Adding upstream version 3.2.3+dfsg.upstream/3.2.3+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

61 files changed, 9731 insertions, 0 deletions

diff --git a/src/include/.gitignore b/src/include/.gitignore
new file mode 100644
index 0000000..c140a2c
--- /dev/null
+++ b/src/include/.gitignore
@@ -0,0 +1,21 @@
+# Autoconf headers
+autoconf.h
+autoconf.sed
+
+# Dynamically generated headers
+attributes.h
+rfc*.h
+missing.h
+tls.h
+features.h
+radpaths.h
+vqp.h
+freeradius.h
+
+# Headers from v3.1.x
+freeradius.snmp.h
+util
+
+# Build scripts
+build-radpaths-h
+stamp-h
diff --git a/src/include/all.mk b/src/include/all.mk
new file mode 100644
index 0000000..e666f14
--- /dev/null
+++ b/src/include/all.mk
@@ -0,0 +1,168 @@
+#
+# Version:	$Id$
+#
+
+#
+#  Build dynamic headers by substituting various values from autoconf.h, these
+#  get installed with the library files, so external programs can tell what
+#  the server library was built with.
+#
+#  The RFC headers are dynamic, too.
+#
+#  The rest of the headers are static.
+#
+
+HEADERS_DY = attributes.h features.h missing.h radpaths.h tls.h
+
+HEADERS	= \
+	autoconf.h \
+	build.h \
+	conf.h \
+	conffile.h \
+	detail.h \
+	event.h \
+	hash.h \
+	heap.h \
+	libradius.h \
+	md4.h \
+	md5.h \
+	modcall.h \
+	modules.h \
+	packet.h \
+	rad_assert.h \
+	radius.h \
+	radiusd.h \
+	radutmp.h \
+	realms.h \
+	regex.h \
+	sha1.h \
+	stats.h \
+	sysutmp.h \
+	tcp.h \
+	threads.h \
+	token.h \
+	udpfromto.h \
+	base64.h \
+	map.h \
+	$(HEADERS_DY)
+
+#
+#  Solaris awk doesn't recognise [[:blank:]] hence [\t ]
+#
+src/include/autoconf.sed: src/include/autoconf.h
+	@grep ^#define $< | sed 's,/\*\*/,1,;' | awk '{print "'\
+	's,#[\\t ]*ifdef[\\t ]*" $$2 "$$,#if "$$3 ",g;'\
+	's,#[\\t ]*ifndef[\\t ]*" $$2 "$$,#if !"$$3 ",g;'\
+	's,defined(" $$2 ")," $$3 ",g;"}' > $@
+	@grep -o '#undef [^ ]*' $< | sed 's,/#undef /,,;' | awk '{print "'\
+	's,#[\\t ]*ifdef[\\t ]*" $$2 "$$,#if 0,g;'\
+	's,#[\\t ]*ifndef[\\t ]*" $$2 "$$,#if 1,g;'\
+	's,defined(" $$2 "),0,g;"}' >> $@
+
+
+######################################################################
+#
+#  Create the header files from the dictionaries.
+#
+
+RFC_DICTS := $(filter-out %~,$(wildcard share/dictionary.rfc*)) share/dictionary.vqp share/dictionary.freeradius
+HEADERS_RFC := $(patsubst share/dictionary.%,src/include/%.h,$(RFC_DICTS))
+HEADERS	+= $(notdir ${HEADERS_RFC})
+
+.PRECIOUS: $(HEADERS_RFC)
+
+src/include/attributes.h: share/dictionary.freeradius.internal
+	@$(ECHO) HEADER $@
+	@echo "/* AUTO-GENERATED HEADER FILE.  DO NOT EDIT. */" > $@
+	@grep ^ATTRIBUTE $<  | awk '{print "PW_"$$2 " " $$3 }' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@
+	@echo " " >> $@
+	@grep -- 'Auth-Type' $< | grep ^VALUE | awk '{print "PW_"$$2 "_" $$3 " " $$4 }' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@
+
+src/include/%.h: share/dictionary.% share/dictionary.vqp
+	@$(ECHO) HEADER $@
+	@echo "/* AUTO-GENERATED HEADER FILE.  DO NOT EDIT. */" > $@
+	@grep ^ATTRIBUTE $<  | awk '{print "PW_"$$2 " " $$3 } ' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@
+
+#
+#  Build features.h by copying over WITH_* and RADIUSD_VERSION_*
+#  preprocessor macros from autoconf.h
+#  This means we don't need to include autoconf.h in installed headers.
+#
+#  We use simple patterns here to work with the lowest common
+#  denominator's grep (Solaris).
+#
+src/include/features.h: src/include/features-h src/include/autoconf.h
+	@$(ECHO) HEADER $@
+	@cp $< $@
+	@grep "^#define[ ]*WITH_" src/include/autoconf.h >> $@
+	@grep "^#define[ ]*RADIUSD_VERSION" src/include/autoconf.h >> $@
+
+#
+#  Use the SED script we built earlier to make permanent substitutions
+#  of definitions in missing-h to build missing.h
+#
+src/include/missing.h: src/include/missing-h src/include/autoconf.sed
+	@$(ECHO) HEADER $@
+	@sed -f src/include/autoconf.sed < $< > $@
+
+src/include/tls.h: src/include/tls-h src/include/autoconf.sed
+	@$(ECHO) HEADER $@
+	@sed -f src/include/autoconf.sed < $< > $@
+
+src/include/radpaths.h: src/include/build-radpaths-h
+	@$(ECHO) HEADER $@
+	@cd src/include && /bin/sh build-radpaths-h
+
+#
+#  Create the soft link for the fake include file path.
+#
+src/freeradius-devel:
+	@[ -e $@ ] || ln -s include $@
+
+#
+#  Ensure we set up the build environment
+#
+BOOTSTRAP_BUILD += src/freeradius-devel $(addprefix src/include/,$(HEADERS_DY)) $(HEADERS_RFC)
+scan: $(BOOTSTRAP_BUILD)
+
+######################################################################
+#
+#  Installation
+#
+# define the installation directory
+SRC_INCLUDE_DIR := ${R}${includedir}/freeradius
+
+$(SRC_INCLUDE_DIR):
+	@$(INSTALL) -d -m 755 ${SRC_INCLUDE_DIR}
+
+#
+#  install the headers by re-writing the local files
+#
+#  install-sh function for creating directories gets confused
+#  if there's a trailing slash, tries to create a directory
+#  it already created, and fails...
+#
+${SRC_INCLUDE_DIR}/%.h: src/include/%.h | $(SRC_INCLUDE_DIR)
+	@echo INSTALL $(notdir $<)
+	@$(INSTALL) -d -m 755 `echo $(dir $@) | sed 's/\/$$//'`
+# Expression must deal with indentation after the hash and copy it to the substitution string.
+# Hash not anchored to allow substitution in function documentation.
+	@sed -e 's/#\([\\t ]*\)include <freeradius-devel\/\([^>]*\)>/#\1include <freeradius\/\2>/g' < $< > $@
+	@chmod 644 $@
+
+install.src.include: $(addprefix ${SRC_INCLUDE_DIR}/,${HEADERS})
+install: install.src.include
+
+#
+#  Cleaning
+#
+.PHONY: clean.src.include distclean.src.include
+clean.src.include:
+	@rm -f $(addprefix src/include/,$(HEADERS_DY)) $(HEADERS_RFC)
+
+clean: clean.src.include
+
+distclean.src.include: clean.src.include
+	@rm -f autoconf.sed
+
+distclean: distclean.src.include
diff --git a/src/include/atomic_queue.h b/src/include/atomic_queue.h
new file mode 100644
index 0000000..9fbcfe7
--- /dev/null
+++ b/src/include/atomic_queue.h
@@ -0,0 +1,79 @@
+#pragma once
+/*
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ *
+ * @file atomic_queue.h
+ * @brief Thread-safe queues.
+ *
+ * @copyright 2016 Alan DeKok (aland@freeradius.org)
+ */
+RCSIDH(atomic_queue_h, "$Id$")
+
+#ifdef HAVE_WDOCUMENTATION
+DIAG_OFF(documentation)
+#endif
+#include <talloc.h>
+#ifdef HAVE_WDOCUMENTATION
+DIAG_ON(documentation)
+#endif
+#include <stdbool.h>
+
+#ifdef HAVE_STDATOMIC_H
+#  include <stdatomic.h>
+#else
+#  include <freeradius-devel/stdatomic.h>
+#endif
+
+/*
+ *	Some macros to make our life easier.
+ */
+#define atomic_int64_t _Atomic(int64_t)
+#define atomic_uint32_t _Atomic(uint32_t)
+#define atomic_uint64_t _Atomic(uint64_t)
+
+#define cas_incr(_store, _var)    atomic_compare_exchange_strong_explicit(&_store, &_var, _var + 1, memory_order_release, memory_order_relaxed)
+#define cas_decr(_store, _var)    atomic_compare_exchange_strong_explicit(&_store, &_var, _var - 1, memory_order_release, memory_order_relaxed)
+#define load(_var)           atomic_load_explicit(&_var, memory_order_relaxed)
+#define aquire(_var)         atomic_load_explicit(&_var, memory_order_acquire)
+#define store(_store, _var)  atomic_store_explicit(&_store, _var, memory_order_release);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct fr_atomic_queue_s fr_atomic_queue_t;
+
+fr_atomic_queue_t	*fr_atomic_queue_alloc(TALLOC_CTX *ctx, size_t size);
+void			fr_atomic_queue_free(fr_atomic_queue_t **aq);
+bool			fr_atomic_queue_push(fr_atomic_queue_t *aq, void *data);
+bool			fr_atomic_queue_pop(fr_atomic_queue_t *aq, void **p_data);
+size_t			fr_atomic_queue_size(fr_atomic_queue_t *aq);
+
+#ifdef WITH_VERIFY_PTR
+void			fr_atomic_queue_verify(fr_atomic_queue_t *aq);
+#endif
+
+#ifndef NDEBUG
+void			fr_atomic_queue_debug(fr_atomic_queue_t *aq, FILE *fp);
+#endif
+
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
new file mode 100644
index 0000000..4774482
--- /dev/null
+++ b/src/include/autoconf.h.in
@@ -0,0 +1,748 @@
+/* src/include/autoconf.h.in.  Generated from configure.ac by autoheader.  */
+
+/* Define if building universal (internal helper macro) */
+#undef AC_APPLE_UNIVERSAL_BUILD
+
+/* BSD-Style get*byaddr_r */
+#undef BSDSTYLE
+
+/* style of ctime_r function */
+#undef CTIMERSTYLE
+
+/* Define to 1 to have OpenSSL version check enabled */
+#undef ENABLE_OPENSSL_VERSION_CHECK
+
+/* Define to ensure each build is the same */
+#undef ENABLE_REPRODUCIBLE_BUILDS
+
+/* Define if your processor stores words with the most significant byte first
+   */
+#undef FR_BIG_ENDIAN
+
+/* Define if your processor stores words with the least significant byte first
+   */
+#undef FR_LITTLE_ENDIAN
+
+/* style of gethostbyaddr_r functions */
+#undef GETHOSTBYADDRRSTYLE
+
+/* style of gethostbyname_r functions */
+#undef GETHOSTBYNAMERSTYLE
+
+/* GNU-Style get*byaddr_r */
+#undef GNUSTYLE
+
+/* Define to 1 if you have the <arpa/inet.h> header file. */
+#undef HAVE_ARPA_INET_H
+
+/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
+#undef HAVE_ASN1_STRING_GET0_DATA
+
+/* Define if your compiler supports the __bounded__ attribute (usually OpenBSD
+   gcc). */
+#undef HAVE_ATTRIBUTE_BOUNDED
+
+/* Define to 1 if you have the `bindat' function. */
+#undef HAVE_BINDAT
+
+/* Define if we have a binary safe regular expression library */
+#undef HAVE_BINSAFE_REGEX
+
+/* Define if the compiler supports __builtin_bswap64 */
+#undef HAVE_BUILTIN_BSWAP_64
+
+/* Define if the compiler supports __builtin_choose_expr */
+#undef HAVE_BUILTIN_CHOOSE_EXPR
+
+/* Define if the compiler supports __builtin_types_compatible_p */
+#undef HAVE_BUILTIN_TYPES_COMPATIBLE_P
+
+/* Define to 1 if you have the <sys/capability.h> header file. */
+#undef HAVE_CAPABILITY_H
+
+/* Define to 1 if you have the `clock_gettime' function. */
+#undef HAVE_CLOCK_GETTIME
+
+/* Define to 1 if you have the `closefrom' function. */
+#undef HAVE_CLOSEFROM
+
+/* Define to 1 if you have the `collectdclient' library (-lcollectdclient). */
+#undef HAVE_COLLECTDC_H
+
+/* Define to 1 if you have the `CONF_modules_load_file' function. */
+#undef HAVE_CONF_MODULES_LOAD_FILE
+
+/* Do we have the crypt function */
+#undef HAVE_CRYPT
+
+/* Define to 1 if you have the `CRYPTO_set_id_callback' function. */
+#undef HAVE_CRYPTO_SET_ID_CALLBACK
+
+/* Define to 1 if you have the `CRYPTO_set_locking_callback' function. */
+#undef HAVE_CRYPTO_SET_LOCKING_CALLBACK
+
+/* Define to 1 if you have the <crypt.h> header file. */
+#undef HAVE_CRYPT_H
+
+/* Do we have the crypt_r function */
+#undef HAVE_CRYPT_R
+
+/* Define to 1 if you have the `ctime_r' function. */
+#undef HAVE_CTIME_R
+
+/* Define to 1 if you have the declaration of `gethostbyaddr_r', and to 0 if
+   you don't. */
+#undef HAVE_DECL_GETHOSTBYADDR_R
+
+/* Define to 1 if you have the <dirent.h> header file, and it defines `DIR'.
+   */
+#undef HAVE_DIRENT_H
+
+/* Define to 1 if you have the `dladdr' function. */
+#undef HAVE_DLADDR
+
+/* Define to 1 if you have the <dlfcn.h> header file. */
+#undef HAVE_DLFCN_H
+
+/* Define to 1 if you have the <errno.h> header file. */
+#undef HAVE_ERRNO_H
+
+/* define this if we have <execinfo.h> and symbols */
+#undef HAVE_EXECINFO
+
+/* Define to 1 if you have the `fcntl' function. */
+#undef HAVE_FCNTL
+
+/* Define to 1 if you have the <fcntl.h> header file. */
+#undef HAVE_FCNTL_H
+
+/* Define to 1 if you have the <features.h> header file. */
+#undef HAVE_FEATURES_H
+
+/* Define to 1 if you have the <fnmatch.h> header file. */
+#undef HAVE_FNMATCH_H
+
+/* Define to 1 if you have the `fopencookie' function. */
+#undef HAVE_FOPENCOOKIE
+
+/* Define to 1 if you have the `funopen' function. */
+#undef HAVE_FUNOPEN
+
+/* Define to 1 if you have the `getaddrinfo' function. */
+#undef HAVE_GETADDRINFO
+
+/* Define to 1 if you have the getgrnam_r. */
+#undef HAVE_GETGRNAM_R
+
+/* Define to 1 if you have the `getnameinfo' function. */
+#undef HAVE_GETNAMEINFO
+
+/* Define to 1 if you have the <getopt.h> header file. */
+#undef HAVE_GETOPT_H
+
+/* Define to 1 if you have the `getopt_long' function. */
+#undef HAVE_GETOPT_LONG
+
+/* Define to 1 if you have the `getpeereid' function. */
+#undef HAVE_GETPEEREID
+
+/* Define to 1 if you have the getpwnam_r. */
+#undef HAVE_GETPWNAM_R
+
+/* Define to 1 if you have the `getresuid' function. */
+#undef HAVE_GETRESUID
+
+/* Define to 1 if you have the `gettimeofday' function. */
+#undef HAVE_GETTIMEOFDAY
+
+/* Define to 1 if you have the `getusershell' function. */
+#undef HAVE_GETUSERSHELL
+
+/* Define to 1 if you have the <glob.h> header file. */
+#undef HAVE_GLOB_H
+
+/* Define to 1 if you have the `gmtime_r' function. */
+#undef HAVE_GMTIME_R
+
+/* Define to 1 if you have the <grp.h> header file. */
+#undef HAVE_GRP_H
+
+/* Define to 1 if you have the <history.h> header file. */
+#undef HAVE_HISTORY_H
+
+/* Define to 1 if you have the `HMAC_CTX_free' function. */
+#undef HAVE_HMAC_CTX_FREE
+
+/* Define to 1 if you have the `HMAC_CTX_new' function. */
+#undef HAVE_HMAC_CTX_NEW
+
+/* Define if the function (or macro) htonll exists. */
+#undef HAVE_HTONLL
+
+/* Define if the function (or macro) htonlll exists. */
+#undef HAVE_HTONLLL
+
+/* Define to 1 if you have the `if_indextoname' function. */
+#undef HAVE_IF_INDEXTONAME
+
+/* define if you have IN6_PKTINFO (Linux) */
+#undef HAVE_IN6_PKTINFO
+
+/* Define to 1 if you have the `inet_aton' function. */
+#undef HAVE_INET_ATON
+
+/* Define to 1 if you have the `inet_ntop' function. */
+#undef HAVE_INET_NTOP
+
+/* Define to 1 if you have the `inet_pton' function. */
+#undef HAVE_INET_PTON
+
+/* Define to 1 if you have the `initgroups' function. */
+#undef HAVE_INITGROUPS
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#undef HAVE_INTTYPES_H
+
+/* define if you have IP_PKTINFO (Linux) */
+#undef HAVE_IP_PKTINFO
+
+/* Define to 1 if you have the `kqueue' function. */
+#undef HAVE_KQUEUE
+
+/* Define to 1 if you have the `cap' library (-lcap). */
+#undef HAVE_LIBCAP
+
+/* Define to 1 if you have the `crypto' library (-lcrypto). */
+#undef HAVE_LIBCRYPTO
+
+/* Define to 1 if you have the `dl' library (-ldl). */
+#undef HAVE_LIBDL
+
+/* Define to 1 if you have the `nsl' library (-lnsl). */
+#undef HAVE_LIBNSL
+
+/* Define to 1 if you have the `pcap' library (-lpcap) and header file
+   <pcap.h>. */
+#undef HAVE_LIBPCAP
+
+/* Define if you have a readline compatible library */
+#undef HAVE_LIBREADLINE
+
+/* Define to 1 if you have the `resolv' library (-lresolv). */
+#undef HAVE_LIBRESOLV
+
+/* Define to 1 if you have the `socket' library (-lsocket). */
+#undef HAVE_LIBSOCKET
+
+/* Define to 1 if you have the `ssl' library (-lssl). */
+#undef HAVE_LIBSSL
+
+/* Define to 1 if you have the `ws2_32' library (-lws2_32). */
+#undef HAVE_LIBWS2_32
+
+/* Define to 1 if you have the <limits.h> header file. */
+#undef HAVE_LIMITS_H
+
+/* Define to 1 if you have the <linux/if_packet.h> header file. */
+#undef HAVE_LINUX_IF_PACKET_H
+
+/* Define to 1 if you have the `localtime_r' function. */
+#undef HAVE_LOCALTIME_R
+
+/* Define to 1 if you have the <malloc.h> header file. */
+#undef HAVE_MALLOC_H
+
+/* Define to 1 if you have the `mallopt' function. */
+#undef HAVE_MALLOPT
+
+/* Define to 1 if you have the <memory.h> header file. */
+#undef HAVE_MEMORY_H
+
+/* Define to 1 if you have the `mkdirat' function. */
+#undef HAVE_MKDIRAT
+
+/* Define to 1 if you have the <ndir.h> header file, and it defines `DIR'. */
+#undef HAVE_NDIR_H
+
+/* Define to 1 if you have the <netdb.h> header file. */
+#undef HAVE_NETDB_H
+
+/* Define to 1 if you have the <netinet/in.h> header file. */
+#undef HAVE_NETINET_IN_H
+
+/* Define to 1 if you have the <net/if.h> header file. */
+#undef HAVE_NET_IF_H
+
+/* Define to 1 if you have the `openat' function. */
+#undef HAVE_OPENAT
+
+/* Define to 1 if you have the <openssl/asn1.h> header file. */
+#undef HAVE_OPENSSL_ASN1_H
+
+/* Define to 1 if you have the <openssl/conf.h> header file. */
+#undef HAVE_OPENSSL_CONF_H
+
+/* Define to 1 if you have the <openssl/crypto.h> header file. */
+#undef HAVE_OPENSSL_CRYPTO_H
+
+/* Define to 1 if you have the <openssl/engine.h> header file. */
+#undef HAVE_OPENSSL_ENGINE_H
+
+/* Define to 1 if you have the <openssl/err.h> header file. */
+#undef HAVE_OPENSSL_ERR_H
+
+/* Define to 1 if you have the <openssl/evp.h> header file. */
+#undef HAVE_OPENSSL_EVP_H
+
+/* Define to 1 if you have the <openssl/hmac.h> header file. */
+#undef HAVE_OPENSSL_HMAC_H
+
+/* Define to 1 if you have the <openssl/md4.h> header file. */
+#undef HAVE_OPENSSL_MD4_H
+
+/* Define to 1 if you have the <openssl/md5.h> header file. */
+#undef HAVE_OPENSSL_MD5_H
+
+/* Define to 1 if you have the <openssl/ocsp.h> header file. */
+#undef HAVE_OPENSSL_OCSP_H
+
+/* Define to 1 if you have the <openssl/rand.h> header file. */
+#undef HAVE_OPENSSL_RAND_H
+
+/* Define to 1 if you have the <openssl/sha.h> header file. */
+#undef HAVE_OPENSSL_SHA_H
+
+/* Define to 1 if you have the <openssl/ssl.h> header file. */
+#undef HAVE_OPENSSL_SSL_H
+
+/* Define to 1 if you have the `pcap_activate' function. */
+#undef HAVE_PCAP_ACTIVATE
+
+/* Define to 1 if you have the `pcap_create' function. */
+#undef HAVE_PCAP_CREATE
+
+/* Define to 1 if you have the `pcap_dump_fopen' function. */
+#undef HAVE_PCAP_DUMP_FOPEN
+
+/* Define to 1 if you have the `pcap_fopen_offline' function. */
+#undef HAVE_PCAP_FOPEN_OFFLINE
+
+/* define this if we have libpcre */
+#undef HAVE_PCRE
+
+/* Define to 1 if you have the <prot.h> header file. */
+#undef HAVE_PROT_H
+
+/* Define to 1 if you have the <pthread.h> header file. */
+#undef HAVE_PTHREAD_H
+
+/* Define to 1 if you have the `pthread_sigmask' function. */
+#undef HAVE_PTHREAD_SIGMASK
+
+/* Define to 1 if you have the <pwd.h> header file. */
+#undef HAVE_PWD_H
+
+/* Define to 1 if you have the <readline.h> header file. */
+#undef HAVE_READLINE_H
+
+/* Define if your readline library has \`add_history' */
+#undef HAVE_READLINE_HISTORY
+
+/* Define to 1 if you have the <readline/history.h> header file. */
+#undef HAVE_READLINE_HISTORY_H
+
+/* Define to 1 if you have the <readline/readline.h> header file. */
+#undef HAVE_READLINE_READLINE_H
+
+/* Define if we have any regular expression library */
+#undef HAVE_REGEX
+
+/* Define to 1 if you have the `regncomp' function. */
+#undef HAVE_REGNCOMP
+
+/* Define to 1 if you have the `regnexec' function. */
+#undef HAVE_REGNEXEC
+
+/* define this if we have REG_EXTENDED (from <regex.h>) */
+#undef HAVE_REG_EXTENDED
+
+/* Define to 1 if you have the <resource.h> header file. */
+#undef HAVE_RESOURCE_H
+
+/* Define to 1 if you have the <sanitizer/lsan_interface.h> header file. */
+#undef HAVE_SANITIZER_LSAN_INTERFACE_H
+
+/* Define to 1 if you have the <semaphore.h> header file. */
+#undef HAVE_SEMAPHORE_H
+
+/* Define to 1 if you have the `setlinebuf' function. */
+#undef HAVE_SETLINEBUF
+
+/* Define to 1 if you have the `setresuid' function. */
+#undef HAVE_SETRESUID
+
+/* Define to 1 if you have the `setsid' function. */
+#undef HAVE_SETSID
+
+/* Define to 1 if you have the `setuid' function. */
+#undef HAVE_SETUID
+
+/* Define to 1 if you have the `setvbuf' function. */
+#undef HAVE_SETVBUF
+
+/* Define to 1 if you have the <siad.h> header file. */
+#undef HAVE_SIAD_H
+
+/* Define to 1 if you have the <sia.h> header file. */
+#undef HAVE_SIA_H
+
+/* Define to 1 if you have the `sigaction' function. */
+#undef HAVE_SIGACTION
+
+/* Define to 1 if you have the <signal.h> header file. */
+#undef HAVE_SIGNAL_H
+
+/* Define to 1 if you have the `sigprocmask' function. */
+#undef HAVE_SIGPROCMASK
+
+/* Define if the type sig_t is defined by signal.h */
+#undef HAVE_SIG_T
+
+/* Define to 1 if you have the `snprintf' function. */
+#undef HAVE_SNPRINTF
+
+/* Define to 1 if you have the `SSL_get_client_random' function. */
+#undef HAVE_SSL_GET_CLIENT_RANDOM
+
+/* Define to 1 if you have the `SSL_get_server_random' function. */
+#undef HAVE_SSL_GET_SERVER_RANDOM
+
+/* Define to 1 if you have the `SSL_SESSION_get_master_key' function. */
+#undef HAVE_SSL_SESSION_GET_MASTER_KEY
+
+/* Define to 1 if you have the <stdalign.h> header file. */
+#undef HAVE_STDALIGN_H
+
+/* Define to 1 if you have the <stdatomic.h> header file. */
+#undef HAVE_STDATOMIC_H
+
+/* Define to 1 if you have the <stdbool.h> header file. */
+#undef HAVE_STDBOOL_H
+
+/* Define to 1 if you have the <stddef.h> header file. */
+#undef HAVE_STDDEF_H
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#undef HAVE_STDINT_H
+
+/* Define to 1 if you have the <stdio.h> header file. */
+#undef HAVE_STDIO_H
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#undef HAVE_STDLIB_H
+
+/* Define to 1 if you have the `strcasecmp' function. */
+#undef HAVE_STRCASECMP
+
+/* Define to 1 if you have the <strings.h> header file. */
+#undef HAVE_STRINGS_H
+
+/* Define to 1 if you have the <string.h> header file. */
+#undef HAVE_STRING_H
+
+/* Define to 1 if you have the `strlcat' function. */
+#undef HAVE_STRLCAT
+
+/* Define to 1 if you have the `strlcpy' function. */
+#undef HAVE_STRLCPY
+
+/* Define to 1 if you have the `strncasecmp' function. */
+#undef HAVE_STRNCASECMP
+
+/* Define to 1 if you have the `strsep' function. */
+#undef HAVE_STRSEP
+
+/* Define to 1 if you have the `strsignal' function. */
+#undef HAVE_STRSIGNAL
+
+/* Generic DNS lookups */
+#undef HAVE_STRUCT_ADDRINFO
+
+/* IPv6 address structure */
+#undef HAVE_STRUCT_IN6_ADDR
+
+/* IPv6 socket addresses */
+#undef HAVE_STRUCT_SOCKADDR_IN6
+
+/* Generic socket addresses */
+#undef HAVE_STRUCT_SOCKADDR_STORAGE
+
+/* Define to 1 if you have the <syslog.h> header file. */
+#undef HAVE_SYSLOG_H
+
+/* Define to 1 if you have the `systemd' library (-lsystemd). */
+#undef HAVE_SYSTEMD
+
+/* Define to 1 if you have the <systemd/sd-daemon.h> header file. */
+#undef HAVE_SYSTEMD_SD_DAEMON_H
+
+/* Define to 1 if you have watchdog support in the `systemd' library
+   (-lsystemd). */
+#undef HAVE_SYSTEMD_WATCHDOG
+
+/* Define to 1 if you have the <sys/dir.h> header file, and it defines `DIR'.
+   */
+#undef HAVE_SYS_DIR_H
+
+/* Define to 1 if you have the <sys/event.h> header file. */
+#undef HAVE_SYS_EVENT_H
+
+/* Define to 1 if you have the <sys/fcntl.h> header file. */
+#undef HAVE_SYS_FCNTL_H
+
+/* Define to 1 if you have the <sys/ndir.h> header file, and it defines `DIR'.
+   */
+#undef HAVE_SYS_NDIR_H
+
+/* Define to 1 if you have the <sys/prctl.h> header file. */
+#undef HAVE_SYS_PRCTL_H
+
+/* Define to 1 if you have the <sys/procctl.h> header file. */
+#undef HAVE_SYS_PROCCTL_H
+
+/* Define to 1 if you have the <sys/ptrace.h> header file. */
+#undef HAVE_SYS_PTRACE_H
+
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#undef HAVE_SYS_RESOURCE_H
+
+/* Define to 1 if you have the <sys/security.h> header file. */
+#undef HAVE_SYS_SECURITY_H
+
+/* Define to 1 if you have the <sys/select.h> header file. */
+#undef HAVE_SYS_SELECT_H
+
+/* Define to 1 if you have the <sys/socket.h> header file. */
+#undef HAVE_SYS_SOCKET_H
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#undef HAVE_SYS_STAT_H
+
+/* Define to 1 if you have the <sys/time.h> header file. */
+#undef HAVE_SYS_TIME_H
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#undef HAVE_SYS_TYPES_H
+
+/* Define to 1 if you have the <sys/un.h> header file. */
+#undef HAVE_SYS_UN_H
+
+/* Define to 1 if you have the <sys/wait.h> header file. */
+#undef HAVE_SYS_WAIT_H
+
+/* Define to 1 if you have the function talloc_set_memlimit. */
+#undef HAVE_TALLOC_SET_MEMLIMIT
+
+/* 128 bit unsigned integer */
+#undef HAVE_UINT128_T
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#undef HAVE_UNISTD_H
+
+/* Define to 1 if you have the `unlinkat' function. */
+#undef HAVE_UNLINKAT
+
+/* Define to 1 if you have the <utime.h> header file. */
+#undef HAVE_UTIME_H
+
+/* Define to 1 if you have the <utmpx.h> header file. */
+#undef HAVE_UTMPX_H
+
+/* Define to 1 if you have the <utmp.h> header file. */
+#undef HAVE_UTMP_H
+
+/* Define to 1 if you have the `vdprintf' function. */
+#undef HAVE_VDPRINTF
+
+/* Define to 1 if you have the `vsnprintf' function. */
+#undef HAVE_VSNPRINTF
+
+/* Define if the compiler supports -Wdocumentation */
+#undef HAVE_WDOCUMENTATION
+
+/* Define to 1 if you have the <winsock.h> header file. */
+#undef HAVE_WINSOCK_H
+
+/* compiler specific 128 bit unsigned integer */
+#undef HAVE___UINT128_T
+
+/* define if you have OSFC2 authentication */
+#undef OSFC2
+
+/* define if you have OSFSIA authentication */
+#undef OSFSIA
+
+/* Define to the address where bug reports for this package should be sent. */
+#undef PACKAGE_BUGREPORT
+
+/* Define to the full name of this package. */
+#undef PACKAGE_NAME
+
+/* Define to the full name and version of this package. */
+#undef PACKAGE_STRING
+
+/* Define to the one symbol short name of this package. */
+#undef PACKAGE_TARNAME
+
+/* Define to the home page for this package. */
+#undef PACKAGE_URL
+
+/* Define to the version of this package. */
+#undef PACKAGE_VERSION
+
+/* Posix-Style ctime_r */
+#undef POSIXSTYLE
+
+/* Version integer in format <ma><ma><mi><mi><in><in> */
+#undef RADIUSD_VERSION
+
+/* Commit HEAD at time of configuring */
+#undef RADIUSD_VERSION_COMMIT
+
+/* Raw version string from VERSION file */
+#undef RADIUSD_VERSION_STRING
+
+/* Solaris-Style ctime_r */
+#undef SOLARISSTYLE
+
+/* Define to 1 if you have the ANSI C header files. */
+#undef STDC_HEADERS
+
+/* SYSV-Style get*byaddr_r */
+#undef SYSVSTYLE
+
+/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
+#undef TIME_WITH_SYS_TIME
+
+/* Define if the compiler supports a thread local storage class */
+#undef TLS_STORAGE_CLASS
+
+/* Enable extensions on AIX 3, Interix.  */
+#ifndef _ALL_SOURCE
+# undef _ALL_SOURCE
+#endif
+/* Enable GNU extensions on systems that have them.  */
+#ifndef _GNU_SOURCE
+# undef _GNU_SOURCE
+#endif
+/* Enable threading extensions on Solaris.  */
+#ifndef _POSIX_PTHREAD_SEMANTICS
+# undef _POSIX_PTHREAD_SEMANTICS
+#endif
+/* Enable extensions on HP NonStop.  */
+#ifndef _TANDEM_SOURCE
+# undef _TANDEM_SOURCE
+#endif
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+# undef __EXTENSIONS__
+#endif
+
+
+/* include support for Ascend binary filter attributes */
+#undef WITH_ASCEND_BINARY
+
+/* define if you want DHCP support */
+#undef WITH_DHCP
+
+/* define if the server was built with -DNDEBUG */
+#undef WITH_NDEBUG
+
+/* define if you want RADIUSv11 support (For RADSec et al) */
+#undef WITH_RADIUSV11
+
+/* define if you want TCP support (For RADSec et al) */
+#undef WITH_TCP
+
+/* define if you want thread support */
+#undef WITH_THREADS
+
+/* define if you want udpfromto */
+#undef WITH_UDPFROMTO
+
+/* define if you want VMPS support */
+#undef WITH_VMPS
+
+/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
+   significant byte first (like Motorola and SPARC, unlike Intel). */
+#if defined AC_APPLE_UNIVERSAL_BUILD
+# if defined __BIG_ENDIAN__
+#  define WORDS_BIGENDIAN 1
+# endif
+#else
+# ifndef WORDS_BIGENDIAN
+#  undef WORDS_BIGENDIAN
+# endif
+#endif
+
+/* Enable large inode numbers on Mac OS X 10.5.  */
+#ifndef _DARWIN_USE_64_BIT_INODE
+# define _DARWIN_USE_64_BIT_INODE 1
+#endif
+
+/* Number of bits in a file offset, on hosts where this is settable. */
+#undef _FILE_OFFSET_BITS
+
+/* Define for large files, on AIX-style hosts. */
+#undef _LARGE_FILES
+
+/* Define to 1 if on MINIX. */
+#undef _MINIX
+
+/* Define to 2 if the system does not provide POSIX.1 features except with
+   this defined. */
+#undef _POSIX_1_SOURCE
+
+/* Define to 1 if you need to in order for `stat' and other things to work. */
+#undef _POSIX_SOURCE
+
+/* Force OSX >= 10.7 Lion to use RFC2292 IPv6 socket options */
+#undef __APPLE_USE_RFC_3542
+
+/* Define to empty if `const' does not conform to ANSI C. */
+#undef const
+
+/* Define to `int' if <sys/types.h> doesn't define. */
+#undef gid_t
+
+/* Define to `long int' if <sys/types.h> does not define. */
+#undef off_t
+
+/* Define to `int' if <sys/types.h> does not define. */
+#undef pid_t
+
+/* Define to `unsigned int' if <sys/types.h> does not define. */
+#undef size_t
+
+/* socklen_t is generally 'int' on systems which don't use it */
+#undef socklen_t
+
+/* Define to `int' if <sys/types.h> doesn't define. */
+#undef uid_t
+
+/* uint16_t should be the canonical '2 octets' for network traffic */
+#undef uint16_t
+
+/* uint32_t should be the canonical 'network integer' */
+#undef uint32_t
+
+/* uint64_t is required for larger counters */
+#undef uint64_t
+
+/* uint8_t should be the canonical 'octet' for network traffic */
+#undef uint8_t
+
+/* define to something if you don't have ut_xtime in struct utmpx */
+#undef ut_xtime
+
+#include <freeradius-devel/automask.h>
diff --git a/src/include/automask.h b/src/include/automask.h
new file mode 100644
index 0000000..87ffdfc
--- /dev/null
+++ b/src/include/automask.h
@@ -0,0 +1,21 @@
+/*
+ *  C Preprocessor definitions we do *NOT* want to leave defined autoconf.h
+ *  Which are dependent on where the header is being used.
+ *
+ *  Version: $Id$
+ */
+
+
+/*
+ *  If were building a module we may have local PACKAGE_* defines if
+ *  AC_INIT() was called with full arguments.
+ */
+#ifdef IS_MODULE
+#	undef PACKAGE_BUGREPORT
+#	undef PACKAGE_NAME
+#	undef PACKAGE_STRING
+#	undef PACKAGE_TARNAME
+#	undef PACKAGE_URL
+#	undef PACKAGE_VERSION
+#endif
+
diff --git a/src/include/base64.h b/src/include/base64.h
new file mode 100644
index 0000000..c83cfc9
--- /dev/null
+++ b/src/include/base64.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2004, 2005, 2006 Free Software Foundation, Inc.
+ * Written by Simon Josefsson.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+#ifndef _FR_BASE64_H
+#define _FR_BASE64_H
+
+RCSIDH(base64_h, "$Id$")
+
+#include <stddef.h>
+#include <stdint.h>
+
+/* This uses that the expression (n+(k-1))/k means the smallest
+   integer >= n/k, i.e., the ceiling of n/k.  */
+#define FR_BASE64_ENC_LENGTH(inlen) ((((inlen) + 2) / 3) * 4)
+#define FR_BASE64_DEC_LENGTH(inlen) ((3 * (inlen / 4)) + 2)
+
+bool fr_is_base64(char c);
+
+ssize_t fr_base64_encode(char *out, size_t outlen, uint8_t const *in, size_t inlen);
+
+ssize_t fr_base64_decode(uint8_t *out, size_t outlen, char const *in, size_t inlen);
+
+#endif /* _FR_BASE64_H */
diff --git a/src/include/build-radpaths-h.in b/src/include/build-radpaths-h.in
new file mode 100644
index 0000000..506a21b
--- /dev/null
+++ b/src/include/build-radpaths-h.in
@@ -0,0 +1,37 @@
+#! /bin/sh
+#
+# build-radpaths-h
+#		Script to generate radpaths.h file. This is needed to
+#		work around the weird way "autoconf" substitutes things
+#		that are generated in anyway from a command line
+#		argument having to do with a path (--prefix etc)
+#
+# Version:	$Id$
+#
+
+# Location of files.
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+sysconfdir=@sysconfdir@
+localstatedir=@localstatedir@
+libdir=@libdir@
+bindir=@bindir@
+sbindir=@sbindir@
+mandir=@mandir@
+logdir=@logdir@
+raddbdir=@raddbdir@
+dictdir=@dictdir@
+radacctdir=@radacctdir@
+datarootdir=@datarootdir@
+
+cat <<EOF > radpaths.h
+/* Automatically generated by "build-radpaths-h" */
+#define LOGDIR		"@logdir@"
+#define LIBDIR		"@libdir@"
+#define RADDBDIR	"@raddbdir@"
+#define RUNDIR		"@localstatedir@/run"
+#define SBINDIR		"@sbindir@"
+#define RADIR		"@radacctdir@"
+#define DICTDIR		"@dictdir@"
+EOF
+
diff --git a/src/include/build.h b/src/include/build.h
new file mode 100644
index 0000000..c5eaa45
--- /dev/null
+++ b/src/include/build.h
@@ -0,0 +1,168 @@
+/**
+ * $Id$
+ *
+ * @brief Source control functions
+ *
+ * @copyright 2013 The FreeRADIUS server project
+ */
+#ifndef _BUILD_H
+#define _BUILD_H
+#ifdef __cplusplus
+extern "C" {
+#endif
+#include <freeradius-devel/autoconf.h> /* Needed for endian macros */
+
+/*
+ *	The ubiquitous stringify macros
+ */
+#define XSTRINGIFY(x) #x
+#define STRINGIFY(x) XSTRINGIFY(x)
+#define JOINSTR(x,y) XSTRINGIFY(x ## y)
+
+/*
+ *	HEX concatenation macros
+ */
+#ifndef HEXIFY
+#  define XHEXIFY4(b1,b2,b3,b4)	(0x ## b1 ## b2 ## b3 ## b4)
+#  define HEXIFY4(b1,b2,b3,b4)	XHEXIFY4(b1, b2, b3, b4)
+
+#  define XHEXIFY3(b1,b2,b3)	(0x ## b1 ## b2 ## b3)
+#  define HEXIFY3(b1,b2,b3)	XHEXIFY3(b1, b2, b3)
+
+#  define XHEXIFY2(b1,b2)	(0x ## b1 ## b2)
+#  define HEXIFY2(b1,b2)	XHEXIFY2(b1, b2)
+
+#  define XHEXIFY(b1)		(0x ## b1)
+#  define HEXIFY(b1)		XHEXIFY(b1)
+#endif
+
+/*
+ *	struct field size
+ */
+#define SIZEOF_MEMBER(_t, _m) sizeof(((_t *)0)->_m)
+
+/*
+ *	Only use GCC __attribute__ if were building with a GCClike
+ *	compiler.
+ */
+#ifdef __GNUC__
+#  define CC_HINT(...)  __attribute__ ((__VA_ARGS__))
+#  define likely(_x)	__builtin_expect((_x), 1)
+#  define unlikely(_x)	__builtin_expect((_x), 0)
+#else
+#  define CC_HINT(...)
+#  define likely(_x)	_x
+#  define unlikely(_x)	_x
+#endif
+
+#ifdef HAVE_ATTRIBUTE_BOUNDED
+#  define CC_BOUNDED(_x, ...) CC_HINT(__bounded__(_x, ## __VA_ARGS__))
+#else
+#  define CC_BOUNDED(...)
+#endif
+
+/*
+ *      GCC uses __SANITIZE_ADDRESS__, clang uses __has_feature, which
+ *      GCC complains about.
+ */
+#ifndef __SANITIZE_ADDRESS__
+#ifdef __has_feature
+#if __has_feature(address_sanitizer)
+#define __SANITIZE_ADDRESS__ (1)
+#endif
+#endif
+#endif
+
+/*
+ *	Macros to add pragmas
+ */
+#define PRAGMA(_x) _Pragma(#_x)
+
+/*
+ *	Macros for controlling warnings in GCC >= 4.2 and clang >= 2.8
+ */
+#if defined(__GNUC__) && ((__GNUC__ * 100) + __GNUC_MINOR__) >= 402
+#  define DIAG_UNKNOWN_PRAGMAS pragmas
+#  define DIAG_PRAGMA(_x) PRAGMA(GCC diagnostic _x)
+#  if ((__GNUC__ * 100) + __GNUC_MINOR__) >= 406
+#    define DIAG_OFF(_x) DIAG_PRAGMA(push) DIAG_PRAGMA(ignored JOINSTR(-W,_x))
+#    define DIAG_ON(_x) DIAG_PRAGMA(pop)
+#  else
+#    define DIAG_OFF(_x) DIAG_PRAGMA(ignored JOINSTR(-W,_x))
+#    define DIAG_ON(_x)  DIAG_PRAGMA(warning JOINSTR(-W,_x))
+#  endif
+#elif defined(__clang__) && ((__clang_major__ * 100) + __clang_minor__ >= 208)
+#  define DIAG_UNKNOWN_PRAGMAS unknown-pragmas
+#  define DIAG_PRAGMA(_x) PRAGMA(clang diagnostic _x)
+#  define DIAG_OFF(_x) DIAG_PRAGMA(push) DIAG_PRAGMA(ignored JOINSTR(-W,_x))
+#  define DIAG_ON(_x) DIAG_PRAGMA(pop)
+#else
+#  define DIAG_UNKNOWN_PRAGMAS
+#  define DIAG_OFF(_x)
+#  define DIAG_ON(_x)
+#endif
+
+/*
+ *	GCC and clang use different macros
+ */
+#ifdef __clang__
+# define DIAG_OPTIONAL DIAG_OFF(unknown-pragmas)
+#else
+# define DIAG_OPTIONAL DIAG_OFF(pragmas)
+#endif
+
+/*
+ *	For dealing with APIs which are only deprecated in OSX (like the OpenSSL API)
+ */
+#ifdef __APPLE__
+#  define USES_APPLE_DEPRECATED_API DIAG_OFF(deprecated-declarations)
+#  define USES_APPLE_RST DIAG_ON(deprecated-declarations)
+#else
+#  define USES_APPLE_DEPRECATED_API
+#  define USES_APPLE_RST
+#endif
+
+#if defined(__GNUC__)
+/* force inclusion of ident keywords in the face of optimization */
+#  define RCSID(id) static char const rcsid[] __attribute__ ((used)) = id;
+#  define RCSIDH(h, id) static char const rcsid_ ## h [] __attribute__ ((used)) = id;
+#elif defined(__SUNPRO_C)
+/* put ident keyword into comment section (nicer than gcc way) */
+#  define RCSID(id) PRAGMA(sun ident id)
+#  define RCSIDH(h, id) PRAGMA(sun ident id)
+#else
+#  define RCSID(id)
+#  define RCSIDH(h, id)
+#endif
+
+/*
+ *	Try and determine endianness of the target system.
+ *
+ *	Other projects seem to use endian.h and variants, but these are
+ *	in non standard locations, and may mess up cross compiling.
+ *
+ *	Here at least the endianness can be set explicitly with
+ *	-DLITTLE_ENDIAN or -DBIG_ENDIAN.
+ */
+#if !defined(FR_LITTLE_ENDIAN) && !defined(FR_BIG_ENDIAN)
+#  if defined(__LITTLE_ENDIAN__) || \
+      (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+#    define FR_LITTLE_ENDIAN 1
+#  elif defined(__BIG_ENDIAN__) || \
+      (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+#    define FR_BIG_ENDIAN 1
+#  else
+#    error Failed determining endianness of system
+#  endif
+#endif
+
+#define PRINTF_LIKE(n)		CC_HINT(format(printf, n, n+1))
+#define NEVER_RETURNS		CC_HINT(noreturn)
+#define HIDDEN                CC_HINT(visibility("hidden"))
+#define UNUSED			CC_HINT(unused)
+#define BLANK_FORMAT		" "	/* GCC_LINT whines about empty formats */
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* _BUILD_H */
diff --git a/src/include/channel.h b/src/include/channel.h
new file mode 100644
index 0000000..5b2d7d5
--- /dev/null
+++ b/src/include/channel.h
@@ -0,0 +1,55 @@
+#ifndef CHANNEL_H
+#define CHANNEL_H
+
+/*
+ * channel.h	For radmin / server channels.
