (rcode < 0) return -1;

  if (rcode == 1) {
    current->func = current->expanded_lhs;
    return 1;
  }

  return current->check_lhs(request, state, current);
}

/** Apply a map (recursively) to a request.
 *
 * @param[out] p_result The rcode indicating what the result
 *          of the operation was.
 * @param[in] request The current request.
 * @param[in] frame Current stack frame.
 * @return
 *  - UNLANG_ACTION_CALCULATE_RESULT changes were applied.
 *  - UNLANG_ACTION_PUSHED_CHILD async execution of an expansion is required.
 */
static unlang_action_t process_edit(unlang_result_t *p_result, request_t *request, unlang_stack_frame_t *frame)
{
  unlang_frame_state_edit_t *state = talloc_get_type_abort(frame->state, unlang_frame_state_edit_t);

  /*
   *  Keep running the "expand map" function until done.
   */
  while (state->current) {
    while (state->current->map) {
      int rcode;

      if (!state->current->map->rhs) {
        XDEBUG("MAP %s ...", state->current->map->lhs->name);
      } else {
        XDEBUG("MAP %s ... %s", state->current->map->lhs->name, state->current->map->rhs->name);
      }

      state->current->lhs.result = state->current->rhs.result = UNLANG_RESULT_RCODE(RLM_MODULE_OK);

      rcode = state->current->func(request, state, state->current);
      if (rcode < 0) {
        RINDENT_RESTORE(request, state);

        /*
         *  Expansions, etc. failures are SOFT failures, which undo the edit
         *  operations, but otherwise do not affect the interpreter.
         *
         *  However, if the caller asked for the actual result, return that, too.
         */
        if (state->success) *state->success = false;

        if (state->ours) fr_edit_list_abort(state->el);
        TALLOC_FREE(frame->state);
        repeatable_clear(frame);

        RETURN_UNLANG_FAIL;
      }

      if (rcode == 1) {
        repeatable_set(frame);
        return UNLANG_ACTION_PUSHED_CHILD;
      }
    }

    /*
     *  Stop if there's no parent to process.
     */
    if (!state->current->parent) break;

    state->current = state->current->parent;
    REXDENT(); /* "push child" has called RINDENT */
  }

  /*
   *  Freeing the edit list will automatically commit the edits.  i.e. trash the undo list, and
   *  leave the edited pairs in place.
   */

  RINDENT_RESTORE(request, state);

  if (state->success) *state->success = true;
  return UNLANG_ACTION_CALCULATE_RESULT;
}

static void edit_state_init_internal(request_t *request, unlang_frame_state_edit_t *state, fr_edit_list_t *el, map_list_t const *map_list)
{
  edit_map_t      *current = &state->first;

  state->current = current;
  fr_value_box_list_init(&current->lhs.list);
  fr_value_box_list_init(&current->rhs.list);

  /*
   *  The edit list creates a local pool which should
   *  generally be large enough for most edits.
   */
  if (!el) {
    MEM(state->el = fr_edit_list_alloc(state, map_list_num_elements(map_list), NULL));
    state->ours = true;
  } else {
    state->el = el;
    state->ours = false;
  }

  current->request = request;
  current->ctx = state;
  current->el = state->el;
  current->map_list = map_list;
  current->map = map_list_head(current->map_list);
  fr_pair_list_init(&current->rhs.pair_list);
  current->func = expand_lhs;
  current->check_lhs = check_lhs;
  current->expanded_lhs = expanded_lhs_attribute;

  /*
   *  Save current indentation for the error path.
   */
  RINDENT_SAVE(state, request);
}

/** Execute an update block
 *
 * Update blocks execute in two phases, first there's an evaluation phase where
 * each input map is evaluated, outputting one or more modification maps. The modification
 * maps detail a change that should be made to a list in the current request.
 * The request is not modified during this phase.
 *
 * The second phase applies those modification maps to the current request.
 * This re-enables the atomic functionality of update blocks provided in v2.x.x.
 * If one map fails in the evaluation phase, no more maps are processed, and the current
 * result is discarded.
 */
static unlang_action_t unlang_edit_state_init(unlang_result_t *p_result, request_t *request, unlang_stack_frame_t *frame)
{
  unlang_edit_t     *edit = unlang_generic_to_edit(frame->instruction);
  unlang_frame_state_edit_t *state = talloc_get_type_abort(frame->state, unlang_frame_state_edit_t);
  fr_edit_list_t      *el = unlang_interpret_edit_list(request);

  edit_state_init_internal(request, state, el, &edit->maps);

  /*
   *  Call process_edit to do all of the work.
   */
  frame_repeat(frame, process_edit);
  return process_edit(p_result, request, frame);
}


/** Push a map onto the stack for edit evaluation
 *
 *  If the "success" variable returns "false", the caller should call fr_edit_list_abort().
 *
 *  If the "success" variable returns "true", the caller can free the edit list (or rely on talloc to do that)
 *  and the transaction will be finalized.
 *
 * @param[in] request   The current request.
 * @param[out] success    Whether or not the edit succeeded
 * @param[in] el    Edit list which can be used to apply multiple edits
 * @param[in] map_list    The map list to process
 */
int unlang_edit_push(request_t *request, bool *success, fr_edit_list_t *el, map_list_t const *map_list)
{
  unlang_stack_t      *stack = request->stack;
  unlang_stack_frame_t    *frame;
  unlang_frame_state_edit_t *state;

  unlang_edit_t     *edit;

  static unlang_t edit_instruction = {
    .type = UNLANG_TYPE_EDIT,
    .name = "edit",
    .debug_name = "edit",
    .actions = DEFAULT_MOD_ACTIONS,
  };

  MEM(edit = talloc(stack, unlang_edit_t));
  *edit = (unlang_edit_t) {
    .self = edit_instruction,
  };

  unlang_type_init(&edit->self, NULL, UNLANG_TYPE_EDIT);
  map_list_init(&edit->maps);

  /*
   *  Push a new edit frame onto the stack
   */
  if (unlang_interpret_push(NULL, request, unlang_edit_to_generic(edit),
          FRAME_CONF(RLM_MODULE_NOT_SET, UNLANG_SUB_FRAME), UNLANG_NEXT_STOP) < 0) return -1;

  frame = &stack->frame[stack->depth];
  state = talloc_get_type_abort(frame->state, unlang_frame_state_edit_t);

  edit_state_init_internal(request, state, el, map_list);
  state->success = success;

  return 0;
}

void unlang_edit_init(void)
{
  unlang_register(&(unlang_op_t){
      .name = "edit",
      .type = UNLANG_TYPE_EDIT,
      .flag = UNLANG_OP_FLAG_INTERNAL,

      .interpret = unlang_edit_state_init,

      .unlang_size = sizeof(unlang_edit_t),
      .unlang_name = "unlang_edit_t",

      .frame_state_size = sizeof(unlang_frame_state_edit_t),
      .frame_state_type = "unlang_frame_state_edit_t",
    });
}

Coverage Report

Created: 2026-03-31 06:21