From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Mon, 28 May 2018 08:14:31 +0000 (+0600)
Subject: More cursor conversions
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=26bb329694ee9ef195ca2dedb870d40d0e91e68e;p=thirdparty%2Ffreeradius-server.git

More cursor conversions
---

diff --git a/src/include/pair.h b/src/include/pair.h
index c8555ab60ce..37b6ad0230a 100644
--- a/src/include/pair.h
+++ b/src/include/pair.h
@@ -243,10 +243,6 @@ void		fr_pair_add(VALUE_PAIR **head, VALUE_PAIR *vp);
 
 void		fr_pair_replace(VALUE_PAIR **head, VALUE_PAIR *add);
 
-int		fr_pair_update_by_num(TALLOC_CTX *ctx, VALUE_PAIR **list,
-				      unsigned int vendor, unsigned int attr, int8_t tag,
-				      fr_value_box_t *value);
-
 void		fr_pair_delete_by_num(VALUE_PAIR **head, unsigned int vendor, unsigned int attr, int8_t tag);
 
 void		fr_pair_delete_by_child_num(VALUE_PAIR **head, fr_dict_attr_t const *parent,
diff --git a/src/include/tmpl.h b/src/include/tmpl.h
index 5fbd07e9571..2384f2ff05d 100644
--- a/src/include/tmpl.h
+++ b/src/include/tmpl.h
@@ -252,7 +252,7 @@ void tmpl_verify(char const *file, int line, vp_tmpl_t const *vpt);
  * Example:
  @code{.c}
    static vp_tmpl_t list = tmpl_initialiser_list(CURRENT_REQUEST, PAIR_LIST_REQUEST);
-   vp_cursor_t cursor;
+   fr_cursor_t cursor;
    VALUE_PAIR *vp;
 
    // Iterate over all pairs in the request list
@@ -298,8 +298,6 @@ void tmpl_verify(char const *file, int line, vp_tmpl_t const *vpt);
 
    value.strvalue = talloc_typed_strdup(NULL, "my new username");
    value.length = talloc_array_length(value.strvalue) - 1;
-
-   if (fr_pair_update_by_num(ctx, head, FR_USERNAME, 0, TAG_ANY, FR_TYPE_STRING, &value) < 0) return -1; // error
  @endcode
  *
  * @param _ctx new #VALUE_PAIR s should be allocated in for the specified list.
diff --git a/src/lib/ldap/control.c b/src/lib/ldap/control.c
index 0238fa20839..c1bbe820ed7 100644
--- a/src/lib/ldap/control.c
+++ b/src/lib/ldap/control.c
@@ -181,14 +181,14 @@ int fr_ldap_control_add_session_tracking(fr_ldap_connection_t *conn, REQUEST *re
 	LDAPControl		*acctmultisessionid_control = NULL;
 	struct berval		tracking_id;
 
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	VALUE_PAIR const	*vp;
 
 	memcpy(&hostname, &main_config.name, sizeof(hostname)); /* const / non-const issues */
 
-	for (vp = fr_pair_cursor_init(&cursor, &request->packet->vps);
+	for (vp = fr_cursor_init(&cursor, &request->packet->vps);
 	     vp;
-	     vp = fr_pair_cursor_next(&cursor)) {
+	     vp = fr_cursor_next(&cursor)) {
 		if (fr_dict_attr_is_top_level(vp->da)) switch (vp->da->attr) {
 		case FR_NAS_IP_ADDRESS:
 		case FR_NAS_IPV6_ADDRESS:
diff --git a/src/lib/ldap/map.c b/src/lib/ldap/map.c
index 4385ddbfb92..e56cd48da7e 100644
--- a/src/lib/ldap/map.c
+++ b/src/lib/ldap/map.c
@@ -39,10 +39,10 @@ int fr_ldap_map_getvalue(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, vp
 {
 	fr_ldap_result_t *self = uctx;
 	VALUE_PAIR *head = NULL, *vp;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor, to_append;
 	int i;
 
-	fr_pair_cursor_init(&cursor, &head);
+	fr_cursor_init(&cursor, &head);
 
 	switch (map->lhs->type) {
 	/*
@@ -93,7 +93,8 @@ int fr_ldap_map_getvalue(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, vp
 				goto next_pair;
 			}
 
-			fr_pair_cursor_merge(&cursor, vp);
+			fr_cursor_init(&to_append, &vp);
+			fr_cursor_merge(&cursor, &to_append);
 			talloc_free(attr);
 
 			/*
diff --git a/src/lib/soh/soh.c b/src/lib/soh/soh.c
index c4e78768d30..34a585f00ea 100644
--- a/src/lib/soh/soh.c
+++ b/src/lib/soh/soh.c
@@ -732,7 +732,7 @@ int fr_soh_init(void)
 		return -1;
 	}
 
-	instance_count++;
+
 
 	return 0;
 }
diff --git a/src/lib/util/pair.c b/src/lib/util/pair.c
index 8ef8480ec36..0398f45f406 100644
--- a/src/lib/util/pair.c
+++ b/src/lib/util/pair.c
@@ -652,12 +652,23 @@ void *fr_pair_iter_next_by_ancestor(void **prev, void *to_eval, void *uctx)
  */
 VALUE_PAIR *fr_pair_find_by_da(VALUE_PAIR *head, fr_dict_attr_t const *da, int8_t tag)
 {
-	vp_cursor_t 	cursor;
+	fr_cursor_t 	cursor;
+	VALUE_PAIR	*vp;
+
+	/* List head may be NULL if it contains no VPs */
+	if (!head) return NULL;
+
+	LIST_VERIFY(head);
 
-	if (!fr_cond_assert(da)) return NULL;
+	if (!da) return NULL;
 
-	(void) fr_pair_cursor_init(&cursor, &head);
-	return fr_pair_cursor_next_by_da(&cursor, da, tag);
+	for (vp = fr_cursor_init(&cursor, &head);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
+		if ((da == vp->da) && TAG_EQ(tag, vp->tag)) return vp;
+	}
+
+	return NULL;
 }
 
 
@@ -667,15 +678,32 @@ VALUE_PAIR *fr_pair_find_by_da(VALUE_PAIR *head, fr_dict_attr_t const *da, int8_
  */
 VALUE_PAIR *fr_pair_find_by_num(VALUE_PAIR *head, unsigned int vendor, unsigned int attr, int8_t tag)
 {
-	vp_cursor_t 	cursor;
+	fr_cursor_t 	cursor;
+	VALUE_PAIR	*vp;
 
 	/* List head may be NULL if it contains no VPs */
 	if (!head) return NULL;
 
 	LIST_VERIFY(head);
 
-	(void) fr_pair_cursor_init(&cursor, &head);
-	return fr_pair_cursor_next_by_num(&cursor, vendor, attr, tag);
+	for (vp = fr_cursor_init(&cursor, &head);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
+		if (!fr_dict_attr_is_top_level(vp->da)) continue;
+
+	     	if (vendor > 0) {
+	     		fr_dict_vendor_t const *dv;
+
+	     		dv = fr_dict_vendor_by_da(vp->da);
+	     		if (!dv) continue;
+
+	     		if (dv->pen != vendor) continue;
+	     	}
+
+		if ((attr == vp->da->attr) && TAG_EQ(tag, vp->tag)) return vp;
+	}
+
+	return NULL;
 }
 
 /** Find the pair with the matching attribute
@@ -683,15 +711,25 @@ VALUE_PAIR *fr_pair_find_by_num(VALUE_PAIR *head, unsigned int vendor, unsigned
  */
 VALUE_PAIR *fr_pair_find_by_child_num(VALUE_PAIR *head, fr_dict_attr_t const *parent, unsigned int attr, int8_t tag)
 {
-	vp_cursor_t 	cursor;
+	fr_cursor_t 		cursor;
+	fr_dict_attr_t const	*da;
+	VALUE_PAIR		*vp;
 