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2015 Alan DeKok <aland@deployingradius.com>
+ */
+
+RCSIDH(heap_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum fr_channel_type_t {
+	FR_CHANNEL_STDIN = 0,
+	FR_CHANNEL_STDOUT,
+	FR_CHANNEL_STDERR,
+	FR_CHANNEL_CMD_STATUS,
+	FR_CHANNEL_INIT_ACK,
+	FR_CHANNEL_AUTH_CHALLENGE,
+	FR_CHANNEL_AUTH_RESPONSE,
+	FR_CHANNEL_WANT_MORE
+} fr_channel_type_t;
+
+typedef enum fr_channel_result_t {
+	FR_CHANNEL_FAIL = 0,
+	FR_CHANNEL_SUCCESS
+} fr_channel_result_t;
+
+ssize_t fr_channel_drain(int fd, fr_channel_type_t *pchannel, void *inbuf, size_t buflen, uint8_t **outbuf, size_t have_read);
+ssize_t fr_channel_read(int fd, fr_channel_type_t *pchannel, void *buffer, size_t buflen);
+ssize_t fr_channel_write(int fd, fr_channel_type_t channel, void const *buffer, size_t buflen);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CHANNEL_H */
diff --git a/src/include/clients.h b/src/include/clients.h
new file mode 100644
index 0000000..46b5b3b
--- /dev/null
+++ b/src/include/clients.h
@@ -0,0 +1,174 @@
+/*
+ *   This library is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU Lesser General Public
+ *   the Free Software Foundation; either version 2 of the License, or (at
+ *   your option) any later version. either
+ *   version 2.1 of the License, or (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ *   Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public
+ *   License along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef CLIENTS_H
+#define CLIENTS_H
+/*
+ * $Id$
+ *
+ * @file clients.h
+ * @brief Function declarations and structures to manage clients.
+ *
+ * @author Arran Cudbard-Bell <a.cudbardb@freeradius.org>
+ * @copyright 2015 The FreeRADIUS server project
+ */
+
+typedef struct radclient_list RADCLIENT_LIST;
+
+
+/** Describes a host allowed to send packets to the server
+ *
+ */
+typedef struct radclient {
+	RADCLIENT_LIST		*list;			//!< parent list
+	fr_ipaddr_t		ipaddr;			//!< IPv4/IPv6 address of the host.
+	fr_ipaddr_t		src_ipaddr;		//!< IPv4/IPv6 address to send responses
+							//!< from (family must match ipaddr).
+
+	char const		*longname;		//!< Client identifier.
+	char const		*shortname;		//!< Client nickname.
+
+	char const		*secret;		//!< Secret PSK.
+
+	bool			message_authenticator;	//!< Require RADIUS message authenticator in requests.
+
+	char const		*nas_type;		//!< Type of client (arbitrary).
+
+	char const		*login;			//!< Username to use for simultaneous use checks.
+	char const		*password;		//!< Password to use for simultaneous use checks.
+
+	char const 		*server;		//!< Virtual server client is associated with.
+
+	int			number;			//!< Unique client number.
+
+	CONF_SECTION	 	*cs;			//!< CONF_SECTION that was parsed to generate the client.
+
+#ifdef WITH_STATS
+	fr_stats_t		auth;			//!< Authentication stats.
+#  ifdef WITH_ACCOUNTING
+	fr_stats_t		acct;			//!< Accounting stats.
+#  endif
+#  ifdef WITH_COA
+	fr_stats_t		coa;			//!< Change of Authorization stats.
+	fr_stats_t		dsc;			//!< Disconnect-Request stats.
+#  endif
+#endif
+
+	struct timeval		response_window;	//!< How long the client has to respond.
+
+	int			proto;			//!< Protocol number.
+#ifdef WITH_TCP
+	fr_socket_limit_t	limit;			//!< Connections per client (TCP clients only).
+#endif
+#ifdef WITH_TLS
+	bool			tls_required;		//!< whether TLS encryption is required.
+
+#ifdef WITH_RADIUSV11
+	char const		*radiusv11_name;
+	fr_radiusv11_t 		radiusv11;
+#endif
+#endif
+
+#ifdef WITH_DYNAMIC_CLIENTS
+	uint32_t		lifetime;		//!< How long before the client is removed.
+	uint32_t		dynamic;		//!< Whether the client was dynamically defined.
+	time_t			created;		//!< When the client was created.
+
+	time_t			last_new_client;	//!< Used for relate limiting addition and deletion of
+							//!< dynamic clients.
+
+	char const		*client_server;		//!< Virtual server associated with this dynamic client.
+							//!< Only used where client specifies a network of potential
+							//!< clients.
+
+	bool			rate_limit;		//!< Where addition of clients should be rate limited.
+	fr_event_t		*ev;			//!< for deleting dynamic clients
+#endif
+
+#ifdef WITH_COA
+	char const		*coa_name;		//!< Name of the CoA home server or pool.
+	home_server_t		*coa_home_server;	//!< The CoA home_server_t the client is associated with.
+							//!< Must be used exclusively from coa_pool.
+	home_pool_t		*coa_home_pool;		//!< The CoA home_pool_t the client is associated with.
+							//!< Must be used exclusively from coa_server.
+	bool			defines_coa_server;	//!< Client also defines a home_server.
+#endif
+} RADCLIENT;
+
+/** Callback for retrieving values when building client sections
+ *
+ * Example:
+ @code{.c}
+   int _client_value_cb(char **out, CONF_PAIR const *cp, void *data)
+   {
+   	my_result *result = data;
+   	char *value;
+
+   	value = get_attribute_from_result(result, cf_pair_value(cp));
+   	if (!value) {
+   		*out = NULL;
+   		return 0;
+   	}
+
+   	*out = talloc_strdup(value);
+   	free_attribute(value);
+
+   	if (!*out) return -1;
+   	return 0;
+   }
+ @endcode
+ *
+ * @param[out] out Where to write a pointer to the talloced value buffer.
+ * @param[in] cp The value of the CONF_PAIR specifies the attribute name to retrieve from the result.
+ * @param[in] data Pointer to the result struct to copy values from.
+ * @return 0 on success -1 on failure.
+ */
+typedef int (*client_value_cb_t)(char **out, CONF_PAIR const *cp, void *data);
+
+RADCLIENT_LIST	*client_list_init(CONF_SECTION *cs);
+
+void		client_list_free(RADCLIENT_LIST *clients);
+
+RADCLIENT_LIST	*client_list_parse_section(CONF_SECTION *section, bool tls_required);
+
+void		client_free(RADCLIENT *client);
+
+bool		client_add(RADCLIENT_LIST *clients, RADCLIENT *client);
+
+#ifdef WITH_DYNAMIC_CLIENTS
+void		client_delete(RADCLIENT_LIST *clients, RADCLIENT *client);
+
+RADCLIENT	*client_afrom_request(RADCLIENT_LIST *clients, REQUEST *request);
+#endif
+
+int		client_map_section(CONF_SECTION *out, CONF_SECTION const *map, client_value_cb_t func, void *data);
+
+RADCLIENT	*client_afrom_cs(TALLOC_CTX *ctx, CONF_SECTION *cs, bool in_server, bool with_coa);
+
+RADCLIENT	*client_afrom_query(TALLOC_CTX *ctx, char const *identifier, char const *secret, char const *shortname,
+				    char const *type, char const *server, bool require_ma)
+		CC_HINT(nonnull(2, 3));
+
+RADCLIENT	*client_find(RADCLIENT_LIST const *clients, fr_ipaddr_t const *ipaddr, int proto);
+
+RADCLIENT	*client_findbynumber(RADCLIENT_LIST const *clients, int number);
+
+RADCLIENT	*client_find_old(fr_ipaddr_t const *ipaddr);
+
+bool		client_add_dynamic(RADCLIENT_LIST *clients, RADCLIENT *master, RADCLIENT *c);
+
+RADCLIENT	*client_read(char const *filename, int in_server, int flag);
+#endif	/* CLIENTS_H */
diff --git a/src/include/conf.h b/src/include/conf.h
new file mode 100644
index 0000000..95005d5
--- /dev/null
+++ b/src/include/conf.h
@@ -0,0 +1,23 @@
+/* Default Database File Names */
+
+#define RADIUS_DIR		RADDBDIR
+#define RADACCT_DIR		RADIR
+#define L_DST_DIR		LOGDIR
+
+#define RADIUS_DICTIONARY	"dictionary"
+#define RADIUS_CLIENTS		"clients"
+#define RADIUS_NASLIST		"naslist"
+#define RADIUS_REALMS		"realms"
+
+#define RADUTMP			LOGDIR "/radutmp"
+#define SRADUTMP		LOGDIR "/sradutmp"
+#define RADWTMP			LOGDIR "/radwtmp"
+#define SRADWTMP		LOGDIR "/sradwtmp"
+
+#ifdef __APPLE__
+#  define LT_SHREXT ".dylib"
+#elif defined (WIN32)
+#  define LT_SHREXT ".dll"
+#else
+#  define LT_SHREXT ".so"
+#endif
diff --git a/src/include/conffile.h b/src/include/conffile.h
new file mode 100644
index 0000000..b996881
--- /dev/null
+++ b/src/include/conffile.h
@@ -0,0 +1,306 @@
+#ifndef _CONFFILE_H
+#define _CONFFILE_H
+
+/*
+ * conffile.h	Defines for the conffile parsing routines.
+ *
+ * Version:	$Id$
+ *
+ */
+
+RCSIDH(conffile_h, "$Id$")
+
+#include <stddef.h>
+#include <freeradius-devel/token.h>
+#include <sys/time.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Export the minimum amount of information about these structs
+ */
+typedef struct conf_item CONF_ITEM;	//!< Generic configuration element, extended to become
+					///< a #CONF_PAIR, a #CONF_SECTION or #CONF_DATA.
+typedef struct conf_pair CONF_PAIR;	//!< #CONF_ITEM with an attribute, an operator and a value.
+typedef struct conf_part CONF_SECTION;	//!< #CONF_ITEM used to group multiple #CONF_PAIR and #CONF_SECTION, together.
+typedef struct conf_data CONF_DATA;	//!< #CONF_ITEM used to associate arbitrary data
+					///< with a #CONF_PAIR or #CONF_SECTION.
+
+
+typedef void conf_type_mismatch;	//!< Dummy type used to indicate PW_TYPE_*/C type mismatch.
+typedef void conf_type_invalid;		//!< Dummy type used to indicate invalid PW_TYPE_*.
+
+#if defined(HAVE_BUILTIN_CHOOSE_EXPR) && defined(HAVE_BUILTIN_TYPES_COMPATIBLE_P)
+/*
+ * Dumb hack for GCC which explodes with lots of errors masking the real
+ * error cause, if we don't use typdefs for these structures.
+ */
+typedef struct timeval _timeval_t;
+
+/** Check the type #_t matches the destination data type
+ *
+ * Validation macro to check the type of the pointer or offset #_p passed in
+ * matches the type #_t of the configuration item.
+ *
+ * Uses various magic builtin precompilation functions, so will likely only
+ * work with recent versions of clang and gcc.
+ *
+ * @note The warnings/errors emitted are usually awful.
+ *
+ * @param _t a #PW_TYPE value with optional PW_TYPE_* flags.
+ * @param _ct data type of global or struct field, obtained with ``__typeof__``.
+ * @param _p Pointer or offset.
+ */
+#  define FR_CONF_TYPE_CHECK(_t, _ct, _p) \
+	__builtin_choose_expr((_t & PW_TYPE_TMPL),\
+		__builtin_choose_expr(__builtin_types_compatible_p(vp_tmpl_t **, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_STRING),\
+		__builtin_choose_expr(__builtin_types_compatible_p(char const **, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_BOOLEAN),\
+		__builtin_choose_expr(__builtin_types_compatible_p(bool *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_SUBSECTION),\
+		_p,\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_INTEGER),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint32_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV4_ADDR),\
+		__builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_DATE),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint32_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_ABINARY),\
+		__builtin_choose_expr(__builtin_types_compatible_p(size_t[32/sizeof(size_t)], _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_OCTETS),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint8_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IFID),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint8_t[8], _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV6_ADDR),\
+		__builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV6_PREFIX),\
+		__builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_BYTE),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint8_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_SHORT),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint16_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_ETHERNET),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint8_t[6], _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_SIGNED),\
+		__builtin_choose_expr(__builtin_types_compatible_p(int32_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_COMBO_IP_ADDR),\
+		__builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_INTEGER64),\
+		__builtin_choose_expr(__builtin_types_compatible_p(uint64_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_IPV4_PREFIX),\
+		__builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_TIMEVAL),\
+		__builtin_choose_expr(__builtin_types_compatible_p(_timeval_t *, _ct), _p, (conf_type_mismatch) 0),\
+	__builtin_choose_expr((((_t) & 0xff) == PW_TYPE_COMBO_IP_PREFIX),\
+		__builtin_choose_expr(__builtin_types_compatible_p(fr_ipaddr_t *, _ct), _p, (conf_type_mismatch) 0),\
+		(conf_type_invalid) 0\
+	)))))))))))))))))))))
+
+#  define FR_CONF_OFFSET(_t, _s, _f)	_t, FR_CONF_TYPE_CHECK((_t), __typeof__(&(((_s *)NULL)->_f)), offsetof(_s, _f)), NULL
+#  define FR_CONF_POINTER(_t, _p)	_t, 0, FR_CONF_TYPE_CHECK((_t), __typeof__(_p), _p)
+#  define FR_ITEM_POINTER(_t, _p)	_t, FR_CONF_TYPE_CHECK((_t), __typeof__(_p), _p)
+#else
+#  define FR_CONF_OFFSET(_t, _s, _f)	_t, offsetof(_s, _f), NULL
+#  define FR_CONF_POINTER(_t, _p)	_t, 0, _p
+#  define FR_ITEM_POINTER(_t, _p)	_t, _p
+#endif
+
+#define FR_CONF_DEPRECATED(_t, _p, _f) (_t) | PW_TYPE_DEPRECATED, 0, NULL
+
+/*
+ *  Instead of putting the information into a configuration structure,
+ *  the configuration file routines MAY just parse it directly into
+ *  user-supplied variables.
+ */
+#define PW_TYPE_SUBSECTION	102
+
+/** @name #CONF_PARSER type flags
+ *
+ * These flags should be or'd with another PW_TYPE_* value to create validation
+ * rules for the #cf_item_parse function.
+ *
+ * @note File PW_TYPE_FILE_* types have a base type of string, so they're validated
+ *	 correctly by the config parser.
+ * @{
+ */
+#define PW_TYPE_DEPRECATED	(1 << 10) //!< If a matching #CONF_PAIR is found, error out with a deprecated message.
+#define PW_TYPE_REQUIRED	(1 << 11) //!< Error out if no matching #CONF_PAIR is found, and no dflt value is set.
+#define PW_TYPE_ATTRIBUTE	(1 << 12) //!< Value must resolve to attribute in dict (deprecated, use #PW_TYPE_TMPL).
+#define PW_TYPE_SECRET		(1 << 13) //!< Only print value if debug level >= 3.
+
+#define PW_TYPE_FILE_INPUT	((1 << 14) | PW_TYPE_STRING) //!< File matching value must exist, and must be readable.
+#define PW_TYPE_FILE_OUTPUT	((1 << 15) | PW_TYPE_STRING) //!< File matching value must exist, and must be writeable.
+
+#define PW_TYPE_XLAT		(1 << 16) //!< string will be dynamically expanded.
+#define PW_TYPE_TMPL		(1 << 17) //!< CONF_PAIR should be parsed as a template.
+
+#define PW_TYPE_MULTI		(1 << 18) //!< CONF_PAIR can have multiple copies.
+#define PW_TYPE_NOT_EMPTY	(1 << 19) //!< CONF_PAIR is required to have a non zero length value.
+#define PW_TYPE_FILE_EXISTS	((1 << 20) | PW_TYPE_STRING) //!< File matching value must exist
+/* @} **/
+
+#define FR_INTEGER_COND_CHECK(_name, _var, _cond, _new)\
+do {\
+	if (!(_cond)) {\
+		WARN("Ignoring \"" _name " = %i\", forcing to \"" _name " = %i\"", _var, _new);\
+		_var = _new;\
+	}\
+} while (0)
+
+#define FR_INTEGER_BOUND_CHECK(_name, _var, _op, _bound) FR_INTEGER_COND_CHECK(_name, _var, (_var _op _bound), _bound)
+
+#define FR_TIMEVAL_BOUND_CHECK(_name, _var, _op, _bound_sec, _bound_usec)\
+do {\
+	struct timeval _bound = {_bound_sec, _bound_usec};\
+	if (!timercmp(_var, &_bound, _op)) {\
+		WARN("Ignoring \"" _name " = %d.%.06d\", forcing to \"" _name " = %d.%06d\"",\
+			(int)(_var)->tv_sec, (int)(_var)->tv_usec,\
+			(int)_bound.tv_sec, (int)_bound.tv_usec);\
+		*_var = _bound;\
+	}\
+} while (0)
+
+#define FR_TIMEVAL_TO_MS(_x) (((_x)->tv_usec * 1000) + ((_x)->tv_sec / 1000))
+extern bool 			check_config;
+
+/** Defines a #CONF_PAIR to C data type mapping
+ *
+ * Is typically used to define mappings between module sections, and module instance structs.
+ * May also be used to set global configuration options.
+ *
+ * Offset/data values should be set using #FR_CONF_OFFSET or #FR_CONF_POINTER.
+ *
+ * Example with #FR_CONF_OFFSET :
+ @code{.c}
+   static CONF_PARSER module_config[] = {
+   	{ "example", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, example_instance_t, example), "default_value" },
+   	CONF_PARSER_TERMINATOR
+   }
+ @endcode
+ *
+ * Example with #FR_CONF_POINTER :
+ @code{.c}
+   static CONF_PARSER global_config[] = {
+   	{ "example", FR_CONF_POINTER(PW_TYPE_STRING | PW_TYPE_NOT_EMPTY, &my_global), "default_value" },
+   	CONF_PARSER_TERMINATOR
+   }
+ @endcode
+ *
+ * @see FR_CONF_OFFSET
+ * @see FR_CONF_POINTER
+ * @see cf_section_parse
+ * @see cf_item_parse
+ */
+typedef struct CONF_PARSER {
+	char const	*name;			//!< Name of the #CONF_ITEM to parse.
+	int		type;			//!< A #PW_TYPE value, may be or'd with one or more PW_TYPE_* flags.
+						//!< @see cf_item_parse.
+
+	size_t		offset;			//!< Relative offset of field or structure to write the parsed value to.
+						//!< When #type is set to #PW_TYPE_SUBSECTION, may be used to specify
+						//!< a base offset to add to all offsets contained within the
+						//!< subsection.
+						//!< @note Must be used exclusively to #data.
+
+	void		*data;			//!< Pointer to a static variable to write the parsed value to.
+						//!< @note Must be used exclusively to #offset.
+
+	const void	*dflt;			//!< Default as it would appear in radiusd.conf.
+						//!< When #type is set to #PW_TYPE_SUBSECTION, should be a pointer
+						//!< to the start of another array of #CONF_PARSER structs, forming
+						//!< the subsection.
+} CONF_PARSER;
+
+#define CONF_PARSER_TERMINATOR	{ NULL, -1, 0, NULL, NULL }
+
+CONF_PAIR	*cf_pair_alloc(CONF_SECTION *parent, char const *attr, char const *value,
+			       FR_TOKEN op, FR_TOKEN lhs_type, FR_TOKEN rhs_type);
+CONF_PAIR	*cf_pair_dup(CONF_SECTION *parent, CONF_PAIR *cp);
+void		cf_pair_add(CONF_SECTION *parent, CONF_PAIR *cp);
+
+CONF_SECTION	*cf_section_alloc(CONF_SECTION *parent, char const *name1, char const *name2);
+CONF_SECTION	*cf_section_dup(CONF_SECTION *parent, CONF_SECTION const *cs,
+				char const *name1, char const *name2, bool copy_meta);
+void		cf_section_add(CONF_SECTION *parent, CONF_SECTION *cs);
+int		cf_pair_replace(CONF_SECTION *cs, CONF_PAIR *cp, char const *value);
+int		cf_item_parse(CONF_SECTION *cs, char const *name, unsigned int type, void *data, char const *dflt);
+int		cf_section_parse(CONF_SECTION *, void *base, CONF_PARSER const *variables);
+int		cf_section_parse_pass2(CONF_SECTION *, void *base, CONF_PARSER const *variables);
+const CONF_PARSER *cf_section_parse_table(CONF_SECTION *cs);
+int		cf_file_read(CONF_SECTION *cs, char const *file);
+void		cf_file_free(CONF_SECTION *cs);
+
+CONF_PAIR	*cf_pair_find(CONF_SECTION const *, char const *name);
+CONF_PAIR	*cf_pair_find_next(CONF_SECTION const *, CONF_PAIR const *, char const *name);
+CONF_SECTION	*cf_section_find(char const *name);
+CONF_SECTION	*cf_section_find_name2(CONF_SECTION const *section,
+				       char const *name1, char const *name2);
+CONF_SECTION	*cf_section_sub_find(CONF_SECTION const *, char const *name);
+CONF_SECTION	*cf_section_sub_find_name2(CONF_SECTION const *, char const *name1, char const *name2);
+char const 	*cf_section_value_find(CONF_SECTION const *, char const *attr);
+CONF_SECTION	*cf_top_section(CONF_SECTION *cs);
+
+void *cf_data_find(CONF_SECTION const *, char const *);
+int cf_data_add(CONF_SECTION *, char const *, void *, void (*)(void *));
+void *cf_data_remove(CONF_SECTION *cs, char const *name);
+
+char const *cf_pair_attr(CONF_PAIR const *pair);
+char const *cf_pair_value(CONF_PAIR const *pair);
+FR_TOKEN cf_pair_operator(CONF_PAIR const *pair);
+FR_TOKEN cf_pair_attr_type(CONF_PAIR const *pair);
+FR_TOKEN cf_pair_value_type(CONF_PAIR const *pair);
+VALUE_PAIR *cf_pairtovp(CONF_PAIR *pair);
+char const *cf_section_name1(CONF_SECTION const *cs);
+char const *cf_section_name2(CONF_SECTION const *cs);
+char const *cf_section_name(CONF_SECTION const *cs);
+FR_TOKEN cf_section_name2_type(CONF_SECTION const *cs);
+int dump_config(CONF_SECTION const *cs);
+CONF_SECTION *cf_subsection_find_next(CONF_SECTION const *section,
+				      CONF_SECTION const *subsection,
+				      char const *name1);
+CONF_SECTION *cf_section_find_next(CONF_SECTION const *section,
+				   CONF_SECTION const *subsection,
+				   char const *name1);
+int cf_section_lineno(CONF_SECTION const *section);
+int cf_pair_lineno(CONF_PAIR const *pair);
+char const *cf_pair_filename(CONF_PAIR const *pair);
+char const *cf_section_filename(CONF_SECTION const *section);
+CONF_ITEM *cf_item_find_next(CONF_SECTION const *section, CONF_ITEM const *item);
+int cf_pair_count(CONF_SECTION const *cs);
+CONF_SECTION *cf_item_parent(CONF_ITEM const *ci);
+bool cf_item_is_section(CONF_ITEM const *item);
+bool cf_item_is_pair(CONF_ITEM const *item);
+bool cf_item_is_data(CONF_ITEM const *item);
+CONF_PAIR *cf_item_to_pair(CONF_ITEM const *item);
+CONF_SECTION *cf_item_to_section(CONF_ITEM const *item);
+CONF_ITEM *cf_pair_to_item(CONF_PAIR const *cp);
+CONF_ITEM *cf_section_to_item(CONF_SECTION const *cs);
+
+void cf_log_err(CONF_ITEM const *ci, char const *fmt, ...)		CC_HINT(format (printf, 2, 3));
+void cf_log_err_cs(CONF_SECTION const *cs, char const *fmt, ...)	CC_HINT(format (printf, 2, 3));
+void cf_log_err_cp(CONF_PAIR const *cp, char const *fmt, ...)		CC_HINT(format (printf, 2, 3));
+void cf_log_info(CONF_SECTION const *cs, char const *fmt, ...)		CC_HINT(format (printf, 2, 3));
+void cf_log_module(CONF_SECTION const *cs, char const *fmt, ...)	CC_HINT(format (printf, 2, 3));
+
+void cf_item_add(CONF_SECTION *cs, CONF_ITEM *ci);
+CONF_ITEM *cf_reference_item(CONF_SECTION const *parentcs,
+			     CONF_SECTION *outercs,
+			     char const *ptr);
+
+#define CF_FILE_NONE   (0)
+#define CF_FILE_ERROR  (1)
+#define CF_FILE_CONFIG (1 << 2)
+#define CF_FILE_MODULE (1 << 3)
+int cf_file_changed(CONF_SECTION *cs, rb_walker_t callback);
+
+extern CONF_SECTION *root_config;
+extern bool cf_new_escape;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _CONFFILE_H */
diff --git a/src/include/connection.h b/src/include/connection.h
new file mode 100644
index 0000000..1fd4be4
--- /dev/null
+++ b/src/include/connection.h
@@ -0,0 +1,131 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_CONNECTION_H
+#define FR_CONNECTION_H
+/**
+ * $Id$
+ *
+ * @file connection.h
+ * @brief Structures, prototypes and global variables for server connection pools.
+ *
+ * @copyright 2012  The FreeRADIUS server project
+ * @copyright 2012  Alan DeKok <aland@deployingradius.com>
+ */
+
+RCSIDH(connection_h, "$Id$")
+
+#include <freeradius-devel/conffile.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct fr_connection_pool_t fr_connection_pool_t;
+
+/** Create a new connection handle
+ *
+ * This function will be called whenever the connection pool manager needs
+ * to spawn a new connection, and on reconnect.
+ *
+ * Memory should be talloced in the parent context to hold the module's
+ * connection structure. The parent context is allocated in the NULL
+ * context, but will be freed when fr_connection_t is freed.
+ *
+ * There is no delete callback, so operations such as closing sockets and
+ * freeing library connection handles should be done by a destructor attached
+ * to memory allocated beneath ctx.
+ *
+ * @note A function pointer matching this prototype must be passed
+ * to fr_connection_pool_init.
+ *
+ * @param[in,out] ctx to allocate memory in.
+ * @param[in] opaque pointer passed to fr_connection_pool_init.
+ * @return NULL on error, else a connection handle.
+ */
+typedef void *(*fr_connection_create_t)(TALLOC_CTX *ctx, void *opaque);
+
+/** Check a connection handle is still viable
+ *
+ * Should check the state  of a connection handle.
+ *
+ * @note NULL may be passed to fr_connection_pool_init, if there is no way to check
+ * the state of a connection handle.
+ * @note Not currently use by connection pool manager.
+ * @param[in] opaque pointer passed to fr_connection_pool_init.
+ * @param[in] connection handle returned by fr_connection_create_t.
+ * @return < 0 on error or if the connection is unusable, else 0.
+ */
+typedef int (*fr_connection_alive_t)(void *opaque, void *connection);
+
+/*
+ *	Pool allocation/initialisation
+ */
+fr_connection_pool_t	*fr_connection_pool_module_init(CONF_SECTION *module,
+							void *opaque,
+							fr_connection_create_t c,
+							fr_connection_alive_t a,
+							char const *prefix);
+
+/*
+ *	Pool getters
+ */
+int	fr_connection_pool_get_num(fr_connection_pool_t *pool);
+
+int	fr_connection_pool_get_retries(fr_connection_pool_t *pool);
+
+/*
+ *	Pool management
+ */
+void	fr_connection_pool_free(fr_connection_pool_t *pool);
+
+/*
+ *	Connection lifecycle
+ */
+void	*fr_connection_get(fr_connection_pool_t *pool);
+
+void	fr_connection_release(fr_connection_pool_t *pool, void *conn);
+
+void	*fr_connection_reconnect(fr_connection_pool_t *pool, void *conn);
+
+int	fr_connection_close(fr_connection_pool_t *pool, void *conn, char const *msg);
+
+typedef struct {
+	time_t		last_checked;		//!< Last time we pruned the connection pool.
+	time_t		last_opened;		//!< Last time we opened a connection.
+	time_t		last_closed;		//!< Last time we closed a connection.
+	time_t		last_failed;		//!< Last time we tried to spawn a connection but failed.
+	time_t		last_throttled;		//!< Last time we refused to spawn a connection because
+						//!< the last connection failed, or we were already spawning
+						//!< a connection.
+	time_t		last_at_max;		//!< Last time we hit the maximum number of allowed
+						//!< connections.
+
+	uint64_t	opened;	       		//!< Number of connections opened over the lifetime
+						//!< of the pool.
+	uint64_t	closed;			//!< Number of connections which were closed for this pool
+	uint64_t	failed;			//!< Number of failed connections for this pool.
+
+	uint32_t       	num;			//!< Number of connections in the pool.
+	uint32_t	active;	 		//!< Number of currently reserved connections.
+} fr_connection_pool_stats_t;
+
+fr_connection_pool_stats_t const *fr_connection_pool_stats(CONF_SECTION *cs);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_CONNECTION_H*/
diff --git a/src/include/detail.h b/src/include/detail.h
new file mode 100644
index 0000000..5b5539b
--- /dev/null
+++ b/src/include/detail.h
@@ -0,0 +1,97 @@
+#ifndef DETAIL_H
+#define DETAIL_H
+/*
+ *	detail.h	Routines to handle detail files.
+ *
+ * Version:	$Id$
+ *
+ */
+
+RCSIDH(detail_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum detail_state_t {
+	STATE_UNOPENED = 0,
+	STATE_UNLOCKED,
+	STATE_HEADER,
+	STATE_READING,
+	STATE_QUEUED,
+	STATE_RUNNING,
+	STATE_NO_REPLY,
+	STATE_REPLIED
+} detail_state_t;
+
+/*
+ *	Allow people to revert to the old behavior if desired.
+ *	Also, use the old code if we don't have threads.
+ *	FIXME: delete the old (crappy) code, and enable the new
+ *	code to work without threads.  One thing at a time...
+ */
+#ifndef WITHOUT_DETAIL_THREAD
+#  ifdef HAVE_PTHREAD_H
+#    define WITH_DETAIL_THREAD (1)
+#  endif
+#endif
+
+typedef struct listen_detail_t {
+	fr_event_t	*ev;	/* has to be first entry (ugh) */
+	char const 	*name;			//!< Identifier used in log messages
+	int		delay_time;
+	char const	*filename;
+	char const	*filename_work;
+
+	TALLOC_CTX	*ctx;
+	VALUE_PAIR	*vps;
+	int		work_fd;
+
+#ifdef WITH_DETAIL_THREAD
+	int		master_pipe[2];
+	int		child_pipe[2];
+	pthread_t	pthread_id;
+#endif
+
+	FILE		*fp;
+	off_t		offset;
+	detail_state_t 	state;
+	time_t		timestamp;
+	time_t		running;
+	fr_ipaddr_t	client_ip;
+
+	off_t		last_offset;
+	off_t		timestamp_offset;
+	bool		done_entry;		//!< Are we done reading this entry?
+	bool		track;			//!< Do we track progress through the file?
+
+	uint32_t	load_factor; /* 1..100 */
+	uint32_t	poll_interval;
+	uint32_t	retry_interval;
+
+	int		signal;
+	int		packets;
+	int		tries;
+	bool		one_shot;
+	int		outstanding;
+	int		has_rtt;
+	int		srtt;
+	int		rttvar;
+	uint32_t	counter;
+	struct timeval  last_packet;
+	RADCLIENT	detail_client;
+} listen_detail_t;
+
+int detail_recv(rad_listen_t *listener);
+int detail_send(rad_listen_t *listener, REQUEST *request);
+void detail_free(rad_listen_t *this);
+int detail_print(rad_listen_t const *this, char *buffer, size_t bufsize);
+int detail_encode(UNUSED rad_listen_t *this, UNUSED REQUEST *request);
+int detail_decode(UNUSED rad_listen_t *this, UNUSED REQUEST *request);
+int detail_parse(CONF_SECTION *cs, rad_listen_t *this);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* DETAIL_H */
diff --git a/src/include/dhcp.h b/src/include/dhcp.h
new file mode 100644
index 0000000..01fa781
--- /dev/null
+++ b/src/include/dhcp.h
@@ -0,0 +1,85 @@
+#ifndef FR_DHCP_H
+#define FR_DHCP_H
+
+/*
+ * dhcp.h	Structures and prototypes for DHCP.
+ *		Why DHCP in a RADIUS server?
+ *		Why not?
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2008 The FreeRADIUS server project
+ * Copyright 2008 Alan DeKok <aland@deployingradius.com>
+ */
+RCSIDH(dhcp_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	Not for production use.
+ */
+RADIUS_PACKET *fr_dhcp_recv(int sockfd);
+int fr_dhcp_send(RADIUS_PACKET *packet);
+
+int fr_dhcp_add_arp_entry(int fd, char const *interface, VALUE_PAIR *hwvp, VALUE_PAIR *clvp);
+
+int8_t fr_dhcp_attr_cmp(void const *a, void const *b);
+ssize_t fr_dhcp_encode_option(TALLOC_CTX *ctx, uint8_t *out, size_t outlen, vp_cursor_t *cursor);
+int fr_dhcp_encode(RADIUS_PACKET *packet);
+ssize_t fr_dhcp_decode_options(TALLOC_CTX *ctx, VALUE_PAIR **out, uint8_t const *data, size_t len);
+int fr_dhcp_decode(RADIUS_PACKET *packet);
+
+#ifdef HAVE_LINUX_IF_PACKET_H
+#include <linux/if_packet.h>
+int fr_socket_packet(int iface_index, struct sockaddr_ll *p_ll);
+int fr_dhcp_send_raw_packet(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *packet);
+RADIUS_PACKET *fr_dhcp_recv_raw_packet(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *request);
+#endif
+
+/*
+ *	This is a horrible hack.
+ */
+#define PW_DHCP_OFFSET		(1024)
+#define PW_DHCP_DISCOVER	(1024 + 1)
+#define PW_DHCP_OFFER		(1024 + 2)
+#define PW_DHCP_REQUEST		(1024 + 3)
+#define PW_DHCP_DECLINE		(1024 + 4)
+#define PW_DHCP_ACK		(1024 + 5)
+#define PW_DHCP_NAK		(1024 + 6)
+#define PW_DHCP_RELEASE		(1024 + 7)
+#define PW_DHCP_INFORM		(1024 + 8)
+#define PW_DHCP_LEASE_QUERY    	(1024 + 10)
+
+#define DHCP_MAGIC_VENDOR (54)
+
+#define PW_DHCP_OPTION_82 (82)
+#define DHCP_PACK_OPTION1(x,y) ((x) | ((y) << 8))
+#define DHCP_BASE_ATTR(x) (x & 0xff)
+#define DHCP_UNPACK_OPTION1(x) (((x) & 0xff00) >> 8)
+
+#define PW_DHCP_MESSAGE_TYPE   (53)
+#define PW_DHCP_YOUR_IP_ADDRESS (264)
+#define PW_DHCP_SUBNET_MASK    (1)
+#define PW_DHCP_IP_ADDRESS_LEASE_TIME (51)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_DHCP_H */
diff --git a/src/include/event.h b/src/include/event.h
new file mode 100644
index 0000000..0409728
--- /dev/null
+++ b/src/include/event.h
@@ -0,0 +1,67 @@
+#ifndef FR_EVENT_H
+#define FR_EVENT_H
+
+/*
+ * event.h	Simple event queue
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2007 The FreeRADIUS server project
+ * Copyright 2007 Alan DeKok <aland@deployingradius.com>
+ */
+
+RCSIDH(event_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct fr_event_list_t fr_event_list_t;
+typedef struct fr_event_t fr_event_t;
+
+typedef	void (*fr_event_callback_t)(void *);
+typedef	void (*fr_event_status_t)(struct timeval *);
+typedef void (*fr_event_fd_handler_t)(fr_event_list_t *el, int sock, void *ctx);
+
+fr_event_list_t *fr_event_list_create(TALLOC_CTX *ctx, fr_event_status_t status);
+
+int fr_event_list_num_fds(fr_event_list_t *el);
+int fr_event_list_num_elements(fr_event_list_t *el);
+
+int fr_event_insert(fr_event_list_t *el,
+		    fr_event_callback_t callback,
+		    void *ctx, struct timeval *when, fr_event_t **parent);
+int fr_event_delete(fr_event_list_t *el, fr_event_t **parent);
+
+int fr_event_run(fr_event_list_t *el, struct timeval *when);
+
+int fr_event_now(fr_event_list_t *el, struct timeval *when);
+
+int fr_event_fd_insert(fr_event_list_t *el, int type, int fd,
+			 fr_event_fd_handler_t handler, void *ctx);
+int fr_event_fd_write_handler(fr_event_list_t *el, int type, int fd,
+			      fr_event_fd_handler_t write_handler, void *ctx);
+int fr_event_fd_delete(fr_event_list_t *el, int type, int fd);
+int fr_event_loop(fr_event_list_t *el);
+void fr_event_loop_exit(fr_event_list_t *el, int code);
+bool fr_event_loop_exiting(fr_event_list_t *el);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_HASH_H */
diff --git a/src/include/exfile.h b/src/include/exfile.h
new file mode 100644
index 0000000..febe2e6
--- /dev/null
+++ b/src/include/exfile.h
@@ -0,0 +1,45 @@
+/*
+ *   This library is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU Lesser General Public
+ *   License as published by the Free Software Foundation; either
+ *   version 2.1 of the License, or (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ *   Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public
+ *   License along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef EXFILE_H
+#define EXFILE_H
+/*
+ * $Id$
+ *
+ * @file exfile.h
+ * @brief Functions for managing concurrent file access.
+ *
+ * @copyright 2014 The FreeRADIUS server project
+ */
+RCSIDH(exfile_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/*
+ *	Multiple threads logging to one or more files.
+ */
+typedef struct exfile_t exfile_t;
+
+exfile_t *exfile_init(TALLOC_CTX *ctx, uint32_t entries, uint32_t idle, bool locking);
+int exfile_open(exfile_t *lf, char const *filename, mode_t permissions, off_t *offset);
+int exfile_close(exfile_t *lf, int fd);
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/src/include/features-h b/src/include/features-h
new file mode 100644
index 0000000..158541f
--- /dev/null
+++ b/src/include/features-h
@@ -0,0 +1,97 @@
+/*
+ *	New defines for minimizing the size of the server, to strip
+ *	out functionality.
+ *
+ *	This is a hack and should be removed when the protocols are moved
+ *	into individual modules.
+ */
+#ifndef WITHOUT_PROXY
+#  define WITH_PROXY (1)
+#else
+#  define WITHOUT_COA (1)
+#endif
+
+#ifndef WITHOUT_UNLANG
+#  define WITH_UNLANG (1)
+#endif
+
+#ifndef WITHOUT_ACCOUNTING
+#  define WITH_ACCOUNTING (1)
+#endif
+
+#ifdef WITH_ACCOUNTING
+#  ifndef WITHOUT_DETAIL
+#    define WITH_DETAIL (1)
+#  endif
+#endif
+
+#ifdef WITH_ACCOUNTING
+#  ifndef WITHOUT_SESSION_MGMT
+#    define WITH_SESSION_MGMT (1)
+#  endif
+#endif
+
+#ifndef WITHOUT_DYNAMIC_CLIENTS
+#  define WITH_DYNAMIC_CLIENTS (1)
+#endif
+
+#ifndef WITHOUT_STATS
+#  define WITH_STATS
+#endif
+
+#ifndef WITHOUT_COMMAND_SOCKET
+#  ifdef HAVE_SYS_UN_H
+#    define WITH_COMMAND_SOCKET (1)
+#  endif
+#endif
+
+#ifndef WITHOUT_COA
+#  define WITH_COA (1)
+#  ifndef WITH_PROXY
+#    error WITH_COA requires WITH_PROXY
+#  endif
+#endif
+
+#ifdef WITHOUT_TLS
+#  ifndef HAVE_OPENSSL_SSL_H
+#    error TLS requires OpenSSL
+#  endif
+#else
+#  ifdef HAVE_OPENSSL_SSL_H
+#    ifndef WITH_TLS
+#      ifndef NO_OPENSSL
+#        define WITH_TLS (1)
+#      endif
+#    endif
+#  endif
+#endif
+
+#ifdef WITH_TLS
+#  ifdef WITH_COA
+#    ifndef WITHOUT_COA_TUNNEL
+#      define WITH_COA_TUNNEL (1)
+#    endif
+#  endif
+#endif
+
+#ifdef WITH_COA_TUNNEL
+#  ifdef WITHOUT_TLS
+#    error Reverse CoA requests requires TLS
+#  endif
+#endif
+
+#ifdef WITH_RADIUSV11_ONLY
+#  define WITH_RADIUSV11
+#else
+#  ifndef WITHOUT_RADIUSV11
+#    ifdef WITH_TLS
+//#      define WITH_RADIUSV11
+#    endif
+#  endif
+#endif
+
+#ifdef WITH_RADIUSV11
+#  ifndef WITH_TLS
+#    error RADIUSv11 requires TLS
+#  endif
+#endif
diff --git a/src/include/hash.h b/src/include/hash.h
new file mode 100644
index 0000000..71c8658
--- /dev/null
+++ b/src/include/hash.h
@@ -0,0 +1,75 @@
+#ifndef FR_HASH_H
+#define FR_HASH_H
+
+/*
+ * hash.h	Structures and prototypes
+ *		for fast hashing.
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2005,2006  The FreeRADIUS server project
+ */
+
+RCSIDH(hash_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	Fast hash, which isn't too bad.  Don't use for cryptography,
+ *	just for hashing internal data.
+ */
+uint32_t fr_hash(void const *, size_t);
+uint32_t fr_hash_update(void const *data, size_t size, uint32_t hash);
+uint32_t fr_hash_string(char const *p);
+
+typedef struct fr_hash_table_t fr_hash_table_t;
+typedef void (*fr_hash_table_free_t)(void *);
+typedef uint32_t (*fr_hash_table_hash_t)(void const *);
+typedef int (*fr_hash_table_cmp_t)(void const *, void const *);
+typedef int (*fr_hash_table_walk_t)(void * /* ctx */, void * /* data */);
+
+fr_hash_table_t *fr_hash_table_create(fr_hash_table_hash_t hashNode,
+					  fr_hash_table_cmp_t cmpNode,
+					  fr_hash_table_free_t freeNode);
+void		fr_hash_table_free(fr_hash_table_t *ht);
+int		fr_hash_table_insert(fr_hash_table_t *ht, void const *data);
+int		fr_hash_table_delete(fr_hash_table_t *ht, void const *data);
+void		*fr_hash_table_yank(fr_hash_table_t *ht, void const *data);
+int		fr_hash_table_replace(fr_hash_table_t *ht, void const *data);
+void		*fr_hash_table_finddata(fr_hash_table_t *ht, void const *data);
+int		fr_hash_table_num_elements(fr_hash_table_t *ht);
+int		fr_hash_table_walk(fr_hash_table_t *ht,
+				     fr_hash_table_walk_t callback,
+				     void *ctx);
+
+typedef struct fr_hash_entry_s fr_hash_entry_t;
+
+typedef struct fr_hash_iter_s {
+	uint32_t		bucket;
+	fr_hash_entry_t		*node;
+} fr_hash_iter_t;
+
+void		*fr_hash_table_iter_init(fr_hash_table_t *ht, fr_hash_iter_t *iter);
+void		*fr_hash_table_iter_next(fr_hash_table_t *ht, fr_hash_iter_t *iter);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_HASH_H */
diff --git a/src/include/heap.h b/src/include/heap.h
new file mode 100644
index 0000000..d980adb
--- /dev/null
+++ b/src/include/heap.h
@@ -0,0 +1,46 @@
+#ifndef LRAD_HEAP_H
+#define LRAD_HEAP_H
+
+/*
+ * heap.h	Structures and prototypes for binary heaps.
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2007 Alan DeKok
+ */
+
+RCSIDH(heap_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef int (*fr_heap_cmp_t)(void const *, void const *);
+
+typedef struct fr_heap_t fr_heap_t;
+fr_heap_t *fr_heap_create(fr_heap_cmp_t cmp, size_t offset);
+void fr_heap_delete(fr_heap_t *hp);
+
+int fr_heap_insert(fr_heap_t *hp, void *data);
+int fr_heap_extract(fr_heap_t *hp, void *data);
+void *fr_heap_peek(fr_heap_t *hp);
+int fr_heap_num_elements(fr_heap_t *hp);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* LRAD_HEAP_H */
diff --git a/src/include/libradius.h b/src/include/libradius.h
new file mode 100644
index 0000000..777927e
--- /dev/null
+++ b/src/include/libradius.h
@@ -0,0 +1,967 @@
+/*
+ *   This library is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU Lesser General Public
+ *   License as published by the Free Software Foundation; either
+ *   version 2.1 of the License, or (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ *   Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public
+ *   License along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef LIBRADIUS_H
+#define LIBRADIUS_H
+/*
+ * $Id$
+ *
+ * @file libradius.h
+ * @brief Structures and prototypes for the radius library.
+ *
+ * @copyright 1999-2014 The FreeRADIUS server project
+ */
+RCSIDH(libradius_h, "$Id$")
+
+/*
+ *  Compiler hinting macros.  Included here for 3rd party consumers
+ *  of libradius.h.
+ */
+#include <freeradius-devel/build.h>
+
+/*
+ *  Let any external program building against the library know what
+ *  features the library was built with.
+ */
+#include <freeradius-devel/features.h>
+
+#ifdef WITHOUT_VERSION_CHECK
+#  define RADIUSD_MAGIC_NUMBER	((uint64_t) (0xf4ee4ad3f4ee4ad3))
+#  define MAGIC_PREFIX(_x)	((uint8_t) 0x00)
+#  define MAGIC_VERSION(_x)	((uint32_t) 0x00000000)
+#  define MAGIC_COMMIT(_x)	((uint32_t) 0x00000000)
+#else
+#  ifdef RADIUSD_VERSION_COMMIT
+#    define RADIUSD_MAGIC_NUMBER ((uint64_t) HEXIFY3(f, RADIUSD_VERSION, RADIUSD_VERSION_COMMIT))
+#  else
+#    define RADIUSD_MAGIC_NUMBER ((uint64_t) HEXIFY3(f, RADIUSD_VERSION, 00000))
+#  endif
+#  define MAGIC_PREFIX(_x)	((uint8_t) (_x >> 56))
+#  define MAGIC_VERSION(_x)	((uint32_t) ((_x >> 32) & 0x00ffffff))
+#  define MAGIC_COMMIT(_x)	((uint32_t) (_x & 0xffffffff))
+#endif
+
+/*
+ *  Talloc memory allocation is used in preference to malloc throughout
+ *  the libraries and server.
