Adding upstream version 3.2.1+dfsg.upstream/3.2.1+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

150 files changed, 8442 insertions, 0 deletions

diff --git a/src/tests/keywords/3gpp b/src/tests/keywords/3gpp
new file mode 100644
index 0000000..05e3fb2
--- /dev/null
+++ b/src/tests/keywords/3gpp
@@ -0,0 +1,19 @@
+#
+#  PRE: update
+#
+update request {
+	3GPP-IMSI := "hello"
+}
+
+#
+#  "request:[0-9]" should be parsed as a list followed
+#  by an attribute.
+#
+update control {
+	Tmp-String-0 := "%{3GPP-IMSI}"
+	Tmp-String-1 := "%{request:3GPP-IMSI}"
+}
+
+update reply {
+       Filter-Id := "filter"
+}
\ No newline at end of file
diff --git a/src/tests/keywords/README.md b/src/tests/keywords/README.md
new file mode 100644
index 0000000..68ce136
--- /dev/null
+++ b/src/tests/keywords/README.md
@@ -0,0 +1,43 @@
+# The Keyword test Framework
+
+See `update` and `default-input.attrs` for examples.
+
+In short, the test framework assumes Access-Request with PAP
+authentication.  The password is hard-coded into the configuration,
+and can't be changed.
+
+The entire test suite consists of two files:
+
+* foo
+
+  Contains a short piece of "unlang".  The shorter the better.  The
+  goal is to do something useful in unlang, and modify the input
+  packet and/or the reply.
+
+  If the test depends on another one, it should name the other test
+  at the top of the file.  For example, the `if-else` test depends
+  on the `if` test.  This dependency is given by the following lines
+  at the top of the `if-else` file:
+
+  `# PRE: if`
+
+* foo.attrs
+
+  Contains the input packet and the filter for the reply.  There
+  always has to be attributes in the input, and filter attributes in the
+  reply.
+
+  If `foo` doesn't exist, then the `default-input.attrs` file is used.
+  This allows many tests to be simplified, as all they need is a
+  little bit of "unlang".
+
+
+## How it works
+
+The input packet is passed into the unit test framework, through the
+unlang snippet in `foo`, and filtered through the reply filter in
+`foo.attrs`.  If everything matches, then the test case passes.
+
+To add a test, just put `foo` and (optionally) `foo.attrs` into this
+directory.  The build framework will pick them up and automatically
+run them.
diff --git a/src/tests/keywords/all.mk b/src/tests/keywords/all.mk
new file mode 100644
index 0000000..739b738
--- /dev/null
+++ b/src/tests/keywords/all.mk
@@ -0,0 +1,123 @@
+#
+#  Unit tests for unlang keywords
+#
+
+#
+#  The test files are files without extensions.
+#  The list is unordered.  The order is added in the next step by looking
+#  at precursors.
+#
+KEYWORD_FILES := $(filter-out %.conf %.md %.attrs %.mk %~ %.rej,$(subst $(DIR)/,,$(wildcard $(DIR)/*)))
+
+ifeq "$(OPENSSL_LIBS)" ""
+KEYWORD_FILES := $(filter-out pap-ssha2,$(KEYWORD_FILES))
+endif
+
+#
+#  Create the output directory
+#
+.PHONY: $(BUILD_DIR)/tests/keywords
+$(BUILD_DIR)/tests/keywords:
+	@mkdir -p $@
+
+#
+#  Find which input files are needed by the tests
+#  strip out the ones which exist
+#  move the filenames to the build directory.
+#
+BOOTSTRAP_EXISTS := $(addprefix $(DIR)/,$(addsuffix .attrs,$(KEYWORD_FILES)))
+BOOTSTRAP_NEEDS	 := $(filter-out $(wildcard $(BOOTSTRAP_EXISTS)),$(BOOTSTRAP_EXISTS))
+BOOTSTRAP	 := $(subst $(DIR),$(BUILD_DIR)/tests/keywords,$(BOOTSTRAP_NEEDS))
+
+#
+#  For each file, look for precursor test.
+#  Ensure that each test depends on its precursors.
+#
+-include $(BUILD_DIR)/tests/keywords/depends.mk
+
+export OPENSSL_LIBS
+
+$(BUILD_DIR)/tests/keywords/depends.mk: $(addprefix $(DIR)/,$(KEYWORD_FILES)) | $(BUILD_DIR)/tests/keywords
+	@rm -f $@
+	@for x in $^; do \
+		y=`grep 'PRE: ' $$x | sed 's/.*://;s/  / /g;s, , $(BUILD_DIR)/tests/keywords/,g'`; \
+		if [ "$$y" != "" ]; then \
+			z=`echo $$x | sed 's,src/,$(BUILD_DIR)/',`; \
+			echo "$$z: $$y" >> $@; \
+			echo "" >> $@; \
+		fi \
+	done
+
+#
+#  These ones get copied over from the default input
+#
+$(BOOTSTRAP): $(DIR)/default-input.attrs | $(BUILD_DIR)/tests/keywords
+	@cp $< $@
+
+#
+#  These ones get copied over from their original files
+#
+$(BUILD_DIR)/tests/keywords/%.attrs: $(DIR)/%.attrs | $(BUILD_DIR)/tests/keywords
+	@cp $< $@
+
+#
+#  Don't auto-remove the files copied by the rule just above.
+#  It's unnecessary, and it clutters the output with crap.
+#
+.PRECIOUS: $(BUILD_DIR)/tests/keywords/%.attrs
+
+KEYWORD_MODULES := $(shell grep -- mods-enabled src/tests/keywords/radiusd.conf | sed 's,.*/,,')
+KEYWORD_RADDB	:= $(addprefix raddb/mods-enabled/,$(KEYWORD_MODULES))
+KEYWORD_LIBS	:= $(addsuffix .la,$(addprefix rlm_,$(KEYWORD_MODULES))) rlm_example.la rlm_cache.la
+
+#
+#  Files in the output dir depend on the unit tests
+#
+#	src/tests/keywords/FOO		unlang for the test
+#	src/tests/keywords/FOO.attrs	input RADIUS and output filter
+#	build/tests/keywords/FOO	updated if the test succeeds
+#	build/tests/keywords/FOO.log	debug output for the test
+#
+#  Auto-depend on modules via $(shell grep INCLUDE $(DIR)/radiusd.conf | grep mods-enabled | sed 's/.*}/raddb/'))
+#
+#  If the test fails, then look for ERROR in the input.  No error
+#  means it's unexpected, so we die.
+#
+#  Otherwise, check the log file for a parse error which matches the
+#  ERROR line in the input.
+#
+$(BUILD_DIR)/tests/keywords/%: ${DIR}/% $(BUILD_DIR)/tests/keywords/%.attrs $(TESTBINDIR)/unittest | $(BUILD_DIR)/tests/keywords $(KEYWORD_RADDB) $(KEYWORD_LIBS) build.raddb rlm_cache_rbtree.la rlm_test.la rlm_unix.la
+	@echo UNIT-TEST $(notdir $@)
+	@if ! KEYWORD=$(notdir $@) $(TESTBIN)/unittest -D share -d src/tests/keywords/ -i $@.attrs -f $@.attrs -xx > $@.log 2>&1; then \
+		if ! grep ERROR $< 2>&1 > /dev/null; then \
+			cat $@.log; \
+			echo "# $@.log"; \
+			echo KEYWORD=$(notdir $@) $(TESTBIN)/unittest -D share -d src/tests/keywords/ -i $@.attrs -f $@.attrs -xx; \
+			exit 1; \
+		fi; \
+		FOUND=$$(grep ^$< $@.log | head -1 | sed 's/:.*//;s/.*\[//;s/\].*//'); \
+		EXPECTED=$$(grep -n ERROR $< | sed 's/:.*//'); \
+		if [ "$$EXPECTED" != "$$FOUND" ]; then \
+			cat $@.log; \
+			echo "# $@.log"; \
+			echo KEYWORD=$(notdir $@) $(TESTBIN)/unittest -D share -d src/tests/keywords/ -i $@.attrs -f $@.attrs -xx; \
+			exit 1; \
+		fi \
+	fi
+	@touch $@
+
+#
+#  Get all of the unit test output files
+#
+TESTS.KEYWORDS_FILES := $(addprefix $(BUILD_DIR)/tests/keywords/,$(KEYWORD_FILES))
+
+#
+#  Depend on the output files, and create the directory first.
+#
+tests.keywords: $(TESTS.KEYWORDS_FILES)
+
+$(TESTS.KEYWORDS_FILES): $(TESTS.XLAT_FILES) $(TESTS.MAP_FILES)
+
+.PHONY: clean.tests.keywords
+clean.tests.keywords:
+	@rm -rf $(BUILD_DIR)/tests/keywords/
diff --git a/src/tests/keywords/array b/src/tests/keywords/array
new file mode 100644
index 0000000..a901a2b
--- /dev/null
+++ b/src/tests/keywords/array
@@ -0,0 +1,53 @@
+#
+#  PRE: if
+#
+#  Tests for dereferencing the Nth attribute
+#
+update reply {
+	Filter-Id := "filter"
+}
+
+update request {
+       Class := 0x01020304
+       Class += 0x05060708
+       Class += 0x090a0b0c
+}
+
+if (&Class != 0x01020304) {
+	update reply {
+		Filter-Id := "fail 0"
+	}
+}
+
+#  Must be the same as above
+if (&Class[0] != 0x01020304) {
+	update reply {
+		Filter-Id += "fail 0a"
+	}
+}
+
+if (&Class[1] != 0x05060708) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+if (&Class[2] != 0x090a0b0c) {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+# must not exist
+if (&Class[3]) {
+	update reply {
+		Filter-Id += "fail 3"
+	}
+}
+
+# Last element of the array
+if (&Class[n] != 0x090a0b0c) {
+	update reply {
+		Filter-Id += "fail 4"
+	}
+}
diff --git a/src/tests/keywords/base64 b/src/tests/keywords/base64
new file mode 100644
index 0000000..9661252
--- /dev/null
+++ b/src/tests/keywords/base64
@@ -0,0 +1,141 @@
+#
+# PRE: hex
+#
+update reply {
+       Filter-Id := "filter"
+}
+
+update request {
+	Tmp-String-0        := '9870'
+	Tmp-Octets-0        := 0x39383731
+	Tmp-IP-Address-0    := 57.56.55.50
+	Tmp-Date-0          := 959985459
+	Tmp-Integer-0       := 959985460
+	Tmp-Cast-Abinary    := 'ip out forward srcip 57.56.55.53/32 udp dstport = 1812'
+	Tmp-Cast-IfId       := '0000:0000:3938:3737'
+	Tmp-Cast-IPv6Addr   := '::3938:3738'
+	Tmp-Cast-IPv6Prefix := '::3938:3739/128'
+	Tmp-Cast-Byte       := 58
+	Tmp-Cast-Short      := 14139
+	Tmp-Cast-Ethernet   := 00:00:39:38:37:3c
+	Tmp-Cast-Integer64  := 1152921505566832445
+	Tmp-Cast-IPv4Prefix := 57.56.55.62/32
+}
+
+update request {
+	Tmp-String-0        := "%{base64:&Tmp-String-0}"
+	Tmp-String-1        := "%{base64:&Tmp-Octets-0}"
+	Tmp-String-2        := "%{base64:&Tmp-IP-Address-0}"
+	Tmp-String-3        := "%{base64:&Tmp-Date-0}"
+	Tmp-String-4        := "%{base64:&Tmp-Integer-0}"
+	Tmp-String-5        := "%{base64:&Tmp-Cast-Abinary}"
+	Tmp-String-6        := "%{base64:&Tmp-Cast-Ifid}"
+	Tmp-String-7        := "%{base64:&Tmp-Cast-IPv6Addr}"
+	Tmp-String-8        := "%{base64:&Tmp-Cast-IPv6Prefix}"
+	Tmp-String-9        := "%{base64:&Tmp-Cast-Byte}"
+}
+
+# String - bin 0x39383730
+if (Tmp-String-0 != 'OTg3MA==') {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+# Octets - bin 0x39383731
+if (Tmp-String-1 != 'OTg3MQ==') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+# IP Address - bin 0x39383732
+if (Tmp-String-2 != 'OTg3Mg==') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# Date - bin 0x39383733
+if (Tmp-String-3 != 'OTg3Mw==') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# Integer - bin 0x39383734
+if (Tmp-String-4 != 'OTg3NA==') {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+# Abinary - bin 0x0101000039383735000000002000110000000714000200000000000000000000
+if (Tmp-String-5 != 'AQEAADk4NzUAAAAAIAARAAAABxQAAgAAAAAAAAAAAAA=') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# ifid - bin 0x0000000039383737
+if (Tmp-String-6 != 'AAAAADk4Nzc=') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+# ipv6addr - bin 0x00000000000000000000000039383738
+if (Tmp-String-7 != 'AAAAAAAAAAAAAAAAOTg3OA==') {
+	update reply {
+		Filter-ID += 'fail 7'
+	}
+}
+
+# ipv6addrprefix - bin 0x008000000000000000000000000039383739
+if (Tmp-String-8 != 'AIAAAAAAAAAAAAAAAAA5ODc5') {
+	update reply {
+		Filter-ID += 'fail 8'
+	}
+}
+
+# byte - bin 0x3a
+if (Tmp-String-9 != 'Og==') {
+	update reply {
+		Filter-ID += 'fail 9'
+	}
+}
+
+update request {
+	Tmp-String-0        := "%{base64:&Tmp-Cast-Short}"
+	Tmp-String-1        := "%{base64:&Tmp-Cast-Ethernet}"
+	Tmp-String-2        := "%{base64:&Tmp-Cast-Integer64}"
+	Tmp-String-3        := "%{base64:&Tmp-Cast-IPv4Prefix}"
+}
+
+# short - bin 0x373b
+if (Tmp-String-0 != 'Nzs=') {
+	update reply {
+		Filter-ID += 'fail 9'
+	}
+}
+
+# ethernet - bin 0x00003938373c
+if (Tmp-String-1 != 'AAA5ODc8') {
+	update reply {
+		Filter-Id += 'fail 10'
+	}
+}
+
+# integer64 - bin 0x100000003938373d
+if (Tmp-String-2 != 'EAAAADk4Nz0=') {
+	update reply {
+		Filter-Id += 'fail 11'
+	}
+}
+
+# ipv4prefix - bin 0x00203938373e
+if (Tmp-String-3 != 'ACA5ODc+') {
+	update reply {
+		Filter-Id += 'fail 12'
+	}
+}
diff --git a/src/tests/keywords/break-error b/src/tests/keywords/break-error
new file mode 100644
index 0000000..fff20f0
--- /dev/null
+++ b/src/tests/keywords/break-error
@@ -0,0 +1,11 @@
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+       Filter-Id := "filter"
+}
+
+if (User-Name == "bob") {
+	break			# ERROR
+}
diff --git a/src/tests/keywords/cache b/src/tests/keywords/cache
new file mode 100644
index 0000000..58ce207
--- /dev/null
+++ b/src/tests/keywords/cache
@@ -0,0 +1,229 @@
+#
+#  PRE: update if
+#
+update {
+	&control:Cleartext-Password := 'hello'
+	&request:Tmp-String-0 := 'testkey'
+	&reply:Filter-Id := 'filter'
+}
+
+
+#
+#  Basic store and retrieve
+#
+update control {
+	&control:Tmp-String-1 := 'cache me'
+}
+
+cache
+if (!updated) {
+	update reply {
+		Filter-Id := 'fail 0'
+	}
+	reject
+}
+
+# Check status-only works correctly (should return ok and consume attribute)
+update control {
+	Cache-Status-Only := 'yes'
+}
+cache
+if (!ok) {
+	update reply {
+		Filter-Id := 'fail 2a'
+	}
+	reject
+}
+
+if (&control:Cache-Status-Only) {
+	update reply {
+		Filter-Id := 'fail 2b'
+	}
+	reject
+}
+
+# Retrieve the entry (should be copied to request list)
+cache
+if (!ok) {
+	update reply {
+		Filter-Id := 'fail 3a'
+	}
+	reject
+}
+
+if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+	update reply {
+		Filter-Id := 'fail 3b'
+	}
+}
+
+# Retrieving the entry should not expire it
+update request {
+	Tmp-String-1 !* ANY
+}
+
+cache
+if (!ok) {
+	update reply {
+		Filter-Id := 'fail 4a'
+	}
+	reject
+}
+
+if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+	update reply {
+		Filter-Id := 'fail 4b'
+	}
+	reject
+}
+
+# Force expiry of the entry
+update control {
+	Cache-TTL := 0
+}
+cache
+if (!ok) {
+	update reply {
+		Filter-Id := 'fail 5'
+	}
+	reject
+}
+
+# Check status-only works correctly (should return notfound and consume attribute)
+update control {
+	Cache-Status-Only := 'yes'
+}
+cache
+if (!notfound) {
+	update reply {
+		Filter-Id := 'fail 6a'
+	}
+	reject
+}
+
+if (&control:Cache-Status-Only) {
+	update reply {
+		Filter-Id := 'fail 6b'
+	}
+	reject
+}
+
+# Check read-only works correctly (should return notfound and consume attribute)
+update control {
+	Cache-Read-Only := 'yes'
+}
+cache
+if (!notfound) {
+	update reply {
+		Filter-Id := 'fail 7a'
+	}
+	reject
+}
+
+if (&control:Cache-Read-Only) {
+	update reply {
+		Filter-Id := 'fail 7b'
+	}
+	reject
+}
+
+# ...and check the entry wasn't recreated
+update control {
+	Cache-Status-Only := 'yes'
+}
+cache
+if (!notfound) {
+	update reply {
+		Filter-Id := 'fail 7c'
+	}
+	reject
+}
+
+# This should still allow the creation of a new entry
+update control {
+	Cache-TTL := -1
+}
+cache
+if (!updated) {
+	update reply {
+		Filter-Id := 'fail 8a'
+	}
+	reject
+}
+
+cache
+if (!ok) {
+	update reply {
+		Filter-Id := 'fail 8b'
+	}
+	reject
+}
+
+if (&Cache-TTL) {
+	update reply {
+		Filter-Id := 'fail 8c'
+	}
+	reject
+}
+
+if (&request:Tmp-String-1 != &control:Tmp-String-1) {
+	update reply {
+		Filter-Id := 'fail 8d'
+	}
+	reject
+}
+
+update control {
+	Tmp-String-1 := 'cache me2'
+}
+
+# Updating the Cache-TTL shouldn't make things go boom (we can't really check if it works)
+update control {
+	Cache-TTL := 30
+}
+cache
+if (!ok) {
+	update reply {
+		Filter-Id := 'fail 9a'
+	}
+	reject
+}
+
+# Request Tmp-String-1 shouldn't have been updated yet
+if (&request:Tmp-String-1 == &control:Tmp-String-1) {
+	update reply {
+		Filter-Id := 'fail 9b'
+	}
+	reject
+}
+
+# Check that a new entry is created
+update control {
+	Cache-TTL := -1
+}
+cache
+if (!updated) {
+	update reply {
+		Filter-Id := 'fail 10a'
+	}
+	reject
+}
+
+# Check Cache-Entry-Hits is updated as we expect
+if (&request:Cache-Entry-Hits != 0) {
+	update reply {
+		Filter-Id := 'fail 12a'
+	}
+	reject
+}
+
+cache
+
+if (&request:Cache-Entry-Hits != 1) {
+	update reply {
+		Filter-Id := 'fail 12b'
+	}
+	reject
+}
+
+
diff --git a/src/tests/keywords/case-attr-error b/src/tests/keywords/case-attr-error
new file mode 100644
index 0000000..e9516cc
--- /dev/null
+++ b/src/tests/keywords/case-attr-error
@@ -0,0 +1,20 @@
+# PRE: case-empty
+#
+update reply {
+	Filter-Id := "fail"
+}
+
+switch &reply:Filter-Id {
+	# deliberately empty
+	case "filter" {
+	}
+
+	case &Not-Dynamically-Allocated {	# ERROR
+		update reply {
+			Filter-Id := "fail"
+		}
+	}
+
+	case {
+	}
+}
diff --git a/src/tests/keywords/case-empty b/src/tests/keywords/case-empty
new file mode 100644
index 0000000..46ea054
--- /dev/null
+++ b/src/tests/keywords/case-empty
@@ -0,0 +1,23 @@
+# PRE: switch
+#
+update reply {
+	Filter-Id := "filter"
+}
+
+switch &reply:Filter-Id {
+	# deliberately empty
+	case "filter" {
+	}
+
+	case "fail" {
+		update reply {
+			Filter-Id := "fail"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+}
diff --git a/src/tests/keywords/case-empty-string b/src/tests/keywords/case-empty-string
new file mode 100644
index 0000000..4b8e7cd
--- /dev/null
+++ b/src/tests/keywords/case-empty-string
@@ -0,0 +1,25 @@
+# PRE: switch
+#
+update request {
+	Filter-Id := ""
+}
+
+switch &Filter-Id {
+	case "" {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case "doug" {
+		update reply {
+			Filter-Id := "doug"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+}
diff --git a/src/tests/keywords/case-list b/src/tests/keywords/case-list
new file mode 100644
index 0000000..e4a0290
--- /dev/null
+++ b/src/tests/keywords/case-list
@@ -0,0 +1,19 @@
+switch &User-Name {
+	case "bob" {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case &reply: {	# ERROR
+		update reply {
+			Filter-Id := "doug"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+}
diff --git a/src/tests/keywords/cast-byte b/src/tests/keywords/cast-byte
new file mode 100644
index 0000000..4663d95
--- /dev/null
+++ b/src/tests/keywords/cast-byte
@@ -0,0 +1,25 @@
+#
+#  PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       request:Class := 0xad
+}
+
+if (<byte>Class == 173) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
+
+if (<byte>Class < 173) {
+	update reply {
+		Filter-Id += "wrong"
+	}
+}
+
+if (<byte>Class > 173) {
+	update reply {
+		Filter-Id += "wrong"
+	}
+}
diff --git a/src/tests/keywords/cast-integer b/src/tests/keywords/cast-integer
new file mode 100644
index 0000000..4972ee7
--- /dev/null
+++ b/src/tests/keywords/cast-integer
@@ -0,0 +1,25 @@
+#
+#  PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       request:Class := 0x00000101
+}
+
+if (<integer>Class == 257) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
+
+if (<integer>Class < 256) {
+	update reply {
+		Filter-Id += "wrong"
+	}
+}
+
+if (<integer>Class > 257) {
+	update reply {
+		Filter-Id += "wrong"
+	}
+}
diff --git a/src/tests/keywords/cast-ipaddr b/src/tests/keywords/cast-ipaddr
new file mode 100644
index 0000000..f0dd356
--- /dev/null
+++ b/src/tests/keywords/cast-ipaddr
@@ -0,0 +1,442 @@
+#
+#  PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       request:NAS-IP-Address := 127.0.0.1
+       request:Tmp-Integer-0 := 2130706433
+       reply:Filter-Id := "filter"
+}
+
+update request {
+	Tmp-String-0 := "%{request:NAS-IP-Address}"
+}
+
+if (<ipaddr>Tmp-Integer-0 != NAS-IP-Address) {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+#
+#  Update statements do implicit casts, so we can check
+#  cast results are correct, by using the update to perform
+#  the cast, and looking at the results.
+#
+update request {
+	Tmp-Cast-Ipaddr	 := 203.0.113.1
+	Tmp-Cast-IPv4Prefix := 203.0.113.0/24
+	Tmp-Cast-IPv4Prefix += 203.0.113.1/32
+	Tmp-Cast-IPv6Addr := 2001:DB8::1
+	Tmp-Cast-IPv6Addr += ::ffff:203.0.113.1
+	Tmp-Cast-IPv6Prefix := 2001:DB8::/32
+	Tmp-Cast-IPv6Prefix += ::ffff:203.0.113.1/128
+	Tmp-Cast-IPv6Prefix += ::ffff:203.0.113.1/64
+}
+
+#
+#  IPv4 address to IPv6 address
+#
+update control {
+	Tmp-Cast-IPv6addr := &Tmp-Cast-IPaddr
+}
+
+if (&control:Tmp-Cast-IPv6addr != ::ffff:203.0.113.1) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+#
+#  IPv6 address to IPv4 address
+#
+update control {
+	Tmp-Cast-IPaddr := &control:Tmp-Cast-IPv6addr
+}
+
+if (&control:Tmp-Cast-IPaddr != 203.0.113.1) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+#
+#  IPv4 prefix to IPv6 prefix
+#
+update control {
+	Tmp-Cast-IPv6Prefix := &Tmp-Cast-IPv4Prefix
+}
+
+if (&control:Tmp-Cast-IPv6Prefix != ::ffff:203.0.113.0/120) {
+	update reply {
+		Filter-Id += 'Fail 31'
+	}
+}
+
+#
+#  IPv6 prefix to IPv4 prefix
+#
+update control {
+	Tmp-Cast-IPv4Prefix := &control:Tmp-Cast-IPv6Prefix
+}
+
+if (&control:Tmp-Cast-IPv4Prefix != 203.0.113.1/24) {
+	update reply {
+		Filter-Id += 'Fail 4'
+	}
+}
+
+#
+#  IPv4 prefix (32) to IPv6 address
+#
+update control {
+	Tmp-Cast-IPv6Addr := &Tmp-Cast-IPv4Prefix[1]
+}
+
+if (&control:Tmp-Cast-IPv6Addr != ::ffff:203.0.113.1) {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+#
+#  IPv6 prefix (128) to IPv4 address
+#
+update control {
+	Tmp-Cast-Ipaddr := &Tmp-Cast-IPv6Prefix[1]
+}
+
+if (&control:Tmp-Cast-Ipaddr != 203.0.113.1/32) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
+
+#
+#  IPv4 address to IPv6 prefix (128)
+#
+update control {
+	Tmp-Cast-IPv6Prefix := &Tmp-Cast-Ipaddr
+}
+
+if (&control:Tmp-Cast-IPv6Prefix != ::ffff:203.0.113.1/128) {
+	update reply {
+		Filter-Id += 'Fail 7'
+	}
+}
+
+#
+#  IPv6 address to IPv4 prefix (32)
+#
+update control {
+	Tmp-Cast-IPv4Prefix := &Tmp-Cast-IPv6Addr[1]
+}
+
+if (&control:Tmp-Cast-IPv4Prefix != 203.0.113.1/32) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
+
+#
+#  IPv4 address to IPv4 prefix (32)
+#
+update control {
+	Tmp-Cast-IPv4Prefix := &Tmp-Cast-Ipaddr
+}
+
+if (&control:Tmp-Cast-IPv4Prefix != 203.0.113.1/32) {
+	update reply {
+		Filter-Id += 'Fail 9'
+	}
+}
+
+#
+#  IPv6 address to IPv6 prefix (128)
+#
+update control {
+	Tmp-Cast-IPv6Prefix := Tmp-Cast-Ipv6addr
+}
+
+if (&control:Tmp-Cast-IPv6Prefix != 2001:DB8::1/128) {
+	update reply {
+		Filter-Id += 'Fail 11'
+	}
+}
+
+#
+#  IPv4 prefix (32) to IPv4 address
+#
+update control {
+	Tmp-Cast-Ipaddr := &Tmp-Cast-IPv4Prefix[1]
+}
+
+if (&control:Tmp-Cast-Ipaddr != 203.0.113.1) {
+	update reply {
+		Filter-Id += 'Fail 12'
+	}
+}
+
+#
+#  IPv6 prefix (128) to IPv6 address
+#
+update control {
+	Tmp-Cast-IPv6Addr := &Tmp-Cast-IPv6Prefix[1]
+}
+
+if (&control:Tmp-Cast-IPv6Addr != ::ffff:203.0.113.1) {
+	update reply {
+		Filter-Id += 'Fail 13'
+	}
+}
+
+#
+#  And the invalid cases...
