Move all the extremely RADIUS specific logging options out of the server core into...

diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
index 865d0b38908affccc0d8388b7935ccdf6f568b8c..434576013642c328d63cca5d876b541db3d0e7c7 100644 (file)
--- a/raddb/radiusd.conf.in
+++ b/raddb/radiusd.conf.in
@@ -265,43 +265,6 @@ log {
        #  don't want to change this.
        #
        syslog_facility = daemon
-
-       #  Log the full User-Name attribute, as it was found in the request.
-       #
-       # allowed values: {no, yes}
-       #
-       stripped_names = no
-
-       #  Log authentication requests to the log file.
-       #
-       #  allowed values: {no, yes}
-       #
-       auth = no
-
-       #  Log passwords with the authentication requests.
-       #  auth_badpass  - logs password if it's rejected
-       #  auth_goodpass - logs password if it's correct
-       #
-       #  allowed values: {no, yes}
-       #
-       auth_badpass = no
-       auth_goodpass = no
-
-       #  Log additional text at the end of the "Login OK" messages.
-       #  for these to work, the "auth" and "auth_goodpass" or "auth_badpass"
-       #  configurations above have to be set to "yes".
-       #
-       #  The strings below are dynamically expanded, which means that
-       #  you can put anything you want in them.  However, note that
-       #  this expansion can be slow, and can negatively impact server
-       #  performance.
-       #
-#      msg_goodpass = ""
-#      msg_badpass = ""
-
-       #  The message when the user exceeds the Simultaneous-Use limit.
-       #
-       msg_denied = "You are already logged in - access denied"
 }
 
 # ENVIRONMENT VARIABLES

diff --git a/raddb/sites-available/default b/raddb/sites-available/default
index 1d471d7277527e93ce6744f8531a263218cd2a6a..0f43dd0a5f7330ac953d51c5b4921fe5748bdd0e 100644 (file)
--- a/raddb/sites-available/default
+++ b/raddb/sites-available/default
@@ -255,6 +255,46 @@ server default {
 #                              deny = 127.0.0/24
                        }
                }
+
+               auth {
+                       #  Log the full User-Name attribute, as it was found in the request.
+                       #
+                       # allowed values: {no, yes}
+                       #
+                       stripped_names = no
+
+                       #  Log authentication requests to the log file.
+                       #
+                       #  allowed values: {no, yes}
+                       #
+                       auth = no
+
+                       #  Log passwords with the authentication requests.
+                       #
+                       #  auth_badpass  - logs password if it's rejected
+                       #  auth_goodpass - logs password if it's correct
+                       #
+                       #  allowed values: {no, yes}
+                       #
+                       auth_badpass = no
+                       auth_goodpass = no
+
+                       #  Log additional text at the end of the "Login OK" messages.
+                       #  for these to work, the "auth" and "auth_goodpass" or "auth_badpass"
+                       #  configurations above have to be set to "yes".
+                       #
+                       #  The strings below are dynamically expanded, which means that
+                       #  you can put anything you want in them.  However, note that
+                       #  this expansion can be slow, and can negatively impact server
+                       #  performance.
+                       #
+#                      msg_goodpass = ""
+#                      msg_badpass = ""
+
+                       #  The message when the user exceeds the Simultaneous-Use limit.
+                       #
+                       msg_denied = "You are already logged in - access denied"
+               }
        }
 
        listen {

diff --git a/src/include/radiusd.h b/src/include/radiusd.h
index 1e009d3e355bd293a076639c4b4ae762096d85b8..4565d780d99c675151807f9ae7fd45aa2f023d04 100644 (file)
--- a/src/include/radiusd.h
+++ b/src/include/radiusd.h
@@ -105,15 +105,6 @@ typedef struct main_config {
        char const      *name;                          //!< Name of the daemon, usually 'radiusd'.
        CONF_SECTION    *config;                        //!< Root of the server config.
 
-       bool            log_auth;                       //!< Log authentication attempts.
-       bool            log_auth_badpass;               //!< Log successful authentications.
-       bool            log_auth_goodpass;              //!< Log failed authentications.
-       char const      *auth_badpass_msg;              //!< Additional text to append to successful auth messages.
-       char const      *auth_goodpass_msg;             //!< Additional text to append to failed auth messages.
-
-       char const      *denied_msg;                    //!< Additional text to append if the user is already logged
-                                                       //!< in (simultaneous use check failed).
-
        bool            daemonize;                      //!< Should the server daemonize on startup.
        bool            spawn_workers;                  //!< Should the server spawn threads.
        char const      *pid_file;                      //!< Path to write out PID file.
@@ -131,7 +122,7 @@ typedef struct main_config {
        char const      *log_file;
        int             syslog_facility;
 
-       char const      *dict_dir;              //!< Where to load dictionaries from.
+       char const      *dict_dir;                      //!< Where to load dictionaries from.
 
        struct timeval  init_delay;                     //!< Initial request processing delay.
 