+ */
+#ifdef HAVE_WDOCUMENTATION
+DIAG_OFF(documentation)
+#endif
+#include <talloc.h>
+#ifdef HAVE_WDOCUMENTATION
+DIAG_ON(documentation)
+#endif
+
+/*
+ *  Defines signatures for any missing functions.
+ */
+#include <freeradius-devel/missing.h>
+
+/*
+ *  Include system headers.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <signal.h>
+
+#ifdef HAVE_LIMITS_H
+#  include <limits.h>
+#endif
+
+#include <freeradius-devel/threads.h>
+#include <freeradius-devel/radius.h>
+#include <freeradius-devel/token.h>
+#include <freeradius-devel/hash.h>
+#include <freeradius-devel/regex.h>
+
+#ifdef SIZEOF_UNSIGNED_INT
+#  if SIZEOF_UNSIGNED_INT != 4
+#    error FATAL: sizeof(unsigned int) != 4
+#  endif
+#endif
+
+/*
+ *  Include for modules.
+ */
+#include <freeradius-devel/sha1.h>
+#include <freeradius-devel/md4.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef HAVE_SIG_T
+typedef void (*sig_t)(int);
+#endif
+
+#if defined(WITH_VERIFY_PTR)
+#  define FREE_MAGIC (0xF4EEF4EE)
+
+/*
+ * @FIXME
+ *  Add if (_x->da) (void) talloc_get_type_abort(_x->da, DICT_ATTR);
+ *  to the macro below when dictionaries are talloced.
+ */
+#  define VERIFY_VP(_x)		fr_pair_verify(__FILE__,  __LINE__, _x)
+#  define VERIFY_LIST(_x, _name)	fr_pair_list_verify(__FILE__,  __LINE__, NULL, _x, _name)
+#  define VERIFY_PACKET(_x)	(void) talloc_get_type_abort(_x, RADIUS_PACKET)
+#else
+/*
+ *  Even if were building without WITH_VERIFY_PTR
+ *  the pointer must not be NULL when these various macros are used
+ *  so we can add some sneaky soft asserts.
+ */
+#  define VERIFY_VP(_x)		fr_assert(_x)
+#  define VERIFY_LIST(_x, _name) fr_assert(_x)
+#  define VERIFY_PACKET(_x)	fr_assert(_x)
+#endif
+
+#define AUTH_VECTOR_LEN		16
+#define CHAP_VALUE_LENGTH       16
+#define MAX_STRING_LEN		254	/* RFC2138: string 0-253 octets */
+#define FR_MAX_VENDOR		(1 << 24) /* RFC limitations */
+
+#ifdef _LIBRADIUS
+#  define RADIUS_HDR_LEN	20
+#  define VENDORPEC_USR		429
+#  define VENDORPEC_LUCENT	4846
+#  define VENDORPEC_STARENT	8164
+#  define DEBUG			if (fr_debug_lvl && fr_log_fp) fr_printf_log
+#endif
+
+#  define debug_pair(vp)	do { if (fr_debug_lvl && fr_log_fp) { \
+					vp_print(fr_log_fp, vp); \
+				     } \
+				} while(0)
+
+#define TAG_VALID(x)		((x) > 0 && (x) < 0x20)
+#define TAG_VALID_ZERO(x)	((x) < 0x20)
+#define TAG_ANY			INT8_MIN
+#define TAG_NONE		0
+/** Check if tags are equal
+ *
+ * @param _x tag were matching on.
+ * @param _y tag belonging to the attribute were checking.
+ */
+#define TAG_EQ(_x, _y) ((_x == _y) || (_x == TAG_ANY) || ((_x == TAG_NONE) && (_y == TAG_ANY)))
+#define ATTRIBUTE_EQ(_x, _y) ((_x && _y) && (_x->da == _y->da) && (!_x->da->flags.has_tag || TAG_EQ(_x->tag, _y->tag)))
+
+#define NUM_ANY			INT_MIN
+#define NUM_ALL			(INT_MIN + 1)
+#define NUM_COUNT		(INT_MIN + 2)
+#define NUM_LAST		(INT_MIN + 3)
+
+#define PAD(_x, _y)		(_y - ((_x) % _y))
+
+typedef struct attr_flags {
+	unsigned int 	is_unknown : 1;				//!< Attribute number or vendor is unknown.
+	unsigned int	is_tlv : 1;				//!< Is a sub attribute.
+
+	unsigned int	has_tag : 1;				//!< Tagged attribute.
+	unsigned int	array : 1; 				//!< Pack multiples into 1 attr.
+	unsigned int	has_value : 1;				//!< Has a value.
+	unsigned int	has_value_alias : 1; 			//!< Has a value alias.
+	unsigned int	has_tlv : 1; 				//!< Has sub attributes.
+
+	unsigned int	extended : 1; 				//!< Extended attribute.
+	unsigned int	long_extended : 1; 			//!< Long format.
+	unsigned int	evs : 1;				//!< Extended VSA.
+	unsigned int	wimax: 1;				//!< WiMAX format=1,1,c.
+
+	unsigned int	concat : 1;				//!< concatenate multiple instances
+	unsigned int	is_pointer : 1;				//!< data is a pointer
+
+	unsigned int	virtual : 1;				//!< for dynamic expansion
+
+	unsigned int	compare : 1;				//!< has a paircompare registered
+
+	unsigned int	is_dup : 1;				//!< is a duplicate of another attribute
+
+	unsigned int	secret : 1;				//!< is a secret thingy
+
+	uint8_t		encrypt;      				//!< Ecryption method.
+	uint8_t		length;
+} ATTR_FLAGS;
+
+/*
+ *  Values of the encryption flags.
+ */
+#define FLAG_ENCRYPT_NONE	    (0)
+#define FLAG_ENCRYPT_USER_PASSWORD   (1)
+#define FLAG_ENCRYPT_TUNNEL_PASSWORD (2)
+#define FLAG_ENCRYPT_ASCEND_SECRET   (3)
+
+extern const FR_NAME_NUMBER dict_attr_types[];
+extern const size_t dict_attr_sizes[PW_TYPE_MAX][2];
+extern const int fr_attr_max_tlv;
+extern const int fr_attr_shift[];
+extern const unsigned int fr_attr_mask[];
+
+/** dictionary attribute
+ *
+ */
+typedef struct dict_attr {
+	unsigned int		attr;
+	PW_TYPE			type;
+	unsigned int		vendor;
+	ATTR_FLAGS		flags;
+	char			name[1];
+} DICT_ATTR;
+
+/** value of an enumerated attribute
+ *
+ */
+typedef struct dict_value {
+	unsigned int		attr;
+	unsigned int		vendor;
+	int			value;
+	char			name[1];
+} DICT_VALUE;
+
+/** dictionary vendor
+ *
+ */
+typedef struct dict_vendor {
+	unsigned int		vendorpec;
+	size_t			type; 				//!< Length of type data
+	size_t			length;				//!< Length of length data
+	size_t			flags;
+	char			name[1];
+} DICT_VENDOR;
+
+/** Union containing all data types supported by the server
+ *
+ * This union contains all data types that can be represented by VALUE_PAIRs. It may also be used in other parts
+ * of the server where values of different types need to be stored.
+ *
+ * PW_TYPE should be an enumeration of the values in this union.
+ */
+typedef union value_data {
+	char const	        *strvalue;			//!< Pointer to UTF-8 string.
+	uint8_t const		*octets;			//!< Pointer to binary string.
+	uint32_t		integer;			//!< 32bit unsigned integer.
+	struct in_addr		ipaddr;				//!< IPv4 Address.
+	uint32_t		date;				//!< Date (32bit Unix timestamp).
+	size_t			filter[32/sizeof(size_t)];	//!< Ascend binary format a packed data
+								//!< structure.
+
+	uint8_t			ifid[8];			//!< IPv6 interface ID (should be struct?).
+	struct in6_addr		ipv6addr;			//!< IPv6 Address.
+	uint8_t			ipv6prefix[18];			//!< IPv6 prefix (should be struct?).
+
+	uint8_t			byte;				//!< 8bit unsigned integer.
+	uint16_t		ushort;				//!< 16bit unsigned integer.
+
+	uint8_t			ether[6];			//!< Ethernet (MAC) address.
+
+	int32_t			sinteger;			//!< 32bit signed integer.
+	uint64_t		integer64;			//!< 64bit unsigned integer.
+
+	uint8_t			ipv4prefix[6];			//!< IPv4 prefix (should be struct?).
+
+	void			*ptr;				//!< generic pointer.
+} value_data_t;
+
+/** The type of value a VALUE_PAIR contains
+ *
+ * This is used to add structure to nested VALUE_PAIRs and specifies what type of node it is (set, list, data).
+ *
+ * xlat is another type of data node which must first be expanded before use.
+ */
+typedef enum value_type {
+	VT_NONE = 0,						//!< VALUE_PAIR has no value.
+	VT_SET,							//!< VALUE_PAIR has children.
+	VT_LIST,						//!< VALUE_PAIR has multiple values.
+	VT_DATA,						//!< VALUE_PAIR has a single value.
+	VT_XLAT							//!< valuepair value must be xlat expanded when it's
+								//!< added to VALUE_PAIR tree.
+} value_type_t;
+
+/** Stores an attribute, a value and various bits of other data
+ *
+ * VALUE_PAIRs are the main data structure used in the server
+ *
+ * They also specify what behaviour should be used when the attribute is merged into a new list/tree.
+ */
+typedef struct value_pair {
+	DICT_ATTR const		*da;				//!< Dictionary attribute defines the attribute
+								//!< number, vendor and type of the attribute.
+
+	struct value_pair	*next;
+
+	FR_TOKEN		op;				//!< Operator to use when moving or inserting
+								//!< valuepair into a list.
+
+	int8_t			tag;				//!< Tag value used to group valuepairs.
+
+	union {
+	//	VALUE_SET	*set;				//!< Set of child attributes.
+	//	VALUE_LIST	*list;				//!< List of values for
+								//!< multivalued attribute.
+	//	value_data_t	*data;				//!< Value data for this attribute.
+
+		char const 	*xlat;				//!< Source string for xlat expansion.
+	} value;
+
+	value_type_t		type;				//!< Type of pointer in value union.
+
+	size_t			length;				//!< of Data field.
+	value_data_t		data;
+} VALUE_PAIR;
+
+/** Abstraction to allow iterating over different configurations of VALUE_PAIRs
+ *
+ * This allows functions which do not care about the structure of collections of VALUE_PAIRs
+ * to iterate over all members in a collection.
+ *
+ * Field within a vp_cursor should not be accessed directly, and vp_cursors should only be
+ * manipulated with the pair* functions.
+ */
+typedef struct vp_cursor {
+	VALUE_PAIR	**first;
+	VALUE_PAIR	*found;					//!< pairfind marker.
+	VALUE_PAIR	*last;					//!< Temporary only used for fr_cursor_insert
+	VALUE_PAIR	*current;				//!< The current attribute.
+	VALUE_PAIR	*next;					//!< Next attribute to process.
+} vp_cursor_t;
+
+/** A VALUE_PAIR in string format.
+ *
+ * Used to represent pairs in the legacy 'users' file format.
+ */
+typedef struct value_pair_raw {
+	char l_opand[256];					//!< Left hand side of the pair.
+	char r_opand[1024];					//!< Right hand side of the pair.
+
+	FR_TOKEN quote;						//!< Type of quoting around the r_opand.
+
+	FR_TOKEN op;						//!< Operator.
+} VALUE_PAIR_RAW;
+
+#define vp_strvalue	data.strvalue
+#define vp_integer	data.integer
+#define vp_ipaddr	data.ipaddr.s_addr
+#define vp_date		data.date
+#define vp_filter	data.filter
+#define vp_octets	data.octets
+#define vp_ifid		data.ifid
+#define vp_ipv6addr	data.ipv6addr
+#define vp_ipv6prefix	data.ipv6prefix
+#define vp_byte		data.byte
+#define vp_short	data.ushort
+#define vp_ether	data.ether
+#define vp_signed	data.sinteger
+#define vp_integer64	data.integer64
+#define vp_ipv4prefix	data.ipv4prefix
+#define vp_length	length
+
+typedef struct fr_ipaddr_t {
+	int		af;	/* address family */
+	union {
+		struct in_addr	ip4addr;
+		struct in6_addr ip6addr; /* maybe defined in missing.h */
+	} ipaddr;
+	uint8_t		prefix;
+	uint32_t	scope;	/* for IPv6 */
+} fr_ipaddr_t;
+
+/*
+ *	vector:		Request authenticator from access-request packet
+ *			Put in there by rad_decode, and must be put in the
+ *			response RADIUS_PACKET as well before calling rad_send
+ *
+ *	verified:	Filled in by rad_decode for accounting-request packets
+ *
+ *	data,data_len:	Used between rad_recv and rad_decode.
+ */
+typedef struct radius_packet {
+	int			sockfd;
+	fr_ipaddr_t		src_ipaddr;
+	fr_ipaddr_t		dst_ipaddr;
+	uint16_t		src_port;
+	uint16_t		dst_port;
+	int			id;
+	unsigned int		code;
+	uint8_t			vector[AUTH_VECTOR_LEN];
+	struct timeval		timestamp;
+	uint8_t			*data;
+	size_t			data_len;
+	VALUE_PAIR		*vps;
+	ssize_t			offset;
+#ifdef WITH_TCP
+	size_t			partial;
+	int			proto;
+#endif
+#ifdef WITH_RADIUSV11
+	bool			radiusv11;
+#endif
+} RADIUS_PACKET;
+
+typedef enum {
+	DECODE_FAIL_NONE = 0,
+	DECODE_FAIL_MIN_LENGTH_PACKET,
+	DECODE_FAIL_MIN_LENGTH_FIELD,
+	DECODE_FAIL_MIN_LENGTH_MISMATCH,
+	DECODE_FAIL_HEADER_OVERFLOW,
+	DECODE_FAIL_UNKNOWN_PACKET_CODE,
+	DECODE_FAIL_INVALID_ATTRIBUTE,
+	DECODE_FAIL_ATTRIBUTE_TOO_SHORT,
+	DECODE_FAIL_ATTRIBUTE_OVERFLOW,
+	DECODE_FAIL_MA_INVALID_LENGTH,
+	DECODE_FAIL_ATTRIBUTE_UNDERFLOW,
+	DECODE_FAIL_TOO_MANY_ATTRIBUTES,
+	DECODE_FAIL_MA_MISSING,
+	DECODE_FAIL_TOO_MANY_AUTH,
+	DECODE_FAIL_MAX
+} decode_fail_t;
+
+#ifdef WITH_RADIUSV11
+typedef enum {
+       FR_RADIUSV11_FORBID = 0,
+       FR_RADIUSV11_ALLOW,
+       FR_RADIUSV11_REQUIRE,
+} fr_radiusv11_t;
+
+extern const FR_NAME_NUMBER radiusv11_types[];
+#endif
+
+/*
+ *	Version check.
+ */
+int		fr_check_lib_magic(uint64_t magic);
+
+/*
+ *	Printing functions.
+ */
+int		fr_utf8_char(uint8_t const *str, ssize_t inlen);
+char const     	*fr_utf8_strchr(int *chr_len, char const *str, char const *chr);
+size_t		fr_prints(char *out, size_t outlen, char const *in, ssize_t inlen, char quote);
+size_t		fr_prints_len(char const *in, ssize_t inlen, char quote);
+char		*fr_aprints(TALLOC_CTX *ctx, char const *in, ssize_t inlen, char quote);
+
+#define		is_truncated(_ret, _max) ((_ret) >= (_max))
+#define		truncate_len(_ret, _max) (((_ret) >= (_max)) ? ((_max) - 1) : _ret)
+size_t   	vp_prints_value(char *out, size_t outlen, VALUE_PAIR const *vp, char quote);
+
+
+char     	*vp_aprints_value(TALLOC_CTX *ctx, VALUE_PAIR const *vp, char quote);
+
+size_t    	vp_prints_value_json(char *out, size_t outlen, VALUE_PAIR const *vp, bool raw_value);
+size_t		vp_prints(char *out, size_t outlen, VALUE_PAIR const *vp);
+void		vp_print(FILE *, VALUE_PAIR const *);
+void		vp_printlist(FILE *, VALUE_PAIR const *);
+char		*vp_aprints_type(TALLOC_CTX *ctx, PW_TYPE type);
+
+char		*vp_aprints(TALLOC_CTX *ctx, VALUE_PAIR const *vp, char quote);
+#define		fprint_attr_val vp_print
+
+/*
+ *	Dictionary functions.
+ */
+#define DICT_VALUE_MAX_NAME_LEN (128)
+#define DICT_VENDOR_MAX_NAME_LEN (128)
+#define DICT_ATTR_MAX_NAME_LEN (128)
+
+#define DICT_ATTR_SIZE sizeof(DICT_ATTR) + DICT_ATTR_MAX_NAME_LEN
+
+extern const int dict_attr_allowed_chars[256];
+int		dict_valid_name(char const *name);
+int		str2argv(char *str, char **argv, int max_argc);
+int		dict_str2oid(char const *ptr, unsigned int *pattr,
+			     unsigned int *pvendor, int tlv_depth);
+int		dict_addvendor(char const *name, unsigned int value);
+int		dict_addattr(char const *name, int attr, unsigned int vendor, PW_TYPE type, ATTR_FLAGS flags);
+int		dict_addvalue(char const *namestr, char const *attrstr, int value);
+int		dict_init(char const *dir, char const *fn);
+void		dict_free(void);
+int		dict_read(char const *dir, char const *filename);
+size_t		dict_print_oid(char *buffer, size_t buflen, DICT_ATTR const *da);
+int		dict_walk(fr_hash_table_walk_t callback, void *context);
+
+void 		dict_attr_free(DICT_ATTR const **da);
+int		dict_unknown_from_fields(DICT_ATTR *da, unsigned int attr, unsigned int vendor);
+DICT_ATTR const *dict_unknown_afrom_fields(TALLOC_CTX *ctx, unsigned int attr, unsigned int vendor);
+int		dict_unknown_from_str(DICT_ATTR *da, char const *name);
+int		dict_unknown_from_substr(DICT_ATTR *da, char const **name);
+DICT_ATTR const *dict_unknown_afrom_str(TALLOC_CTX *ctx, char const *name);
+DICT_ATTR const *dict_unknown_add(DICT_ATTR const *old);
+
+DICT_ATTR const	*dict_attrbyvalue(unsigned int attr, unsigned int vendor);
+DICT_ATTR const	*dict_attrbyname(char const *attr);
+DICT_ATTR const *dict_attrbyname_substr(char const **name);
+DICT_ATTR const	*dict_attrbytype(unsigned int attr, unsigned int vendor,
+				 PW_TYPE type);
+DICT_ATTR const	*dict_attrbyparent(DICT_ATTR const *parent, unsigned int attr,
+					   unsigned int vendor);
+DICT_ATTR const *dict_parent(unsigned int attr, unsigned int vendor);
+int		dict_attr_child(DICT_ATTR const *parent,
+				unsigned int *pattr, unsigned int *pvendor);
+DICT_VALUE	*dict_valbyattr(unsigned int attr, unsigned int vendor, int val);
+DICT_VALUE	*dict_valbyname(unsigned int attr, unsigned int vendor, char const *val);
+char const	*dict_valnamebyattr(unsigned int attr, unsigned int vendor, int value);
+int		dict_vendorbyname(char const *name);
+DICT_VENDOR	*dict_vendorbyvalue(int vendor);
+
+#if 1 /* FIXME: compat */
+#define dict_attrget	dict_attrbyvalue
+#define dict_attrfind	dict_attrbyname
+#define dict_valfind	dict_valbyname
+/*#define dict_valget	dict_valbyattr almost but not quite*/
+#endif
+
+/* radius.c */
+int		rad_send(RADIUS_PACKET *, RADIUS_PACKET const *, char const *secret);
+bool		rad_packet_ok(RADIUS_PACKET *packet, int flags, decode_fail_t *reason);
+RADIUS_PACKET	*rad_recv(TALLOC_CTX *ctx, int fd, int flags);
+ssize_t rad_recv_header(int sockfd, fr_ipaddr_t *src_ipaddr, uint16_t *src_port, int *code);
+void		rad_recv_discard(int sockfd);
+int		rad_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original,
+			   char const *secret);
+int		rad_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret);
+int		rad_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+			   char const *secret);
+int		rad_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+			 char const *secret);
+
+int rad_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length);
+RADIUS_PACKET	*rad_alloc(TALLOC_CTX *ctx, bool new_vector);
+RADIUS_PACKET	*rad_alloc_reply(TALLOC_CTX *ctx, RADIUS_PACKET *);
+RADIUS_PACKET *rad_copy_packet(TALLOC_CTX *ctx, RADIUS_PACKET const *in);
+
+void		rad_free(RADIUS_PACKET **);
+
+#ifndef WITH_RADIUSV11_ONLY
+int		rad_pwencode(char *encpw, size_t *len, char const *secret,
+			     uint8_t const *vector);
+int		rad_pwdecode(char *encpw, size_t len, char const *secret,
+			     uint8_t const *vector);
+
+#define	FR_TUNNEL_PW_ENC_LENGTH(_x) (2 + 1 + _x + PAD(_x + 1, 16))
+ssize_t		rad_tunnel_pwencode(char *encpw, size_t *len, char const *secret,
+				    uint8_t const *vector);
+ssize_t		rad_tunnel_pwdecode(uint8_t *encpw, size_t *len,
+				    char const *secret, uint8_t const *vector);
+int		rad_chap_encode(RADIUS_PACKET *packet, uint8_t *output,
+				int id, VALUE_PAIR *password);
+#endif
+
+int		rad_attr_ok(RADIUS_PACKET const *packet, RADIUS_PACKET const *original,
+			    DICT_ATTR *da, uint8_t const *data, size_t length);
+int		rad_tlv_ok(uint8_t const *data, size_t length,
+			   size_t dv_type, size_t dv_length);
+
+ssize_t		data2vp(TALLOC_CTX *ctx,
+			RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+			char const *secret,
+			DICT_ATTR const *da, uint8_t const *start,
+			size_t const attrlen, size_t const packetlen,
+			VALUE_PAIR **pvp);
+
+ssize_t		rad_attr2vp(TALLOC_CTX *ctx,
+			    RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+			    char const *secret,
+			    uint8_t const *data, size_t length,
+			    VALUE_PAIR **pvp);
+
+ssize_t rad_data2vp_tlvs(TALLOC_CTX *ctx,
+			 RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+			 char const *secret, DICT_ATTR const *da,
+			 uint8_t const *start, size_t length,
+			 VALUE_PAIR **pvp);
+
+ssize_t		rad_vp2data(uint8_t const **out, VALUE_PAIR const *vp);
+
+int		rad_vp2extended(RADIUS_PACKET const *packet,
+				RADIUS_PACKET const *original,
+				char const *secret, VALUE_PAIR const **pvp,
+				uint8_t *ptr, size_t room);
+int		rad_vp2wimax(RADIUS_PACKET const *packet,
+			     RADIUS_PACKET const *original,
+			     char const *secret, VALUE_PAIR const **pvp,
+			     uint8_t *ptr, size_t room);
+
+int		rad_vp2vsa(RADIUS_PACKET const *packet, RADIUS_PACKET const *original,
+			   char const *secret, VALUE_PAIR const **pvp, uint8_t *start,
+			   size_t room);
+
+int		rad_vp2rfc(RADIUS_PACKET const *packet,
+			   RADIUS_PACKET const *original,
+			   char const *secret, VALUE_PAIR const **pvp,
+			   uint8_t *ptr, size_t room);
+
+int		rad_vp2attr(RADIUS_PACKET const *packet,
+			    RADIUS_PACKET const *original, char const *secret,
+			    VALUE_PAIR const **pvp, uint8_t *ptr, size_t room);
+
+/* pair.c */
+VALUE_PAIR	*fr_pair_alloc(TALLOC_CTX *ctx);
+VALUE_PAIR	*fr_pair_afrom_da(TALLOC_CTX *ctx, DICT_ATTR const *da);
+VALUE_PAIR	*fr_pair_afrom_num(TALLOC_CTX *ctx, unsigned int attr, unsigned int vendor);
+int		fr_pair_to_unknown(VALUE_PAIR *vp);
+void		fr_pair_list_free(VALUE_PAIR **);
+VALUE_PAIR	*fr_pair_find_by_num(VALUE_PAIR *, unsigned int attr, unsigned int vendor, int8_t tag);
+VALUE_PAIR	*fr_pair_find_by_da(VALUE_PAIR *, DICT_ATTR const *da, int8_t tag);
+
+VALUE_PAIR	*fr_cursor_init(vp_cursor_t *cursor, VALUE_PAIR * const *node);
+void		fr_cursor_copy(vp_cursor_t *out, vp_cursor_t *in);
+VALUE_PAIR	*fr_cursor_first(vp_cursor_t *cursor);
+VALUE_PAIR	*fr_cursor_last(vp_cursor_t *cursor);
+VALUE_PAIR	*fr_cursor_next_by_num(vp_cursor_t *cursor, unsigned int attr, unsigned int vendor, int8_t tag);
+
+VALUE_PAIR	*fr_cursor_next_by_da(vp_cursor_t *cursor, DICT_ATTR const *da, int8_t tag)
+		CC_HINT(nonnull);
+
+VALUE_PAIR	*fr_cursor_next(vp_cursor_t *cursor);
+VALUE_PAIR	*fr_cursor_next_peek(vp_cursor_t *cursor);
+VALUE_PAIR	*fr_cursor_current(vp_cursor_t *cursor);
+void		fr_cursor_insert(vp_cursor_t *cursor, VALUE_PAIR *vp);
+void		fr_cursor_merge(vp_cursor_t *cursor, VALUE_PAIR *vp);
+VALUE_PAIR	*fr_cursor_remove(vp_cursor_t *cursor);
+VALUE_PAIR	*fr_cursor_replace(vp_cursor_t *cursor, VALUE_PAIR *new);
+void		fr_pair_delete_by_num(VALUE_PAIR **, unsigned int attr, unsigned int vendor, int8_t tag);
+void		fr_pair_delete_by_da(VALUE_PAIR **first, DICT_ATTR const *da);
+void		fr_pair_add(VALUE_PAIR **, VALUE_PAIR *);
+void		fr_pair_prepend(VALUE_PAIR **, VALUE_PAIR *);
+void		fr_pair_replace(VALUE_PAIR **first, VALUE_PAIR *add);
+int		fr_pair_cmp(VALUE_PAIR *a, VALUE_PAIR *b);
+int		fr_pair_list_cmp(VALUE_PAIR *a, VALUE_PAIR *b);
+
+typedef		int8_t (*fr_cmp_t)(void const *a, void const *b);
+int8_t		attrcmp(void const *a, void const *b);
+int8_t		fr_pair_cmp_by_da_tag(void const *a, void const *b);
+void		fr_pair_list_sort(VALUE_PAIR **vps, fr_cmp_t cmp);
+void		fr_pair_validate_debug(TALLOC_CTX *ctx, VALUE_PAIR const *failed[2]);
+bool		fr_pair_validate(VALUE_PAIR const *failed[2], VALUE_PAIR *filter, VALUE_PAIR *list);
+bool 		fr_pair_validate_relaxed(VALUE_PAIR const *failed[2], VALUE_PAIR *filter, VALUE_PAIR *list);
+VALUE_PAIR	*fr_pair_copy(TALLOC_CTX *ctx, VALUE_PAIR const *vp);
+VALUE_PAIR	*fr_pair_list_copy(TALLOC_CTX *ctx, VALUE_PAIR *from);
+VALUE_PAIR	*fr_pair_list_copy_by_num(TALLOC_CTX *ctx, VALUE_PAIR *from, unsigned int attr, unsigned int vendor, int8_t tag);
+void		fr_pair_steal(TALLOC_CTX *ctx, VALUE_PAIR *vp);
+void		fr_pair_value_memcpy(VALUE_PAIR *vp, uint8_t const * src, size_t len);
+void		fr_pair_value_memsteal(VALUE_PAIR *vp, uint8_t const *src);
+void		fr_pair_value_strsteal(VALUE_PAIR *vp, char const *src);
+void		fr_pair_value_strcpy(VALUE_PAIR *vp, char const * src);
+void		fr_pair_value_bstrncpy(VALUE_PAIR *vp, void const * src, size_t len);
+void		fr_pair_value_sprintf(VALUE_PAIR *vp, char const * fmt, ...) CC_HINT(format (printf, 2, 3));
+void		fr_pair_list_move(TALLOC_CTX *ctx, VALUE_PAIR **to, VALUE_PAIR **from, FR_TOKEN op);
+void		fr_pair_list_move_by_num(TALLOC_CTX *ctx, VALUE_PAIR **to, VALUE_PAIR **from,
+					 unsigned int attr, unsigned int vendor, int8_t tag);
+void		fr_pair_list_mcopy_by_num(TALLOC_CTX *ctx, VALUE_PAIR **to, VALUE_PAIR **from,
+					  unsigned int attr, unsigned int vendor, int8_t tag);
+VALUE_PAIR	*fr_pair_afrom_ip_str(TALLOC_CTX *ctx, char const *value,
+			     DICT_ATTR *ipv4, DICT_ATTR *ipv6, DICT_ATTR *ipv4_prefix, DICT_ATTR *ipv6_prefix);
+int		fr_pair_value_from_str(VALUE_PAIR *vp, char const *value, size_t len);
+VALUE_PAIR	*fr_pair_make(TALLOC_CTX *ctx, VALUE_PAIR **vps, char const *attribute, char const *value, FR_TOKEN op);
+int 		fr_pair_mark_xlat(VALUE_PAIR *vp, char const *value);
+FR_TOKEN 	fr_pair_raw_from_str(char const **ptr, VALUE_PAIR_RAW *raw);
+FR_TOKEN	fr_pair_list_afrom_str(TALLOC_CTX *ctx, char const *buffer, VALUE_PAIR **head);
+int		fr_pair_list_afrom_file(TALLOC_CTX *ctx, VALUE_PAIR **out, FILE *fp, bool *pfiledone);
+
+
+/** Compare two attributes using and operator.
+ *
+ * @return 1 if equal, 0 if not eaqual, -1 on error.
+ */
+#define		fr_pair_cmp_op(_op, _a, _b)	value_data_cmp_op(_op, _a->da->type, &_a->data, _a->vp_length, _b->da->type, &_b->data, _b->vp_length)
+
+/* value.c */
+int		value_data_cmp(PW_TYPE a_type, value_data_t const *a, size_t a_len,
+			       PW_TYPE b_type, value_data_t const *b, size_t b_len);
+
+int		value_data_cmp_op(FR_TOKEN op,
+				  PW_TYPE a_type, value_data_t const *a, size_t a_len,
+				  PW_TYPE b_type, value_data_t const *b, size_t b_len);
+
+ssize_t		value_data_from_str(TALLOC_CTX *ctx, value_data_t *dst,
+				    PW_TYPE *src_type, DICT_ATTR const *src_enumv,
+				    char const *src, ssize_t src_len, char quote);
+
+ssize_t		value_data_cast(TALLOC_CTX *ctx, value_data_t *dst,
+				PW_TYPE dst_type, DICT_ATTR const *dst_enumv,
+				PW_TYPE src_type, DICT_ATTR const *src_enumv,
+				value_data_t const *src, size_t src_len);
+
+ssize_t		value_data_copy(TALLOC_CTX *ctx, value_data_t *dst, PW_TYPE type,
+				const value_data_t *src, size_t src_len);
+
+size_t		value_data_prints(char *out, size_t outlen,
+				  PW_TYPE type, DICT_ATTR const *enumv,
+				  value_data_t const *data, ssize_t inlen, char quote);
+
+char		*value_data_aprints(TALLOC_CTX *ctx,
+				    PW_TYPE type, DICT_ATTR const *enumv, value_data_t const *data,
+				    size_t inlen, char quote);
+
+/*
+ *	Error functions.
+ */
+void		fr_strerror_printf(char const *, ...) CC_HINT(format (printf, 1, 2));
+void		fr_perror(char const *, ...) CC_HINT(format (printf, 1, 2));
+
+
+char const	*fr_strerror(void);
+char const	*fr_syserror(int num);
+extern bool	fr_dns_lookups;	/* do IP -> hostname lookups? */
+extern bool	fr_hostname_lookups; /* do hostname -> IP lookups? */
+extern int	fr_debug_lvl;	/* 0 = no debugging information */
+extern uint32_t	fr_max_attributes; /* per incoming packet */
+#define	FR_MAX_PACKET_CODE (52)
+extern char const *fr_packet_codes[FR_MAX_PACKET_CODE];
+#define is_radius_code(_x) ((_x > 0) && (_x < FR_MAX_PACKET_CODE))
+extern FILE	*fr_log_fp;
+void		rad_print_hex(RADIUS_PACKET const *packet);
+void		fr_printf_log(char const *, ...) CC_HINT(format (printf, 1, 2));
+
+/*
+ *	Several handy miscellaneous functions.
+ */
+int		fr_set_signal(int sig, sig_t func);
+int		fr_unset_signal(int sig);
+int		fr_link_talloc_ctx_free(TALLOC_CTX *parent, TALLOC_CTX *child);
+char const	*fr_inet_ntop(int af, void const *src);
+char const 	*ip_ntoa(char *, uint32_t);
+int		fr_pton4(fr_ipaddr_t *out, char const *value, ssize_t inlen, bool resolve, bool fallback);
+int		fr_pton6(fr_ipaddr_t *out, char const *value, ssize_t inlen, bool resolve, bool fallback);
+int		fr_pton(fr_ipaddr_t *out, char const *value, ssize_t inlen, int af, bool resolve);
+int		fr_pton_port(fr_ipaddr_t *out, uint16_t *port_out, char const *value, ssize_t inlen, int af,
+			     bool resolve);
+int		fr_ntop(char *out, size_t outlen, fr_ipaddr_t const *addr);
+char		*ifid_ntoa(char *buffer, size_t size, uint8_t const *ifid);
+uint8_t		*ifid_aton(char const *ifid_str, uint8_t *ifid);
+int		rad_lockfd(int fd, int lock_len);
+int		rad_lockfd_nonblock(int fd, int lock_len);
+int		rad_unlockfd(int fd, int lock_len);
+char		*fr_abin2hex(TALLOC_CTX *ctx, uint8_t const *bin, size_t inlen);
+size_t		fr_bin2hex(char *hex, uint8_t const *bin, size_t inlen);
+size_t		fr_hex2bin(uint8_t *bin, size_t outlen, char const *hex, size_t inlen);
+uint32_t	fr_strtoul(char const *value, char **end);
+bool		is_whitespace(char const *value);
+bool		is_printable(void const *value, size_t len);
+bool		is_integer(char const *value);
+bool		is_zero(char const *value);
+
+int		fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b);
+
+int		ip_hton(fr_ipaddr_t *out, int af, char const *hostname, bool fallback);
+char const	*ip_ntoh(fr_ipaddr_t const *src, char *dst, size_t cnt);
+struct in_addr	fr_inaddr_mask(struct in_addr const *ipaddr, uint8_t prefix);
+struct in6_addr	fr_in6addr_mask(struct in6_addr const *ipaddr, uint8_t prefix);
+void		fr_ipaddr_mask(fr_ipaddr_t *addr, uint8_t prefix);
+int		fr_ipaddr2sockaddr(fr_ipaddr_t const *ipaddr, uint16_t port,
+				   struct sockaddr_storage *sa, socklen_t *salen);
+int		fr_sockaddr2ipaddr(struct sockaddr_storage const *sa, socklen_t salen,
+				   fr_ipaddr_t *ipaddr, uint16_t *port);
+int		fr_nonblock(int fd);
+int		fr_blocking(int fd);
+ssize_t		fr_writev(int fd, struct iovec[], int iovcnt, struct timeval *timeout);
+
+ssize_t		fr_utf8_to_ucs2(uint8_t *out, size_t outlen, char const *in, size_t inlen);
+size_t		fr_prints_uint128(char *out, size_t outlen, uint128_t const num);
+int		fr_get_time(char const *date_str, time_t *date);
+int8_t		fr_pointer_cmp(void const *a, void const *b);
+void		fr_quick_sort(void const *to_sort[], int min_idx, int max_idx, fr_cmp_t cmp);
+
+void 		fr_timeval_from_ms(struct timeval *out, uint64_t ms);
+void 		fr_timeval_from_usec(struct timeval *out, uint64_t usec);
+
+/*
+ *	Define TALLOC_DEBUG to check overflows with talloc.
+ *	we can't use valgrind, because the memory used by
+ *	talloc is valid memory... just not for us.
+ */
+#ifdef TALLOC_DEBUG
+void		fr_talloc_verify_cb(const void *ptr, int depth,
+				    int max_depth, int is_ref,
+				    void *private_data);
+#define VERIFY_ALL_TALLOC talloc_report_depth_cb(NULL, 0, -1, fr_talloc_verify_cb, NULL)
+#else
+#define VERIFY_ALL_TALLOC
+#endif
+
+#ifdef WITH_ASCEND_BINARY
+/* filters.c */
+int		ascend_parse_filter(value_data_t *out, char const *value, size_t len);
+void		print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, int8_t quote);
+#endif /*WITH_ASCEND_BINARY*/
+
+/* random numbers in isaac.c */
+/* context of random number generator */
+typedef struct fr_randctx {
+	uint32_t randcnt;
+	uint32_t randrsl[256];
+	uint32_t randmem[256];
+	uint32_t randa;
+	uint32_t randb;
+	uint32_t randc;
+} fr_randctx;
+
+void		fr_isaac(fr_randctx *ctx);
+void		fr_randinit(fr_randctx *ctx, int flag);
+uint32_t	fr_rand(void);	/* like rand(), but better. */
+void		fr_rand_seed(void const *, size_t ); /* seed the random pool */
+
+
+/* crypt wrapper from crypt.c */
+int		fr_crypt_check(char const *key, char const *salt);
+
+/* cbuff.c */
+
+typedef struct fr_cbuff fr_cbuff_t;
+
+fr_cbuff_t	*fr_cbuff_alloc(TALLOC_CTX *ctx, uint32_t size, bool lock);
+void		fr_cbuff_rp_insert(fr_cbuff_t *cbuff, void *obj);
+void		*fr_cbuff_rp_next(fr_cbuff_t *cbuff, TALLOC_CTX *ctx);
+
+/* debug.c */
+typedef enum {
+	DEBUG_STATE_UNKNOWN_NO_PTRACE		= -3,	//!< We don't have ptrace so can't check.
+	DEBUG_STATE_UNKNOWN_NO_PTRACE_CAP	= -2,	//!< CAP_SYS_PTRACE not set for the process.
+	DEBUG_STATE_UNKNOWN			= -1,	//!< Unknown, likely fr_get_debug_state() not called yet.
+	DEBUG_STATE_NOT_ATTACHED		= 0,	//!< We can attach, so a debugger must not be.
+	DEBUG_STATE_ATTACHED			= 1	//!< We can't attach, it's likely a debugger is already tracing.
+} fr_debug_state_t;
+
+#define FR_FAULT_LOG(fmt, ...) fr_fault_log(fmt "\n", ## __VA_ARGS__)
+typedef void (*fr_fault_log_t)(char const *msg, ...) CC_HINT(format (printf, 1, 2));
+extern fr_debug_state_t fr_debug_state;
+
+/** Optional callback passed to fr_fault_setup
+ *
+ * Allows optional logic to be run before calling the main fault handler.
+ *
+ * If the callback returns < 0, the main fault handler will not be called.
+ *
+ * @param signum signal raised.
+ * @return 0 on success < 0 on failure.
+ */
+typedef int (*fr_fault_cb_t)(int signum);
+typedef struct fr_bt_marker fr_bt_marker_t;
+
+void		fr_store_debug_state(void);
+char const	*fr_debug_state_to_msg(fr_debug_state_t state);
+void		fr_debug_break(bool always);
+void		backtrace_print(fr_cbuff_t *cbuff, void *obj);
+int		fr_backtrace_do(fr_bt_marker_t *marker);
+fr_bt_marker_t	*fr_backtrace_attach(fr_cbuff_t **cbuff, TALLOC_CTX *obj);
+
+void		fr_panic_on_free(TALLOC_CTX *ctx);
+int		fr_set_dumpable_init(void);
+int		fr_set_dumpable(bool allow_core_dumps);
+int		fr_reset_dumpable(void);
+int		fr_log_talloc_report(TALLOC_CTX *ctx);
+void		fr_fault(int sig);
+void		fr_talloc_fault_setup(void);
+int		fr_fault_setup(char const *cmd, char const *program);
+void		fr_fault_set_cb(fr_fault_cb_t func);
+void		fr_fault_set_log_fd(int fd);
+void		fr_fault_log(char const *msg, ...) CC_HINT(format (printf, 1, 2));
+
+#  ifdef WITH_VERIFY_PTR
+void		fr_pair_verify(char const *file, int line, VALUE_PAIR const *vp);
+void		fr_pair_list_verify(char const *file, int line, TALLOC_CTX *expected, VALUE_PAIR *vps, char const *name);
+#  endif
+
+bool		fr_assert_cond(char const *file, int line, char const *expr, bool cond);
+#  define	fr_assert(_x) fr_assert_cond(__FILE__,  __LINE__, #_x, (_x))
+
+void		NEVER_RETURNS _fr_exit(char const *file, int line, int status);
+#  define	fr_exit(_x) _fr_exit(__FILE__,  __LINE__, (_x))
+
+void		NEVER_RETURNS _fr_exit_now(char const *file, int line, int status);
+#  define	fr_exit_now(_x) _fr_exit_now(__FILE__,  __LINE__, (_x))
+
+/* rbtree.c */
+typedef struct rbtree_t rbtree_t;
+typedef struct rbnode_t rbnode_t;
+
+/* callback order for walking  */
+typedef enum {
+	RBTREE_PRE_ORDER,
+	RBTREE_IN_ORDER,
+	RBTREE_POST_ORDER,
+	RBTREE_DELETE_ORDER
+} rb_order_t;
+
+#define RBTREE_FLAG_NONE    (0)
+#define RBTREE_FLAG_REPLACE (1 << 0)
+#define RBTREE_FLAG_LOCK    (1 << 1)
+
+typedef int (*rb_comparator_t)(void const *ctx, void const *data);
+typedef int (*rb_walker_t)(void *ctx, void *data);
+typedef void (*rb_free_t)(void *data);
+
+rbtree_t	*rbtree_create(TALLOC_CTX *ctx, rb_comparator_t compare, rb_free_t node_free, int flags);
+void		rbtree_free(rbtree_t *tree);
+bool		rbtree_insert(rbtree_t *tree, void *data);
+rbnode_t	*rbtree_insert_node(rbtree_t *tree, void *data);
+void		rbtree_delete(rbtree_t *tree, rbnode_t *z);
+bool		rbtree_deletebydata(rbtree_t *tree, void const *data);
+rbnode_t	*rbtree_find(rbtree_t *tree, void const *data);
+void		*rbtree_finddata(rbtree_t *tree, void const *data);
+uint32_t	rbtree_num_elements(rbtree_t *tree);
+void		*rbtree_node2data(rbtree_t *tree, rbnode_t *node);
+
+/*
+ *	The callback should be declared as:
+ *	int callback(void *context, void *data)
+ *
+ *	The "context" is some user-defined context.
+ *	The "data" is the pointer to the user data in the node,
+ *	NOT the node itself.
+ *
+ *	It should return 0 if all is OK, and !0 for any error.
+ *	The walking will stop on any error.
+ *
+ *	Except with RBTREE_DELETE_ORDER, where the callback should return <0 for
+ *	errors, and may return 1 to delete the current node and halt,
+ *	or 2 to delete the current node and continue.  This may be
+ *	used to batch-delete select nodes from a locked rbtree.
+ */
+int		rbtree_walk(rbtree_t *tree, rb_order_t order, rb_walker_t compare, void *context);
+
+/*
+ *	FIFOs
+ */
+typedef struct	fr_fifo_t fr_fifo_t;
+typedef void (*fr_fifo_free_t)(void *);
+fr_fifo_t	*fr_fifo_create(TALLOC_CTX *ctx, int max_entries, fr_fifo_free_t freeNode);
+void		fr_fifo_free(fr_fifo_t *fi);
+int		fr_fifo_push(fr_fifo_t *fi, void *data);
+void		*fr_fifo_pop(fr_fifo_t *fi);
+void		*fr_fifo_peek(fr_fifo_t *fi);
+unsigned int	fr_fifo_num_elements(fr_fifo_t *fi);
+
+/*
+ *	socket.c
+ */
+int		fr_socket_client_unix(char const *path, bool async);
+int		fr_socket_client_udp(fr_ipaddr_t *src_ipaddr, fr_ipaddr_t *dst_ipaddr, uint16_t dst_port, bool async);
+int		fr_socket_client_tcp(fr_ipaddr_t *src_ipaddr, fr_ipaddr_t *dst_ipaddr, uint16_t dst_port, bool async);
+int		fr_socket_wait_for_connect(int sockfd, struct timeval *timeout);
+
+#ifdef __cplusplus
+}
+#endif
+
+#include <freeradius-devel/packet.h>
+
+#ifdef WITH_TCP
+#  include <freeradius-devel/tcp.h>
+#endif
+
+#endif /*LIBRADIUS_H*/
diff --git a/src/include/listen.h b/src/include/listen.h
new file mode 100644
index 0000000..a82b91d
--- /dev/null
+++ b/src/include/listen.h
@@ -0,0 +1,206 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef LISTEN_H
+#define LISTEN_H
+/**
+ * $Id$
+ *
+ * @file listen.h
+ * @brief The listener API.
+ *
+ * @copyright 2015  The FreeRADIUS server project
+ */
+
+/*
+ *	Types of listeners.
+ *
+ *	Ordered by priority!
+ */
+typedef enum RAD_LISTEN_TYPE {
+	RAD_LISTEN_NONE = 0,
+	RAD_LISTEN_PROXY,
+	RAD_LISTEN_AUTH,
+	RAD_LISTEN_ACCT,
+	RAD_LISTEN_DETAIL,
+	RAD_LISTEN_VQP,
+	RAD_LISTEN_DHCP,
+	RAD_LISTEN_COMMAND,
+	RAD_LISTEN_COA,
+	RAD_LISTEN_MAX
+} RAD_LISTEN_TYPE;
+
+typedef enum RAD_LISTEN_STATUS {
+	RAD_LISTEN_STATUS_INIT = 0,
+	RAD_LISTEN_STATUS_KNOWN,
+	RAD_LISTEN_STATUS_PAUSE,
+	RAD_LISTEN_STATUS_RESUME,
+	RAD_LISTEN_STATUS_FROZEN,
+	RAD_LISTEN_STATUS_EOL,
+	RAD_LISTEN_STATUS_REMOVE_NOW
+} RAD_LISTEN_STATUS;
+
+typedef struct rad_listen rad_listen_t;
+
+typedef int (*rad_listen_recv_t)(rad_listen_t *);
+typedef int (*rad_listen_send_t)(rad_listen_t *, REQUEST *);
+typedef int (*rad_listen_print_t)(rad_listen_t const *, char *, size_t);
+typedef int (*rad_listen_encode_t)(rad_listen_t *, REQUEST *);
+typedef int (*rad_listen_decode_t)(rad_listen_t *, REQUEST *);
+
+struct rad_listen {
+	rad_listen_t *next; /* should be rbtree stuff */
+
+	/*
+	 *	For normal sockets.
