static void handle_request(REQUEST *request, VALUE_PAIR *vp)
{
	char *input_data;
	int input_len;
	char *output_data;
	int output_len;
	char *smime_msg;
	ATTR_REQ_OUT *outstruct;
	
	input_len = unpack_mime_text((char *)vp->data.octets, vp->length, &input_data);
	ATTR_REQ_IN *attr_request = parse_attr_req(input_data, input_len);
	if (!attr_request)
	{
		return;
	}

	X509 *cert = get_matching_certificate(request, attr_request->proxydn);
	if (!cert)
	{
		return;
	}

	outstruct = get_attr_req_out(attr_request);
	output_len = attr_req_out_to_string(outstruct, &output_data);
	smime_msg = pack_smime_text(output_data, private_key, cert);
	VALUE_PAIR *avp_smime = pairmake("Moonshot-Request",smime_msg, T_OP_EQ);
	pairadd(&request->reply->vps, avp_smime);
	return;
}

/*
 *	First, look for Exec-Program && Exec-Program-Wait.
 *
 *	Then, call exec_dispatch.
 */
static int exec_postauth(void *instance, REQUEST *request)
{
	int result;
	int exec_wait = 0;
	VALUE_PAIR *vp, *tmp;
	rlm_exec_t *inst = (rlm_exec_t *) instance;

	vp = pairfind(request->reply->vps, PW_EXEC_PROGRAM, 0);
	if (vp) {
		exec_wait = 0;

	} else if ((vp = pairfind(request->reply->vps, PW_EXEC_PROGRAM_WAIT, 0)) != NULL) {
		exec_wait = 1;
	}
	if (!vp) {
		if (!inst->program) return RLM_MODULE_NOOP;
		
		return exec_dispatch(instance, request);
	}

	tmp = NULL;
	result = radius_exec_program(vp->vp_strvalue, request, exec_wait,
				     NULL, 0, request->packet->vps, &tmp,
				     inst->shell_escape);

	/*
	 *	Always add the value-pairs to the reply.
	 */
	pairmove(&request->reply->vps, &tmp);
	pairfree(&tmp);

	if (result < 0) {
		/*
		 *	Error. radius_exec_program() returns -1 on
		 *	fork/exec errors.
		 */
		tmp = pairmake("Reply-Message", "Access denied (external check failed)", T_OP_SET);
		pairadd(&request->reply->vps, tmp);

		RDEBUG2("Login incorrect (external check failed)");

		request->reply->code = PW_AUTHENTICATION_REJECT;
		return RLM_MODULE_REJECT;
	}
	if (result > 0) {
		/*
		 *	Reject. radius_exec_program() returns >0
		 *	if the exec'ed program had a non-zero
		 *	exit status.
		 */
		request->reply->code = PW_AUTHENTICATION_REJECT;
		RDEBUG2("Login incorrect (external check said so)");
		return RLM_MODULE_REJECT;
	}

	return RLM_MODULE_OK;
}

void cbtls_info(const SSL *s, int where, int ret)
{
	const char *str, *state;
	int w;
	REQUEST *request = SSL_get_ex_data(s, FR_TLS_EX_INDEX_REQUEST);
	char buffer[1024];

	w = where & ~SSL_ST_MASK;
	if (w & SSL_ST_CONNECT) str="    TLS_connect";
	else if (w & SSL_ST_ACCEPT) str="    TLS_accept";
	else str="    (other)";

	state = SSL_state_string_long(s);
	state = state ? state : "NULL";
	buffer[0] = '\0';

	if (where & SSL_CB_LOOP) {
		RDEBUG2("%s: %s", str, state);
	} else if (where & SSL_CB_HANDSHAKE_START) {
		RDEBUG2("%s: %s", str, state);
	} else if (where & SSL_CB_HANDSHAKE_DONE) {
		RDEBUG2("%s: %s", str, state);
	} else if (where & SSL_CB_ALERT) {
		str=(where & SSL_CB_READ)?"read":"write";

		snprintf(buffer, sizeof(buffer), "TLS Alert %s:%s:%s",
			 str,
			 SSL_alert_type_string_long(ret),
			 SSL_alert_desc_string_long(ret));
	} else if (where & SSL_CB_EXIT) {
		if (ret == 0) {
			snprintf(buffer, sizeof(buffer), "%s: failed in %s",
				 str, state);