 	/* List head may be NULL if it contains no VPs */
 	if (!head) return NULL;
 
 	LIST_VERIFY(head);
 
-	(void) fr_pair_cursor_init(&cursor, &head);
-	return fr_pair_cursor_next_by_child_num(&cursor, parent, attr, tag);
+	da = fr_dict_attr_child_by_num(parent, attr);
+	if (!da) return NULL;
+
+	for (vp = fr_cursor_init(&cursor, &head);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
+		if ((da == vp->da) && TAG_EQ(tag, vp->tag)) return vp;
+	}
+
+	return NULL;
 }
 
 
@@ -788,46 +826,6 @@ void fr_pair_replace(VALUE_PAIR **head, VALUE_PAIR *replace)
 	*prev = replace;
 }
 
-/** Create a new VALUE_PAIR or replace the value of the head pair in the specified list
- *
- * @note Any buffers associated with value, will be stolen to the context of the
- *	VALUE_PAIR we create, or find.
- *
- * @param[in] ctx	to allocate new #VALUE_PAIR in.
- * @param[in,out] list	in search and insert into it.
- * @param[in] attr	Number of attribute to update.
- * @param[in] vendor	of attribute to update.
- * @param[in] tag	of attribute to update.
- * @param[in] value	to set.
- * @return
- *	- 0 on success.
- *	- -1 on failure.
- */
-int fr_pair_update_by_num(TALLOC_CTX *ctx, VALUE_PAIR **list,
-			  unsigned int vendor, unsigned int attr, int8_t tag,
-			  fr_value_box_t *value)
-{
-	vp_cursor_t cursor;
-	VALUE_PAIR *vp;
-
-	(void)fr_pair_cursor_init(&cursor, list);
-	vp = fr_pair_cursor_next_by_num(&cursor, vendor, attr, tag);
-	if (vp) {
-		VP_VERIFY(vp);
-		if (fr_value_box_steal(vp, &vp->data, value) < 0) return -1;
-		return 0;
-	}
-
-	vp = fr_pair_afrom_num(ctx, vendor, attr);
-	if (!vp) return -1;
-	vp->tag = tag;
-	if (fr_value_box_steal(vp, &vp->data, value) < 0) return -1;
-
-	fr_pair_cursor_append(&cursor, vp);
-
-	return 0;
-}
-
 /** Delete matching pairs
  *
  * Delete matching pairs from the attribute list.
@@ -1429,8 +1427,8 @@ mismatch:
  */
 bool fr_pair_validate_relaxed(VALUE_PAIR const *failed[2], VALUE_PAIR *filter, VALUE_PAIR *list)
 {
-	vp_cursor_t filter_cursor;
-	vp_cursor_t list_cursor;
+	vp_cursor_t	filter_cursor;
+	vp_cursor_t	list_cursor;
 
 	VALUE_PAIR *check, *last_check = NULL, *match = NULL;
 
@@ -1581,10 +1579,10 @@ int fr_pair_list_afrom_file(TALLOC_CTX *ctx, VALUE_PAIR **out, FILE *fp, bool *p
 	char buf[8192];
 	FR_TOKEN last_token = T_EOL;
 
-	vp_cursor_t cursor;
+	fr_cursor_t cursor, to_append;
 
 	VALUE_PAIR *vp = NULL;
-	fr_pair_cursor_init(&cursor, out);
+	fr_cursor_init(&cursor, out);
 
 	while (fgets(buf, sizeof(buf), fp) != NULL) {
 		/*
@@ -1614,7 +1612,8 @@ int fr_pair_list_afrom_file(TALLOC_CTX *ctx, VALUE_PAIR **out, FILE *fp, bool *p
 			break;
 		}
 
-		fr_pair_cursor_merge(&cursor, vp);
+		fr_cursor_init(&to_append, &vp);
+		fr_cursor_merge(&cursor, &to_append);
 		buf[0] = '\0';
 	}
 	*pfiledone = true;
@@ -1623,7 +1622,7 @@ int fr_pair_list_afrom_file(TALLOC_CTX *ctx, VALUE_PAIR **out, FILE *fp, bool *p
 
 error:
 	*pfiledone = false;
-	vp = fr_pair_cursor_head(&cursor);
+	vp = fr_cursor_head(&cursor);
 	if (vp) fr_pair_list_free(&vp);
 
 	return -1;
@@ -2478,11 +2477,11 @@ void fr_pair_fprint(FILE *fp, VALUE_PAIR const *vp)
 void fr_pair_list_fprint(FILE *fp, VALUE_PAIR const *const_vp)
 {
 	VALUE_PAIR *vp;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 
 	memcpy(&vp, &const_vp, sizeof(vp)); /* const work-arounds */
 
-	for (vp = fr_pair_cursor_init(&cursor, &vp); vp; vp = fr_pair_cursor_next(&cursor)) {
+	for (vp = fr_cursor_init(&cursor, &vp); vp; vp = fr_cursor_next(&cursor)) {
 		fr_pair_fprint(fp, vp);
 	}
 }
@@ -2901,23 +2900,23 @@ inline void fr_pair_verify(char const *file, int line, VALUE_PAIR const *vp)
  */
 void fr_pair_list_verify(char const *file, int line, TALLOC_CTX const *expected, VALUE_PAIR *vps)
 {
-	vp_cursor_t		slow_cursor, fast_cursor;
+	fr_cursor_t		slow_cursor, fast_cursor;
 	VALUE_PAIR		*slow, *fast;
 	TALLOC_CTX		*parent;
 
 	if (!vps) return;	/* Fast path */
 
-	fr_pair_cursor_init(&fast_cursor, &vps);
+	fr_cursor_init(&fast_cursor, &vps);
 
-	for (slow = fr_pair_cursor_init(&slow_cursor, &vps), fast = fr_pair_cursor_init(&fast_cursor, &vps);
+	for (slow = fr_cursor_init(&slow_cursor, &vps), fast = fr_cursor_init(&fast_cursor, &vps);
 	     slow && fast;
-	     slow = fr_pair_cursor_next(&fast_cursor), fast = fr_pair_cursor_next(&fast_cursor)) {
+	     slow = fr_cursor_next(&fast_cursor), fast = fr_cursor_next(&fast_cursor)) {
 		VP_VERIFY(slow);
 
 		/*
 		 *	Advances twice as fast as slow...
 		 */
-		fast = fr_pair_cursor_next(&fast_cursor);
+		fast = fr_cursor_next(&fast_cursor);
 		if (fast == slow) {
 			FR_FAULT_LOG("CONSISTENCY CHECK FAILED %s[%u]: Looping list found.  Fast pointer hit "
 				     "slow pointer at \"%s\"", file, line, slow->da->name);
@@ -2946,15 +2945,13 @@ void fr_pair_list_verify(char const *file, int line, TALLOC_CTX const *expected,
 void fr_pair_list_tainted(VALUE_PAIR *vps)
 {
 	VALUE_PAIR	*vp;
-	vp_cursor_t	cursor;
+	fr_cursor_t	cursor;
 
-	if (!vps) {
-		return;
-	}
+	if (!vps) return;
 
-	for (vp = fr_pair_cursor_init(&cursor, &vps);
+	for (vp = fr_cursor_init(&cursor, &vps);
 	     vp;
-	     vp = fr_pair_cursor_next(&cursor)) {
+	     vp = fr_cursor_next(&cursor)) {
 		VP_VERIFY(vp);
 		vp->vp_tainted = true;
 	}
diff --git a/src/main/auth.c b/src/main/auth.c
index 003410d70af..fb8ee3d8f5b 100644
--- a/src/main/auth.c
+++ b/src/main/auth.c
@@ -76,24 +76,31 @@ char *auth_name(char *buf, size_t buflen, REQUEST *request, bool do_cli)
  */
 static int CC_HINT(nonnull) rad_check_password(REQUEST *request)
 {
-	vp_cursor_t	cursor;
-	VALUE_PAIR	*auth_type_pair;
-	int		auth_type = -1;
-	int		result;
-	int		auth_type_count = 0;
+	fr_cursor_t		cursor;
+	VALUE_PAIR		*auth_type_pair;
+	int			auth_type = -1;
+	int			result;
+	int			auth_type_count = 0;
+	fr_dict_attr_t const	*da;
+
+	da = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_AUTH_TYPE);
+	if (!da) {
+		RERROR("Missing definition for Auth-Type");
+		return -1;
+	}
 