+	 */
+	RAD_LISTEN_TYPE	type;
+	int		fd;
+	char const	*server;
+	int		status;
+	int		count;
+#ifdef WITH_TCP
+	rbtree_t	*children;
+	rad_listen_t	*parent;
+
+	bool		dual;
+	bool		proxy_protocol;		//!< haproxy protocol
+#endif
+	bool		nodup;
+	bool		synchronous;
+	bool		dead;
+	uint32_t	workers;
+
+#ifdef WITH_TLS
+	fr_tls_server_conf_t *tls;
+	bool		check_client_connections;
+	bool		nonblock;
+	bool		blocked;
+#ifdef WITH_RADIUSV11
+	fr_radiusv11_t 	radiusv11;
+#endif
+
+#ifdef WITH_COA_TUNNEL
+	char const	*key;		/* Originating-Realm-Key */
+	bool		send_coa;	/* to the NAS */
+
+	uint32_t	coa_irt;
+	uint32_t	coa_mrc;
+	uint32_t	coa_mrt;
+	uint32_t	coa_mrd;
+
+	int		num_ids_used;	/* for proxying CoA packets */
+#endif
+#endif
+
+	rad_listen_recv_t recv;
+	rad_listen_send_t send;
+
+	/*
+	 *	We don't need a proxy_recv, because the main loop in
+	 *	process.c calls listener->recv(), and we don't know
+	 *	what kind of packet we're receiving until we receive
+	 *	it.
+	 */
+	rad_listen_send_t proxy_send;
+
+
+	rad_listen_encode_t encode;
+	rad_listen_decode_t decode;
+	rad_listen_encode_t proxy_encode;
+	rad_listen_decode_t proxy_decode;
+	rad_listen_print_t print;
+
+	CONF_SECTION const *cs;
+	void		*data;
+
+#ifdef WITH_STATS
+	fr_stats_t	stats;
+#endif
+};
+
+/*
+ *	This shouldn't really be exposed...
+ */
+typedef struct listen_socket_t {
+	/*
+	 *	For normal sockets.
+	 */
+	fr_ipaddr_t	my_ipaddr;
+	uint16_t	my_port;
+
+	char const	*interface;
+#ifdef SO_BROADCAST
+	int		broadcast;
+#endif
+
+	int		recv_buff;
+
+	time_t		rate_time;
+	uint32_t	rate_pps_old;
+	uint32_t	rate_pps_now;
+	uint32_t	max_rate;
+
+	/* for outgoing sockets */
+	home_server_t	*home;
+	fr_ipaddr_t	other_ipaddr;
+	uint16_t	other_port;
+
+	int		proto;
+
+#ifdef WITH_TCP
+	/* for a proxy connecting to home servers */
+	time_t		last_packet;
+	time_t		opened;
+	fr_event_t	*ev;
+
+	fr_socket_limit_t limit;
+
+	struct listen_socket_t *parent;
+	RADCLIENT	*client;
+
+	RADIUS_PACKET   *packet; /* for reading partial packets */
+
+	fr_ipaddr_t	haproxy_src_ipaddr;	//!< for proxy_protocol
+	fr_ipaddr_t	haproxy_dst_ipaddr;
+	uint16_t	haproxy_src_port;
+	uint16_t	haproxy_dst_port;
+#endif
+
+#ifdef WITH_TLS
+	tls_session_t	*ssn;
+	REQUEST		*request; /* horrible hacks */
+	VALUE_PAIR	*certs;
+	uint32_t	connect_timeout;
+	pthread_mutex_t mutex;
+	uint8_t		*data;
+	size_t		partial;
+	enum {
+		LISTEN_TLS_INIT = 0,
+		LISTEN_TLS_CHECKING,
+		LISTEN_TLS_SETUP,
+		LISTEN_TLS_RUNNING,
+	} state;
+
+#ifdef WITH_RADIUSV11
+	bool		alpn_checked;
+	bool		radiusv11;		//!< defaults to "no"!
+#endif
+#endif
+
+	RADCLIENT_LIST	*clients;
+} listen_socket_t;
+#endif /* LISTEN_H */
+
diff --git a/src/include/log.h b/src/include/log.h
new file mode 100644
index 0000000..2736591
--- /dev/null
+++ b/src/include/log.h
@@ -0,0 +1,390 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_LOG_H
+#define FR_LOG_H
+/**
+ * $Id$
+ *
+ * @file log.h
+ * @brief Macros and function definitions to write log messages, and control the logging system.
+ *
+ * @copyright 2015 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
+ * @copyright 2013 Alan DeKok <aland@freeradius.org>
+ */
+RCSIDH(log_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum log_type {
+	L_AUTH = 2,		//!< Authentication message.
+	L_INFO = 3,		//!< Informational message.
+	L_ERR = 4,		//!< Error message.
+	L_WARN = 5,		//!< Warning.
+	L_PROXY	= 6,		//!< Proxy messages
+	L_ACCT = 7,		//!< Accounting messages
+
+	L_DBG = 16,		//!< Only displayed when debugging is enabled.
+	L_DBG_WARN = 17,	//!< Warning only displayed when debugging is enabled.
+	L_DBG_ERR = 18,		//!< Error only displayed when debugging is enabled.
+	L_DBG_WARN_REQ = 19,	//!< Less severe warning only displayed when debugging is enabled.
+	L_DBG_ERR_REQ = 20	//!< Less severe error only displayed when debugging is enabled.
+} log_type_t;
+
+typedef enum log_lvl {
+	L_DBG_LVL_DISABLE = -1,	//!< Don't print messages.
+	L_DBG_LVL_OFF = 0,	//!< No debug messages.
+	L_DBG_LVL_1,		//!< Highest priority debug messages (-x).
+	L_DBG_LVL_2,		//!< 2nd highest priority debug messages (-xx | -X).
+	L_DBG_LVL_3,		//!< 3rd highest priority debug messages (-xxx | -Xx).
+	L_DBG_LVL_MAX		//!< Lowest priority debug messages (-xxxx | -Xxx).
+} log_lvl_t;
+
+typedef enum log_dst {
+	L_DST_STDOUT = 0,	//!< Log to stdout.
+	L_DST_FILES,		//!< Log to a file on disk.
+	L_DST_SYSLOG,		//!< Log to syslog.
+	L_DST_STDERR,		//!< Log to stderr.
+	L_DST_NULL,		//!< Discard log messages.
+	L_DST_NUM_DEST
+} log_dst_t;
+
+typedef struct fr_log_t {
+	bool		colourise;	//!< Prefix log messages with VT100 escape codes to change text
+					//!< colour.
+	int		fd;		//!< File descriptor to write messages to.
+	log_dst_t	dst;		//!< Log destination.
+	char const	*file;		//!< Path to log file.
+	char const	*debug_file;	//!< Path to debug log file.
+} fr_log_t;
+
+typedef		void (*radlog_func_t)(log_type_t lvl, log_lvl_t priority, REQUEST *, char const *, va_list ap);
+
+extern FR_NAME_NUMBER const syslog_facility_table[];
+extern FR_NAME_NUMBER const syslog_severity_table[];
+extern FR_NAME_NUMBER const log_str2dst[];
+extern fr_log_t default_log;
+
+int	radlog_init(fr_log_t *log, bool daemonize);
+
+int	vradlog(log_type_t lvl, char const *fmt, va_list ap)
+	CC_HINT(format (printf, 2, 0)) CC_HINT(nonnull);
+int	radlog(log_type_t lvl, char const *fmt, ...)
+	CC_HINT(format (printf, 2, 3)) CC_HINT(nonnull (2));
+
+bool	debug_enabled(log_type_t type, log_lvl_t lvl);
+
+bool	rate_limit_enabled(void);
+
+bool	radlog_debug_enabled(log_type_t type, log_lvl_t lvl, REQUEST *request)
+	CC_HINT(nonnull);
+
+void	vradlog_request(log_type_t type, log_lvl_t lvl, REQUEST *request, char const *msg, va_list ap)
+	CC_HINT(format (printf, 4, 0)) CC_HINT(nonnull (3, 4));
+
+void	radlog_request(log_type_t type, log_lvl_t lvl, REQUEST *request, char const *msg, ...)
+	CC_HINT(format (printf, 4, 5)) CC_HINT(nonnull (3, 4));
+
+void	radlog_request_error(log_type_t type, log_lvl_t lvl, REQUEST *request, char const *msg, ...)
+	CC_HINT(format (printf, 4, 5)) CC_HINT(nonnull (3, 4));
+
+void	radlog_request_marker(log_type_t type, log_lvl_t lvl, REQUEST *request,
+			      char const *fmt, size_t indent, char const *error)
+	CC_HINT(nonnull);
+
+void	fr_canonicalize_error(TALLOC_CTX *ctx, char **spaces, char **text, ssize_t slen, char const *msg);
+
+/** @name Log global messages
+ *
+ * Write to the global log.
+ *
+ * Messages will always be written irrespective of the debugging level set with ``-x`` or ``-X``.
+ *
+ * @warning If a REQUEST * is **NOT** available, these macros **MUST** be used.
+ *
+ * @note These macros should only be used for important global events.
+ *
+ * **Debug categories**
+ * Name     | Syslog severity         | Colour/style | When to use
+ * -------- | ----------------------- | ------------ | -----------
+ * AUTH     | LOG_NOTICE              | Bold         | Never - Deprecated
+ * ACCT     | LOG_NOTICE              | Bold         | Never - Deprecated
+ * PROXY    | LOG_NOTICE              | Bold         | Never - Deprecated
+ * INFO     | LOG_INFO                | Bold         | TBD
+ * WARN     | LOG_WARNING             | Yellow       | Warnings. Impending resource exhaustion, resource exhaustion
+ * ERROR    | LOG_ERR                 | Red          | Critical server errors. Malformed queries, failed operations, connection errors, packet processing errors
+ *
+ * @{
+ */
+#define AUTH(fmt, ...)		radlog(L_AUTH, fmt, ## __VA_ARGS__)
+#define ACCT(fmt, ...)		radlog(L_ACCT, fmt, ## __VA_ARGS__)
+#define PROXY(fmt, ...)		radlog(L_PROXY, fmt, ## __VA_ARGS__)
+
+#define INFO(fmt, ...)		radlog(L_INFO,  fmt, ## __VA_ARGS__)
+#define WARN(fmt, ...)		radlog(L_WARN, fmt, ## __VA_ARGS__)
+#define ERROR(fmt, ...)		radlog(L_ERR, fmt, ## __VA_ARGS__)
+/** @} */
+
+/** @name Log global debug messages (DEBUG*)
+ *
+ * Write debugging messages to the global log.
+ *
+ * Messages will be written if the debug level is high enough.
+ *
+ * **Debug categories**
+ * Name     | Syslog severity         | Colour/style | When to use
+ * -------- | ----------------------- | -------------| -----------
+ * DEBUG    | LOG_DEBUG               | Regular      | Normal debug output
+ *
+ * **Debug levels**
+ * Level    | Debug arguments         | Macro(s) enabled              | When to use
+ * -------- | ----------------------- | ----------------------------- | -----------
+ * 1        | ``-x``                  | DEBUG                         | Never - Deprecated
+ * 2        | ``-xx`` or ``-X``       | DEBUG, DEBUG2                 | Interactions with external entities. Connection management, control socket, triggers, etc...
+ * 3        | ``-xxx`` or ``-Xx``     | DEBUG, DEBUG2, DEBUG3         | Lower priority events. Polling for detail files, cleanups, etc...
+ * 4        | ``-xxxx`` or ``-Xxx``   | DEBUG, DEBUG2, DEBUG3, DEBUG4 | Internal server state debugging.
+ *
+ * @{
+ */
+#define DEBUG_ENABLED		debug_enabled(L_DBG, L_DBG_LVL_1)			//!< True if global debug level 1 messages are enabled
+#define DEBUG_ENABLED2		debug_enabled(L_DBG, L_DBG_LVL_2)			//!< True if global debug level 1-2 messages are enabled
+#define DEBUG_ENABLED3		debug_enabled(L_DBG, L_DBG_LVL_3)			//!< True if global debug level 1-3 messages are enabled
+#define DEBUG_ENABLED4		debug_enabled(L_DBG, L_DBG_LVL_MAX)			//!< True if global debug level 1-4 messages are enabled
+
+#define _SL(_l, _p, _f, ...)	if (rad_debug_lvl >= _p) radlog(_l, _f, ## __VA_ARGS__)
+#define DEBUG(fmt, ...)		_SL(L_DBG, L_DBG_LVL_1, fmt, ## __VA_ARGS__)
+#define DEBUG2(fmt, ...)	_SL(L_DBG, L_DBG_LVL_2, fmt, ## __VA_ARGS__)
+#define DEBUG3(fmt, ...)	_SL(L_DBG, L_DBG_LVL_3, fmt, ## __VA_ARGS__)
+#define DEBUG4(fmt, ...)	_SL(L_DBG, L_DBG_LVL_MAX, fmt, ## __VA_ARGS__)
+/** @} */
+
+/** @name Log request-specific messages (R*)
+ *
+ * Write to the request log, or the global log if a request logging function is not set.
+ *
+ * Messages will always be written irrespective of the debugging level set with ``-x`` or ``-X``.
+ *
+ * @note Automatically prepends date (at lvl >= 3), request number, and module, to the log message.
+ * @note If a REQUEST * is available, these macros should be used.
+ * @note These macros should only be used for important global events.
+ *
+ * **Debug categories**
+ * Name     | Syslog severity         | Colour/style | When to use
+ * -------- | ----------------------- | -------------| -----------
+ * RAUTH    | LOG_NOTICE              | Bold         | Never - Deprecated
+ * RACCT    | LOG_NOTICE              | Bold         | Never - Deprecated
+ * RPROXY   | LOG_NOTICE              | Bold         | Never - Deprecated
+ * RINFO    | LOG_INFO                | Bold         | TBD
+ * RWARN    | LOG_WARNING             | Yellow/Bold  | Warnings. Impending resource exhaustion, or resource exhaustion.
+ * RERROR   | LOG_ERR                 | Red/Bold     | Critical server errors. Malformed queries, failed operations, connection errors, packet processing errors.
+ * @{
+ */
+#define RAUTH(fmt, ...)		radlog_request(L_AUTH, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__)
+#define RACCT(fmt, ...)		radlog_request(L_ACCT, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__)
+#define RPROXY(fmt, ...)	radlog_request(L_PROXY, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__)
+#define RINFO(fmt, ...)		radlog_request(L_INFO, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__)
+#define RWARN(fmt, ...)		radlog_request(L_DBG_WARN, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__)
+#define RERROR(fmt, ...)	radlog_request_error(L_DBG_ERR, L_DBG_LVL_OFF, request, fmt, ## __VA_ARGS__)
+/** @} */
+
+/** @name Log request-specific debug (R*DEBUG*)
+ *
+ * Write debug messages to the request log.
+ *
+ * Messages will only be written if a request log function is set and the request or global
+ * debug level is high enough.
+ *
+ * @note Automatically prepends date (at lvl >= 3), request number, and module, to the log message.
+ *
+ * **Debug categories**
+ * Name     | Syslog severity         | Colour and style | When to use
+ * -------- | ----------------------- | -----------------| -----------
+ * RDEBUG*  | LOG_DEBUG               | Regular          | Normal debugging messages
+ * RIDEBUG* | LOG_DEBUG               | Bold             | Informational messages.
+ * RWDEBUG* | LOG_DEBUG               | Yellow/Bold      | Warnings. Invalid configuration, missing or invalid attributes etc...
+ * REDEBUG* | LOG_DEBUG               | Red/Bold         | Errors. Reject messages, bad values etc...
+ *
+ * **Debug levels**
+ * Level    | Debug arguments         | Macro(s) enabled                       | When to use
+ * -------- | ----------------------- | -------------------------------------- | -----------
+ * 1        | ``-x``                  | R*DEBUG                                | Never - Deprecated
+ * 2        | ``-xx`` or ``-X``       | R*DEBUG, R*DEBUG2                      | Normal request flow. Operations, Results of queries, or execs, etc...
+ * 3        | ``-xxx`` or ``-Xx``     | R*DEBUG, R*DEBUG2, R*DEBUG3            | Internal server state or packet input. State machine changes, extra attribute info, etc...
+ * 4        | ``-xxxx`` or ``-Xxx``   | R*DEBUG, R*DEBUG2, R*DEBUG3, R*DEBUG4  | Verbose internal server state messages or packet input. Hex dumps, structure dumps, pointer values.
+ *
+ * @{
+ */
+#define RDEBUG_ENABLED		radlog_debug_enabled(L_DBG, L_DBG_LVL_1, request)	//!< True if request debug level 1 messages are enabled
+#define RDEBUG_ENABLED2		radlog_debug_enabled(L_DBG, L_DBG_LVL_2, request)	//!< True if request debug level 1-2 messages are enabled
+#define RDEBUG_ENABLED3		radlog_debug_enabled(L_DBG, L_DBG_LVL_3, request)	//!< True if request debug level 1-3 messages are enabled
+#define RDEBUG_ENABLED4		radlog_debug_enabled(L_DBG, L_DBG_LVL_MAX, request)	//!< True if request debug level 1-4 messages are enabled
+
+#define RDEBUGX(_l, fmt, ...)	radlog_request(L_DBG, _l, request, fmt, ## __VA_ARGS__)
+#define RDEBUG(fmt, ...)	if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__)
+#define RDEBUG2(fmt, ...)	if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__)
+#define RDEBUG3(fmt, ...)	if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_3, request, fmt, ## __VA_ARGS__)
+#define RDEBUG4(fmt, ...)	if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG, L_DBG_LVL_MAX, request, fmt, ## __VA_ARGS__)
+
+#define RIDEBUG(fmt, ...)	radlog_request(L_INFO, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__)
+#define RIDEBUG2(fmt, ...)	radlog_request(L_INFO, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__)
+
+#define RWDEBUG(fmt, ...)	if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG_WARN, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__)
+#define RWDEBUG2(fmt, ...)	if (rad_debug_lvl || request->log.lvl) radlog_request(L_DBG_WARN, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__)
+
+#define REDEBUG(fmt, ...)	radlog_request_error(L_DBG_ERR, L_DBG_LVL_1, request, fmt, ## __VA_ARGS__)
+#define REDEBUG2(fmt, ...)	radlog_request_error(L_DBG_ERR, L_DBG_LVL_2, request, fmt, ## __VA_ARGS__)
+#define REDEBUG3(fmt, ...)	radlog_request_error(L_DBG_ERR, L_DBG_LVL_3, request, fmt, ## __VA_ARGS__)
+#define REDEBUG4(fmt, ...)	radlog_request_error(L_DBG_ERR, L_DBG_LVL_MAX, request, fmt, ## __VA_ARGS__)
+/** @} */
+
+/** Indent R* messages by one level
+ *
+ * @note Has no effect on the indentation of INFO, WARN, ERROR, DEBUG messages,
+ *	 only RINFO, RWARN, RERROR etc...
+ */
+#define RINDENT() (request->log.indent += 2)
+
+/** Exdent (unindent) R* messages by one level
+ *
+ * @note Has no effect on the indentation of INFO, WARN, ERROR, DEBUG messages,
+ *	 only RINFO, RWARN, RERROR etc...
+ */
+#define REXDENT() (request->log.indent -= 2)
+
+/** Output string with error marker, showing where format error occurred
+ *
+ @verbatim
+   my pet kitty
+      ^ kitties are not pets, are nature devouring hell beasts
+ @endverbatim
+ *
+ * @warning If a REQUEST * is **NOT** available, or is NULL, this macro must **NOT** be used.
+ *
+ * @param _l log category, a log_type_t value.
+ * @param _p log priority, a log_lvl_t value.
+ * @param _m string to mark e.g. "my pet kitty".
+ * @param _i index e.g. 3 (starts from 0).
+ * @param _e error e.g. "kitties are not pets, are nature devouring hell beasts".
+ */
+#define RMARKER(_l, _p, _m, _i, _e)	radlog_request_marker(_l, _p, request, _m, _i, _e)
+
+/** Output string with error marker, showing where format error occurred
+ *
+ * These are logged as RERROR messages.
+ *
+ @verbatim
+   my pet kitty
+      ^ kitties are not pets, are nature devouring hell beasts
+ @endverbatim
+ *
+ * @warning If a REQUEST * is **NOT** available, or is NULL, this macro must **NOT** be used.
+ *
+ * @param _m string to mark e.g. "my pet kitty".
+ * @param _i index e.g. 3 (starts from 0).
+ * @param _e error e.g. "kitties are not pets, are nature devouring hell beasts".
+ */
+#define REMARKER(_m, _i, _e)		RMARKER(L_DBG_ERR, L_DBG_LVL_1, _m, _i, _e)
+
+/** Output string with error marker, showing where format error occurred
+ *
+ * These are logged as RDEBUG messages.
+ *
+ @verbatim
+   my pet kitty
+      ^ kitties are not pets, are nature devouring hell beasts
+ @endverbatim
+ *
+ * @warning If a REQUEST * is **NOT** available, or is NULL, this macro must **NOT** be used.
+ *
+ * @param _m string to mark e.g. "my pet kitty".
+ * @param _i index e.g. 3 (starts from 0).
+ * @param _e error e.g. "kitties are not pets, are nature devouring hell beasts".
+ */
+#define RDMARKER(_m, _i, _e)		RMARKER(L_DBG, L_DBG_LVL_1, _m, _i, _e)
+
+/** Use different logging functions depending on whether request is NULL or not.
+ *
+ * @note The module must define MOD_PREFIX as its name (do this in the module
+ *	 header file) e.g. @code{.c}#define MOD_PREFIX "rlm_example"@endcode
+ *
+ * This is useful for areas of code which are run on server startup, and when
+ * processing requests.
+ *
+ * @param _l_request The name of a R* logging macro e.g. RDEBUG3.
+ * @param _l_global The name of a global logging macro e.g. DEBUG3.
+ * @param fmt printf style format string.
+ * @param ... printf arguments.
+ */
+ #define MOD_ROPTIONAL(_l_request, _l_global, fmt, ...) \
+do {\
+	if (request) {\
+		_l_request(fmt, ## __VA_ARGS__);\
+	} else {\
+		_l_global(MOD_PREFIX " (%s): " fmt, inst->name, ## __VA_ARGS__);\
+ 	}\
+} while (0)
+
+/** Use different logging functions depending on whether request is NULL or not.
+ *
+ * This is useful for areas of code which are run on server startup, and when
+ * processing requests.
+ *
+ * @param _l_request The name of a R* logging macro e.g. RDEBUG3.
+ * @param _l_global The name of a global logging macro e.g. DEBUG3.
+ * @param fmt printf style format string.
+ * @param ... printf arguments.
+ */
+ #define ROPTIONAL(_l_request, _l_global, fmt, ...) \
+do {\
+	if (request) {\
+		_l_request(fmt, ## __VA_ARGS__);\
+	} else {\
+		_l_global(LOG_PREFIX ": " fmt, ## __VA_ARGS__);\
+ 	}\
+} while (0)
+
+#define RATE_LIMIT_ENABLED rate_limit_enabled()		//!< True if rate limiting is enabled.
+/** Rate limit messages
+ *
+ * Rate limit log messages so they're written a maximum of once per second.
+ *
+ @code{.c}
+   RATE_LIMIT(RERROR("Home servers alive in pool %s", pool->name));
+ @endcode
+ * @note Rate limits the macro, not the message. If five different messages are
+ *	 produced using the same macro in the same second, only the first will
+ *	 be written to the log.
+ *
+ * @param _x Logging macro to limit.
+ */
+#define RATE_LIMIT(_x) \
+do {\
+	if (RATE_LIMIT_ENABLED) {\
+		static time_t _last_complained = 0;\
+		time_t _now = time(NULL);\
+		if (_now != _last_complained) {\
+			_last_complained = _now;\
+			_x;\
+		}\
+	} else _x;\
+} while (0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_LOG_H */
diff --git a/src/include/map.h b/src/include/map.h
new file mode 100644
index 0000000..584c76b
--- /dev/null
+++ b/src/include/map.h
@@ -0,0 +1,111 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef MAP_H
+#define MAP_H
+/**
+ * $Id$
+ *
+ * @file map.h
+ * @brief Structures and prototypes for maps
+ *
+ * @copyright 2015 The FreeRADIUS server project
+ * @copyright 2015 Arran Cudbard-bell <a.cudbardb@freeradius.org>
+ */
+
+RCSIDH(map_h, "$Id$")
+
+#include <freeradius-devel/conffile.h>
+#include <freeradius-devel/tmpl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Value pair map
+ *
+ * Value pair maps contain a pair of templates, that describe a src attribute
+ * or value, and a destination attribute.
+ *
+ * Neither src or dst need to be an FR attribute, and their type can be inferred
+ * from whether map->da is NULL (not FR).
+ *
+ * @see vp_tmpl_t
+ */
+typedef struct vp_map {
+	vp_tmpl_t		*lhs;	//!< Typically describes the attribute to add, modify or compare.
+	vp_tmpl_t		*rhs;   //!< Typically describes a literal value or a src attribute to copy or compare.
+
+	FR_TOKEN		op; 	//!< The operator that controls insertion of the dst attribute.
+
+	CONF_ITEM		*ci;	//!< Config item that the map was created from. Mainly used for
+					//!< logging validation errors.
+
+	struct vp_map		*next;	//!< The next valuepair map.
+} vp_map_t;
+
+#ifndef WITH_VERIFY_PTR
+#  define VERIFY_MAP(_x) rad_assert((_x)->lhs)
+#else
+#  define VERIFY_MAP(_x) do { \
+	VERIFY_TMPL((_x)->lhs); \
+	if ((_x)->rhs) VERIFY_TMPL((_x)->rhs); \
+} while (0)
+#endif
+
+typedef int (*map_validate_t)(vp_map_t *map, void *ctx);
+typedef int (*radius_map_getvalue_t)(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request,
+				     vp_map_t const *map, void *uctx);
+
+int		map_afrom_cp(TALLOC_CTX *ctx, vp_map_t **out, CONF_PAIR *cp,
+			     request_refs_t dst_request_def, pair_lists_t dst_list_def,
+			     request_refs_t src_request_def, pair_lists_t src_list_def);
+
+int		map_afrom_fields(TALLOC_CTX *ctx, vp_map_t **out, char const *lhs, FR_TOKEN lhs_type,
+				 FR_TOKEN op, char const *rhs, FR_TOKEN rhs_type,
+				 request_refs_t dst_request_def, pair_lists_t dst_list_def,
+				 request_refs_t src_request_def, pair_lists_t src_list_def);
+
+int		map_afrom_cs(vp_map_t **out, CONF_SECTION *cs,
+			     pair_lists_t dst_list_def, pair_lists_t src_list_def,
+			     map_validate_t validate, void *ctx, unsigned int max) CC_HINT(nonnull(1, 2));
+
+int		map_afrom_attr_str(TALLOC_CTX *ctx, vp_map_t **out, char const *raw,
+				   request_refs_t dst_request_def, pair_lists_t dst_list_def,
+				   request_refs_t src_request_def, pair_lists_t src_list_def);
+
+int8_t		map_cmp_by_lhs_attr(void const *a, void const *b);
+
+void		map_sort(vp_map_t **maps, fr_cmp_t cmp);
+
+int		map_to_vp(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request,
+			  vp_map_t const *map, void *uctx) CC_HINT(nonnull (2,3,4));
+
+int		map_to_request(REQUEST *request, vp_map_t const *map,
+			       radius_map_getvalue_t func, void *ctx);
+
+bool		map_dst_valid(REQUEST *request, vp_map_t const *map);
+
+size_t		map_prints(char *buffer, size_t bufsize, vp_map_t const *map);
+
+void		map_debug_log(REQUEST *request, vp_map_t const *map,
+			      VALUE_PAIR const *vp) CC_HINT(nonnull(1, 2));
+
+bool		map_cast_from_hex(vp_map_t *map, FR_TOKEN rhs_type, char const *rhs);
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* MAP_H */
diff --git a/src/include/math.h b/src/include/math.h
new file mode 100644
index 0000000..dc7b197
--- /dev/null
+++ b/src/include/math.h
@@ -0,0 +1,161 @@
+#pragma once
+/*
+ *   This library is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU Lesser General Public
+ *   License as published by the Free Software Foundation; either
+ *   version 2.1 of the License, or (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ *   Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public
+ *   License along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/** Various miscellaneous utility functions
+ *
+ * @file src/lib/util/misc.h
+ *
+ * @copyright 2000,2006 The FreeRADIUS server project
+ */
+RCSIDH(math_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+/** Find the highest order high bit in an unsigned 64 bit integer
+ *
+ * @return 0-64 indicating the position of the highest bit,
+ *	with 0 indicating no high bits, 1 indicating the 1st
+ *	bit and 64 indicating the last bit.
+ */
+static inline uint8_t fr_high_bit_pos(uint64_t num)
+{
+	if (num == 0) return 0;	/* num being zero is undefined behaviour for __builtin_clzll */
+
+#ifdef HAVE_BUILTIN_CLZLL
+	return (64 - __builtin_clzll(num));
+#else
+	uint8_t ret = 1;
+	while (num >>= 1) ret++;
+	return ret;
+#endif
+}
+
+/** Find the lowest order high bit in an unsigned 64 bit integer
+ *
+ * @return 0-64 indicating the position of the lowest bit,
+ *	with 0 indicating no high bits, 1 indicating the 1st
+ *	bit and 64 indicating the last bit.
+ */
+static inline uint8_t fr_low_bit_pos(uint64_t num)
+{
+	if (num == 0) return 0;
+
+#ifdef HAVE_BUILTIN_CLZLL
+	return __builtin_ctzll(num) + 1;
+#else
+	uint8_t ret = 1;
+
+	do {
+		if (num & 0x01) break;
+		ret++;
+	} while (num >>= 1);
+
+	return ret;
+#endif
+}
+
+/** Efficient calculation of log10 of a unsigned 64bit integer
+ *
+ * @param[in] num	to calculate log10 of.
+ * @return log10 of the integer
+ */
+static inline uint8_t fr_log10(uint64_t num)
+{
+	static uint64_t const pow_of_10[] =
+	{
+		1ULL,
+		10ULL,
+		100ULL,
+		1000ULL,
+		10000ULL,
+		100000ULL,
+		1000000ULL,
+		10000000ULL,
+		100000000ULL,
+		1000000000ULL,
+		10000000000ULL,
+		100000000000ULL,
+		1000000000000ULL,
+		10000000000000ULL,
+		100000000000000ULL,
+		1000000000000000ULL,
+		10000000000000000ULL,
+		100000000000000000ULL,
+		1000000000000000000ULL,
+		10000000000000000000ULL
+	};
+	uint64_t tmp;
+
+	tmp = (fr_high_bit_pos(num) * 1233) >> 12;
+	return tmp - (num < pow_of_10[tmp]);
+}
+
+/** Multiplies two integers together
+ *
+ * @param[in] _out	Where to store the result.
+ * @param[in] _a	first argument to multiply.
+ * @param[in] _b	second argument to multiply.
+ * @return
+ *      - false on overflow.
+ *      - true if there was no overflow.
+ */
+#define fr_multiply(_out, _a, _b) !__builtin_mul_overflow(_a, _b, _out)
+
+/** Adds two integers
+ *
+ * @param[in] _out	Where to store the result.
+ * @param[in] _a	first argument to add.
+ * @param[in] _b	second argument to add.
+ * @return
+ *      - false on overflow.
+ *      - true if there was no overflow.
+ */
+#define fr_add(_out, _a, _b) !__builtin_add_overflow(_a, _b, _out)
+
+/** Subtracts two integers
+ *
+ * @param[in] _out	Where to store the result.
+ * @param[in] _a	first argument to subtract.
+ * @param[in] _b	second argument to subtract.
+ * @return
+ *      - false on overflow.
+ *      - true if there was no overflow.
+ */
+#define fr_sub(_out, _a, _b) !__builtin_sub_overflow(_a, _b, _out)
+
+/** Round up - Only works if _mul is a power of 2 but avoids division
+ */
+#define ROUND_UP_POW2(_num, _mul)	(((_num) + ((_mul) - 1)) & ~((_mul) - 1))
+
+/** Round up - Works in all cases, but is slower
+ */
+#define ROUND_UP(_num, _mul)		(((((_num) + ((_mul) - 1))) / (_mul)) * (_mul))
+
+/** Get the ceiling value of integer division
+ *
+ */
+#define ROUND_UP_DIV(_x, _y)		(1 + (((_x) - 1) / (_y)))
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/include/md4.h b/src/include/md4.h
new file mode 100644
index 0000000..1492bd4
--- /dev/null
+++ b/src/include/md4.h
@@ -0,0 +1,137 @@
+/**
+ * $Id$
+ *
+ * @note license is LGPL, but largely derived from a public domain source.
+ *
+ * @file md4.h
+ * @brief Structures and prototypes for md4.
+ */
+
+#ifndef _FR_MD4_H
+#define _FR_MD4_H
+
+RCSIDH(md4_h, "$Id$")
+
+#ifdef HAVE_INTTYPES_H
+#  include <inttypes.h>
+#endif
+
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+
+#ifdef HAVE_STDINT_H
+#  include <stdint.h>
+#endif
+
+#include <string.h>
+
+#ifdef WITH_FIPS
+#undef HAVE_OPENSSL_MD4_H
+#endif
+
+#ifdef HAVE_OPENSSL_MD4_H
+#  include <openssl/md4.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef MD4_DIGEST_LENGTH
+#  define MD4_DIGEST_LENGTH 16
+#endif
+
+#ifndef HAVE_OPENSSL_MD4_H
+/*
+ * The MD5 code used here and in md4.c was originally retrieved from:
+ *   http://www.openbsd.org/cgi-bin/cvsweb/src/include/md4.h?rev=1.12
+ *
+ * This code implements the MD4 message-digest algorithm.
+ * The algorithm is due to Ron Rivest.  This code was
+ * written by Colin Plumb in 1993, no copyright is claimed.
+ * This code is in the public domain; do with it what you wish.
+ * Todd C. Miller modified the MD5 code to do MD4 based on RFC 1186.
+ *
+ * Equivalent code is available from RSA Data Security, Inc.
+ * This code has been tested against that, and is equivalent,
+ * except that you don't need to include two pages of legalese
+ * with every copy.
+ */
+#  define MD4_BLOCK_LENGTH 64
+#  define MD4_DIGEST_STRING_LENGTH (MD4_DIGEST_LENGTH * 2 + 1)
+
+typedef struct FR_MD4Context {
+	uint32_t state[4];			//!< State.
+	uint32_t count[2];			//!< Number of bits, mod 2^64.
+	uint8_t buffer[MD4_BLOCK_LENGTH];	//!< Input buffer.
+} FR_MD4_CTX;
+
+void	fr_md4_init(FR_MD4_CTX *ctx);
+void	fr_md4_update(FR_MD4_CTX *ctx, uint8_t const *in, size_t inlen)
+	CC_BOUNDED(__string__, 2, 3);
+void	fr_md4_final(uint8_t out[MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx)
+	CC_BOUNDED(__minbytes__, 1, MD4_DIGEST_LENGTH);
+void	fr_md4_transform(uint32_t buf[4], uint8_t const inc[MD4_BLOCK_LENGTH])
+	CC_BOUNDED(__size__, 1, 4, 4)
+	CC_BOUNDED(__minbytes__, 2, MD4_BLOCK_LENGTH);
+#  define fr_md4_destroy(_x)
+#else  /* HAVE_OPENSSL_MD4_H */
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+USES_APPLE_DEPRECATED_API
+#  define FR_MD4_CTX		MD4_CTX
+#  define fr_md4_init		MD4_Init
+#  define fr_md4_update		MD4_Update
+#  define fr_md4_final		MD4_Final
+#  define fr_md4_transform	MD4_Transform
+#  define fr_md4_destroy(_x)
+#else
+#include <openssl/evp.h>
+
+/*
+ *	Wrappers for OpenSSL3, so we don't have to butcher the rest of
+ *	the code too much.
+ */
+typedef struct FR_MD4_CTX {
+	EVP_MD_CTX	*ctx;
+	EVP_MD const   	*md;
+	unsigned int	len;
+} FR_MD4_CTX;
+
+static inline void fr_md4_init(FR_MD4_CTX *ctx)
+{
+	ctx->ctx = EVP_MD_CTX_new();
+//	ctx->md = EVP_MD_fetch(NULL, "MD4", "provider=legacy");
+	ctx->md = EVP_md4();
+	ctx->len = MD4_DIGEST_LENGTH;
+
+	EVP_MD_CTX_set_flags(ctx->ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+	EVP_DigestInit_ex(ctx->ctx, ctx->md, NULL);
+}
+
+static inline void fr_md4_update(FR_MD4_CTX *ctx, uint8_t const *in, size_t inlen)
+{
+        EVP_DigestUpdate(ctx->ctx, in, inlen);
+}
+
+static inline void fr_md4_final(uint8_t out[MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx)
+{
+	EVP_DigestFinal_ex(ctx->ctx, out, &(ctx->len));
+}
+
+static inline void fr_md4_destroy(FR_MD4_CTX *ctx)
+{
+	EVP_MD_CTX_destroy(ctx->ctx);
+//	EVP_MD_free(ctx->md);
+}
+
+#endif	/* OPENSSL3 */
+#endif	/* HAVE_OPENSSL_MD4_H */
+
+/* md4.c */
+void fr_md4_calc(uint8_t out[MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen);
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* _FR_MD4_H */
diff --git a/src/include/md5.h b/src/include/md5.h
new file mode 100644
index 0000000..b7d571a
--- /dev/null
+++ b/src/include/md5.h
@@ -0,0 +1,123 @@
+/**
+ * $Id$
+ *
+ * @note license is LGPL, but largely derived from a public domain source.
+ *
+ * @file md5.h
+ * @brief Structures and prototypes for md5.
+ */
+
+#ifndef _FR_MD5_H
+#define _FR_MD5_H
+
+RCSIDH(md5_h, "$Id$")
+
+#ifdef HAVE_INTTYPES_H
+#  include <inttypes.h>
+#endif
+
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+
+#ifdef HAVE_STDINT_H
+#  include <stdint.h>
+#endif
+
+#  include <string.h>
+
+#ifdef WITH_FIPS
+#undef HAVE_OPENSSL_MD5_H
+#endif
+
+#ifdef HAVE_OPENSSL_MD5_H
+#  include <openssl/md5.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef MD5_DIGEST_LENGTH
+#  define MD5_DIGEST_LENGTH 16
+#endif
+
+#ifndef HAVE_OPENSSL_MD5_H
+/*
+ * The MD5 code used here and in md5.c was originally retrieved from:
+ *   http://www.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/crypto/md5.h?rev=1.1
+ *
+ * This code implements the MD5 message-digest algorithm.
+ * The algorithm is due to Ron Rivest.  This code was
+ * written by Colin Plumb in 1993, no copyright is claimed.
+ * This code is in the public domain; do with it what you wish.
+ *
+ * Equivalent code is available from RSA Data Security, Inc.
+ * This code has been tested against that, and is equivalent,
+ * except that you don't need to include two pages of legalese
+ * with every copy.
+ */
+#  define MD5_BLOCK_LENGTH 64
+typedef struct FR_MD5Context {
+	uint32_t state[4];			//!< State.
+	uint32_t count[2];			//!< Number of bits, mod 2^64.
+	uint8_t buffer[MD5_BLOCK_LENGTH];	//!< Input buffer.
+} FR_MD5_CTX;
+
+void 	fr_md5_init(FR_MD5_CTX *ctx);
+void	fr_md5_update(FR_MD5_CTX *ctx, uint8_t const *in, size_t inlen)
+	CC_BOUNDED(__string__, 2, 3);
+void	fr_md5_final(uint8_t out[MD5_DIGEST_LENGTH], FR_MD5_CTX *ctx)
+	CC_BOUNDED(__minbytes__, 1, MD5_DIGEST_LENGTH);
+void	fr_md5_transform(uint32_t state[4], uint8_t const block[MD5_BLOCK_LENGTH])
+	CC_BOUNDED(__size__, 1, 4, 4)
+	CC_BOUNDED(__minbytes__, 2, MD5_BLOCK_LENGTH);
+#  define fr_md5_destroy(_x)
+#  define fr_md5_copy(_dst, _src) _dst = _src
+#else  /* HAVE_OPENSSL_MD5_H */
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+USES_APPLE_DEPRECATED_API
+#  define FR_MD5_CTX		MD5_CTX
+#  define fr_md5_init		MD5_Init
+#  define fr_md5_update		MD5_Update
+#  define fr_md5_final		MD5_Final
+#  define fr_md5_transform	MD5_Transform
+#  define fr_md5_copy(_dst, _src) _dst = _src
+#  define fr_md5_destroy(_x)
+#else
+#include <openssl/evp.h>
+
+/*
+ *	Wrappers for OpenSSL3, so we don't have to butcher the rest of
+ *	the code too much.
+ */
+typedef EVP_MD_CTX* FR_MD5_CTX;
+
+#  define fr_md5_init(_ctx) \
+	do { \
+		*_ctx = EVP_MD_CTX_new(); \
+		EVP_MD_CTX_set_flags(*_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); \
+		EVP_DigestInit_ex(*_ctx, EVP_md5(), NULL); \
+	} while (0)
+#  define fr_md5_update(_ctx, _str, _len) \
+        EVP_DigestUpdate(*_ctx, _str, _len)
+#  define fr_md5_final(_out, _ctx) \
+	EVP_DigestFinal_ex(*_ctx, _out, NULL)
+#  define fr_md5_destroy(_ctx)	EVP_MD_CTX_destroy(*_ctx)
+#  define fr_md5_copy(_dst, _src) EVP_MD_CTX_copy_ex(_dst, _src)
+#endif	/* OPENSSL3 */
+#endif	/* HAVE_OPENSSL_MD5_H */
+
+/* hmac.c */
+void	fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
+		    uint8_t const *key, size_t key_len)
+	CC_BOUNDED(__minbytes__, 1, MD5_DIGEST_LENGTH);
+
+/* md5.c */
+void	fr_md5_calc(uint8_t *out, uint8_t const *in, size_t inlen);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _FR_MD5_H */
diff --git a/src/include/missing-h b/src/include/missing-h
new file mode 100644
index 0000000..5698797
--- /dev/null
+++ b/src/include/missing-h
@@ -0,0 +1,530 @@
+#ifndef _FR_MISSING_H
+#define _FR_MISSING_H
+
+/*
+ * missing.h	Replacements for functions that are or can be
+ *		missing on some platforms.
+ *		HAVE_* and WITH_* defines are substituted at
+ *		build time by make with values from autoconf.h.
+ *
+ * Version:	$Id$
+ *
+ */
+RCSIDH(missing_h, "$Id$")
+
+#ifdef HAVE_STDINT_H
+#  include <stdint.h>
+#endif
+
+#ifdef HAVE_STDDEF_H
+#  include <stddef.h>
+#endif
+
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+
+#ifdef HAVE_INTTYPES_H
+#  include <inttypes.h>
+#endif
+
+#ifdef HAVE_STRINGS_H
+#  include <strings.h>
+#endif
+
+#ifdef HAVE_STRING_H
+#  include <string.h>
+#endif
+
+#ifdef HAVE_NETDB_H
+#  include <netdb.h>
+#endif
+
+#ifdef HAVE_NETINET_IN_H
+#  include <netinet/in.h>
+#endif
+
+#ifdef HAVE_ARPA_INET_H
+#  include <arpa/inet.h>
+#endif
+
+#ifdef HAVE_SYS_SELECT_H
+#  include <sys/select.h>
+#endif
+
+#ifdef HAVE_SYS_SOCKET_H
+#  include <sys/socket.h>
+#endif
+
+#ifdef HAVE_UNISTD_H
+#  include <unistd.h>
+#endif
+
+#ifndef HAVE_VSNPRINTF
+#  include <stdarg.h>
+#endif
+
+#ifdef HAVE_ERRNO_H
+#  include <errno.h>
+#endif
+
+/*
+ *  Check for inclusion of <time.h>, versus <sys/time.h>
+ *  Taken verbatim from the autoconf manual.
+ */
+#ifdef TIME_WITH_SYS_TIME
+#  include <sys/time.h>
+#  include <time.h>
+#else
+#  if HAVE_SYS_TIME_H
+#    include <sys/time.h>
+#  else
+#    include <time.h>
+#  endif
+#endif
+
+#ifdef HAVE_OPENSSL_SSL_H
+#  include <openssl/ssl.h>
+#endif
+
+#ifdef HAVE_OPENSSL_HMAC_H
+#  include <openssl/hmac.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ASN1_H
+#  include <openssl/asn1.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#  include <openssl/conf.h>
+#endif
+
+/*
+ *	Don't look for winsock.h if we're on cygwin.