@@ -338,7 +329,6 @@ extern fr_log_lvl_t req_debug_lvl;
 extern char const      *radacct_dir;
 extern char const      *log_dir;
 extern char const      *radlib_dir;
-extern bool            log_stripped_names;
 extern char const      *radiusd_version;
 extern char const      *radiusd_version_short;
 void                   radius_signal_self(int flag);

diff --git a/src/main/auth.c b/src/main/auth.c
index c52ca4aac34ba59d1f423344b7cf9e6efb3398eb..80105482be3debacab0902785dc5b73e42ca858f 100644 (file)
--- a/src/main/auth.c
+++ b/src/main/auth.c
@@ -64,97 +64,6 @@ char *auth_name(char *buf, size_t buflen, REQUEST *request, bool do_cli)
        return buf;
 }
 
-
-
-/*
- * Make sure user/pass are clean
- * and then log them
- */
-static int rad_authlog(char const *msg, REQUEST *request, int goodpass)
-{
-       int logit;
-       char const *extra_msg = NULL;
-       char clean_password[1024];
-       char clean_username[1024];
-       char buf[1024];
-       char extra[1024];
-       char *p;
-       VALUE_PAIR *username = NULL;
-
-       if (!request->root->log_auth) {
-               return 0;
-       }
-
-       /*
-        * Get the correct username based on the configured value
-        */
-       if (!log_stripped_names) {
-               username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
-       } else {
-               username = request->username;
-       }
-
-       /*
-        *      Clean up the username
-        */
-       if (username == NULL) {
-               strcpy(clean_username, "<no User-Name attribute>");
-       } else {
-               fr_snprint(clean_username, sizeof(clean_username), username->vp_strvalue, username->vp_length, '\0');
-       }
-
-       /*
-        *      Clean up the password
-        */
-       if (request->root->log_auth_badpass || request->root->log_auth_goodpass) {
-               if (!request->password) {
-                       VALUE_PAIR *auth_type;
-
-                       auth_type = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY);
-                       if (auth_type) {
-                               snprintf(clean_password, sizeof(clean_password),
-                                        "<via Auth-Type = %s>",
-                                        fr_dict_enum_alias_by_value(auth_type->da, &auth_type->data));
-                       } else {
-                               strcpy(clean_password, "<no User-Password attribute>");
-                       }
-               } else if (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) {
-                       strcpy(clean_password, "<CHAP-Password>");
-               } else {
-                       fr_snprint(clean_password, sizeof(clean_password),
-                                 request->password->vp_strvalue, request->password->vp_length, '\0');
-               }
-       }
-
-       if (goodpass) {
-               logit = request->root->log_auth_goodpass;
-               extra_msg = request->root->auth_goodpass_msg;
-       } else {
-               logit = request->root->log_auth_badpass;
-               extra_msg = request->root->auth_badpass_msg;
-       }
-
-       if (extra_msg) {
-               extra[0] = ' ';
-               p = extra + 1;
-               if (xlat_eval(p, sizeof(extra) - 1, request, extra_msg, NULL, NULL) < 0) {
-                       return -1;
-               }
-       } else {
-               *extra = '\0';
-       }
-
-       RAUTH("%s: [%s%s%s] (%s)%s",
-                      msg,
-                      clean_username,
-                      logit ? "/" : "",
-                      logit ? clean_password : "",
-                      auth_name(buf, sizeof(buf), request, 1),
-                      extra);
-
-       return 0;
-}
-
 /*
  *     Check password.
  *
@@ -392,14 +301,6 @@ autz_redo:
        case RLM_MODULE_REJECT:
        case RLM_MODULE_USERLOCK:
        default:
-               if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL) {
-                       char msg[FR_MAX_STRING_LEN + 16];
-                       snprintf(msg, sizeof(msg), "Invalid user (%s)",
-                                module_msg->vp_strvalue);
-                       rad_authlog(msg,request,0);
-               } else {
-                       rad_authlog("Invalid user", request, 0);
-               }
                request->reply->code = FR_CODE_ACCESS_REJECT;
                return rcode;
        }
@@ -436,16 +337,6 @@ autz_redo:
                RDEBUG2("Failed to authenticate the user");
                request->reply->code = FR_CODE_ACCESS_REJECT;
 