+#
+
+#
+#  IPv6 Prefix < 128 to IPv6 address
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-IPv6Addr := Tmp-Cast-IPv6Prefix
+		}
+		update reply {
+			Filter-Id += 'Fail 14'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6prefix to ipv6addr.  Only /128 prefixes may be cast to IP address types') {
+			update reply {
+				Filter-Id += 'Fail 14.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv6 Prefix < 128 to IPv4 address
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-Ipaddr := &Tmp-Cast-IPv6Prefix[2]
+		}
+		update reply {
+			Filter-Id += 'Fail 15'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6prefix to ipaddr.  Only /128 prefixes may be cast to IP address types') {
+			update reply {
+				Filter-Id += 'Fail 15.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv6 Prefix < 96 to IPv4 prefix (causes part of the IPv4/v6 mapping prefix to be masked off)
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-Ipv4Prefix := &Tmp-Cast-IPv6Prefix[2]
+		}
+		update reply {
+			Filter-Id += 'Fail 16'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6prefix to ipv4prefix.  No IPv4-IPv6 mapping prefix') {
+			update reply {
+				Filter-Id += 'Fail 16.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv4 Prefix < 32 to IPv6 address
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-IPv6Addr := &Tmp-Cast-IPv4Prefix
+		}
+		update reply {
+			Filter-Id += 'Fail 17'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv4prefix to ipv6addr.  Only /32 prefixes may be cast to IP address types') {
+			update reply {
+				Filter-Id += 'Fail 17.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv4 Prefix < 32 to IPv4 address
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-Ipaddr := &Tmp-Cast-IPv4Prefix
+		}
+		update reply {
+			Filter-Id += 'Fail 17'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv4prefix to ipaddr.  Only /32 prefixes may be cast to IP address types') {
+			update reply {
+				Filter-Id += 'Fail 17.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv6 Prefix outside mapping range to IPv4 address
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-Ipaddr := &Tmp-Cast-IPv6Prefix
+		}
+		update reply {
+			Filter-Id += 'Fail 18'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6prefix to ipaddr.  Only /128 prefixes may be cast to IP address types') {
+			update reply {
+				Filter-Id += 'Fail 18.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv6 Prefix outside mapping range to IPv4 prefix
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-IPv4Prefix := &Tmp-Cast-IPv6Prefix
+		}
+		update reply {
+			Filter-Id += 'Fail 19'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6prefix to ipv4prefix.  No IPv4-IPv6 mapping prefix') {
+			update reply {
+				Filter-Id += 'Fail 19.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv6 Address outside mapping range to IPv4 address
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-Ipaddr := &Tmp-Cast-IPv6Addr
+		}
+		update reply {
+			Filter-Id += 'Fail 20'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6addr to ipaddr.  No IPv4-IPv6 mapping prefix') {
+			update reply {
+				Filter-Id += 'Fail 20'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv6 Address outside mapping range to IPv4 prefix
+#
+redundant {
+	group {
+		update control {
+			Tmp-Cast-IPv4Prefix := &Tmp-Cast-IPv6Addr
+		}
+		update reply {
+			Filter-Id += 'Fail 21'
+		}
+	}
+	group {
+		if ("%{Module-Failure-Message}" != 'Attribute conversion failed: Invalid cast from ipv6addr to ipv4prefix.  No IPv4-IPv6 mapping prefix') {
+			update reply {
+				Filter-Id += 'Fail 21.5'
+			}
+		}
+		update request {
+			Module-Failure-Message !* ANY
+		}
+		ok
+	}
+}
+
+#
+#  IPv4 address to integer
+#
+update request {
+	Tmp-Integer-0 := &NAS-IP-Address
+}
+
+if (Tmp-Integer-0 != 0x7f000001) {
+	update reply {
+		Filter-Id += 'Fail 22'
+	}
+}
+
+#
+#  Check the decimal value just for the heck of it
+#
+if (Tmp-Integer-0 != 2130706433) {
+	update reply {
+		Filter-Id += 'Fail 23'
+	}
+}
diff --git a/src/tests/keywords/cast-short b/src/tests/keywords/cast-short
new file mode 100644
index 0000000..a17b379
--- /dev/null
+++ b/src/tests/keywords/cast-short
@@ -0,0 +1,25 @@
+#
+#  PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       request:Class := 0x0101
+}
+
+if (<short>Class == 257) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
+
+if (<short>Class < 256) {
+	update reply {
+		Filter-Id += "wrong"
+	}
+}
+
+if (<short>Class > 257) {
+	update reply {
+		Filter-Id += "wrong"
+	}
+}
diff --git a/src/tests/keywords/cmp b/src/tests/keywords/cmp
new file mode 100644
index 0000000..4cd59b8
--- /dev/null
+++ b/src/tests/keywords/cmp
@@ -0,0 +1,20 @@
+#
+#  PRE: update
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update request {
+       Called-Station-Id  := "This is a test"
+       Calling-Station-Id := "This is a test"
+}
+
+#
+#  Check attribute references
+#
+if (Called-Station-Id == &Calling-Station-Id) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/cmp-ipaddr b/src/tests/keywords/cmp-ipaddr
new file mode 100644
index 0000000..bf197af
--- /dev/null
+++ b/src/tests/keywords/cmp-ipaddr
@@ -0,0 +1,20 @@
+#
+#  PRE: update
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update request {
+       NAS-IP-Address    := 127.0.0.1
+       Framed-IP-Address := 127.0.0.1
+}
+
+#
+#  Check attribute references
+#
+if (NAS-IP-Address == &Framed-IP-Address) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/comments b/src/tests/keywords/comments
new file mode 100644
index 0000000..483bd05
--- /dev/null
+++ b/src/tests/keywords/comments
@@ -0,0 +1,48 @@
+#
+#  PRE: update if
+#
+
+# One comment
+#{ Two comment
+#} Three comment
+#'Four'
+#"Five comment"
+##Six Comment#
+	#Seven comment (yes i'm meant to be tabbed in)
+  #Eight comment (yes i'm meant to have spaces before me)
+ 	#Nine comment (tabs and spaces, are you crazy?!)
+
+update {					#}'{ Opening block with extra special chars {} '"
+       control:Cleartext-Password := 'hello'	# This should update the password so the test passes
+       reply:Filter-Id := 'filter'# Eek! Too close
+}						#{'} Closing block with extra special chars {} '"
+
+update { request:Tmp-String-0 := 'candy' }	# Comment after unicorn block
+
+update request {
+	request:Reply-Message += 'I am #literally a comment #'
+	request:Reply-Message += "I am #literally a comment #"
+}
+
+if (&request:Tmp-String-0 != 'candy') {
+	update reply {
+		reply:Filter-Id += 'fail 0'
+	}
+}
+
+if (&request:Reply-Message[0] != 'I am #literally a comment #') {
+	update reply {
+		reply:Filter-Id += 'fail 1'
+	}
+}
+
+if (&request:Reply-Message[1] != "I am #literally a comment #") {
+	update reply {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+ok # I'm a comment after a module call
+ok # I'm a comment # after a module {} call
+
+ok, ok, ok, ok, ok
diff --git a/src/tests/keywords/count-error b/src/tests/keywords/count-error
new file mode 100644
index 0000000..f0723cb
--- /dev/null
+++ b/src/tests/keywords/count-error
@@ -0,0 +1,11 @@
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+       Filter-Id := "filter"
+}
+
+update request {
+	Tmp-String-0 := &reply:Filter-Id[#]	# ERROR
+}
diff --git a/src/tests/keywords/crypt b/src/tests/keywords/crypt
new file mode 100644
index 0000000..e6d63aa
--- /dev/null
+++ b/src/tests/keywords/crypt
@@ -0,0 +1,151 @@
+#
+# PRE: update if
+#
+
+# Skip all these tests if crypt_r was not available
+#
+if ("%{crypt:&User-Password}") {
+	noop
+}
+if ("%{request:Module-Failure-Message[0]}" !~ /^Crypt not available at compile time/) {
+
+
+# Set required attributes
+#
+update reply {
+	&Filter-Id := "filter"
+}
+
+update request {
+	&Tmp-String-0 := 'foo'
+	&Tmp-String-1 := 'foo:bar'
+	&Tmp-String-2 := 'f:'
+	&Tmp-String-3 := &User-Password
+	&Tmp-String-4 := &control:Cleartext-Password
+	&Tmp-String-5 := 'fwtLWDtMiSbH8lmXCMIVfrSMJjF'
+	&Tmp-String-8 := 'aa'
+	&Tmp-String-9 := '$1$abcdefgh'
+}
+
+
+# Check for error on no salt
+#
+if ("%{crypt:&User-Password}") {
+	update reply {
+		&Filter-Id += 'fail 1a'
+	}
+}
+
+if ("%{request:Module-Failure-Message[0]}" != 'No salt specified in crypt xlat') {
+        update reply {
+                &Filter-Id += 'fail 1b'
+        }
+}
+
+
+# Check DES - all crypt_r() implementations should do this.
+#
+if ("%{crypt:aa:foo}" != "aaKNIEDOaueR6") {
+	update reply {
+		&Filter-Id += 'fail 2a'
+	}
+}
+
+if ("%{crypt:&Tmp-String-8:foo}" != "aaKNIEDOaueR6") {
+	update reply {
+		&Filter-Id += 'fail 2b'
+	}
+}
+
+if ("%{crypt:aa:&User-Password}" != "aaPwJ9XL9Y99E") {
+	update reply {
+		&Filter-Id += 'fail 2c'
+	}
+}
+
+
+# Test we can encrypt and then authenticate
+#
+update {
+	&request:User-Password := &request:Tmp-String-5
+	&control:Crypt-Password := "%{crypt:AZ:&Tmp-String-5}"
+	&control:Cleartext-Password !* ""
+}
+
+group {
+	pap.authenticate {
+		fail = 1
+		reject = 1
+	}
+
+	if (!ok) {
+		update reply {
+			&Filter-Id += 'fail 3'
+		}
+	}
+}
+
+update {
+	&request:User-Password := &Tmp-String-3
+	&control:Cleartext-Password := &Tmp-String-4
+}
+
+
+# Clear Module-Failure-Message so below tests work no matter what
+# happened above
+#
+update request {
+	&Module-Failure-Message !* ""
+}
+
+
+# Check colons in password
+#
+if ("%{crypt:aa:foo:bar}" != "aadzEnaZwH90k") {
+	update reply {
+		&Filter-Id += 'fail 4a'
+	}
+}
+
+if ("%{crypt:aa:&Tmp-String-1}" != "aadzEnaZwH90k") {
+	update reply {
+		&Filter-Id += 'fail 4b'
+	}
+}
+
+
+# Check invalid chars in salt
+#
+# In this case, depending on the library implementation, crypt
+# seems to either return an empty string (null) and set an error,
+# or it will return an invalid hash beginning with '*'.
+#
+update request {
+	&Tmp-String-7 := "%{crypt:&Tmp-String-2:foo}"
+}
+
+if (&Tmp-String-7 !~ /^\*/ && \
+		"%{request:Module-Failure-Message[0]}" !~ /Crypt salt has the wrong format/) {
+        update reply {
+                &Filter-Id += 'fail 5a'
+        }
+}
+
+
+# Convert the Cleartext-Password to Password-With-Header and auth with that
+#
+update control {
+	&Password-With-Header := "{crypt}%{crypt:$1$abcdefgh:&Tmp-String-4}"
+	&Crypt-Password !* ""
+	&Cleartext-Password !* ""
+}
+
+
+# Crypt not available at compile time? Force the test to pass.
+#
+}
+else {
+	update reply {
+		&Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/default-input.attrs b/src/tests/keywords/default-input.attrs
new file mode 100644
index 0000000..93566a6
--- /dev/null
+++ b/src/tests/keywords/default-input.attrs
@@ -0,0 +1,11 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Filter-Id == 'filter'
diff --git a/src/tests/keywords/else-error b/src/tests/keywords/else-error
new file mode 100644
index 0000000..3816270
--- /dev/null
+++ b/src/tests/keywords/else-error
@@ -0,0 +1,14 @@
+#
+#  PRE: update if
+#
+#  "else" has to be preceded by an "if" or "elsif"
+#
+if (1) {
+	update reply {
+		Filter-Id := "filter"
+	}
+
+	else {	# ERROR
+	     ok
+	}
+}
diff --git a/src/tests/keywords/escape b/src/tests/keywords/escape
new file mode 100644
index 0000000..5d0b3bc
--- /dev/null
+++ b/src/tests/keywords/escape
@@ -0,0 +1,67 @@
+#
+#  PRE: update if xlat-attr-index
+#
+update request {
+        control:Cleartext-Password := 'hello'
+        reply:Filter-Id := "filter"
+
+	Tmp-String-0 := '@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /'
+	Tmp-String-1 := '±§#$%^&+={[}];<,>?`|"'
+	Tmp-String-2 := '™¥¤'
+	Tmp-String-3 := '=C2=B1=C2=A7=23=24=25=5E=26=2B=3D=7B=5B=7D=5D=3B=3C=2C=3E=3F=60=7C=22'
+	Tmp-String-4 := '=E2=84=A2=C2=A5=C2=A4'
+	Tmp-String-5 := '=40=61=62=63=64=65=66=67'
+
+	# Mixture of safe and unsafe chars
+	Tmp-String-6 := 'ŒČÿ'
+	Tmp-String-7 := 'Œ=C4=8Cÿ'
+}
+
+if (<string>"%{escape:%{request:Tmp-String-0}}" != &Tmp-String-0) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+if (<string>"%{escape:%{request:Tmp-String-1}}" != &Tmp-String-3) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+if (<string>"%{escape:%{request:Tmp-String-2}}" != &Tmp-String-4) {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
+
+if (<string>"%{unescape:%{request:Tmp-String-0}}" != &Tmp-String-0) {
+	update reply {
+		Filter-Id += 'Fail 4'
+	}
+}
+
+if (<string>"%{unescape:%{request:Tmp-String-3}}" != "%{Tmp-String-1}") {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+if (<string>"%{unescape:%{request:Tmp-String-4}}" != &Tmp-String-2) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
+
+if (<string>"%{escape:%{request:Tmp-String-6}}" != &Tmp-String-7) {
+	update reply {
+		Filter-Id += 'Fail 7'
+	}
+}
+
+if (<string>"%{unescape:%{request:Tmp-String-7}}" != &Tmp-String-6) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
+
diff --git a/src/tests/keywords/escape-sequences b/src/tests/keywords/escape-sequences
new file mode 100644
index 0000000..967656d
--- /dev/null
+++ b/src/tests/keywords/escape-sequences
@@ -0,0 +1,95 @@
+#
+#  PRE: update if xlat-attr-index
+#
+update request {
+	control:Cleartext-Password := 'hello'
+	Tmp-Octets-0 := 0x69206861766520736361727920656d626564646564207468696e67730020696e73696465206d65
+	Tmp-Octets-1 := 0x30783031013078303707307830410A307830440D222230786230b0C2b0
+	Tmp-String-0 := "i have scary embedded things\000 inside me"
+	Tmp-String-0 += "0x01\0010x07\0070x0A\n0x0D\r\"\"0xb0\260°"
+
+	# and again with single quoted strings.
+	# unlike other languages, \r, \t, and \n have meaning inside of 'string'
+	Tmp-String-1 := 'i have scary embedded things\000 inside me'
+	Tmp-String-1 += '0x01\0010x07\0070x0A\n0x0D\r""0xb0\260°'
+
+	Tmp-String-2 := 'i have scary embedded things\000 inside me'
+	Tmp-String-2 += "0x01\0010x07\0070x0A\n0x0D\r''0xb0\260°"
+
+	reply:Filter-Id := "filter"
+}
+
+
+if ("%{length:&Tmp-String-0}" != 39) {
+	update reply {
+		Filter-Id += 'fail l-0'
+	}
+}
+
+if ("%{length:&Tmp-String-1}" != 42) {
+	update reply {
+		Filter-Id += 'fail l-1'
+	}
+}
+
+if ("%{string:Tmp-Octets-0}" != "i have scary embedded things\000 inside me") {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if (&Tmp-String-0 != "i have scary embedded things\000 inside me") {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{string:Tmp-Octets-1}" != "0x01\0010x07\0070x0A\n0x0D\r\"\"0xb0\260°") {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+if ("%{Tmp-String-0[0]}" != "i have scary embedded things\000 inside me") {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+if ("%{Tmp-String-0[1]}" != "0x01\0010x07\0070x0A\n0x0D\r\"\"0xb0\260°") {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# And another slightly different codepath...
+if ("%{Tmp-String-0[*]}" != "i have scary embedded things\000 inside me,0x01\0010x07\0070x0A\n0x0D\r\"\"0xb0\260°") {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+if (&Tmp-String-0[0] != &Tmp-String-0[0]) {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+#
+#  This seems weird... double escapes for most things, but single escapes
+#  for the quotation marks.
+#
+if ("%{Tmp-String-2[1]}" != "0x01\0010x07\0070x0A\n0x0D\r''0xb0\260°") {
+	update reply {
+		Filter-Id += 'fail 8'
+	}
+}
+
+#
+# And again as an attribute reference
+#
+if (&Tmp-String-2[1] != "0x01\0010x07\0070x0A\n0x0D\r''0xb0\260°") {
+	update reply {
+		Filter-Id += 'fail 9'
+	}
+}
diff --git a/src/tests/keywords/expand b/src/tests/keywords/expand
new file mode 100644
index 0000000..ada0ee9
--- /dev/null
+++ b/src/tests/keywords/expand
@@ -0,0 +1,39 @@
+#
+#  PRE: update switch
+#
+
+#
+#  This is a virtual attribute.
+#  It is NOT optimized to
+#
+#	switch &Request-Processing-Stage
+#
+#  because it doesn't really exist.
+#  The xlat expansion code will take care of
+#  returning the string value of the "attribute"
+#
+switch "%{Request-Processing-Stage}" {
+	case authorize {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case authenticate {
+		update reply {
+			Filter-Id := "authenticate"
+		}
+	}
+
+	case bob {
+		update reply {
+			Filter-Id := "bob"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+}
diff --git a/src/tests/keywords/expr b/src/tests/keywords/expr
new file mode 100644
index 0000000..7645931
--- /dev/null
+++ b/src/tests/keywords/expr
@@ -0,0 +1,108 @@
+#
+#  PRE: update if
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+	Filter-Id := "filter"
+}
+
+#
+#  Simple
+#
+if ("%{expr: 1 + 2 + 3 + 4}" != 10) {
+	update reply {
+		Filter-Id := "fail-1"
+	}
+}
+
+#
+#  Precedence
+#
+if ("%{expr: 1 + 2 * 3 + 4}" != 11) {
+	update reply {
+		Filter-Id := "fail-2"
+	}
+}
+
+#
+#  attribute references
+#
+update request {
+	Tmp-Integer-0 = 1
+	Tmp-Integer-1 = 3
+	Tmp-Integer-2 = 4
+	Tmp-Date-0 = "%l"
+}
+
+if ("%{expr: 1 + 2 * &Tmp-Integer-1 + 4}" != 11) {
+	update reply {
+		Filter-Id := "fail-3"
+	}
+}
+
+if ("%{expr: 1 + 2 * (&Tmp-Integer-1 + 4)}" != 15) {
+	update reply {
+		Filter-Id := "fail-4"
+	}
+}
+
+if ("%{expr: 1 + 2 * (&Tmp-Integer-1 + &Tmp-Integer-2)}" != 15) {
+	update reply {
+		Filter-Id := "fail-5"
+	}
+}
+
+if ("%{expr: 1 & ~1}" != 0) {
+	update reply {
+		Filter-Id := "fail-6"
+	}
+}
+
+if ("%{expr: 1 & ~2}" != 1) {
+	update reply {
+		Filter-Id := "fail-7"
+	}
+}
+
+if ("%{expr: -1 * 2}" != -2) {
+	update reply {
+		Filter-Id := "fail-8"
+	}
+}
+
+if ("%{expr: 2 - -1}" != 3) {
+	update reply {
+		Filter-Id := "fail-9"
+	}
+}
+
+if ("%{expr: 1 << 2 | 1}" != 5) {
+	update reply {
+		Filter-Id := "fail-10"
+	}
+}
+
+if ("%{expr: &Tmp-Date-0}" <= 0) {
+	update reply {
+		Filter-Id := "fail-11"
+	}
+}
+
+#
+#  Unary negation
+#
+if ("%{expr: 6 + -(1 + 3)}" != 2) {
+	update reply {
+		Filter-Id := "fail-12"
+	}
+}
+
+if ("%{expr: 6 * -&Tmp-Integer-2}" != -24) {
+	update reply {
+		Filter-Id := "fail-13"
+	}
+}
+
diff --git a/src/tests/keywords/foreach b/src/tests/keywords/foreach
new file mode 100644
index 0000000..9a4c266
--- /dev/null
+++ b/src/tests/keywords/foreach
@@ -0,0 +1,5 @@
+foreach Filter-Id {
+	update reply {
+	       Called-Station-Id += "%{Foreach-Variable-0}"
+	}
+}
diff --git a/src/tests/keywords/foreach-break b/src/tests/keywords/foreach-break
new file mode 100644
index 0000000..67812fe
--- /dev/null
+++ b/src/tests/keywords/foreach-break
@@ -0,0 +1,73 @@
+# PRE: foreach
+#
+
+#
+#  We DON'T want to see this one.
+#
+update request {
+       Filter-Id += "broken"
+}
+
+foreach Filter-Id {
+	#
+	#  If we see this one, "break" out of the
+	#  foreach loop.
+	#
+	if ("%{Foreach-Variable-0}" == "broken") {
+		break
+	}
+
+	update reply {
+	       Called-Station-Id += "%{Foreach-Variable-0}"
+	}
+}
+
+
+#
+# Adding attribute during request and immediately breaking
+#
+update {
+	request:Filter-Id += "1"
+	request:Filter-Id += "2"
+}
+
+foreach &request:Reply-Message {
+	if("%{Foreach-Variable-0}" == "1") {
+		update {
+			request:Filter-Id += "3"
+		}
+		break
+
+		update reply {
+			Filter-Id := "fail-break-1"
+		}
+	}
+}
+
+update {
+	request:Filter-Id !* ANY
+}
+
+#
+# Adding attribute during request and continuing
+#
+update {
+	request:Filter-Id += "1"
+	request:Filter-Id += "2"
+}
+
+foreach &request:Reply-Message {
+	if("%{Foreach-Variable-0}" == "1") {
+		update {
+			request:Filter-Id += "3"
+		}
+	}
+
+	if ("%{Foreach-Variable-0}" == "3") {
+		break
+
+		update reply {
+			Filter-Id := "fail-break-2"
+		}
+	}
+}
diff --git a/src/tests/keywords/foreach-break-2 b/src/tests/keywords/foreach-break-2
new file mode 100644
index 0000000..b1f6040
--- /dev/null
+++ b/src/tests/keywords/foreach-break-2
@@ -0,0 +1,46 @@
+#
+#  PRE: foreach foreach-break
+#
+
+update request {
+	Calling-Station-Id := "ABCDEF_8"
+}
+
+update control {
+	&Tmp-String-0 := "0"
+	&Tmp-String-0 += "1"
+	&Tmp-String-0 += "2"
+	&Tmp-String-0 += "3"
+	&Tmp-String-0 += "4"
+	&Tmp-String-0 += "5"
+	&Tmp-String-0 += "6"
+	&Tmp-String-0 += "7"
+	&Tmp-String-0 += "8"
+	&Tmp-String-0 += "9"
+	&Tmp-String-0 += "a"
+	&Tmp-String-0 += "b"
+	&Tmp-String-0 += "c"
+	&Tmp-String-0 += "d"
+	&Tmp-String-0 += "e"
+	&Tmp-String-0 += "f"
+	&Tmp-String-0 += "g"
+}
+
+foreach control:Tmp-String-0 {
+	if ("%{Calling-Station-Id[*]}" =~ /([A-Z0-9\-]*)_%{Foreach-Variable-0}/) {
+		update request {
+			Called-Station-Id := "%{1}"
+		}
+		update reply {
+			Filter-Id := "filter"
+		}
+
+		break
+	}
+	elsif ("%{Foreach-Variable-0}" == '9') {
+		update reply {
+			Filter-Id := "fail-9"
+		}
+		reject
+	}
+}
diff --git a/src/tests/keywords/foreach-break-3 b/src/tests/keywords/foreach-break-3
new file mode 100644
index 0000000..af03da6
--- /dev/null
+++ b/src/tests/keywords/foreach-break-3
@@ -0,0 +1,44 @@
+#
+#  PRE: foreach foreach-break
+#
+
+update request {
+	Calling-Station-Id := "8"
+}
+
+update control {
+	&Calling-Station-Id := "0"
+	&Calling-Station-Id += "1"
+	&Calling-Station-Id += "2"
+	&Calling-Station-Id += "3"
+	&Calling-Station-Id += "4"
+	&Calling-Station-Id += "5"
+	&Calling-Station-Id += "6"
+	&Calling-Station-Id += "7"
+	&Calling-Station-Id += "8"
+	&Calling-Station-Id += "9"
+	&Calling-Station-Id += "a"
+	&Calling-Station-Id += "b"
+	&Calling-Station-Id += "c"
+	&Calling-Station-Id += "d"
+	&Calling-Station-Id += "e"
+	&Calling-Station-Id += "f"
+	&Calling-Station-Id += "g"
+}
+
+foreach &control:Calling-Station-Id {
+	if (&request:Calling-Station-Id == "%{Foreach-Variable-0}") {
+		update reply {
+			Filter-Id := "filter"
+		}
+
+		break
+	}
+	elsif ("%{Foreach-Variable-0}" == '9') {
+		update reply {
+			Filter-Id := "fail-9"
+		}
+
+		reject
+	}
+}
diff --git a/src/tests/keywords/foreach-break-4 b/src/tests/keywords/foreach-break-4
new file mode 100644
index 0000000..037af8e
--- /dev/null
+++ b/src/tests/keywords/foreach-break-4
@@ -0,0 +1,44 @@
+#
+#  PRE: foreach foreach-break-3
+#
+
+update request {
+	Calling-Station-Id := "8"
+}
+
+update control {
+	&Calling-Station-Id := "0"
+	&Calling-Station-Id += "1"
+	&Calling-Station-Id += "2"
+	&Calling-Station-Id += "3"
+	&Calling-Station-Id += "4"
+	&Calling-Station-Id += "5"
+	&Calling-Station-Id += "6"
+	&Calling-Station-Id += "7"
+	&Calling-Station-Id += "8"
+	&Calling-Station-Id += "9"
+	&Calling-Station-Id += "a"
+	&Calling-Station-Id += "b"
+	&Calling-Station-Id += "c"
+	&Calling-Station-Id += "d"
+	&Calling-Station-Id += "e"
+	&Calling-Station-Id += "f"
+	&Calling-Station-Id += "g"
+}
+
+foreach &control:Calling-Station-Id {
+	if (&request:Calling-Station-Id == "%{Foreach-Variable-0}") {
+		update reply {
+			Filter-Id := "filter"
+		}
+
+		break
+	}
+	elsif ("%{Foreach-Variable-0}" == '9') {
+		update reply {
+			Filter-Id := "fail-9"
+		}
+
+		reject
+	}
+}
diff --git a/src/tests/keywords/foreach-break.attrs b/src/tests/keywords/foreach-break.attrs
new file mode 100644
index 0000000..26c2876
--- /dev/null
+++ b/src/tests/keywords/foreach-break.attrs
@@ -0,0 +1,18 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+Filter-Id = "1"
+Filter-Id += "2"
+Filter-Id += "3"
+Filter-Id += "4"
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Called-Station-Id == "1"
+Called-Station-Id == "2"
+Called-Station-Id == "3"
+Called-Station-Id == "4"
diff --git a/src/tests/keywords/foreach-error b/src/tests/keywords/foreach-error
new file mode 100644
index 0000000..fb4a236
--- /dev/null
+++ b/src/tests/keywords/foreach-error
@@ -0,0 +1,5 @@
+foreach "%{expr:1 + 2}" {	# ERROR
+	update reply {
+	       Called-Station-Id += "%{Foreach-Variable-0}"
+	}
+}
diff --git a/src/tests/keywords/foreach-isolation b/src/tests/keywords/foreach-isolation
new file mode 100644
index 0000000..b77806d
--- /dev/null
+++ b/src/tests/keywords/foreach-isolation
@@ -0,0 +1,38 @@
+#
+#  PRE: foreach if-multivalue
+#
+
+update {
+	&reply:Filter-Id := 'filter'
+	&control:Tmp-String-0 := '0'
+	&control:Tmp-String-0 += '1'
+	&control:Tmp-String-0 += '2'
+	&control:Tmp-String-0 += '3'
+}
+
+foreach control:Tmp-String-0 {
+	update control {
+		Tmp-String-0 -= "%{expr:%{Foreach-Variable-0} + 1}"
+	}
+	update request {
+		Tmp-String-0 += "%{Foreach-Variable-0}"
+	}
+}
+
+if (!&Tmp-String-0[0] || !&Tmp-String-0[1] || !&Tmp-String-0[2] || !&Tmp-String-0[3]) {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+if ((&Tmp-String-0[0] != '0') || (&Tmp-String-0[1] != '1') || (&Tmp-String-0[2] != '2') || (&Tmp-String-0[3] != '3')) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+if (!&control:Tmp-String-0[0] || &control:Tmp-String-0[1] || &control:Tmp-String-0[2] || &control:Tmp-String-0[3]) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
diff --git a/src/tests/keywords/foreach-list b/src/tests/keywords/foreach-list
new file mode 100644
index 0000000..4780e4f
--- /dev/null
+++ b/src/tests/keywords/foreach-list
@@ -0,0 +1,5 @@
+foreach &request: {
+	update reply {
+		Called-Station-Id += "%{Foreach-Variable-0}"
+	}
+}
diff --git a/src/tests/keywords/foreach-list.attrs b/src/tests/keywords/foreach-list.attrs
new file mode 100644
index 0000000..aedd599
--- /dev/null
+++ b/src/tests/keywords/foreach-list.attrs
@@ -0,0 +1,21 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+Filter-Id = "1"
+Filter-Id += "2"
+Filter-Id += "3"
+Filter-Id += "4"
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Called-Station-Id == 'bob'
+Called-Station-Id == 'hello'
+Called-Station-Id == '1'
+Called-Station-Id == '2'
+Called-Station-Id == '3'
+Called-Station-Id == '4'
+
diff --git a/src/tests/keywords/foreach-nested b/src/tests/keywords/foreach-nested
new file mode 100644
index 0000000..b6109a3
--- /dev/null
+++ b/src/tests/keywords/foreach-nested
@@ -0,0 +1,9 @@
+# PRE: foreach
+#
+foreach Filter-Id {
+	foreach Calling-Station-Id {
+		update reply {
+			Called-Station-Id += "%{Foreach-Variable-0} %{Foreach-Variable-1}"
+		}
+	}
+}
diff --git a/src/tests/keywords/foreach-nested.attrs b/src/tests/keywords/foreach-nested.attrs
new file mode 100644
index 0000000..52d1f81
--- /dev/null
+++ b/src/tests/keywords/foreach-nested.attrs
@@ -0,0 +1,25 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+Filter-Id = "1"
+Filter-Id += "2"
+Filter-Id += "3"
+Filter-Id += "4"
+Calling-Station-Id = "foo\n"
+Calling-Station-Id += "bar"
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Called-Station-Id == '1 foo\n'
+Called-Station-Id == '1 bar'
+Called-Station-Id == '2 foo\n'
+Called-Station-Id == '2 bar'
+Called-Station-Id == '3 foo\n'
+Called-Station-Id == '3 bar'
+Called-Station-Id == '4 foo\n'
+Called-Station-Id == '4 bar'
+
diff --git a/src/tests/keywords/foreach-regex b/src/tests/keywords/foreach-regex
new file mode 100644
index 0000000..dab57a3
--- /dev/null
+++ b/src/tests/keywords/foreach-regex
@@ -0,0 +1,26 @@
+# PRE: foreach if-regex-match
+
+# This is what most people end up using foreach for,
+# so we should probably test it works.