 	/*
 	 *	Look for matching check items. We skip the whole lot
 	 *	if the authentication type is FR_AUTH_TYPE_ACCEPT or
 	 *	FR_AUTH_TYPE_REJECT.
 	 */
-	fr_pair_cursor_init(&cursor, &request->control);
-	while ((auth_type_pair = fr_pair_cursor_next_by_num(&cursor, 0, FR_AUTH_TYPE, TAG_ANY))) {
+	for (auth_type_pair = fr_cursor_iter_by_da_init(&cursor, &request->control, da);
+	     auth_type_pair;
+	     auth_type_pair = fr_cursor_next(&cursor)) {
 		auth_type = auth_type_pair->vp_uint32;
 		auth_type_count++;
 
-		RDEBUG2("Using 'Auth-Type = %s' for authenticate {...}",
-			fr_dict_enum_alias_by_value(auth_type_pair->da, fr_box_uint32(auth_type)));
+		RDEBUG2("Using '%pP' for authenticate {...}", auth_type_pair);
 		if (auth_type == FR_AUTH_TYPE_REJECT) {
 			RDEBUG2("Auth-Type = Reject, rejecting user");
 
diff --git a/src/main/client.c b/src/main/client.c
index c5905087c22..1fd87bc97b7 100644
--- a/src/main/client.c
+++ b/src/main/client.c
@@ -886,7 +886,7 @@ RADCLIENT *client_afrom_request(TALLOC_CTX *ctx, REQUEST *request)
 	static int	cnt;
 	CONF_SECTION	*cs;
 	char		src_buf[128], buffer[256];
-	vp_cursor_t	cursor;
+	fr_cursor_t	cursor;
 	VALUE_PAIR	*vp;
 	RADCLIENT	*c;
 
@@ -898,14 +898,14 @@ RADCLIENT *client_afrom_request(TALLOC_CTX *ctx, REQUEST *request)
 
 	cs = cf_section_alloc(ctx, NULL, "client", buffer);
 
-	fr_pair_cursor_init(&cursor, &request->control);
+	fr_cursor_init(&cursor, &request->control);
 
 	RDEBUG2("Converting &request:control to client {...} section");
 	RINDENT();
 
-	for (vp = fr_pair_cursor_init(&cursor, &request->control);
+	for (vp = fr_cursor_init(&cursor, &request->control);
 	     vp != NULL;
-	     vp = fr_pair_cursor_next(&cursor)) {
+	     vp = fr_cursor_next(&cursor)) {
 		CONF_PAIR	*cp = NULL;
 		char const	*value;
 		char const	*attr;
diff --git a/src/main/exec.c b/src/main/exec.c
index adc90795c11..af31044708f 100644
--- a/src/main/exec.c
+++ b/src/main/exec.c
@@ -183,9 +183,10 @@ pid_t radius_start_program(char const *cmd, REQUEST *request, bool exec_wait,
 	envp[0] = NULL;
 
 	if (input_pairs) {
-		char		*p;
-		vp_cursor_t	cursor;
-		char		buffer[1024];
+		char			*p;
+		fr_cursor_t		cursor;
+		char			buffer[1024];
+		fr_dict_attr_t const	*da;
 
 		input_ctx = talloc_new(request);
 
@@ -195,9 +196,9 @@ pid_t radius_start_program(char const *cmd, REQUEST *request, bool exec_wait,
 		 *	hold mutexes.  They might be locked when we fork,
 		 *	and will remain locked in the child.
 		 */
-		for (vp = fr_pair_cursor_init(&cursor, &input_pairs);
+		for (vp = fr_cursor_init(&cursor, &input_pairs);
 		     vp && (envlen < ((sizeof(envp) / sizeof(*envp)) - 1));
-		     vp = fr_pair_cursor_next(&cursor)) {
+		     vp = fr_cursor_next(&cursor)) {
 			/*
 			 *	Hmm... maybe we shouldn't pass the
 			 *	user's password in an environment
@@ -221,10 +222,16 @@ pid_t radius_start_program(char const *cmd, REQUEST *request, bool exec_wait,
 			envp[envlen++] = talloc_typed_strdup(input_ctx, buffer);
 		}
 
-		fr_pair_cursor_init(&cursor, radius_list(request, PAIR_LIST_CONTROL));
-		while ((envlen < ((sizeof(envp) / sizeof(*envp)) - 1)) &&
-		       (vp = fr_pair_cursor_next_by_num(&cursor, 0, FR_EXEC_EXPORT, TAG_ANY))) {
-			DEBUG3("export %s", vp->vp_strvalue);
+		da = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EXEC_EXPORT);
+		if (!da) {
+			ERROR("Missing Exec-Export definition");
+			return -1;
+		}
+
+		for (vp = fr_cursor_iter_by_da_init(&cursor, radius_list(request, PAIR_LIST_CONTROL), da);
+		     vp && (envlen < ((sizeof(envp) / sizeof(*envp)) - 1));
+		     vp = fr_cursor_next(&cursor)) {
+			DEBUG3("export %pV", &vp->data);
 			memcpy(&envp[envlen++], &vp->vp_strvalue, sizeof(*envp));
 		}
 
diff --git a/src/main/state.c b/src/main/state.c
index 4020eec2788..3633f51adf3 100644
--- a/src/main/state.c
+++ b/src/main/state.c
@@ -257,7 +257,7 @@ static void state_entry_unlink(fr_state_tree_t *state, fr_state_entry_t *entry)
 static int _state_entry_free(fr_state_entry_t *entry)
 {
 #ifdef WITH_VERIFY_PTR
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 	VALUE_PAIR *vp;
 
 	/*
@@ -265,9 +265,9 @@ static int _state_entry_free(fr_state_entry_t *entry)
 	 *	by the state context.
 	 */
 	if (entry->ctx) {
-		for (vp = fr_pair_cursor_init(&cursor, &entry->vps);
+		for (vp = fr_cursor_init(&cursor, &entry->vps);
 		     vp;
-		     vp = fr_pair_cursor_next(&cursor)) {
+		     vp = fr_cursor_next(&cursor)) {
 			rad_assert(entry->ctx == talloc_parent(vp));
 		}
 	}
diff --git a/src/main/tmpl.c b/src/main/tmpl.c
index 3c600402df3..8164540340c 100644
--- a/src/main/tmpl.c
+++ b/src/main/tmpl.c
@@ -2160,7 +2160,7 @@ static void *_tmpl_cursor_next(void **prev, void *curr, void *ctx)
 	return NULL;
 }
 
-/** Initialise a #vp_cursor_t to the #VALUE_PAIR specified by a #vp_tmpl_t
+/** Initialise a #fr_cursor_t to the #VALUE_PAIR specified by a #vp_tmpl_t
  *
  * This makes iterating over the one or more #VALUE_PAIR specified by a #vp_tmpl_t
  * significantly easier.
diff --git a/src/main/trigger.c b/src/main/trigger.c
index 0b7dce0e9a9..d417be0e004 100644
--- a/src/main/trigger.c
+++ b/src/main/trigger.c
@@ -313,7 +313,7 @@ VALUE_PAIR *trigger_args_afrom_server(TALLOC_CTX *ctx, char const *server, uint1
 	fr_dict_attr_t const	*server_da;
 	fr_dict_attr_t const	*port_da;
 	VALUE_PAIR		*out = NULL, *vp;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 
 	server_da = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_CONNECTION_POOL_SERVER);
 	if (!server_da) {
@@ -327,15 +327,15 @@ VALUE_PAIR *trigger_args_afrom_server(TALLOC_CTX *ctx, char const *server, uint1
 		return NULL;
 	}
 