+ */
+#if !defined(__CYGWIN__) && defined(HAVE_WINSOCK_H)
+#  include <winsock.h>
+#endif
+
+#ifdef __APPLE__
+#undef DARWIN
+#define DARWIN (1)
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	Functions from missing.c
+ */
+#ifndef HAVE_STRNCASECMP
+int strncasecmp(char *s1, char *s2, int n);
+#endif
+
+#ifndef HAVE_STRCASECMP
+int strcasecmp(char *s1, char *s2);
+#endif
+
+#ifndef HAVE_STRSEP
+char *strsep(char **stringp, char const *delim);
+#endif
+
+#ifndef HAVE_LOCALTIME_R
+struct tm;
+struct tm *localtime_r(time_t const *l_clock, struct tm *result);
+#endif
+
+#ifndef HAVE_CTIME_R
+char *ctime_r(time_t const *l_clock, char *l_buf);
+#endif
+
+#ifndef HAVE_INET_PTON
+int		inet_pton(int af, char const *src, void *dst);
+#endif
+#ifndef HAVE_INET_NTOP
+char const	*inet_ntop(int af, void const *src, char *dst, size_t cnt);
+#endif
+#ifndef HAVE_CLOSEFROM
+int		closefrom(int fd);
+#endif
+
+#ifndef HAVE_SETLINEBUF
+#  ifdef HAVE_SETVBUF
+#    define setlinebuf(x) setvbuf(x, NULL, _IOLBF, 0)
+#  else
+#    define setlinebuf(x)     0
+#  endif
+#endif
+
+#ifndef INADDR_ANY
+#  define INADDR_ANY      ((uint32_t) 0x00000000)
+#endif
+
+#ifndef INADDR_LOOPBACK
+#  define INADDR_LOOPBACK ((uint32_t) 0x7f000001) /* Inet 127.0.0.1 */
+#endif
+
+#ifndef INADDR_NONE
+#  define INADDR_NONE     ((uint32_t) 0xffffffff)
+#endif
+
+#ifndef INADDRSZ
+#  define INADDRSZ 4
+#endif
+
+#ifndef INET_ADDRSTRLEN
+#  define INET_ADDRSTRLEN 16
+#endif
+
+#ifndef AF_UNSPEC
+#  define AF_UNSPEC 0
+#endif
+
+#ifndef AF_INET6
+#  define AF_INET6 10
+#endif
+
+#ifndef HAVE_STRUCT_IN6_ADDR
+struct in6_addr
+{
+	union {
+		uint8_t	u6_addr8[16];
+		uint16_t u6_addr16[8];
+		uint32_t u6_addr32[4];
+	} in6_u;
+#  define s6_addr	in6_u.u6_addr8
+#  define s6_addr16	in6_u.u6_addr16
+#  define s6_addr32	in6_u.u6_addr32
+};
+
+#  ifndef IN6ADDRSZ
+#    define IN6ADDRSZ 16
+#  endif
+
+#  ifndef INET6_ADDRSTRLEN
+#    define INET6_ADDRSTRLEN 46
+#  endif
+
+#  ifndef IN6ADDR_ANY_INIT
+#    define IN6ADDR_ANY_INIT 		{{{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 }}}
+#  endif
+
+#  ifndef IN6ADDR_LOOPBACK_INIT
+#    define IN6ADDR_LOOPBACK_INIT 	{{{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 }}}
+#  endif
+
+#  ifndef IN6_IS_ADDR_UNSPECIFIED
+#    define IN6_IS_ADDR_UNSPECIFIED(a) \
+	(((__const uint32_t *) (a))[0] == 0				      \
+	 && ((__const uint32_t *) (a))[1] == 0				      \
+	 && ((__const uint32_t *) (a))[2] == 0				      \
+	 && ((__const uint32_t *) (a))[3] == 0)
+#  endif
+
+#  ifndef IN6_IS_ADDR_LOOPBACK
+#    define IN6_IS_ADDR_LOOPBACK(a) \
+	(((__const uint32_t *) (a))[0] == 0				      \
+	 && ((__const uint32_t *) (a))[1] == 0				      \
+	 && ((__const uint32_t *) (a))[2] == 0				      \
+	 && ((__const uint32_t *) (a))[3] == htonl (1))
+#  endif
+
+#  ifndef IN6_IS_ADDR_MULTICAST
+#    define IN6_IS_ADDR_MULTICAST(a) (((__const uint8_t *) (a))[0] == 0xff)
+#  endif
+
+#  ifndef IN6_IS_ADDR_LINKLOCAL
+#    define IN6_IS_ADDR_LINKLOCAL(a) \
+	((((__const uint32_t *) (a))[0] & htonl (0xffc00000))		      \
+	 == htonl (0xfe800000))
+#  endif
+
+#  ifndef IN6_IS_ADDR_SITELOCAL
+#    define IN6_IS_ADDR_SITELOCAL(a) \
+	((((__const uint32_t *) (a))[0] & htonl (0xffc00000))		      \
+	 == htonl (0xfec00000))
+#  endif
+
+#  ifndef IN6_IS_ADDR_V4MAPPED
+#    define IN6_IS_ADDR_V4MAPPED(a) \
+	((((__const uint32_t *) (a))[0] == 0)				      \
+	 && (((__const uint32_t *) (a))[1] == 0)			      \
+	 && (((__const uint32_t *) (a))[2] == htonl (0xffff)))
+#  endif
+
+#  ifndef IN6_IS_ADDR_V4COMPAT
+#    define IN6_IS_ADDR_V4COMPAT(a) \
+	((((__const uint32_t *) (a))[0] == 0)				      \
+	 && (((__const uint32_t *) (a))[1] == 0)			      \
+	 && (((__const uint32_t *) (a))[2] == 0)			      \
+	 && (ntohl (((__const uint32_t *) (a))[3]) > 1))
+#  endif
+
+#  ifndef IN6_ARE_ADDR_EQUAL
+#    define IN6_ARE_ADDR_EQUAL(a,b) \
+	((((__const uint32_t *) (a))[0] == ((__const uint32_t *) (b))[0])     \
+	 && (((__const uint32_t *) (a))[1] == ((__const uint32_t *) (b))[1])  \
+	 && (((__const uint32_t *) (a))[2] == ((__const uint32_t *) (b))[2])  \
+	 && (((__const uint32_t *) (a))[3] == ((__const uint32_t *) (b))[3]))
+#  endif
+#endif /* HAVE_STRUCT_IN6_ADDR */
+
+/*
+ *	Functions from getaddrinfo.c
+ */
+
+#ifndef HAVE_STRUCT_SOCKADDR_STORAGE
+struct sockaddr_storage
+{
+    uint16_t ss_family;		/* Address family, etc.  */
+    char ss_padding[128 - (sizeof(uint16_t))];
+};
+#endif
+
+#ifndef HAVE_STRUCT_ADDRINFO
+/* for old netdb.h */
+#  ifndef EAI_SERVICE
+#    define EAI_MEMORY      2
+#    define EAI_FAMILY      5	/* ai_family not supported */
+#    define EAI_NONAME      8	/* hostname nor servname provided, or not known */
+#    define EAI_SERVICE     9	/* servname not supported for ai_socktype */
+#  endif
+
+/* dummy value for old netdb.h */
+#  ifndef AI_PASSIVE
+#    define AI_PASSIVE      1
+#    define AI_CANONNAME    2
+#    define AI_NUMERICHOST  4
+#    define NI_NUMERICHOST  2
+#    define NI_NAMEREQD     4
+#    define NI_NUMERICSERV  8
+
+struct addrinfo
+{
+  int ai_flags;			/* Input flags.  */
+  int ai_family;		/* Protocol family for socket.  */
+  int ai_socktype;		/* Socket type.  */
+  int ai_protocol;		/* Protocol for socket.  */
+  socklen_t ai_addrlen;		/* Length of socket address.  */
+  struct sockaddr *ai_addr;	/* Socket address for socket.  */
+  char *ai_canonname;		/* Canonical name for service location.  */
+  struct addrinfo *ai_next;	/* Pointer to next in list.  */
+};
+
+#  endif /* AI_PASSIVE */
+#endif /* HAVE_STRUCT_ADDRINFO */
+
+/* Translate name of a service location and/or a service name to set of
+   socket addresses. */
+#ifndef HAVE_GETADDRINFO
+int getaddrinfo(char const *__name, char const *__service,
+		struct addrinfo const *__req,
+		struct addrinfo **__pai);
+
+/* Free `addrinfo' structure AI including associated storage.  */
+void freeaddrinfo (struct addrinfo *__ai);
+
+/* Convert error return from getaddrinfo() to a string.  */
+char const *gai_strerror (int __ecode);
+#endif
+
+/* Translate a socket address to a location and service name. */
+#ifndef HAVE_GETNAMEINFO
+int getnameinfo(struct sockaddr const *__sa,
+		socklen_t __salen, char *__host,
+		size_t __hostlen, char *__serv,
+		size_t __servlen, unsigned int __flags);
+#endif
+
+/*
+ *	Functions from snprintf.c
+ */
+#ifndef HAVE_VSNPRINTF
+int vsnprintf(char *str, size_t count, char const *fmt, va_list arg);
+#endif
+
+#ifndef HAVE_SNPRINTF
+int snprintf(char *str, size_t count, char const *fmt, ...);
+#endif
+
+/*
+ *	Functions from strl{cat,cpy}.c
+ */
+#ifndef HAVE_STRLCPY
+size_t strlcpy(char *dst, char const *src, size_t siz);
+#endif
+
+#ifndef HAVE_STRLCAT
+size_t strlcat(char *dst, char const *src, size_t siz);
+#endif
+
+#ifndef INT16SZ
+#  define INT16SZ (2)
+#endif
+
+#ifndef HAVE_GMTIME_R
+struct tm *gmtime_r(time_t const *l_clock, struct tm *result);
+#endif
+
+#ifndef HAVE_VDPRINTF
+int vdprintf (int fd, char const *format, va_list args);
+#endif
+
+#ifndef HAVE_GETTIMEOFDAY
+int gettimeofday (struct timeval *tv, void *tz);
+#endif
+
+/*
+ *	Work around different ctime_r styles
+ */
+#if defined(CTIMERSTYLE) && (CTIMERSTYLE == SOLARISSTYLE)
+#  define CTIME_R(a,b,c) ctime_r(a,b,c)
+#  define ASCTIME_R(a,b,c) asctime_r(a,b,c)
+#else
+#  define CTIME_R(a,b,c) ctime_r(a,b)
+#  define ASCTIME_R(a,b,c) asctime_r(a,b)
+#endif
+
+#ifdef WIN32
+#  undef interface
+#  undef mkdir
+#  define mkdir(_d, _p) mkdir(_d)
+#  define FR_DIR_SEP '\\'
+#  define FR_DIR_IS_RELATIVE(p) ((*p && (p[1] != ':')) || ((*p != '\\') && (*p != '\\')))
+#else
+#  define FR_DIR_SEP '/'
+#  define FR_DIR_IS_RELATIVE(p) ((*p) != '/')
+#endif
+
+#ifndef offsetof
+#  define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+#endif
+
+void timeval2ntp(struct  timeval const *tv, uint8_t *ntp);
+void ntp2timeval(struct timeval *tv, char const *ntp);
+
+/*
+ *	This is really hacky. Any code needing to perform operations on 128bit integers,
+ *	or return 128BIT integers should check for HAVE_128BIT_INTEGERS.
+ */
+#ifndef HAVE_UINT128_T
+#  ifdef HAVE___UINT128_T
+#    define HAVE_128BIT_INTEGERS
+#    define uint128_t __uint128_t
+#    define int128_t __int128_t
+#  else
+typedef struct uint128_t { uint8_t v[16]; } uint128_t;
+typedef struct int128_t { uint8_t v[16]; } int128_t;
+#  endif
+#else
+#  define HAVE_128BIT_INTEGERS
+#endif
+
+/* abcd efgh -> dcba hgfe -> hgfe dcba */
+#ifndef HAVE_HTONLL
+#  ifdef FR_LITTLE_ENDIAN
+#    ifdef HAVE_BUILTIN_BSWAP64
+#      define ntohll(x) __builtin_bswap64(x)
+#    else
+#      define ntohll(x) (((uint64_t)ntohl((uint32_t)(x >> 32))) | (((uint64_t)ntohl(((uint32_t) x)) << 32)))
+#    endif
+#  else
+#    define ntohll(x) (x)
+#  endif
+#  define htonll(x) ntohll(x)
+#endif
+
+#ifndef HAVE_HTONLLL
+#  ifdef FR_LITTLE_ENDIAN
+#    ifdef HAVE_128BIT_INTEGERS
+#      define ntohlll(x) (((uint128_t)ntohll((uint64_t)(x >> 64))) | (((uint128_t)ntohll(((uint64_t) x)) << 64)))
+#    else
+uint128_t ntohlll(uint128_t num);
+#    endif
+#  else
+#    define ntohlll(x) (x)
+#  endif
+#  define htonlll(x) htohlll(x)
+#endif
+
+#ifndef HAVE_SIG_T
+typedef void(*sig_t)(int);
+#endif
+
+#ifdef HAVE_OPENSSL_HMAC_H
+#  ifndef HAVE_HMAC_CTX_NEW
+HMAC_CTX *HMAC_CTX_new(void);
+#  endif
+#  ifndef HAVE_HMAC_CTX_FREE
+void HMAC_CTX_free(HMAC_CTX *ctx);
+#  endif
+#endif
+
+#ifdef HAVE_OPENSSL_ASN1_H
+#  ifndef HAVE_ASN1_STRING_GET0_DATA
+static inline const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x)
+{
+	/*
+	 * Trick the compiler into not issuing the warning on qualifier stripping.
+	 * We know that ASN1_STRING_data doesn't change x, and we're casting
+	 * the return value back to const immediately, so it's OK.
+	 */
+	union {
+		const ASN1_STRING	*c;
+		ASN1_STRING		*nc;
+	} const_strip = {.c = x};
+	return ASN1_STRING_data(const_strip.nc);
+}
+#  endif
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#  ifndef HAVE_CONF_MODULES_LOAD_FILE
+static inline int CONF_modules_load_file(const char *filename,
+					 const char *appname,
+					 unsigned long flags)
+{
+	(void)filename;
+	(void)flags;
+	return OPENSSL_config(appname);
+}
+#  endif
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#ifdef HAVE_OPENSSL_SSL_H
+#  ifndef HAVE_SSL_GET_CLIENT_RANDOM
+size_t SSL_get_client_random(const SSL *s, unsigned char *out, size_t outlen);
+#  endif
+#  ifndef HAVE_SSL_GET_SERVER_RANDOM
+size_t SSL_get_server_random(const SSL *s, unsigned char *out, size_t outlen);
+#  endif
+#  ifndef HAVE_SSL_SESSION_GET_MASTER_KEY
+size_t SSL_SESSION_get_master_key(const SSL_SESSION *s,
+				  unsigned char *out, size_t outlen);
+#  endif
+#endif
+
+/*
+ *  NetBSD doesn't have O_DIRECTORY.
+ */
+#ifndef O_DIRECTORY
+#define O_DIRECTORY 0
+#endif
+
+#ifndef O_NOFOLLOW
+#define O_NOFOLLOW 0
+#endif
+
+/*
+ *	Not really missing, but may be submitted as patches
+ *	to the talloc project at some point in the future.
+ */
+char *talloc_typed_strdup(const void *t, const char *p);
+char *talloc_typed_asprintf(const void *t, const char *fmt, ...) CC_HINT(format (printf, 2, 3));
+char *talloc_bstrndup(const void *t, char const *in, size_t inlen);
+#endif /* _FR_MISSING_H */
diff --git a/src/include/modcall.h b/src/include/modcall.h
new file mode 100644
index 0000000..7486ef1
--- /dev/null
+++ b/src/include/modcall.h
@@ -0,0 +1,55 @@
+#ifndef FR_MODCALL_H
+#define FR_MODCALL_H
+
+/* modcall.h: the outside interface to the module-calling tree. Includes
+ * functions to build the tree from the config file, and to call it by
+ * feeding it REQUESTs.
+ *
+ * Version: $Id$ */
+
+#include <freeradius-devel/conffile.h> /* Need CONF_* definitions */
+#include <freeradius-devel/modules.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	For each authorize/authtype/etc, we have an ordered
+ *	tree of instances to call.  This data structure keeps track
+ *	of that order.
+ */
+typedef struct modcallable modcallable;
+
+int modcall_fixup_update(vp_map_t *map, void *ctx);
+
+int modcall(rlm_components_t component, modcallable *c, REQUEST *request);
+
+/* Parse a module-method's config section (e.g. authorize{}) into a tree that
+ * may be called with modcall() */
+modcallable *compile_modgroup(modcallable *parent,
+			      rlm_components_t component, CONF_SECTION *cs);
+
+/* Create a single modcallable node that references a module instance. This
+ * may be a CONF_SECTION containing action specifiers like "notfound = return"
+ * or a simple CONF_PAIR, in which case the default actions are used. */
+modcallable *compile_modsingle(TALLOC_CTX *ctx, modcallable **parent, rlm_components_t component, CONF_ITEM *ci,
+			       char const **modname);
+
+/*
+ *	Do the second pass on compiling the modules.
+ */
+bool modcall_pass2(modcallable *mc);
+
+/* Add an entry to the end of a modgroup */
+void add_to_modcallable(modcallable *parent, modcallable *this);
+
+void modcall_debug(modcallable *mc, int depth);
+
+int modcall_pass2_condition(fr_cond_t *c);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/modpriv.h b/src/include/modpriv.h
new file mode 100644
index 0000000..f69b47c
--- /dev/null
+++ b/src/include/modpriv.h
@@ -0,0 +1,69 @@
+/* modpriv.h: Stuff needed by both modules.c and modcall.c, but should not be
+ * accessed from anywhere else.
+ *
+ * Version: $Id$ */
+#ifndef FR_MODPRIV_H
+#define FR_MODPRIV_H
+
+#include <freeradius-devel/radiusd.h>
+#include <freeradius-devel/modules.h>
+
+#ifndef HAVE_DLFCN_H
+#error FreeRADIUS needs either libltdl, or a working dlopen()
+#else
+#include <dlfcn.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void *fr_dlhandle;
+
+fr_dlhandle fr_dlopenext(char const *name);
+void *fr_dlsym(fr_dlhandle handle, char const *symbol);
+int fr_dlclose(fr_dlhandle handle);
+char const *fr_dlerror(void);
+
+/*
+ *	Keep track of which modules we've loaded.
+ */
+typedef struct module_entry_t {
+	char			name[MAX_STRING_LEN];
+	module_t const		*module;
+	fr_dlhandle		handle;
+} module_entry_t;
+
+typedef struct fr_module_hup_t fr_module_hup_t;
+
+/*
+ *	Per-instance data structure, to correlate the modules
+ *	with the instance names (may NOT be the module names!),
+ *	and the per-instance data structures.
+ */
+typedef struct module_instance_t {
+	char			name[MAX_STRING_LEN];
+	module_entry_t		*entry;
+	void			*insthandle;
+#ifdef HAVE_PTHREAD_H
+	pthread_mutex_t		*mutex;
+#endif
+	CONF_SECTION		*cs;
+	time_t			last_hup;
+	bool			instantiated;
+	bool			force;
+	rlm_rcode_t		code;
+	fr_module_hup_t	       	*mh;
+} module_instance_t;
+
+module_instance_t	*module_instantiate(CONF_SECTION *modules, char const *askedname);
+module_instance_t	*module_instantiate_method(CONF_SECTION *modules, char const *askedname, rlm_components_t *method);
+module_instance_t	*module_find(CONF_SECTION *modules, char const *askedname);
+int			find_module_sibling_section(CONF_SECTION **out, CONF_SECTION *module, char const *name);
+int			module_hup_module(CONF_SECTION *cs, module_instance_t *node, time_t when);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* FR_MODPRIV_H */
diff --git a/src/include/modules.h b/src/include/modules.h
new file mode 100644
index 0000000..9ba81b3
--- /dev/null
+++ b/src/include/modules.h
@@ -0,0 +1,175 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ *
+ * @file modules.h
+ * @brief Interface to the RADIUS module system.
+ *
+ * @copyright 2013 The FreeRADIUS server project
+ */
+
+#ifndef RADIUS_MODULES_H
+#define RADIUS_MODULES_H
+
+RCSIDH(modules_h, "$Id$")
+
+#include <freeradius-devel/conffile.h>
+#include <freeradius-devel/features.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** The different section components of the server
+ *
+ * Used as indexes in the methods array in the module_t struct.
+ */
+typedef enum rlm_components {
+	MOD_AUTHENTICATE = 0,	//!< 0 methods index for authenticate section.
+	MOD_AUTHORIZE,		//!< 1 methods index for authorize section.
+	MOD_PREACCT,		//!< 2 methods index for preacct section.
+	MOD_ACCOUNTING,		//!< 3 methods index for accounting section.
+	MOD_SESSION,		//!< 4 methods index for checksimul section.
+	MOD_PRE_PROXY,		//!< 5 methods index for preproxy section.
+	MOD_POST_PROXY,		//!< 6 methods index for postproxy section.
+	MOD_POST_AUTH,		//!< 7 methods index for postauth section.
+#ifdef WITH_COA
+	MOD_RECV_COA,		//!< 8 methods index for recvcoa section.
+	MOD_SEND_COA,		//!< 9 methods index for sendcoa section.
+#endif
+	MOD_COUNT		//!< 10 how many components there are.
+} rlm_components_t;
+
+extern const FR_NAME_NUMBER mod_rcode_table[];
+
+/** Map a section name, to a section typename, to an attribute number
+ *
+ * Used by modules.c to define the mappings between names, types and control
+ * attributes.
+ */
+typedef struct section_type_value_t {
+	char const      *section;	//!< Section name e.g. "Authorize".
+	char const      *typename;	//!< Type name e.g. "Auth-Type".
+	int	     attr;		//!< Attribute number.
+} section_type_value_t;
+
+/** Mappings between section names, typenames and control attributes
+ *
+ * Defined in modules.c.
+ */
+extern const section_type_value_t section_type_value[];
+
+#define RLM_TYPE_THREAD_SAFE	(0 << 0) 	//!< Module is threadsafe.
+#define RLM_TYPE_THREAD_UNSAFE	(1 << 0) 	//!< Module is not threadsafe.
+						//!< Server will protect calls
+						//!< with mutex.
+#define RLM_TYPE_HUP_SAFE	(1 << 2) 	//!< Will be restarted on HUP.
+						//!< Server will instantiated
+						//!< new instance, and then
+						//!< destroy old instance.
+
+
+/* Stop people using different module/library/server versions together */
+#define RLM_MODULE_INIT RADIUSD_MAGIC_NUMBER
+
+/** Module section callback
+ *
+ * Is called when the module is listed in a particular section of a virtual
+ * server, and the request has reached the module call.
+ *
+ * @param[in] instance created in instantiated, holds module config.
+ * @param[in,out] request being processed.
+ * @return the appropriate rcode.
+ */
+typedef rlm_rcode_t (*packetmethod)(void *instance, REQUEST *request);
+
+/** Module instantiation callback
+ *
+ * Is called once per module instance. Is not called when new threads are
+ * spawned. Modules that require separate thread contexts should use the
+ * connection pool API.
+ *
+ * @param[in] mod_cs Module instance's configuration section.
+ * @param[out] instance Module instance's configuration structure, should be
+ *		alloced by by callback and freed by detach.
+ * @return -1 if instantiation failed, else 0.
+ */
+typedef int (*instantiate_t)(CONF_SECTION *mod_cs, void *instance);
+
+/** Module detach callback
+ *
+ * Is called just before the server exits, and after re-instantiation on HUP,
+ * to free the old module instance.
+ *
+ * Detach should close all handles associated with the module instance, and
+ * free any memory allocated during instantiate.
+ *
+ * @param[in] instance to free.
+ * @return -1 if detach failed, else 0.
+ */
+typedef int (*detach_t)(void *instance);
+
+/** Metadata exported by the module
+ *
+ * This determines the capabilities of the module, and maps internal functions
+ * within the module to different sections.
+ */
+typedef struct module_t {
+	uint64_t 		magic;			//!< Used to validate module struct.
+	char const		*name;			//!< The name of the module (without rlm_ prefix).
+	int			type;			//!< One or more of the RLM_TYPE_* constants.
+	size_t			inst_size;		//!< Size of the instance data
+	CONF_PARSER const	*config;		//!< Configuration information
+	instantiate_t		bootstrap;		//!< register dynamic attrs, etc.
+	instantiate_t		instantiate;		//!< Function to use for instantiation.
+	detach_t		detach;			//!< Function to use to free module instance.
+	packetmethod		methods[MOD_COUNT];	//!< Pointers to the various section functions.
+} module_t;
+
+int modules_init(CONF_SECTION *);
+int modules_free(void);
+int modules_hup(CONF_SECTION *modules);
+rlm_rcode_t process_authorize(int type, REQUEST *request);
+rlm_rcode_t process_authenticate(int type, REQUEST *request);
+rlm_rcode_t module_preacct(REQUEST *request);
+rlm_rcode_t process_accounting(int type, REQUEST *request);
+int process_checksimul(int type, REQUEST *request, int maxsimul);
+rlm_rcode_t process_pre_proxy(int type, REQUEST *request);
+rlm_rcode_t process_post_proxy(int type, REQUEST *request);
+rlm_rcode_t process_post_auth(int type, REQUEST *request);
+#ifdef WITH_COA
+rlm_rcode_t process_recv_coa(int type, REQUEST *request);
+rlm_rcode_t process_send_coa(int type, REQUEST *request);
+#define MODULE_NULL_COA_FUNCS ,NULL,NULL
+#else
+#define MODULE_NULL_COA_FUNCS
+#endif
+
+rlm_rcode_t indexed_modcall(rlm_components_t comp, int idx, REQUEST *request);
+
+/*
+ *	For now, these are strongly tied together.
+ */
+int virtual_servers_load(CONF_SECTION *config);
+void virtual_servers_free(time_t when);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* RADIUS_MODULES_H */
diff --git a/src/include/net.h b/src/include/net.h
new file mode 100644
index 0000000..2d87b4c
--- /dev/null
+++ b/src/include/net.h
@@ -0,0 +1,140 @@
+#ifndef FR_NET_H
+#define FR_NET_H
+/*
+ *   This program is is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License, version 2 of the
+ *   License as published by the Free Software Foundation.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ * @file include/net.h
+ * @brief Structures and functions for parsing raw network packets.
+ *
+ * @author Arran Cudbard-Bell <a.cudbardb@freeradius.org>
+ * @copyright 2014 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
+ */
+
+/*
+ *	If we don't have libpcap, we still need an enumeration of link layers.
+ */
+#ifdef HAVE_LIBPCAP
+#  include <pcap.h>
+#else
+typedef enum {
+	DLT_RAW,
+	DLT_NULL,
+	DLT_LOOP,
+	DLT_EN10MB,
+	DLT_LINUX_SLL,
+	DLT_PFLOG
+} fr_dlt;
+#endif
+
+/*
+ *	The number of bytes in an ethernet (MAC) address.
+ */
+#define ETHER_ADDR_LEN 	6
+
+/*
+ *	Length of a DEC/Intel/Xerox or 802.3 Ethernet header.
+ *	Note that some compilers may pad "struct ether_header" to
+ *	a multiple of 4 *bytes, for example, so "sizeof (struct
+ *	ether_header)" may not give the right answer.
+ *
+ *	6 Byte SRC, 6 Byte DST, 2 Byte Ether type, 4 Byte CVID, 4 Byte SVID
+ */
+#define ETHER_HDR_LEN	22
+#define IP_HDR_LEN	60
+
+/*
+ *	The number of bytes in a RADIUS packet header.
+ */
+#define RADIUS_HDR_LEN	20
+
+/*
+ *	RADIUS packet length.
+ *	RFC 2865, Section 3., subsection 'length' says:
+ *	" ... and maximum length is 4096."
+ */
+#define MAX_RADIUS_LEN	4096
+#define MIN_RADIUS_LEN	20
+
+
+#define IP_V(ip)	(((ip)->ip_vhl & 0xf0) >> 4)
+#define IP_HL(ip)       ((ip)->ip_vhl & 0x0f)
+
+#define IP_VHL(v, hl) ((v & 0x0f) << 4) | (hl & 0x0f)
+
+#define	I_DF		0x4000		//!< Dont fragment flag.
+#define IP_MF		0x2000		//!< More fragments flag.
+#define IP_OFFMASK	0x1fff		//!< Mask for fragmenting bits.
+
+/*
+ *	Structure of a DEC/Intel/Xerox or 802.3 Ethernet header.
+ */
+typedef struct CC_HINT(__packed__) ethernet_header {
+	uint8_t		ether_dst[ETHER_ADDR_LEN];
+	uint8_t		ether_src[ETHER_ADDR_LEN];
+	uint16_t	ether_type;
+} ethernet_header_t;
+
+/*
+ *	Structure of an internet header, naked of options.
+ */
+typedef struct CC_HINT(__packed__) ip_header {
+	uint8_t		ip_vhl;		//!< Header length, version.
+
+	uint8_t		ip_tos;		//!< Type of service.
+	uint16_t	ip_len;		//!< Total length.
+	uint16_t	ip_id;		//!< identification.
+	uint16_t	ip_off;		//!< Fragment offset field.
+
+	uint8_t		ip_ttl;		//!< Time To Live.
+	uint8_t		ip_p;		//!< Protocol.
+	uint16_t	ip_sum;		//!< Checksum.
+	struct in_addr	ip_src, ip_dst;	//!< Src and Dst address
+} ip_header_t;
+
+typedef struct CC_HINT(__packed__) ip_header6 {
+	uint32_t	ip_vtcfl;	//!< Version, traffic class, flow label.
+	uint16_t	ip_len;		//!< Payload length
+
+	uint8_t		ip_next;	//!< Next header (protocol)
+	uint8_t		ip_hopl;	//!< IP Hop Limit
+
+	struct in6_addr ip_src, ip_dst;	//!< Src and Dst address
+} ip_header6_t;
+
+/*
+ *	UDP protocol header.
+ *	Per RFC 768, September, 1981.
+ */
+typedef struct CC_HINT(__packed__) udp_header {
+	uint16_t	src;		//!< Source port.
+	uint16_t	dst;		//!< Destination port.
+	uint16_t	len;		//!< UDP length.
+	uint16_t	checksum;	//!< UDP checksum.
+} udp_header_t;
+
+typedef struct CC_HINT(__packed__) radius_packet_t {
+	uint8_t		code;
+	uint8_t		id;
+	uint8_t		length[2];
+	uint8_t		vector[AUTH_VECTOR_LEN];
+	uint8_t		data[];
+} radius_packet_t;
+
+uint16_t	fr_udp_checksum(uint8_t const *data, uint16_t len, uint16_t checksum,
+			 	struct in_addr const src_addr, struct in_addr const dst_addr);
+uint16_t	fr_iph_checksum(uint8_t const *data, uint8_t ihl);
+#endif /* FR_NET_H */
diff --git a/src/include/openssl3.h b/src/include/openssl3.h
new file mode 100644
index 0000000..4423ee5
--- /dev/null
+++ b/src/include/openssl3.h
@@ -0,0 +1,109 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_OPENSSL3_H
+#define FR_OPENSSL3_H
+/**
+ * $Id$
+ *
+ * @file openssl3.h
+ * @brief Wrappers to shut up OpenSSL3
+ *
+ * @copyright 2021 Network RADIUS SAS (legal@networkradius.com)
+ */
+
+RCSIDH(openssl3_h, "$Id$")
+
+/*
+ *	The HMAC APIs are deprecated in OpenSSL3.  We don't want to
+ *	fill the code with ifdef's, so we define some horrific
+ *	wrappers here.
+ *
+ *	This file should be included AFTER all OpenSSL header files.
+ */
+#ifdef HAVE_OPENSSL_SSL_H
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <string.h>
+#include <openssl/evp.h>
+#include <openssl/core_names.h>
+
+typedef struct {
+	EVP_MAC		*mac;
+	EVP_MAC_CTX	*ctx;
+} HMAC3_CTX;
+#define HMAC_CTX HMAC3_CTX
+
+#define HMAC_CTX_new HMAC3_CTX_new
+static inline HMAC3_CTX *HMAC3_CTX_new(void)
+{
+	HMAC3_CTX *h = calloc(1, sizeof(*h));
+
+	return h;
+}
+
+#define HMAC_Init_ex(_ctx, _key, _keylen, _md, _engine) HMAC3_Init_ex(_ctx, _key, _keylen, _md, _engine)
+static inline int HMAC3_Init_ex(HMAC3_CTX *ctx, const unsigned char *key, unsigned int keylen, const EVP_MD *md, UNUSED void *engine)
+{
+	OSSL_PARAM params[2], *p = params;
+	char const *name;
+	char *unconst;
+
+	ctx->mac = EVP_MAC_fetch(NULL, "HMAC", NULL);
+	if (!ctx->mac) return 0;
+
+	ctx->ctx = EVP_MAC_CTX_new(ctx->mac);
+	if (!ctx->ctx) return 0;
+
+	name = EVP_MD_get0_name(md);
+	memcpy(&unconst, &name, sizeof(name)); /* const issues */
+
+	p[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST, unconst, 0);
+	p[1] = OSSL_PARAM_construct_end();
+
+	return EVP_MAC_init(ctx->ctx, key, keylen, params);
+}
+
+#define HMAC_Update HMAC3_Update
+static inline int HMAC3_Update(HMAC3_CTX *ctx, const unsigned char *data, unsigned int datalen)
+{
+	return EVP_MAC_update(ctx->ctx, data, datalen);
+}
+
+#define HMAC_Final HMAC3_Final
+static inline int HMAC3_Final(HMAC3_CTX *ctx, unsigned char *out, unsigned int *len)
+{
+	size_t mylen = *len;
+
+	if (!EVP_MAC_final(ctx->ctx, out, &mylen, mylen)) return 0;
+
+	*len = mylen;
+	return 1;
+}
+
+#define HMAC_CTX_free HMAC3_CTX_free
+static inline void HMAC3_CTX_free(HMAC3_CTX *ctx)
+{
+	if (!ctx) return;
+
+	EVP_MAC_free(ctx->mac);
+	EVP_MAC_CTX_free(ctx->ctx);
+	free(ctx);
+}
+
+#define HMAC_CTX_set_flags(_ctx, _flags)
+
+#endif	/* OPENSSL_VERSION_NUMBER */
+#endif
+#endif /* FR_OPENSSL3_H */
diff --git a/src/include/packet.h b/src/include/packet.h
new file mode 100644
index 0000000..5b41498
--- /dev/null
+++ b/src/include/packet.h
@@ -0,0 +1,87 @@
+#ifndef FR_PACKET_H
+#define FR_PACKET_H
+
+/*
+ * packet.h	Structures and prototypes
+ *		for packet manipulation
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2001,2002,2003,2004,2005,2006  The FreeRADIUS server project
+ */
+
+RCSIDH(packet_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int fr_packet_cmp(RADIUS_PACKET const *a, RADIUS_PACKET const *b);
+int fr_inaddr_any(fr_ipaddr_t *ipaddr);
+void fr_request_from_reply(RADIUS_PACKET *request,
+			     RADIUS_PACKET const *reply);
+int fr_socket(fr_ipaddr_t *ipaddr, uint16_t port);
+
+typedef struct fr_packet_list_t fr_packet_list_t;
+
+fr_packet_list_t *fr_packet_list_create(int alloc_id);
+void fr_packet_list_free(fr_packet_list_t *pl);
+bool fr_packet_list_insert(fr_packet_list_t *pl,
+			    RADIUS_PACKET **request_p);
+
+RADIUS_PACKET **fr_packet_list_find(fr_packet_list_t *pl,
+				      RADIUS_PACKET *request);
+RADIUS_PACKET **fr_packet_list_find_byreply(fr_packet_list_t *pl,
+					      RADIUS_PACKET *reply);
+bool fr_packet_list_yank(fr_packet_list_t *pl,
+			 RADIUS_PACKET *request);
+uint32_t fr_packet_list_num_elements(fr_packet_list_t *pl);
+bool fr_packet_list_id_alloc(fr_packet_list_t *pl, int proto,
+			    RADIUS_PACKET **request_p, void **pctx);
+bool fr_packet_list_id_free(fr_packet_list_t *pl,
+			    RADIUS_PACKET *request, bool yank);
+bool fr_packet_list_socket_add(fr_packet_list_t *pl, int sockfd, int proto,
+#ifdef WITH_RADIUSV11
+			       bool radiusv11,
+#endif
+			       fr_ipaddr_t *dst_ipaddr, uint16_t dst_port,
+			       void *ctx);
+bool fr_packet_list_socket_del(fr_packet_list_t *pl, int sockfd);
+bool fr_packet_list_socket_freeze(fr_packet_list_t *pl, int sockfd);
+bool fr_packet_list_socket_thaw(fr_packet_list_t *pl, int sockfd);
+int fr_packet_list_walk(fr_packet_list_t *pl, void *ctx, rb_walker_t callback);
+int fr_packet_list_fd_set(fr_packet_list_t *pl, fd_set *set);
+RADIUS_PACKET *fr_packet_list_recv(fr_packet_list_t *pl, fd_set *set);
+
+uint32_t fr_packet_list_num_incoming(fr_packet_list_t *pl);
+uint32_t fr_packet_list_num_outgoing(fr_packet_list_t *pl);
+void fr_packet_header_print(FILE *fp, RADIUS_PACKET *packet, bool received);
+
+/*
+ *	"find" returns a pointer to the RADIUS_PACKET* member in the
+ *	caller's structure.  In order to get the pointer to the *top*
+ *	of the caller's structure, you have to subtract the offset to
+ *	the member from the returned pointer, and cast it to the
+ *	required type.
+ */
+# define fr_packet2myptr(TYPE, MEMBER, PTR) (TYPE *) (((char *)PTR) - offsetof(TYPE, MEMBER))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_PACKET_H */
diff --git a/src/include/parser.h b/src/include/parser.h
new file mode 100644
index 0000000..9f3fdeb
--- /dev/null
+++ b/src/include/parser.h
@@ -0,0 +1,111 @@
+#ifndef FR_PARSER_H
+#define FR_PARSER_H
+
+/*
+ * parser.h	Structures and prototypes for parsing
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2013 Alan DeKok <aland@freeradius.org>
+ */
+
+RCSIDH(parser_h, "$Id$")
+
+#include <freeradius-devel/map.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef RADIUSD_H
+/*
+ *	Also defined in radiusd.h for radius_evalute_cond()
+ */
+typedef struct fr_cond_t fr_cond_t;
+#endif
+
+typedef enum {
+	COND_NONE = 0,
+	COND_AND = '&',
+	COND_OR = '|'
+} fr_cond_op_t;
+
+
+typedef enum {
+	COND_TYPE_INVALID = 0,
+	COND_TYPE_TRUE,
+	COND_TYPE_FALSE,
+	COND_TYPE_EXISTS,
+	COND_TYPE_MAP,
+	COND_TYPE_CHILD
+} fr_cond_type_t;
+
+typedef enum {
+	PASS2_FIXUP_NONE = 0,
+	PASS2_FIXUP_ATTR,
+	PASS2_FIXUP_TYPE,
+	PASS2_PAIRCOMPARE
+} fr_cond_pass2_t;
+
+/*
+ *	Allow for the following structures:
+ *
+ *	FOO			no OP, RHS is NULL
+ *	FOO OP BAR
+ *	(COND)			no LHS/RHS, child is COND, child OP is true
+ *	(!(COND))		no LHS/RHS, child is COND, child OP is NOT
+ *	(COND1 OP COND2)	no LHS/RHS, next is COND2, next OP is OP
+ */
+struct fr_cond_t {
+	fr_cond_type_t	type;
+
+	CONF_ITEM const *ci;
+	union {
+		vp_map_t *map;
+		vp_tmpl_t *vpt;
+		fr_cond_t  	*child;
+	} data;
+
+	bool		negate;
+	fr_cond_pass2_t	pass2_fixup;
+
+	DICT_ATTR const *cast;
+
+	fr_cond_op_t	next_op;
+	fr_cond_t	*next;
+};
+
+
+/*
+ *	One pass over the conditions means that all references must
+ *	exist at parse time.
+ *
+ *	Two pass means "soft fail", that some invalid references are
+ *	left for pass 2.
+ */
+#define FR_COND_ONE_PASS (0)
+#define FR_COND_TWO_PASS (1)
+
+ssize_t fr_condition_tokenize(TALLOC_CTX *ctx, CONF_ITEM *ci, char const *start, fr_cond_t **head, char const **error, int flag);
+size_t fr_cond_sprint(char *buffer, size_t bufsize, fr_cond_t const *c);
+
+bool fr_condition_walk(fr_cond_t *head, bool (*callback)(void *, fr_cond_t *), void *ctx);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_PARSER_H */
diff --git a/src/include/pcap.h b/src/include/pcap.h
new file mode 100644
index 0000000..1d57d93
--- /dev/null
+++ b/src/include/pcap.h
@@ -0,0 +1,101 @@
+#ifndef FR_PCAP_H
+#define FR_PCAP_H
+#ifdef HAVE_LIBPCAP
+/*
+ *   This program is is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License, version 2 of the
+ *   License as published by the Free Software Foundation.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ * @file include/pcap.h
+ * @brief Prototypes and constants for PCAP functions.
+ *
+ * @author Arran Cudbard-Bell <a.cudbardb@freeradius.org>
+ * @copyright 2013 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
+ */
+#include <freeradius-devel/libradius.h>
+#include <freeradius-devel/net.h>
+
+#include <sys/types.h>
+#include <pcap.h>
+
+#define SNAPLEN ETHER_HDR_LEN + IP_HDR_LEN + sizeof(struct udp_header) + MAX_RADIUS_LEN
+#define PCAP_BUFFER_DEFAULT (10000)
+/*
+ *	It's unclear why this differs between platforms
+ */
+#ifndef __linux__
+#  define PCAP_NONBLOCK_TIMEOUT (0)
+#else
+#  define PCAP_NONBLOCK_TIMEOUT (-1)
+#endif
+
+#ifndef BIOCIMMEDIATE
+#  define BIOCIMMEDIATE (2147762800)
+#endif
+
+/*
+ *	Older versions of libpcap don't define this
+ */
+#ifndef PCAP_NETMASK_UNKNOWN
+#  define PCAP_NETMASK_UNKNOWN 0
+#endif
+
+typedef enum {
+	PCAP_INVALID = 0,
+	PCAP_INTERFACE_IN,
+	PCAP_FILE_IN,
+	PCAP_STDIO_IN,
+	PCAP_INTERFACE_OUT,
+	PCAP_FILE_OUT,
+	PCAP_STDIO_OUT
+} fr_pcap_type_t;
+
+extern const FR_NAME_NUMBER pcap_types[];
+
+/*
+ *	Internal pcap structures
+ */
+typedef struct fr_pcap fr_pcap_t;
+struct fr_pcap {
+	char			errbuf[PCAP_ERRBUF_SIZE];	//!< Last error on this interface.
+	fr_pcap_type_t		type;				//!< What type of handle this is.
+	char			*name;				//!< Name of file or interface.
+	bool			promiscuous;			//!< Whether the interface is in promiscuous mode.
+								//!< Only valid for live capture handles.
+	int			buffer_pkts;			//!< How big to make the PCAP ring buffer.
+								//!< Actual buffer size is SNAPLEN * buffer.
+								//!< Only valid for live capture handles.
+
+	pcap_t			*handle;			//!< libpcap handle.
+	pcap_dumper_t		*dumper;			//!< libpcap dumper handle.
+
+	int			link_layer;			//!< Link layer type.
+
+	int			fd;				//!< Selectable file descriptor we feed to select.
+	struct pcap_stat	pstats;				//!< The last set of pcap stats for this handle.
+
+	fr_pcap_t		*next;				//!< Next handle in collection.
+};
+
+int		fr_pcap_if_link_layer(char *errbuff, pcap_if_t *dev);
+fr_pcap_t	*fr_pcap_init(TALLOC_CTX *ctx, char const *name, fr_pcap_type_t type);
+int		fr_pcap_open(fr_pcap_t *handle);
+int		fr_pcap_apply_filter(fr_pcap_t *handle, char const *expression);
+char		*fr_pcap_device_names(TALLOC_CTX *ctx, fr_pcap_t *handle, char c);
+
+bool		fr_pcap_link_layer_supported(int link_layer);
+ssize_t		fr_pcap_link_layer_offset(uint8_t const *data, size_t len, int link_layer);
+#endif
+#endif
diff --git a/src/include/process.h b/src/include/process.h
new file mode 100644
index 0000000..35a91bf
--- /dev/null
+++ b/src/include/process.h
@@ -0,0 +1,87 @@
+#ifndef FR_PROCESS_H
+#define FR_PROCESS_H
+
+/*
+ * process.h	State machine for a server to process packets.
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2012 The FreeRADIUS server project
+ * Copyright 2012 Alan DeKok <aland@deployingradius.com>
+ */
+
+RCSIDH(process_h, "$Id$")
+
+#include <freeradius-devel/clients.h>
+#include <freeradius-devel/listen.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef HAVE_SYSTEMD_WATCHDOG
+extern struct timeval sd_watchdog_interval;
+#endif
+
+typedef enum fr_state_action_t {	/* server action */
+	FR_ACTION_INVALID = 0,
+	FR_ACTION_RUN,
+	FR_ACTION_DONE,
+	FR_ACTION_DUP,
+	FR_ACTION_TIMER,
+#ifdef WITH_PROXY
+	FR_ACTION_PROXY_REPLY,
+#endif
+	FR_ACTION_CANCELLED,
+	FR_ACTION_CONFLICT,
+	FR_ACTION_MAX_TIME,
+	FR_ACTION_INTERNAL_FAILURE,
+	FR_ACTION_CLEANUP_DELAY,
+	FR_ACTION_COA_CANCELLED,
+} fr_state_action_t;
+
+/*
+ *  Function handler for requests.
+ */
+typedef	int (*RAD_REQUEST_FUNP)(REQUEST *);
+typedef	void (*fr_request_process_t)(REQUEST *, int);
+
+extern time_t fr_start_time;
+
+#ifdef HAVE_PTHREAD_H
+/*
+ *	In threads.c
+ */
+int request_enqueue(REQUEST *request);
+#endif
+
+int request_receive(TALLOC_CTX *ctx, rad_listen_t *listener, RADIUS_PACKET *packet,
+		    RADCLIENT *client, RAD_REQUEST_FUNP fun);
+void request_inject(REQUEST *request);
+
+#ifdef WITH_PROXY
+int request_proxy_reply(RADIUS_PACKET *packet);
+
+void proxy_listener_freeze(rad_listen_t *listener, fr_event_fd_handler_t write_handler);
+void proxy_listener_thaw(rad_listen_t *listener);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_PROCESS_H */
diff --git a/src/include/protocol.h b/src/include/protocol.h
new file mode 100644
index 0000000..f09ea4a
--- /dev/null
+++ b/src/include/protocol.h
@@ -0,0 +1,63 @@
+#ifndef FR_PROTOCOL_H
+#define FR_PROTOCOL_H
+
+/*
+ * heap.h	Structures and prototypes for plug-in protocols
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2013 Alan DeKok
+ */
+
+RCSIDH(protocol_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	We'll use this below.
+ */
+typedef int (*rad_listen_parse_t)(CONF_SECTION *, rad_listen_t *);
+typedef void (*rad_listen_free_t)(rad_listen_t *);
+
+typedef struct fr_protocol_t {
+	uint64_t 		magic;	//!< Used to validate loaded library
+	char const		*name;	//!< The name of the protocol
+	size_t			inst_size;
+	CONF_PARSER		*proto_config;
+
+	rad_listen_parse_t	parse;
+	rad_listen_free_t	free;
+	rad_listen_recv_t	recv;
+	rad_listen_send_t	send;
+	rad_listen_print_t	print;
+	rad_listen_encode_t	encode;
+	rad_listen_decode_t	decode;
+} fr_protocol_t;
+
+/*
+ *	@todo: fix for later
+ */
+int common_socket_parse(CONF_SECTION *cs, rad_listen_t *this);
+int common_socket_print(rad_listen_t const *this, char *buffer, size_t bufsize);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_PROTOCOL_H */
diff --git a/src/include/rad_assert.h b/src/include/rad_assert.h
new file mode 100644
index 0000000..0c16e59
--- /dev/null
+++ b/src/include/rad_assert.h
@@ -0,0 +1,50 @@
+#ifndef RAD_ASSERT_H
+#define RAD_ASSERT_H
+/*
+ * rad_assert.h	  Debug assertions, with logging.