+update request {
+	Tmp-String-0 := "cisco"
+}
+
+# Expanded regex
+foreach Cisco-AVPair {
+	if ("%{Foreach-Variable-0}"  =~ /^%{Tmp-String-0}=(.*)$/i) {
+		update reply {
+			Called-Station-Id += "%{1}"
+		}
+	}
+}
+
+# Compiled regex
+foreach Cisco-AVPair {
+	if ("%{Foreach-Variable-0}"  =~ /^stupid=(.*)$/i) {
+		update reply {
+			Called-Station-Id += "%{1}"
+		}
+	}
+}
+
diff --git a/src/tests/keywords/foreach-regex.attrs b/src/tests/keywords/foreach-regex.attrs
new file mode 100644
index 0000000..79996c7
--- /dev/null
+++ b/src/tests/keywords/foreach-regex.attrs
@@ -0,0 +1,16 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+Cisco-AVPair = "stupid=1"
+Cisco-AVPair += "retarded=2"
+Cisco-AVPair += "cisco=3"
+Cisco-AVPair += "shit=4"
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Called-Station-Id == "3"
+Called-Station-Id == "1"
diff --git a/src/tests/keywords/foreach-return b/src/tests/keywords/foreach-return
new file mode 100644
index 0000000..05409c9
--- /dev/null
+++ b/src/tests/keywords/foreach-return
@@ -0,0 +1,52 @@
+# PRE: foreach foreach-break
+#
+
+update control {
+	Cleartext-Password := 'hello'
+}
+
+#
+# Adding attribute during request and immediately returning should still work
+#
+update request {
+	Filter-Id := "1"
+	Filter-Id += "2"
+	Filter-Id += "3"
+	Filter-Id += "4"
+	Filter-Id += "5"
+}
+
+foreach &Filter-Id {
+	if ("%{Foreach-Variable-0}" == "3") {
+		update reply {
+			Filter-Id := "filter"
+		}
+
+		#
+		#  We need this because the "return" below
+		#  will prevent the "pap" module from being run
+		#  in the "authorize" section.
+		#
+		update control {
+			Auth-Type := PAP
+		}
+		
+		#
+		#  Stop processing "authorize", and go to the next section.
+		#
+		return
+		
+		#
+		#  Shouldn't reach this
+		#
+		update reply {
+			Filter-Id := "fail"
+		}
+	}
+
+	if ("%{Foreach-Variable-0}" == "4") {
+		update reply {
+			Filter-Id := "fail-4"
+		}
+	}
+}
diff --git a/src/tests/keywords/foreach-varied-depth b/src/tests/keywords/foreach-varied-depth
new file mode 100644
index 0000000..3c3918d
--- /dev/null
+++ b/src/tests/keywords/foreach-varied-depth
@@ -0,0 +1,43 @@
+update {
+	control:Tmp-String-0 := "ssid=ABCDEF"
+	control:Tmp-String-0 += "ssid=GHIJKL"
+	reply:Filter-Id := "filter"
+}
+
+if (User-Name) {
+	foreach &control:Tmp-String-0 {
+		if ("%{Foreach-Variable-0}" =~ /(.*)/) {
+			update control {
+				Tmp-String-1 := "%{1}"
+			}
+		}
+	}
+}
+
+if (&control:Tmp-String-1 != 'ssid=GHIJKL') {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+update control {
+	Tmp-String-1 !* ANY
+}
+
+foreach &control:Tmp-String-0 {
+	if ("%{Foreach-Variable-0}" =~ /(.*)/) {
+		update control {
+			Tmp-String-1 := "%{1}"
+		}
+	}
+}
+
+if (&control:Tmp-String-1 != 'ssid=GHIJKL') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+update control {
+	Tmp-String-1 !* ANY
+}
diff --git a/src/tests/keywords/foreach.attrs b/src/tests/keywords/foreach.attrs
new file mode 100644
index 0000000..26c2876
--- /dev/null
+++ b/src/tests/keywords/foreach.attrs
@@ -0,0 +1,18 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+Filter-Id = "1"
+Filter-Id += "2"
+Filter-Id += "3"
+Filter-Id += "4"
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Called-Station-Id == "1"
+Called-Station-Id == "2"
+Called-Station-Id == "3"
+Called-Station-Id == "4"
diff --git a/src/tests/keywords/hex b/src/tests/keywords/hex
new file mode 100644
index 0000000..b55bab2
--- /dev/null
+++ b/src/tests/keywords/hex
@@ -0,0 +1,141 @@
+#
+# PRE: update
+#
+update reply {
+       Filter-Id := "filter"
+}
+
+update request {
+	Tmp-String-0        := '9870'
+	Tmp-Octets-0        := 0x39383731
+	Tmp-IP-Address-0    := 57.56.55.50
+	Tmp-Date-0          := 959985459
+	Tmp-Integer-0       := 959985460
+	Tmp-Cast-Abinary    := 'ip out forward srcip 57.56.55.53/32 udp dstport = 1812'
+	Tmp-Cast-IfId       := '0000:0000:3938:3737'
+	Tmp-Cast-IPv6Addr   := '::3938:3738'
+	Tmp-Cast-IPv6Prefix := '::3938:3739/128'
+	Tmp-Cast-Byte       := 58
+	Tmp-Cast-Short      := 14139
+	Tmp-Cast-Ethernet   := 00:00:39:38:37:3c
+	Tmp-Cast-Integer64  := 1152921505566832445
+	Tmp-Cast-IPv4Prefix := 57.56.55.62/32
+}
+
+update request {
+	Tmp-String-0        := "%{hex:Tmp-String-0}"
+	Tmp-String-1        := "%{hex:Tmp-Octets-0}"
+	Tmp-String-2        := "%{hex:Tmp-IP-Address-0}"
+	Tmp-String-3        := "%{hex:Tmp-Date-0}"
+	Tmp-String-4        := "%{hex:Tmp-Integer-0}"
+	Tmp-String-5        := "%{hex:Tmp-Cast-Abinary}"
+	Tmp-String-6        := "%{hex:Tmp-Cast-Ifid}"
+	Tmp-String-7        := "%{hex:Tmp-Cast-IPv6Addr}"
+	Tmp-String-8        := "%{hex:Tmp-Cast-IPv6Prefix}"
+	Tmp-String-9        := "%{hex:Tmp-Cast-Byte}"
+}
+
+# String
+if (Tmp-String-0 != '39383730') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+# Octets
+if (Tmp-String-1 != '39383731') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# IP Address
+if (Tmp-String-2 != '39383732') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# Date
+if (Tmp-String-3 != '39383733') {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+# Integer
+if (Tmp-String-4 != '39383734') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# Abinary
+if (Tmp-String-5 != '0101000039383735000000002000110000000714000200000000000000000000') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+# ifid
+if (Tmp-String-6 != '0000000039383737') {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+# ipv6addr
+if (Tmp-String-7 != '00000000000000000000000039383738') {
+	update reply {
+		Filter-ID += 'fail 8'
+	}
+}
+
+# ipv6addrprefix
+if (Tmp-String-8 != '008000000000000000000000000039383739') {
+	update reply {
+		Filter-ID += 'fail 9'
+	}
+}
+
+# byte
+if (Tmp-String-9 != '3a') {
+	update reply {
+		Filter-ID += "fail 10 - expected 3a got %{Tmp-String-9}"
+	}
+}
+
+update request {
+	Tmp-String-0        := "%{hex:Tmp-Cast-Short}"
+	Tmp-String-1        := "%{hex:Tmp-Cast-Ethernet}"
+	Tmp-String-2        := "%{hex:Tmp-Cast-Integer64}"
+	Tmp-String-3        := "%{hex:Tmp-Cast-IPv4Prefix}"
+}
+
+# short
+if (Tmp-String-0 != '373b') {
+	update reply {
+		Filter-ID += 'fail 11'
+	}
+}
+
+# ethernet
+if (Tmp-String-1 != '00003938373c') {
+	update reply {
+		Filter-Id += 'fail 12'
+	}
+}
+
+# integer64
+if (Tmp-String-2 != '100000003938373d') {
+	update reply {
+		Filter-Id += 'fail 13'
+	}
+}
+
+# ipv4prefix
+if (Tmp-String-3 != '00203938373e') {
+	update reply {
+		Filter-Id += 'fail 14 expected 00203938373e got %{Tmp-String-3}'
+	}
+}
diff --git a/src/tests/keywords/if b/src/tests/keywords/if
new file mode 100644
index 0000000..a146029
--- /dev/null
+++ b/src/tests/keywords/if
@@ -0,0 +1,10 @@
+#
+#  PRE: update
+#
+#  Static if condition
+#
+if (1) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/if-bob b/src/tests/keywords/if-bob
new file mode 100644
index 0000000..4e8ae3c
--- /dev/null
+++ b/src/tests/keywords/if-bob
@@ -0,0 +1,15 @@
+# PRE: if
+#
+#  Matching "if" conditions
+#
+if (User-Name == "bob") {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
+
+if (User-Name != "bob") {
+	update reply {
+		Filter-Id := "not bob"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/if-else b/src/tests/keywords/if-else
new file mode 100644
index 0000000..788d606
--- /dev/null
+++ b/src/tests/keywords/if-else
@@ -0,0 +1,15 @@
+#
+# PRE: if
+#
+#  Matching "if" conditions
+#
+if (User-Name != "bob") {
+	update reply {
+		Filter-Id := "not bob"
+	}
+}
+else {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/if-elsif b/src/tests/keywords/if-elsif
new file mode 100644
index 0000000..c0a41ed
--- /dev/null
+++ b/src/tests/keywords/if-elsif
@@ -0,0 +1,19 @@
+# PRE: if if-else
+#
+#  Matching "if" conditions
+#
+if (User-Name != "bob") {
+	update reply {
+		Filter-Id := "not bob"
+	}
+}
+elsif (User-Name == "bob") {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
+else {
+	update reply {
+		Filter-Id := "last else"
+	}
+}
diff --git a/src/tests/keywords/if-multivalue b/src/tests/keywords/if-multivalue
new file mode 100644
index 0000000..f12d6fe
--- /dev/null
+++ b/src/tests/keywords/if-multivalue
@@ -0,0 +1,173 @@
+#
+# PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tmp-String-0 := 'foo'
+	Tmp-String-0 += 'bar'
+	Tmp-String-0 += 'baz'
+
+	Tmp-String-1 := 'GROUP ADMINISTRATORS'
+	Tmp-String-1 += 'GROUP STUDENTS'
+	Tmp-String-1 += 'GROUP PEONS'
+
+	Tmp-String-2 := 'PEONS'
+	Tmp-String-2 += 'STUDENTS'
+	Tmp-String-2 += 'ADMINISTRATORS'
+
+	Tmp-String-3 := 'no'
+	Tmp-String-3 += 'no'
+	Tmp-String-3 += 'yes'
+
+	Tmp-Integer-0 := 1
+	Tmp-Integer-0 += 2
+	Tmp-Integer-0 += 5
+}
+
+update control {
+	Tmp-String-0 := 'foo'
+	Tmp-String-0 += 'bar'
+	Tmp-String-0 += 'baz'
+
+	Tmp-String-1 := 'boink'
+	Tmp-String-1 += 'tard'
+	Tmp-String-1 += 'dink'
+	Tmp-String-1 += 'slink'
+
+	Tmp-Integer-0 := 01
+	Tmp-Integer-0 += 02
+	Tmp-Integer-0 += 05
+	Tmp-Integer-0 += 04
+
+	Tmp-Integer-1 := 10
+	Tmp-Integer-1 += 20
+	Tmp-Integer-1 += 30
+}
+
+#
+#  Mmmm O(N^2)
+#
+if (&request:Tmp-String-0[*] != &control:Tmp-String-0[*]) {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+if (&request:Tmp-String-0[*] == &control:Tmp-String-1[*]) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if (&request:Tmp-String-1[*] == &control:Tmp-String-0[*]) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+#
+#  Integer comparison and normalisation
+#
+if (&request:Tmp-Integer-0 != &control:Tmp-Integer-0) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+#
+#  if any value of request:Tmp-Integer-0 > any value of
+#  request:Tmp-Integer-1 then evaluate to true
+#
+if (&request:Tmp-Integer-0[*] > &control:Tmp-Integer-1[*]) {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+#
+#  Compiled regex comparisons
+#
+if (&request:Tmp-String-1[*] !~ /PEONS$/) {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+if (&control:Tmp-String-1 =~ /PEONS$/) {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+if (&control:Tmp-String-1 =~ /DINKS$/) {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+#
+#  Dynamic regex comparisons
+#
+if (&request:Tmp-String-1[*] !~ /%{Tmp-String-2[0]}$/) {
+	update reply {
+		Filter-Id += 'fail 8'
+	}
+}
+
+if (&request:Tmp-String-1 =~ /%{Tmp-String-2[1]}$/) {
+	update reply {
+		Filter-Id += 'fail 9'
+	}
+}
+
+if (&request:Tmp-String-1 !~ /%{Tmp-String-2[2]}$/) {
+	update reply {
+		Filter-Id += 'fail 10'
+	}
+}
+
+if (&request:Tmp-String-1 =~ /%{Tmp-String-2[#]}$/) {
+	update reply {
+		Filter-Id += 'fail 11'
+	}
+}
+
+#
+#  XLAT virtual comparisons
+#
+if (&control:Tmp-Integer-0[*] != "%{control:Tmp-Integer-0[#]}") {
+	update reply {
+		Filter-Id += 'fail 12'
+	}
+}
+
+#
+#  Literal comparisons
+#
+if (&control:Tmp-String-1[*] != 'boink') {
+	update reply {
+		Filter-Id += 'fail 13'
+	}
+}
+
+if (&control:Tmp-String-1[*] == 'foo') {
+	update reply {
+		Filter-Id += 'fail 14'
+	}
+}
+
+if (&request:Tmp-Integer-0[*] > 10) {
+	update reply {
+		Filter-Id += 'fail 15'
+	}
+}
+
+if (!(&request:Tmp-Integer-0[*] < 10)) {
+	update reply {
+		Filter-Id += 'fail 16'
+	}
+}
diff --git a/src/tests/keywords/if-paircmp b/src/tests/keywords/if-paircmp
new file mode 100644
index 0000000..6ed06e3
--- /dev/null
+++ b/src/tests/keywords/if-paircmp
@@ -0,0 +1,27 @@
+#
+# PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       reply:Filter-Id := 'filter'
+}
+
+#
+#  Paircmp
+#
+
+#
+#  Passing 'yes' causes the test paircmp to return match
+#  Passing 'no' causes the test paircmp to return a non-match
+#
+if (&Test-Paircmp != 'yes') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if (&Test-Paircmp == 'no') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
diff --git a/src/tests/keywords/if-rcode-error b/src/tests/keywords/if-rcode-error
new file mode 100644
index 0000000..fed8a49
--- /dev/null
+++ b/src/tests/keywords/if-rcode-error
@@ -0,0 +1,11 @@
+# PRE: if
+#
+#  return code in an "if" section.
+#
+if (User-Name == "bob") {
+	update reply {
+		Filter-Id := "filter"
+	}
+
+	ok = reject	# ERROR
+}
diff --git a/src/tests/keywords/if-regex-bad-attribute b/src/tests/keywords/if-regex-bad-attribute
new file mode 100644
index 0000000..f330fde
--- /dev/null
+++ b/src/tests/keywords/if-regex-bad-attribute
@@ -0,0 +1,21 @@
+#
+# PRE: if-regex-match if-regex-error
+#
+
+#
+#  This should parse
+#
+if (&User-Name =~ /%{User-Name}/) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
+
+#
+#  Check regexes which refer to unknown attributes
+#
+if (&User-Name =~ /%{What-The-Heck-Is-This-Thing}/) {	# ERROR
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/if-regex-error b/src/tests/keywords/if-regex-error
new file mode 100644
index 0000000..f618e82
--- /dev/null
+++ b/src/tests/keywords/if-regex-error
@@ -0,0 +1,12 @@
+#
+# PRE: if-regex-match
+#
+
+#
+#  Check that bad regular expressions will fail
+#
+if (&User-Name =~ /[a-3]/) {	# ERROR
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/if-regex-match b/src/tests/keywords/if-regex-match
new file mode 100644
index 0000000..458e455
--- /dev/null
+++ b/src/tests/keywords/if-regex-match
@@ -0,0 +1,183 @@
+# PRE: if
+#
+update request {
+	Tmp-Integer-0 := '123456789'
+}
+
+# Non matching on attribute ref
+if (User-Name !~ /^([0-9])_([0-9])?_([0-9]*)_([0-9]+)_([^_])_(6)_([7-8])%{Tmp-String-0}/) {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+# Matching on xlat expanded value
+if ("%{User-Name}" !~ /^([0-9])_([0-9])?_([0-9]*)_([0-9]+)_([^_])_(6)_([7-8])%{Tmp-String-0}/) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+# Matching on attribute ref with capture groups
+if (User-Name =~ /^([0-9])_([0-9])?_([0-9]*)_([0-9]+)_([^_])_(6)_([7-8])%{Tmp-String-0}/) {
+	# Test all the capture groups
+	update {
+		reply:User-Name := "%{7}_%{6}_%{5}_%{4}_%{3}_%{2}_%{1}_%{0}"
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+# Checking capture groups are cleared out correctly
+if (User-Name =~ /^([0-9])_%{Tmp-String-0}/) {
+	if ("%{0}%{1}%{2}%{3}%{4}%{5}%{6}%{7}" != '1_1') {
+		update reply {
+			Filter-Id += 'Fail 3'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 3.5'
+	}
+}
+
+# Checking capture groups are cleared out correctly when there are no matches
+if (User-Name =~ /^.%{Tmp-String-0}/) {
+	if ("%{0}%{1}%{2}%{3}%{4}%{5}%{6}%{7}" != '1') {
+		update reply {
+			Filter-Id += 'Fail 4'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 4.5'
+	}
+}
+
+# Checking full capture group range
+if ('a_b_c_d_e_f_g_h_i_j_k_l_m_n_o_p_q_r_s_t_u_v_w_x_y_z_A_B_C_D_E_F' =~ /^(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)$/) {
+	if ("%{0}%{1}%{2}%{3}%{4}%{5}%{6}%{7}%{8}%{9}%{10}%{11}%{12}%{13}%{14}%{15}%{16}%{17}%{18}%{19}%{20}%{21}%{22}%{23}%{24}%{25}%{26}%{27}%{28}%{29}%{30}%{31}%{32}" != 'a_b_c_d_e_f_g_h_i_j_k_l_m_n_o_p_q_r_s_t_u_v_w_x_y_z_A_B_C_D_E_FabcdefghijklmnopqrstuvwxyzABCDEF') {
+		update reply {
+			Filter-Id += 'Fail 6'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 6.5'
+	}
+}
+
+# Checking full capture group overun
+if ('a_b_c_d_e_f_g_h_i_j_k_l_m_n_o_p_q_r_s_t_u_v_w_x_y_z_A_B_C_D_E_F_G' =~ /^(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)_(.)$/) {
+	if ("%{0}%{1}%{2}%{3}%{4}%{5}%{6}%{7}%{8}%{9}%{10}%{11}%{12}%{13}%{14}%{15}%{16}%{17}%{18}%{19}%{20}%{21}%{22}%{23}%{24}%{25}%{26}%{27}%{28}%{29}%{30}%{31}%{32}" != 'a_b_c_d_e_f_g_h_i_j_k_l_m_n_o_p_q_r_s_t_u_v_w_x_y_z_A_B_C_D_E_F_GabcdefghijklmnopqrstuvwxyzABCDEF') {
+		update reply {
+			Filter-Id += 'Fail 7'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 7.5'
+	}
+}
+
+# uncompiled - ref - insensitive
+if (Calling-Station-Id !~ /:roamyroam%{Tmp-String-0}$/i) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
+
+# uncompiled - expansion - insensitive
+if ("%{Calling-Station-Id}" !~ /:roamyroam%{Tmp-String-0}$/i) {
+	update reply {
+		Filter-Id += 'Fail 9'
+	}
+}
+
+# uncompiled - enum - ref - insensitive
+if (Service-Type !~ /^framed-user%{Tmp-String-0}$/i) {
+	update reply {
+		Filter-Id += 'Fail 10'
+	}
+}
+
+# uncompiled - enum - expansion - insensitive
+if ("%{Service-Type}" !~ /^framed-user%{Tmp-String-0}$/i) {
+	update reply {
+		Filter-Id += 'Fail 11'
+	}
+}
+
+# uncompiled - enum - ref
+if (Service-Type =~ /^framed-user%{Tmp-String-0}$/) {
+	update reply {
+		Filter-Id += 'Fail 12'
+	}
+}
+
+# uncompiled - integer - ref
+if (Tmp-Integer-0 !~ /%{Tmp-Integer-0}/) {
+	update reply {
+		Filter-Id += 'Fail 13'
+	}
+}
+
+update request {
+	Tmp-String-0 := "foo\nbar"
+}
+
+# uncompiled - ref - multiline
+if (&Tmp-String-0 !~ /^foo$%{Tmp-String-8}/m) {
+	update reply {
+		Filter-Id += 'Fail 14'
+	}
+}
+
+# uncompiled - ref - non-multiline
+if (&Tmp-String-0 =~ /^foo$%{Tmp-String-8}/) {
+	update reply {
+		Filter-Id += 'Fail 15'
+	}
+}
+
+# uncompiled - ref - non-multiline
+if (&Tmp-String-0 !~ /^foo\nbar%{Tmp-String-8}$/) {
+	update reply {
+		Filter-Id += 'Fail 16'
+	}
+}
+
+# uncompiled - ref - multiline
+if (&Tmp-String-0 !~ /^bar%{Tmp-String-8}$/m) {
+	update reply {
+		Filter-Id += 'Fail 17'
+	}
+}
+
+# uncompiled - ref - multiline - sensitive
+if (&Tmp-String-0 =~ /^BAR%{Tmp-String-8}$/m) {
+	update reply {
+		Filter-Id += 'Fail 18'
+	}
+}
+
+# uncompiled - ref - multiline - insensitive
+if (&Tmp-String-0 !~ /^BAR%{Tmp-String-8}$/mi) {
+	update reply {
+		Filter-Id += 'Fail 19'
+	}
+}
+
+# uncompiled - ref - multiline - insensitive (flag order reversed)
+if (&Tmp-String-0 !~ /^BAR%{Tmp-String-8}$/im) {
+	update reply {
+		Filter-Id += 'Fail 20'
+	}
+}
diff --git a/src/tests/keywords/if-regex-match-comp b/src/tests/keywords/if-regex-match-comp
new file mode 100644
index 0000000..c9c2d15
--- /dev/null
+++ b/src/tests/keywords/if-regex-match-comp
@@ -0,0 +1,149 @@
+# PRE: if
+#
+
+# Non matching on attribute ref
+if (User-Name !~ /^([0-9])_([0-9])?_([0-9]*)_([0-9]+)_([^_])_(6)_([7-8])/) {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+# Matching on xlat expanded value
+if ("%{User-Name}" !~ /^([0-9])_([0-9])?_([0-9]*)_([0-9]+)_([^_])_(6)_([7-8])/) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+# Matching on attribute ref with capture groups
+if (User-Name =~ /^([0-9])_([0-9])?_([0-9]*)_([0-9]+)_([^_])_(6)_([7-8])/) {
+	# Test all the capture groups
+	update {
+		reply:User-Name := "%{7}_%{6}_%{5}_%{4}_%{3}_%{2}_%{1}_%{0}"
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+# Checking capture groups are cleared out correctly
+if (User-Name =~ /^([0-9])_/) {
+	if ("%{0}%{1}%{2}%{3}%{4}%{5}%{6}%{7}" != '1_1') {
+		update reply {
+			Filter-Id += 'Fail 3'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 3.5'
+	}
+}
+
+# Checking capture groups are cleared out correctly when there are no matches
+if (User-Name =~ /^./) {
+	if ("%{0}%{1}%{2}%{3}%{4}%{5}%{6}%{7}" != '1') {
+		update reply {
+			Filter-Id += 'Fail 4'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 4.5'
+	}
+}
+
+# compiled - ref - insensitive
+if (Calling-Station-Id !~ /:roamyroam$/i) {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+# compiled - expansion - insensitive
+if ("%{Calling-Station-Id}" !~ /:roamyroam$/i) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
+
+# compiled - enum - ref - insensitive
+if (Service-Type !~ /^framed-user$/i) {
+	update reply {
+		Filter-Id += 'Fail 7'
+	}
+}
+
+# compiled - enum - expansion - insensitive
+if ("%{Service-Type}" !~ /^framed-user$/i) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
+
+# compiled - enum - ref
+if (Service-Type =~ /^framed-user$/) {
+	update reply {
+		Filter-Id += 'Fail 9'
+	}
+}
+
+update request {
+	Tmp-String-0 := "foo\nbar"
+}
+
+# compiled - ref - multiline
+if (&Tmp-String-0 !~ /^foo$/m) {
+	update reply {
+		Filter-Id += 'Fail 14'
+	}
+}
+
+# compiled - ref - non-multiline
+if (&Tmp-String-0 =~ /^foo$/) {
+	update reply {
+		Filter-Id += 'Fail 15'
+	}
+}
+
+# compiled - ref - non-multiline
+
+# Not all POSIX implementations support the \n character classes
+# so only run this test if the server was built with libpcre.
+if (("${feature.regex-pcre}" == 'yes') && (&Tmp-String-0 !~ /^foo\nbar$/)) {
+	update reply {
+		Filter-Id += 'Fail 16'
+	}
+}
+
+# compiled - ref - multiline
+if (&Tmp-String-0 !~ /^bar$/m) {
+	update reply {
+		Filter-Id += 'Fail 17'
+	}
+}
+
+# compiled - ref - multiline - sensitive
+if (&Tmp-String-0 =~ /^BAR$/m) {
+	update reply {
+		Filter-Id += 'Fail 17'
+	}
+}
+
+# compiled - ref - multiline - insensitive
+if (&Tmp-String-0 !~ /^BAR$/mi) {
+	update reply {
+		Filter-Id += 'Fail 17'
+	}
+}
+
+# compiled - ref - multiline - insensitive (flag order reversed)
+if (&Tmp-String-0 !~ /^BAR$/im) {
+	update reply {
+		Filter-Id += 'Fail 18'
+	}
+}
+
diff --git a/src/tests/keywords/if-regex-match-comp.attrs b/src/tests/keywords/if-regex-match-comp.attrs
new file mode 100644
index 0000000..ba7188d
--- /dev/null
+++ b/src/tests/keywords/if-regex-match-comp.attrs
@@ -0,0 +1,7 @@
+User-Name = '1_2_3_4_5_6_7'
+User-Password = 'hello'
+Service-Type := 'Framed-User'
+Calling-Station-ID := '00:11:22:33:44:55:66:ROAMYROAM'
+
+Response-Packet-Type == Access-Accept
+User-Name == '7_6_5_4_3_2_1_1_2_3_4_5_6_7'
diff --git a/src/tests/keywords/if-regex-match-named b/src/tests/keywords/if-regex-match-named
new file mode 100644
index 0000000..2aa665f
--- /dev/null
+++ b/src/tests/keywords/if-regex-match-named
@@ -0,0 +1,117 @@
+# PRE: if
+#
+if ('${feature.regex-pcre}' == 'yes') {
+update request {
+	Tmp-Integer-0 := '123456789'
+	Tmp-Integer-1 := 1
+}
+
+# Check failures when no previous capture
+if ("%{regex:}" != "") {
+	update reply {
+		Filter-Id += 'Fail 0.1'
+	}
+}
+
+if ("%{regex:foo}" != "") {
+	update reply {
+		Filter-Id += 'Fail 0.2'
+	}
+}
+
+if ("%{regex:%{Tmp-Integer-1}}" != "") {
+	update reply {
+		Filter-Id += 'Fail 0.3'
+	}
+}
+
+if ("%{regex:1}" != "") {
+	update reply {
+		Filter-Id += 'Fail 0.4'
+	}
+}
+
+# uncompiled - ref - named capture groups
+if (User-Name =~ /^(?<one>[0-9])_(?<two>[0-9])?_(?<three>[0-9]*)_(?<four>[0-9]+)_(?<five>[^_])_(?<six>6)_(?<seven>[7-8])%{Tmp-String-0}/) {
+	if ("%{regex:seven}_%{regex:six}_%{regex:five}_%{regex:four}_%{regex:three}_%{regex:two}_%{regex:one}_%{0}" != '7_6_5_4_3_2_1_1_2_3_4_5_6_7') {
+		update reply {
+			Filter-Id += 'Fail 1'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 1.5'
+	}
+}
+
+# Checking capture groups are cleared out correctly
+if (User-Name =~ /^(?<one>[0-9])_%{Tmp-String-0}/) {
+	if ("%{0}%{regex:one}%{regex:two}%{regex:three}%{regex:four}%{regex:five}%{regex:six}%{regex:seven}" != '1_1') {
+		update reply {
+			Filter-Id += 'Fail 2'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 2.5'
+	}
+}
+
+# Checking capture groups are cleared out correctly when there are no matches
+if (User-Name =~ /^.%{Tmp-String-0}/) {
+	if ("%{0}%{regex:one}%{regex:two}%{regex:three}%{regex:four}%{regex:five}%{regex:six}%{regex:seven}" != '1') {
+		update reply {
+			Filter-Id += 'Fail 3'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 3.5'
+	}
+}
+
+# compiled - ref - named capture groups
+if (User-Name =~ /^(?<one>[0-9])_(?<two>[0-9])?_(?<three>[0-9]*)_(?<four>[0-9]+)_(?<five>[^_])_(?<six>6)_(?<seven>[7-8])/) {
+	if ("%{regex:seven}_%{regex:six}_%{regex:five}_%{regex:four}_%{regex:three}_%{regex:two}_%{regex:one}_%{0}" != '7_6_5_4_3_2_1_1_2_3_4_5_6_7') {
+		update reply {
+			Filter-Id += 'Fail 4'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 4.5'
+	}
+}
+
+# compiled - xlat - named capture groups
+if ('1_2_3_4_5_6_7' =~ /^(?<one>[0-9])_(?<two>[0-9])?_(?<three>[0-9]*)_(?<four>[0-9]+)_(?<five>[^_])_(?<six>6)_(?<seven>[7-8])/) {
+	if ("%{regex:seven}_%{regex:six}_%{regex:five}_%{regex:four}_%{regex:three}_%{regex:two}_%{regex:one}_%{0}" != '7_6_5_4_3_2_1_1_2_3_4_5_6_7') {
+		update reply {
+			Filter-Id += 'Fail 5'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 5.5'
+	}
+}
+
+# compiled - ref - named capture groups (numeric indexes)
+if (User-Name =~ /^(?<one>[0-9])_(?<two>[0-9])?_(?<three>[0-9]*)_(?<four>[0-9]+)_(?<five>[^_])_(?<six>6)_(?<seven>[7-8])/) {
+	if ("%{7}_%{6}_%{5}_%{4}_%{3}_%{2}_%{1}_%{0}" != '7_6_5_4_3_2_1_1_2_3_4_5_6_7') {
+		update reply {
+			Filter-Id += 'Fail 4'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 4.5'
+	}
+}
+}
diff --git a/src/tests/keywords/if-regex-match-named.attrs b/src/tests/keywords/if-regex-match-named.attrs
new file mode 100644
index 0000000..867ed23
--- /dev/null
+++ b/src/tests/keywords/if-regex-match-named.attrs
@@ -0,0 +1,6 @@
+User-Name = '1_2_3_4_5_6_7'
+User-Password = 'hello'
+Service-Type := 'Framed-User'
+Calling-Station-ID := '00:11:22:33:44:55:66:ROAMYROAM'
+
+Response-Packet-Type == Access-Accept
diff --git a/src/tests/keywords/if-regex-match.attrs b/src/tests/keywords/if-regex-match.attrs
new file mode 100644
index 0000000..ba7188d
--- /dev/null
+++ b/src/tests/keywords/if-regex-match.attrs
@@ -0,0 +1,7 @@
+User-Name = '1_2_3_4_5_6_7'
+User-Password = 'hello'
+Service-Type := 'Framed-User'
+Calling-Station-ID := '00:11:22:33:44:55:66:ROAMYROAM'
+
+Response-Packet-Type == Access-Accept
+User-Name == '7_6_5_4_3_2_1_1_2_3_4_5_6_7'
diff --git a/src/tests/keywords/if-regex-multivalue b/src/tests/keywords/if-regex-multivalue
new file mode 100644
index 0000000..7358c93
--- /dev/null
+++ b/src/tests/keywords/if-regex-multivalue
@@ -0,0 +1,26 @@
+#
+# PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       reply:Filter-Id := 'filter'
+}
+
+update request {
+	Cisco-AVPair := 'foo=bar'
+	Cisco-AVPair += 'bar=baz'
+	Cisco-AVPair += 'baz=foo'
+}
+
+if (&Cisco-AVPair[*] =~ /bar=(.*)/) {
+	if ("%{1}" != 'baz') {
+		update reply {
+			Filter-Id += 'Fail 1'
+		}
+	}
+}
+else {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
diff --git a/src/tests/keywords/if-skip b/src/tests/keywords/if-skip
new file mode 100644
index 0000000..0e74f22
--- /dev/null
+++ b/src/tests/keywords/if-skip
@@ -0,0 +1,42 @@
+# PRE: if
+#
+#  Conditions which statically evaluate to "false"
+#  have their entire contents skipped on load.