-	fr_pair_cursor_init(&cursor, &out);
+	fr_cursor_init(&cursor, &out);
 
 	MEM(vp = fr_pair_afrom_da(ctx, server_da));
 	fr_pair_value_strcpy(vp, server);
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	MEM(vp = fr_pair_afrom_da(ctx, port_da));
 	vp->vp_uint16 = port;
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	return out;
 }
diff --git a/src/main/users_file.c b/src/main/users_file.c
index 74c1e108b7a..b12ed640275 100644
--- a/src/main/users_file.c
+++ b/src/main/users_file.c
@@ -93,7 +93,7 @@ int pairlist_read(TALLOC_CTX *ctx, char const *file, PAIR_LIST **list, int compl
 	FR_TOKEN parsecode;
 #ifdef HAVE_REGEX_H
 	VALUE_PAIR *vp;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 #endif
 	char newfile[8192];
 
@@ -231,9 +231,9 @@ parse_again:
 			/*
 			 *	Do some more sanity checks.
 			 */
-			for (vp = fr_pair_cursor_init(&cursor, &check_tmp);
+			for (vp = fr_cursor_init(&cursor, &check_tmp);
 			     vp;
-			     vp = fr_pair_cursor_next(&cursor)) {
+			     vp = fr_cursor_next(&cursor)) {
 				if (((vp->op == T_OP_REG_EQ) ||
 				     (vp->op == T_OP_REG_NE)) &&
 				    (vp->vp_type != FR_TYPE_STRING)) {
diff --git a/src/modules/proto_detail/proto_detail.c b/src/modules/proto_detail/proto_detail.c
index f626538cfeb..acf4612cb70 100644
--- a/src/modules/proto_detail/proto_detail.c
+++ b/src/modules/proto_detail/proto_detail.c
@@ -211,13 +211,10 @@ static int mod_decode(void const *instance, REQUEST *request, uint8_t *const dat
 	int			num, lineno;
 	uint8_t const		*p, *end;
 	VALUE_PAIR		*vp;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	time_t			timestamp = 0;
 
-	if (DEBUG_ENABLED3) {
-		RDEBUG("proto_detail decode packet");
-//		fr_radius_print_hex(fr_log_fp, data, data_len);
-	}
+	RHEXDUMP(L_DBG_LVL_3, data, data_len, "proto_detail decode packet");
 
 	request->packet->code = inst->code;
 
@@ -249,7 +246,7 @@ static int mod_decode(void const *instance, REQUEST *request, uint8_t *const dat
 	}
 
 	lineno = 1;
-	fr_pair_cursor_init(&cursor, &request->packet->vps);
+	fr_cursor_init(&cursor, &request->packet->vps);
 
 	/*
 	 *	Parse each individual line.
@@ -295,7 +292,7 @@ static int mod_decode(void const *instance, REQUEST *request, uint8_t *const dat
 			if (vp) {
 				vp->vp_date = (uint32_t) timestamp;
 				vp->type = VT_DATA;
-				fr_pair_cursor_append(&cursor, vp);
+				fr_cursor_append(&cursor, vp);
 			}
 			goto next;
 		}
@@ -315,7 +312,7 @@ static int mod_decode(void const *instance, REQUEST *request, uint8_t *const dat
 		 */
 		vp = NULL;
 		if ((fr_pair_list_afrom_str(request->packet, (char const *) p, &vp) > 0) && vp) {
-			fr_pair_cursor_append(&cursor, vp);
+			fr_cursor_append(&cursor, vp);
 		} else {
 			RWDEBUG("Ignoring line %d - :%s", lineno, p);
 		}
diff --git a/src/modules/proto_dhcpv4/dhcpclient.c b/src/modules/proto_dhcpv4/dhcpclient.c
index 2e0d75470d1..007afceed7e 100644
--- a/src/modules/proto_dhcpv4/dhcpclient.c
+++ b/src/modules/proto_dhcpv4/dhcpclient.c
@@ -147,7 +147,7 @@ static void NEVER_RETURNS usage(void)
 static RADIUS_PACKET *request_init(char const *filename)
 {
 	FILE *fp;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 	VALUE_PAIR *vp;
 	bool filedone = false;
 	RADIUS_PACKET *request;
@@ -179,9 +179,9 @@ static RADIUS_PACKET *request_init(char const *filename)
 	/*
 	 *	Fix / set various options
 	 */
-	for (vp = fr_pair_cursor_init(&cursor, &request->vps);
+	for (vp = fr_cursor_init(&cursor, &request->vps);
 	     vp;
-	     vp = fr_pair_cursor_next(&cursor)) {
+	     vp = fr_cursor_next(&cursor)) {
 		/*
 		 *	Allow to set packet type using DHCP-Message-Type
 		 */
@@ -524,7 +524,7 @@ static int send_with_pcap(RADIUS_PACKET **reply, RADIUS_PACKET *request)
 
 static void dhcp_packet_debug(RADIUS_PACKET *packet, bool received)
 {
-	vp_cursor_t	cursor;
+	fr_cursor_t	cursor;
 	char		buffer[256];
 
 	char		src_ipaddr[INET6_ADDRSTRLEN];
@@ -569,9 +569,9 @@ static void dhcp_packet_debug(RADIUS_PACKET *packet, bool received)
 #endif
 	       packet->data_len);
 
-	for (vp = fr_pair_cursor_init(&cursor, &packet->vps);
+	for (vp = fr_cursor_init(&cursor, &packet->vps);
 	     vp;
-	     vp = fr_pair_cursor_next(&cursor)) {
+	     vp = fr_cursor_next(&cursor)) {
 		VP_VERIFY(vp);
 
 		fr_pair_snprint(buffer, sizeof(buffer), vp);
diff --git a/src/modules/proto_radius/proto_radius.c b/src/modules/proto_radius/proto_radius.c
index 37eb8912d32..1055e676566 100644
--- a/src/modules/proto_radius/proto_radius.c
+++ b/src/modules/proto_radius/proto_radius.c
@@ -358,14 +358,14 @@ static int mod_decode(void const *instance, REQUEST *request, uint8_t *const dat
 	 *	values.
 	 */
 	if (!client->active) {
-		vp_cursor_t cursor;
+		fr_cursor_t cursor;
 		VALUE_PAIR *vp;
 
 		rad_assert(client->dynamic);
 
-		for (vp = fr_pair_cursor_init(&cursor, &request->packet->vps);
+		for (vp = fr_cursor_init(&cursor, &request->packet->vps);
 		     vp != NULL;
-		     vp = fr_pair_cursor_next(&cursor)) {
+		     vp = fr_cursor_next(&cursor)) {
 			if (vp->da->flags.encrypt != FLAG_ENCRYPT_NONE) {
 				switch (vp->da->type) {
 				default:
diff --git a/src/modules/proto_tacacs/proto_tacacs.c b/src/modules/proto_tacacs/proto_tacacs.c
index 9b0aaace20b..df7a9272f96 100644
--- a/src/modules/proto_tacacs/proto_tacacs.c
+++ b/src/modules/proto_tacacs/proto_tacacs.c
@@ -198,7 +198,7 @@ static void tacacs_running(REQUEST *request, fr_state_signal_t action)
 	CONF_SECTION		*unlang;
 	fr_dict_enum_t const	*dv = NULL;
 	VALUE_PAIR *vp,		*auth_type;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	int			rc;
 