		} else if (ret < 0) {
			if (SSL_want_read(s)) {
				RDEBUG2("%s: Need to read more data: %s",
				       str, state);
			} else {
				snprintf(buffer, sizeof(buffer),
					 "%s: error in %s", str, state);
			}
		}
	}

	if (buffer[0]) {
		radlog(L_ERR, "%s", buffer);
		
		if (request) {
			VALUE_PAIR *vp;
			
			vp = pairmake("Module-Failure-Message", buffer, T_OP_ADD);
			if (vp) pairadd(&request->packet->vps, vp);
		}
	}
}

static int eap_post_auth(void *instance, REQUEST *request)
{
	rlm_eap_t	*inst = instance;
	VALUE_PAIR	*vp;
	EAP_HANDLER	*handler;
	eap_packet_t	*eap_packet;
	
	/*
	 * Only build a failure message if something previously rejected the request
	 */
	vp = pairfind(request->config_items, PW_POSTAUTHTYPE, 0, TAG_ANY);

	if (!vp || (vp->vp_integer != PW_POSTAUTHTYPE_REJECT)) return RLM_MODULE_NOOP;
	
	if (!pairfind(request->packet->vps, PW_EAP_MESSAGE, 0, TAG_ANY)) {
		RDEBUG2("Request didn't contain an EAP-Message, not inserting EAP-Failure");
		return RLM_MODULE_NOOP;
	}
	
	if (pairfind(request->reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY)) {
		RDEBUG2("Reply already contained an EAP-Message, not inserting EAP-Failure");
		return RLM_MODULE_NOOP;
	}
	
	eap_packet = eap_vp2packet(request->packet->vps);
	if (eap_packet == NULL) {
		radlog_request(L_ERR, 0, request, "Malformed EAP Message");
		return RLM_MODULE_FAIL;
	}

	handler = eap_handler(inst, &eap_packet, request);
	if (handler == NULL) {
		RDEBUG2("Failed to get handler, probably already removed, not inserting EAP-Failure");
		return RLM_MODULE_NOOP;
	}

	RDEBUG2("Request was previously rejected, inserting EAP-Failure");
	eap_fail(handler);
	eap_handler_free(inst, handler);
	
	/*
	 * Make sure there's a message authenticator attribute in the response
	 * RADIUS protocol code will calculate the correct value later...
	 */
	vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
	if (!vp) {
		vp = pairmake("Message-Authenticator",
				  "0x00", T_OP_EQ);
		rad_assert(vp != NULL);
		pairadd(&(request->reply->vps), vp);
	}

	return RLM_MODULE_UPDATED;
}

/** Create a pair, and add it to a particular list of VPs
 *
 * Note that this function ALWAYS returns.  If we're OOM, then it causes the
 * server to exit!
 *
 * @param[in] request current request.
 * @param[in] vps to modify.
 * @param[in] attribute name.
 * @param[in] value attribute value.
 * @param[in] operator fr_tokens value.
 * @return a new VALUE_PAIR.
 */
VALUE_PAIR *radius_pairmake(UNUSED REQUEST *request, VALUE_PAIR **vps,
			    const char *attribute, const char *value,
			    int operator)
{
	VALUE_PAIR *vp;

	vp = pairmake(attribute, value, operator);
	if (!vp) return NULL;

	if (vps) pairadd(vps, vp);

	return vp;
}

static int
remotedb_answer_builder(REQUEST *request, const char *password, const char *vlan)
{
        VALUE_PAIR *pair;

        radlog(L_DBG, "Building answer : password = %s, vlan = %s\n", password, vlan);

        pair = pairmake("NT-Password", password, T_OP_SET);	
        pairmove(&request->config_items, &pair);
        pairfree(&pair);

        pair = pairmake("Tunnel-Private-Group-Id", vlan, T_OP_SET);
        pairadd(&request->reply->vps, pair);
        
        pair = pairmake("Tunnel-Medium-Type", "6", T_OP_SET);
        pairadd(&request->reply->vps, pair);
        
        pair = pairmake("Tunnel-Type", "13", T_OP_SET);
        pairadd(&request->reply->vps, pair);
        
        return RLM_MODULE_OK;
}

/*
 *    Write accounting information to this modules database.
 */
static int stg_accounting(void *, REQUEST * request)
{
    const STG_PAIR * pairs;
    const STG_PAIR * pair;
    size_t count = 0;

    instance = instance;