+#
+#  Conditions which statically evaluate to "true"
+#  have the following "else" sections skipped, too.
+#
+#  i.e. we can reference things which don't exist,
+#  and they'll get ignored.
+#
+if (0) {
+	no-such-module
+}
+
+if (0) {
+	no-such-module
+}
+else {
+	ok
+}
+
+if (1) {
+	ok
+}
+else {
+	no-such-module
+}
+
+if (1) {
+	ok
+}
+elsif ("%{foo:bar}") {	# no pass2
+	no-such-module
+}
+else {
+	no-such-module
+}
+
+update reply {
+	Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/integer b/src/tests/keywords/integer
new file mode 100644
index 0000000..7e43270
--- /dev/null
+++ b/src/tests/keywords/integer
@@ -0,0 +1,209 @@
+#
+# PRE: update
+#
+update reply {
+       Filter-Id := "filter"
+}
+
+update request {
+	Tmp-String-0        := '9870'
+	Tmp-String-1        := '98709870'
+	Tmp-String-2        := '987098709870'
+	Tmp-Octets-0        := 0x39383731
+	Tmp-Octets-1        := 0x3938373139383731
+	Tmp-Octets-2        := 0x393837313938373139383731
+	Tmp-IP-Address-0    := 57.56.55.50
+	Tmp-Date-0          := 959985459
+	Tmp-Integer-0       := 959985460
+	Tmp-Cast-Abinary    := 'ip out forward srcip 57.56.55.53/32 udp dstport = 1812'
+	Tmp-Cast-IfId       := '0000:0000:3938:3737'
+	Tmp-Cast-IPv6Addr   := '::3938:3738'
+	Tmp-Cast-IPv6Prefix := '::3938:3739/128'
+	Tmp-Cast-Byte       := 58
+	Tmp-Cast-Short      := 14139
+	Tmp-Cast-Ethernet   := 00:00:39:38:37:3c
+	Tmp-Cast-Integer64  := 1152921505566832445
+	Tmp-Cast-IPv4Prefix := 57.56.55.62/32
+}
+
+update request {
+	Tmp-String-2        := "%{integer:Tmp-IP-Address-0}"
+	Tmp-String-3        := "%{integer:Tmp-Date-0}"
+	Tmp-String-4        := "%{integer:Tmp-Integer-0}"
+	Tmp-String-5        := "%{integer:Tmp-Cast-Abinary}"
+	Tmp-String-6        := "%{integer:Tmp-Cast-Ifid}"
+	Tmp-String-7        := "%{integer:Tmp-Cast-IPv6Addr}"
+	Tmp-String-8        := "%{integer:Tmp-Cast-IPv6Prefix}"
+}
+
+# String - network order representation of a 4 char string
+update request {
+	Tmp-Integer-0 := "%{integer:Tmp-String-0}"
+}
+if ((Tmp-String-0 != "%{string:Tmp-Integer-0}") || (Tmp-Integer-0 != 959985456)) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+# String - network order representation of a 8 char string
+update request {
+	Tmp-Integer64-0 := "%{integer:Tmp-String-1}"
+}
+if ((Tmp-String-1 != "%{string:Tmp-Integer64-0}") || (Tmp-Integer64-0 != 4123106139115632432)) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# String - Can't convert 12 byte string to integer (our biggest native size is a 64bit unsigned int)
+if ("%{integer:Tmp-String-2}" != '') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# Octets - network order representation of a 4 byte octet string
+update request {
+	Tmp-Integer-0 := "%{integer:Tmp-Octets-0}"
+}
+if (Tmp-Octets-0 != "0x%{hex:Tmp-Integer-0}") {
+	update reply {
+		Filter-Id += 'fail 4a'
+	}
+}
+
+if (Tmp-Integer-0 != 959985457) {
+	update reply {
+		Filter-Id += 'fail 4b'
+	}
+}
+
+# Octets - network order representation of a 8 byte octet string
+update request {
+	Tmp-Integer64-0 := "%{integer:Tmp-Octets-1}"
+}
+if (Tmp-Octets-1 != "0x%{hex:Tmp-Integer64-0}") {
+	update reply {
+		Filter-Id += 'fail 5a'
+	}
+}
+
+if (Tmp-Integer64-0 != 4123106143410599729) {
+	update reply {
+		Filter-Id += 'fail 5b'
+	}
+}
+
+# String - Can't convert 12 byte octet string to integer (our biggest native size is a 64bit unsigned int)
+if ("%{integer:Tmp-Octets-2}" != '') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+# IP Address
+if (Tmp-String-2 != '959985458') {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+if (<ipaddr>Tmp-String-2 != &Tmp-IP-Address-0) {
+	update reply {
+		Filter-Id += 'fail 8'
+	}
+}
+
+# Date
+if (Tmp-String-3 != '959985459') {
+	update reply {
+		Filter-Id += 'fail 9'
+	}
+}
+
+# Integer
+if (Tmp-String-4 != '959985460') {
+	update reply {
+		Filter-Id += 'fail 10'
+	}
+}
+
+# Abinary - Can't convert ascend binary to an integer
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 11'
+	}
+}
+
+# ifid - Can't convert interface ID to an integer
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 12'
+	}
+}
+
+# ipv6addr - Can't convert IPv6 to integer
+if (Tmp-String-7 != '959985464') {
+	update reply {
+		Filter-ID += 'fail 13'
+	}
+}
+
+# ipv6addrprefix
+if (Tmp-String-8 != '959985465') {
+	update reply {
+		Filter-ID += 'fail 14'
+	}
+}
+update request {
+	Tmp-String-0        := "%{integer:Tmp-Cast-Byte}"
+	Tmp-String-1        := "%{integer:Tmp-Cast-Short}"
+	Tmp-String-2        := "%{integer:Tmp-Cast-Ethernet}"
+	Tmp-String-3        := "%{integer:Tmp-Cast-Integer64}"
+	Tmp-String-4        := "%{integer:Tmp-Cast-IPv4Prefix}"
+}
+
+# byte
+if (Tmp-String-0 != '58') {
+	update reply {
+		Filter-ID += 'fail 15'
+	}
+}
+
+# short
+if (Tmp-String-1 != '14139') {
+	update reply {
+		Filter-ID += 'fail 16'
+	}
+}
+
+# ethernet
+if (Tmp-String-2 != '62913607630848') {
+	update reply {
+		Filter-Id += 'fail 17'
+	}
+}
+if (<ether>Tmp-String-2 != &Tmp-Cast-Ethernet) {
+	update reply {
+		Filter-Id += 'fail 18'
+	}
+}
+
+# integer64
+if (Tmp-String-3 != '1152921505566832445') {
+	update reply {
+		Filter-Id += 'fail 19'
+	}
+}
+
+# ipv4prefix
+if (Tmp-String-4 != '959985470') {
+	update reply {
+		Filter-Id += 'fail 20'
+	}
+}
+
+
+
+
diff --git a/src/tests/keywords/ipaddr b/src/tests/keywords/ipaddr
new file mode 100644
index 0000000..3010a23
--- /dev/null
+++ b/src/tests/keywords/ipaddr
@@ -0,0 +1,51 @@
+#
+#  PRE: update if
+#
+update control {
+       Cleartext-Password := 'hello'
+       reply:Filter-Id := "filter"
+}
+
+update request {
+	# Dotted Quad
+	Tmp-IP-Address-0 := 127.0.0.1
+
+	# Dotted Quad with prefix
+	Tmp-IP-Address-1 := 127.0.0.2/32
+
+	# Hex (0x)
+	Tmp-IP-Address-2 := 0x7f000003
+
+	# Decimal
+	Tmp-IP-Address-3 := 2130706436
+}
+
+if (NAS-IP-Address != 127.0.0.1) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+if (Tmp-IP-Address-0 != 127.0.0.1) {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+if (Tmp-IP-Address-1 != 127.0.0.2) {
+	update reply {
+		Filter-Id += "fail 3"
+	}
+}
+
+if (Tmp-IP-Address-2 != 127.0.0.3) {
+	update reply {
+		Filter-Id += "fail 4"
+	}
+}
+
+if (Tmp-IP-Address-3 != 127.0.0.4) {
+	update reply {
+		Filter-Id += "fail 5"
+	}
+}
diff --git a/src/tests/keywords/ipaddr-error b/src/tests/keywords/ipaddr-error
new file mode 100644
index 0000000..5483a4f
--- /dev/null
+++ b/src/tests/keywords/ipaddr-error
@@ -0,0 +1,10 @@
+#
+#  PRE: update ipaddr
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+	Framed-IP-Address := 256.1 # ERROR
+}
diff --git a/src/tests/keywords/ipaddr.attrs b/src/tests/keywords/ipaddr.attrs
new file mode 100644
index 0000000..ab9c27e
--- /dev/null
+++ b/src/tests/keywords/ipaddr.attrs
@@ -0,0 +1,12 @@
+#
+#  Input packet
+#
+User-Name = "bob"
+User-Password = "hello"
+NAS-IP-Address = 127.0.0.1
+
+#
+#  Expected answer
+#
+Response-Packet-Type == Access-Accept
+Filter-Id == 'filter'
diff --git a/src/tests/keywords/ipprefix b/src/tests/keywords/ipprefix
new file mode 100644
index 0000000..0ab8dce
--- /dev/null
+++ b/src/tests/keywords/ipprefix
@@ -0,0 +1,52 @@
+#
+#  PRE: update if
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+	Filter-Id := "filter"
+}
+
+update control {
+	Tmp-Cast-IPv4Prefix := 198.51.100.255/16
+	Tmp-Cast-IPv6Prefix := ::198.51.100.255/112
+	Framed-IP-Address := 198.51.0.1
+}
+
+if ("%{control:Tmp-Cast-IPv6Prefix}" != '::198.51.0.0/112') {
+	update reply {
+		Filter-Id += "Fail 0"
+	}
+}
+
+if ("%{control:Tmp-Cast-IPv4Prefix}" != '198.51.0.0/16') {
+	update reply {
+		Filter-Id += "Fail 1"
+	}
+}
+
+if (control:Tmp-Cast-IPv6Prefix != ::198.51.0.0/112) {
+	update reply {
+		Filter-Id += "Fail 2"
+	}
+}
+
+if (control:Tmp-Cast-IPv4Prefix != 198.51.0.0/16) {
+	update reply {
+		Filter-Id += "Fail 3"
+	}
+}
+
+if (!(&control:Tmp-Cast-IPv4Prefix < 198.0.0.0/8)) {
+	update reply {
+		Filter-Id += "Fail 4"
+	}
+}
+
+if (!(&control:Framed-IP-Address < 198.51.0.0/16)) {
+	update reply {
+		Filter-Id += "Fail 5"
+	}
+}
diff --git a/src/tests/keywords/length b/src/tests/keywords/length
new file mode 100644
index 0000000..ad37fc8
--- /dev/null
+++ b/src/tests/keywords/length
@@ -0,0 +1,155 @@
+#
+# PRE: hex
+#
+update reply {
+       Filter-Id := "filter"
+}
+
+update request {
+	Tmp-String-0        := '\
+abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz\
+abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz\
+abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz'
+	Tmp-String-2        := '9870'
+	Tmp-Octets-0        := 0x39383731
+	Tmp-IP-Address-0    := 57.56.55.50
+	Tmp-Date-0          := 959985459
+	Tmp-Integer-0       := 959985460
+	Tmp-Cast-Abinary    := 'ip out forward srcip 57.56.55.53/32 udp dstport = 1812'
+	Tmp-Cast-IfId       := '0000:0000:3938:3737'
+	Tmp-Cast-IPv6Addr   := '::3938:3738'
+	Tmp-Cast-IPv6Prefix := '::3938:3739/128'
+	Tmp-Cast-Byte       := 58
+	Tmp-Cast-Short      := 14139
+	Tmp-Cast-Ethernet   := 00:00:39:38:37:3c
+	Tmp-Cast-Integer64  := 1152921505566832445
+	Tmp-Cast-IPv4Prefix := 57.56.55.62/32
+}
+
+update request {
+	Tmp-Integer-0        := "%{length:Tmp-String-0}"
+}
+
+if (Tmp-Integer-0 != 260) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+update request {
+	Tmp-Integer-0        := "%{length:Tmp-String-2}"
+	Tmp-Integer-1        := "%{length:Tmp-Octets-0}"
+	Tmp-Integer-2        := "%{length:Tmp-IP-Address-0}"
+	Tmp-Integer-3        := "%{length:Tmp-Date-0}"
+	Tmp-Integer-4        := "%{length:Tmp-Integer-0}"
+	Tmp-Integer-5        := "%{length:Tmp-Cast-Abinary}"
+	Tmp-Integer-6        := "%{length:Tmp-Cast-Ifid}"
+	Tmp-Integer-7        := "%{length:Tmp-Cast-IPv6Addr}"
+	Tmp-Integer-8        := "%{length:Tmp-Cast-IPv6Prefix}"
+	Tmp-Integer-9        := "%{length:Tmp-Cast-Byte}"
+}
+
+# String - bin 0x39383730
+if (Tmp-Integer-0 != 4) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# Octets - bin 0x39383731
+if (Tmp-Integer-1 != 4) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# IP Address - bin 0x39383732
+if (Tmp-Integer-2 != 4) {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+# Date - bin 0x39383733
+if (Tmp-Integer-3 != 4) {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# Integer - bin 0x39383734
+if (Tmp-Integer-4 != 4) {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+# Abinary - bin 0x0101000039383735000000002000110000000714000200000000000000000000
+if (Tmp-Integer-5 != 32) {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+# ifid - bin 0x0000000039383737
+if (Tmp-Integer-6 != 8) {
+	update reply {
+		Filter-Id += 'fail 8'
+	}
+}
+
+# ipv6addr - bin 0x00000000000000000000000039383738
+if (Tmp-Integer-7 != 16) {
+	update reply {
+		Filter-ID += 'fail 9'
+	}
+}
+
+# ipv6addrprefix - bin 0x008000000000000000000000000039383739
+if (Tmp-Integer-8 != 18) {
+	update reply {
+		Filter-ID += 'fail 10'
+	}
+}
+
+# byte - bin 0x3a
+if (Tmp-Integer-9 != 1) {
+	update reply {
+		Filter-ID += 'fail 11'
+	}
+}
+
+update request {
+	Tmp-Integer-0        := "%{length:Tmp-Cast-Short}"
+	Tmp-Integer-1        := "%{length:Tmp-Cast-Ethernet}"
+	Tmp-Integer-2        := "%{length:Tmp-Cast-Integer64}"
+	Tmp-Integer-3        := "%{length:Tmp-Cast-IPv4Prefix}"
+}
+
+# short - bin 0x373b
+if (Tmp-Integer-0 != 2) {
+	update reply {
+		Filter-ID += 'fail 12'
+	}
+}
+
+# ethernet - bin 0x00003938373c
+if (Tmp-Integer-1 != 6) {
+	update reply {
+		Filter-Id += 'fail 13'
+	}
+}
+
+# integer64 - bin 0x100000003938373d
+if (Tmp-Integer-2 != 8) {
+	update reply {
+		Filter-Id += 'fail 14'
+	}
+}
+
+# ipv4prefix - bin 0x00203938373e
+if (Tmp-Integer-3 != 6) {
+	update reply {
+		Filter-Id += 'fail 15'
+	}
+}
diff --git a/src/tests/keywords/load-balance b/src/tests/keywords/load-balance
new file mode 100644
index 0000000..d07939a
--- /dev/null
+++ b/src/tests/keywords/load-balance
@@ -0,0 +1,97 @@
+# PRE: update if foreach
+#
+#  Load-Balance blocks.
+#
+#  Should distribute load between the modules.
+#
+update request {
+    Tmp-Integer-0 := 0
+    Tmp-Integer-1 := 0
+
+    Tmp-Integer-2 += 0		# 0
+    Tmp-Integer-2 += 1
+    Tmp-Integer-2 += 2
+    Tmp-Integer-2 += 3
+    Tmp-Integer-2 += 4
+    Tmp-Integer-2 += 5
+    Tmp-Integer-2 += 6
+    Tmp-Integer-2 += 7
+    Tmp-Integer-2 += 8
+    Tmp-Integer-2 += 9		# 10
+    Tmp-Integer-2 += 0
+    Tmp-Integer-2 += 1
+    Tmp-Integer-2 += 2
+    Tmp-Integer-2 += 3
+    Tmp-Integer-2 += 4
+    Tmp-Integer-2 += 5
+    Tmp-Integer-2 += 6
+    Tmp-Integer-2 += 7
+    Tmp-Integer-2 += 8
+    Tmp-Integer-2 += 9		# 20
+    Tmp-Integer-2 += 0
+    Tmp-Integer-2 += 1
+    Tmp-Integer-2 += 2
+    Tmp-Integer-2 += 3
+    Tmp-Integer-2 += 4
+    Tmp-Integer-2 += 5
+    Tmp-Integer-2 += 6
+    Tmp-Integer-2 += 7
+    Tmp-Integer-2 += 8
+    Tmp-Integer-2 += 9		# 30
+    Tmp-Integer-2 += 0
+    Tmp-Integer-2 += 1
+    Tmp-Integer-2 += 2
+    Tmp-Integer-2 += 3
+    Tmp-Integer-2 += 4
+    Tmp-Integer-2 += 5
+    Tmp-Integer-2 += 6
+    Tmp-Integer-2 += 7
+    Tmp-Integer-2 += 8
+    Tmp-Integer-2 += 9		# 40
+    Tmp-Integer-2 += 0
+    Tmp-Integer-2 += 1
+    Tmp-Integer-2 += 2
+    Tmp-Integer-2 += 3
+    Tmp-Integer-2 += 4
+    Tmp-Integer-2 += 5
+    Tmp-Integer-2 += 6
+    Tmp-Integer-2 += 7
+    Tmp-Integer-2 += 8
+    Tmp-Integer-2 += 9		# 49
+}
+
+#
+#  Loop 0..9
+#
+foreach &Tmp-Integer-2 {
+	load-balance {
+		group {
+			update request {
+				Tmp-Integer-0 := "%{expr:%{Tmp-Integer-0} + 1}"
+				Filter-Id += "PICKED GROUP 1 %{Tmp-Integer-0} TIME(S)"
+			}
+			ok
+		}
+		group {
+			update request {
+				Tmp-Integer-1 := "%{expr:%{Tmp-Integer-1} + 1}"
+				Filter-Id += "PICKED GROUP 2 %{Tmp-Integer-1} TIME(S)"
+			}
+			ok
+		}
+	}
+}
+
+# The chances of one group being used over another 50 times by random occurrence
+# is quite small, and if this happens repeatedly, it's likely there's a bug in
+# the load-balance code or random number generator.
+if ((&Tmp-Integer-0 == 0) || (&Tmp-Integer-1 == 0)) {
+	update reply {
+		Filter-Id += "fail 1 %{Tmp-Integer-0}/%{Tmp-Integer-1})"
+	}
+}
+else {
+	update reply {
+		Filter-Id := 'filter'
+	}
+}
diff --git a/src/tests/keywords/log b/src/tests/keywords/log
new file mode 100644
index 0000000..97a2557
--- /dev/null
+++ b/src/tests/keywords/log
@@ -0,0 +1,7 @@
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+       Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/map-xlat b/src/tests/keywords/map-xlat
new file mode 100644
index 0000000..24446a5
--- /dev/null
+++ b/src/tests/keywords/map-xlat
@@ -0,0 +1,25 @@
+#
+# PRE: update
+#
+#  Test the map xlat
+#
+update {
+       control:Cleartext-Password := 'hello'
+       reply:Filter-Id := "filter"
+}
+
+update {
+	Tmp-String-0 := '&control:Tmp-String-0 := \'testing123\''
+}
+
+if ("%{map:%{Tmp-String-0}}" != 1) {
+    update reply {
+        Filter-Id += 'Fail 0'
+    }
+}
+
+if (&control:Tmp-String-0 != 'testing123') {
+    update reply {
+        Filter-Id += 'Fail 1'
+    }
+}
diff --git a/src/tests/keywords/md4 b/src/tests/keywords/md4
new file mode 100644
index 0000000..7e9b1ff
--- /dev/null
+++ b/src/tests/keywords/md4
@@ -0,0 +1,58 @@
+#
+# PRE: update if
+#
+update reply {
+	Filter-Id := "filter"
+}
+
+update {
+       control:Cleartext-Password := 'hello'
+       request:Tmp-String-0 := "This is a string\n"
+       request:Tmp-Octets-0 := 0x000504030201
+       request:Tmp-String-1 := "what do ya want for nothing?"
+       request:Tmp-String-2 := "Jefe"
+}
+
+#
+#  Put "This is a string" into a file and call "md5sum" on it.
+#  You should get this string.
+#
+if ("%{md4:This is a string\n}" != '1f60d5cd85e17bfbdda7c923822f060c') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{md4:&Tmp-String-0}" != '1f60d5cd85e17bfbdda7c923822f060c') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{md4:&request:Tmp-String-0}" != '1f60d5cd85e17bfbdda7c923822f060c') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+if ("%{md4:%{request:Tmp-String-0}}" != '1f60d5cd85e17bfbdda7c923822f060c') {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+#
+#  MD4 should also be able to cope with references to octet attributes
+#
+if ("%{md4:&request:Tmp-Octets-0}" != 'ac3ed17b3cf19ec38352ec534a932fc6') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+if ("%{md4:&Tmp-String-1}" != 'f7b44afb9cfdc877aa99d44654fe808b') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
diff --git a/src/tests/keywords/md5 b/src/tests/keywords/md5
new file mode 100644
index 0000000..a973660
--- /dev/null
+++ b/src/tests/keywords/md5
@@ -0,0 +1,60 @@
+#
+# PRE: update if
+#
+update reply {
+	Filter-Id := "filter"
+}
+
+update {
+       control:Cleartext-Password := 'hello'
+       request:Tmp-String-0 := "This is a string\n"
+       request:Tmp-Octets-0 := 0x000504030201
+       request:Tmp-String-1 := "what do ya want for nothing?"
+       request:Tmp-String-2 := "Jefe"
+}
+
+#
+#  Put "This is a string" into a file and call "md5sum" on it.
+#  You should get this string.