 	REQUEST_VERIFY(request);
@@ -281,9 +281,10 @@ stop_processing:
 		/*
 		 *	Find Auth-Type, and complain if they have too many.
 		 */
-		fr_pair_cursor_init(&cursor, &request->control);
 		auth_type = NULL;
-		while ((vp = fr_pair_cursor_next_by_da(&cursor, attr_auth_type, TAG_ANY)) != NULL) {
+		for (vp = fr_cursor_iter_by_da_init(&cursor, &request->control, attr_auth_type);
+		     vp;
+		     vp = fr_cursor_next(&cursor)) {
 			if (!auth_type) {
 				auth_type = vp;
 				continue;
diff --git a/src/modules/rlm_client/rlm_client.c b/src/modules/rlm_client/rlm_client.c
index 1c61bd132cb..bbc61f4b27a 100644
--- a/src/modules/rlm_client/rlm_client.c
+++ b/src/modules/rlm_client/rlm_client.c
@@ -44,13 +44,13 @@ static int _map_proc_client_get_vp(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *r
 {
 	client_get_vp_ctx_t	*client = uctx;
 	VALUE_PAIR		*head = NULL, *vp;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	fr_dict_attr_t const	*da;
 	CONF_PAIR const		*cp;
 
 	rad_assert(ctx != NULL);
 
-	fr_pair_cursor_init(&cursor, &head);
+	fr_cursor_init(&cursor, &head);
 
 	/*
 	 *	FIXME: allow multiple entries.
@@ -89,7 +89,7 @@ static int _map_proc_client_get_vp(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *r
 		}
 
 		vp->op = map->op;
-		fr_pair_cursor_merge(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		if (map->op != T_OP_ADD) break;	/* Create multiple attribute for multiple CONF_PAIRs */
 	}
diff --git a/src/modules/rlm_csv/rlm_csv.c b/src/modules/rlm_csv/rlm_csv.c
index e098a112f35..32ef571a51d 100644
--- a/src/modules/rlm_csv/rlm_csv.c
+++ b/src/modules/rlm_csv/rlm_csv.c
@@ -406,13 +406,13 @@ static int mod_bootstrap(void *instance, CONF_SECTION *conf)
  */
 static int csv_map_getvalue(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, vp_map_t const *map, void *uctx)
 {
-	char const *str = uctx;
-	VALUE_PAIR *head = NULL, *vp;
-	vp_cursor_t cursor;
-	fr_dict_attr_t const *da;
+	char const		*str = uctx;
+	VALUE_PAIR		*head = NULL, *vp;
+	fr_cursor_t		cursor;
+	fr_dict_attr_t		const *da;
 
 	rad_assert(ctx != NULL);
-	fr_pair_cursor_init(&cursor, &head);
+	fr_cursor_init(&cursor, &head);
 
 	/*
 	 *	FIXME: allow multiple entries.
@@ -452,7 +452,7 @@ static int csv_map_getvalue(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request,
 	}
 
 	vp->op = map->op;
-	fr_pair_cursor_merge(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	*out = head;
 	return 0;
diff --git a/src/modules/rlm_digest/rlm_digest.c b/src/modules/rlm_digest/rlm_digest.c
index c8d8e8c1a4c..9de7bdca4ec 100644
--- a/src/modules/rlm_digest/rlm_digest.c
+++ b/src/modules/rlm_digest/rlm_digest.c
@@ -85,7 +85,7 @@ fr_dict_attr_autoload_t rlm_digest_dict_attr[] = {
 static int digest_fix(REQUEST *request)
 {
 	VALUE_PAIR *first, *i;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 
 	/*
 	 *	We need both of these attributes to do the authentication.
@@ -107,15 +107,14 @@ static int digest_fix(REQUEST *request)
 	 */
 	RDEBUG("Checking for correctly formatted Digest-Attributes");
 
-	first = fr_pair_find_by_da(request->packet->vps, attr_digest_attributes, TAG_ANY);
-	if (!first) {
-		return RLM_MODULE_NOOP;
-	}
+	first = fr_cursor_iter_by_da_init(&cursor, &request->packet->vps, attr_digest_attributes);
+	if (!first) return RLM_MODULE_NOOP;
 
-	fr_pair_cursor_init(&cursor, &first);
-	while ((i = fr_pair_cursor_next_by_da(&cursor, attr_digest_attributes, TAG_ANY))) {
-		int length = i->vp_length;
-		int attrlen;
+	for (i = fr_cursor_head(&cursor);
+	     i;
+	     i = fr_cursor_next(&cursor)) {
+		size_t length = i->vp_length;
+		size_t attrlen;
 		uint8_t const *p = i->vp_octets;
 
 		/*
@@ -157,12 +156,14 @@ static int digest_fix(REQUEST *request)
 	 *	Convert them to something sane.
 	 */
 	RDEBUG("Digest-Attributes look OK.  Converting them to something more useful");
-	fr_pair_cursor_head(&cursor);
-	while ((i = fr_pair_cursor_next_by_da(&cursor, attr_digest_attributes, TAG_ANY))) {
-		int length = i->vp_length;
-		int attrlen;
-		uint8_t const *p = &i->vp_octets[0];
-		VALUE_PAIR *sub;
+	fr_cursor_head(&cursor);
+	for (i = fr_cursor_head(&cursor);
+	     i;
+	     i = fr_cursor_next(&cursor)) {
+		size_t		length = i->vp_length;
+		size_t		attrlen;
+		uint8_t const	*p = &i->vp_octets[0];
+		VALUE_PAIR	*sub;
 
 		/*
 		 *	Until this stupidly encoded attribute is exhausted.
@@ -182,7 +183,7 @@ static int digest_fix(REQUEST *request)
 			 *	Too short.
 			 */
 			if (attrlen < 3) {
-				REDEBUG("Received Digest-Attributes with short sub-attribute %d, of length %d",
+				REDEBUG("Received Digest-Attributes with short sub-attribute %d, of length %zu",
 					p[0], attrlen);
 				return RLM_MODULE_INVALID;
 			}
@@ -191,7 +192,7 @@ static int digest_fix(REQUEST *request)
 			 *	Too long.
 			 */
 			if (attrlen > length) {
-				REDEBUG("Received Digest-Attributes with long sub-attribute %d, of length %d",
+				REDEBUG("Received Digest-Attributes with long sub-attribute %d, of length %zu",
 					p[0], attrlen);
 				return RLM_MODULE_INVALID;
 			}
diff --git a/src/modules/rlm_eap/lib/base/eap_base.c b/src/modules/rlm_eap/lib/base/eap_base.c
index 02f5964bdec..137539cfa16 100644
--- a/src/modules/rlm_eap/lib/base/eap_base.c
+++ b/src/modules/rlm_eap/lib/base/eap_base.c
@@ -223,7 +223,7 @@ VALUE_PAIR *eap_packet2vp(RADIUS_PACKET *packet, eap_packet_raw_t const *eap)
 	uint8_t const *ptr;
 	VALUE_PAIR	*head = NULL;
 	VALUE_PAIR	*vp;
-	vp_cursor_t	out;
+	fr_cursor_t	out;
 
 	total = eap->length[0] * 256 + eap->length[1];
 
@@ -234,7 +234,7 @@ VALUE_PAIR *eap_packet2vp(RADIUS_PACKET *packet, eap_packet_raw_t const *eap)
 
 	ptr = (uint8_t const *) eap;
 
-	fr_pair_cursor_init(&out, &head);
+	fr_cursor_init(&out, &head);
 	do {
 		size = total;
 		if (size > 253) size = 253;
@@ -246,7 +246,7 @@ VALUE_PAIR *eap_packet2vp(RADIUS_PACKET *packet, eap_packet_raw_t const *eap)
 		}
 		fr_pair_value_memcpy(vp, ptr, size);
 