    DEBUG("rlm_stg: stg_accounting()");

    VALUE_PAIR * svc = pairfind(request->packet->vps, PW_SERVICE_TYPE);
    VALUE_PAIR * sessid = pairfind(request->packet->vps, PW_ACCT_SESSION_ID);
    VALUE_PAIR * sttype = pairfind(request->packet->vps, PW_ACCT_STATUS_TYPE);

    if (!sessid) {
        DEBUG("rlm_stg: stg_accounting() Acct-Session-ID undefined");
        return RLM_MODULE_FAIL;
    }

    if (sttype) {
        DEBUG("Acct-Status-Type := %s", sttype->vp_strvalue);
        if (svc) {
            DEBUG("rlm_stg: stg_accounting() Service-Type defined as '%s'", svc->vp_strvalue);
            pairs = stgAccountingImpl((const char *)request->username->vp_strvalue, (const char *)svc->vp_strvalue, (const char *)sttype->vp_strvalue, (const char *)sessid->vp_strvalue);
        } else {
            DEBUG("rlm_stg: stg_accounting() Service-Type undefined");
            pairs = stgAccountingImpl((const char *)request->username->vp_strvalue, "", (const char *)sttype->vp_strvalue, (const char *)sessid->vp_strvalue);
        }
    } else {
        DEBUG("rlm_stg: stg_accounting() Acct-Status-Type := NULL");
        return RLM_MODULE_OK;
    }
    if (!pairs) {
        DEBUG("rlm_stg: stg_accounting() failed.");
        return RLM_MODULE_REJECT;
    }

    pair = pairs;
    while (!emptyPair(pair)) {
        VALUE_PAIR * pwd = pairmake(pair->key, pair->value, T_OP_SET);
        pairadd(&request->reply->vps, pwd);
        ++pair;
        ++count;
    }
    deletePairs(pairs);

    if (count)
        return RLM_MODULE_UPDATED;

    return RLM_MODULE_OK;
}

int proxy_handle_request(REQUEST *request)
{
	char *cert_message;
	VALUE_PAIR *vp;
	switch (request->packet->code) //it's allowed to handle multiple requests, the request type is based on radius responses
   {
   	case PW_AUTHENTICATION_REQUEST:
      	pack_mime_cert(public_certificate, &cert_message);
      	VALUE_PAIR *avp_certificate;
      	avp_certificate = pairmake("AVP_CERTIFICATE_RADIUS",
                                       cert_message, T_OP_EQ); //AVP_CERTIFICATE_RADIUS is an AVP that stores the certificate chain
            pairadd(&request->reply->vps, avp_certificate); //add AVP
            return RLM_MODULE_UPDATED;                      //we are basically saying that our AVPs are updated
            
        case PW_AUTHENTICATION_ACK:
            
            vp = request->packet->vps;
            
            do {
                if (vp->attribute == ATTR_SMIME_REQUEST) //detect if AVP_PROXY_REQUEST is sent by the idp module
                {
                    char *message_attributes = unpack_smime_text((char *)vp->data.octets, private_key, private_certificate);
					char *out_message = obtain_attributes(message_attributes);
                    VALUE_PAIR *avp_attributes;
                    avp_attributes = pairmake("AVP_PROXY_ATTRIBUTES",
                                        out_message, T_OP_EQ); //AVP_PROXY_ATTRIBUTES is an AVP that stores the attributes
                    pairadd(&request->reply->vps, avp_attributes); //add AVP
                    return RLM_MODULE_UPDATED;                      //return statement that is needed when AVPs are updated
                }
            } while ((vp = vp -> next) != 0);
            