-               if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL){
-                       char msg[FR_MAX_STRING_LEN+19];
-
-                       snprintf(msg, sizeof(msg), "Login incorrect (%s)",
-                                module_msg->vp_strvalue);
-                       rad_authlog(msg, request, 0);
-               } else {
-                       rad_authlog("Login incorrect", request, 0);
-               }
-
                if (request->password) {
                        VP_VERIFY(request->password);
                        /* double check: maybe the secret is wrong? */
@@ -482,16 +373,6 @@ autz_redo:
         */
        if (request->reply->code == 0) request->reply->code = FR_CODE_ACCESS_ACCEPT;
 
-       if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_SUCCESS_MESSAGE, TAG_ANY)) != NULL){
-               char msg[FR_MAX_STRING_LEN+12];
-
-               snprintf(msg, sizeof(msg), "Login OK (%s)",
-                        module_msg->vp_strvalue);
-               rad_authlog(msg, request, 1);
-       } else {
-               rad_authlog("Login OK", request, 1);
-       }
-
        return rcode;
 }
 

diff --git a/src/main/cf_parse.c b/src/main/cf_parse.c
index 53cd6ee4ca98832885399fc390c3692da1b510ad..6702b8cafdc9fe4ba991d6c00c816ebdee249f87 100644 (file)
--- a/src/main/cf_parse.c
+++ b/src/main/cf_parse.c
@@ -666,7 +666,7 @@ static int CC_HINT(nonnull(3,4)) cf_pair_parse_internal(TALLOC_CTX *ctx, void *o
                        }
 
                        /*
-                        *      Switch between customer parsing function
+                        *      Switch between custom parsing function
                         *      and the standard value parsing function.
                         */
                        if (rule->func) {

diff --git a/src/main/mainconfig.c b/src/main/mainconfig.c
index fd9fac627d8bbd180e9fc27fecd98ea8a0c49ed3..83246e7c9448a948216d782240e608469427afc5 100644 (file)
--- a/src/main/mainconfig.c
+++ b/src/main/mainconfig.c
@@ -122,16 +122,9 @@ static const CONF_PARSER initial_logging_config[] = {
  *
  **********************************************************************/
 static const CONF_PARSER log_config[] = {
-       { FR_CONF_POINTER("stripped_names", FR_TYPE_BOOL, &log_stripped_names), .dflt = "no" },
-       { FR_CONF_POINTER("auth", FR_TYPE_BOOL, &main_config.log_auth), .dflt = "no" },
-       { FR_CONF_POINTER("auth_badpass", FR_TYPE_BOOL, &main_config.log_auth_badpass), .dflt = "no" },
-       { FR_CONF_POINTER("auth_goodpass", FR_TYPE_BOOL, &main_config.log_auth_goodpass), .dflt = "no" },
-       { FR_CONF_POINTER("msg_badpass", FR_TYPE_STRING, &main_config.auth_badpass_msg) },
-       { FR_CONF_POINTER("msg_goodpass", FR_TYPE_STRING, &main_config.auth_goodpass_msg) },
        { FR_CONF_POINTER("colourise", FR_TYPE_BOOL, &do_colourise) },
        { FR_CONF_POINTER("timestamp", FR_TYPE_BOOL, &log_timestamp) },
        { FR_CONF_POINTER("use_utc", FR_TYPE_BOOL, &log_dates_utc) },
-       { FR_CONF_POINTER("msg_denied", FR_TYPE_STRING, &main_config.denied_msg), .dflt = "You are already logged in - access denied" },
 #ifdef WITH_CONF_WRITE
        { FR_CONF_POINTER("write_dir", FR_TYPE_STRING, &main_config.write_dir), .dflt = NULL },
 #endif
@@ -196,10 +189,10 @@ static const CONF_PARSER server_config[] = {
         *      DON'T exist in radiusd.conf, then the previously parsed
         *      values for "log { foo = bar}" will be used.
         */
-       { FR_CONF_POINTER("log_auth", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &main_config.log_auth) },
-       { FR_CONF_POINTER("log_auth_badpass", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &main_config.log_auth_badpass) },
-       { FR_CONF_POINTER("log_auth_goodpass", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &main_config.log_auth_goodpass) },
-       { FR_CONF_POINTER("log_stripped_names", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &log_stripped_names) },
+       { FR_CONF_DEPRECATED("log_auth", FR_TYPE_BOOL, NULL, NULL) },
+       { FR_CONF_DEPRECATED("log_auth_badpass", FR_TYPE_BOOL, NULL, NULL) },
+       { FR_CONF_DEPRECATED("log_auth_goodpass", FR_TYPE_BOOL, NULL, NULL ) },
+       { FR_CONF_DEPRECATED("log_stripped_names", FR_TYPE_BOOL, NULL, NULL) },
 