+#
+if ("%{md5:This is a string\n}" != '9ac4dbbc3c0ad2429e61d0df5dc28add') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{md5:&Tmp-String-0}" != '9ac4dbbc3c0ad2429e61d0df5dc28add') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{md5:&request:Tmp-String-0}" != '9ac4dbbc3c0ad2429e61d0df5dc28add') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+if ("%{md5:%{request:Tmp-String-0}}" != '9ac4dbbc3c0ad2429e61d0df5dc28add') {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+#
+#  MD5 should also be able to cope with references to octet attributes
+#
+if ("%{md5:&request:Tmp-Octets-0}" != 'c1e7fa505b2fc1fd0da6cac3db6f6f44') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+#
+#  MD5 HMAC with attribute references
+#
+if ("%{hmacmd5:&Tmp-String-1 &Tmp-String-2}" != '750c783e6ab0b503eaa86e310a5db738') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
diff --git a/src/tests/keywords/module-failure-message b/src/tests/keywords/module-failure-message
new file mode 100644
index 0000000..51b1ef4
--- /dev/null
+++ b/src/tests/keywords/module-failure-message
@@ -0,0 +1,40 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+test
+if ("%{request:Module-Failure-Message[0]}" != 'test: RERROR error message') {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+if ("%{request:Module-Failure-Message[1]}" != 'test: RDEBUG error message') {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+if ("%{request:Module-Failure-Message[2]}" != 'test: RDEBUG2 error message') {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+if ("%{request:Module-Failure-Message[3]}" != 'test: RDEBUG3 error message') {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
+
+if ("%{request:Module-Failure-Message[4]}" != 'test: RDEBUG4 error message') {
+	update reply {
+		Filter-Id += 'Fail 4'
+	}
+}
diff --git a/src/tests/keywords/ok-return b/src/tests/keywords/ok-return
new file mode 100644
index 0000000..f79ef02
--- /dev/null
+++ b/src/tests/keywords/ok-return
@@ -0,0 +1,13 @@
+update {
+	control:Auth-Type = 'Accept'
+	reply:Reply-Message = 'pass'
+}
+
+# Section should exit after this statement
+ok {
+	ok = return
+}
+
+update {
+	reply:Reply-Message := 'fail'
+}
diff --git a/src/tests/keywords/ok-return.attrs b/src/tests/keywords/ok-return.attrs
new file mode 100644
index 0000000..ad30f4d
--- /dev/null
+++ b/src/tests/keywords/ok-return.attrs
@@ -0,0 +1,4 @@
+User-Name = 'test'
+
+Response-Packet-Type == Access-Accept
+Reply-Message == 'pass'
diff --git a/src/tests/keywords/pad b/src/tests/keywords/pad
new file mode 100644
index 0000000..0a1f9ce
--- /dev/null
+++ b/src/tests/keywords/pad
@@ -0,0 +1,62 @@
+#
+#  PRE: if update return
+#
+
+update request {
+	Tmp-String-0 = "test"
+}
+
+#
+#	rpad tests
+#
+
+if ("%{rpad:&Tmp-String-0 7}" != "test   ") {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+	return
+}
+
+if ("%{rpad:&Tmp-String-0 2}" != "te") {
+	update reply {
+		Filter-Id := "fail 2"
+	}
+	return
+}
+
+if ("%{rpad:&Tmp-String-0 7 x}" != "testxxx") {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+	return
+}
+
+#
+#	lpad tests
+#
+
+if ("%{lpad:&Tmp-String-0 7}" != "   test") {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+	return
+}
+
+if ("%{lpad:&Tmp-String-0 2}" != "te") {
+	update reply {
+		Filter-Id := "fail 2"
+	}
+	return
+}
+
+if ("%{lpad:&Tmp-String-0 7 x}" != "xxxtest") {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+	return
+}
+
+update reply {
+	Filter-Id := "filter"
+}
+
diff --git a/src/tests/keywords/pairs b/src/tests/keywords/pairs
new file mode 100644
index 0000000..4230c57
--- /dev/null
+++ b/src/tests/keywords/pairs
@@ -0,0 +1,42 @@
+#
+# PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       request:Tmp-String-0 := "This is a string"
+       request:Tmp-String-0 += "This is another one"
+       request:Tmp-Octets-0 := 0x000504030201
+       request:Tmp-Integer-0 := 7331
+       request:Tunnel-Private-Group-Id:5 = 127.0.0.1
+       reply:Filter-Id = 'filter'
+}
+
+if ("%{pairs:request:}" != "User-Name = \"bob\", User-Password = \"hello\", Tmp-String-0 = \"This is a string\", Tmp-String-0 = \"This is another one\", Tmp-Octets-0 = 0x000504030201, Tmp-Integer-0 = 7331, Tunnel-Private-Group-Id:5 = \"127.0.0.1\"") {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{pairs:Tmp-String-0}" != "Tmp-String-0 = \"This is a string\"") {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{pairs:Tmp-String-0[*]}" != "Tmp-String-0 = \"This is a string\", Tmp-String-0 = \"This is another one\"") {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+if ("%{pairs:control:}" != "Cleartext-Password = \"hello\"") {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+if ("%{pairs:control:User-Name}" != '') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
diff --git a/src/tests/keywords/pap b/src/tests/keywords/pap
new file mode 100644
index 0000000..a347b7c
--- /dev/null
+++ b/src/tests/keywords/pap
@@ -0,0 +1,146 @@
+#
+# PRE: update if
+#
+update {
+	reply:Filter-Id := 'filter'
+	control: !* ANY
+	request:Tmp-String-0 := "5RNqNl8iYLbkCc7JhR8as4TtDDCX6otuuWtcja8rITUyx9zrnHSe9tTHGmKK"	# 60 byte salt
+}
+
+#
+#  Unencoded Cleartext-Password in password with header
+#
+update {
+ 	control:Password-With-Header := "%{request:User-Password}"
+}
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+#
+#  Base64 encoded Cleartext-Password in password with header
+#
+update {
+	Tmp-String-1 := "{clear}%{User-Password}"
+}
+update {
+ 	control:Password-With-Header := "%{base64:&request:Tmp-String-1}"
+}
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+#
+#  Hex encoded SSHA password
+#
+update {
+	control:Password-With-Header += "{ssha}%{sha1:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:&request:Tmp-String-0}"
+}
+
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+#
+#  Base64 encoded SSHA password
+#
+update {
+	control:Tmp-String-1 := "%{sha1:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:&request:Tmp-String-0}"
+}
+
+# To Binary
+update {
+	control:Tmp-Octets-0 := "0x%{control:Tmp-String-1}"
+}
+
+# To Base64
+update {
+	control:Tmp-String-1 := "%{base64:&control:Tmp-Octets-0}"
+}
+
+update {
+	control:Password-With-Header += "{ssha}%{control:Tmp-String-1}"
+}
+
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+#
+#  Base64 of Base64 encoded SSHA password
+#
+update {
+	control:Tmp-String-1 := "%{sha1:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:&request:Tmp-String-0}"
+}
+
+# To Binary
+update {
+	control:Tmp-Octets-0 := "0x%{control:Tmp-String-1}"
+}
+
+# To Base64
+update {
+	control:Tmp-String-1 := "{ssha}%{base64:&control:Tmp-Octets-0}"
+}
+
+update {
+	control:Password-With-Header += "%{base64:&control:Tmp-String-1}"
+}
+
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+update control {
+	Auth-Type := Accept
+}
diff --git a/src/tests/keywords/pap-ssha2 b/src/tests/keywords/pap-ssha2
new file mode 100644
index 0000000..a8c9c9b
--- /dev/null
+++ b/src/tests/keywords/pap-ssha2
@@ -0,0 +1,114 @@
+#
+# PRE: update if pap
+#
+
+#
+#  Skip if the server wasn't built with openssl
+#
+if ('${feature.tls}' != 'yes') {
+	update control {
+		Response-Packet-Type := Access-Accept
+	}
+	handled
+}
+
+update {
+	reply:Filter-Id := 'filter'
+	control: !* ANY
+	request:Tmp-String-0 := "5RNqNl8iYLbkCc7JhR8as4TtDDCX6otuuWtcja8rITUyx9zrnHSe9tTHGmKK"	# 60 byte salt
+}
+
+#
+#  Hex encoded SSHA2-512 password
+#
+update {
+	control:Password-With-Header += "{ssha512}%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:&request:Tmp-String-0}"
+}
+
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+#
+#  Base64 encoded SSHA2-512 password
+#
+update {
+	control:Tmp-String-1 := "%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:&request:Tmp-String-0}"
+}
+
+# To Binary
+update {
+	control:Tmp-Octets-0 := "0x%{control:Tmp-String-1}"
+}
+
+# To Base64
+update {
+	control:Tmp-String-1 := "%{base64:&control:Tmp-Octets-0}"
+}
+
+update {
+	control:Password-With-Header += "{ssha512}%{control:Tmp-String-1}"
+}
+
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+#
+#  Base64 of Base64 encoded SSHA2-512 password
+#
+update {
+	control:Tmp-String-1 := "%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:&request:Tmp-String-0}"
+}
+
+# To Binary
+update {
+	control:Tmp-Octets-0 := "0x%{control:Tmp-String-1}"
+}
+
+# To Base64
+update {
+	control:Tmp-String-1 := "{ssha512}%{base64:&control:Tmp-Octets-0}"
+}
+
+update {
+	control:Password-With-Header += "%{base64:&control:Tmp-String-1}"
+}
+
+pap.authorize
+pap.authenticate {
+	reject = 1
+}
+if (reject) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+update {
+	control: !* ANY
+}
+
+update control {
+	Auth-Type := Accept
+}
diff --git a/src/tests/keywords/radiusd.conf b/src/tests/keywords/radiusd.conf
new file mode 100644
index 0000000..58cb356
--- /dev/null
+++ b/src/tests/keywords/radiusd.conf
@@ -0,0 +1,127 @@
+#
+#  Minimal radiusd.conf for testing keywords
+#
+
+raddb		= raddb
+keyword		= src/tests/keywords
+
+modconfdir	= ${raddb}/mods-config
+
+correct_escapes	= true
+
+#  Only for testing!
+#  Setting this on a production system is a BAD IDEA.
+security {
+	allow_vulnerable_openssl = yes
+}
+
+modules {
+	$INCLUDE ${raddb}/mods-enabled/always
+
+	$INCLUDE ${raddb}/mods-enabled/pap
+
+	$INCLUDE ${raddb}/mods-enabled/expr
+
+	$INCLUDE ${raddb}/mods-enabled/unpack
+
+	test {
+
+	}
+
+	unix {
+	}
+
+	cache {
+		driver = "rlm_cache_rbtree"
+
+		key = "%{Tmp-String-0}"
+		ttl = 2
+
+		update {
+			&request:Tmp-String-1 := &control:Tmp-String-1
+			&request:Tmp-Integer-0 := &control:Tmp-Integer-0
+			&control: += &reply:
+		}
+
+		add_stats = yes
+	}
+}
+
+policy {
+	#
+	#  Outputs the contents of the control list in debugging (-X) mode
+	#
+	debug_control {
+		if("%{debug_attr:control:}" == '') {
+			noop
+		}
+	}
+
+	#
+	#  Outputs the contents of the request list in debugging (-X) mode
+	#
+	debug_request {
+		if("%{debug_attr:request:}" == '') {
+			noop
+		}
+	}
+
+	#
+	#  Outputs the contents of the reply list in debugging (-X) mode
+	#
+	debug_reply {
+		if("%{debug_attr:reply:}" == '') {
+			noop
+		}
+	}
+
+	#
+	#  Outputs the contents of the main lists in debugging (-X) mode
+	#
+	debug_all {
+		debug_control
+		debug_request
+		debug_reply
+	}
+
+	#
+	#  Just check that this can be referred to as "virtual_policy.post-auth"
+	#
+	virtual_policy {
+		ok
+	}
+
+	with.dots {
+		ok
+	}
+}
+
+instantiate {
+	#
+	#  Just check that this can be referred to as "virtual_instantiate.post-auth"
+	#
+	load-balance virtual_instantiate {
+		ok
+		ok
+	}
+}
+
+server default {
+	authorize {
+		update control {
+			Cleartext-Password := 'hello'
+		}
+
+		#
+		# Include the test file specified by the
+		# KEYWORD environment variable.
+		#
+		$INCLUDE ${keyword}/$ENV{KEYWORD}
+
+		pap
+	}
+
+	authenticate {
+		pap
+	}
+}
diff --git a/src/tests/keywords/redundant b/src/tests/keywords/redundant
new file mode 100644
index 0000000..cebe7be
--- /dev/null
+++ b/src/tests/keywords/redundant
@@ -0,0 +1,17 @@
+# PRE: update if foreach
+#
+#  Redundant blocks.
+#
+#  The first one fails, so the second one is used
+#
+redundant {
+	group {
+		fail
+	}
+
+	group {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+}
diff --git a/src/tests/keywords/redundant-error b/src/tests/keywords/redundant-error
new file mode 100644
index 0000000..bec4335
--- /dev/null
+++ b/src/tests/keywords/redundant-error
@@ -0,0 +1,6 @@
+#
+#  Check that redundant blocks can't be empty
+#
+redundant {	# ERROR
+
+}
diff --git a/src/tests/keywords/redundant-load-balance b/src/tests/keywords/redundant-load-balance
new file mode 100644
index 0000000..27721f1
--- /dev/null
+++ b/src/tests/keywords/redundant-load-balance
@@ -0,0 +1,65 @@
+# PRE: update if foreach
+#
+#  Redundant blocks.
+#
+#  The first one fails, so the second one is used
+#
+update request {
+    Tmp-Integer-0 := 0
+    Tmp-Integer-1 += 0
+    Tmp-Integer-1 += 1
+    Tmp-Integer-1 += 2
+    Tmp-Integer-1 += 3
+    Tmp-Integer-1 += 4
+    Tmp-Integer-1 += 5
+    Tmp-Integer-1 += 6
+    Tmp-Integer-1 += 7
+    Tmp-Integer-1 += 8
+    Tmp-Integer-1 += 9
+
+}
+
+#
+#  Loop 0..9
+#
+foreach &Tmp-Integer-1 {
+    redundant-load-balance {
+        group {
+	    # fail on even numbered values, succeed on odd numbered ones
+            if ("%{expr:%{Foreach-Variable-0} %% 2}" == 0) {
+                fail
+            }
+            else {
+                update request {
+                    Tmp-Integer-0 := "%{expr:%{Tmp-Integer-0} + 1}"
+		    Filter-Id += "SUCCEED ODD %{Foreach-Variable-0} %{Tmp-Integer-0}"
+                }
+                ok
+            }
+        }
+        group {
+	    # succeed on even-numbered values, fail on off-numbered ones.
+            if ("%{expr:%{Foreach-Variable-0} %% 2}" == 1) {
+	        fail
+            }
+            else {
+                update request {
+                    Tmp-Integer-0 := "%{expr:%{Tmp-Integer-0} + 1}"
+		    Filter-Id += "SUCCEED EVEN %{Foreach-Variable-0} %{Tmp-Integer-0}"
+                }
+                ok
+            }
+        }
+    }
+}
+
+if (&Tmp-Integer-0 != "%{Tmp-Integer-1[#]}") {
+    update reply {
+        Filter-Id += "fail 2 (passed %{Tmp-Integer-0}/%{Tmp-Integer-1[#]})"
+    }
+}
+else {
+     update reply {
+	Filter-Id := 'filter'
+     }
+}
diff --git a/src/tests/keywords/redundant-redundant b/src/tests/keywords/redundant-redundant
new file mode 100644
index 0000000..294f53e
--- /dev/null
+++ b/src/tests/keywords/redundant-redundant
@@ -0,0 +1,73 @@
+# PRE: update if foreach redundant redundant-load-balance
+#
+#  Nested redundant blocks.
+#
+#
+update request {
+	Tmp-Integer-2 := 0
+	Tmp-Integer-3 := 0
+	Tmp-Integer-4 := 0
+	Tmp-Integer-5 := 0
+}
+
+redundant {
+	redundant-load-balance {
+		group {
+			update request {
+				Tmp-Integer-2 := "%{expr:&Tmp-Integer-2 + 1}"
+			}
+			fail
+		}
+		group {
+			update request {
+				Tmp-Integer-3 := "%{expr:&Tmp-Integer-3 + 1}"
+			}
+			fail
+		}
+		group {
+			update request {
+				Tmp-Integer-4 := "%{expr:&Tmp-Integer-4 + 1}"
+			}
+			fail
+		}
+		group {
+			update request {
+				Tmp-Integer-5 := "%{expr:&Tmp-Integer-5 + 1}"
+			}
+			fail
+		}
+	}
+	ok
+}
+
+if (&Tmp-Integer-2 != 1) {
+	update reply {
+		Filter-Id += 'Fail 3a'
+	}
+	return
+}
+
+if (&Tmp-Integer-3 != 1) {
+	update reply {
+		Filter-Id += 'Fail 3b'
+	}
+	return
+}
+
+if (&Tmp-Integer-4 != 1) {
+	update reply {
+		Filter-Id += 'Fail 3c'
+	}
+	return
+}
+
+if (&Tmp-Integer-5 != 1) {
+	update reply {
+		Filter-Id += 'Fail 3d'
+	}
+	return
+}
+
+update reply {
+	Filter-Id := "filter"
+}
\ No newline at end of file
diff --git a/src/tests/keywords/regex-escape b/src/tests/keywords/regex-escape
new file mode 100644
index 0000000..4ab1e5b
--- /dev/null
+++ b/src/tests/keywords/regex-escape
@@ -0,0 +1,29 @@
+#
+#  PRE: update if
+#
+
+#
+#  Strings which are expanded in a regex have regex special
+#  characters escaped.  Because the input strings are unsafe.
+#
+update request {
+	Tmp-String-0 := "example.com"
+	Tmp-String-1 := "exampleXcom"
+}
+
+if ("exampleXcom" =~ /%{Tmp-String-0}/) {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+}
+
+elsif (&Tmp-String-1 =~ /%{Tmp-String-0}/) {
+	update reply {
+		Filter-Id := "fail 2"
+	}
+}
+else {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/regex-lhs b/src/tests/keywords/regex-lhs
new file mode 100644
index 0000000..91b0b20
--- /dev/null
+++ b/src/tests/keywords/regex-lhs
@@ -0,0 +1,27 @@
+#
+#  PRE: update if regex-escape
+#
+
+#
+#  Strings which are expanded in a regex have regex special
+#  characters escaped.  Because the input strings are unsafe.
+#
+update request {
+	Tmp-String-0 := "example.com"
+	Tmp-String-1 := "^foo$bar"
+}
+
+if (&Tmp-String-0 !~ /example\.com$/) {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+}
+elsif (&Tmp-String-1 !~ /\^foo\$bar/) {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+} else {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/return b/src/tests/keywords/return
new file mode 100644
index 0000000..49779a5
--- /dev/null
+++ b/src/tests/keywords/return
@@ -0,0 +1,33 @@
+#
+#  PRE: update if
+#
+update control {
+	Cleartext-Password := 'hello'
+}
+
+if (User-Name == "bob") {
+	update reply {
+		Filter-Id := "filter"
+	}
+
+	#
+	#  We need this because the "return" below
+	#  will prevent the "pap" module from being run
+	#  in the "authorize" section.
+	#
+	update control {
+		Auth-Type := PAP
+	}
+
+	#
+	#  Stop processing "authorize", and go to the next section.
+	#
+	return
+
+	#
+	#  Shouldn't reach this
+	#
+	update reply {
+		Filter-Id := "fail"
+	}
+}
diff --git a/src/tests/keywords/return-group b/src/tests/keywords/return-group
new file mode 100644
index 0000000..92978e4
--- /dev/null
+++ b/src/tests/keywords/return-group
@@ -0,0 +1,22 @@
+# PRE: return
+#
+update {
+	control:Auth-Type = 'Accept'
+}
+
+group {
+	# Section should exit after this statement
+	ok {
+		ok = return
+	}
+
+	# This entry should never be reached
+	update {
+		reply:Reply-Message := 'fail'
+	}
+}
+
+# We should continue processing after the previous group.
+update {
+	reply:Reply-Message += 'pass'	
+}
diff --git a/src/tests/keywords/return-group.attrs b/src/tests/keywords/return-group.attrs
new file mode 100644
index 0000000..ad30f4d
--- /dev/null
+++ b/src/tests/keywords/return-group.attrs
@@ -0,0 +1,4 @@
+User-Name = 'test'
+
+Response-Packet-Type == Access-Accept
+Reply-Message == 'pass'
diff --git a/src/tests/keywords/return-section b/src/tests/keywords/return-section
new file mode 100644
index 0000000..21ecea1
--- /dev/null
+++ b/src/tests/keywords/return-section
@@ -0,0 +1,35 @@
+#
+#  PRE: update if
+#
+update control {
+	Cleartext-Password := 'hello'
+}
+
+if (User-Name == "bob") {
+	update reply {
+		Filter-Id := "filter"
+	}
+
+	#
+	#  We need this because the "return" below
+	#  will prevent the "pap" module from being run
+	#  in the "authorize" section.
+	#
+	update control {
+		Auth-Type := PAP
+	}
+
+	#
+	#  Stop processing "authorize", and go to the next section.
+	#
+	return {	# ERROR
+	       ok = 1
+	}
+
+	#
+	#  Shouldn't reach this
+	#
+	update reply {
+		Filter-Id := "fail"
+	}
+}
diff --git a/src/tests/keywords/sha1 b/src/tests/keywords/sha1
new file mode 100644
index 0000000..0d577a9
--- /dev/null
+++ b/src/tests/keywords/sha1
@@ -0,0 +1,60 @@
+#
+# PRE: update if
+#
+update {
+       control:Cleartext-Password := 'hello'
+       request:Tmp-String-0 := "This is a string\n"
+       request:Tmp-Octets-0 := 0x000504030201
+       request:Tmp-String-1 := "what do ya want for nothing?"
+       request:Tmp-String-2 := "Jefe"
+}
+
+update reply {
+	Filter-Id := 'filter'
+}
+
+#
+#  Put "This is a string" into a file and call "sha1sum" on it.
+#  You should get this string.
+#
+if ("%{sha1:This is a string\n}" != 'cc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{sha1:&Tmp-String-0}" != 'cc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{sha1:&request:Tmp-String-0}" != 'cc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+if ("%{sha1:%{Tmp-String-0}}" != 'cc7edf1ccc4bdf1e0ec8f72b95388b65218ecf0c') {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+#
+#  SHA1 should also be able to cope with references to octet attributes
+#
+if ("%{sha1:&request:Tmp-Octets-0}" != '365b244645fe7294dff062174996572319d5a82c') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+#
+#  SHA1 HMAC with attribute references
+#
+if ("%{hmacsha1:&Tmp-String-1 &Tmp-String-2}" != 'effcdf6ae5eb2fa2d27416d5f184df9c259a7c79') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
diff --git a/src/tests/keywords/sha2 b/src/tests/keywords/sha2
new file mode 100644
index 0000000..89c54f4
--- /dev/null
+++ b/src/tests/keywords/sha2
@@ -0,0 +1,81 @@
+#
+# PRE: update if
+#
+if ("$ENV{OPENSSL_LIBS}" != "") {
+
+update {
+       control:Cleartext-Password := 'hello'
+       request:Tmp-String-0 := "This is a string\n"
+       request:Tmp-Octets-0 := 0x000504030201
+}
+
+update reply {
+	Filter-Id := 'filter'
+}
+
+#
+#  Put "This is a string" into a file and call "sha256sum" on it.
+#  You should get this string.
+#
+if ("%{sha256:This is a string\n}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{sha256:&Tmp-String-0}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{sha256:&request:Tmp-String-0}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+if ("%{sha256:%{Tmp-String-0}}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+#
+#  SHA256 should also be able to cope with references to octet attributes
+#
+if ("%{sha256:&request:Tmp-Octets-0}" != 'f307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+#
+#  SHA512 and SHA256 share common code paths, so the tests don't need to be
+#  as exhaustive.
+#
+if ("%{sha512:This is a string\n}" != '56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+if ("%{sha512:&Tmp-String-0}" != '56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f') {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+if ("%{sha512:&request:Tmp-Octets-0}" != 'de80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7') {
+	update reply {
+		Filter-Id += 'fail 8'
+	}
+}
+
+}
+
+else {	# no OPENSSL.  Force the test to pass
+	update reply {
+		Filter-Id := 'filter'
+	}
+}
diff --git a/src/tests/keywords/smash b/src/tests/keywords/smash
new file mode 100644
index 0000000..fd19d3f
--- /dev/null
+++ b/src/tests/keywords/smash
@@ -0,0 +1,6 @@
+#
+#  PRE: update
+#
+#  This gives the game away.
+#
+update { control:Cleartext-Password := 'hello', reply:Filter-Id := "filter" }
diff --git a/src/tests/keywords/string b/src/tests/keywords/string
new file mode 100644
index 0000000..bcf0fcf
--- /dev/null
+++ b/src/tests/keywords/string
@@ -0,0 +1,19 @@
+#
+#  PRE: cmp
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update request {
+	Tmp-String-0 := "this\000is\000a\000string"
+}
+
+#
+#  %{string:...} is explicitly not binary safe
+#
+if ("%{string:Tmp-String-0}" == "this") {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/substring b/src/tests/keywords/substring
new file mode 100644
index 0000000..0ce4e9d
--- /dev/null
+++ b/src/tests/keywords/substring
@@ -0,0 +1,418 @@
+#
+# PRE: update
+#
+#  Check substring xlat works correctly
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tmp-String-0      := 'foo bar'
+	Tmp-Integer-0     := 54786512
+	Tmp-IP-Address-0  := 192.168.56.34
+	Tmp-Cast-Ethernet := 01:23:45:67:89:ab
+}
+
+update request {
+	Tmp-String-1 := "%{substring:&Tmp-String-0 2 3}"
+	Tmp-String-2 := "%{substring:&Tmp-String-0 -3 2}"
+	Tmp-String-3 := "%{substring:&Tmp-String-0 1 -3}"
+	Tmp-String-4 := "%{substring:&Tmp-String-0 -4 -1}"
+	Tmp-String-5 := "%{substring:&Tmp-String-0 8 5}"
+	Tmp-String-6 := "%{substring:&Tmp-String-0 4 -10}"
+	Tmp-String-7 := "%{substring:&Tmp-String-0 0 7}"
+	Tmp-String-8 := "%{substring:&Tmp-String-0 3 0}"
+	Tmp-String-9 := "%{substring:&Tmp-String-0 4 8}"
+}
+
+if (Tmp-String-1 != 'o b') {
+	update reply {
+		Filter-Id += 'fail 0.1'
+	}
+}
+
+if (Tmp-String-2 != 'ba') {
+	update reply {
+		Filter-Id += 'fail 0.2'
+	}
+}
+
+if (Tmp-String-3 != 'oo ') {
+	update reply {
+		Filter-Id += 'fail 0.3'
+	}
+}
+
+if (Tmp-String-4 != ' ba') {
+	update reply {
+		Filter-Id += 'fail 0.4'
+	}
+}
+
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 0.5'
+	}
+}
+
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 0.6'
+	}
+}
+
+if (Tmp-String-7 != 'foo bar') {
+	update reply {
+		Filter-Id += 'fail 0.7'
+	}
+}
+
+if (Tmp-String-8 != '') {
+	update reply {
+		Filter-Id += 'fail 0.8'
+	}
+}
+
+if (Tmp-String-9 != 'bar') {
+	update reply {
+		Filter-Id += 'fail 0.9'
+	}
+}
+
+update request {
+	Tmp-String-0      := ' foo bar '
+}
+
+update request {
+	Tmp-String-1 := "%{substring: &Tmp-String-0 2 3}"
+	Tmp-String-2 := "%{substring:&Tmp-String-0 -3 2}"
+	Tmp-String-3 := "%{substring:&Tmp-String-0 1 -3}"
+	Tmp-String-4 := "%{substring:&Tmp-String-0 -4 -1}"
+	Tmp-String-5 := "%{substring:&Tmp-String-0 10 5}"
+	Tmp-String-6 := "%{substring:&Tmp-String-0 4 -10}"
+	Tmp-String-7 := "%{substring:&Tmp-String-0 0 9}"
+	Tmp-String-8 := "%{substring:&Tmp-String-0 3 0}"
+	Tmp-String-9 := "%{substring:&Tmp-String-0 4 10}"
+}
+
+if (Tmp-String-1 != 'oo ') {
+	update reply {
+		Filter-Id += 'fail 1.1'
+	}
+}
+
+if (Tmp-String-2 != 'ar') {
+	update reply {
+		Filter-Id += 'fail 1.2'
+	}
+}
+
+if (Tmp-String-3 != 'foo b') {
+	update reply {
+		Filter-Id += 'fail 1.3'
+	}
+}
+
+if (Tmp-String-4 != 'bar') {
+	update reply {
+		Filter-Id += 'fail 1.4'
+	}
+}
+
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 1.5'
+	}
+}
+
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 1.6'
+	}
+}
+
+if (Tmp-String-7 != ' foo bar ') {
+	update reply {
+		Filter-Id += 'fail 1.7'
+	}
+}
+
+if (Tmp-String-8 != '') {
+	update reply {
+		Filter-Id += 'fail 1.8'
+	}
+}
+
+if (Tmp-String-9 != ' bar ') {
+	update reply {
+		Filter-Id += 'fail 1.9'
+	}
+}
+
+update request {
+	Tmp-String-1 := "%{substring:&Tmp-Integer-0 2 3}"
+	Tmp-String-2 := "%{substring:&Tmp-Integer-0 -3 2}"
+	Tmp-String-3 := "%{substring:&Tmp-Integer-0 1 -3}"
+	Tmp-String-4 := "%{substring:&Tmp-Integer-0 -4 -1}"
+	Tmp-String-5 := "%{substring:&Tmp-Integer-0 8 5}"
+	Tmp-String-6 := "%{substring:&Tmp-Integer-0 4 -10}"
+	Tmp-String-7 := "%{substring:&Tmp-Integer-0 0 8}"
+	Tmp-String-8 := "%{substring:&Tmp-Integer-0 5 0}"
+	Tmp-String-9 := "%{substring:&Tmp-Integer-0 4 10}"
+}
+
+if (Tmp-String-1 != '786') {
+	update reply {
+		Filter-Id += 'fail 2.1'
+	}
+}
+
+if (Tmp-String-2 != '51') {
+	update reply {
+		Filter-Id += 'fail 2.2'
+	}
+}
+
+if (Tmp-String-3 != '4786') {
+	update reply {
+		Filter-Id += 'fail 2.3'
+	}
+}
+
+if (Tmp-String-4 != '651') {
+	update reply {
+		Filter-Id += 'fail 2.4'
+	}
+}
+
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 2.5'
+	}
+}
+
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 2.6'
+	}
+}
+
+if (Tmp-String-7 != '54786512') {
+	update reply {
+		Filter-Id += 'fail 2.7'
+	}
+}
+
+if (Tmp-String-8 != '') {
+	update reply {
+		Filter-Id += 'fail 2.8'
+	}
+}
+
+if (Tmp-String-9 != '6512') {
+	update reply {
+		Filter-Id += 'fail 2.9'
+	}
+}
+
+update request {
+	Tmp-String-1 := "%{substring:&Tmp-IP-Address-0 2 3}"
+	Tmp-String-2 := "%{substring:&Tmp-IP-Address-0 -3 2}"
+	Tmp-String-3 := "%{substring:&Tmp-IP-Address-0 1 -3}"
+	Tmp-String-4 := "%{substring:&Tmp-IP-Address-0 -4 -1}"
+	Tmp-String-5 := "%{substring:&Tmp-IP-Address-0 15 5}"
+	Tmp-String-6 := "%{substring:&Tmp-IP-Address-0 4 -20}"
+	Tmp-String-7 := "%{substring:&Tmp-IP-Address-0 0 13}"
+	Tmp-String-8 := "%{substring:&Tmp-IP-Address-0 6 0}"
+	Tmp-String-9 := "%{substring:&Tmp-IP-Address-0 8 12}"
+}
+
+if (Tmp-String-1 != '2.1') {
+	update reply {
+		Filter-Id += 'fail 3.1'
+	}
+}
+
+if (Tmp-String-2 != '.3') {
+	update reply {
+		Filter-Id += 'fail 3.2'
+	}
+}
+
+if (Tmp-String-3 != '92.168.56') {
+	update reply {
+		Filter-Id += 'fail 3.3'
+	}
+}
+
+if (Tmp-String-4 != '6.3') {
+	update reply {
+		Filter-Id += 'fail 3.4'
+	}
+}
+
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 3.5'
+	}
+}
+
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 3.6'
+	}
+}
+
+if (Tmp-String-7 != '192.168.56.34') {
+	update reply {
+		Filter-Id += 'fail 3.7'
+	}
+}
+
+if (Tmp-String-8 != '') {
+	update reply {
+		Filter-Id += 'fail 3.8'
+	}
+}
+
+if (Tmp-String-9 != '56.34') {
+	update reply {
+		Filter-Id += 'fail 3.9'
+	}
+}
+
+update request {
+	Tmp-String-1 := "%{substring:&Tmp-Cast-Ethernet 2 3}"
+	Tmp-String-2 := "%{substring:&Tmp-Cast-Ethernet -3 2}"
+	Tmp-String-3 := "%{substring:&Tmp-Cast-Ethernet 1 -3}"
+	Tmp-String-4 := "%{substring:&Tmp-Cast-Ethernet -4 -1}"
+	Tmp-String-5 := "%{substring:&Tmp-Cast-Ethernet 20 5}"
+	Tmp-String-6 := "%{substring:&Tmp-Cast-Ethernet 4 -20}"
+	Tmp-String-7 := "%{substring:&Tmp-Cast-Ethernet 0 17}"
+	Tmp-String-8 := "%{substring:&Tmp-Cast-Ethernet 8 0}"
+	Tmp-String-9 := "%{substring:&Tmp-Cast-Ethernet 9 12}"
+}
+
+if (Tmp-String-1 != ':23') {
+	update reply {
+		Filter-Id += 'fail 4.1'
+	}
+}
+
+if (Tmp-String-2 != ':a') {
+	update reply {
+		Filter-Id += 'fail 4.2'
+	}
+}
+
+if (Tmp-String-3 != '1:23:45:67:89') {
+	update reply {
+		Filter-Id += 'fail 4.3'
+	}
+}
+
+if (Tmp-String-4 != '9:a') {
+	update reply {
+		Filter-Id += 'fail 4.4'
+	}
+}
+
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 4.5'
+	}
+}
+
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 4.6'
+	}
+}
+
+if (Tmp-String-7 != '01:23:45:67:89:ab') {
+	update reply {
+		Filter-Id += 'fail 4.7'
+	}
+}
+
+if (Tmp-String-8 != '') {
+	update reply {
+		Filter-Id += 'fail 4.8'
+	}
+}
+
+if (Tmp-String-9 != '67:89:ab') {
+	update reply {
+		Filter-Id += 'fail 4.9'
+	}
+}
+
+update request {
+	Tmp-String-1 := "%{substring:foo bar 2 3}"
+	Tmp-String-2 := "%{substring:foo bar -3 2}"
+	Tmp-String-3 := "%{substring:foo bar 1 -3}"
+	Tmp-String-4 := "%{substring:foo bar -4 -1}"
+	Tmp-String-5 := "%{substring:foo bar 8 5}"
+	Tmp-String-6 := "%{substring:foo bar 4 -10}"
+	Tmp-String-7 := "%{substring: foo bar  0 9}"
+	Tmp-String-8 := "%{substring: foo bar  5 0}"
+	Tmp-String-9 := "%{substring: foo bar  4 10}"
+}
+
+debug_request
+
+if (Tmp-String-1 != 'o b') {
+	update reply {
+		Filter-Id += 'fail 5.1'
+	}
+}
+
+if (Tmp-String-2 != 'ba') {
+	update reply {
+		Filter-Id += 'fail 5.2'
+	}
+}
+
+if (Tmp-String-3 != 'oo ') {
+	update reply {
+		Filter-Id += 'fail 5.3'
+	}
+}
+
+if (Tmp-String-4 != ' ba') {
+	update reply {
+		Filter-Id += 'fail 5.4'
+	}
+}
+
+if (Tmp-String-5 != '') {
+	update reply {
+		Filter-Id += 'fail 5.5'
+	}
+}
+
+if (Tmp-String-6 != '') {
+	update reply {
+		Filter-Id += 'fail 5.6'
+	}
+}
+
+if (Tmp-String-7 != ' foo bar ') {
+	update reply {
+		Filter-Id += 'fail 5.7'
+	}
+}
+
+if (Tmp-String-8 != '') {
+	update reply {
+		Filter-Id += 'fail 5.8'
+	}
+}
+
+if (Tmp-String-9 != ' bar ') {
+	update reply {
+		Filter-Id += 'fail 5.9'
+	}
+}
diff --git a/src/tests/keywords/switch b/src/tests/keywords/switch
new file mode 100644
index 0000000..f64aeaf
--- /dev/null
+++ b/src/tests/keywords/switch
@@ -0,0 +1,19 @@
+switch &User-Name {
+	case "bob" {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case "doug" {
+		update reply {
+			Filter-Id := "doug"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+}
diff --git a/src/tests/keywords/switch-attr-cast b/src/tests/keywords/switch-attr-cast
new file mode 100644
index 0000000..e271a18
--- /dev/null
+++ b/src/tests/keywords/switch-attr-cast
@@ -0,0 +1,34 @@
+#
+#  PRE: switch switch-attr-cmp
+#
+
+update request {
+	Service-Type := Login-User
+	Filter-Id := "Login-User"
+}
+
+switch &Service-Type {
+       case "%{expr: 1 + 2}" {
+		update reply {
+			Filter-Id := "3"
+		}
+       }
+
+       #
+       #  The Filter-Id will get printed to a string,
+       #  have the string parsed as a Service-Type attr,
+       #  and then that compared to the input Service-Type
+       #
+       case &Filter-Id {
+		update reply {
+			Filter-Id := "filter"
+		}
+       }
+
+       case {
+		update reply {
+			Filter-Id := "default"
+		}
+       }
+
+}
diff --git a/src/tests/keywords/switch-attr-cmp b/src/tests/keywords/switch-attr-cmp
new file mode 100644
index 0000000..e28ded8
--- /dev/null
+++ b/src/tests/keywords/switch-attr-cmp
@@ -0,0 +1,36 @@
+#
+#  PRE: switch
+#
+update request {
+	Tmp-String-0 := &User-Name
+}
+
+#
+#  A switch statement where we compare two attributes
+#
+switch &User-Name {
+	case &Tmp-String-0 {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case "bob" {
+		update reply {
+			Filter-Id := "failed 0"
+		}
+	}
+
+	case "doug" {
+		update reply {
+			Filter-Id := "failed 1"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "failed 2"
+		}
+	}
+
+}
diff --git a/src/tests/keywords/switch-default b/src/tests/keywords/switch-default
new file mode 100644
index 0000000..6115ed9
--- /dev/null
+++ b/src/tests/keywords/switch-default
@@ -0,0 +1,22 @@
+# PRE: switch
+#
+switch User-Name {
+	case "harry" {
+		update reply {
+			Filter-Id := "harry"
+		}
+	}
+
+	case "doug" {
+		update reply {
+			Filter-Id := "doug"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+}
\ No newline at end of file
diff --git a/src/tests/keywords/switch-escape b/src/tests/keywords/switch-escape
new file mode 100644
index 0000000..50d9fdf
--- /dev/null
+++ b/src/tests/keywords/switch-escape
@@ -0,0 +1,43 @@
+update request {
+	&Tmp-String-0 := 'foo'
+}
+
+switch "%{tolower:%{request:Tmp-String-0}}" {
+	case 'foo' {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case '' {
+		update reply {
+			Filter-Id += "fail-empty-1"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id += "fail-default-1"
+		}
+	}
+}
+
+switch "%{request:Tmp-String-0}" {
+	case 'foo' {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case '' {
+		update reply {
+			Filter-Id += "fail-empty-2"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id += "fail-default-2"
+		}
+	}
+}
diff --git a/src/tests/keywords/switch-nodefault b/src/tests/keywords/switch-nodefault
new file mode 100644
index 0000000..5fb9469
--- /dev/null
+++ b/src/tests/keywords/switch-nodefault
@@ -0,0 +1,22 @@
+#
+#  User-Name is "bob", and a switch statement
+#  with no "default" should not crash the server.