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2000,2001,2006  The FreeRADIUS server project
+ */
+
+RCSIDH(rad_assert_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void rad_assert_fail(char const *file, unsigned int line, char const *expr) CC_HINT(noreturn);
+
+#ifdef NDEBUG
+	#define rad_assert(expr) ((void) (0))
+
+#elif !defined(__clang_analyzer__)
+	#define rad_assert(expr) \
+		((void) ((expr) ? (void) 0 : \
+			(void) rad_assert_fail (__FILE__, __LINE__, #expr)))
+
+#else
+#include <assert.h>
+#define rad_assert assert
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/radclient.h b/src/include/radclient.h
new file mode 100644
index 0000000..1eb10f3
--- /dev/null
+++ b/src/include/radclient.h
@@ -0,0 +1,93 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef _RADCLIENT_H
+#define _RADCLIENT_H
+/**
+ * $Id$
+ *
+ * @file radclient.h
+ * @brief Structures for the radclient utility.
+ *
+ * @copyright 2014  The FreeRADIUS server project
+ */
+#include <freeradius-devel/libradius.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	Logging macros
+ */
+ #undef DEBUG
+#define DEBUG(fmt, ...)		if (do_output && (fr_debug_lvl > 0)) fprintf(fr_log_fp, fmt "\n", ## __VA_ARGS__)
+#undef DEBUG2
+#define DEBUG2(fmt, ...)	if (do_output && (fr_debug_lvl > 1)) fprintf(fr_log_fp, fmt "\n", ## __VA_ARGS__)
+
+
+#define ERROR(fmt, ...)		if (do_output) fr_perror("radclient: " fmt, ## __VA_ARGS__)
+
+#define RDEBUG_ENABLED()	(do_output && (fr_debug_lvl > 0))
+#define RDEBUG_ENABLED2()	(do_output && (fr_debug_lvl > 1))
+
+#define REDEBUG(fmt, ...)	if (do_output) fr_perror("(%" PRIu64 ") " fmt , request->num, ## __VA_ARGS__)
+#define RDEBUG(fmt, ...)	if (do_output && (fr_debug_lvl > 0)) fprintf(fr_log_fp, "(%" PRIu64 ") " fmt "\n", request->num, ## __VA_ARGS__)
+#define RDEBUG2(fmt, ...)	if (do_output && (fr_debug_lvl > 1)) fprintf(fr_log_fp, "(%" PRIu64 ") " fmt "\n", request->num, ## __VA_ARGS__)
+
+typedef struct rc_stats {
+	uint64_t accepted;		//!< Requests to which we received a accept
+	uint64_t rejected;		//!< Requests to which we received a reject
+	uint64_t lost;			//!< Requests to which we received no response
+	uint64_t passed;		//!< Requests which passed a filter
+	uint64_t failed;		//!< Requests which failed a fitler
+} rc_stats_t;
+
+typedef struct rc_file_pair {
+	char const *packets;		//!< The file containing the request packet
+	char const *filters;		//!< The file containing the definition of the
+					//!< packet we want to match.
+} rc_file_pair_t;
+
+typedef struct rc_request rc_request_t;
+
+struct rc_request {
+	uint64_t	num;		//!< The number (within the file) of the request were reading.
+
+	rc_request_t	*prev;
+	rc_request_t	*next;
+
+	rc_file_pair_t	*files;		//!< Request and response file names.
+
+	VALUE_PAIR	*password;	//!< Cleartext-Password
+	time_t		timestamp;
+
+	RADIUS_PACKET	*packet;	//!< The outgoing request.
+	RADIUS_PACKET	*reply;		//!< The incoming response.
+	VALUE_PAIR	*filter;	//!< If the reply passes the filter, then the request passes.
+	PW_CODE		filter_code;	//!< Expected code of the response packet.
+
+	int		resend;
+	int		tries;
+	bool		done;		//!< Whether the request is complete.
+
+	char const	*name;		//!< Test name (as specified in the request).
+};
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _RADCLIENT_H */
diff --git a/src/include/radius.h b/src/include/radius.h
new file mode 100644
index 0000000..473528d
--- /dev/null
+++ b/src/include/radius.h
@@ -0,0 +1,186 @@
+/*
+ * radius.h  Constants of the radius protocol.
+ *
+ * Version:  $Id$
+ *
+ */
+
+/** Internal data types used within libfreeradius
+ *
+ */
+typedef enum {
+	PW_TYPE_INVALID = 0,			//!< Invalid (uninitialised) attribute type.
+	PW_TYPE_STRING,				//!< String of printable characters.
+	PW_TYPE_INTEGER,			//!< 32 Bit unsigned integer.
+	PW_TYPE_IPV4_ADDR,			//!< 32 Bit IPv4 Address.
+	PW_TYPE_DATE,				//!< 32 Bit Unix timestamp.
+	PW_TYPE_ABINARY,			//!< Ascend binary format a packed data structure.
+	PW_TYPE_OCTETS,				//!< Raw octets.
+	PW_TYPE_IFID,				//!< Interface ID.
+	PW_TYPE_IPV6_ADDR,			//!< 128 Bit IPv6 Address.
+	PW_TYPE_IPV6_PREFIX,			//!< IPv6 Prefix.
+	PW_TYPE_BYTE,				//!< 8 Bit unsigned integer.
+	PW_TYPE_SHORT,				//!< 16 Bit unsigned integer.
+	PW_TYPE_ETHERNET,			//!< 48 Bit Mac-Address.
+	PW_TYPE_SIGNED,				//!< 32 Bit signed integer.
+	PW_TYPE_COMBO_IP_ADDR,			//!< WiMAX IPv4 or IPv6 address depending on length.
+	PW_TYPE_TLV,				//!< Contains nested attributes.
+	PW_TYPE_EXTENDED,			//!< Extended attribute space attribute.
+	PW_TYPE_LONG_EXTENDED,			//!< Long extended attribute space attribute.
+	PW_TYPE_EVS,				//!< Extended attribute, vendor specific.
+	PW_TYPE_INTEGER64,			//!< 64 Bit unsigned integer.
+	PW_TYPE_IPV4_PREFIX,			//!< IPv4 Prefix.
+	PW_TYPE_VSA,				//!< Vendor-Specific, for RADIUS attribute 26.
+	PW_TYPE_TIMEVAL,			//!< Time value (struct timeval), only for config items.
+	PW_TYPE_BOOLEAN,			//!< A truth value.
+	PW_TYPE_COMBO_IP_PREFIX,		//!< WiMAX IPv4 or IPv6 address prefix depending on length.
+	PW_TYPE_MAX				//!< Number of defined data types.
+} PW_TYPE;
+
+/** RADIUS packet codes
+ *
+ */
+typedef enum {
+	PW_CODE_UNDEFINED		= 0,	//!< Packet code has not been set
+	PW_CODE_ACCESS_REQUEST		= 1,	//!< RFC2865 - Access-Request
+	PW_CODE_ACCESS_ACCEPT		= 2,	//!< RFC2865 - Access-Accept
+	PW_CODE_ACCESS_REJECT		= 3,	//!< RFC2865 - Access-Reject
+	PW_CODE_ACCOUNTING_REQUEST	= 4,	//!< RFC2866 - Accounting-Request
+	PW_CODE_ACCOUNTING_RESPONSE	= 5,	//!< RFC2866 - Accounting-Response
+	PW_CODE_ACCOUNTING_STATUS	= 6,	//!< RFC3575 - Reserved
+	PW_CODE_PASSWORD_REQUEST	= 7,	//!< RFC3575 - Reserved
+	PW_CODE_PASSWORD_ACK		= 8,	//!< RFC3575 - Reserved
+	PW_CODE_PASSWORD_REJECT		= 9,	//!< RFC3575 - Reserved
+	PW_CODE_ACCOUNTING_MESSAGE	= 10,	//!< RFC3575 - Reserved
+	PW_CODE_ACCESS_CHALLENGE	= 11,	//!< RFC2865 - Access-Challenge
+	PW_CODE_STATUS_SERVER	 	= 12,	//!< RFC2865/RFC5997 - Status Server (request)
+	PW_CODE_STATUS_CLIENT		= 13,	//!< RFC2865/RFC5997 - Status Server (response)
+	PW_CODE_DISCONNECT_REQUEST	= 40,	//!< RFC3575/RFC5176 - Disconnect-Request
+	PW_CODE_DISCONNECT_ACK		= 41,	//!< RFC3575/RFC5176 - Disconnect-Ack (positive)
+	PW_CODE_DISCONNECT_NAK		= 42,	//!< RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
+	PW_CODE_COA_REQUEST		= 43,	//!< RFC3575/RFC5176 - CoA-Request
+	PW_CODE_COA_ACK			= 44,	//!< RFC3575/RFC5176 - CoA-Ack (positive)
+	PW_CODE_COA_NAK			= 45,	//!< RFC3575/RFC5176 - CoA-Nak (not willing to perform)
+	PW_CODE_MAX			= 255,	//!< Maximum possible code
+} PW_CODE;
+
+#define PW_AUTH_UDP_PORT		1812
+#define PW_AUTH_UDP_PORT_ALT		1645
+#define PW_ACCT_UDP_PORT		1813
+#define PW_ACCT_UDP_PORT_ALT		1646
+#define PW_POD_UDP_PORT			3799
+#define PW_RADIUS_TLS_PORT	       	2083
+#define PW_COA_UDP_PORT			3799
+
+/*
+ *  The RFC says 4096 octets max, and most packets are less than 256.
+ */
+#define MAX_PACKET_LEN 4096
+
+#include <freeradius-devel/rfc2865.h>
+#include <freeradius-devel/rfc2866.h>
+#include <freeradius-devel/rfc2867.h>
+#include <freeradius-devel/rfc2868.h>
+#include <freeradius-devel/rfc2869.h>
+
+#include <freeradius-devel/rfc3162.h>
+#include <freeradius-devel/rfc3576.h>
+#include <freeradius-devel/rfc3580.h>
+
+#include <freeradius-devel/rfc4072.h>
+#include <freeradius-devel/rfc4372.h>
+
+#define PW_CUI	PW_CHARGEABLE_USER_IDENTITY
+
+#include <freeradius-devel/rfc4675.h>
+#include <freeradius-devel/rfc4818.h>
+#include <freeradius-devel/rfc4849.h>
+
+#include <freeradius-devel/rfc5580.h>
+#include <freeradius-devel/rfc5607.h>
+#include <freeradius-devel/rfc5904.h>
+
+#include <freeradius-devel/rfc6572.h>
+#include <freeradius-devel/rfc6677.h>
+#include <freeradius-devel/rfc6911.h>
+#include <freeradius-devel/rfc6929.h>
+#include <freeradius-devel/rfc6930.h>
+
+#include <freeradius-devel/rfc7055.h>
+#include <freeradius-devel/rfc7155.h>
+#include <freeradius-devel/rfc7268.h>
+
+/*
+ *	All internal attributes are now defined in this file.
+ */
+#include <freeradius-devel/attributes.h>
+
+#include <freeradius-devel/freeradius.h>
+
+#include <freeradius-devel/vqp.h>
+
+#define PW_DIGEST_RESPONSE		206
+#define PW_DIGEST_ATTRIBUTES		207
+
+/*
+ *	Integer Translations
+ */
+
+/*	User Types	*/
+
+#define PW_LOGIN_USER			1
+#define PW_FRAMED_USER			2
+#define PW_CALLBACK_LOGIN_USER		3
+#define PW_CALLBACK_FRAMED_USER		4
+#define PW_OUTBOUND_USER		5
+#define PW_ADMINISTRATIVE_USER		6
+#define PW_NAS_PROMPT_USER		7
+#define PW_AUTHENTICATE_ONLY		8
+#define PW_CALLBACK_NAS_PROMPT		9
+#define PW_AUTHORIZE_ONLY		17
+
+/*	Framed Protocols	*/
+
+#define PW_PPP				1
+#define PW_SLIP				2
+
+/*	Status Types	*/
+
+#define PW_STATUS_START			1
+#define PW_STATUS_STOP			2
+#define PW_STATUS_ALIVE			3
+#define PW_STATUS_ACCOUNTING_ON		7
+#define PW_STATUS_ACCOUNTING_OFF	8
+
+/*
+ *	Vendor Private Enterprise Codes
+ */
+#define VENDORPEC_MICROSOFT		311
+#define VENDORPEC_FREERADIUS		11344
+#define VENDORPEC_WIMAX			24757
+#define VENDORPEC_UKERNA		25622
+
+/*
+ *	Microsoft has vendor code 311.
+ */
+#define PW_MSCHAP_RESPONSE			1
+#define PW_MSCHAP_ERROR				2
+#define PW_MSCHAP_CPW_1				3
+#define PW_MSCHAP_CPW_2				4
+#define PW_MSCHAP_NT_ENC_PW			6
+#define PW_MSCHAP_MPPE_ENCRYPTION_POLICY	7
+#define PW_MSCHAP_MPPE_ENCRYPTION_TYPES		8
+#define PW_MSCHAP_CHALLENGE			11
+#define PW_MSCHAP_MPPE_SEND_KEY			16
+#define PW_MSCHAP_MPPE_RECV_KEY			17
+#define PW_MSCHAP2_RESPONSE			25
+#define PW_MSCHAP2_SUCCESS			26
+#define PW_MSCHAP2_CPW				27
+#define PW_MS_QUARANTINE_SOH			55
+
+/*
+ * JANET's code for transporting eap channel binding data over ttls
+ */
+
+#define PW_UKERNA_CHBIND		135
+#define PW_UKERNA_TR_COI 136
diff --git a/src/include/radiusd.h b/src/include/radiusd.h
new file mode 100644
index 0000000..594a6bd
--- /dev/null
+++ b/src/include/radiusd.h
@@ -0,0 +1,631 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef RADIUSD_H
+#define RADIUSD_H
+/**
+ * $Id$
+ *
+ * @file radiusd.h
+ * @brief Structures, prototypes and global variables for the FreeRADIUS server.
+ *
+ * @copyright 1999-2000,2002-2008  The FreeRADIUS server project
+ */
+
+RCSIDH(radiusd_h, "$Id$")
+
+#include <freeradius-devel/libradius.h>
+#include <freeradius-devel/radpaths.h>
+#include <freeradius-devel/conf.h>
+#include <freeradius-devel/conffile.h>
+#include <freeradius-devel/event.h>
+#include <freeradius-devel/connection.h>
+
+typedef struct rad_request REQUEST;
+
+#include <freeradius-devel/log.h>
+
+#ifdef HAVE_PTHREAD_H
+#  include <pthread.h>
+#else
+#  include <sys/wait.h>
+#endif
+
+#ifndef NDEBUG
+#  define REQUEST_MAGIC (0xdeadbeef)
+#endif
+
+/*
+ *	WITH_VMPS is handled by src/include/features.h
+ */
+#ifdef WITHOUT_VMPS
+#  undef WITH_VMPS
+#endif
+
+#ifdef WITH_TLS
+#  include <freeradius-devel/tls.h>
+#endif
+
+#include <freeradius-devel/stats.h>
+#include <freeradius-devel/realms.h>
+#include <freeradius-devel/xlat.h>
+#include <freeradius-devel/tmpl.h>
+#include <freeradius-devel/map.h>
+#include <freeradius-devel/clients.h>
+#include <freeradius-devel/process.h>
+/*
+ *	All POSIX systems should have these headers
+ */
+#include <pwd.h>
+#include <grp.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *	See util.c
+ */
+typedef struct request_data_t request_data_t;
+
+/** Return codes indicating the result of the module call
+ *
+ * All module functions must return one of the codes listed below (apart from
+ * RLM_MODULE_NUMCODES, which is used to check for validity).
+ */
+typedef enum rlm_rcodes {
+	RLM_MODULE_REJECT = 0,	//!< Immediately reject the request.
+	RLM_MODULE_FAIL,	//!< Module failed, don't reply.
+	RLM_MODULE_OK,		//!< The module is OK, continue.
+	RLM_MODULE_HANDLED,	//!< The module handled the request, so stop.
+	RLM_MODULE_INVALID,	//!< The module considers the request invalid.
+	RLM_MODULE_USERLOCK,	//!< Reject the request (user is locked out).
+	RLM_MODULE_NOTFOUND,	//!< User not found.
+	RLM_MODULE_NOOP,	//!< Module succeeded without doing anything.
+	RLM_MODULE_UPDATED,	//!< OK (pairs modified).
+	RLM_MODULE_NUMCODES,	//!< How many valid return codes there are.
+	RLM_MODULE_UNKNOWN	//!< Error resolving rcode (should not be
+				//!< returned by modules).
+} rlm_rcode_t;
+extern const FR_NAME_NUMBER modreturn_table[];
+
+/** Main server configuration
+ *
+ * The parsed version of the main server config.
+ */
+typedef struct main_config {
+	struct main_config *next;			//!< Next version of the main_config.
+
+	char const	*name;				//!< Name of the daemon, usually 'radiusd'.
+	CONF_SECTION	*config;			//!< Root of the server config.
+
+	fr_ipaddr_t	myip;				//!< IP to bind to. Set on command line.
+	uint16_t	port;				//!< Port to bind to. Set on command line.
+
+	bool		suppress_secrets;		//!< for debug levels < 3
+	bool		log_auth;			//!< Log all authentication attempts.
+	bool		log_accept;			//!< Log Access-Accept
+	bool		log_reject;			//!< Log Access-Reject
+	bool		log_auth_badpass;		//!< Log successful authentications.
+	bool		log_auth_goodpass;		//!< Log failed authentications.
+	char const	*auth_badpass_msg;		//!< Additional text to append to successful auth messages.
+	char const	*auth_goodpass_msg;		//!< Additional text to append to failed auth messages.
+
+	char const	*denied_msg;			//!< Additional text to append if the user is already logged
+							//!< in (simultaneous use check failed).
+
+	bool		daemonize;			//!< Should the server daemonize on startup.
+	char const      *pid_file;			//!< Path to write out PID file.
+
+#ifdef WITH_PROXY
+	bool		proxy_requests;			//!< Toggle to enable/disable proxying globally.
+#endif
+	struct timeval	reject_delay;			//!< How long to wait before sending an Access-Reject.
+	bool		status_server;			//!< Whether to respond to status-server messages.
+
+
+	uint32_t	max_request_time;		//!< How long a request can be processed for before
+							//!< timing out.
+	uint32_t	cleanup_delay;			//!< How long before cleaning up cached responses.
+	uint32_t	max_requests;
+
+	bool		postauth_client_lost;		//!< Whether to run Post-Auth-Type Client-Lost section
+
+	uint32_t	debug_level;
+	char const	*log_file;
+	int		syslog_facility;
+
+	char const	*dictionary_dir;		//!< Where to load dictionaries from.
+
+	char const	*checkrad;			//!< Script to use to determine if a user is already
+							//!< connected.
+
+	rad_listen_t	*listen;			//!< Head of a linked list of listeners.
+
+
+	char const	*panic_action;			//!< Command to execute if the server receives a fatal
+							//!< signal.
+
+	struct timeval	init_delay;			//!< Initial request processing delay.
+
+	uint32_t       	talloc_pool_size;		//!< Size of pool to allocate to hold each #REQUEST.
+	bool		debug_memory;			//!< Cleanup the server properly on exit, freeing
+							//!< up any memory we allocated.
+	bool		memory_report;			//!< Print a memory report on what's left unfreed.
+							//!< Can only be used when the server is running in single
+							//!< threaded mode.
+
+	bool		allow_core_dumps;		//!< Whether the server is allowed to drop a core when
+							//!< receiving a fatal signal.
+
+	bool		write_pid;			//!< write the PID file
+
+	bool		exiting;			//!< are we exiting?
+
+
+#ifdef ENABLE_OPENSSL_VERSION_CHECK
+	char const	*allow_vulnerable_openssl;	//!< The CVE number of the last security issue acknowledged.
+#endif
+} main_config_t;
+
+#if defined(WITH_VERIFY_PTR)
+#  define VERIFY_REQUEST(_x) verify_request(__FILE__, __LINE__, _x)
+#else
+/*
+ *  Even if were building without WITH_VERIFY_PTR
+ *  the pointer must not be NULL when these various macros are used
+ *  so we can add some sneaky asserts.
+ */
+#  define VERIFY_REQUEST(_x) rad_assert(_x)
+#endif
+
+typedef enum {
+	REQUEST_ACTIVE = 1,
+	REQUEST_STOP_PROCESSING,
+	REQUEST_COUNTED
+} rad_master_state_t;
+#define REQUEST_MASTER_NUM_STATES (REQUEST_COUNTED + 1)
+
+typedef enum {
+	REQUEST_QUEUED = 1,
+	REQUEST_RUNNING,
+	REQUEST_PROXIED,
+	REQUEST_RESPONSE_DELAY,
+	REQUEST_CLEANUP_DELAY,
+	REQUEST_DONE
+} rad_child_state_t;
+#define REQUEST_CHILD_NUM_STATES (REQUEST_DONE + 1)
+
+struct rad_request {
+#ifndef NDEBUG
+	uint32_t		magic; 		//!< Magic number used to detect memory corruption,
+						//!< or request structs that have not been properly initialised.
+#endif
+	unsigned int	       	number; 	//!< Monotonically increasing request number. Reset on server restart.
+	time_t			timestamp;	//!< When the request was received.
+
+	request_data_t		*data;		//!< Request metadata.
+
+	rad_listen_t		*listener;	//!< The listener that received the request.
+	RADCLIENT		*client;	//!< The client that originally sent us the request.
+
+	RADIUS_PACKET		*packet;	//!< Incoming request.
+	VALUE_PAIR		*username;	//!< Cached username #VALUE_PAIR from request #RADIUS_PACKET.
+	VALUE_PAIR		*password;	//!< Cached password #VALUE_PAIR from request #RADIUS_PACKET.
+
+	RADIUS_PACKET		*reply;		//!< Outgoing response.
+
+	VALUE_PAIR		*config;	//!< #VALUE_PAIR (s) used to set per request parameters
+						//!< for modules and the server core at runtime.
+
+	TALLOC_CTX		*state_ctx;	//!< for request->state
+	VALUE_PAIR		*state;		//!< #VALUE_PAIR (s) available over the lifetime of the authentication
+						//!< attempt. Useful where the attempt involves a sequence of
+						//!< many request/challenge packets, like OTP, and EAP.
+
+#ifdef WITH_PROXY
+	rad_listen_t		*proxy_listener;//!< Listener for outgoing requests.
+	RADIUS_PACKET		*proxy;		//!< Outgoing request to proxy server.
+	RADIUS_PACKET		*proxy_reply;	//!< Incoming response from proxy server.
+
+	home_server_t	       	*home_server;
+	home_pool_t		*home_pool;	//!< For dynamic failover
+#endif
+
+	fr_request_process_t	process;	//!< The function to call to move the request through the state machine.
+
+	struct timeval		response_delay;	//!< How long to wait before sending Access-Rejects.
+	fr_state_action_t	timer_action;	//!< What action to perform when the timer event fires.
+	fr_event_t		*ev;		//!< Event in event loop tied to this request.
+
+	RAD_REQUEST_FUNP	handle;		//!< The function to call to move the request through the
+						//!< various server configuration sections.
+	rlm_rcode_t		rcode;		//!< Last rcode returned by a module
+	char const		*module;	//!< Module the request is currently being processed by.
+	char const		*component; 	//!< Section the request is in.
+
+	int			delay;
+
+	rad_master_state_t	master_state;	//!< Set by the master thread to signal the child that's currently
+						//!< working with the request, to do something.
+	rad_child_state_t	child_state;
+
+#ifdef HAVE_PTHREAD_H
+	pthread_t    		child_pid;	//!< Current thread handling the request.
+#endif
+
+	main_config_t		*root;		//!< Pointer to the main config hack to try and deal with hup.
+
+
+	int			simul_max;	//!< Maximum number of concurrent sessions for this user.
+#ifdef WITH_SESSION_MGMT
+	int			simul_count;	//!< The current number of sessions for this user.
+	int			simul_mpp; 	//!< WEIRD: 1 is false, 2 is true.
+#endif
+
+	RAD_LISTEN_TYPE		priority;
+
+	bool			max_time;	//!< did we hit max time?
+
+	bool			in_request_hash;
+#ifdef WITH_PROXY
+	bool			in_proxy_hash;
+
+	uint32_t		num_proxied_requests;	//!< How many times this request was proxied.
+							//!< Retransmissions are driven by requests from the NAS.
+	uint32_t		num_proxied_responses;
+#endif
+
+	char const		*server;
+	REQUEST			*parent;
+
+	struct {
+		radlog_func_t	func;		//!< Function to call to output log messages about this
+						//!< request.
+
+		log_lvl_t	lvl;		//!< Controls the verbosity of debug statements regarding
+						//!< the request.
+
+		uint8_t		indent;		//!< By how much to indent log messages. uin8_t so it's obvious
+						//!< when a request has been exdented too much.
+	} log;
+
+	uint32_t		options;	//!< mainly for proxying EAP-MSCHAPv2.
+
+#ifdef WITH_COA
+	REQUEST			*coa;		//!< CoA request originated by this request.
+	uint32_t		num_coa_requests;//!< Counter for number of requests sent including
+						//!< retransmits.
+#endif
+};				/* REQUEST typedef */
+
+#define RAD_REQUEST_LVL_NONE	(0)		//!< No debug messages should be printed.
+#define RAD_REQUEST_LVL_DEBUG	(1)
+#define RAD_REQUEST_LVL_DEBUG2	(2)
+#define RAD_REQUEST_LVL_DEBUG3	(3)
+#define RAD_REQUEST_LVL_DEBUG4	(4)
+
+#define RAD_REQUEST_OPTION_COA		(1 << 0)
+#define RAD_REQUEST_OPTION_CTX 		(1 << 1)
+#define RAD_REQUEST_OPTION_CANCELLED	(1 << 2)
+
+#define SECONDS_PER_DAY		86400
+#define MAX_REQUEST_TIME	30
+#define CLEANUP_DELAY		5
+#define MAX_REQUESTS		256
+#define RETRY_DELAY		5
+#define RETRY_COUNT		3
+#define DEAD_TIME		120
+#define EXEC_TIMEOUT		10
+
+/* for paircompare_register */
+typedef int (*RAD_COMPARE_FUNC)(void *instance, REQUEST *,VALUE_PAIR *, VALUE_PAIR *, VALUE_PAIR *, VALUE_PAIR **);
+
+typedef enum request_fail {
+	REQUEST_FAIL_UNKNOWN = 0,
+	REQUEST_FAIL_NO_THREADS,	//!< No threads to handle it.
+	REQUEST_FAIL_DECODE,		//!< Rad_decode didn't like it.
+	REQUEST_FAIL_PROXY,		//!< Call to proxy modules failed.
+	REQUEST_FAIL_PROXY_SEND,	//!< Proxy_send didn't like it.
+	REQUEST_FAIL_NO_RESPONSE,	//!< We weren't told to respond, so we reject.
+	REQUEST_FAIL_HOME_SERVER,	//!< The home server didn't respond.
+	REQUEST_FAIL_HOME_SERVER2,	//!< Another case of the above.
+	REQUEST_FAIL_HOME_SERVER3,	//!< Another case of the above.
+	REQUEST_FAIL_NORMAL_REJECT,	//!< Authentication failure.
+	REQUEST_FAIL_SERVER_TIMEOUT	//!< The server took too long to process the request.
+} request_fail_t;
+
+/*
+ *	Global variables.
+ *
+ *	We really shouldn't have this many.
+ */
+extern log_lvl_t	rad_debug_lvl;
+extern char const	*radacct_dir;
+extern char const	*radlog_dir;
+extern char const	*radlib_dir;
+extern bool		log_stripped_names;
+extern HIDDEN char const	*radiusd_version;
+extern HIDDEN char const	*radiusd_version_short;
+void			radius_signal_self(int flag);
+
+typedef enum {
+	RADIUS_SIGNAL_SELF_NONE		= (0),
+	RADIUS_SIGNAL_SELF_HUP		= (1 << 0),
+	RADIUS_SIGNAL_SELF_TERM		= (1 << 1),
+	RADIUS_SIGNAL_SELF_EXIT		= (1 << 2),
+	RADIUS_SIGNAL_SELF_DETAIL	= (1 << 3),
+	RADIUS_SIGNAL_SELF_NEW_FD	= (1 << 4),
+	RADIUS_SIGNAL_SELF_MAX		= (1 << 5)
+} radius_signal_t;
+/*
+ *	Function prototypes.
+ */
+
+/* acct.c */
+int		rad_accounting(REQUEST *);
+
+int		rad_coa_recv(REQUEST *request);
+
+/* session.c */
+int		rad_check_ts(fr_ipaddr_t const *nas_addr, uint32_t nas_port, char const *nas_port_id, char const *user, char const *sessionid);
+int		session_zap(REQUEST *request, fr_ipaddr_t const *nas_addr,
+			    uint32_t nas_port, char const *nas_port_id, char const *user,
+			    char const *sessionid, uint32_t cliaddr,
+			    char proto, int session_time);
+
+/* radiusd.c */
+#undef debug_pair
+void		debug_pair(VALUE_PAIR *);
+void		rdebug_pair(log_lvl_t level, REQUEST *, VALUE_PAIR *, char const *);
+void 		rdebug_pair_list(log_lvl_t level, REQUEST *, VALUE_PAIR *, char const *);
+void		rdebug_proto_pair_list(log_lvl_t level, REQUEST *, VALUE_PAIR *);
+int		log_err (char *);
+
+/* util.c */
+#define MEM(x) if (!(x)) { ERROR("%s[%u] OUT OF MEMORY", __FILE__, __LINE__); _fr_exit_now(__FILE__, __LINE__, 1); }
+void (*reset_signal(int signo, void (*func)(int)))(int);
+int		rad_mkdir(char *directory, mode_t mode, uid_t uid, gid_t gid);
+size_t		rad_filename_make_safe(UNUSED REQUEST *request, char *out, size_t outlen,
+				       char const *in, UNUSED void *arg);
+size_t		rad_filename_escape(UNUSED REQUEST *request, char *out, size_t outlen,
+				    char const *in, UNUSED void *arg);
+ssize_t		rad_filename_unescape(char *out, size_t outlen, char const *in, size_t inlen);
+void		*rad_malloc(size_t size); /* calls exit(1) on error! */
+void		rad_const_free(void const *ptr);
+REQUEST		*request_alloc(TALLOC_CTX *ctx);
+REQUEST		*request_alloc_fake(REQUEST *oldreq);
+REQUEST		*request_alloc_coa(REQUEST *request);
+int		request_data_add(REQUEST *request,
+				 void *unique_ptr, int unique_int,
+				 void *opaque, bool free_opaque);
+void		*request_data_get(REQUEST *request,
+				  void *unique_ptr, int unique_int);
+void		*request_data_reference(REQUEST *request,
+				  void *unique_ptr, int unique_int);
+int		rad_copy_string(char *dst, char const *src);
+int		rad_copy_string_bare(char *dst, char const *src);
+int		rad_copy_variable(char *dst, char const *from);
+uint32_t	rad_pps(uint32_t *past, uint32_t *present, time_t *then, struct timeval *now);
+int		rad_expand_xlat(REQUEST *request, char const *cmd,
+				int max_argc, char const *argv[], bool can_fail,
+				size_t argv_buflen, char *argv_buf);
+void		rad_tv_sub(struct timeval const *end, struct timeval const *start, struct timeval *elapsed);
+
+void		verify_request(char const *file, int line, REQUEST *request);	/* only for special debug builds */
+void		rad_mode_to_str(char out[10], mode_t mode);
+void		rad_mode_to_oct(char out[5], mode_t mode);
+int		rad_getpwuid(TALLOC_CTX *ctx, struct passwd **out, uid_t uid);
+int		rad_getpwnam(TALLOC_CTX *ctx, struct passwd **out, char const *name);
+int		rad_getgrgid(TALLOC_CTX *ctx, struct group **out, gid_t gid);
+int		rad_getgrnam(TALLOC_CTX *ctx, struct group **out, char const *name);
+int		rad_getgid(TALLOC_CTX *ctx, gid_t *out, char const *name);
+int		rad_prints_uid(TALLOC_CTX *ctx, char *out, size_t outlen, uid_t uid);
+int		rad_prints_gid(TALLOC_CTX *ctx, char *out, size_t outlen, gid_t gid);
+int		rad_seuid(uid_t uid);
+int		rad_segid(gid_t gid);
+
+void		rad_suid_set_down_uid(uid_t uid);
+void		rad_suid_down(void);
+void		rad_suid_up(void);
+void		rad_suid_down_permanent(void);
+/* regex.c */
+
+#ifdef HAVE_REGEX
+/*
+ *	Increasing this is essentially free
+ *	It just increases memory usage. 12-16 bytes for each additional subcapture.
+ */
+#  define REQUEST_MAX_REGEX 32
+
+void	regex_sub_to_request(REQUEST *request, regex_t **preg, char const *value,
+			     size_t len, regmatch_t rxmatch[], size_t nmatch);
+
+int	regex_request_to_sub(TALLOC_CTX *ctx, char **out, REQUEST *request, uint32_t num);
+
+/*
+ *	Named capture groups only supported by PCRE.
+ */
+#  ifdef HAVE_PCRE
+int	regex_request_to_sub_named(TALLOC_CTX *ctx, char **out, REQUEST *request, char const *name);
+#  endif
+#endif
+
+/* files.c */
+int		pairlist_read(TALLOC_CTX *ctx, char const *file, PAIR_LIST **list, int complain);
+void		pairlist_free(PAIR_LIST **);
+
+/* version.c */
+int		rad_check_lib_magic(uint64_t magic);
+int 		ssl_check_consistency(void);
+char const	*ssl_version_by_num(uint32_t version);
+char const	*ssl_version_num(void);
+char const	*ssl_version_range(uint32_t low, uint32_t high);
+char const	*ssl_version(void);
+int		version_add_feature(CONF_SECTION *cs, char const *name, bool enabled);
+int		version_add_number(CONF_SECTION *cs, char const *name, char const *version);
+void		version_init_features(CONF_SECTION *cs);
+void		version_init_numbers(CONF_SECTION *cs);
+void		version_print(void);
+
+/* auth.c */
+char	*auth_name(char *buf, size_t buflen, REQUEST *request, bool do_cli);
+int		rad_authenticate (REQUEST *);
+int		rad_postauth(REQUEST *);
+int		rad_virtual_server(REQUEST *);
+
+/* exec.c */
+pid_t radius_start_program(char const *cmd, REQUEST *request, bool exec_wait,
+			   int *input_fd, int *output_fd,
+			   VALUE_PAIR *input_pairs, bool shell_escape);
+int radius_readfrom_program(int fd, pid_t pid, int timeout,
+			    char *answer, int left);
+int radius_exec_program(TALLOC_CTX *ctx, char *out, size_t outlen, VALUE_PAIR **output_pairs,
+			REQUEST *request, char const *cmd, VALUE_PAIR *input_pairs,
+			bool exec_wait, bool shell_escape, int timeout) CC_HINT(nonnull (5, 6));
+void exec_trigger(REQUEST *request, CONF_SECTION *cs, char const *name, int quench)
+     CC_HINT(nonnull (3));
+
+/* valuepair.c */
+int paircompare_register_byname(char const *name, DICT_ATTR const *from,
+				bool first_only, RAD_COMPARE_FUNC func, void *instance);
+int paircompare_register(DICT_ATTR const *attribute, DICT_ATTR const *from,
+			 bool first_only, RAD_COMPARE_FUNC func, void *instance);
+void		paircompare_unregister(DICT_ATTR const *attr, RAD_COMPARE_FUNC func);
+void		paircompare_unregister_instance(void *instance);
+int		paircompare(REQUEST *request, VALUE_PAIR *req_list,
+			    VALUE_PAIR *check, VALUE_PAIR **rep_list);
+vp_tmpl_t	*xlat_to_tmpl_attr(TALLOC_CTX *ctx, xlat_exp_t *xlat);
+xlat_exp_t		*xlat_from_tmpl_attr(TALLOC_CTX *ctx, vp_tmpl_t *vpt);
+int		radius_xlat_do(REQUEST *request, VALUE_PAIR *vp);
+int radius_compare_vps(REQUEST *request, VALUE_PAIR *check, VALUE_PAIR *vp);
+int radius_callback_compare(REQUEST *request, VALUE_PAIR *req,
+			    VALUE_PAIR *check, VALUE_PAIR *check_pairs,
+			    VALUE_PAIR **reply_pairs);
+int radius_find_compare(DICT_ATTR const *attribute);
+VALUE_PAIR	*radius_pair_create(TALLOC_CTX *ctx, VALUE_PAIR **vps, unsigned int attribute, unsigned int vendor);
+
+void module_failure_msg(REQUEST *request, char const *fmt, ...) CC_HINT(format (printf, 2, 3));
+void vmodule_failure_msg(REQUEST *request, char const *fmt, va_list ap) CC_HINT(format (printf, 2, 0));
+
+int radius_get_vp(VALUE_PAIR **out, REQUEST *request, char const *name);
+int radius_copy_vp(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, char const *name);
+
+
+/*
+ *	Less code == fewer bugs
+ *
+ * @param _a attribute
+ * @param _b value
+ * @param _c op
+ */
+#define pair_make_request(_a, _b, _c) fr_pair_make(request->packet, &request->packet->vps, _a, _b, _c)
+#define pair_make_reply(_a, _b, _c) fr_pair_make(request->reply, &request->reply->vps, _a, _b, _c)
+#define pair_make_config(_a, _b, _c) fr_pair_make(request, &request->config, _a, _b, _c)
+
+/* threads.c */
+int	thread_pool_init(CONF_SECTION *cs, bool *spawn_flag);
+void	thread_pool_stop(void);
+int	thread_pool_addrequest(REQUEST *, RAD_REQUEST_FUNP);
+pid_t	rad_fork(void);
+pid_t	rad_waitpid(pid_t pid, int *status);
+int	total_active_threads(void);
+void	thread_pool_lock(void);
+void	thread_pool_unlock(void);
+void	thread_pool_queue_stats(int array[RAD_LISTEN_MAX], int pps[2]);
+void	thread_pool_thread_stats(int stats[3]);
+
+#ifndef HAVE_PTHREAD_H
+#  define rad_fork(n) fork()
+#  define rad_waitpid(a,b) waitpid(a,b, 0)
+#endif
+
+/* main_config.c */
+/* Define a global config structure */
+extern bool			log_dates_utc;
+extern main_config_t		main_config;
+extern bool			event_loop_started;
+
+void set_radius_dir(TALLOC_CTX *ctx, char const *path);
+char const *get_radius_dir(void);
+int main_config_init(void);
+int main_config_free(void);
+void main_config_hup(void);
+void hup_logfile(void);
+
+/* listen.c */
+void listen_free(rad_listen_t **head);
+int listen_init(CONF_SECTION *cs, rad_listen_t **head, bool spawn_flag);
+rad_listen_t *proxy_new_listener(TALLOC_CTX *ctx, home_server_t *home, uint16_t src_port);
+RADCLIENT *client_listener_find(rad_listen_t *listener, fr_ipaddr_t const *ipaddr, uint16_t src_port);
+
+#ifdef WITH_STATS
+RADCLIENT_LIST *listener_find_client_list(fr_ipaddr_t const *ipaddr, uint16_t port, int proto);
+#endif
+rad_listen_t *listener_find_byipaddr(fr_ipaddr_t const *ipaddr, uint16_t port, int proto);
+int rad_status_server(REQUEST *request);
+
+/* event.c */
+typedef enum event_corral_t {
+	EVENT_CORRAL_MAIN = 0,	//!< Always main thread event list
+	EVENT_CORRAL_AUX	//!< Maybe main thread or one shared by modules
+} event_corral_t;
+
+fr_event_list_t *radius_event_list_corral(event_corral_t hint);
+int radius_event_init(TALLOC_CTX *ctx);
+int radius_event_start(CONF_SECTION *cs, bool spawn_flag);
+void radius_event_free(void);
+int radius_event_process(void);
+void radius_update_listener(rad_listen_t *listener);
+void revive_home_server(void *ctx);
+void mark_home_server_dead(home_server_t *home, struct timeval *when, bool down);
+
+/* evaluate.c */
+typedef struct fr_cond_t fr_cond_t;
+int radius_evaluate_tmpl(REQUEST *request, int modreturn, int depth,
+			 vp_tmpl_t const *vpt);
+int radius_evaluate_map(REQUEST *request, int modreturn, int depth,
+			fr_cond_t const *c);
+int radius_evaluate_cond(REQUEST *request, int modreturn, int depth,
+			 fr_cond_t const *c);
+void radius_pairmove(REQUEST *request, VALUE_PAIR **to, VALUE_PAIR *from, bool do_xlat) CC_HINT(nonnull);
+
+#ifdef WITH_TLS
+/*
+ *	For run-time patching of which function handles which socket.
+ */
+int dual_tls_recv(rad_listen_t *listener);
+int dual_tls_send(rad_listen_t *listener, REQUEST *request);
+int proxy_tls_recv(rad_listen_t *listener);
+int proxy_tls_send(rad_listen_t *listener, REQUEST *request);
+#ifdef WITH_COA_TUNNEL
+int proxy_tls_send_reply(rad_listen_t *listener, REQUEST *request);
+int dual_tls_send_coa_request(rad_listen_t *listener, REQUEST *request);
+void listen_coa_free(void);
+void listen_coa_add(rad_listen_t *listener, char const *key);
+int listen_coa_find(REQUEST *request, char const *key);
+#endif
+#endif
+
+/*
+ *	For radmin over TCP.
+ */
+#define PW_RADMIN_PORT 18120
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*RADIUSD_H*/
diff --git a/src/include/radsniff.h b/src/include/radsniff.h
new file mode 100644
index 0000000..c909ecd
--- /dev/null
+++ b/src/include/radsniff.h
@@ -0,0 +1,323 @@
+/*
+ *   This program is is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License, version 2 of the
+ *   License as published by the Free Software Foundation.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ * @file radsniff.h
+ * @brief Structures and prototypes for the RADIUS sniffer.
+ *
+ * @copyright 2013 Arran Cudbard-Bell <arran.cudbardb@freeradius.org>
+ * @copyright 2006 The FreeRADIUS server project
+ * @copyright 2006 Nicolas Baradakis <nicolas.baradakis@cegetel.net>
+ */
+
+RCSIDH(radsniff_h, "$Id$")
+
+#include <sys/types.h>
+
+#include <freeradius-devel/libradius.h>
+#include <freeradius-devel/pcap.h>
+#include <freeradius-devel/event.h>
+
+#ifdef HAVE_COLLECTDC_H
+#  include <collectd/client.h>
+#endif
+
+#define RS_DEFAULT_PREFIX	"radsniff"	//!< Default instance
+#define RS_DEFAULT_SECRET	"testing123"	//!< Default secret
+#define RS_DEFAULT_TIMEOUT	5200		//!< Standard timeout of 5s + 300ms to cover network latency
+#define RS_FORCE_YIELD		1000		//!< Service another descriptor every X number of packets
+#define RS_RETRANSMIT_MAX	5		//!< Maximum number of times we expect to see a packet retransmitted
+#define RS_MAX_ATTRS		50		//!< Maximum number of attributes we can filter on.
+#define RS_SOCKET_REOPEN_DELAY  5000		//!< How long we delay re-opening a collectd socket.
+
+/*
+ *	Logging macros
+ */
+#undef DEBUG2
+#define DEBUG2(fmt, ...)	if (fr_debug_lvl > 2) fprintf(fr_log_fp , fmt "\n", ## __VA_ARGS__)
+#undef DEBUG
+#define DEBUG(fmt, ...)		if (fr_debug_lvl > 1) fprintf(fr_log_fp , fmt "\n", ## __VA_ARGS__)
+#undef INFO
+#define INFO(fmt, ...)		if (fr_debug_lvl > 0) fprintf(fr_log_fp , fmt "\n", ## __VA_ARGS__)
+
+#define ERROR(fmt, ...)		fr_perror("radsniff: " fmt, ## __VA_ARGS__)
+
+#define RIDEBUG_ENABLED()	(conf->print_packet && (fr_debug_lvl > 0))
+#define RDEBUG_ENABLED()	(conf->print_packet && (fr_debug_lvl > 1))
+#define RDEBUG_ENABLED2()	(conf->print_packet && (fr_debug_lvl > 2))
+
+#define REDEBUG(fmt, ...)	if (conf->print_packet) fr_perror("%s (%" PRIu64 ") " fmt , timestr, count, ## __VA_ARGS__)
+#define RIDEBUG(fmt, ...)	if (conf->print_packet && (fr_debug_lvl > 0)) fprintf(fr_log_fp , "%s (%" PRIu64 ") " fmt "\n", timestr, count, ## __VA_ARGS__)
+#define RDEBUG(fmt, ...)	if (conf->print_packet && (fr_debug_lvl > 1)) fprintf(fr_log_fp , "%s (%" PRIu64 ") " fmt "\n", timestr, count, ## __VA_ARGS__)
+#define RDEBUG2(fmt, ...)	if (conf->print_packet && (fr_debug_lvl > 2)) fprintf(fr_log_fp , "%s (%" PRIu64 ") " fmt "\n", timestr, count, ## __VA_ARGS__)
+
+typedef enum {
+	RS_NORMAL	= 0x01,
+	RS_UNLINKED	= 0x02,
+	RS_RTX		= 0x04,
+	RS_REUSED	= 0x08,
+	RS_ERROR	= 0x10,
+	RS_LOST		= 0x20
+} rs_status_t;
+
+typedef void (*rs_packet_logger_t)(uint64_t count, rs_status_t status, fr_pcap_t *handle, RADIUS_PACKET *packet,
+				   struct timeval *elapsed, struct timeval *latency, bool response, bool body);
+typedef enum {
+#ifdef HAVE_COLLECTDC_H
+	RS_STATS_OUT_COLLECTD = 1,
+#endif
+	RS_STATS_OUT_STDIO
+} stats_out_t;
+
+typedef struct rs rs_t;
+
+#ifdef HAVE_COLLECTDC_H
+typedef struct rs_stats_tmpl rs_stats_tmpl_t;
+typedef struct rs_stats_value_tmpl rs_stats_value_tmpl_t;
+#endif
+
+typedef struct rs_counters {
+	uint64_t type[PW_CODE_MAX];
+} rs_counters_t;
+
+/** Stats for a single interval
+ *
+ * And interval is defined as the time between a call to the stats output function.