-		fr_pair_cursor_append(&out, vp);
+		fr_cursor_append(&out, vp);
 
 		ptr += size;
 		total -= size;
@@ -265,18 +265,18 @@ VALUE_PAIR *eap_packet2vp(RADIUS_PACKET *packet, eap_packet_raw_t const *eap)
  */
 eap_packet_raw_t *eap_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 {
-	VALUE_PAIR *first, *i;
-	eap_packet_raw_t *eap_packet;
-	unsigned char *ptr;
-	uint16_t len;
-	int total_len;
-	vp_cursor_t cursor;
+	VALUE_PAIR		*vp;
+	eap_packet_raw_t	*eap_packet;
+	unsigned char		*ptr;
+	uint16_t		len;
+	int			total_len;
+	fr_cursor_t		cursor;
 
 	/*
 	 *	Get only EAP-Message attribute list
 	 */
-	first = fr_pair_find_by_da(vps, attr_eap_message, TAG_ANY);
-	if (!first) {
+	vp = fr_cursor_iter_by_da_init(&cursor, &vps, attr_eap_message);
+	if (!vp) {
 		fr_strerror_printf("EAP-Message not found");
 		return NULL;
 	}
@@ -284,7 +284,7 @@ eap_packet_raw_t *eap_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 	/*
 	 *	Sanity check the length before doing anything.
 	 */
-	if (first->vp_length < 4) {
+	if (vp->vp_length < 4) {
 		fr_strerror_printf("EAP packet is too short");
 		return NULL;
 	}
@@ -293,7 +293,7 @@ eap_packet_raw_t *eap_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 	 *	Get the Actual length from the EAP packet
 	 *	First EAP-Message contains the EAP packet header
 	 */
-	memcpy(&len, first->vp_strvalue + 2, sizeof(len));
+	memcpy(&len, vp->vp_strvalue + 2, sizeof(len));
 	len = ntohs(len);
 
 	/*
@@ -308,9 +308,10 @@ eap_packet_raw_t *eap_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 	 *	Sanity check the length, BEFORE allocating  memory.
 	 */
 	total_len = 0;
-	fr_pair_cursor_init(&cursor, &first);
-	while ((i = fr_pair_cursor_next_by_da(&cursor, attr_eap_message, TAG_ANY))) {
-		total_len += i->vp_length;
+	for (vp = fr_cursor_head(&cursor);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
+		total_len += vp->vp_length;
 
 		if (total_len > len) {
 			fr_strerror_printf("Malformed EAP packet.  Length in packet header %i, "
@@ -340,10 +341,11 @@ eap_packet_raw_t *eap_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 	ptr = (unsigned char *)eap_packet;
 
 	/* RADIUS ensures order of attrs, so just concatenate all */
-	fr_pair_cursor_head(&cursor);
-	while ((i = fr_pair_cursor_next_by_da(&cursor, attr_eap_message, TAG_ANY))) {
-		memcpy(ptr, i->vp_strvalue, i->vp_length);
-		ptr += i->vp_length;
+	for (vp = fr_cursor_head(&cursor);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
+		memcpy(ptr, vp->vp_strvalue, vp->vp_length);
+		ptr += vp->vp_length;
 	}
 
 	return eap_packet;
diff --git a/src/modules/rlm_eap/lib/base/eap_chbind.c b/src/modules/rlm_eap/lib/base/eap_chbind.c
index 389c8bd4adf..b65ce0fd6cf 100644
--- a/src/modules/rlm_eap/lib/base/eap_chbind.c
+++ b/src/modules/rlm_eap/lib/base/eap_chbind.c
@@ -254,20 +254,19 @@ chbind_packet_t *eap_chbind_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 {
 	size_t			length;
 	uint8_t 		*ptr;
-	VALUE_PAIR		*first, *vp;
+	VALUE_PAIR		*vp;
 	chbind_packet_t		*packet;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 
-	first = fr_pair_find_by_da(vps, attr_eap_channel_binding_message, TAG_ANY);
-	if (!first) return NULL;
+	if (!fr_cursor_iter_by_da_init(&cursor, &vps, attr_eap_channel_binding_message)) return NULL;
 
 	/*
 	 *	Compute the total length of the channel binding data.
 	 */
 	length = 0;
-	for (vp = fr_pair_cursor_init(&cursor, &first);
-	     vp != NULL;
-	     vp = fr_pair_cursor_next_by_da(&cursor, attr_eap_channel_binding_message, TAG_ANY)) {
+	for (vp = fr_cursor_current(&cursor);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
 		length += vp->vp_length;
 	}
 
@@ -286,9 +285,9 @@ chbind_packet_t *eap_chbind_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps)
 	 *	Copy the data over to our packet.
 	 */
 	packet = (chbind_packet_t *) ptr;
-	for (vp = fr_pair_cursor_init(&cursor, &first);
+	for (vp = fr_cursor_head(&cursor);
 	     vp != NULL;
-	     vp = fr_pair_cursor_next_by_da(&cursor, attr_eap_channel_binding_message, TAG_ANY)) {
+	     vp = fr_cursor_next(&cursor)) {
 		memcpy(ptr, vp->vp_octets, vp->vp_length);
 		ptr += vp->vp_length;
 	}
diff --git a/src/modules/rlm_eap/rlm_eap.c b/src/modules/rlm_eap/rlm_eap.c
index f3d142f3dc9..52542fd224d 100644
--- a/src/modules/rlm_eap/rlm_eap.c
+++ b/src/modules/rlm_eap/rlm_eap.c
@@ -727,7 +727,7 @@ static rlm_rcode_t mod_post_proxy(void *instance, UNUSED void *thread, REQUEST *
 	char		*p;
 	VALUE_PAIR	*vp;
 	eap_session_t	*eap_session;
-	vp_cursor_t	cursor;
+	fr_cursor_t	cursor;
 	rlm_eap_t const	*inst = instance;
 
 	/*
@@ -822,8 +822,9 @@ static rlm_rcode_t mod_post_proxy(void *instance, UNUSED void *thread, REQUEST *
 	 *	This is vendor Cisco (9), Cisco-AVPair
 	 *	attribute (1)
 	 */
-	fr_pair_cursor_init(&cursor, &request->proxy->reply->vps);
-	while ((vp = fr_pair_cursor_next_by_da(&cursor, attr_cisco_avpair, TAG_ANY))) {
+	for (vp = fr_cursor_iter_by_da_init(&cursor, &request->proxy->reply->vps, attr_cisco_avpair);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
 		/*
 		 *	If it's "leap:session-key", then stop.
 		 *
diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
index a3dbf9aac5a..f5c8dfd459f 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
@@ -423,7 +423,7 @@ unexpected:
  *
  * FIXME do something with mandatory
  */
-ssize_t eap_fast_decode_pair(TALLOC_CTX *ctx, vp_cursor_t *cursor, fr_dict_attr_t const *parent,
+ssize_t eap_fast_decode_pair(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t const *parent,
 			     uint8_t const *data, size_t data_len,
 			     void *decoder_ctx)
 {
@@ -461,7 +461,7 @@ ssize_t eap_fast_decode_pair(TALLOC_CTX *ctx, vp_cursor_t *cursor, fr_dict_attr_
 			fr_pair_to_unknown(vp);
 			fr_pair_value_memcpy(vp, p, len);
 		}
-		fr_pair_cursor_append(cursor, vp);
+		fr_cursor_append(cursor, vp);
 		p += len;
 	}
 
@@ -478,7 +478,7 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *e
 {
 	rlm_rcode_t			rcode = RLM_MODULE_REJECT;
 	VALUE_PAIR			*vp;
-	vp_cursor_t			cursor;
+	fr_cursor_t			cursor;
 
 	eap_fast_tunnel_t	*t = talloc_get_type_abort(tls_session->opaque, eap_fast_tunnel_t);
 
@@ -501,7 +501,7 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *e
 		 * Copy what we need into the TTLS tunnel and leave
 		 * the rest to be cleaned up.
 		 */
-		for (vp = fr_pair_cursor_init(&cursor, &reply->vps); vp; vp = fr_pair_cursor_next(&cursor)) {
+		for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 			if (fr_dict_vendor_num_by_da(vp->da) != VENDORPEC_MICROSOFT) continue;
 