            
            
            
    }
    
    
}

/*
 *	Find the named user in this modules database.  Create the set
 *	of attribute-value pairs to check and reply with for this user
 *	from the database. The authentication code only needs to check
 *	the password, the rest is done here.
 */
static int yubikey_authorize(void *instance, REQUEST *request)
{
    //	VALUE_PAIR *state;
    //	VALUE_PAIR *reply;

    if (pairfind(request->config_items, PW_AUTHTYPE) != NULL)
    {
        RDEBUG2("WARNING: Auth-Type already set.  Not setting to YUBIKEY");
        return RLM_MODULE_NOOP;
    }

    RDEBUG("Setting 'Auth-Type := YUBIKEY'");
    pairadd(&request->config_items,
            pairmake("Auth-Type", "YUBIKEY", T_OP_EQ));
    return RLM_MODULE_OK;


    /* quiet the compiler */
    instance = instance;
    request = request;
    DEBUG("rlm_yubikey: Authorizing user %s", request->username->vp_strvalue);
    return RLM_MODULE_OK;
    /*
     *  Look for the 'state' attribute.
     */
    /*	state =  pairfind(request->packet->vps, PW_STATE);
            if (state != NULL) {
                    RDEBUG("Found reply to access challenge");
                    return RLM_MODULE_OK;
            }
     */
    /*
     *  Create the challenge, and add it to the reply.
     */
    /*     	reply = pairmake("Reply-Message", "This is a challenge", T_OP_EQ);
            pairadd(&request->reply->vps, reply);
            state = pairmake("State", "0", T_OP_EQ);
            pairadd(&request->reply->vps, state);
     */
    /*
     *  Mark the packet as an Access-Challenge packet.
     *
     *  The server will take care of sending it to the user.
     */
    /*	request->reply->code = PW_ACCESS_CHALLENGE;
            RDEBUG("Sending Access-Challenge.");
            return RLM_MODULE_OK;
     */
}

/*
 *	add_reply() adds either MS-CHAP2-Success or MS-CHAP-Error
 *	attribute to reply packet
 */
void mschap_add_reply(REQUEST *request, VALUE_PAIR** vp, unsigned char ident,
		      const char* name, const char* value, int len)
{
	VALUE_PAIR *reply_attr;
	reply_attr = pairmake(name, "", T_OP_EQ);
	if (!reply_attr) {
		RDEBUG("Failed to create attribute %s: %s\n", name, fr_strerror());
		return;
	}

	reply_attr->vp_octets[0] = ident;
	memcpy(reply_attr->vp_octets + 1, value, len);
	reply_attr->length = len + 1;
	pairadd(vp, reply_attr);
}

int 
rad_set_eap_id(RADIUS_PACKET* rp)
{
	VALUE_PAIR* vp = NULL;
	char eap_id[8] = {0};

	
    bzero(eap_id,sizeof(eap_id));
    snprintf(eap_id,sizeof(eap_id),"%d",rp->id);
    vp = pairmake("EAP-Id",eap_id,T_OP_SET);
    if(vp == NULL) {
		return -1;
    }
    pairadd(&rp->vps,vp);
	return 0;
}

/*
 * Add value pair to reply
 */
static void add_reply(VALUE_PAIR** vp,
		      const char* name, const uint8_t *value, size_t len)
{
	VALUE_PAIR *reply_attr;
	reply_attr = pairmake(name, "", T_OP_EQ);
	if (!reply_attr) {
		DEBUG("rlm_eap_sim: "
		      "add_reply failed to create attribute %s: %s\n",
		      name, fr_strerror());
		return;
	}

	memcpy(reply_attr->vp_strvalue, value, len);
	reply_attr->length = len;
	pairadd(vp, reply_attr);
}