+ */
+typedef struct rs_latency {
+	int			intervals;			//!< Number of stats intervals.
+
+	double			latency_smoothed;		//!< Smoothed moving average.
+	uint64_t		latency_smoothed_count;		//!< Number of CMA datapoints processed.
+
+	struct {
+		uint64_t		received_total;		//!< Total received over interval.
+		uint64_t		linked_total;		//!< Total request/response pairs over interval.
+		uint64_t		unlinked_total;		//!< Total unlinked over interval.
+		uint64_t		reused_total;		//!< Total reused over interval.
+		uint64_t		lost_total;		//!< Total packets definitely lost in this interval.
+		uint64_t		rt_total[RS_RETRANSMIT_MAX + 1];	//!< Number of RTX until complete
+										//!< over interval.
+
+
+		double			received;		//!< Number of this type of packet we've received.
+		double			linked;			//!< Number of request/response pairs
+		double			unlinked;		//!< Response with no request.
+		double			reused;			//!< ID re-used too quickly.
+		double			lost;			//!< Never got a response to a request.
+		double			rt[RS_RETRANSMIT_MAX + 1];	//!< Number of times we saw the same
+									//!< request packet.
+
+		long double		latency_total;		//!< Total latency between requests/responses in the
+								//!< interval.
+		double			latency_average;	//!< Average latency (this iteration).
+
+		double			latency_high;		//!< Latency high water mark.
+		double			latency_low;		//!< Latency low water mark.
+	} interval;
+} rs_latency_t;
+
+typedef struct rs_malformed {
+	uint64_t		min_length_packet;
+	uint64_t		min_length_field;
+	uint64_t		min_length_mimatch;
+	uint64_t		header_overflow;
+	uint64_t		invalid_attribute;
+	uint64_t		attribute_too_short;
+	uint64_t		attribute_overflow;
+	uint64_t		ma_invalid_length;
+	uint64_t		attribute_underflow;
+	uint64_t		too_many_attributes;
+	uint64_t		ma_missing;
+} rs_malformed_t;
+
+/** One set of statistics
+ *
+ */
+typedef struct rs_stats {
+	int			intervals;		//!< Number of stats intervals.
+
+	rs_latency_t		exchange[PW_CODE_MAX];  //!< We end up allocating ~16K, but memory is cheap so
+							//!< what the hell.  This is required because instances of
+							//!< FreeRADIUS delay Access-Rejects, which would artificially
+							//!< increase latency stats for Access-Requests.
+
+	struct timeval		quiet;			//!< We may need to 'mute' the stats if libpcap starts
+							//!< dropping packets, or we run out of memory.
+} rs_stats_t;
+
+typedef struct rs_capture {
+	struct pcap_pkthdr	*header;		//!< PCAP packet header.
+	uint8_t			*data;			//!< PCAP packet data.
+} rs_capture_t;
+
+/** Wrapper for RADIUS_PACKET
+ *
+ * Allows an event to be associated with a request packet.  This is required because we need to disarm
+ * the event timer when a response is received, so we don't erroneously log the response as lost.
+ */
+typedef struct rs_request {
+	uint64_t		id;			//!< Monotonically increasing packet counter.
+	fr_event_t		*event;			//!< Event created when we received the original request.
+
+	bool			logged;			//!< Whether any messages regarding this request were logged.
+
+	struct timeval		when;			//!< Time when the packet was received, or next time an event
+							//!< is scheduled.
+	fr_pcap_t		*in;			//!< PCAP handle the original request was received on.
+	RADIUS_PACKET		*packet;		//!< The original packet.
+	RADIUS_PACKET		*expect;		//!< Request/response.
+	RADIUS_PACKET		*linked;		//!< The subsequent response or forwarded request the packet
+							//!< was linked against.
+
+
+	rs_capture_t		capture[RS_RETRANSMIT_MAX];	//!< Buffered request packets (if a response filter
+								//!< has been applied).
+	rs_capture_t		*capture_p;			//!< Next packet slot.
+
+	uint64_t		rt_req;			//!< Number of times we saw the same request packet.
+	uint64_t		rt_rsp;			//!< Number of times we saw a retransmitted response
+							//!< packet.
+	rs_latency_t		*stats_req;		//!< Latency entry for the request type.
+	rs_latency_t		*stats_rsp;		//!< Latency entry for the request type.
+
+	bool			silent_cleanup;		//!< Cleanup was forced before normal expiry period,
+							//!< ignore stats about packet loss.
+
+	VALUE_PAIR		*link_vps;		//!< VALUE_PAIRs used to link retransmissions.
+
+	bool			in_request_tree;	//!< Whether the request is currently in the request tree.
+	bool			in_link_tree;		//!< Whether the request is currently in the linked tree.
+} rs_request_t;
+
+/** Statistic write/print event
+ *
+ */
+typedef struct rs_event {
+	fr_event_list_t		*list;			//!< The event list.
+
+	fr_pcap_t		*in;			//!< PCAP handle event occurred on.
+	fr_pcap_t		*out;			//!< Where to write output.
+
+	rs_stats_t		*stats;			//!< Where to write stats.
+} rs_event_t;
+
+/** FD data which gets passed to callbacks
+ *
+ */
+typedef struct rs_update {
+	fr_event_list_t		*list;			//!< List to insert new event into.
+
+	fr_pcap_t		*in;			//!< Linked list of PCAP handles to check for drops.
+	rs_stats_t		*stats;			//!< Stats to process.
+} rs_update_t;
+
+
+struct rs {
+	bool			from_file;		//!< Were reading pcap data from files.
+	bool			from_dev;		//!< Were reading pcap data from devices.
+	bool			from_stdin;		//!< Were reading pcap data from stdin.
+	bool			to_file;		//!< Were writing pcap data to files.
+	bool			to_stdout;		//!< Were writing pcap data to stdout.
+
+	bool			daemonize;		//!< Daemonize and write PID out to file.
+	char const		*pidfile;		//!< File to write PID to.
+
+	bool			from_auto;		//!< From list was auto-generated.
+	bool			promiscuous;		//!< Capture in promiscuous mode.
+	bool			print_packet;		//!< Print packet info, disabled with -W
+	bool			decode_attrs;		//!< Whether we should decode attributes in the request
+							//!< and response.
+	bool			verify_udp_checksum;	//!< Check UDP checksum in packets.
+
+	char const		*radius_secret;		//!< Secret to decode encrypted attributes.
+
+	char			*pcap_filter;		//!< PCAP filter string applied to live capture devices.
+
+	char			*list_attributes;	//!< Raw attribute filter string.
+	DICT_ATTR const 	*list_da[RS_MAX_ATTRS]; //!< Output CSV with these attribute values.
+	int			list_da_num;
+
+	char			*link_attributes;	//!< Names of DICT_ATTRs to use for rtx.
+	DICT_ATTR const		*link_da[RS_MAX_ATTRS];	//!< DICT_ATTRs to link on.
+	int			link_da_num;		//!< Number of rtx DICT_ATTRs.
+
+	char const		*filter_request;	//!< Raw request filter string.
+	char const		*filter_response;	//!< Raw response filter string.
+
+	VALUE_PAIR 		*filter_request_vps;	//!< Sorted filter vps.
+	VALUE_PAIR 		*filter_response_vps;	//!< Sorted filter vps.
+	PW_CODE			filter_request_code;	//!< Filter request packets by code.
+	PW_CODE			filter_response_code;	//!< Filter response packets by code.
+
+	rs_status_t		event_flags;		//!< Events we log and capture on.
+	rs_packet_logger_t	logger;			//!< Packet logger
+
+	int			buffer_pkts;		//!< Size of the ring buffer to setup for live capture.
+	uint64_t		limit;			//!< Maximum number of packets to capture
+
+	struct {
+		int			interval;		//!< Time between stats updates in seconds.
+		stats_out_t		out;			//!< Where to write stats.
+		int			timeout;		//!< Maximum length of time we wait for a response.
+
+#ifdef HAVE_COLLECTDC_H
+		char const		*collectd;		//!< Collectd server/port/unixsocket
+		char const		*prefix;		//!< Prefix collectd stats with this value.
+		lcc_connection_t	*handle;		//!< Collectd client handle.
+		rs_stats_tmpl_t		*tmpl;			//!< The stats templates we created on startup.
+#endif
+	} stats;
+};
+
+#ifdef HAVE_COLLECTDC_H
+
+/** Callback for processing stats values.
+ *
+ */
+typedef void (*rs_stats_cb_t)(rs_t *conf, rs_stats_value_tmpl_t *tmpl);
+struct rs_stats_value_tmpl {
+	void			*src;			//!< Pointer to source field in struct. Must be set by
+							//!< stats_collectdc_init caller.
+	int			type;			//!< Stats type.
+	rs_stats_cb_t		cb;			//!< Callback used to process stats
+	void			*dst;			//!< Pointer to dst field in value struct. Must be set
+							//!< by stats_collectdc_init caller.
+};
+
+/** Stats templates
+ *
+ * This gets processed to turn radsniff stats structures into collectd lcc_value_list_t structures.
+ */
+struct rs_stats_tmpl
+{
+	rs_stats_value_tmpl_t	*value_tmpl;		//!< Value template
+	void			*stats;			//!< Struct containing the raw stats to process
+	lcc_value_list_t	*value;			//!< Collectd stats struct to populate
+
+	rs_stats_tmpl_t		*next;			//!< Next...
+};
+
+/*
+ *	collectd.c - Registration and processing functions
+ */
+rs_stats_tmpl_t *rs_stats_collectd_init_latency(TALLOC_CTX *ctx, rs_stats_tmpl_t **out, rs_t *conf,
+						char const *type, rs_latency_t *stats, PW_CODE code);
+void rs_stats_collectd_do_stats(rs_t *conf, rs_stats_tmpl_t *tmpls, struct timeval *now);
+int rs_stats_collectd_open(rs_t *conf);
+int rs_stats_collectd_close(rs_t *conf);
+
+#endif
diff --git a/src/include/radutmp.h b/src/include/radutmp.h
new file mode 100644
index 0000000..77b7551
--- /dev/null
+++ b/src/include/radutmp.h
@@ -0,0 +1,65 @@
+/*
+ * radutmp.h	Definitions for the Radius UTMP file.
+ *
+ * Version:	$Id$
+ */
+
+#ifndef _RADUTMP_H
+#define _RADUTMP_H
+
+RCSIDH(radutmp_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ *      Types of connection.
+ */
+#ifndef P_UNKNOWN
+#  define P_UNKNOWN       0
+#  define P_LOCAL	 'L'
+#  define P_RLOGIN	'R'
+#  define P_SLIP	  'S'
+#  define P_CSLIP	 'C'
+#  define P_PPP	   'P'
+#  define P_AUTOPPP       'A'
+#  define P_TELNET	'E'
+#  define P_TCPCLEAR      'T'
+#  define P_TCPLOGIN      'U'
+#  define P_CONSOLE       '!'
+#  define P_SHELL	 'X'
+#endif
+
+#define P_IDLE		0
+#define P_LOGIN		1
+
+struct radutmp {
+  char login[32];		/* Loginname */
+				/* FIXME: extend to 48 or 64 bytes */
+  unsigned int nas_port;	/* Port on the terminal server (32 bits). */
+  char session_id[8];		/* Radius session ID (first 8 bytes at least)*/
+				/* FIXME: extend to 16 or 32 bytes */
+  unsigned int nas_address;	/* IP of portmaster. */
+  unsigned int framed_address;	/* SLIP/PPP address or login-host. */
+  int proto;			/* Protocol. */
+  time_t time;			/* Time entry was last updated. */
+  time_t delay;			/* Delay time of request */
+  int type;			/* Type of entry (login/logout) */
+  char porttype;		/* Porttype (I=ISDN A=Async T=Async-ISDN */
+  char res1,res2,res3;		/* Fills up to one int */
+  char caller_id[16];		/* Calling-Station-ID */
+  char reserved[12];		/* 3 ints reserved */
+};
+
+/*
+ *	Take the size of the structure from the actual structure definition.
+ */
+#define RUT_NAMESIZE sizeof(((struct radutmp *) NULL)->login)
+#define RUT_SESSSIZE sizeof(((struct radutmp *) NULL)->session_id)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _RADUTMP_H */
diff --git a/src/include/realms.h b/src/include/realms.h
new file mode 100644
index 0000000..23806f4
--- /dev/null
+++ b/src/include/realms.h
@@ -0,0 +1,235 @@
+#ifndef REALMS_H
+#define REALMS_H
+
+/*
+ * realms.h	Structures, prototypes and global variables
+ *		for realms
+ *
+ * Version:	$Id$
+ *
+ */
+
+RCSIDH(realms_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern bool home_servers_udp;	//!< Whether there are any UDP home servers
+
+typedef enum {
+	HOME_TYPE_INVALID = 0,
+	HOME_TYPE_AUTH,		//!< Authentication server
+	HOME_TYPE_ACCT,		//!< Accounting server
+	HOME_TYPE_AUTH_ACCT,	//!< Authentication and accounting server
+
+#ifdef WITH_COA
+	HOME_TYPE_COA,		//!< CoA destination (NAS or Proxy)
+
+#ifdef WITH_COA_TUNNEL
+	HOME_TYPE_AUTH_COA,	//!< auth + coa
+	HOME_TYPE_AUTH_ACCT_COA, //!< auth + acct + coa
+#endif
+#endif
+} home_type_t;
+
+typedef enum {
+	HOME_PING_CHECK_INVALID = 0,
+	HOME_PING_CHECK_NONE,
+	HOME_PING_CHECK_STATUS_SERVER,
+	HOME_PING_CHECK_REQUEST
+} home_ping_check_t;
+
+typedef enum {
+	HOME_STATE_ALIVE = 0,
+	HOME_STATE_ZOMBIE,
+	HOME_STATE_IS_DEAD,
+	HOME_STATE_UNKNOWN,
+	HOME_STATE_ADMIN_DOWN,
+	HOME_STATE_CONNECTION_FAIL,
+} home_state_t;
+
+#define HOME_SERVER_IS_DEAD(_x) (((_x)->state == HOME_STATE_IS_DEAD) || ((_x)->state == HOME_STATE_ADMIN_DOWN) || ((_x)->state == HOME_STATE_CONNECTION_FAIL))
+
+typedef struct fr_socket_limit_t {
+	uint32_t	max_connections;
+	uint32_t	num_connections;
+	uint32_t	max_requests;
+	uint32_t	num_requests;
+	uint32_t	lifetime;
+	uint32_t	idle_timeout;
+} fr_socket_limit_t;
+
+typedef struct home_server {
+	char const		*log_name;		//!< The name used for log messages.
+
+	char const		*name;			//!< Name the server may be referenced by for querying
+							//!< stats or when specifying home servers for a pool.
+
+	bool			dual;			//!< One of a pair of homeservers on consecutive ports.
+	bool			dynamic;		//!< is this a dynamically added home server?
+	bool			nonblock;		//!< Enable a socket non-blocking to the home server.
+#ifdef WITH_COA_TUNNEL
+	bool			recv_coa;		//!< receive CoA packets, too
+#endif
+	char const		*virtual_server;		//!< For internal proxying
+	char const		*parent_server;
+
+	fr_ipaddr_t		ipaddr;			//!< IP address of home server.
+	uint16_t		port;
+
+	char const		*type_str;		//!< String representation of type.
+	home_type_t		type;			//!< Auth, Acct, CoA etc.
+
+	char const		*src_ipaddr_str;	//!< Need to parse the string specially as it may
+							//!< require a DNS lookup and the address family for that
+							//!< is the same as ipaddr.
+	fr_ipaddr_t		src_ipaddr;		//!< Resolved version of src_ipaddr_str.  Preferred source
+							//!< IP address (useful for multihomed systems).
+
+	char const		*proto_str;		//!< String representation of protocol.
+	int			proto;			//!< TCP or UDP.
+
+	fr_socket_limit_t 	limit;
+
+	char const		*secret;
+
+	fr_event_t		*ev;
+	struct timeval		when;
+
+	struct timeval		response_window;
+	uint32_t		response_timeouts;
+	uint32_t		max_response_timeouts;
+	uint32_t		max_outstanding;	//!< Maximum outstanding requests.
+	uint32_t		currently_outstanding;
+
+	time_t			last_packet_sent;
+	time_t			last_packet_recv;
+	time_t			last_failed_open;
+	struct timeval		revive_time;
+	struct timeval		zombie_period_start;
+	uint32_t		zombie_period;		//!< Unresponsive for T, mark it dead.
+
+	int			state;
+
+	char const		*ping_check_str;
+	home_ping_check_t	ping_check;		//!< What method we use to perform the 'ping'
+							//!< none, status-server or fake request.
+
+	char const		*ping_user_name;
+	char const		*ping_user_password;
+
+	uint32_t		ping_interval;
+	uint32_t		num_pings_to_alive;
+	uint32_t		num_sent_pings;
+	uint32_t		num_received_pings;
+	uint32_t		ping_timeout;
+
+	uint32_t		revive_interval;	//!< How often we revive it (if it doesn't support pings).
+	CONF_SECTION		*cs;
+#ifdef WITH_COA
+	uint32_t		coa_irt;
+	uint32_t		coa_mrc;
+	uint32_t		coa_mrt;
+	uint32_t		coa_mrd;
+#ifdef WITH_COA_TUNNEL
+	char const		*recv_coa_server;      	//!< for accepting incoming CoA requests
+#endif
+#endif
+#ifdef WITH_TLS
+	fr_tls_server_conf_t	*tls;
+	uint32_t		connect_timeout;
+	rbtree_t		*listeners;
+#endif
+
+#ifdef WITH_STATS
+	int			number;
+
+	fr_stats_t		stats;
+
+	fr_stats_ema_t  	ema;
+#endif
+#ifdef HAVE_TRUST_ROUTER_TR_DH_H
+	time_t			expiration;
+#endif
+
+} home_server_t;
+
+
+typedef enum home_pool_type_t {
+	HOME_POOL_INVALID = 0,
+	HOME_POOL_LOAD_BALANCE,
+	HOME_POOL_FAIL_OVER,
+	HOME_POOL_CLIENT_BALANCE,
+	HOME_POOL_CLIENT_PORT_BALANCE,
+	HOME_POOL_KEYED_BALANCE
+} home_pool_type_t;
+
+
+typedef struct home_pool_t {
+	char const		*name;
+	home_pool_type_t	type;
+
+	home_type_t    		server_type;
+	CONF_SECTION		*cs;
+
+	char const		*virtual_server; /* for pre/post-proxy */
+
+	home_server_t		*fallback;
+	int			in_fallback;
+	time_t			time_all_dead;
+	time_t			last_serviced;
+
+	int			num_home_servers;
+	home_server_t		*servers[1];
+} home_pool_t;
+
+
+typedef struct _realm {
+	char const		*name;
+
+	bool			strip_realm;
+
+	home_pool_t		*auth_pool;
+	home_pool_t		*acct_pool;
+#ifdef WITH_COA
+	home_pool_t		*coa_pool;
+#endif
+} REALM;
+
+typedef struct realm_config realm_config_t;
+
+int		realms_init(CONF_SECTION *config);
+void		realms_free(void);
+REALM		*realm_find(char const *name); /* name is from a packet */
+REALM		*realm_find2(char const *name); /* ... with name taken from realm_find */
+
+void		realm_home_server_sanitize(home_server_t *home, CONF_SECTION *cs);
+int		realm_pool_add(home_pool_t *pool, CONF_SECTION *cs);
+void		realm_pool_free(home_pool_t *pool);
+bool		realm_home_server_add(home_server_t *home);
+int		realm_realm_add( REALM *r, CONF_SECTION *cs);
+
+void		home_server_update_request(home_server_t *home, REQUEST *request);
+home_server_t	*home_server_ldb(char const *realmname, home_pool_t *pool, REQUEST *request);
+home_server_t	*home_server_find(fr_ipaddr_t *ipaddr, uint16_t port, int proto);
+home_server_t	*home_server_find_bysrc(fr_ipaddr_t *ipaddr, uint16_t port, int proto, fr_ipaddr_t *src_ipaddr);
+home_server_t	*home_server_afrom_cs(TALLOC_CTX *ctx, realm_config_t *rc, CONF_SECTION *cs);
+CONF_SECTION	*home_server_cs_afrom_client(CONF_SECTION *client);
+#ifdef WITH_COA
+home_server_t	*home_server_byname(char const *name, int type);
+#endif
+#ifdef WITH_STATS
+extern int home_server_max_number;
+home_server_t	*home_server_bynumber(int number);
+#endif
+home_pool_t	*home_pool_byname(char const *name, int type);
+
+int		home_server_afrom_file(char const *filename);
+int		home_server_delete(char const *name, char const *type);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* REALMS_H */
diff --git a/src/include/regex.h b/src/include/regex.h
new file mode 100644
index 0000000..efb7b86
--- /dev/null
+++ b/src/include/regex.h
@@ -0,0 +1,77 @@
+/*
+ *   This library is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU Lesser General Public
+ *   License as published by the Free Software Foundation; either
+ *   version 2.1 of the License, or (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ *   Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public
+ *   License along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef REGEX_H
+#define REGEX_H
+#ifdef HAVE_REGEX
+/*
+ * $Id$
+ *
+ * @file regex.h
+ * @brief Wrappers around various regular expression libraries.
+ *
+ * @copyright 2014 The FreeRADIUS server project
+ */
+RCSIDH(regex_h, "$Id$")
+
+#  ifdef __cplusplus
+extern "C" {
+#  endif
+#  ifdef HAVE_PCRE
+#    include <pcre.h>
+/*
+ *  Versions older then 8.20 didn't have the JIT functionality
+ *  gracefully degrade.
+ */
+#    ifndef PCRE_STUDY_JIT_COMPILE
+#      define PCRE_STUDY_JIT_COMPILE 0
+#    endif
+/*
+ *  libpcre defines its matches as an array of ints which is a
+ *  multiple of three.
+ */
+typedef struct regmatch {
+	int a;
+	int b;
+	int c;
+} regmatch_t;
+
+typedef struct regex {
+	bool		precompiled;	//!< Whether this regex was precompiled, or compiled for one of evaluation.
+	pcre		*compiled;	//!< Compiled regular expression.
+	pcre_extra	*extra;		//!< Result of studying a regular expression.
+} regex_t;
+#  else
+#    include <regex.h>
+/*
+ *  Allow REG_EXTENDED and REG_NOSUB to be or'd with flags
+ *  if they're not defined.
+ */
+#    ifndef REG_EXTENDED
+#      define REG_EXTENDED (0)
+#    endif
+
+#    ifndef REG_NOSUB
+#      define REG_NOSUB (0)
+#    endif
+#  endif
+ssize_t regex_compile(TALLOC_CTX *ctx, regex_t **out, char const *pattern, size_t len,
+		      bool ignore_case, bool multiline, bool subcaptures, bool runtime);
+int	regex_exec(regex_t *preg, char const *string, size_t len, regmatch_t pmatch[], size_t *nmatch);
+#  ifdef __cplusplus
+}
+#  endif
+#endif
+#endif
diff --git a/src/include/sha1.h b/src/include/sha1.h
new file mode 100644
index 0000000..86c3d9f
--- /dev/null
+++ b/src/include/sha1.h
@@ -0,0 +1,57 @@
+#ifndef _FR_SHA1_H
+#define _FR_SHA1_H
+
+#ifdef WITH_OPENSSL_SHA1
+#include <openssl/sha.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef SHA1_DIGEST_LENGTH
+#  define SHA1_DIGEST_LENGTH 20
+#endif
+
+#ifndef WITH_OPENSSL_SHA1
+typedef struct {
+    uint32_t state[5];
+    uint32_t count[2];
+    uint8_t buffer[64];
+} fr_sha1_ctx;
+
+void fr_sha1_transform(uint32_t state[5], uint8_t const buffer[64]);
+void fr_sha1_init(fr_sha1_ctx *context);
+void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *data, size_t len);
+void fr_sha1_final(uint8_t digest[20], fr_sha1_ctx *context);
+
+/*
+ * this version implements a raw SHA1 transform, no length is appended,
+ * nor any 128s out to the block size.
+ */
+void fr_sha1_final_no_len(uint8_t digest[20], fr_sha1_ctx* context);
+
+#else  /* WITH_OPENSSL_SHA1 */
+USES_APPLE_DEPRECATED_API
+#define fr_sha1_ctx	SHA_CTX
+#define fr_sha1_init	SHA1_Init
+#define fr_sha1_update	SHA1_Update
+#define fr_sha1_final	SHA1_Final
+#define fr_sha1_transform SHA1_Transform
+#endif
+
+/*
+ * FIPS 186-2 PRF based upon SHA1.
+ */
+void fips186_2prf(uint8_t mk[20], uint8_t finalkey[160]);
+
+/* hmacsha1.c */
+
+void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
+		  uint8_t const *key, size_t key_len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _FR_SHA1_H */
diff --git a/src/include/socket.h b/src/include/socket.h
new file mode 100644
index 0000000..821c2a0
--- /dev/null
+++ b/src/include/socket.h
@@ -0,0 +1,53 @@
+#pragma once
+
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or (at
+ *   your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/** Functions for establishing and managing low level sockets
+ *
+ * @file src/include/socket.h
+ *
+ * @author Arran Cudbard-Bell (a.cudbardb@freeradius.org)
+ * @author Alan DeKok (aland@freeradius.org)
+ *
+ * @copyright 2015 The FreeRADIUS project
+ */
+RCSIDH(socket_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <freeradius-devel/build.h>
+#include <freeradius-devel/missing.h>
+
+#ifdef HAVE_SYS_UN_H
+#  include <sys/un.h>
+/*
+ *  The linux headers define the macro as:
+ *
+ * # define SUN_LEN(ptr) ((size_t) (((struct sockaddr_un *) 0)->sun_path)        \
+ *                      + strlen ((ptr)->sun_path))
+ *
+ * Which trips UBSAN, because it sees an operation on a NULL pointer.
+ */
+#  undef SUN_LEN
+#  define SUN_LEN(su)  (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path))
+#endif
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/include/soh.h b/src/include/soh.h
new file mode 100644
index 0000000..c1187cc
--- /dev/null
+++ b/src/include/soh.h
@@ -0,0 +1,42 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_SOH_H
+#define FR_SOH_H
+/**
+ * $Id$
+ *
+ * @file soh.h
+ * @brief Microsoft SoH support
+ *
+ * @copyright 2010 Phil Mayers <p.mayers@imperial.ac.uk>
+ */
+
+RCSIDH(soh_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int soh_verify(REQUEST *request, uint8_t const *data, unsigned int data_len) CC_HINT(nonnull);
+uint16_t soh_pull_be_16(uint8_t const *p);
+uint32_t soh_pull_be_24(uint8_t const *p);
+uint32_t soh_pull_be_32(uint8_t const *p);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/state.h b/src/include/state.h
new file mode 100644
index 0000000..d9b47a0
--- /dev/null
+++ b/src/include/state.h
@@ -0,0 +1,47 @@
+#ifndef FR_STATE_H
+#define FR_STATE_H
+
+/*
+ * state.h	handle multi-packet state
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2014 The FreeRADIUS server project
+ * Copyright 2014 Alan DeKok <aland@deployingradius.com>
+ */
+
+RCSIDH(state_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct fr_state_t fr_state_t;
+
+fr_state_t *fr_state_init(TALLOC_CTX *ctx);
+void fr_state_delete(fr_state_t *state);
+
+void fr_state_discard(REQUEST *request, RADIUS_PACKET *original);
+
+void fr_state_get_vps(REQUEST *request, RADIUS_PACKET *packet);
+bool fr_state_put_vps(REQUEST *request, RADIUS_PACKET *original, RADIUS_PACKET *packet);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_HASH_H */
diff --git a/src/include/stats.h b/src/include/stats.h
new file mode 100644
index 0000000..68903f9
--- /dev/null
+++ b/src/include/stats.h
@@ -0,0 +1,101 @@
+#ifndef FR_STATS_H
+#define FR_STATS_H
+
+/*
+ * stats.h	Structures and functions for statistics.
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2005,2006,2007,2008  The FreeRADIUS server project
+ */
+
+RCSIDH(stats_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef WITH_STATS
+typedef struct fr_stats_t {
+	uint64_t	total_requests;
+	uint64_t	total_invalid_requests;
+	uint64_t	total_dup_requests;
+	uint64_t	total_responses;
+	uint64_t	total_access_accepts;
+	uint64_t	total_access_rejects;
+	uint64_t	total_access_challenges;
+	uint64_t	total_malformed_requests;
+	uint64_t	total_bad_authenticators;
+	uint64_t	total_packets_dropped;
+	uint64_t	total_no_records;
+	uint64_t	total_unknown_types;
+	uint64_t	total_timeouts;
+	uint64_t	total_conflicts;
+	uint64_t	unresponsive_child;
+	time_t		last_packet;
+	uint64_t	elapsed[8];
+} fr_stats_t;
+
+typedef struct fr_stats_ema_t {
+	uint32_t	window;
+
+	uint32_t	f1, f10;
+	uint32_t	ema1, ema10;
+} fr_stats_ema_t;
+
+extern fr_stats_t	radius_auth_stats;
+#ifdef WITH_ACCOUNTING
+extern fr_stats_t	radius_acct_stats;
+#endif
+#ifdef WITH_COA
+extern fr_stats_t	radius_coa_stats;
+extern fr_stats_t	radius_dsc_stats;
+#endif
+#ifdef WITH_PROXY
+extern fr_stats_t	proxy_auth_stats;
+#ifdef WITH_ACCOUNTING
+extern fr_stats_t	proxy_acct_stats;
+#endif
+#ifdef WITH_COA
+extern fr_stats_t	proxy_coa_stats;
+extern fr_stats_t	proxy_dsc_stats;
+#endif
+#endif
+
+void radius_stats_init(int flag);
+void request_stats_final(REQUEST *request);
+void request_stats_reply(REQUEST *request);
+void radius_stats_ema(fr_stats_ema_t *ema,
+		      struct timeval *start, struct timeval *end);
+
+#define FR_STATS_INC(_x, _y) radius_ ## _x ## _stats._y++;if (listener) listener->stats._y++;if (client) client->_x._y++;
+#define FR_STATS_TYPE_INC(_x) _x++
+
+#else  /* WITH_STATS */
+#define request_stats_init(_x)
+#define request_stats_final(_x)
+
+#define FR_STATS_INC(_x, _y)
+#define FR_STATS_TYPE_INC(_x)
+
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_STATS_H */
diff --git a/src/include/stdatomic.h b/src/include/stdatomic.h
new file mode 100644
index 0000000..780e5a0
--- /dev/null
+++ b/src/include/stdatomic.h
@@ -0,0 +1,364 @@
+#pragma once
+/*
+ * An implementation of C11 stdatomic.h directly borrowed from FreeBSD
+ * (original copyright follows), with minor modifications for
+ * portability to other systems. Works for recent Clang (that
+ * implement the feature c_atomic) and GCC 4.7+; includes
+ * compatibility for GCC below 4.7 but I wouldn't recommend it.
+ *
+ * Caveats and limitations:
+ * - Only the ``_Atomic parentheses'' notation is implemented, while
+ *   the ``_Atomic space'' one is not.
+ * - _Atomic types must be typedef'ed, or programs using them will
+ *   not type check correctly (incompatible anonymous structure
+ *   types).
+ * - Non-scalar _Atomic types would require runtime support for
+ *   runtime locking, which, as far as I know, is not currently
+ *   available on any system.
+ */
+
+/*-
+ * @copyright (c) 2011 Ed Schouten <ed@FreeBSD.org>
+ *                    David Chisnall <theraven@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/include/stdatomic.h,v 1.10.2.2 2012/05/30 19:21:54 theraven Exp $
+ */
+#include <stddef.h>
+#include <stdint.h>
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if !defined(__has_builtin)
+#define __has_builtin(x) 0
+#endif
+#if !defined(__GNUC_PREREQ__)
+#if defined(__GNUC__) && defined(__GNUC_MINOR__)
+#define __GNUC_PREREQ__(maj, min)					\
+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
+#else
+#define __GNUC_PREREQ__(maj, min) 0
+#endif
+#endif
+
+#if !defined(__CLANG_ATOMICS) && !defined(__GNUC_ATOMICS)
+#if __has_feature(c_atomic)
+#define	__CLANG_ATOMICS
+#elif __GNUC_PREREQ__(4, 7)
+#define	__GNUC_ATOMICS
+#elif !defined(__GNUC__)
+#error "stdatomic.h does not support your compiler"
+#endif
+#endif
+
+#if !defined(__CLANG_ATOMICS)
+#define	_Atomic(T)			struct { volatile __typeof__(T) __val; }
+#endif
+
+/*
+ * 7.17.2 Initialization.
+ */
+
+#if defined(__CLANG_ATOMICS)
+#define	ATOMIC_VAR_INIT(value)		(value)
+#define	atomic_init(obj, value)		__c11_atomic_init(obj, value)
+#else
+#define	ATOMIC_VAR_INIT(value)		{ .__val = (value) }
+#define	atomic_init(obj, value) do {					\
+	(obj)->__val = (value);						\
+} while (0)
+#endif
+
+/*
+ * Clang and recent GCC both provide predefined macros for the memory
+ * orderings.  If we are using a compiler that doesn't define them, use the
+ * clang values - these will be ignored in the fallback path.
+ */
+
+#ifndef __ATOMIC_RELAXED
+#define __ATOMIC_RELAXED		0
+#endif
+#ifndef __ATOMIC_CONSUME
+#define __ATOMIC_CONSUME		1
+#endif
+#ifndef __ATOMIC_ACQUIRE
+#define __ATOMIC_ACQUIRE		2
+#endif
+#ifndef __ATOMIC_RELEASE
+#define __ATOMIC_RELEASE		3
+#endif
+#ifndef __ATOMIC_ACQ_REL
+#define __ATOMIC_ACQ_REL		4
+#endif
+#ifndef __ATOMIC_SEQ_CST
+#define __ATOMIC_SEQ_CST		5
+#endif
+
+/*
+ * 7.17.3 Order and consistency.
+ *
+ * The memory_order_* constants that denote the barrier behaviour of the
+ * atomic operations.
+ */
+
+enum memory_order {
+	memory_order_relaxed = __ATOMIC_RELAXED,
+	memory_order_consume = __ATOMIC_CONSUME,
+	memory_order_acquire = __ATOMIC_ACQUIRE,
+	memory_order_release = __ATOMIC_RELEASE,
+	memory_order_acq_rel = __ATOMIC_ACQ_REL,
+	memory_order_seq_cst = __ATOMIC_SEQ_CST
+};
+
+typedef enum memory_order memory_order;
+
+/*
+ * 7.17.4 Fences.
+ */
+
+#ifdef __CLANG_ATOMICS
+#define	atomic_thread_fence(order)	__c11_atomic_thread_fence(order)
+#define	atomic_signal_fence(order)	__c11_atomic_signal_fence(order)
+#elif defined(__GNUC_ATOMICS)
+#define	atomic_thread_fence(order)	__atomic_thread_fence(order)
+#define	atomic_signal_fence(order)	__atomic_signal_fence(order)
+#else
+#define	atomic_thread_fence(order)	__sync_synchronize()
+#define	atomic_signal_fence(order)	__asm volatile ("" : : : "memory")
+#endif
+
+/*
+ * 7.17.5 Lock-free property.
+ */
+
+#if defined(__CLANG_ATOMICS)
+#define	atomic_is_lock_free(obj) \
+	__c11_atomic_is_lock_free(sizeof(obj))
+#elif defined(__GNUC_ATOMICS)
+#define	atomic_is_lock_free(obj) \
+	__atomic_is_lock_free(sizeof((obj)->__val))
+#else
+#define	atomic_is_lock_free(obj) \
+	(sizeof((obj)->__val) <= sizeof(void *))
+#endif
+
+/*
+ * 7.17.6 Atomic integer types.
+ */
+
+typedef _Atomic(_Bool)			atomic_bool;
+typedef _Atomic(char)			atomic_char;
+typedef _Atomic(signed char)		atomic_schar;
+typedef _Atomic(unsigned char)		atomic_uchar;
+typedef _Atomic(short)			atomic_short;
+typedef _Atomic(unsigned short)		atomic_ushort;
+typedef _Atomic(int)			atomic_int;
+typedef _Atomic(unsigned int)		atomic_uint;
+typedef _Atomic(long)			atomic_long;
+typedef _Atomic(unsigned long)		atomic_ulong;
+typedef _Atomic(long long)		atomic_llong;
+typedef _Atomic(unsigned long long)	atomic_ullong;
+#if 0
+typedef _Atomic(char16_t)		atomic_char16_t;
+typedef _Atomic(char32_t)		atomic_char32_t;
+#endif
+typedef _Atomic(wchar_t)		atomic_wchar_t;
+typedef _Atomic(int_least8_t)		atomic_int_least8_t;
+typedef _Atomic(uint_least8_t)		atomic_uint_least8_t;
+typedef _Atomic(int_least16_t)		atomic_int_least16_t;
+typedef _Atomic(uint_least16_t)		atomic_uint_least16_t;
+typedef _Atomic(int_least32_t)		atomic_int_least32_t;
+typedef _Atomic(uint_least32_t)		atomic_uint_least32_t;
+typedef _Atomic(int_least64_t)		atomic_int_least64_t;
+typedef _Atomic(uint_least64_t)		atomic_uint_least64_t;
+typedef _Atomic(int_fast8_t)		atomic_int_fast8_t;
+typedef _Atomic(uint_fast8_t)		atomic_uint_fast8_t;
+typedef _Atomic(int_fast16_t)		atomic_int_fast16_t;
+typedef _Atomic(uint_fast16_t)		atomic_uint_fast16_t;
+typedef _Atomic(int_fast32_t)		atomic_int_fast32_t;
+typedef _Atomic(uint_fast32_t)		atomic_uint_fast32_t;
+typedef _Atomic(int_fast64_t)		atomic_int_fast64_t;
+typedef _Atomic(uint_fast64_t)		atomic_uint_fast64_t;
+typedef _Atomic(intptr_t)		atomic_intptr_t;
+typedef _Atomic(uintptr_t)		atomic_uintptr_t;
+typedef _Atomic(size_t)			atomic_size_t;
+typedef _Atomic(ptrdiff_t)		atomic_ptrdiff_t;
+typedef _Atomic(intmax_t)		atomic_intmax_t;
+typedef _Atomic(uintmax_t)		atomic_uintmax_t;
+
+/*
+ * 7.17.7 Operations on atomic types.
+ */
+
+/*
+ * Compiler-specific operations.
+ */
+
+#if defined(__CLANG_ATOMICS)
+#define	atomic_compare_exchange_strong_explicit(object, expected,	\
+    desired, success, failure)						\
+	__c11_atomic_compare_exchange_strong(object, expected, desired,	\
+	    success, failure)
+#define	atomic_compare_exchange_weak_explicit(object, expected,		\
+    desired, success, failure)						\
+	__c11_atomic_compare_exchange_weak(object, expected, desired,	\
+	    success, failure)
+#define	atomic_exchange_explicit(object, desired, order)		\
+	__c11_atomic_exchange(object, desired, order)
+#define	atomic_fetch_add_explicit(object, operand, order)		\
+	__c11_atomic_fetch_add(object, operand, order)
+#define	atomic_fetch_and_explicit(object, operand, order)		\
+	__c11_atomic_fetch_and(object, operand, order)
+#define	atomic_fetch_or_explicit(object, operand, order)		\
+	__c11_atomic_fetch_or(object, operand, order)
+#define	atomic_fetch_sub_explicit(object, operand, order)		\
+	__c11_atomic_fetch_sub(object, operand, order)
+#define	atomic_fetch_xor_explicit(object, operand, order)		\
+	__c11_atomic_fetch_xor(object, operand, order)
+#define	atomic_load_explicit(object, order)				\
+	__c11_atomic_load(object, order)
+#define	atomic_store_explicit(object, desired, order)			\
+	__c11_atomic_store(object, desired, order)
+#elif defined(__GNUC_ATOMICS)
+#define	atomic_compare_exchange_strong_explicit(object, expected,	\
+    desired, success, failure)						\
+	__atomic_compare_exchange_n(&(object)->__val, expected,		\
+	    desired, 0, success, failure)
+#define	atomic_compare_exchange_weak_explicit(object, expected,		\
+    desired, success, failure)						\
+	__atomic_compare_exchange_n(&(object)->__val, expected,		\
+	    desired, 1, success, failure)
+#define	atomic_exchange_explicit(object, desired, order)		\
+	__atomic_exchange_n(&(object)->__val, desired, order)
+#define	atomic_fetch_add_explicit(object, operand, order)		\
+	__atomic_fetch_add(&(object)->__val, operand, order)
+#define	atomic_fetch_and_explicit(object, operand, order)		\
+	__atomic_fetch_and(&(object)->__val, operand, order)
+#define	atomic_fetch_or_explicit(object, operand, order)		\
+	__atomic_fetch_or(&(object)->__val, operand, order)
+#define	atomic_fetch_sub_explicit(object, operand, order)		\
+	__atomic_fetch_sub(&(object)->__val, operand, order)
+#define	atomic_fetch_xor_explicit(object, operand, order)		\
+	__atomic_fetch_xor(&(object)->__val, operand, order)
+#define	atomic_load_explicit(object, order)				\
+	__atomic_load_n(&(object)->__val, order)
+#define	atomic_store_explicit(object, desired, order)			\
+	__atomic_store_n(&(object)->__val, desired, order)
+#else
+#define	atomic_compare_exchange_strong_explicit(object, expected,	\
+    desired, success, failure) ({					\
+	__typeof__((object)->__val) __v;				\
+	_Bool __r;							\
+	__v = __sync_val_compare_and_swap(&(object)->__val,		\
+	    *(expected), desired);					\
+	__r = *(expected) == __v;					\
+	*(expected) = __v;						\
+	__r;								\
+})
+
+#define	atomic_compare_exchange_weak_explicit(object, expected,		\
+    desired, success, failure)						\
+	atomic_compare_exchange_strong_explicit(object, expected,	\
+		desired, success, failure)
+#if __has_builtin(__sync_swap)
+/* Clang provides a full-barrier atomic exchange - use it if available. */
+#define atomic_exchange_explicit(object, desired, order)		\
+	__sync_swap(&(object)->__val, desired)
+#else
+/*
+ * __sync_lock_test_and_set() is only an acquire barrier in theory (although in
+ * practice it is usually a full barrier) so we need an explicit barrier after
+ * it.
+ */
+#define	atomic_exchange_explicit(object, desired, order) ({		\
+	__typeof__((object)->__val) __v;				\
+	__v = __sync_lock_test_and_set(&(object)->__val, desired);	\
+	__sync_synchronize();						\
+	__v;								\
+})
+#endif
+#define	atomic_fetch_add_explicit(object, operand, order)		\
+	__sync_fetch_and_add(&(object)->__val, operand)
+#define	atomic_fetch_and_explicit(object, operand, order)		\
+	__sync_fetch_and_and(&(object)->__val, operand)
+#define	atomic_fetch_or_explicit(object, operand, order)		\
+	__sync_fetch_and_or(&(object)->__val, operand)
+#define	atomic_fetch_sub_explicit(object, operand, order)		\
+	__sync_fetch_and_sub(&(object)->__val, operand)
+#define	atomic_fetch_xor_explicit(object, operand, order)		\
+	__sync_fetch_and_xor(&(object)->__val, operand)
+#define	atomic_load_explicit(object, order)				\
+	__sync_fetch_and_add(&(object)->__val, 0)
+#define	atomic_store_explicit(object, desired, order) do {		\
+	__sync_synchronize();						\
+	(object)->__val = (desired);					\
+	__sync_synchronize();						\
+} while (0)
+#endif
+
+/*
+ * Convenience functions.
+ */
+
+#define	atomic_compare_exchange_strong(object, expected, desired)	\
+	atomic_compare_exchange_strong_explicit(object, expected,	\
+	    desired, memory_order_seq_cst, memory_order_seq_cst)
+#define	atomic_compare_exchange_weak(object, expected, desired)		\
+	atomic_compare_exchange_weak_explicit(object, expected,		\
+	    desired, memory_order_seq_cst, memory_order_seq_cst)
+#define	atomic_exchange(object, desired)				\
+	atomic_exchange_explicit(object, desired, memory_order_seq_cst)
+#define	atomic_fetch_add(object, operand)				\
+	atomic_fetch_add_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_and(object, operand)				\
+	atomic_fetch_and_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_or(object, operand)				\
+	atomic_fetch_or_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_sub(object, operand)				\
+	atomic_fetch_sub_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_xor(object, operand)				\
+	atomic_fetch_xor_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_load(object)						\
+	atomic_load_explicit(object, memory_order_seq_cst)
+#define	atomic_store(object, desired)					\
+	atomic_store_explicit(object, desired, memory_order_seq_cst)
+
+/*
+ * 7.17.8 Atomic flag type and operations.
+ */
+
+typedef atomic_bool			atomic_flag;
+
+#define	ATOMIC_FLAG_INIT		ATOMIC_VAR_INIT(0)
+
+#define	atomic_flag_clear_explicit(object, order)			\
+	atomic_store_explicit(object, 0, order)
+#define	atomic_flag_test_and_set_explicit(object, order)		\
+	atomic_compare_exchange_strong_explicit(object, 0, 1, order, order)
+
+#define	atomic_flag_clear(object)					\
+	atomic_flag_clear_explicit(object, memory_order_seq_cst)
+#define	atomic_flag_test_and_set(object)				\
+	atomic_flag_test_and_set_explicit(object, memory_order_seq_cst)
diff --git a/src/include/sysutmp.h b/src/include/sysutmp.h
new file mode 100644
index 0000000..13a47b5
--- /dev/null
+++ b/src/include/sysutmp.h
@@ -0,0 +1,108 @@
+/*
+ * sysutmp.h	Compatibility stuff for the different UTMP systems.
+ *
+ * Version:	$Id$
+ */
+
+#ifndef SYSUTMP_H_INCLUDED
+#define SYSUTMP_H_INCLUDED
+
+RCSIDH(sysutmp_h, "$Id$")
+
+/*
+ *  If we have BOTH utmp.h and utmpx.h, then
+ *  we prefer to use utmp.h, but only on systems other than Solaris.