 			/* FIXME must be a better way to capture/re-derive this later for ISK */
@@ -538,9 +538,11 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *e
 		/*
 		 *	Copy the EAP-Message back to the tunnel.
 		 */
-		(void) fr_pair_cursor_init(&cursor, &reply->vps);
+		(void) fr_cursor_init(&cursor, &reply->vps);
 
-		while ((vp = fr_pair_cursor_next_by_da(&cursor, attr_eap_message, TAG_ANY)) != NULL) {
+		for (vp = fr_cursor_iter_by_da_init(&cursor, &reply->vps, attr_eap_message);
+		     vp;
+		     vp = fr_cursor_next(&cursor)) {
 			eap_fast_tlv_append(tls_session, attr_eap_fast_eap_payload, true, vp->vp_length, vp->vp_octets);
 		}
 
@@ -798,12 +800,14 @@ static FR_CODE eap_fast_process_tlvs(REQUEST *request, eap_session_t *eap_sessio
 {
 	eap_fast_tunnel_t		*t = talloc_get_type_abort(tls_session->opaque, eap_fast_tunnel_t);
 	VALUE_PAIR			*vp;
-	vp_cursor_t			cursor;
+	fr_cursor_t			cursor;
 	eap_tlv_crypto_binding_tlv_t	my_binding, *binding = NULL;
 
 	memset(&my_binding, 0, sizeof(my_binding));
 
-	for (vp = fr_pair_cursor_init(&cursor, &fast_vps); vp; vp = fr_pair_cursor_next(&cursor)) {
+	for (vp = fr_cursor_init(&cursor, &fast_vps);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
 		FR_CODE code = FR_CODE_ACCESS_REJECT;
 		char *value;
 
@@ -902,7 +906,7 @@ FR_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session)
 {
 	FR_CODE			code;
 	VALUE_PAIR		*fast_vps = NULL;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	uint8_t const		*data;
 	size_t			data_len;
 	eap_fast_tunnel_t	*t;
@@ -955,7 +959,7 @@ FR_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session)
 		return FR_CODE_ACCESS_CHALLENGE;
 	}
 
-	fr_pair_cursor_init(&cursor, &fast_vps);
+	fr_cursor_init(&cursor, &fast_vps);
 	if (eap_fast_decode_pair(request, &cursor, attr_eap_fast_tlv,
 				 data, data_len, NULL) < 0) return FR_CODE_ACCESS_REJECT;
 
diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.h b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.h
index a9597934b87..94a2a9d00e9 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.h
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.h
@@ -257,6 +257,6 @@ FR_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session)
 /*
  *	A bunch of EAP-FAST helper functions.
  */
-ssize_t		eap_fast_decode_pair(TALLOC_CTX *ctx, vp_cursor_t *cursor, fr_dict_attr_t const *parent,
+ssize_t		eap_fast_decode_pair(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t const *parent,
 			     	     uint8_t const *data, size_t data_len,
 			     	     UNUSED void *decoder_ctx);
diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
index 98695aca111..e27ad679cfb 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
@@ -319,7 +319,7 @@ static int _session_ticket(SSL *s, uint8_t const *data, int len, void *arg)
 	REQUEST			*request = (REQUEST *)SSL_get_ex_data(s, FR_TLS_EX_INDEX_REQUEST);
 	eap_fast_tunnel_t	*t;
 	VALUE_PAIR		*fast_vps = NULL, *vp;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	char const		*errmsg;
 	int			dlen, plen;
 	uint16_t		length;
@@ -380,13 +380,15 @@ error:
 
 	RHEXDUMP(L_DBG_LVL_MAX, (uint8_t const *)&opaque_plaintext, plen, "PAC-Opaque plaintext data section");
 
-	fr_pair_cursor_init(&cursor, &fast_vps);
+	fr_cursor_init(&cursor, &fast_vps);
 	if (eap_fast_decode_pair(tls_session, &cursor, attr_eap_fast_pac_opaque_tlv, (uint8_t *)&opaque_plaintext, plen, NULL) < 0) {
 		errmsg = fr_strerror();
 		goto error;
 	}
 
-	for (vp = fr_pair_cursor_head(&cursor); vp; vp = fr_pair_cursor_next(&cursor)) {
+	for (vp = fr_cursor_head(&cursor);
+	     vp;
+	     vp = fr_cursor_next(&cursor)) {
 		char *value;
 
 		if (vp->da == attr_eap_fast_pac_info_pac_type) {
diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
index f8f36cda456..2059a921e7a 100644
--- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
@@ -270,7 +270,7 @@ static VALUE_PAIR *eap_peap_inner_to_pairs(UNUSED REQUEST *request, RADIUS_PACKE
 	size_t 		total;
 	uint8_t		*p;
 	VALUE_PAIR	*vp = NULL, *head = NULL;
-	vp_cursor_t	cursor;
+	fr_cursor_t	cursor;
 
 	if (data_len > 65535) return NULL; /* paranoia */
 
@@ -293,8 +293,8 @@ static VALUE_PAIR *eap_peap_inner_to_pairs(UNUSED REQUEST *request, RADIUS_PACKE
 	memcpy(p + EAP_HEADER_LEN, data, total);
 	fr_pair_value_memsteal(vp, p);
 
-	fr_pair_cursor_init(&cursor, &head);
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_init(&cursor, &head);
+	fr_cursor_append(&cursor, vp);
 	while (total < data_len) {
 		vp = fr_pair_afrom_da(packet, attr_eap_message);
 		if (!vp) {
@@ -306,7 +306,7 @@ static VALUE_PAIR *eap_peap_inner_to_pairs(UNUSED REQUEST *request, RADIUS_PACKE
 
 		total += vp->vp_length;
 
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 	}
 
 	return head;
@@ -321,7 +321,7 @@ static int eap_peap_inner_from_pairs(REQUEST *request, tls_session_t *tls_sessio
 {
 	rad_assert(vp != NULL);
 	VALUE_PAIR *this;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 
 	/*
 	 *	Send the EAP data in the first attribute, WITHOUT the
@@ -333,10 +333,10 @@ static int eap_peap_inner_from_pairs(REQUEST *request, tls_session_t *tls_sessio
 	/*
 	 *	Send the rest of the EAP data, but skipping the first VP.
 	 */
-	fr_pair_cursor_init(&cursor, &vp);
-	for (this = fr_pair_cursor_next(&cursor);
+	fr_cursor_init(&cursor, &vp);
+	for (this = fr_cursor_next(&cursor);
 	     this;
-	     this = fr_pair_cursor_next(&cursor)) {
+	     this = fr_cursor_next(&cursor)) {
 		(tls_session->record_from_buff)(&tls_session->clean_in, this->vp_octets, this->vp_length);
 	}
 
diff --git a/src/protocols/dhcpv6/dhcpv6.h b/src/protocols/dhcpv6/dhcpv6.h
index 10072fb7723..2e65ceca86f 100644
--- a/src/protocols/dhcpv6/dhcpv6.h
+++ b/src/protocols/dhcpv6/dhcpv6.h
@@ -56,5 +56,5 @@ ssize_t		fr_dhcpv6_encode_option(uint8_t *out, size_t outlen, fr_cursor_t *curso
 /*
  *	decode.c
  */
-ssize_t		fr_dhcpv6_decode_option(TALLOC_CTX *ctx, vp_cursor_t *cursor,
+ssize_t		fr_dhcpv6_decode_option(TALLOC_CTX *ctx, fr_cursor_t *cursor,
 					uint8_t const *data, size_t data_len, void *decoder_ctx);
diff --git a/src/protocols/tacacs/tacacs.c b/src/protocols/tacacs/tacacs.c
index f14a2cd0329..1a8aca6bfcc 100644
--- a/src/protocols/tacacs/tacacs.c
+++ b/src/protocols/tacacs/tacacs.c
@@ -298,7 +298,7 @@ int tacacs_encode(RADIUS_PACKET * const packet, char const * const secret)
 	uint16_t		length_hdr;
 	uint16_t		length_body;
 	VALUE_PAIR const	*vp;
-	vp_cursor_t		cursor;
+	fr_cursor_t		cursor;
 	tacacs_packet_t		*pkt;
 	struct {
 		VALUE_PAIR const	*server_msg;
@@ -325,7 +325,9 @@ int tacacs_encode(RADIUS_PACKET * const packet, char const * const secret)
 		: TAC_PLUS_UNENCRYPTED_FLAG;
 