        CONF_PARSER_TERMINATOR
 };

diff --git a/src/main/radiusd.c b/src/main/radiusd.c
index 86b2e4aeaf62c8a4d88f3d83470216df325d6966..eb2ecd596aaa52e8186b057be047e3c446f4e57e 100644 (file)
--- a/src/main/radiusd.c
+++ b/src/main/radiusd.c
@@ -66,8 +66,6 @@ RCSID("$Id$")
 char const     *radacct_dir = NULL;
 char const     *log_dir = NULL;
 
-bool           log_stripped_names;
-
 char const *radiusd_version = RADIUSD_VERSION_STRING_BUILD("FreeRADIUS");
 static pid_t radius_pid;
 
@@ -315,9 +313,6 @@ int main(int argc, char *argv[])
                        main_config.spawn_workers = false;
                        main_config.daemonize = false;
                        rad_debug_lvl += 2;
-                       main_config.log_auth = true;
-                       main_config.log_auth_badpass = true;
-                       main_config.log_auth_goodpass = true;
        do_stdout:
                        fr_log_fp = stdout;
                        default_log.dst = L_DST_STDOUT;

diff --git a/src/main/radwho.c b/src/main/radwho.c
index 88f1c53a6acaba185c6ca8fdd5ee05528aa112eb..9df3ce3bdee4110407d51a2d3f4053c2f2a93802 100644 (file)
--- a/src/main/radwho.c
+++ b/src/main/radwho.c
@@ -55,8 +55,6 @@ static char const *dict_dir = DICTDIR;
 
 char const *radacct_dir = NULL;
 
-bool log_stripped_names;
-
 /*
  *     Global, for log.c to use.
  */

diff --git a/src/main/unit_test_module.c b/src/main/unit_test_module.c
index 8cfd0f81e3356c7c35166891dc402b82ee0644a5..d8b86dc22897047642efdb1a7622a9653dc32f54 100644 (file)
--- a/src/main/unit_test_module.c
+++ b/src/main/unit_test_module.c
@@ -44,7 +44,7 @@ RCSID("$Id$")
  */
 char const *radacct_dir = NULL;
 char const *log_dir = NULL;
-bool log_stripped_names = false;
+
 
 static bool filedone = false;
 
@@ -782,9 +782,6 @@ int main(int argc, char *argv[])
 
                        case 'X':
                                rad_debug_lvl += 2;
-                               main_config.log_auth = true;
-                               main_config.log_auth_badpass = true;
-                               main_config.log_auth_goodpass = true;
                                break;
 
                        case 'x':

diff --git a/src/modules/proto_radius/proto_radius.c b/src/modules/proto_radius/proto_radius.c
index 0430b8f8e0177bebd158953f2ed02012ffb5b1ee..020fd941862c8f5c39b9d06f657fcd389ea5cf87 100644 (file)
--- a/src/modules/proto_radius/proto_radius.c
+++ b/src/modules/proto_radius/proto_radius.c
@@ -155,6 +155,7 @@ static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PAR
 
        char const              *type_str = cf_pair_value(cf_item_to_pair(ci));
        CONF_SECTION            *listen_cs = cf_item_to_section(cf_parent(ci));
+       CONF_SECTION            *process_app_cs;
        CONF_SECTION            *server = cf_item_to_section(cf_parent(listen_cs));
        proto_radius_t          *inst;
        dl_instance_t           *parent_inst;
@@ -231,10 +232,21 @@ static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PAR
                inst->code_allowed[FR_CODE_DISCONNECT_REQUEST] = true;
        }
 
+       process_app_cs = cf_section_find(listen_cs, name, NULL);
+
+       /*
+        *      Allocate an empty section if one doesn't exist
+        *      this is so defaults get parsed.
+        */
+       if (!process_app_cs) {
+               process_app_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL);
+               cf_section_add(listen_cs, process_app_cs);
+       }
+
        /*
         *      Parent dl_instance_t added in virtual_servers.c (listen_parse)
         */
-       return dl_instance(ctx, out, listen_cs, parent_inst, name, DL_TYPE_SUBMODULE);
+       return dl_instance(ctx, out, cf_section_find(listen_cs, name, NULL), parent_inst, name, DL_TYPE_SUBMODULE);
 }
 