+ */
+#if !defined(__sun) && !defined(sgi) && !defined(hpux)
+#  ifdef HAVE_UTMP_H
+#    undef HAVE_UTMPX_H
+#  endif
+#endif
+
+#if defined(HAVE_UTMP_H) || defined(HAVE_UTMPX_H)
+
+/* UTMP stuff. Uses utmpx on svr4 */
+#ifdef HAVE_UTMPX_H
+#  include <utmpx.h>
+#  include <sys/fcntl.h>
+#  define utmp utmpx
+#  define UT_NAMESIZE	32
+#  define UT_LINESIZE	32
+#  define UT_HOSTSIZE	257
+#if defined(hpux) || defined(__FreeBSD__)
+#  define ut_name ut_user
+#endif
+#else
+#  include <utmp.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef __osf__
+#  define UT_NAMESIZE	32
+#  define UT_LINESIZE	32
+#  define UT_HOSTSIZE	64
+#endif
+
+#if (defined(__FreeBSD__) && !defined(HAVE_UTMPX_H)) || defined(__NetBSD__) || defined(bsdi) || defined(__OpenBSD__) || defined(__APPLE__)
+#  ifndef UTMP_FILE
+#    define UTMP_FILE "/var/run/utmp"
+#  endif
+#  define ut_user ut_name
+#endif
+
+/*
+ *	Generate definitions for systems which are too broken to
+ *	do it themselves.
+ *
+ *	Hmm... this means that we can probably get rid of a lot of
+ *	the static defines above, as the following lines will generate
+ *	the proper defines for any system.
+ */
+#ifndef UT_LINESIZE
+#define UT_LINESIZE sizeof(((struct utmp *) NULL)->ut_line)
+#endif
+
+#ifndef UT_NAMESIZE
+#define UT_NAMESIZE sizeof(((struct utmp *) NULL)->ut_user)
+#endif
+
+#ifndef UT_HOSTSIZE
+#define UT_HOSTSIZE sizeof(((struct utmp *) NULL)->ut_host)
+#endif
+
+#else /* HAVE_UTMP_H */
+
+/*
+ *	No <utmp.h> file - define stuff ourselves (minimally).
+ */
+#define UT_LINESIZE	16
+#define UT_NAMESIZE	16
+#define UT_HOSTSIZE	16
+
+#define USER_PROCESS	7
+#define DEAD_PROCESS	8
+
+#define UTMP_FILE	"/var/run/utmp"
+#define ut_name		ut_user
+
+struct utmp {
+	short	ut_type;
+	int	ut_pid;
+	char	ut_line[UT_LINESIZE];
+	char	ut_id[4];
+	long	ut_time;
+	char	ut_user[UT_NAMESIZE];
+	char	ut_host[UT_HOSTSIZE];
+	long	ut_addr;
+};
+
+#endif /* HAVE_UTMP_H */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SYSUTMP_H_INCLUDED */
diff --git a/src/include/talloc.h b/src/include/talloc.h
new file mode 100644
index 0000000..b9e6abd
--- /dev/null
+++ b/src/include/talloc.h
@@ -0,0 +1,51 @@
+#pragma once
+/*
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/** Functions which we wish were included in the standard talloc distribution
+ *
+ * @file src/lib/util/talloc.h
+ *
+ * @copyright 2017 The FreeRADIUS server project
+ * @copyright 2017 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
+ */
+RCSIDH(talloc_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <ctype.h>
+#include <stdbool.h>
+#include <stdint.h>
+
+#ifdef HAVE_WDOCUMENTATION
+DIAG_OFF(documentation)
+#endif
+#include <talloc.h>
+#ifdef HAVE_WDOCUMENTATION
+DIAG_ON(documentation)
+#endif
+
+#include <freeradius-devel/autoconf.h>	/* Very easy to miss including in special builds */
+#include <freeradius-devel/build.h>
+#include <freeradius-devel/missing.h>
+
+TALLOC_CTX	*talloc_aligned_array(TALLOC_CTX *ctx, void **start, size_t alignment, size_t size);
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/src/include/tcp.h b/src/include/tcp.h
new file mode 100644
index 0000000..624560e
--- /dev/null
+++ b/src/include/tcp.h
@@ -0,0 +1,31 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_TCP_H
+#define FR_TCP_H
+/**
+ * $Id$
+ *
+ * @file tcp.h
+ * @brief RADIUS over TCP
+ *
+ * @copyright 2009 Dante http://dante.net
+ */
+
+RCSIDH(tcp_h, "$Id$")
+
+int fr_tcp_read_packet(RADIUS_PACKET *packet, int flags);
+RADIUS_PACKET *fr_tcp_recv(int sockfd, int flags);
+#endif /* FR_TCP_H */
diff --git a/src/include/threads.h b/src/include/threads.h
new file mode 100644
index 0000000..f2aea77
--- /dev/null
+++ b/src/include/threads.h
@@ -0,0 +1,119 @@
+#ifndef FR_THREADS_H
+#define FR_THREADS_H
+/*
+ *   This library is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU Lesser General Public
+ *   License as published by the Free Software Foundation; either
+ *   version 2.1 of the License, or (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ *   Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public
+ *   License along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ *
+ * @file threads.h
+ * @brief Macros to abstract Thread Local Storage
+ *
+ * @copyright 2013  The FreeRADIUS server project
+ */
+typedef void (*pthread_destructor_t)(void*);
+
+#if !defined(HAVE_PTHREAD_H) && defined(WITH_THREADS)
+#  error WITH_THREADS defined, but pthreads not available
+#endif
+
+/*
+ *	First figure whether we have compiler support this is usually the case except on OSX,
+ *	where we need to use pthreads.
+ */
+#ifdef TLS_STORAGE_CLASS
+#  define __THREAD TLS_STORAGE_CLASS
+#endif
+
+/*
+ *	Now we define three macros for initialisation, updating, and retrieving
+ */
+#ifndef WITH_THREADS
+#  define fr_thread_local_setup(_t, _n)	static _t _n;\
+static inline int __fr_thread_local_destructor_##_n(pthread_destructor_t *ctx)\
+{\
+	pthread_destructor_t func = *ctx;\
+	func(_n);\
+	return 0;\
+}\
+DIAG_OFF(deprecated-declarations) \
+static inline _t __fr_thread_local_init_##_n(pthread_destructor_t func)\
+{\
+	static pthread_destructor_t *ctx;\
+	if (!ctx) {\
+		ctx = talloc(talloc_autofree_context(), pthread_destructor_t);\
+		talloc_set_destructor(ctx, __fr_thread_local_destructor_##_n);\
+		*ctx = func;\
+	}\
+	return _n;\
+} \
+DIAG_ON(deprecated-declarations)
+
+#  define fr_thread_local_init(_n, _f) __fr_thread_local_init_##_n(_f)
+#  define fr_thread_local_set(_n, _v) ((int)!((_n = _v) || 1))
+#  define fr_thread_local_get(_n) _n
+#elif defined(__THREAD)
+#  include <pthread.h>
+#  define fr_thread_local_setup(_t, _n) static __THREAD _t _n;\
+static pthread_key_t __fr_thread_local_key_##_n;\
+static pthread_once_t __fr_thread_local_once_##_n = PTHREAD_ONCE_INIT;\
+static pthread_destructor_t __fr_thread_local_destructor_##_n = NULL;\
+static void __fr_thread_local_destroy_##_n(UNUSED void *unused)\
+{\
+	__fr_thread_local_destructor_##_n(_n);\
+}\
+static void __fr_thread_local_key_init_##_n(void)\
+{\
+	(void) pthread_key_create(&__fr_thread_local_key_##_n, __fr_thread_local_destroy_##_n);\
+}\
+static _t __fr_thread_local_init_##_n(pthread_destructor_t func)\
+{\
+	__fr_thread_local_destructor_##_n = func;\
+	if (_n) return _n; \
+	(void) pthread_once(&__fr_thread_local_once_##_n, __fr_thread_local_key_init_##_n);\
+	(void) pthread_setspecific(__fr_thread_local_key_##_n, &(_n));\
+	return _n;\
+}
+#  define fr_thread_local_init(_n, _f)	__fr_thread_local_init_##_n(_f)
+#  define fr_thread_local_set(_n, _v) ((int)!((_n = _v) || 1))
+#  define fr_thread_local_get(_n) _n
+#elif defined(HAVE_PTHREAD_H)
+#  include <pthread.h>
+#  define fr_thread_local_setup(_t, _n) \
+static pthread_key_t __fr_thread_local_key_##_n;\
+static pthread_once_t __fr_thread_local_once_##_n = PTHREAD_ONCE_INIT;\
+static pthread_destructor_t __fr_thread_local_destructor_##_n = NULL;\
+static void __fr_thread_local_destroy_##_n(UNUSED void *unused)\
+{\
+	__fr_thread_local_destructor_##_n(_n);\
+}\
+static void __fr_thread_local_key_init_##_n(void)\
+{\
+	(void) pthread_key_create(&__fr_thread_local_key_##_n, __fr_thread_local_destroy_##_n);\
+	(void) pthread_setspecific(__fr_thread_local_key_##_n, &(_n));\
+}\
+static _t __fr_thread_local_init_##_n(pthread_destructor_t func)\
+{\
+	__fr_thread_local_destructor_##_n = func;\
+	if (_n) return _n; \
+	(void) pthread_once(&__fr_thread_local_once_##_n, __fr_thread_local_key_init_##_n);\
+	return _n;\
+}
+#  define fr_thread_local_init(_n, _f)			__fr_thread_local_init_##_n(_f)
+#  define fr_thread_local_set(_n, _v)			__fr_thread_local_set_##_n(_v)
+#  define fr_thread_local_get(_n)			__fr_thread_local_get_##_n()
+#endif
+#endif
diff --git a/src/include/tls-h b/src/include/tls-h
new file mode 100644
index 0000000..4bf1665
--- /dev/null
+++ b/src/include/tls-h
@@ -0,0 +1,453 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_TLS_H
+#define FR_TLS_H
+
+#ifdef WITH_TLS
+/**
+ * $Id$
+ *
+ * @file tls.h
+ * @brief Structures and prototypes for TLS wrappers
+ *
+ * @copyright 2010 Network RADIUS SARL <info@networkradius.com>
+ */
+
+RCSIDH(tls_h, "$Id$")
+
+#include <freeradius-devel/conffile.h>
+
+/*
+ *	For RH 9, which apparently needs this.
+ */
+#ifndef OPENSSL_NO_KRB5
+#  define OPENSSL_NO_KRB5
+#endif
+#include <openssl/err.h>
+#ifdef HAVE_OPENSSL_ENGINE_H
+#  include <openssl/engine.h>
+#endif
+#include <openssl/ssl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct fr_tls_server_conf_t fr_tls_server_conf_t;
+
+typedef enum {
+	FR_TLS_INVALID = 0,	  		//!< Invalid, don't reply.
+	FR_TLS_REQUEST,       			//!< Request, ok to send, invalid to receive.
+	FR_TLS_RESPONSE,       			//!< Response, ok to receive, invalid to send.
+	FR_TLS_SUCCESS,       			//!< Success, send success.
+	FR_TLS_FAIL,       			//!< Fail, send fail.
+	FR_TLS_NOOP,       			//!< Noop, continue.
+
+	FR_TLS_START,       			//!< Start, ok to send, invalid to receive.
+	FR_TLS_OK, 		 		//!< Ok, continue.
+	FR_TLS_ACK,       			//!< Acknowledge, continue.
+	FR_TLS_FIRST_FRAGMENT,    		//!< First fragment.
+	FR_TLS_MORE_FRAGMENTS,    		//!< More fragments, to send/receive.
+	FR_TLS_LENGTH_INCLUDED,	  		//!< Length included.
+	FR_TLS_MORE_FRAGMENTS_WITH_LENGTH,   	//!< More fragments with length.
+	FR_TLS_HANDLED	  			//!< TLS code has handled it.
+} fr_tls_status_t;
+extern FR_NAME_NUMBER const fr_tls_status_table[];
+
+#define MAX_RECORD_SIZE 65536
+
+/*
+ *	A single TLS record may be up to 16384 octets in length, but a
+ *	TLS message may span multiple TLS records, and a TLS
+ *	certificate message may in principle be as long as 16MB.
+ *
+ *	However, note that in order to protect against reassembly
+ *	lockup and denial of service attacks, it may be desirable for
+ *	an implementation to set a maximum size for one such group of
+ *	TLS messages.
+ *
+ *	The TLS Message Length field is four octets, and provides the
+ *	total length of the TLS message or set of messages that is
+ *	being fragmented; this simplifies buffer allocation.
+ */
+
+/*
+ * FIXME: Dynamic allocation of buffer to overcome MAX_RECORD_SIZE overflows.
+ * 	or configure TLS not to exceed MAX_RECORD_SIZE.
+ */
+typedef struct _record_t {
+	size_t  used;
+	uint8_t data[MAX_RECORD_SIZE];
+} record_t;
+
+typedef struct _tls_info_t {
+	int		origin;		// 0 - received (from peer), 1 - sending (to peer)
+	int		content_type;
+	uint8_t		handshake_type;
+	uint8_t		alert_level;
+	uint8_t		alert_description;
+	bool		initialized;
+
+	char 		info_description[256];
+	size_t		record_len;
+} tls_info_t;
+
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#define ssl_session ssl->session
+#else
+#define ssl_session session
+#endif
+
+/** Contains EAP-REQUEST specific data (ie FR_TLS_DATA(fragment), EAPTLS-ALERT, EAPTLS-REQUEST ...)
+ *
+ * The tls_session_t Structure gets stored as opaque in eap_handler_t
+ */
+typedef struct _tls_session_t {
+	SSL_CTX		*ctx;
+	SSL 		*ssl;
+#if OPENSSL_VERSION_NUMBER >= 0x10001000L
+	SSL_SESSION	*session;
+#endif
+	tls_info_t	info;
+
+	BIO 		*into_ssl;
+	BIO 		*from_ssl;
+	record_t 	clean_in;			//!< Data that needs to be sent but only after it is soiled.
+	record_t 	clean_out;			//!< Data that is cleaned after receiving.
+	record_t 	dirty_in;			//!< Data EAP server receives.
+	record_t 	dirty_out;			//!< Data EAP server sends.
+
+	void 		(*record_init)(record_t *buf);
+	void 		(*record_close)(record_t *buf);
+	unsigned int 	(*record_plus)(record_t *buf, void const *ptr, unsigned int size);
+	unsigned int 	(*record_minus)(record_t *buf, void *ptr, unsigned int size);
+
+	bool		invalid_hb_used;		//!< Whether heartbleed attack was detected.
+	bool		connected;			//!< whether the outgoing socket is connected
+	bool		is_init_finished;		//!< whether or not init is finished
+	bool		client_cert_ok;			//!< whether or not we validated the client certificate
+	bool		authentication_success;		//!< whether or not the user was authenticated (cert or PW)
+	bool		quick_session_tickets;		//!< for EAP-TLS.
+
+	/*
+	 *	Framed-MTU attribute in RADIUS, if present, can also be used to set this
+	 */
+	size_t 		mtu;				//!< Current fragment size transmitted.
+	size_t		tls_msg_len;			//!< Actual/Total TLS message length.
+	bool		fragment;			//!< Flag, In fragment mode or not.
+	bool		length_flag;			//!< A flag to include length in every TLS Data/Alert packet.
+							//!< If set to no then only the first fragment contains length.
+	int		peap_flag;
+
+	size_t		tls_record_in_total_len;	//!< How long the peer indicated the complete tls record
+							//!< would be.
+	size_t		tls_record_in_recvd_len;	//!< How much of the record we've received so far.
+
+	/*
+	 *	Used by TTLS & PEAP to keep track of other per-session data.
+	 */
+	void 		*opaque;
+	void 		(*free_opaque)(void *opaque);
+
+	char const	*label;
+	bool		allow_session_resumption;	//!< Whether session resumption is allowed.
+	bool		session_not_resumed;		//!< Whether our session was not resumed.
+
+	fr_tls_server_conf_t const *conf;		//! for better complaints
+} tls_session_t;
+
+/*
+ *	RFC 2716, Section 4.2:
+ *
+ *	   Flags
+ *
+ *      0 1 2 3 4 5 6 7 8
+ *      +-+-+-+-+-+-+-+-+
+ *      |L M S R R R R R|
+ *      +-+-+-+-+-+-+-+-+
+ *
+ *      L = Length included
+ *      M = More fragments
+ *      S = EAP-TLS start
+ *      R = Reserved
+ */
+#define TLS_START(x) 		(((x) & 0x20) != 0)
+#define TLS_MORE_FRAGMENTS(x) 	(((x) & 0x40) != 0)
+#define TLS_LENGTH_INCLUDED(x) 	(((x) & 0x80) != 0)
+
+#define TLS_CHANGE_CIPHER_SPEC(x) 	(((x) & 0x0014) == 0x0014)
+#define TLS_ALERT(x) 			(((x) & 0x0015) == 0x0015)
+#define TLS_HANDSHAKE(x) 		(((x) & 0x0016) == 0x0016)
+
+#define SET_START(x) 		((x) | (0x20))
+#define SET_MORE_FRAGMENTS(x) 	((x) | (0x40))
+#define SET_LENGTH_INCLUDED(x) 	((x) | (0x80))
+
+/*
+ *	Following enums from rfc2246
+ *
+ *	Hmm... since we dpeend on OpenSSL, it would be smarter to
+ *	use the OpenSSL names for these.
+ */
+enum ContentType {
+	change_cipher_spec = 20,
+	alert = 21,
+	handshake = 22,
+	application_data = 23
+};
+
+enum AlertLevel {
+	warning = 1,
+	fatal = 2
+};
+
+enum AlertDescription {
+	close_notify = 0,
+	unexpected_message = 10,
+	bad_record_mac = 20,
+	decryption_failed = 21,
+	record_overflow = 22,
+	decompression_failure = 30,
+	handshake_failure = 40,
+	bad_certificate = 42,
+	unsupported_certificate = 43,
+	certificate_revoked = 44,
+	certificate_expired = 45,
+	certificate_unknown = 46,
+	illegal_parameter = 47,
+	unknown_ca = 48,
+	access_denied = 49,
+	decode_error = 50,
+	decrypt_error = 51,
+	export_restriction = 60,
+	protocol_version = 70,
+	insufficient_security = 71,
+	internal_error = 80,
+	user_canceled = 90,
+	no_renegotiation = 100
+};
+
+enum HandshakeType {
+	hello_request = 0,
+	client_hello = 1,
+	server_hello = 2,
+	certificate = 11,
+	server_key_exchange  = 12,
+	certificate_request = 13,
+	server_hello_done = 14,
+	certificate_verify = 15,
+	client_key_exchange = 16,
+	handshake_finished = 20
+};
+
+
+/*
+ * From rfc
+   Flags
+
+      0 1 2 3 4 5 6 7 8
+      +-+-+-+-+-+-+-+-+
+      |L M S R R R R R|
+      +-+-+-+-+-+-+-+-+
+
+      L = Length included
+      M = More fragments
+      S = EAP-TLS start
+      R = Reserved
+
+      The L bit (length included) is set to indicate the presence of the
+      four octet TLS Message Length field, and MUST be set for the first
+      fragment of a fragmented TLS message or set of messages. The M bit
+      (more fragments) is set on all but the last fragment. The S bit
+      (EAP-TLS start) is set in an EAP-TLS Start message.  This
+      differentiates the EAP-TLS Start message from a fragment
+      acknowledgement.
+
+   TLS Message Length
+
+      The TLS Message Length field is four octets, and is present only
+      if the L bit is set. This field provides the total length of the
+      TLS message or set of messages that is being fragmented.
+
+   TLS data
+
+      The TLS data consists of the encapsulated TLS packet in TLS record
+      format.
+ *
+ * The data structures present here
+ * maps only to the typedata in the EAP packet
+ *
+ * Based on the L bit flag, first 4 bytes of data indicate the length
+ */
+
+/* Callbacks */
+int 		cbtls_password(char *buf, int num, int rwflag, void *userdata);
+void 		cbtls_info(SSL const *s, int where, int ret);
+void 		cbtls_msg(int write_p, int msg_version, int content_type, void const *buf, size_t len, SSL *ssl,
+			  void *arg);
+int		cbtls_verify(int ok, X509_STORE_CTX *ctx);
+
+/* threads.c */
+int		tls_mutexes_init(void);
+
+/* TLS */
+int		tls_global_init(bool spawn_flag, bool check);
+#ifdef ENABLE_OPENSSL_VERSION_CHECK
+int		tls_global_version_check(char const *acknowledged);
+#endif
+
+int		tls_error_log(REQUEST *request, char const *msg, ...) CC_HINT(format (printf, 2, 3));
+int		tls_error_io_log(REQUEST *request, tls_session_t *session, int ret, char const *msg, ...)
+				 CC_HINT(format (printf, 4, 5));
+
+void		tls_global_cleanup(void);
+tls_session_t	*tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQUEST *request, bool client_cert, bool allow_tls13);
+tls_session_t	*tls_new_client_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, int fd, VALUE_PAIR **certs);
+fr_tls_server_conf_t *tls_server_conf_parse(CONF_SECTION *cs);
+fr_tls_server_conf_t *tls_client_conf_parse(CONF_SECTION *cs);
+fr_tls_server_conf_t *tls_server_conf_alloc(TALLOC_CTX *ctx);
+SSL_CTX		*tls_init_ctx(fr_tls_server_conf_t *conf, int client, char const *chain_file, char const *private_key_file);
+int 		tls_handshake_recv(REQUEST *, tls_session_t *ssn);
+int 		tls_handshake_send(REQUEST *, tls_session_t *ssn);
+void 		tls_session_information(tls_session_t *ssn);
+void		tls_session_id(SSL_SESSION *ssn, char *buffer, size_t bufsize);
+X509_STORE	*fr_init_x509_store(fr_tls_server_conf_t *conf);
+
+/*
+ *	Low-level TLS stuff
+ */
+int tls_success(tls_session_t *ssn, REQUEST *request);
+void tls_fail(tls_session_t *ssn);
+fr_tls_status_t tls_ack_handler(tls_session_t *tls_session, REQUEST *request);
+fr_tls_status_t tls_application_data(tls_session_t *ssn, REQUEST *request);
+
+#define FR_TLS_EX_INDEX_HANDLER  (10)
+#define FR_TLS_EX_INDEX_CONF	 (11)
+#define FR_TLS_EX_INDEX_REQUEST	 (12)
+#define FR_TLS_EX_INDEX_IDENTITY (13)
+#define FR_TLS_EX_INDEX_STORE	 (14)
+#define FR_TLS_EX_INDEX_SSN	 (15)
+#define FR_TLS_EX_INDEX_TALLOC	 (16)
+#define FR_TLS_EX_INDEX_FIX_CERT_ORDER (17)
+
+extern int fr_tls_ex_index_certs;
+extern int fr_tls_ex_index_vps;
+
+/* configured values goes right here */
+struct fr_tls_server_conf_t {
+	SSL_CTX		*ctx;
+	CONF_SECTION	*cs;
+
+	char const	*private_key_password;
+	char const	*private_key_file;
+	char const	*certificate_file;
+	char const	*random_file;
+	char const	*ca_path;
+	char const	*ca_file;
+	char const	*dh_file;
+	char const	*rsa_file;
+	uint32_t	verify_depth;
+	bool		file_type;
+	bool		include_length;
+	bool		auto_chain;
+	bool		disable_single_dh_use;
+	bool		disable_tlsv1;
+	bool		disable_tlsv1_1;
+	bool		disable_tlsv1_2;
+	bool		disallow_untrusted;		//!< allow untrusted CAs to issue client certificates
+
+	int		min_version;
+	int		max_version;
+
+	char const	*tls_min_version;
+	char const	*tls_max_version;
+
+	/*
+	 *	Always < 4096 (due to radius limit), 0 by default = 1024
+	 */
+	uint32_t	fragment_size;
+	bool		check_crl;
+	bool		check_all_crl;
+	bool		allow_expired_crl;
+	uint32_t	ca_path_reload_interval;
+	uint32_t	ca_path_last_reload;
+	X509_STORE	*old_x509_store;
+	char const	*check_cert_cn;
+	char const	*cipher_list;
+	bool		cipher_server_preference;
+	char const	*check_cert_issuer;
+	char const	*sigalgs_list;
+
+	bool     	session_cache_enable;
+	uint32_t     	session_lifetime;
+	uint32_t     	session_cache_size;
+	char const	*session_id_name;
+	char const	*session_cache_path;
+	char const	*session_cache_server;
+	fr_hash_table_t *cache_ht;
+	char		session_context_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
+
+	bool		verify_skip_if_ocsp_ok;
+	char const	*verify_tmp_dir;
+	char const	*verify_client_cert_cmd;
+	bool		require_client_cert;
+
+	bool		fix_cert_order;
+
+	pthread_mutex_t	mutex;
+
+#ifdef HAVE_OPENSSL_OCSP_H
+	/*
+	 * OCSP Configuration
+	 */
+	bool		ocsp_enable;
+	bool		ocsp_override_url;
+	char const	*ocsp_url;
+	bool		ocsp_use_nonce;
+	X509_STORE	*ocsp_store;
+	uint32_t	ocsp_timeout;
+	bool		ocsp_softfail;
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
+#ifndef OPENSSL_NO_ECDH
+	char const	*ecdh_curve;
+#endif
+#endif
+
+#ifdef PSK_MAX_IDENTITY_LEN
+	char const	*psk_identity;
+	char const	*psk_password;
+	char const	*psk_query;
+#endif
+
+	char const	*realm_dir;
+	fr_hash_table_t	*realms;
+
+	char const	*client_hostname;
+
+#ifdef WITH_RADIUSV11
+       char const	*radiusv11_name;
+       fr_radiusv11_t	radiusv11;
+#endif
+};
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* WITH_TLS */
+#endif /* FR_TLS_H */
diff --git a/src/include/tmpl.h b/src/include/tmpl.h
new file mode 100644
index 0000000..92884b1
--- /dev/null
+++ b/src/include/tmpl.h
@@ -0,0 +1,345 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef TMPL_H
+#define TMPL_H
+/**
+ * $Id$
+ *
+ * @file tmpl.h
+ * @brief Structures and prototypes for templates
+ *
+ * These functions are used to work with #vp_tmpl_t structs.
+ *
+ * #vp_tmpl_t (VPTs) specify either a data source, or a data sink.
+ *
+ * Examples of sources are #TMPL_TYPE_XLAT, #TMPL_TYPE_EXEC and #TMPL_TYPE_ATTR.
+ * Examples of sinks are #TMPL_TYPE_ATTR, #TMPL_TYPE_LIST.
+ *
+ * VPTs are used to gather values or attributes for evaluation, or copying, and to specify
+ * where values or #VALUE_PAIR should be copied to.
+ *
+ * To create new #vp_tmpl_t use one of the tmpl_*from_* functions.  These parse
+ * strings into VPTs. The main parsing function is #tmpl_afrom_str, which can produce
+ * most types of VPTs. It uses the type of quoting (passed as an #FR_TOKEN) to determine
+ * what type of VPT to parse the string as. For example a #T_DOUBLE_QUOTED_STRING will
+ * produce either a #TMPL_TYPE_XLAT or a #TMPL_TYPE_LITERAL (depending if the string
+ * contained a non-literal expansion).
+ *
+ * @see tmpl_afrom_str
+ * @see tmpl_afrom_attr_str
+ * @see tmpl_from_attr_str
+ * @see tmpl_from_attr_substr
+ *
+ * In the case of #TMPL_TYPE_ATTR and #TMPL_TYPE_LIST, there are special cursor overlay
+ * functions which can be used to iterate over only the #VALUE_PAIR that match a
+ * vp_tmpl_t in a given list.
+ *
+ * @see tmpl_cursor_init
+ * @see tmpl_cursor_next
+ *
+ * Or for simplicity, there are functions which wrap the cursor functions, to copy or
+ * return the #VALUE_PAIR that match the VPT.
+ *
+ * @see tmpl_copy_vps
+ * @see tmpl_find_vp
+ *
+ * If you just need the string value of whatever the VPT refers to, the tmpl_*expand
+ * functions may be used. These functions evaluate the VPT, execing, and xlat expanding
+ * as necessary. In the case of #TMPL_TYPE_ATTR, and #PW_TYPE_STRING or #PW_TYPE_OCTETS
+ * #tmpl_expand will return a pointer to the raw #VALUE_PAIR buffer. This can be very
+ * useful when using the #PW_TYPE_TMPL type in #CONF_PARSER structs, as it allows the
+ * user to determine whether they want the module to sanitise the value using presentation
+ * format specific #xlat_escape_t function, or to operate on the raw value.
+ *
+ * @see tmpl_expand
+ * @see tmpl_aexpand
+ *
+ * @copyright 2014-2015 The FreeRADIUS server project
+ */
+
+RCSIDH(tmpl_h, "$Id$")
+
+#include <freeradius-devel/xlat.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+#
+typedef enum pair_lists {
+	PAIR_LIST_UNKNOWN = 0,		//!< Unknown list.
+	PAIR_LIST_REQUEST,		//!< Attributes in incoming or internally proxied
+					///< request.
+	PAIR_LIST_REPLY,		//!< Attributes to send in the response.
+	PAIR_LIST_CONTROL,		//!< Attributes that change the behaviour of
+					///< modules.
+	PAIR_LIST_STATE,		//!< Attributes to store multiple rounds of
+					///< challenges/responses.
+#ifdef WITH_PROXY
+	PAIR_LIST_PROXY_REQUEST,	//!< A copy of attributes in the request list
+					///< that may be modified in pre-proxy before
+					//!< proxying the request.
+	PAIR_LIST_PROXY_REPLY,		//!< Attributes sent in response to the proxied
+					///< request.
+#endif
+#ifdef WITH_COA
+	PAIR_LIST_COA,			//!< Attributes to send in a forked CoA-Request.
+	PAIR_LIST_COA_REPLY,		//!< Attributes sent in response to the forked
+					///< CoA-Request.
+	PAIR_LIST_DM,			//!< Attributes to send in a forked Disconnect-Request.
+	PAIR_LIST_DM_REPLY		//!< Attributes sent in response to the forked
+					//!< Disconnect-Request.
+#endif
+} pair_lists_t;
+
+extern const FR_NAME_NUMBER pair_lists[];
+
+typedef enum requests {
+	REQUEST_UNKNOWN = 0,		//!< Unknown request.
+	REQUEST_OUTER,			//!< #REQUEST containing the outer layer of the EAP
+					//!< conversation. Usually the RADIUS request sent
+					//!< by the NAS.
+	REQUEST_CURRENT,		//!< The current request.
+	REQUEST_PARENT			//!< Not currently used.
+} request_refs_t;
+
+extern const FR_NAME_NUMBER request_refs[];
+
+typedef struct pair_list {
+	char const		*name;
+	VALUE_PAIR		*check;
+	VALUE_PAIR		*reply;
+	int			order;		/* for ordering! */
+	int			lineno;
+	struct pair_list	*next;
+} PAIR_LIST;
+
+/** Types of #vp_tmpl_t
+ */
+typedef enum tmpl_type {
+	TMPL_TYPE_UNKNOWN = 0,		//!< Uninitialised.
+	TMPL_TYPE_LITERAL,		//!< Literal string.
+	TMPL_TYPE_XLAT,			//!< XLAT expansion.
+	TMPL_TYPE_ATTR,			//!< Dictionary attribute.
+	TMPL_TYPE_ATTR_UNDEFINED,	//!< Attribute not found in the global dictionary.
+	TMPL_TYPE_LIST,			//!< Attribute list.
+	TMPL_TYPE_REGEX,		//!< Regular expression.
+	TMPL_TYPE_EXEC,			//!< Callout to an external script or program.
+	TMPL_TYPE_DATA,			//!< Value in native format.
+	TMPL_TYPE_XLAT_STRUCT,	      	//!< Pre-parsed XLAT expansion.
+	TMPL_TYPE_REGEX_STRUCT,	      	//!< Pre-parsed regular expression.
+	TMPL_TYPE_NULL			//!< Has no value.
+} tmpl_type_t;
+
+extern const FR_NAME_NUMBER tmpl_names[];
+
+/** Describes a #TMPL_TYPE_ATTR, #TMPL_TYPE_ATTR_UNDEFINED or #TMPL_TYPE_LIST
+ */
+typedef struct {
+	request_refs_t		request;		//!< Request to search or insert in.
+	pair_lists_t		list;			//!< List to search or insert in.
+
+	DICT_ATTR const		*da;			//!< Resolved dictionary attribute.
+	union {
+		uint8_t			da[DICT_ATTR_SIZE];	//!< Unknown dictionary attribute buffer.
+		char			name[DICT_ATTR_SIZE];	//!< Raw unknown dictionary name.
+	} unknown;
+	int			num;			 //!< For array references.
+	int8_t			tag;			 //!< For tag references.
+} value_pair_tmpl_attr_t;
+
+/** A source or sink of value data.
+ *
+ * Is used as both the RHS and LHS of a map (both update, and conditional types)
+ *
+ * @section update_maps Use in update vp_map_t
+ * When used on the LHS it describes an attribute to create and should be one of these types:
+ * - #TMPL_TYPE_ATTR
+ * - #TMPL_TYPE_LIST
+ *
+ * When used on the RHS it describes the value to assign to the attribute being created and
+ * should be one of these types:
+ * - #TMPL_TYPE_LITERAL
+ * - #TMPL_TYPE_XLAT
+ * - #TMPL_TYPE_ATTR
+ * - #TMPL_TYPE_LIST
+ * - #TMPL_TYPE_EXEC
+ * - #TMPL_TYPE_DATA
+ * - #TMPL_TYPE_XLAT_STRUCT (pre-parsed xlat)
+ *
+ * @section conditional_maps Use in conditional vp_map_t
+ * When used as part of a condition it may be any of the RHS side types, as well as:
+ * - #TMPL_TYPE_REGEX_STRUCT (pre-parsed regex)
+ *
+ * @see vp_map_t
+ */
+typedef struct vp_tmpl_t {
+	tmpl_type_t	type;		//!< What type of value tmpl refers to.
+	char const	*name;		//!< Original attribute ref string, or
+					//!< where this refers to a none FR
+					//!< attribute, just the string id for
+					//!< the attribute.
+	size_t		len;		//!< Name length.
+	char		quote;		//!< Quotation character for "name"
+	bool		auto_converted; //!< Attr-26.9.1 --> Cisco-AVPair
+
+#ifdef HAVE_REGEX
+	bool		iflag;		//!< regex - case insensitive (if operand is used in regex comparison)
+	bool		mflag;		//!< regex - multiline flags (controls $ matching)
+#endif
+
+	union {
+		/*
+		 *  Attribute reference. Either an attribute currently in the request
+		 *  or an attribute to create.
+		 */
+		value_pair_tmpl_attr_t attribute;
+
+		/*
+		 *  Attribute value. Typically used as the RHS of an update map.
+		 */
+		struct {
+			PW_TYPE			type;			 //!< Type of data.
+			size_t			length;			 //!< of the vpd data.
+			value_data_t		data;			 //!< Value data.
+		} literal;
+
+		xlat_exp_t	*xlat;	 //!< pre-parsed xlat_exp_t
+
+#ifdef HAVE_REGEX
+		regex_t		*preg;	//!< pre-parsed regex_t
+#endif
+	} data;
+} vp_tmpl_t;
+
+/** @name Field accessors for #TMPL_TYPE_ATTR, #TMPL_TYPE_ATTR_UNDEFINED, #TMPL_TYPE_LIST
+ *
+ * @{
+ */
+#define tmpl_request		data.attribute.request
+#define tmpl_list		data.attribute.list
+#define tmpl_da			data.attribute.da
+#define tmpl_unknown		data.attribute.unknown.da
+#define tmpl_unknown_name      	data.attribute.unknown.name
+#define tmpl_num		data.attribute.num
+#define tmpl_tag		data.attribute.tag
+/* @} **/
+
+/** @name Field accessors for #TMPL_TYPE_XLAT_STRUCT
+ *
+ * @{
+ */
+#define tmpl_xlat		data.xlat
+/* @} **/
+
+/** @name Field accessors for #TMPL_TYPE_DATA
+ *
+ * @{
+ */
+#define tmpl_data		data.literal
+#define tmpl_data_type		data.literal.type
+#define tmpl_data_length	data.literal.length
+#define tmpl_data_value		data.literal.data
+/* @} **/
+
+/** @name Field accessors for #TMPL_TYPE_REGEX_STRUCT and #TMPL_TYPE_REGEX
+ *
+ * @{
+ */
+#ifdef HAVE_REGEX
+#  define tmpl_preg		data.preg	//!< #TMPL_TYPE_REGEX_STRUCT only.
+#  define tmpl_iflag		iflag
+#  define tmpl_mflag		mflag
+#endif
+/* @} **/
+
+#ifndef WITH_VERIFY_PTR
+#  define VERIFY_TMPL(_x)
+#else
+#  define VERIFY_TMPL(_x) tmpl_verify(__FILE__,  __LINE__, _x)
+void tmpl_verify(char const *file, int line, vp_tmpl_t const *vpt);
+#endif
+
+VALUE_PAIR		**radius_list(REQUEST *request, pair_lists_t list);
+
+RADIUS_PACKET		*radius_packet(REQUEST *request, pair_lists_t list_name);
+
+TALLOC_CTX		*radius_list_ctx(REQUEST *request, pair_lists_t list_name);
+
+size_t			radius_list_name(pair_lists_t *out, char const *name, pair_lists_t default_list);
+
+int			radius_request(REQUEST **request, request_refs_t name);
+
+size_t			radius_request_name(request_refs_t *out, char const *name, request_refs_t unknown);
+
+vp_tmpl_t		*tmpl_init(vp_tmpl_t *vpt, tmpl_type_t type,
+				   char const *name, ssize_t len);
+
+vp_tmpl_t		*tmpl_alloc(TALLOC_CTX *ctx, tmpl_type_t type, char const *name,
+				    ssize_t len);
+
+ssize_t			tmpl_from_attr_substr(vp_tmpl_t *vpt, char const *name,
+					      request_refs_t request_def, pair_lists_t list_def,
+					      bool allow_unknown, bool allow_undefined);
+
+ssize_t			tmpl_from_attr_str(vp_tmpl_t *vpt, char const *name,
+					   request_refs_t request_def,
+					   pair_lists_t list_def,
+					   bool allow_unknown, bool allow_undefined);
+
+ssize_t			tmpl_afrom_attr_substr(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *name,
+					       request_refs_t request_def, pair_lists_t list_def,
+					       bool allow_unknown, bool allow_undefined);
+
+ssize_t			tmpl_afrom_attr_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *name,
+					    request_refs_t request_def,
+					    pair_lists_t list_def,
+					    bool allow_unknown, bool allow_undefined);
+
+ssize_t			tmpl_afrom_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *name, size_t inlen,
+				       FR_TOKEN type, request_refs_t request_def, pair_lists_t list_def, bool do_escape);
+
+int			tmpl_cast_in_place(vp_tmpl_t *vpt, PW_TYPE type, DICT_ATTR const *enumv);
+
+void			tmpl_cast_in_place_str(vp_tmpl_t *vpt);
+
+int			tmpl_cast_to_vp(VALUE_PAIR **out, REQUEST *request,
+					vp_tmpl_t const *vpt, DICT_ATTR const *cast);
+
+size_t			tmpl_prints(char *buffer, size_t bufsize, vp_tmpl_t const *vpt,
+				    DICT_ATTR const *values);
+
+ssize_t			tmpl_expand(char const **out, char *buff, size_t outlen, REQUEST *request,
+				    vp_tmpl_t const *vpt, xlat_escape_t escape, void *escape_ctx);
+
+ssize_t			tmpl_aexpand(TALLOC_CTX *ctx, char **out, REQUEST *request, vp_tmpl_t const *vpt,
+				     xlat_escape_t escape, void *escape_ctx);
+
+VALUE_PAIR		*tmpl_cursor_init(int *err, vp_cursor_t *cursor, REQUEST *request,
+					  vp_tmpl_t const *vpt);
+
+VALUE_PAIR		*tmpl_cursor_next(vp_cursor_t *cursor, vp_tmpl_t const *vpt);
+
+int			tmpl_copy_vps(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request,
+				      vp_tmpl_t const *vpt);
+
+int			tmpl_find_vp(VALUE_PAIR **out, REQUEST *request, vp_tmpl_t const *vpt);
+
+int			tmpl_define_unknown_attr(vp_tmpl_t *vpt);
+
+#ifdef __cplusplus
+}
+#endif
+#endif	/* TMPL_H */
diff --git a/src/include/token.h b/src/include/token.h
new file mode 100644
index 0000000..c8bb748
--- /dev/null
+++ b/src/include/token.h
@@ -0,0 +1,95 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef FR_TOKEN_H
+#define FR_TOKEN_H
+
+/**
+ * $Id$
+ *
+ * @file token.h
+ * @brief Tokenisation code and constants.
+ *
+ * @copyright 2001,2006  The FreeRADIUS server project
+ */
+
+RCSIDH(token_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum fr_token_t {
+	T_INVALID = 0,			/* invalid token */
+	T_EOL,				/* end of line */
+	T_LCBRACE,			/* { */
+	T_RCBRACE,			/* } */
+	T_LBRACE,			/* ( */
+	T_RBRACE,			/* ) 		 5 */
+	T_COMMA,			/* , */
+	T_SEMICOLON,			/* ; */
+
+	T_OP_INCRM,			/* ++ */
+	T_OP_ADD,			/* += */
+	T_OP_SUB,			/* -=  		10 */
+	T_OP_SET,			/* := */
+	T_OP_EQ,			/* = */
+	T_OP_NE,			/* != */
+	T_OP_GE,			/* >= */
+	T_OP_GT,			/* > 		15 */
+	T_OP_LE,			/* <= */
+	T_OP_LT,			/* < */
+	T_OP_REG_EQ,			/* =~ */
+	T_OP_REG_NE,			/* !~ */
+	T_OP_CMP_TRUE,			/* =* 		20 */
+	T_OP_CMP_FALSE,			/* !* */
+	T_OP_CMP_EQ,			/* == */
+	T_OP_PREPEND,			/* ^= */
+	T_HASH,				/* # */
+	T_BARE_WORD,			/* bare word    25 */
+	T_DOUBLE_QUOTED_STRING,		/* "foo" */
+	T_SINGLE_QUOTED_STRING,		/* 'foo' */
+	T_BACK_QUOTED_STRING,		/* `foo` */
+	T_TOKEN_LAST
+} FR_TOKEN;
+
+#define T_EQSTART	T_OP_ADD
+#define	T_EQEND		(T_OP_PREPEND + 1)
+
+typedef struct FR_NAME_NUMBER {
+	char const	*name;
+	int		number;
+} FR_NAME_NUMBER;
+
+extern const FR_NAME_NUMBER fr_tokens[];
+extern const bool fr_assignment_op[];
+extern const bool fr_equality_op[];
+extern const bool fr_str_tok[];
+
+int fr_str2int(FR_NAME_NUMBER const *table, char const *name, int def);
+int fr_substr2int(FR_NAME_NUMBER const *table, char const *name, int def, int len);
+char const *fr_int2str(FR_NAME_NUMBER const *table, int number, char const *def);
+
+int		getword (char const **ptr, char *buf, int buflen, bool unescape);
+FR_TOKEN	gettoken(char const **ptr, char *buf, int buflen, bool unescape);
+FR_TOKEN	getop(char const **ptr);
+FR_TOKEN	getstring(char const **ptr, char *buf, int buflen, bool unescape);
+char const	*fr_token_name(int);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* FR_TOKEN_H */
diff --git a/src/include/udpfromto.h b/src/include/udpfromto.h
new file mode 100644
index 0000000..7b029cd
--- /dev/null
+++ b/src/include/udpfromto.h
@@ -0,0 +1,31 @@
+#ifndef UDPFROMTO_H
+#define UDPFROMTO_H
+/*
+ * $Id$
+ *
+ * @file udpfromto.h
+ */
+
+RCSIDH(udpfromtoh, "$Id$")
+
+#include <freeradius-devel/libradius.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef WITH_UDPFROMTO
+int udpfromto_init(int s);
+int recvfromto(int s, void *buf, size_t len, int flags,
+	       struct sockaddr *from, socklen_t *fromlen,
+	       struct sockaddr *to, socklen_t *tolen);
+int sendfromto(int s, void *buf, size_t len, int flags,
+	       struct sockaddr *from, socklen_t fromlen,
+	       struct sockaddr *to, socklen_t tolen);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/xlat.h b/src/include/xlat.h
new file mode 100644
index 0000000..535dd81
--- /dev/null
+++ b/src/include/xlat.h
@@ -0,0 +1,71 @@
+/*
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+#ifndef XLAT_H
+#define XLAT_H
+
+/**
+ * $Id$
+ *
+ * @file xlat.h
+ * @brief Structures and prototypes for templates
+ *
+ * @copyright 2015  The FreeRADIUS server project
+ */
+
+RCSIDH(xlat_h, "$Id$")
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <freeradius-devel/conffile.h>
+
+typedef struct xlat_exp xlat_exp_t;
+
+typedef size_t (*xlat_escape_t)(REQUEST *, char *out, size_t outlen, char const *in, void *arg);
+typedef ssize_t (*xlat_func_t)(void *instance, REQUEST *, char const *, char *, size_t);
+
+ssize_t radius_xlat(char *out, size_t outlen, REQUEST *request, char const *fmt, xlat_escape_t escape,
+		    void *escape_ctx)
+	CC_HINT(nonnull (1 ,3 ,4));
+
+ssize_t radius_xlat_struct(char *out, size_t outlen, REQUEST *request, xlat_exp_t const *xlat,
+			   xlat_escape_t escape, void *ctx)
+	CC_HINT(nonnull (1 ,3 ,4));
+
+ssize_t radius_axlat(char **out, REQUEST *request, char const *fmt, xlat_escape_t escape, void *escape_ctx)
+	CC_HINT(nonnull (1, 2, 3));
+
+ssize_t radius_axlat_struct(char **out, REQUEST *request, xlat_exp_t const *xlat, xlat_escape_t escape,
+			    void *ctx)
+	CC_HINT(nonnull (1, 2, 3));
+
+ssize_t xlat_tokenize(TALLOC_CTX *ctx, char *fmt, xlat_exp_t **head, char const **error);
+
+size_t xlat_sprint(char *buffer, size_t bufsize, xlat_exp_t const *node);
+
+int		xlat_register(char const *module, xlat_func_t func, xlat_escape_t escape,
+			      void *instance);
+void		xlat_unregister(char const *module, xlat_func_t func, void *instance);
+void		xlat_unregister_module(void *instance);
+bool		xlat_register_redundant(CONF_SECTION *cs);
+ssize_t		xlat_fmt_to_ref(uint8_t const **out, REQUEST *request, char const *fmt);
+void		xlat_free(void);
+
+#ifdef __cplusplus
+}
+#endif
+#endif	/* TMPL_H */