 	length_body = 0;
-	for (vp = fr_pair_cursor_init(&cursor, &packet->vps); vp != NULL; vp = fr_pair_cursor_next(&cursor)) {
+	for (vp = fr_cursor_init(&cursor, &packet->vps);
+	     vp != NULL;
+	     vp = fr_cursor_next(&cursor)) {
 		VP_VERIFY(vp);
 
 		if (!vp->da->flags.internal) continue;
@@ -468,7 +470,7 @@ skip_fields:
 }
 
 
-static int tacacs_decode_field(TALLOC_CTX *ctx, vp_cursor_t *cursor, fr_dict_attr_t const *da,
+static int tacacs_decode_field(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dict_attr_t const *da,
 			       char const *field_name, uint8_t **field_data, size_t field_len, size_t *remaining)
 {
 	uint8_t *p;
@@ -492,7 +494,7 @@ static int tacacs_decode_field(TALLOC_CTX *ctx, vp_cursor_t *cursor, fr_dict_att
 	fr_pair_value_bstrncpy(vp, p, field_len);
 	p += field_len;
 	*remaining -= field_len;
-	fr_pair_cursor_append(cursor, vp);
+	fr_cursor_append(cursor, vp);
 
 	*field_data = p;
 
@@ -505,13 +507,13 @@ int tacacs_decode(RADIUS_PACKET * const packet)
 {
 	int i;
 	tacacs_packet_t *pkt;
-	vp_cursor_t cursor;
+	fr_cursor_t cursor;
 	VALUE_PAIR *vp;
 	uint8_t *p;
 	uint32_t session_id;
 	size_t remaining;
 
-	fr_pair_cursor_init(&cursor, &packet->vps);
+	fr_cursor_init(&cursor, &packet->vps);
 
 	/*
 	 *	There MUST be at least a TACACS packert header, and
@@ -524,21 +526,21 @@ int tacacs_decode(RADIUS_PACKET * const packet)
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_version_minor));
 	vp->vp_uint8 = pkt->hdr.ver.minor;
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_packet_type));
 	vp->vp_uint8 = pkt->hdr.type;
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	packet->code = pkt->hdr.type;
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_sequence_number));
 	vp->vp_uint8 = pkt->hdr.seq_no;
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_session_id));
 	vp->vp_uint32 = ntohl(pkt->hdr.session_id);
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 	session_id = vp->vp_uint32;
 
 	switch ((tacacs_type_t)pkt->hdr.type) {
@@ -557,20 +559,20 @@ int tacacs_decode(RADIUS_PACKET * const packet)
 			 */
 			MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_action));
 			vp->vp_uint8 = pkt->authen.start.action;
-			fr_pair_cursor_append(&cursor, vp);
+			fr_cursor_append(&cursor, vp);
 
 			MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_privilege_level));
 			vp->vp_uint8 = pkt->authen.start.priv_lvl;
-			fr_pair_cursor_append(&cursor, vp);
+			fr_cursor_append(&cursor, vp);
 
 			MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_type));
 			vp->vp_uint8 = pkt->authen.start.authen_type;
-			fr_pair_cursor_append(&cursor, vp);
+			fr_cursor_append(&cursor, vp);
 
 			MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_service));
 			if (!vp) return -1;
 			vp->vp_uint8 = pkt->authen.start.authen_service;
-			fr_pair_cursor_append(&cursor, vp);
+			fr_cursor_append(&cursor, vp);
 
 			/*
 			 *	Decode 4 fields, based on their "length"
@@ -626,7 +628,7 @@ int tacacs_decode(RADIUS_PACKET * const packet)
 			 */
 			if (pkt->authen.cont.flags & TAC_PLUS_CONTINUE_FLAG_ABORT) {
 				if (!ntohs(pkt->authen.cont.data_len) ||
-				    !(vp = fr_pair_cursor_tail(&cursor))) {
+				    !(vp = fr_cursor_tail(&cursor))) {
 					fr_strerror_printf("Client aborted authentication session %u "
 							   "with no message", session_id);
 					return -2;
@@ -671,19 +673,19 @@ int tacacs_decode(RADIUS_PACKET * const packet)
 		 */
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_method));
 		vp->vp_uint8 = pkt->author.req.authen_method;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_privilege_level));
 		vp->vp_uint8 = pkt->author.req.priv_lvl;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_type));
 		vp->vp_uint8 = pkt->author.req.authen_type;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_service));
 		vp->vp_uint8 = pkt->author.req.authen_service;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		/*
 		 *	Decode 3 fields, based on their "length"
@@ -741,23 +743,23 @@ int tacacs_decode(RADIUS_PACKET * const packet)
 		 */
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_accounting_flags));
 		vp->vp_uint8 = pkt->acct.req.flags;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_method));
 		vp->vp_uint8 = pkt->acct.req.authen_method;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_privilege_level));
 		vp->vp_uint8 = pkt->acct.req.priv_lvl;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_type));
 		vp->vp_uint8 = pkt->acct.req.authen_type;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		MEM(vp = fr_pair_afrom_da(packet, attr_tacacs_authentication_service));
 		vp->vp_uint8 = pkt->acct.req.authen_service;
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 
 		/*
 		 *	Decode 3 fields, based on their "length"
diff --git a/src/protocols/vqp/vqp.c b/src/protocols/vqp/vqp.c
index 85791cb6fa8..dc1d31d14ca 100644
--- a/src/protocols/vqp/vqp.c
+++ b/src/protocols/vqp/vqp.c
@@ -274,32 +274,32 @@ int vqp_decode(RADIUS_PACKET *packet)
 	uint8_t		*ptr, *end;
 	int		attr;
 	size_t		attr_len;
-	vp_cursor_t	cursor;
+	fr_cursor_t	cursor;
 	VALUE_PAIR	*vp;
 
 	if (!packet || !packet->data) return -1;
 
 	if (packet->data_len < VQP_HDR_LEN) return -1;
 
-	fr_pair_cursor_init(&cursor, &packet->vps);
+	fr_cursor_init(&cursor, &packet->vps);
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_vqp_packet_type));
 	vp->vp_uint32 = packet->data[1];
 	vp->vp_tainted = true;
 	DEBUG2("&%pP", vp);
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_vqp_error_code));
 	vp->vp_uint32 = packet->data[2];
 	vp->vp_tainted = true;
 	DEBUG2("&%pP", vp);
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	MEM(vp = fr_pair_afrom_da(packet, attr_vqp_sequence_number));
 	vp->vp_uint32 = packet->id; /* already set by vqp_recv */
 	vp->vp_tainted = true;
 	DEBUG2("&%pP", vp);
-	fr_pair_cursor_append(&cursor, vp);
+	fr_cursor_append(&cursor, vp);
 
 	ptr = packet->data + VQP_HDR_LEN;
 	end = packet->data + packet->data_len;
@@ -349,7 +349,7 @@ int vqp_decode(RADIUS_PACKET *packet)
 		ptr += attr_len;
 		vp->vp_tainted = true;
 		DEBUG2("&%pP", vp);
-		fr_pair_cursor_append(&cursor, vp);
+		fr_cursor_append(&cursor, vp);
 	}
 
 	/*