 /** Wrapper around dl_instance
@@ -261,7 +273,10 @@ static int transport_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CON
         *      Allocate an empty section if one doesn't exist
         *      this is so defaults get parsed.
         */
-       if (!transport_cs) transport_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL);
+       if (!transport_cs) {
+               transport_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL);
+               cf_section_add(listen_cs, transport_cs);
+       }
 
        parent_inst = cf_data_value(cf_data_find(listen_cs, dl_instance_t, "proto_radius"));
        rad_assert(parent_inst);

diff --git a/src/modules/proto_radius/proto_radius_auth.c b/src/modules/proto_radius/proto_radius_auth.c
index 3cffe8c9f37f176ce2374d4f41af059a827398da..92c3414c85c1f516e779015bd983e39cd3a796e7 100644 (file)
--- a/src/modules/proto_radius/proto_radius_auth.c
+++ b/src/modules/proto_radius/proto_radius_auth.c
@@ -34,6 +34,30 @@
 #define USEC (1000000)
 #endif
 
+typedef struct {
+       bool            log_stripped_names;
+       bool            log_auth;                       //!< Log authentication attempts.
+       bool            log_auth_badpass;               //!< Log successful authentications.
+       bool            log_auth_goodpass;              //!< Log failed authentications.
+       char const      *auth_badpass_msg;              //!< Additional text to append to successful auth messages.
+       char const      *auth_goodpass_msg;             //!< Additional text to append to failed auth messages.
+
+       char const      *denied_msg;                    //!< Additional text to append if the user is already logged
+                                                       //!< in (simultaneous use check failed).
+} proto_radius_auth_t;
+
+static const CONF_PARSER proto_radius_auth_config[] = {
+       { FR_CONF_OFFSET("log_stripped_names", FR_TYPE_BOOL, proto_radius_auth_t, log_stripped_names), .dflt = "no" },
+       { FR_CONF_OFFSET("log_auth", FR_TYPE_BOOL, proto_radius_auth_t, log_auth), .dflt = "no" },
+       { FR_CONF_OFFSET("log_auth_badpass", FR_TYPE_BOOL, proto_radius_auth_t, log_auth_badpass), .dflt = "no" },
+       { FR_CONF_OFFSET("log_auth_goodpass", FR_TYPE_BOOL,proto_radius_auth_t,  log_auth_goodpass), .dflt = "no" },
+       { FR_CONF_OFFSET("msg_badpass", FR_TYPE_STRING, proto_radius_auth_t, auth_badpass_msg) },
+       { FR_CONF_OFFSET("msg_goodpass", FR_TYPE_STRING, proto_radius_auth_t, auth_goodpass_msg) },
+       { FR_CONF_OFFSET("msg_denied", FR_TYPE_STRING, proto_radius_auth_t, denied_msg), .dflt = "You are already logged in - access denied" },
+
+       CONF_PARSER_TERMINATOR
+};
+
 static fr_dict_t *dict_freeradius;
 static fr_dict_t *dict_radius;
 
@@ -72,7 +96,8 @@ fr_dict_attr_autoload_t proto_radius_auth_dict_attr[] = {
  *     Make sure user/pass are clean and then create an attribute
  *     which contains the log message.
  */
-static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool goodpass, char const *fmt, ...)
+static void CC_HINT(format (printf, 4, 5)) auth_message(proto_radius_auth_t const *inst,
+                                                       REQUEST *request, bool goodpass, char const *fmt, ...)
 {
        va_list          ap;
 
@@ -91,7 +116,7 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g
        /*
         * Get the correct username based on the configured value
         */
-       if (!log_stripped_names) {
+       if (!inst->log_stripped_names) {
                username = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY);
        } else {
                username = request->username;
@@ -100,7 +125,7 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g
        /*
         *      Clean up the password
         */
-       if (request->root->log_auth_badpass || request->root->log_auth_goodpass) {
+       if (inst->log_auth_badpass || inst->log_auth_goodpass) {
                if (!request->password) {
                        VALUE_PAIR *auth_type;
 