/*
 *	Make a VALUE_PAIR from a policy_assignment_t*
 *
 *	The assignment operator has to be '='.
 */
static VALUE_PAIR *assign2vp(REQUEST *request,
			     const policy_assignment_t *assign)
{
	VALUE_PAIR *vp;
	FR_TOKEN operator = T_OP_EQ;
	const char *value = assign->rhs;
	char buffer[2048];

	if ((assign->rhs_type == POLICY_LEX_DOUBLE_QUOTED_STRING) &&
	    (strchr(assign->rhs, '%') != NULL)) {
		radius_xlat(buffer, sizeof(buffer), assign->rhs,
			    request, NULL, NULL);
		value = buffer;
	}

	/*
	 *	This is crappy.. fix it.
	 */
	switch (assign->assign) {
	case POLICY_LEX_ASSIGN:
		operator = T_OP_EQ;
		break;

	case POLICY_LEX_SET_EQUALS:
		operator = T_OP_SET;
		break;

	case POLICY_LEX_PLUS_EQUALS:
		operator = T_OP_ADD;
		break;

	default:
		fprintf(stderr, "Expected '=' for operator, not '%s' at line %d\n",
			fr_int2str(rlm_policy_tokens,
				     assign->assign, "?"),
			assign->item.lineno);
		return NULL;
	}

	vp = pairmake(assign->lhs, value, operator);
	if (!vp) {
		fprintf(stderr, "Failed creating pair: %s %s\n", value, fr_strerror());
	}

	return vp;
}

/*
 *
 *     Verify that a Perl SV is a string and save it in FreeRadius
 *     Value Pair Format
 *
 */
static int pairadd_sv(TALLOC_CTX *ctx, VALUE_PAIR **vps, char *key, SV *sv, FR_TOKEN op)
{
	char	    *val;
	VALUE_PAIR      *vp;

	if (SvOK(sv)) {
		val = SvPV_nolen(sv);
		vp = pairmake(ctx, vps, key, val, op);
		if (vp != NULL) {
			DEBUG("rlm_perl: Added pair %s = %s", key, val);
			return 1;
		} else {
			EDEBUG("rlm_perl: Failed to create pair %s = %s", key, val);
		}
	}
	return 0;
}

/*
 *    Find the named user in this modules database.  Create the set
 *    of attribute-value pairs to check and reply with for this user
 *    from the database. The authentication code only needs to check
 *    the password, the rest is done here.
 */
static int stg_authorize(void *, REQUEST *request)
{
    const STG_PAIR * pairs;
    const STG_PAIR * pair;
    size_t count = 0;

    instance = instance;

    DEBUG("rlm_stg: stg_authorize()");

    if (request->username) {
        DEBUG("rlm_stg: stg_authorize() request username field: '%s'", request->username->vp_strvalue);
    }
    if (request->password) {
        DEBUG("rlm_stg: stg_authorize() request password field: '%s'", request->password->vp_strvalue);
    }
    // Here we need to define Framed-Protocol
    VALUE_PAIR * svc = pairfind(request->packet->vps, PW_SERVICE_TYPE);
    if (svc) {
        DEBUG("rlm_stg: stg_authorize() Service-Type defined as '%s'", svc->vp_strvalue);
        pairs = stgAuthorizeImpl((const char *)request->username->vp_strvalue, (const char *)svc->vp_strvalue);
    } else {
        DEBUG("rlm_stg: stg_authorize() Service-Type undefined");
        pairs = stgAuthorizeImpl((const char *)request->username->vp_strvalue, "");
    }
    if (!pairs) {
        DEBUG("rlm_stg: stg_authorize() failed.");
        return RLM_MODULE_REJECT;
    }

    pair = pairs;
    while (!emptyPair(pair)) {
        VALUE_PAIR * pwd = pairmake(pair->key, pair->value, T_OP_SET);
        pairadd(&request->config_items, pwd);
        DEBUG("Adding pair '%s': '%s'", pair->key, pair->value);
        ++pair;
        ++count;
    }
    deletePairs(pairs);

    if (count)
        return RLM_MODULE_UPDATED;

    return RLM_MODULE_NOOP;
}

/*
 *	Add a "Proxy-To-Realm" attribute to the request.
 */
static void add_proxy_to_realm(VALUE_PAIR **vps, REALM *realm)
{
	VALUE_PAIR *vp;