+#
+switch &User-Name {
+	case "doug" {
+		update reply {
+			Filter-Id := "doug"
+		}
+	}
+}
+
+if (&reply:Filter-Id) {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+}
+else {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/switch-value-error b/src/tests/keywords/switch-value-error
new file mode 100644
index 0000000..18db9e1
--- /dev/null
+++ b/src/tests/keywords/switch-value-error
@@ -0,0 +1,29 @@
+#
+#  PRE: switch
+#
+switch &Service-Type {
+	case "%{expr: 1 + 2}" {
+		update reply {
+			Filter-Id := "3"
+		}
+	}
+
+	case Login-User {
+		update reply {
+			Filter-Id := "Login-User"
+		}
+	}
+
+	case No-Such-Value {	# ERROR
+		update reply {
+			Filter-Id := "FAILED"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+
+}
diff --git a/src/tests/keywords/switch-value-error2 b/src/tests/keywords/switch-value-error2
new file mode 100644
index 0000000..a291e7b
--- /dev/null
+++ b/src/tests/keywords/switch-value-error2
@@ -0,0 +1,27 @@
+#
+#  PRE: switch-value-error
+#
+#  The same as "switch-value-error", but the attribute
+#  is hidden inside of an xlat expansion.  We now turn
+#  simple attribute xlats into templates.
+#
+switch "%{Service-Type}" {	# ERROR
+	case "%{expr: 1 + 2}" {
+		update reply {
+			Filter-Id := "3"
+		}
+	}
+
+	case Login-User {
+		update reply {
+			Filter-Id := "Login-User"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+
+}
diff --git a/src/tests/keywords/switch-virtual b/src/tests/keywords/switch-virtual
new file mode 100644
index 0000000..659604d
--- /dev/null
+++ b/src/tests/keywords/switch-virtual
@@ -0,0 +1,23 @@
+#
+#  PRE: update switch
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+#
+#  Virtual attribute references get mashed to xlats
+#
+switch &Packet-Type {
+	case Access-Request {
+		update reply {
+			Filter-Id := "filter"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "fail"
+		}
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/switch-xlat-error b/src/tests/keywords/switch-xlat-error
new file mode 100644
index 0000000..d03f6d3
--- /dev/null
+++ b/src/tests/keywords/switch-xlat-error
@@ -0,0 +1,17 @@
+#
+#  PRE: switch
+#
+switch &User-Name {
+	case "%{no-such-module:bob}" {	# ERROR
+		update reply {
+			Filter-Id := "fail"
+		}
+	}
+
+	case {
+		update reply {
+			Filter-Id := "default"
+		}
+	}
+
+}
diff --git a/src/tests/keywords/truncation b/src/tests/keywords/truncation
new file mode 100644
index 0000000..8217e36
--- /dev/null
+++ b/src/tests/keywords/truncation
@@ -0,0 +1,109 @@
+# cat /dev/urandom | env LC_CTYPE=C tr -cd 'a-f0-9' | head -c <n>
+
+update reply {
+       Filter-Id := "filter"
+}
+
+# 8192 - 0x (2) - '' (2) there are unlikely to be any static buffers this big outside of the conffile parser
+update request {
+	Tmp-Octets-0 := '0x\
+d8abccb7834711af1de1812be2579febe946f5d7beef6fa5c7074c0cb917e9b91e23e14b016f27610097c16c0e0fad88176e077b24198c770746159\
+05b8810d1c8b774d98889fa5c6027cde5e9c56dd4f7c48298c7713aeca5ba5dcfd506032ad05b1396f50e825b633d5a6af0dce6181b640287e03a65\
+8734df46a86341556f28455b3f377313a5a2ac8c8267b8a5de559b95f9b493a68b9e0278485f9e3914d702b2b7b90ee85ff393461f197386d09b836\
+5a8ae85ea025aea095f5d834c2ddf21e9a16b945da03c97f8a52687f19c605af9a245878b4bc5ed15b7937371ad629081159cf7de613d02c43f5cab\
+3529abbe61a6da1e55c685c2310c8eccb452f9758bf63fddfa58cdffb5cbf912f90e628310978dd1b3b7c2d3a08dd7ca6ca51081a114b013cc9d4c1\
+9f5ce0b1af81166c9402c105019a0fa9d15996c4f3d5fa35226bf88166598ff4f619322866df276d8b92fad06d120470c29217d29abb96ff861751e\
+acebbe839e28287c8cd485769d9a09e5bab524bde5776e15037d19503a2d032658e21aec7090032707ba0d662fcfa99e5e5ec183f8c63c6022bf281\
+22cf090fb80263f70c523aa0e00dd9f610c5b669754092253edd6f83b57bdd7a251514cdd99ab86cfa98b11469d1d1118aba0a149db6f0ccceb2f17\
+06bf33f657c7b8547dc284dfc10fdc1678c184901aa17f756d18df43409e1c4ead239cb78c46a9c412ccb097bba2244bb680bb249c15004d796731f\
+3890c1f94d8e0eda81487da9a65f817b5dbac4e639fce063f61a7db87d8b9d4b855120f56c3a0d57cb61ced57092506da881337280a18b2729717f5\
+133978362ca7941f9dbe9462ae5a46886c4d3c51b633278d6ad58a331c95e481cbbae866f046cb1a59ae2545fa32b12d4772244fd24bb91f7611d0c\
+beffbc5dee309c671fb5a171eacf45b20641e1cb4db306965eb43e98cb900ee805065c7adf4db3cdb97bbf8116dbb29f5ac07c7041a5f02d1a4fd1f\
+a7be6da388146d6b80ae8e152ac873cbf1f88c98cdd2e1de02df76461a1c50139f558f43ac1a91824fc48ea35976fab29d412f1ad990e528893ad4c\
+b6045b63d2a7af0657f1c348302e674ef0b39bd689b3b33dd3664c3e2386d0ea3241e70d2a2990b6243638d68033cc6040758e11f82ef783db2ae94\
+d2a8dbccd25fe2dce554837a2ca424199e4bd5442215623a77bffd603b575c847f88763fff1d6d0ff314851b1af06f99fb44d0a3115ad4389462452\
+c2331be24d486f6b5f2224cdfe44909e0a3bec47cdf6fe49fa60518e37950f986677e7f45617adcb20bc02990d3fe60de54ad2d1950bdd423e752c4\
+60f4eeaf2eeece07f3dea26db63cc0bc222a6f3228131cdb3360b9ec7e8f861c3e0bc822f9da00fef17f44ab4de7c166e5cb07d5c671f0364d4bccb\
+dc7f24868e066998bc8b3ab9052171b967162d536082b0a11c24f263c0e5f656b8349f970124af712cf098e8b08910aefcf7d42dd8a74e84ae6f9c4\
+006aa09483715b514833291c9d2e2bcdda567a16a493ac4fa17d5dff7a04b9f7f967febe7a8bdf911b1b668716be73fbf6f2416609224494dca1a18\
+1c1c7bb298671d39bdc1f664c833c9d2d4c08a65866db885929611fcd0c33139bc2959a865cbb686694896b539daa1db265ba78298cb3a09a331ef0\
+1423a7fd04b38ccdfbf1182a493c7a53c720a2dcf486249ff2b674341e77c2c0d5eb78efc07f295d562a77667457df58ea419c488680b9ce51aac01\
+4cd78984f70f29aec2a9b77fd45d38e0b07257b71f2146ccb11cd07681cbfff787b39b7ce9c42ce60513eccec2b490c68378e86bd441735b30410be\
+8710e71b2a326bd8b929abde80f25a0adb312f8ed5bb748866ddd8fb5fa81855d194afbdb1d511be453e21ab3f6481e47fa86b0697342706f85b8e8\
+84c6bf427390ef4c62532797de25004bb9d293e196ed29950e14682c68a8b6ab7c03256bc493b61eb3e44dc16726fcedb6c6776e2e9e0b3450fe6c6\
+24eef42e4806ef7c8abc367b7f1c83b7955ff6579d03362b428ca7711d228cf88402b60fd162ef4819216b9db66b4a1b0a5e0651a7901290eafa3d5\
+c698e40f73b3d66345d9e328d50ef2c767d370879890980d0d989de122ab22d7ef9979832b022e676eba4630d49434ec70025b44cb7146f9688d102\
+ceb55e6ca8ee9b9a66327da80f46367f452de7e2a84bf702b155539c7fa488d86c83faf3f150fda6d75eb476e2c31d73cea88148d9f02d178b0c098\
+5b4061830231ca405fbf41547ed9c036f53fc706b0fd1bb084e84a9e6dec81b4b4eea46c5ea26e99993ee930ccfeff4a185ffbce8a937243fa4734b\
+c24abbf465b0cd1f87686d44762140b5dfe57ae904cd8ed121f055d8a1bbf9c8a977133215f135e563b935451a7f797e72ef8f96390bc2477ad7aac\
+d2679557bac3b9a030926ff0801cc692dd641cf4f8a7bd9bdee21cdab3f7fbcf7d1d0de51101c5d816b19db49109958a8e75662ac700653112cd86c\
+10cbf45d3ea16f861de2d46714dfba8a34c1ad7ed4d5484802270187c3c7f70f7a51858479d8504e3b6267194404011b416329401ec55940f890f33\
+97d4bb3eab46990a4a03cdae9951ccd0bd42584ec88262f7d80193f09843c1fca7627b9cf708c646e84883b19fe3a8987912d04f1c0d1c779b740a7\
+fea0270374416a3987dd91d706e22e8c9698ef870d7f80d1c3042914a34736c185e542976d0145531c8eb20c3a6c5a5f747e97228ff55425fd93222\
+2d802ca36ac61555f69be4d645532579ddadb24a821f0bab1fb1f3b724ed4759b5303fe0015626ad00879e1a363d5e8b3aa0b7f3e572df3dc5f7352\
+7eb30b78e70dbe6ca81052315925d3892485168dd6f900289d1a0f9285e52988480bfda6a2c8b28cbd175b4dec735240c8f79afd5c93ed058da5551\
+8f20fb09edf4b4112c352604876f4083b68e534874d0b9ce2f977be2bcea0f9c123e119a70d269bc26ece608c39c98dbb069118148b01e403c16076\
+330b5d7929a7a7d724a7030d514ff0e38bee78e0044ffa508fc9793d7fc59075fd825e68d34e58568bffd8b20791862a8d0686763e49f1e3ed8a728\
+e33bb32a57c6374d153f93ba3cd283ce0af9a0a3b0ced4f83e3d604ff66f6584a35b51938ff4a0282c51f6f8561bd77b842ed0fd39fc43be825652f\
+f2c021f2b4d2b8c8ed2cf8eeb16f86863e59b374eda5a17e1bfc0b5a54169dd3e62b84a81bc1afd5cc3a1b193484428bcc3afb5344da990697f6787\
+5f72bc1ab04f52f75bc671b8d1239fc811d44032822abc95f8ea3465cdabdce5f83d5895d50fcbd97ad88e6b193172a4cf5f51814d9348498b1736e\
+de25f8b5afc8556d3b9573cb2ae8f51e8f0bca2f048d883592c9ab317e87864d48ca901e2aa2774360c77ba3f0a76c21f10155e32e91a2239d00e6b\
+0279bbc8977fadbea04b7b67575437fd5f6611a8889ecbde5fe45fcab8db9b62e831aadcd0ade54a94d30b6963d727979c116ef9f4a9a16a0e7a76e\
+d4f1177ad0ac7022beb12581629a7fd36c8ca5eeaa40d1a0d88cb0f701b288baae6c00a74c0b0dc3ffa6e9710bf3264684c1b9ff220710b2348cc93\
+d658d9eddae36232a0d0e06439d5dafdc7271eafbb3d16a17e36de7470c7a5ed034d735e2c216073ba6b4be7b319718d5afbd634684f5468d26afd0\
+63edfbc7fe6c8e98914eff397fcfdf44a10b84ba90b30d1a5da6823aab1792d666b32bdd0516ce3590c5dc2b49a6eabdb28cdc72dbc24e60ba0883f\
+953f0a99d29c1089b06063588b8bd965ba42e27f618d2b046fb3db93161981bbcd67fc965b0084ac25993445732b52d18cd2868e6b545214a2d501a\
+0002d2043d9a9790905dde296f16517e295dd295a97991c205d50dba331e86f06b0195e52fdd21f8e65e6b00fe7165e1a951805e5947aaee125f180\
+a2127375d8898aba1af3a3db34470e78bed99917a6bb87725788c1e2c8f35d6022d51bafdc3e69673cbdd80dc9cfde7dc1bd06e3a6437c720cb7b6c\
+2b3bc808111593d5f2a88c6e5b499c51155f4ff0267606abcbfa03dc5e4c108e7f3d33989952df2f4f1476df8fe53eaa39d2338a87b6ccc91587a67\
+bc0da2f5667248ce969b91f1521c5bfda97c8f062b62d768a9d302f4a4bd0e67646c6666a9fea93749a65d06fdcd0168fe81edac542fc287503a592\
+61591a686b418ac2602e2464f6679ef7ecf5387af45e5fdd72224695e454d6676687b03a5858afe71dda7180a59ef2e1d8c81c4a9c8375e62c43711\
+cbd0e7d437a5913bc4d7e8fbb71f68e4805ad41bd624c06e84761dbda3014c1576a866c073ca32b37007884730ac9f831b95db8ce10f0db45e009d0\
+6e1ad8c96c340c98debee0dd0ca9e6694fe7a69306c15e6a7054cfd612e070f538c6ff0c1a34b257df10087b650da852a5b663a5795a335193dfe64\
+1950ea614ae05b0c202cedabd1ebe6da561e167fe81dd9fc190740a20db38f5356e61f8bed7b3db783a6b53e48f408a8b08f9f79738438a3ed0c4bc\
+f444d5922c76ff03c943a3c72c513047aa75caf51381b5c306fdbaedcd4001a2df456c3afef7559241f553dffac2dfd9ac94570e50c571329203bf0\
+38cbdac9bc76f896635356c402f2f5c105eb4e334f7792716e8e8883352870e949623f29bb8fac428bc858ec3297166afe358e1947b0c2337309315\
+062a040129f978b036657e9323550765cc4c14aaa4c24572eb17a0aa940ba336fd8fd385fb46b5b0c067c59ee42922d2702feb7b43d2ffef11cbdf0\
+1f11c92ac18197a387f0633fd19509b19c0b8a2f63983f6c0a6286593c84d5866ae8d91139b141e8bdf3b7ae7df7d92754186e545f4b600fbe69494\
+3ae4bcef324b9a3f47ba5c835b54a010ca42f3b9cc5368278c148c9b02ea8c4c9f244fd49fa69c9a5feac5376e07f52e64be9c873afca3ebf776fe9\
+fc813bd2e58c6d0dfd951570dbff4b5e73ce547cd100ab320b6944e887d611b3425bfcdf3bfa852ff5804119a1f69e33d624eda6f9e5d1fb2811f9f\
+9f5b3224d009e09621a8fcb524f89c6fcf38f7c933aa027de2b48aa9ddbfa55f56b383f06b8feef09e4709bc4fdcbab659bab4a277a2fbebb98970e\
+44bd68a61b264c695d8ae27a676e123b5fb60c7c4cbc88f24b6554dcfebfde607500f50ec85f589eaa4213ccaa237598660a66009bc56d55455487a\
+28fa24d62e50df57feab0d1c8ec77b1085002d922c52d4a3092f8693c3b9ba9725a4d225637350812b534e93209b414b4516642eca67490199a9217\
+614322972fa2fcc5c7fc2695e9b5762d442e2c7dd8403d14228aa90df58e2ffe1a3c9922f6c5d62649664b63c017fbf3859723e7e97ea6710097683\
+6408a97de3ad7d902c7be0296fb3d476de2460602f65eb7edacc2e4f49b1652fe8948f7afb1cc9f83f3283e6013304160cd2ac7c311c492133252a6\
+5ccf45c5af9c05a47905ac8bfe55f9b912c3fca856abe7863f87392b6f6b0069e3d8412a056b1034aaac506bf2ca51760aa180c5f43a751beb06e88\
+fc6afab4c5dd4aae4a2e6f0293c15278d557c2925acba90c73eeea09ebb95f0d469aa77ae983a0e69dacd55bd8a7e78a41df5227de35af05127fa3b\
+a02f4a3ab98d75992d68a15d393387fe9ef01041569570ad6fe884764e55567311bcacfcffae76554dcfebfde607500f50ec85f589eaade607500f5\
+3ae4bcef324b9a3f47ba5c835b54a010ca42f3b9cc5368278c148c9b02ea8c4c9f244fd49fab'
+}
+
+# Actual length of octet string is 4084 bytes
+update request {
+	Tmp-Integer-0 := "%{length:Tmp-Octets-0}"
+}
+
+if (Tmp-Integer-0 != 4084) {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+# Octets are expanded to 8168 hexits
+if ("%{Tmp-Octets-0}" !~ /^0x([0-9a-f]+)$/) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+update request {
+	Tmp-String-0 := "%{1}"
+}
+
+if ("%{length:Tmp-String-0}" != 8168) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+# We can't do any more until all the xlat code uses dynamically allocated buffers
diff --git a/src/tests/keywords/unknown b/src/tests/keywords/unknown
new file mode 100644
index 0000000..eb96591
--- /dev/null
+++ b/src/tests/keywords/unknown
@@ -0,0 +1,84 @@
+#
+#  PRE: wimax
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+	Filter-Id := "filter"
+}
+
+update request {
+	FreeRADIUS-Proxied-To  := 127.0.0.2
+}
+
+#
+#  Check that a known but malformed attr is malformed
+#
+update request {
+	Attr-26.24757.84.9.5.7 = 0xab
+}
+
+if (&Attr-26.24757.84.9.5.7 != 0xab) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+#
+#  Check that an unknown attr is OK
+#
+update request {
+       Attr-26.24757.84.9.5.15 = 0xabcdef
+}
+
+if (&Attr-26.24757.84.9.5.15 != 0xabcdef) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+#
+#  Check that unknown attributes which are defined
+#  get automatically resolved to the real attribute.
+#
+if (&Vendor-11344-Attr-1 == 127.0.0.1) {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
+
+if (&Vendor-11344-Attr-1 != 127.0.0.2) {
+	update reply {
+		Filter-Id += 'Fail 4'
+	}
+}
+
+update request {
+	&Vendor-11344-Attr-1 := 127.0.0.1
+}
+
+if (&FreeRADIUS-Proxied-To == 127.0.0.2) {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+if (&FreeRADIUS-Proxied-To != 127.0.0.1) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
+
+if (&Vendor-11344-Attr-1 == 127.0.0.2) {
+	update reply {
+		Filter-Id += 'Fail 7'
+	}
+}
+
+if (&Vendor-11344-Attr-1 != 127.0.0.1) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
diff --git a/src/tests/keywords/unknown-if b/src/tests/keywords/unknown-if
new file mode 100644
index 0000000..3dccbff
--- /dev/null
+++ b/src/tests/keywords/unknown-if
@@ -0,0 +1,8 @@
+#
+#  PRE: unknown-update
+#
+if (&This-Does-Not-Exist == 1) {	# ERROR
+	update reply {
+		Filter-Id := "fail"
+	}
+}
diff --git a/src/tests/keywords/unknown-name b/src/tests/keywords/unknown-name
new file mode 100644
index 0000000..5a99ac9
--- /dev/null
+++ b/src/tests/keywords/unknown-name
@@ -0,0 +1,15 @@
+#
+#  PRE: update unknown
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+#
+#  This delayed binding should result in a parse error
+#
+if (&User-Name == &Foo-Bar-Baz) { # ERROR
+	update reply {
+		Filter-Id += "fail-2"
+	}
+}
diff --git a/src/tests/keywords/unknown-update b/src/tests/keywords/unknown-update
new file mode 100644
index 0000000..1403879
--- /dev/null
+++ b/src/tests/keywords/unknown-update
@@ -0,0 +1,6 @@
+#
+#  PRE: update unknown
+#
+update control {
+       This-Does-Not-Exist = 1		# ERROR
+}
diff --git a/src/tests/keywords/update b/src/tests/keywords/update
new file mode 100644
index 0000000..97a2557
--- /dev/null
+++ b/src/tests/keywords/update
@@ -0,0 +1,7 @@
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+       Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/update-add-ref-index b/src/tests/keywords/update-add-ref-index
new file mode 100644
index 0000000..7f5e74a
--- /dev/null
+++ b/src/tests/keywords/update-add-ref-index
@@ -0,0 +1,118 @@
+#
+#  PRE: update array
+#
+
+update request {
+       reply:Filter-Id := "filter"
+       Class := 0x01020304
+       Class += 0x05060708
+       Class += 0x090a0b0c
+}
+
+#
+#  Copy all the class attributes to Proxy-State
+#
+update request {
+       Proxy-State += &Class[*]
+}
+
+if (&Proxy-State[0] != 0x01020304) {
+	update reply {
+		Filter-Id := "fail 0a"
+	}
+}
+
+#  Must be the same as above
+if (&Proxy-State[1] != 0x05060708) {
+	update reply {
+		Filter-Id += "fail 0b"
+	}
+}
+
+if (&Proxy-State[2] != 0x090a0b0c) {
+	update reply {
+		Filter-Id += "fail 0c"
+	}
+}
+
+# must not exist
+if (&Proxy-State[3]) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+# Remove all the Proxy-State attributes
+update request {
+	Proxy-State !* ANY
+}
+
+#
+#  Copy the first instance (implicitly) of class
+#
+update request {
+	Proxy-State += &Class
+}
+
+if (&Proxy-State[0] != 0x01020304) {
+	update reply {
+		Filter-Id := "fail 2a"
+	}
+}
+
+#  Must be the same as above
+if (&Proxy-State[1]) {
+	update reply {
+		Filter-Id += "fail 2b"
+	}
+}
+
+# Remove all the Proxy-State attributes
+update request {
+	Proxy-State !* ANY
+}
+
+#
+#  Copy the first instance (explicitly) of class
+#
+update request {
+	Proxy-State += &Class[0]
+}
+
+if (&Proxy-State[0] != 0x01020304) {
+	update reply {
+		Filter-Id := "fail 3a"
+	}
+}
+
+#  Must be the same as above
+if (&Proxy-State[1]) {
+	update reply {
+		Filter-Id += "fail 3b"
+	}
+}
+
+# Remove all the Proxy-State attributes
+update request {
+	Proxy-State !* ANY
+}
+
+#
+#  Copy the second instance of class
+#
+update request {
+	Proxy-State += &Class[1]
+}
+
+if (&Proxy-State[0] != 0x05060708) {
+	update reply {
+		Filter-Id := "fail 4a"
+	}
+}
+
+#  Must be the same as above
+if (&Proxy-State[1]) {
+	update reply {
+		Filter-Id += "fail 4b"
+	}
+}
diff --git a/src/tests/keywords/update-add-ref-tag b/src/tests/keywords/update-add-ref-tag
new file mode 100644
index 0000000..39800b8
--- /dev/null
+++ b/src/tests/keywords/update-add-ref-tag
@@ -0,0 +1,118 @@
+#
+#  PRE: update array
+#
+
+update request {
+	reply:Filter-Id := "filter"
+	request:Tunnel-Server-Endpoint += '192.0.1.1'
+	request:Tunnel-Server-Endpoint += '192.0.1.2'
+	request:Tunnel-Server-Endpoint:1 += '192.0.1.1'
+	request:Tunnel-Server-Endpoint:2 += '192.0.2.1'
+	request:Tunnel-Server-Endpoint:2 += '192.0.2.2'
+	request:Tunnel-Server-Endpoint:3 += '192.0.3.1'
+}
+
+#
+#  Copy all Tunnel-Server-Endpoint attributes
+#
+update request {
+       control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint[*]
+}
+
+if ((&control:Tunnel-Server-Endpoint[0] != '192.0.1.1') || \
+    (&control:Tunnel-Server-Endpoint[1] != '192.0.1.2') || \
+    (&control:Tunnel-Server-Endpoint[2] != '192.0.1.1') || \
+    (&control:Tunnel-Server-Endpoint[3] != '192.0.2.1') || \
+    (&control:Tunnel-Server-Endpoint[4] != '192.0.2.2') || \
+    (&control:Tunnel-Server-Endpoint[5] != '192.0.3.1') || \
+    &control:Tunnel-Server-Endpoint[6]) {
+	update reply {
+		Filter-Id := "fail 0"
+	}
+}
+
+#
+#  Clear out control attributes...
