Global dict_attr_valid (fr_dict_attr_t *da)

we need to check length of none vendor attributes.

Global fr_bio_chain (fr_bio_t *first, fr_bio_t *second)

- this likely needs to be public

Global fr_bio_dedup_timer (UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)

- expire items from the pending list, too

Global fr_bio_fd_read_retry (fr_bio_fd_t *my, ssize_t *rcode_p, int *tries_p)

- do we want the callbacks to notify the previous BIO in the chain? That way the top-level BIO can notify the application.

Global fr_bio_fd_socket_unix_bind (fr_bio_fd_t *my, fr_bio_fd_config_t const *cfg)

- this function only does a tiny bit of what fr_server_domain_socket_peercred() and fr_server_domain_socket_perm() do. Those functions do a lot more sanity checks.

Global fr_bio_fd_write_retry (fr_bio_fd_t *my, ssize_t *rcode_p, int *tries_p, size_t size)

- do we want the callbacks to notify the previous BIO in the chain? That way the top-level BIO can notify the application.

Global fr_bio_mem_call_verify (fr_bio_t *bio, void *packet_ctx, size_t *size)

- have this as a parameter to the read routines, so that they only return complete packets?

Global fr_bio_queue_alloc (TALLOC_CTX *ctx, size_t max_saved, fr_bio_queue_saved_t saved, fr_bio_queue_callback_t sent, fr_bio_queue_callback_t cancel, fr_bio_t *next))

- we need to mark up the bio as "blocked", and then have a write_blocked() API? ugh. or just add bool blocked and bool eof to both read/write bios

Global fr_bio_unchain (fr_bio_t *bio)

- this likely needs to be public

Global fr_canonicalize_error (TALLOC_CTX *ctx, char **spaces, char **text, ssize_t slen, char const *fmt)

merge with above function (log_request_marker)

Global fr_cmd_s::help

- long / short help

Global fr_exec_fork_nowait (fr_event_list_t *el, char **argv_in, char **env_in, bool env_inherit, bool debug)

- maybe take an fr_dcursor_t instead of env_pairs? That would allow finer-grained control over the attributes to put into the environment.

Global fr_exec_fork_wait (pid_t *pid_p, int *stdin_fd, int *stdout_fd, int *stderr_fd, char **argv_in, char **env_usr, bool env_inherit, bool debug)

- maybe take an fr_dcursor_t instead of env_pairs? That would allow finer-grained control over the attributes to put into the environment.

Global fr_io_nak_expire (fr_io_thread_t *thread, fr_time_t now)

- make the size of the NAK list configurable. For now, a hard-coded limit of 1000 isn't terrible. If there are more NAK IPs than that, the admin should set up firewall rules to block traffic.

Struct fr_message_set_s

Add a flag for UDP-style protocols, where we can put the message into the ring buffer. This helps with locality of reference, and removes the need to track two separate things.

Global fr_pair_fprint (FILE *fp, fr_pair_t const *vp)

- This function should print flattened lists.

Global fr_pair_validate_debug (fr_pair_t const *failed[2])

add thread specific talloc contexts.

Global fr_regex_cmp_op (fr_token_t op, fr_value_box_t const *a, fr_value_box_t const *b)

- allow /foo/i on the RHS

Global fr_vasprintf_internal (TALLOC_CTX *ctx, char const *fmt, va_list ap, bool suppress_secrets)

Do something sensible with 'n$', though it's probably not actually used anywhere in our code base.

Global log_parse_section (CONF_SECTION *cs)

- we should probably allow for TCP sockets, too. But then those can block. So we then also need a way to buffer outbound log messages, and discard log messages if the buffer is full.

Global mod_map_proc (unlang_result_t *p_result, map_ctx_t const *mpctx, request_t *request, fr_value_box_list_t *url, map_list_t const *maps)

For xlat expansions we need to parse the raw URL first, and then apply different escape functions to the different parts.

Global pair_ctx_set_from_substr (fr_pair_ctx_t *pair_ctx, fr_sbuff_t *in)

- allow for child contexts, so that the parser can parse TLVs into vp->vp_children. The change requires nested cursors, but not necessarily nested contexts. One design is a fr_dlist_t of pair_ctx, where the parser always operates on the last pair_ctx in the list. When the context changes to the parent of an attribute, pair_ctx also changes to a parent context. The list resembles the da stack, but with child cursors as well.

Global sigtran_client_link_up (sigtran_conn_t const **out, sigtran_conn_conf_t const *conn_conf)

Return struct representing the connection

Global STATS_HEADER_COMMON

- if we need additional tracking data (rb trees, dlists, etc.), they can go here.

Global stats_merge_internal (fr_stats_link_t const *def, void *out, void const *in)

- ensure that the struct magic is the same as the def magic

Global tcp_handle_t::src_port

- not set by socket_client_tcp()

Global unlang_fixup_edit (map_t *map, void *ctx)

- this is only called for CONF_PAIR maps, not for CONF_SECTION. So when we parse nested maps, there's no validation done of the CONF_SECTION. In order to fix this, we need to have map_afrom_cs() call the validation function for the CONF_SECTION before recursing.

Global upcast_cmp [FR_TYPE_MAX+1][FR_TYPE_MAX+1]

- check this table against fr_type_promote()

Global virtual_module_determine_dict (module_rlm_virtual_t *vm, CONF_SECTION *cs)

- look at the attributes, to determine which dictionary that they belong to?

- if there is no dictionary, then compile it once for each possible dictionary?