@@ -118,11 +143,11 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g
        }
 
        if (goodpass) {
-               logit = request->root->log_auth_goodpass;
-               extra_msg = request->root->auth_goodpass_msg;
+               logit = inst->log_auth_goodpass;
+               extra_msg = inst->auth_goodpass_msg;
        } else {
-               logit = request->root->log_auth_badpass;
-               extra_msg = request->root->auth_badpass_msg;
+               logit = inst->log_auth_badpass;
+               extra_msg = inst->auth_badpass_msg;
        }
 
        if (extra_msg) {
@@ -151,13 +176,14 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g
        talloc_free(msg);
 }
 
-static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request, fr_io_action_t action)
+static fr_io_final_t mod_process(void const *instance, REQUEST *request, fr_io_action_t action)
 {
-       VALUE_PAIR              *vp, *auth_type;
-       rlm_rcode_t             rcode;
-       CONF_SECTION            *unlang;
-       fr_dict_enum_t const    *dv = NULL;
-       fr_cursor_t             cursor;
+       proto_radius_auth_t const       *inst = instance;
+       VALUE_PAIR                      *vp, *auth_type;
+       rlm_rcode_t                     rcode;
+       CONF_SECTION                    *unlang;
+       fr_dict_enum_t const            *dv = NULL;
+       fr_cursor_t                     cursor;
 
        REQUEST_VERIFY(request);
 
@@ -230,9 +256,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request,
                default:
                        if ((vp = fr_pair_find_by_da(request->packet->vps,
                                                     attr_module_failure_message, TAG_ANY)) != NULL) {
-                               auth_message(request, false, "Invalid user (%pV)", &vp->data);
+                               auth_message(inst, request, false, "Invalid user (%pV)", &vp->data);
                        } else {
-                               auth_message(request, false, "Invalid user");
+                               auth_message(inst, request, false, "Invalid user");
                        }
 
                        request->reply->code = FR_CODE_ACCESS_REJECT;
@@ -355,9 +381,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request,
 
                        vp = fr_pair_find_by_da(request->packet->vps, attr_module_failure_message, TAG_ANY);
                        if (vp) {
-                               auth_message(request, false, "Login incorrect (%pV)", &vp->data);
+                               auth_message(inst, request, false, "Login incorrect (%pV)", &vp->data);
                        } else {
-                               auth_message(request, false, "Login incorrect");
+                               auth_message(inst, request, false, "Login incorrect");
                        }
 
                        /*
@@ -403,9 +429,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request,
                if (request->reply->code == FR_CODE_ACCESS_ACCEPT) {
                        vp = fr_pair_find_by_da(request->packet->vps, attr_module_success_message, TAG_ANY);
                        if (vp){
-                               auth_message(request, true, "Login OK (%pV)", &vp->data);
+                               auth_message(inst, request, true, "Login OK (%pV)", &vp->data);
                        } else {
-                               auth_message(request, true, "Login OK");
+                               auth_message(inst, request, true, "Login OK");
                        }
                }
 
@@ -554,8 +580,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request,
 }
 
 
-static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *listen_cs)
+static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *process_app_cs)
 {
+       CONF_SECTION            *listen_cs = cf_item_to_section(cf_parent(process_app_cs));
        CONF_SECTION            *server_cs;
 
        rad_assert(listen_cs);
@@ -563,16 +590,16 @@ static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *listen_cs)
        server_cs = cf_item_to_section(cf_parent(listen_cs));
        rad_assert(strcmp(cf_section_name1(server_cs), "server") == 0);
 
-
        if (virtual_server_section_attribute_define(server_cs, "authenticate", attr_auth_type) < 0) return -1;
 
        return 0;
 }
 
-static int mod_instantiate(UNUSED void *instance, CONF_SECTION *listen_cs)
+static int mod_instantiate(UNUSED void *instance, CONF_SECTION *process_app_cs)
 {
-       CONF_SECTION            *subcs = NULL;;
+       CONF_SECTION            *listen_cs = cf_item_to_section(cf_parent(process_app_cs));
        CONF_SECTION            *server_cs;
+       CONF_SECTION            *subcs = NULL;
 
        rad_assert(listen_cs);
 
@@ -603,6 +630,9 @@ extern fr_app_process_t proto_radius_auth;
 fr_app_process_t proto_radius_auth = {
        .magic          = RLM_MODULE_INIT,
        .name           = "radius_auth",
+       .config         = proto_radius_auth_config,
+       .inst_size      = sizeof(proto_radius_auth_t),
+
        .bootstrap      = mod_bootstrap,
        .instantiate    = mod_instantiate,
        .entry_point    = mod_process,