+#
+update control {
+	Tunnel-Server-Endpoint !* ANY
+}
+
+#
+#  Copy all Tunnel-Server-Endpoint attributes with tag 2
+#
+update request {
+       control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:2[*]
+}
+
+if ((&control:Tunnel-Server-Endpoint[0] != '192.0.2.1') || \
+    (&control:Tunnel-Server-Endpoint[1] != '192.0.2.2') || \
+    &control:Tunnel-Server-Endpoint[2]) {
+	update reply {
+		Filter-Id := "fail 1"
+	}
+}
+
+#
+#  Clear out control attributes...
+#
+update control {
+	Tunnel-Server-Endpoint !* ANY
+}
+
+#
+#  Copy all Tunnel-Server-Endpoint attributes with no tag
+#
+update request {
+       control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:0[*]
+}
+
+if ((&control:Tunnel-Server-Endpoint[0] != '192.0.1.1') || \
+    (&control:Tunnel-Server-Endpoint[1] != '192.0.1.2') || \
+    &control:Tunnel-Server-Endpoint[2]) {
+	update reply {
+		Filter-Id := "fail 2"
+	}
+}
+
+#
+#  Clear out control attributes...
+#
+update control {
+	Tunnel-Server-Endpoint !* ANY
+}
+
+#
+#  Copy the first attribute with tag 2 (implicit)
+#
+update request {
+       control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:2
+}
+
+if ((&control:Tunnel-Server-Endpoint[0] != '192.0.2.1') || \
+    &control:Tunnel-Server-Endpoint[1]) {
+	update reply {
+		Filter-Id := "fail 3"
+	}
+}
+
+#
+#  Clear out control attributes...
+#
+update control {
+	Tunnel-Server-Endpoint !* ANY
+}
+
+#
+#  Copy the first attribute with tag 2 (explicit)
+#
+update request {
+       control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:2[0]
+}
+
+if ((&control:Tunnel-Server-Endpoint[0] != '192.0.2.1') || \
+    &control:Tunnel-Server-Endpoint[1]) {
+	update reply {
+		Filter-Id := "fail 4"
+	}
+}
diff --git a/src/tests/keywords/update-all b/src/tests/keywords/update-all
new file mode 100644
index 0000000..549a122
--- /dev/null
+++ b/src/tests/keywords/update-all
@@ -0,0 +1,9 @@
+#
+# PRE: update
+#
+#  A more generic "update" mechanism
+#
+update {
+       control:Cleartext-Password := 'hello'
+       reply:Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/update-array b/src/tests/keywords/update-array
new file mode 100644
index 0000000..c872f4e
--- /dev/null
+++ b/src/tests/keywords/update-array
@@ -0,0 +1,63 @@
+#
+#  PRE: update array
+#
+
+update request {
+       Class := 0x01020304
+       Class += 0x05060708
+       Class += 0x090a0b0c
+}
+
+
+#
+#  Use array references in the RHS
+#  of the update section
+#
+
+update request {
+       Proxy-State += &Class[0]
+       Proxy-State += &Class[1]
+       Proxy-State += &Class[2]
+}
+
+if (&Proxy-State != 0x01020304) {
+	update reply {
+		Filter-Id := "fail 0"
+	}
+}
+
+#  Must be the same as above
+if (&Proxy-State[0] != 0x01020304) {
+	update reply {
+		Filter-Id += "fail 0a"
+	}
+}
+
+if (&Proxy-State[1] != 0x05060708) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+if (&Proxy-State[2] != 0x090a0b0c) {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+# must not exist
+if (&Proxy-State[3]) {
+	update reply {
+		Filter-Id += "fail 3"
+	}
+}
+
+#
+#  The test passes only if no test above
+#  added a Filter-Id
+#
+if (!reply:Filter-Id) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/update-delete b/src/tests/keywords/update-delete
new file mode 100644
index 0000000..a5c2d5a
--- /dev/null
+++ b/src/tests/keywords/update-delete
@@ -0,0 +1,40 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tmp-String-0 := 'foobarbaz'
+	Tmp-Integer-0 := 123456789
+	Tmp-IP-Address-0 := 192.0.2.1
+}
+
+if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789) || (Tmp-IP-Address-0 != 192.0.2.1)) {
+	update {
+		reply:Filter-Id := 'fail'
+	}
+}
+
+# Remove all attributes in the control list
+update {
+	request: !* ANY
+}
+
+# All attributes should now of been removed
+if ((Tmp-String-0 && (Tmp-String-0 == 'foobarbaz')) || \
+    (Tmp-Integer-0 && (Tmp-Integer-0 == 123456789)) || \
+    (Tmp-IP-Address-0 && (Tmp-IP-Address-0 == 192.0.2.1))) {
+	update {
+		reply:Filter-Id := 'fail'
+	}
+}
+
+# This will of been removed too
+update request {
+	User-Password := 'hello'
+}
diff --git a/src/tests/keywords/update-error b/src/tests/keywords/update-error
new file mode 100644
index 0000000..92e0ed2
--- /dev/null
+++ b/src/tests/keywords/update-error
@@ -0,0 +1,9 @@
+#
+# PRE: update
+#
+#  It's an error to update lists that don't exist.
+#
+update no-such-list {	# ERROR
+       control:Cleartext-Password := 'hello'
+       reply:Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/update-error-2 b/src/tests/keywords/update-error-2
new file mode 100644
index 0000000..1fe98f0
--- /dev/null
+++ b/src/tests/keywords/update-error-2
@@ -0,0 +1,9 @@
+#
+# PRE: update-error
+#
+#  It's an error to update lists that don't exist.
+#
+update {
+       no-such-list:Cleartext-Password := 'hello'	# ERROR
+       reply:Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/update-error-3 b/src/tests/keywords/update-error-3
new file mode 100644
index 0000000..ffab73a
--- /dev/null
+++ b/src/tests/keywords/update-error-3
@@ -0,0 +1,10 @@
+#
+# PRE: update-error
+#
+#  It's an error to assign literal values which are not
+#  part of the set of enumerated values for an attribute
+#
+update {
+       Service-Type := 'hello'	# ERROR
+       reply:Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/update-exec b/src/tests/keywords/update-exec
new file mode 100644
index 0000000..b9a0f73
--- /dev/null
+++ b/src/tests/keywords/update-exec
@@ -0,0 +1,94 @@
+#
+#  PRE: update if redundant
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+	Filter-Id := "filter"
+}
+
+#
+# Exec with script output to attribute
+#
+update request {
+	Tmp-String-0 = `/bin/sh -c "echo 'foo bar baz'"`
+}
+
+if (Tmp-String-0 != "foo bar baz") {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+#
+# Exec with output to list (single attribute)
+#
+update {
+	request: = `/bin/sh -c "echo Tmp-String-0 := foo"`
+}
+
+if (Tmp-String-0 != 'foo') {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+#
+# Exec with output to list (multiple attributes)
+#
+update {
+	request: = `/bin/sh -c 'echo Tmp-String-0 := foo, Tmp-String-1 := bar'`
+}
+
+if ((Tmp-String-0 != 'foo') || (Tmp-String-1 != 'bar')) {
+	update reply {
+		Filter-Id += "fail 3"
+	}
+}
+
+#
+# Failed exec (malformed attributes) - check no attributes are added
+#
+update request {
+	Tmp-String-0 !* ANY
+	Tmp-String-1 !* ANY
+}
+
+redundant {
+	group {
+		update {
+			request: = `/bin/sh -c 'echo Tmp-String-0 := foo, Tmp-String-1 ?= bar'`
+		}
+	}
+	ok
+}
+if (Tmp-String-0 || Tmp-String-1) {
+	update reply {
+		Filter-Id += "fail 4"
+	}
+}
+
+#
+# Exec with output to list - error code
+#
+update request {
+	Tmp-String-0 !* ANY
+	Tmp-String-1 !* ANY
+}
+
+redundant {
+	group {
+		update {
+			request: = `/bin/sh -c 'echo Tmp-String-0 := foo; exit 64'`
+		}
+	}
+	ok
+}
+if (Tmp-String-0) {
+	update reply {
+		Filter-Id += "fail 5"
+	}
+}
+
diff --git a/src/tests/keywords/update-filter b/src/tests/keywords/update-filter
new file mode 100644
index 0000000..30f96be
--- /dev/null
+++ b/src/tests/keywords/update-filter
@@ -0,0 +1,75 @@
+#
+#  PRE: update
+#
+update control {
+	Tmp-Integer-0 := 5
+	Tmp-Integer-0 += 10
+	Tmp-Integer-0 += 15
+	Tmp-Integer-0 += 20
+	Tmp-String-0 := 'foo'
+	Tmp-String-0 += 'baz'
+	Tmp-String-0 += 'boink'
+}
+
+#
+#  Reset the request list
+#
+update {
+	&request: !* ANY
+	&request: += &control:[*]
+}
+
+debug_request
+
+#
+#  Only matching attributes of the specified type should remain
+#
+update request {
+	&Tmp-Integer-0 == 10
+}
+
+if (&Tmp-Integer-0[0] != 10) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+if ("%{Tmp-Integer-0[#]}" != 1) {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+if ("%{Tmp-String-0[#]}" != 3) {
+	update reply {
+		Filter-Id += "fail 3"
+	}
+}
+
+debug_request
+
+#
+#  Only matching attributes of the specified type should remain
+#
+update request {
+	&Tmp-String-0 == 'baz'
+}
+
+if (&Tmp-String-0[0] != 'baz') {
+	update reply {
+		Filter-Id += "fail 4"
+	}
+}
+
+if ("%{Tmp-String-0[#]}" != 1) {
+	update reply {
+		Filter-Id += "fail 5"
+	}
+}
+
+update {
+	control:Auth-Type := Accept
+	reply:Filter-Id := "filter"
+}
+
+debug_request
diff --git a/src/tests/keywords/update-index b/src/tests/keywords/update-index
new file mode 100644
index 0000000..390aca7
--- /dev/null
+++ b/src/tests/keywords/update-index
@@ -0,0 +1,52 @@
+#
+# PRE: update update-remove-index
+#
+#  A more generic "update" mechanism
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := "filter"
+}
+
+update {
+	control:Reply-Message += 'a'
+	control:Reply-Message += 'b'
+	control:Reply-Message += 'c'
+}
+
+if ((&control:Reply-Message[0] != 'a') || (&control:Reply-Message[1] != 'b') || (&control:Reply-Message[2] != 'c')) {
+	update {
+		reply:Filter-Id := 'Fail 0'
+	}
+}
+
+# Overwrite a specific index, and check the value here is replaced
+update {
+	&control:Reply-Message[1] := 'd'
+}
+
+if ((&control:Reply-Message[0] != 'a') || (&control:Reply-Message[1] != 'd') || (&control:Reply-Message[2] != 'c')) {
+	update {
+		reply:Filter-Id := 'Fail 1'
+	}
+}
+
+# Check isolation...
+update {
+	&control:Reply-Message[0] := &control:Reply-Message[0]
+}
+
+if ((&control:Reply-Message[0] != 'a') || (&control:Reply-Message[1] != 'd') || (&control:Reply-Message[2] != 'c')) {
+	update {
+		reply:Filter-Id := 'Fail 2'
+	}
+}
+
+# Verify we haven't acquired any extra..
+
+if ("%{control:Reply-Message[#]}" != 3) {
+	update {
+		reply:Filter-Id := 'Fail 3'
+	}
+}
+
diff --git a/src/tests/keywords/update-list-error b/src/tests/keywords/update-list-error
new file mode 100644
index 0000000..2613055
--- /dev/null
+++ b/src/tests/keywords/update-list-error
@@ -0,0 +1,19 @@
+#
+# PRE: update
+#
+#  It's an error to update lists that don't exist.
+#
+update {
+	request := reply
+	config += request
+	reply !* ANY
+}
+
+update {
+       reply += `/path/to/foo bar baz`
+}
+
+
+update {
+	request := nope		# ERROR
+}
diff --git a/src/tests/keywords/update-operator b/src/tests/keywords/update-operator
new file mode 100644
index 0000000..ccbcb16
--- /dev/null
+++ b/src/tests/keywords/update-operator
@@ -0,0 +1,85 @@
+#
+#  PRE: update
+#
+
+#
+#  Set it.
+#
+update request {
+	NAS-Port := 1000
+}
+
+#
+#  Enforce it.
+#
+update request {
+	NAS-Port == 1000
+}
+
+if (NAS-Port != 1000) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+#
+#  Enforce to new lower value.
+#
+update request {
+	NAS-Port <= 500
+}
+
+if (NAS-Port != 500) {
+	update reply {
+		Filter-Id += "fail 2 - expected 500, got %{NAS-Port}"
+	}
+}
+
+#
+#  Enforce to new higher value
+#
+update request {
+	NAS-Port >= 2000
+}
+
+if (NAS-Port != 2000) {
+	update reply {
+		Filter-Id += "fail 3 - expected 2000, got %{NAS-Port}"
+	}
+}
+
+#
+#  Enforce value which previously didn't exist.
+#
+update request {
+	Idle-Timeout >= 14400
+}
+
+if (&request:Idle-Timeout != 14400) {
+	update reply {
+		Filter-Id += "fail Idle-Timeout >= 14400"
+	}
+}
+
+# non-existent attribute
+update request {
+       Class -= 0xabcdef
+}
+
+update request {
+       Class -= &Class
+}
+
+update request {
+       NAS-Port -= &NAS-Port
+}
+
+if (!reply:Filter-Id) {
+	update control {
+		Cleartext-Password := 'hello'
+	}
+
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/update-prepend b/src/tests/keywords/update-prepend
new file mode 100644
index 0000000..4ba9335
--- /dev/null
+++ b/src/tests/keywords/update-prepend
@@ -0,0 +1,65 @@
+#
+#  PRE: update
+#
+update control {
+	&Tmp-String-0 := 'foo'
+	&Tmp-String-0 += 'baz'
+}
+
+# Reset the request list
+update {
+	&request !* ANY
+	&request += &control
+}
+
+debug_request
+
+# Prepend a single value
+update request {
+	&Tmp-String-0 ^= 'boink'
+}
+
+# The prepended value should be first followd by the other two
+if (("%{Tmp-String-0[0]}" != 'boink') || ("%{Tmp-String-0[1]}" != 'foo') || ("%{Tmp-String-0[2]}" != 'baz')) {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+if ("%{Tmp-String-0[#]}" != 3) {
+	update reply {
+		Filter-Id += "fail 1a"
+	}
+}
+
+# Add an extra element to the start of control
+update control {
+	&Tmp-String-0 ^= 'wibble'
+}
+
+# Prepend control to request
+update {
+	&request ^= &control
+}
+
+debug_request
+
+# The attributes should now be "wibble", "foo", "baz", "boink", "foo", "baz"
+if (("%{Tmp-String-0[0]}" != 'wibble') || ("%{Tmp-String-0[1]}" != 'foo') || ("%{Tmp-String-0[2]}" != 'baz') || ("%{Tmp-String-0[3]}" != 'boink') || ("%{Tmp-String-0[4]}" != 'foo') || ("%{Tmp-String-0[5]}" != 'baz')) {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+if ("%{Tmp-String-0[#]}" != 6) {
+	update reply {
+		Filter-Id += "fail 2a"
+	}
+}
+
+if (!reply:Filter-Id) {
+	update {
+		&request:User-Password := 'hello'
+		&reply:Filter-Id := 'filter'
+	}
+}
diff --git a/src/tests/keywords/update-remove-any b/src/tests/keywords/update-remove-any
new file mode 100644
index 0000000..e0ef600
--- /dev/null
+++ b/src/tests/keywords/update-remove-any
@@ -0,0 +1,50 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update {
+	request:Tmp-String-0 := 'foobarbaz'
+	request:Tmp-Integer-0 := 123456789
+	request:Tmp-IP-Address-0 := 192.0.2.1
+	request:Tmp-IP-Address-0 += 192.0.2.2
+	control:Tmp-IP-Address-0 := 192.0.2.1
+	control:Tmp-IP-Address-0 += 192.0.2.3
+}
+
+if (("%{Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{Tmp-IP-Address-0[1]}" != 192.0.2.2)) {
+	update {
+		reply:Filter-Id := 'fail 1'
+	}
+}
+
+# Remove all attributes in the control list
+update {
+	request:Tmp-IP-Address-0 !* ANY
+}
+
+# Non Tmp-IP-Address-0 address attributes should still be in the request list
+if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) {
+	update reply {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+# There should be no Tmp-IP-Address attributes in the request list
+if (Tmp-IP-Address-0 || ("%{Tmp-IP-Address-0[1]}" != '')) {
+	update {
+		reply:Filter-Id += 'fail 3'
+	}
+}
+
+# But there should still be some in the control list
+if ((control:Tmp-IP-Address-0 != 192.0.2.1) || ("%{control:Tmp-IP-Address-0[1]}" != 192.0.2.3)) {
+	update {
+		reply:Filter-Id += 'fail 4'
+	}
+}
diff --git a/src/tests/keywords/update-remove-index b/src/tests/keywords/update-remove-index
new file mode 100644
index 0000000..58df9a5
--- /dev/null
+++ b/src/tests/keywords/update-remove-index
@@ -0,0 +1,100 @@
+#
+# PRE: update update-remove-value
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update {
+	request:Tmp-String-0 := 'foobarbaz'
+	request:Tmp-Integer-0 := 123456789
+	request:Tmp-IP-Address-0 := 192.0.2.1
+	request:Tmp-IP-Address-0 += 192.0.2.2
+	request:Tmp-IP-Address-0 += 192.0.2.3
+	request:Tmp-IP-Address-0 += 192.0.2.2
+	request:Tmp-IP-Address-0 += 192.0.2.4
+}
+
+
+update request {
+	Tmp-IP-Address-0[3] -= 192.0.2.2
+}
+
+# Only the 1st, 2nd, 3rd and 5th Tmp-IP-Address attributes should still be in the list
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.1') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[2]}" != '192.0.2.3') || \
+    ("%{Tmp-IP-Address-0[3]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[4]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+# There's still a 192.0.2.2 but it's not at index 3
+update request {
+	Tmp-IP-Address-0[3] -= 192.0.2.2
+}
+
+# Should be the same as the previous result
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.1') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[2]}" != '192.0.2.3') || \
+    ("%{Tmp-IP-Address-0[3]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[4]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# Remove whatever's at index 0
+update request {
+	Tmp-IP-Address-0[0] !* ANY
+}
+
+# IP address at index 0 should be removed
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.3') || \
+    ("%{Tmp-IP-Address-0[2]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[3]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# Remove whatever's at index 3 (should be nothing)
+update request {
+	Tmp-IP-Address-0[3] !* ANY
+}
+
+# Should be the same as the previous result
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.3') || \
+    ("%{Tmp-IP-Address-0[2]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[3]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+# Remove all instances of Tmp-IP-Address
+update request {
+	Tmp-IP-Address-0 !* ANY
+}
+
+# No more IP address attributes!
+if ("%{Tmp-IP-Address-0[0]}" != '') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# Non Tmp-IP-Address-0 address attributes should still be in the request list
+if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
diff --git a/src/tests/keywords/update-remove-list b/src/tests/keywords/update-remove-list
new file mode 100644
index 0000000..22ae577
--- /dev/null
+++ b/src/tests/keywords/update-remove-list
@@ -0,0 +1,40 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tmp-String-0 := 'foobarbaz'
+	Tmp-Integer-0 := 123456789
+	Tmp-IP-Address-0 := 192.0.2.1
+}
+
+if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789) || (Tmp-IP-Address-0 != 192.0.2.1)) {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+# Remove all attributes in the control list
+update {
+	request: !* ANY
+}
+
+# All attributes should now of been removed
+if ((Tmp-String-0 && (Tmp-String-0 == 'foobarbaz')) || \
+    (Tmp-Integer-0 && (Tmp-Integer-0 == 123456789)) || \
+    (Tmp-IP-Address-0 && (Tmp-IP-Address-0 == 192.0.2.1))) {
+	update reply {
+		Filter-Id := 'fail 1'
+	}
+}
+
+# This will of been removed too
+update request {
+	User-Password := 'hello'
+}
diff --git a/src/tests/keywords/update-remove-tag b/src/tests/keywords/update-remove-tag
new file mode 100644
index 0000000..3328789
--- /dev/null
+++ b/src/tests/keywords/update-remove-tag
@@ -0,0 +1,275 @@
+#
+# PRE: update update-remove-value update-remove-index update-tag
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update {
+	request:Tunnel-Server-Endpoint += '192.0.1.1'
+	request:Tunnel-Server-Endpoint += '192.0.1.2'
+	request:Tunnel-Server-Endpoint:1 += '192.0.1.1'
+	request:Tunnel-Server-Endpoint:2 += '192.0.2.1'
+	request:Tunnel-Server-Endpoint:2 += '192.0.2.2'
+	request:Tunnel-Server-Endpoint:3 += '192.0.3.1'
+	request:Tunnel-Server-Endpoint:3 += '192.0.3.2'
+	request:Tunnel-Server-Endpoint:3 += '192.0.3.3'
+	control: += request:
+}
+
+# Check [#] is working correctly (should probably be another set of tests)
+if (("%{request:Tunnel-Server-Endpoint[#]}" != 8) || \
+    ("%{request:Tunnel-Server-Endpoint:0[#]}" != 2) || \
+    ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \
+    ("%{request:Tunnel-Server-Endpoint:2[#]}" != 2) || \
+    ("%{request:Tunnel-Server-Endpoint:3[#]}" != 3)) {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+update {
+	Tunnel-Server-Endpoint !* ANY
+}
+
+# List should now be empty
+if ("%{request:Tunnel-Server-Endpoint[#]}" != 0) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+# Reset the list
+update {
+	request: += control:
+}
+
+# Now remove all Tunnel-Server-Endpoint attributes with :2
+update {
+	Tunnel-Server-Endpoint:2 !* ANY
+}
+
+if (("%{request:Tunnel-Server-Endpoint[#]}" != 6) || \
+    ("%{request:Tunnel-Server-Endpoint:0[#]}" != 2) || \
+    ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \
+    ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:3[#]}" != 3)) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# Now remove all Tunnel-Server-Endpoint attributes with :0 (no tags)
+update {
+	Tunnel-Server-Endpoint:0 !* ANY
+}
+
+if (("%{request:Tunnel-Server-Endpoint[#]}" != 4) || \
+    ("%{request:Tunnel-Server-Endpoint:0[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \
+    ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:3[#]}" != 3)) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# Now remove all Tunnel-Server-Endpoint attributes with :3
+update {
+	Tunnel-Server-Endpoint:3 !* ANY
+}
+
+if (("%{request:Tunnel-Server-Endpoint[#]}" != 1) || \
+    ("%{request:Tunnel-Server-Endpoint:0[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \
+    ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:3[#]}" != 0)) {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+# Now remove all Tunnel-Server-Endpoint attributes with :1
+update {
+	Tunnel-Server-Endpoint:1 !* ANY
+}
+
+if (("%{request:Tunnel-Server-Endpoint[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:0[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:1[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \
+    ("%{request:Tunnel-Server-Endpoint:3[#]}" != 0)) {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# Reset the list
+update {
+	request: += control:
+}
+
+# Remove all Tunnel-Server-Endpoint attributes at :3[0] (none)
+update {
+	Tunnel-Server-Endpoint:1[3] !* ANY
+}
+
+if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+if (Tunnel-Server-Endpoint:3[1] != '192.0.3.2') {
+	update reply {
+		Filter-Id += 'fail 7'
+	}
+}
+
+if (Tunnel-Server-Endpoint:3[2] != '192.0.3.3') {
+	update reply {
+		Filter-Id += 'fail 8'
+	}
+}
+
+# Remove all Tunnel-Server-Endpoint attributes at :3[1]
+update {
+	Tunnel-Server-Endpoint:3[1] !* ANY
+}
+
+if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') {
+	update reply {
+		Filter-Id += 'fail 9'
+	}
+}
+
+if (Tunnel-Server-Endpoint:3[1] != '192.0.3.3') {
+	update reply {
+		Filter-Id += 'fail 10'
+	}
+}
+
+# Remove any Tunnel-Server-Endpoint with a value of '192.0.1.1' (should remove both tagged and untagged versions)
+update {
+	Tunnel-Server-Endpoint -= '192.0.1.1'
+}
+
+# Also checks whether presence checks for tagged attributes work correctly
+if (request:Tunnel-Server-Endpoint:1) {
+	update reply {
+		Filter-Id += 'fail 11'
+	}
+}
+
+if (request:Tunnel-Server-Endpoint:0[0] != '192.0.1.2') {
+	update reply {
+		Filter-Id += 'fail 12'
+	}
+}
+
+# Remove any Tunnel-Server-Endpoint with a value of '192.0.3.1'
+update {
+	Tunnel-Server-Endpoint:3 -= '192.0.3.2'
+}
+
+if (request:Tunnel-Server-Endpoint:3[0] != '192.0.3.1') {
+	update reply {
+		Filter-Id += 'fail 13'
+	}
+}
+
+if (request:Tunnel-Server-Endpoint:3[1] != '192.0.3.3') {
+	update reply {
+		Filter-Id += 'fail 14'
+	}
+}
+
+# Reset the list
+update {
+	request: !* ANY
+}
+update {
+	request: += control:
+}
+
+# Remove only the tagged version of '192.0.1.1'
+update {
+	request:Tunnel-Server-Endpoint:1 -= '192.0.1.1'
+}
+
+if (request:Tunnel-Server-Endpoint:0[0] != '192.0.1.1') {
+	update reply {
+		Filter-Id += 'fail 15'
+	}
+}
+
+# Reset the list
+update {
+	request: !* ANY
+}
+update {
+	request: += control:
+}
+
+# Remove only the untagged version of '192.0.1.1'
+update {
+	request:Tunnel-Server-Endpoint:0 -= '192.0.1.1'
+}
+
+if (request:Tunnel-Server-Endpoint:1[0] != '192.0.1.1') {
+	update reply {
+		Filter-Id += 'fail 16'
+	}
+}
+
+# Remove the value of Tunnel-Server-Endpoint:3 at index 1 only if it matches '192.0.3.3' (which it does)
+update {
+	Tunnel-Server-Endpoint:3[1] -= '192.0.3.2'
+}
+
+if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') {
+	update reply {
+		Filter-Id += 'fail 17'
+	}
+}
+
+if (Tunnel-Server-Endpoint:3[1] != '192.0.3.3') {
+	update reply {
+		Filter-Id += 'fail 18'
+	}
+}
+
+# Reset the list
+update {
+	request: !* ANY
+}
+update {
+	request: += control:
+}
+
+# Remove the value of Tunnel-Server-Endpoint:3 at index 1 only if it matches '192.0.3.4' (which it doesn't)
+update {
+	Tunnel-Server-Endpoint:3[1] -= '192.0.3.4'
+}
+
+if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') {
+	update reply {
+		Filter-Id += 'fail 19'
+	}
+}
+
+if (Tunnel-Server-Endpoint:3[1] != '192.0.3.2') {
+	update reply {
+		Filter-Id += 'fail 20'
+	}
+}
+
+if (Tunnel-Server-Endpoint:3[2] != '192.0.3.3') {
+	update reply {
+		Filter-Id += 'fail 21'
+	}
+}
+
diff --git a/src/tests/keywords/update-remove-value b/src/tests/keywords/update-remove-value
new file mode 100644
index 0000000..3fd1f94
--- /dev/null
+++ b/src/tests/keywords/update-remove-value
@@ -0,0 +1,116 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update {
+	request:Tmp-String-0 := 'foobarbaz'
+	request:Tmp-Integer-0 := 123456789
+	request:Tmp-IP-Address-0 := 192.0.2.1
+	request:Tmp-IP-Address-0 += 192.0.2.2
+	request:Tmp-IP-Address-0 += 192.0.2.3
+	request:Tmp-IP-Address-0 += 192.0.2.4
+	control:Tmp-IP-Address-0 := 192.0.2.1
+	control:Tmp-IP-Address-0 += 192.0.2.3
+}
+
+if (("%{Tmp-IP-Address-0[0]}" != 192.0.2.1) || \
+    ("%{Tmp-IP-Address-0[1]}" != 192.0.2.2) || \
+    ("%{Tmp-IP-Address-0[2]}" != 192.0.2.3) || \
+    ("%{Tmp-IP-Address-0[3]}" != 192.0.2.4)) {
+	update reply {
+		Filter-Id += 'fail 0'
+	}
+}
+
+# Remove Tmp-IP-Address-0 with a specific value
+update {
+	request:Tmp-IP-Address-0 -= 192.0.2.1
+}
+
+# Only the 2nd, 3rd and 4th Tmp-IP-Address attributes should still be in the list
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.3') || \
+    ("%{Tmp-IP-Address-0[2]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[3]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 1'
+	}
+}
+
+# Remove Tmp-IP-Address-0 with a specific value (somewhere in the middle)
+update {
+	request:Tmp-IP-Address-0 -= 192.0.2.3
+}
+
+# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[2]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 2'
+	}
+}
+
+# Remove Tmp-IP-Address-0 with a specific value (which doesn't exist)
+update {
+	request:Tmp-IP-Address-0 -= 192.0.2.3
+}
+
+# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[1]}" != '192.0.2.4') || \
+    ("%{Tmp-IP-Address-0[2]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 3'
+	}
+}
+
+# Remove Tmp-IP-Address-4 (which doesn't exist - more to check for SEGV/assert)
+update {
+	request:Tmp-IP-Address-4 -= 192.0.2.3
+}
+
+# Remove Tmp-IP-Address-0 with a specific value
+update {
+	request:Tmp-IP-Address-0 -= 192.0.2.4
+}
+
+# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
+if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \
+    ("%{Tmp-IP-Address-0[1]}" != '')) {
+	update reply {
+		Filter-Id += 'fail 4'
+	}
+}
+
+# Remove Tmp-IP-Address-0 with a specific value
+update {
+	request:Tmp-IP-Address-0 -= 192.0.2.2
+}
+
+# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list
+if ("%{Tmp-IP-Address-0[0]}" != '') {
+	update reply {
+		Filter-Id += 'fail 5'
+	}
+}
+
+# Non Tmp-IP-Address-0 address attributes should still be in the request list
+if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) {
+	update reply {
+		Filter-Id += 'fail 6'
+	}
+}
+
+# But there should still be some in the control list
+if (("%{control:Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{control:Tmp-IP-Address-0[1]}" != 192.0.2.3)) {
+	update {
+		Filter-Id += 'fail 7'
+	}
+}
diff --git a/src/tests/keywords/update-tag b/src/tests/keywords/update-tag
new file mode 100644
index 0000000..15afd59
--- /dev/null
+++ b/src/tests/keywords/update-tag
@@ -0,0 +1,176 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tunnel-Server-Endpoint:0 := '192.0.1.1'	# Should not be tagged
+	Tunnel-Server-Endpoint:0 += '192.0.1.2'	# Should not be tagged
+	Tunnel-Server-Endpoint:1 := '192.0.2.1'
+	Tunnel-Server-Endpoint:1 += '192.0.2.2'
+	Tunnel-Server-Endpoint:2 := '192.0.3.1'
+	Tunnel-Server-Endpoint:2 += '192.0.3.2'
+}
+
+update request {
+	Tmp-Integer-0 := "%{debug_attr:request:}"
+}
+
+
+#
+# Selecting on attributes which have no tag (0)
+#
+if (Tunnel-Server-Endpoint:0[0] != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 1'
+	}
+}
+
+if (Tunnel-Server-Endpoint:0[1] != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+#
+# Selecting on attributes with no tag specified (should match all of that type)
+#
+if (Tunnel-Server-Endpoint[0] != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 3'
+	}
+}
+
+if (Tunnel-Server-Endpoint[1] != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 4'
+	}
+}
+
+if (Tunnel-Server-Endpoint[2] != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 5'
+	}
+}
+
+#
+# Now the none xlat version
+#
+# Check that access attributes by tag works first
+if (Tunnel-Server-Endpoint:2 != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 6'
+	}
+}
+
+if (Tunnel-Server-Endpoint:2 == '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 7'
+	}
+}
+
+if (Tunnel-Server-Endpoint:1 != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 8'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if (Tunnel-Server-Endpoint:2[0] != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 9'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if (Tunnel-Server-Endpoint:2[1] != '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 10'
+	}
+}
+
+#
+# Assignment (bare)
+#
+update request {
+	Tmp-String-1 += &Tunnel-Server-Endpoint:2		# 0
+	Tmp-String-1 += &Tunnel-Server-Endpoint:2		# 1
+	Tmp-String-1 += &Tunnel-Server-Endpoint:1		# 2
+	Tmp-String-1 += &Tunnel-Server-Endpoint:2[0]		# 3
+	Tmp-String-1 += &Tunnel-Server-Endpoint:2[1]		# 4
+	Tmp-String-1 += &Tunnel-Server-Endpoint:0[0]		# 5
+	Tmp-String-1 += &Tunnel-Server-Endpoint:0[1]		# 6
+	Tmp-String-1 += &Tunnel-Server-Endpoint:0[2]		# 7 (No attribute should be added here)
+	Tmp-String-1 += &Tunnel-Server-Endpoint[0]		# 8
+	Tmp-String-1 += &Tunnel-Server-Endpoint[1]		# 9
+	Tmp-String-1 += &Tunnel-Server-Endpoint[2]		# 10
+}
+
+# Check that access attributes by tag works first
+if (Tmp-String-1[0] != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 11'
+	}
+}
+
+if (Tmp-String-1[1] == '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 12'
+	}
+}
+
+if (Tmp-String-1[2] != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 13'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if (Tmp-String-1[3] != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 14'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if (Tmp-String-1[4] != '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 15'
+	}
+}
+
+# Now check the assignment
+if (Tmp-String-1[5] != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 16'
+	}
+}
+
+if (Tmp-String-1[6] != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 17'
+	}
+}
+
+if (Tmp-String-1[7] != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 19'
+	}
+}
+
+if (Tmp-String-1[8] != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 20'
+	}
+}
+
+if (Tmp-String-1[9] != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 21'
+	}
+}
diff --git a/src/tests/keywords/update-xlat b/src/tests/keywords/update-xlat
new file mode 100644
index 0000000..59230dc
--- /dev/null
+++ b/src/tests/keywords/update-xlat
@@ -0,0 +1,61 @@
+#
+# PRE: update
+#
+#  Form attribute references with xlats
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+
+update request {
+	Tmp-String-0 := 'Tmp-String-1'
+}
+
+#
+#  Shouldn't update Tmp-String-0, should instead update Tmp-String-1
+#  ... maybe this is what Alan meant when he was talking about people
+#  doing stupid things with this feature.