	/*
	 *	Tell the server to proxy this request to another
	 *	realm.
	 */
	vp = pairmake("Proxy-To-Realm", realm->name, T_OP_EQ);
	if (!vp) {
		radlog(L_ERR, "no memory");
		exit(1);
	}

	/*
	 *  Add it, even if it's already present.
	 */
	pairadd(vps, vp);
}

/*
 *
 *     Verify that a Perl SV is a string and save it in FreeRadius
 *     Value Pair Format
 *
 */
static int pairadd_sv(VALUE_PAIR **vp, char *key, SV *sv, int operator) {
       char            *val;
       VALUE_PAIR      *vpp;

       if (SvOK(sv)) {
               val = SvPV_nolen(sv);
               vpp = pairmake(key, val, operator);
               if (vpp != NULL) {
                       pairadd(vp, vpp);
                       radlog(L_DBG,
                         "rlm_perl: Added pair %s = %s", key, val);
		       return 1;
               } else {
                       radlog(L_DBG,
                         "rlm_perl: ERROR: Failed to create pair %s = %s",
                         key, val);
               }
        }
       return 0;
}

static int chap_authorize(void *instance, REQUEST *request)
{

	/* quiet the compiler */
	instance = instance;
	request = request;

	if (!pairfind(request->packet->vps, PW_CHAP_PASSWORD)) {
		return RLM_MODULE_NOOP;
	}

	if (pairfind(request->config_items, PW_AUTHTYPE) != NULL) {
		RDEBUG2("WARNING: Auth-Type already set.  Not setting to CHAP");
		return RLM_MODULE_NOOP;
	}

	RDEBUG("Setting 'Auth-Type := CHAP'");
	pairadd(&request->config_items,
		pairmake("Auth-Type", "CHAP", T_OP_EQ));
	return RLM_MODULE_OK;
}

/*
 *	Find the named user in this modules database.  Create the set
 *	of attribute-value pairs to check and reply with for this user
 *	from the database. The authentication code only needs to check
 *	the password, the rest is done here.
 */
static rlm_rcode_t smsotp_authorize(void *instance, REQUEST *request)
{
	VALUE_PAIR *state;
	rlm_smsotp_t *opt = instance;

	/* quiet the compiler */
	instance = instance;
	request = request;

	/*
	 *  Look for the 'state' attribute.
	 */
	state = pairfind(request->packet->vps, PW_STATE, 0, TAG_ANY);
	if (state != NULL) {
		DEBUG("rlm_smsotp: Found reply to access challenge (AUTZ), Adding Auth-Type '%s'",opt->smsotp_authtype);
		
		pairdelete(&request->config_items, PW_AUTH_TYPE, 0, TAG_ANY); /* delete old auth-type */
		pairadd(&request->config_items, pairmake("Auth-Type", opt->smsotp_authtype, T_OP_SET));
	}

	return RLM_MODULE_OK;
}

static int stg_postauth(void *, REQUEST *request)
{
    const STG_PAIR * pairs;
    const STG_PAIR * pair;
    size_t count = 0;

    instance = instance;

    DEBUG("rlm_stg: stg_postauth()");

    VALUE_PAIR * svc = pairfind(request->packet->vps, PW_SERVICE_TYPE);

    if (svc) {
        DEBUG("rlm_stg: stg_postauth() Service-Type defined as '%s'", svc->vp_strvalue);
        pairs = stgPostAuthImpl((const char *)request->username->vp_strvalue, (const char *)svc->vp_strvalue);
    } else {
        DEBUG("rlm_stg: stg_postauth() Service-Type undefined");
        pairs = stgPostAuthImpl((const char *)request->username->vp_strvalue, "");
    }
    if (!pairs) {
        DEBUG("rlm_stg: stg_postauth() failed.");
        return RLM_MODULE_REJECT;
    }

    pair = pairs;
    while (!emptyPair(pair)) {
        VALUE_PAIR * pwd = pairmake(pair->key, pair->value, T_OP_SET);
        pairadd(&request->reply->vps, pwd);
        ++pair;
        ++count;
    }
    deletePairs(pairs);

    if (count)
        return RLM_MODULE_UPDATED;

    return RLM_MODULE_NOOP;
}