+#
+update request {
+	"%{Tmp-String-0}" := 'hello'
+}
+
+if (&Tmp-String-1 != 'hello') {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+if (&Tmp-String-0 == 'hello') {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+#
+#  Try updating an attribute specified by an OID string
+#
+update {
+	Tmp-Integer-0 := 11344
+}
+update {
+	"Vendor-%{Tmp-Integer-0}-Attr-1" := 127.0.0.1
+}
+
+if (&FreeRADIUS-Proxied-To != 127.0.0.1) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+update {
+	"Attr-%{attr_num:Tmp-String-1}" := 'hello2'
+}
+
+if (&Tmp-String-1 != 'hello2') {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
diff --git a/src/tests/keywords/urlquote b/src/tests/keywords/urlquote
new file mode 100644
index 0000000..35057d8
--- /dev/null
+++ b/src/tests/keywords/urlquote
@@ -0,0 +1,50 @@
+#
+# PRE: update if
+#
+update {
+	# Some encoders replace ~ with %7E RFC3986 Section 2.4 says this should not be done.
+	request:Tmp-String-0 := '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_.~'
+	request:Tmp-String-1 := '±§!@#$%^&*()+={[}]:;"\'|\<,>?/`'
+	request:Tmp-String-2 := '™œ¥¤'
+	request:Tmp-String-3 := '%C2%B1%C2%A7%21%40%23%24%25%5E%26%2A%28%29%2B%3D%7B%5B%7D%5D%3A%3B%22%27%7C%5C%3C%2C%3E%3F%2F%60'
+
+	request:Tmp-String-4 := '%E2%84%A2%C5%93%C2%A5%C2%A4'
+	reply:Filter-ID := 'filter'
+}
+
+
+if (<string>"%{urlquote:%{request:Tmp-String-0}}" != &Tmp-String-0) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+if (<string>"%{urlquote:%{request:Tmp-String-1}}" != &Tmp-String-3) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+if (<string>"%{urlquote:%{request:Tmp-String-2}}" != &Tmp-String-4) {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
+
+if (<string>"%{urlunquote:%{request:Tmp-String-0}}" != &Tmp-String-0) {
+	update reply {
+		Filter-Id += 'Fail 4'
+	}
+}
+
+if (<string>"%{urlunquote:%{request:Tmp-String-3}}" != &Tmp-String-1) {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+if (<string>"%{urlunquote:%{request:Tmp-String-4}}" != &Tmp-String-2) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
diff --git a/src/tests/keywords/virtual b/src/tests/keywords/virtual
new file mode 100644
index 0000000..d6dbe32
--- /dev/null
+++ b/src/tests/keywords/virtual
@@ -0,0 +1,12 @@
+#
+#  PRE: update if
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+if (request:Packet-Type == Access-Request) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/virtual-exists b/src/tests/keywords/virtual-exists
new file mode 100644
index 0000000..7a8e8f3
--- /dev/null
+++ b/src/tests/keywords/virtual-exists
@@ -0,0 +1,12 @@
+#
+#  PRE: update if
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+if (&Client-Shortname) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/virtual-load-balance b/src/tests/keywords/virtual-load-balance
new file mode 100644
index 0000000..256c2ff
--- /dev/null
+++ b/src/tests/keywords/virtual-load-balance
@@ -0,0 +1,14 @@
+# PRE: update if foreach
+#
+#  Virtual Load-Balance blocks.
+#
+
+#
+#  Both of these should parse.
+#
+virtual_instantiate
+virtual_instantiate.post-auth
+
+update reply {
+	Filter-Id := 'filter'
+}
diff --git a/src/tests/keywords/virtual-rhs b/src/tests/keywords/virtual-rhs
new file mode 100644
index 0000000..0d21e7f
--- /dev/null
+++ b/src/tests/keywords/virtual-rhs
@@ -0,0 +1,16 @@
+#
+#  PRE: update if
+#
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update request {
+	Tmp-String-0 := "<UNKNOWN-CLIENT>"
+}
+
+if (&Tmp-String-0 == &Client-Shortname) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
diff --git a/src/tests/keywords/virtual_policy b/src/tests/keywords/virtual_policy
new file mode 100644
index 0000000..4ab00e2
--- /dev/null
+++ b/src/tests/keywords/virtual_policy
@@ -0,0 +1,15 @@
+# PRE: update if foreach
+#
+#  Virtual policies
+#
+
+
+#
+#  Both of these should parse.
+#
+virtual_policy
+virtual_policy.post-auth
+
+update reply {
+	Filter-Id := 'filter'
+}
diff --git a/src/tests/keywords/wimax b/src/tests/keywords/wimax
new file mode 100644
index 0000000..f149da4
--- /dev/null
+++ b/src/tests/keywords/wimax
@@ -0,0 +1,31 @@
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update request {
+	WiMAX-PFDv2-Src-Port = 6809
+}
+
+if (WiMAX-PFDv2-Src-Port != 6809) {
+	update reply {
+		Filter-Id := "fail-1"
+	}
+}
+
+#
+#  This is known, and should be renamed
+update request {
+	Attr-26.24757.84.9.5.7 = 0x01
+}
+
+if (WiMAX-PFDv2-Src-Assigned != 1) {
+	update reply {
+		Filter-Id := "fail-2"
+	}
+}
+
+if (!reply:Filter-Id) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/wimax-comboip b/src/tests/keywords/wimax-comboip
new file mode 100644
index 0000000..c4c8a3f
--- /dev/null
+++ b/src/tests/keywords/wimax-comboip
@@ -0,0 +1,19 @@
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update request {
+	WiMAX-DHCPv4-Server := 192.0.2.23
+}
+
+if (WiMAX-DHCPv4-Server != 192.0.2.23) {
+	update reply {
+		Filter-Id := "fail-1"
+	}
+}
+
+if (!reply:Filter-Id) {
+	update reply {
+		Filter-Id := "filter"
+	}
+}
\ No newline at end of file
diff --git a/src/tests/keywords/with_dots b/src/tests/keywords/with_dots
new file mode 100644
index 0000000..4fc6b06
--- /dev/null
+++ b/src/tests/keywords/with_dots
@@ -0,0 +1,19 @@
+#
+#  PRE: update
+#
+
+#
+#  Ensure that policies can have dots.
+#
+#  The main problem is that conf section references
+#  also have dots in them...
+#
+with.dots
+
+update control {
+       Cleartext-Password := 'hello'
+}
+
+update reply {
+       Filter-Id := "filter"
+}
diff --git a/src/tests/keywords/xlat-attr b/src/tests/keywords/xlat-attr
new file mode 100644
index 0000000..d19495a
--- /dev/null
+++ b/src/tests/keywords/xlat-attr
@@ -0,0 +1,62 @@
+#
+# PRE: update
+#
+#  Check attribute info xlats work correctly
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Reply-Message := 'foo'
+	FreeRADIUS-Proxied-To := 127.0.0.1
+}
+
+if ("%{attr:&FreeRADIUS-Proxied-To}" != 'FreeRADIUS-Proxied-To') {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+if ("%{attr_num:&FreeRADIUS-Proxied-To}" != 1) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+if ("%{vendor:&FreeRADIUS-Proxied-To}" != 'FreeRADIUS') {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
+
+if ("%{vendor_num:&FreeRADIUS-Proxied-To}" != 11344) {
+	update reply {
+		Filter-Id += 'Fail 4'
+	}
+}
+
+if ("%{attr:&Reply-Message}" != 'Reply-Message') {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+if ("%{attr_num:&Reply-Message}" != 18) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
+
+if ("%{vendor:&Reply-Message}" != '') {
+	update reply {
+		Filter-Id += 'Fail 7'
+	}
+}
+
+if ("%{vendor_num:&Reply-Message}" != 0) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
diff --git a/src/tests/keywords/xlat-attr-index b/src/tests/keywords/xlat-attr-index
new file mode 100644
index 0000000..c967dd6
--- /dev/null
+++ b/src/tests/keywords/xlat-attr-index
@@ -0,0 +1,53 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tmp-IP-Address-0 := 192.0.2.1
+	Tmp-IP-Address-0 += 192.0.2.2
+}
+
+if ("%{Tmp-IP-Address-0[#]}" != 2) {
+	update {
+		reply:Filter-Id += 'fail 0'
+	}
+}
+
+if (("%{Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{Tmp-IP-Address-0[1]}" != 192.0.2.2)) {
+	update {
+		reply:Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{Tmp-IP-Address-0[*]}" != '192.0.2.1,192.0.2.2') {
+	update {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+# Try calling these xlats in mapping too, they may get optimised to VPTs which is a
+# different code path.
+update request {
+	Tmp-IP-Address-1 += "%{Tmp-IP-Address-0[1]}"
+	Tmp-IP-Address-1 += "%{Tmp-IP-Address-0[0]}"
+	Tmp-String-0 = "%{Tmp-IP-Address-0[*]}"
+	Tmp-Integer-0 = "%{Tmp-IP-Address-0[#]}"
+}
+
+if (Tmp-String-0 != '192.0.2.1,192.0.2.2') {
+	update {
+		reply:Filter-Id += 'fail 3'
+	}
+}
+
+if (Tmp-Integer-0 != 2) {
+	update {
+		reply:Filter-Id += 'fail 4'
+	}
+}
diff --git a/src/tests/keywords/xlat-attr-tag b/src/tests/keywords/xlat-attr-tag
new file mode 100644
index 0000000..c0bd8b6
--- /dev/null
+++ b/src/tests/keywords/xlat-attr-tag
@@ -0,0 +1,225 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update request {
+	Tunnel-Server-Endpoint   := '192.0.1.1'	# Should not be tagged
+	Tunnel-Server-Endpoint:0 += '192.0.1.2'	# Should not be tagged
+	Tunnel-Server-Endpoint:1 := '192.0.2.1'
+	Tunnel-Server-Endpoint:1 += '192.0.2.2'
+	Tunnel-Server-Endpoint:2 := '192.0.3.1'
+	Tunnel-Server-Endpoint:2 += '192.0.3.2'
+}
+
+update request {
+	Tmp-Integer-0 := "%{debug_attr:request:}"
+}
+
+# Check the tag printing xlat works correctly
+if ("%{tag:Tunnel-Server-Endpoint[0]}" != '') {
+	update {
+		reply:Filter-Id += 'fail 0a'
+	}
+}
+
+if ("%{tag:Tunnel-Server-Endpoint[1]}" != '') {
+	update {
+		reply:Filter-Id += 'fail 0b'
+	}
+}
+
+
+if ("%{tag:Tunnel-Server-Endpoint[2]}" != '1') {
+	update {
+		reply:Filter-Id += 'fail 0c'
+	}
+}
+
+if ("%{tag:Tunnel-Server-Endpoint[5]}" != '2') {
+	update {
+		reply:Filter-Id += 'fail 0d'
+	}
+}
+
+if ("%{tag:Tunnel-Server-Endpoint[6]}" != '') {
+	update {
+		reply:Filter-Id += 'fail 0e'
+	}
+}
+
+if ("%{tag:control:Cleartext-Password}" != '') {
+	update {
+		reply:Filter-Id += 'fail 0f'
+	}
+}
+
+# Check that access attributes by tag works first
+if ("%{Tunnel-Server-Endpoint:2}" != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 1'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint:2}" == '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint:1}" != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 3'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if ("%{Tunnel-Server-Endpoint:2[0]}" != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 4'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if ("%{Tunnel-Server-Endpoint:2[1]}" != '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 5'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint:0[2]}" != '') {
+	update {
+		reply:Filter-Id += 'fail 6'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint:0[0]}" != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 7'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint:0[1]}" != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 8'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint:0[2]}" != '') {
+	update {
+		reply:Filter-Id += 'fail 9'
+	}
+}
+
+#
+# Selecting on attributes with no tag specified (should match all of that type)
+#
+if ("%{Tunnel-Server-Endpoint[0]}" != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 10'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint[1]}" != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 11'
+	}
+}
+
+if ("%{Tunnel-Server-Endpoint[2]}" != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 12'
+	}
+}
+
+#
+# Assignment (xlat)
+#
+update request {
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:2}"		#0
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:2}"		#1
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:1}"		#2
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:2[0]}"	#3
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:2[1]}"	#4
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:0[0]}"	#5
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:0[1]}"	#6
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint:0[2]}"	#7
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint[0]}"		#8
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint[1]}"		#9
+	Tmp-String-0 += "%{Tunnel-Server-Endpoint[2]}"		#10
+}
+
+# Check that access attributes by tag works first
+if (Tmp-String-0[0] != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 13'
+	}
+}
+
+if (Tmp-String-0[1] == '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 14'
+	}
+}
+
+if (Tmp-String-0[2] != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 15'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if (Tmp-String-0[3] != '192.0.3.1') {
+	update {
+		reply:Filter-Id += 'fail 16'
+	}
+}
+
+# Get the first instance of Tunnel-Server-Endpoint:2
+if (Tmp-String-0[4] != '192.0.3.2') {
+	update {
+		reply:Filter-Id += 'fail 17'
+	}
+}
+
+# Now check the assignment
+if (Tmp-String-0[5] != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 18'
+	}
+}
+
+if (Tmp-String-0[6] != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 19'
+	}
+}
+
+if (Tmp-String-0[7] != '') {
+	update {
+		reply:Filter-Id += 'fail 20'
+	}
+}
+
+if (Tmp-String-0[8] != '192.0.1.1') {
+	update {
+		reply:Filter-Id += 'fail 21'
+	}
+}
+
+if (Tmp-String-0[9] != '192.0.1.2') {
+	update {
+		reply:Filter-Id += 'fail 22'
+	}
+}
+
+if (Tmp-String-0[10] != '192.0.2.1') {
+	update {
+		reply:Filter-Id += 'fail 23'
+	}
+}
diff --git a/src/tests/keywords/xlat-concat b/src/tests/keywords/xlat-concat
new file mode 100644
index 0000000..e0c55a9
--- /dev/null
+++ b/src/tests/keywords/xlat-concat
@@ -0,0 +1,40 @@
+#
+# PRE: xlat-list
+#
+#  concat xlat
+#
+
+update control {
+    control !* ANY
+}
+
+update control {
+	Tmp-IP-Address-0 := 192.0.2.1
+	Tmp-IP-Address-0 += 192.0.2.2
+}
+
+update request {
+	Tmp-String-0 := "%{concat:control:[*] ;}"
+}
+
+if (Tmp-String-0 != '192.0.2.1;192.0.2.2') {
+	update {
+		reply:Filter-Id += 'fail 1'
+	}
+}
+
+update request {
+	Tmp-String-0 := "%{concat:control:[*] X}"
+}
+
+if (Tmp-String-0 != '192.0.2.1X192.0.2.2') {
+	update {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+# Boilerplate junk
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
diff --git a/src/tests/keywords/xlat-error b/src/tests/keywords/xlat-error
new file mode 100644
index 0000000..b6a2587
--- /dev/null
+++ b/src/tests/keywords/xlat-error
@@ -0,0 +1,12 @@
+#
+#  PRE: if xlat-attr-tag
+#
+
+#
+#  missing a closing } for the expansion in the string.
+#
+if ("%{expr:1 + 2" == 3) { # ERROR
+	update reply {
+		Filter-Id := "fail"
+	}
+}
diff --git a/src/tests/keywords/xlat-explode b/src/tests/keywords/xlat-explode
new file mode 100644
index 0000000..ea727d9
--- /dev/null
+++ b/src/tests/keywords/xlat-explode
@@ -0,0 +1,91 @@
+#
+# PRE: update
+#
+#  Check explode works correctly
+#
+update {
+	request:Class := '1=1|my_attr=2|my_attr=hello|'
+	request:Calling-Station-ID += '|'
+	control:User-Name += '|hello|goodbye'
+	control:User-Name += '|morning|night|1|'
+	control:Reply-Message := 'Can\'t touch this'
+	reply:Filter-Id = 'filter'
+}
+
+if ("%{explode:&Class |}" != 3) {
+	update reply {
+		Filter-Id += 'Fail 0'
+	}
+}
+
+if ("%{Class[#]}" != 3) {
+	update reply {
+		Filter-Id += 'Fail 1'
+	}
+}
+
+if ((&Class[0] != '1=1') || (&Class[1] != 'my_attr=2') || (&Class[2] != 'my_attr=hello')) {
+	update reply {
+		Filter-Id += 'Fail 2'
+	}
+}
+
+if (&Class[3]) {
+	update reply {
+		Filter-Id += 'Fail 3'
+	}
+}
+
+if ("%{explode:&control:Calling-Station-Id |}" != 0) {
+	update reply {
+		filter-Id += 'Fail 4'
+	}
+}
+
+if ("%{explode:&control:User-Name[*] |}" != 5) {
+	update reply {
+		Filter-Id += 'Fail 5'
+	}
+}
+
+if ("%{control:User-Name[#]}" != 5) {
+	update reply {
+		Filter-Id += 'Fail 6'
+	}
+}
+
+if ((&control:User-Name[0] != 'hello') || \
+    (&control:User-Name[1] != 'goodbye') || \
+    (&control:User-Name[2] != 'morning') || \
+    (&control:User-Name[3] != 'night') || \
+    (&control:User-Name[4] != '1')) {
+	update reply {
+		Filter-Id += 'Fail 7'
+	}
+}
+
+if (&control:User-Name[5]) {
+	update reply {
+		Filter-Id += 'Fail 8'
+	}
+}
+
+if ("%{explode:&control:Reply-Message |}" != 0) {
+	update reply {
+		Filter-Id += 'Fail 9'
+	}
+}
+
+if ("%{control:Reply-Message[#]}" != 1) {
+	update reply {
+		Filter-Id += 'Fail 10'
+	}
+}
+
+if (&control:Reply-Message != 'Can\'t touch this') {
+	update reply {
+		Filter-Id += 'Fail 11'
+	}
+}
+
+debug_all
diff --git a/src/tests/keywords/xlat-list b/src/tests/keywords/xlat-list
new file mode 100644
index 0000000..fcd9e84
--- /dev/null
+++ b/src/tests/keywords/xlat-list
@@ -0,0 +1,64 @@
+#
+# PRE: update
+#
+update control {
+    control !* ANY
+}
+
+update control {
+	Tmp-IP-Address-0 := 192.0.2.1
+	Tmp-IP-Address-0 += 192.0.2.2
+}
+
+if ("%{control:[#]}" != 2) {
+	update {
+		reply:Filter-Id += 'fail 0'
+	}
+}
+
+debug_control
+
+if (("%{control:[0]}" != 192.0.2.1) || ("%{control:[1]}" != 192.0.2.2)) {
+	update {
+		reply:Filter-Id += 'fail 1'
+	}
+}
+
+if (("%{control:[n]}" != 192.0.2.2)) {
+    update {
+        reply:Filter-Id += 'fail 1a'
+    }
+}
+
+if ("%{control:[*]}" != '192.0.2.1,192.0.2.2') {
+	update {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+# Try calling these xlats in mapping too, they may get optimised to VPTs which is a
+# different code path.
+update request {
+	Tmp-IP-Address-1 += "%{control:[1]}"
+	Tmp-IP-Address-1 += "%{control:[0]}"
+	Tmp-String-0 = "%{control:[*]}"
+	Tmp-Integer-0 = "%{control:[#]}"
+}
+
+if (Tmp-String-0 != '192.0.2.1,192.0.2.2') {
+	update {
+		reply:Filter-Id += 'fail 3'
+	}
+}
+
+if (Tmp-Integer-0 != 2) {
+	update {
+		reply:Filter-Id += 'fail 4'
+	}
+}
+
+# Boilerplate junk
+update {
+	control:Cleartext-Password := 'hello'
+    reply:Filter-Id := 'filter'
+}
diff --git a/src/tests/keywords/xlat-octets b/src/tests/keywords/xlat-octets
new file mode 100644
index 0000000..ea9543c
--- /dev/null
+++ b/src/tests/keywords/xlat-octets
@@ -0,0 +1,36 @@
+#
+# PRE: update if
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+#
+#  Regression test for 0x prefix. xlat expanded
+#  octet strings must NOT have a 0x prefix added
+#
+update request {
+	Tmp-Octets-0 := 0x0001020304050607
+	Tmp-Octets-0 += 0x0706050403020100
+}
+
+if ("%{Tmp-Octets-0}" != '0x0001020304050607') {
+	update {
+		reply:Filter-Id := 'fail 1'
+	}
+}
+
+if ("%{Tmp-Octets-0[0]}" != '0x0001020304050607') {
+	update {
+		reply:Filter-Id += 'fail 2'
+	}
+}
+
+if ("%{Tmp-Octets-0[*]}" != '0x0001020304050607,0x0706050403020100') {
+	update {
+		reply:Filter-Id += 'fail 3'
+	}
+}
diff --git a/src/tests/keywords/xlat-virtual-attr b/src/tests/keywords/xlat-virtual-attr
new file mode 100644
index 0000000..e476993
--- /dev/null
+++ b/src/tests/keywords/xlat-virtual-attr
@@ -0,0 +1,131 @@
+#
+#  PRE: if
+#
+
+update reply {
+	Filter-Id := "filter"
+}
+
+if ("%{Client-Shortname}" != '<UNKNOWN-CLIENT>') {
+	update reply {
+		Filter-Id += "fail 0"
+	}
+}
+
+if ("%{Request-Processing-Stage}" != 'authorize') {
+	update reply {
+		Filter-Id += "fail 1"
+	}
+}
+
+if ("%{Virtual-Server}" != 'default') {
+	update reply {
+		Filter-Id += "fail 2"
+	}
+}
+
+if ("%{Module-Return-Code}" != '') {
+	update reply {
+		Filter-Id += "fail 3a"
+	}
+}
+
+ok
+if ("%{Module-Return-Code}" != 'ok') {
+	update reply {
+		Filter-Id += "fail 3b"
+	}
+}
+
+if ("%{Packet-Type}" != 'Access-Request') {
+	update reply {
+		Filter-Id += "fail 4"
+	}
+}
+
+# Response hasn't been set yet
+if ("%{Response-Packet-Type}" != '') {
+	update reply {
+		Filter-Id += "fail 5"
+	}
+}
+
+if ("%{Packet-Authentication-Vector}" != '0x00000000000000000000000000000000') {
+	update reply {
+		Filter-Id += "fail 6"
+	}
+}
+
+if ("%{Client-IP-Address}" != 127.0.0.1) {
+	update reply {
+		Filter-Id += "fail 7a"
+	}
+}
+
+if ("%{Packet-Src-IP-Address}" != 127.0.0.1) {
+	update reply {
+		Filter-Id += "fail 7b"
+	}
+}
+
+if ("%{Packet-Dst-IP-Address}" != 127.0.0.1) {
+	update reply {
+		Filter-Id += "fail 8"
+	}
+}
+
+# Can't have both...
+if ("%{Packet-Src-IPv6-Address}" != '') {
+	update reply {
+		Filter-Id += "fail 9"
+	}
+}
+
+if ("%{Packet-Dst-IPv6-Address}" != '') {
+	update reply {
+		Filter-Id += "fail 10"
+	}
+}
+
+if ("%{Packet-Src-Port}" != '18120') {
+	update reply {
+		Filter-Id += "fail 11"
+	}
+}
+
+if ("%{Packet-Dst-Port}" != '1812') {
+	update reply {
+		Filter-Id += "fail 12"
+	}
+}
+
+
+# We should allow the user to overload virtual attributes
+update request {
+	Client-Shortname := 'my_test_client'
+}
+
+if ("%{Client-Shortname}" != 'my_test_client') {
+	update reply {
+		Filter-Id += "fail 13"
+	}
+}
+
+# Operations on virtual attributes should be the same as on real ones
+if ("%{Virtual-Server[0]}" != 'default') {
+	update reply {
+		Filter-Id += "fail 14"
+	}
+}
+
+if ("%{Virtual-Server[*]}" != 'default') {
+	update reply {
+		Filter-Id += "fail 15"
+	}
+}
+
+if ("%{Virtual-Server[#]}" != 1) {
+	update reply {
+		Filter-Id += "fail 16"
+	}
+}