From 793cde1230391b39c6c009d78657e545f28db9a5 Mon Sep 17 00:00:00 2001
From: "Alan T. DeKok" <aland@freeradius.org>
Date: Mon, 20 Jan 2025 12:59:36 -0500
Subject: [PATCH] remove '&' from the start of the line

earlier commits didn't do that.

 perl -p -i -e 's/^&//' $(git grep -l '^&' src/tests/modules)
---
 src/tests/modules/always/set_rcode.unlang     |  2 +-
 .../modules/always/set_status_dead.unlang     |  2 +-
 .../modules/always/set_status_revive.unlang   |  2 +-
 src/tests/modules/attr_filter/bob.unlang      |  4 +-
 .../modules/attr_filter/operators.unlang      |  8 +-
 .../modules/cache_rbtree/cache-bin.unlang     | 36 ++++-----
 .../modules/cache_rbtree/cache-logic.unlang   | 36 ++++-----
 .../cache_rbtree/cache-method-bin.unlang      | 36 ++++-----
 .../cache_rbtree/cache-method-logic.unlang    | 20 ++---
 .../cache_rbtree/cache-method-update.unlang   | 12 +--
 .../modules/cache_rbtree/cache-update.unlang  | 12 +--
 .../modules/cache_rbtree/cache-xlat.unlang    | 14 ++--
 src/tests/modules/chap/chap_password.unlang   |  6 +-
 src/tests/modules/cipher/fingerprint.unlang   |  4 +-
 .../modules/cipher/rsa_encrypt_decrypt.unlang | 14 ++--
 .../modules/cipher/rsa_sign_verify.unlang     | 20 ++---
 src/tests/modules/cipher/serial.unlang        |  2 +-
 src/tests/modules/cipher/valid.unlang         |  4 +-
 src/tests/modules/client/map.unlang           |  6 +-
 src/tests/modules/client/xlat.unlang          | 12 +--
 src/tests/modules/detail/escape.unlang        |  2 +-
 src/tests/modules/detail/simple.unlang        |  2 +-
 src/tests/modules/detail/suppress.unlang      |  2 +-
 src/tests/modules/dict/map.unlang             |  4 +-
 .../modules/eap_sim/sim_xlat_id_aka.unlang    | 18 ++---
 .../sim_xlat_id_aka_decrypt_no_tag.unlang     |  6 +-
 .../modules/eap_sim/sim_xlat_id_error.unlang  |  4 +-
 .../modules/eap_sim/sim_xlat_id_sim.unlang    |  4 +-
 src/tests/modules/exec/async.unlang           |  4 +-
 src/tests/modules/exec/backticks_list.unlang  |  4 +-
 src/tests/modules/exec/sync.unlang            | 14 ++--
 src/tests/modules/files/any.unlang            |  2 +-
 src/tests/modules/files/compound_key.unlang   |  4 +-
 src/tests/modules/files/prefix.unlang         | 16 ++--
 src/tests/modules/files/subnet2.unlang        |  6 +-
 src/tests/modules/icmp/ping.unlang            |  2 +-
 src/tests/modules/idn/idn.unlang              | 16 ++--
 src/tests/modules/imap/auth_bad_pw.unlang     |  2 +-
 src/tests/modules/imap/auth_bad_usr.unlang    |  2 +-
 src/tests/modules/imap/auth_plaintext.unlang  | 24 +++---
 src/tests/modules/json/encode.unlang          | 60 +++++++-------
 src/tests/modules/json/encode_error.unlang    |  2 +-
 src/tests/modules/json/eval.unlang            | 78 +++++++++----------
 src/tests/modules/json/json_quote.unlang      | 12 +--
 src/tests/modules/json/nested_encode.unlang   |  2 +-
 src/tests/modules/json/regression02.unlang    |  2 +-
 src/tests/modules/ldap/access_state.unlang    |  6 +-
 src/tests/modules/ldap/acct.unlang            |  2 +-
 src/tests/modules/ldap/auth.unlang            | 14 ++--
 .../modules/ldap/auth_nested_profile.unlang   |  2 +-
 src/tests/modules/ldap/auth_ssl.unlang        |  2 +-
 src/tests/modules/ldap/auth_starttls.unlang   |  2 +-
 src/tests/modules/ldap/dynamic_dn.unlang      |  4 +-
 src/tests/modules/ldap/map_regression0.unlang |  2 +-
 src/tests/modules/ldap/xlat.unlang            | 38 ++++-----
 src/tests/modules/ldap/xlat_profile.unlang    |  4 +-
 .../modules/linelog/linelog-errors.unlang     |  8 +-
 .../modules/linelog/linelog-escapes.unlang    | 22 +++---
 .../modules/linelog/linelog-multi.unlang      | 16 ++--
 src/tests/modules/linelog/linelog.unlang      |  2 +-
 src/tests/modules/linelog/linelog_xlat.unlang | 12 +--
 src/tests/modules/mschap/auth.unlang          |  4 +-
 src/tests/modules/mschap/auth_mschapv2.unlang |  6 +-
 src/tests/modules/mschap/auth_winbind.unlang  |  4 +-
 .../modules/mschap/pwdchange_local.unlang     |  6 +-
 .../modules/mschap/pwdchange_ntlm.unlang      |  6 +-
 src/tests/modules/perl/auth.unlang            | 12 +--
 src/tests/modules/perl/xlat.unlang            | 32 ++++----
 src/tests/modules/redis/cluster_key.unlang    |  6 +-
 .../modules/redis/cluster_node_fail.unlang    |  4 +-
 src/tests/modules/redis/cluster_reset.inc     | 12 +--
 src/tests/modules/redis_ippool/alloc.unlang   | 16 ++--
 .../redis_ippool/pool_tool_delete.unlang      |  4 +-
 .../redis_ippool/pool_tool_modify.unlang      |  2 +-
 .../redis_ippool/pool_tool_release.unlang     |  4 +-
 .../redis_ippool/pool_tool_static.unlang      | 12 +--
 src/tests/modules/redis_ippool/release.unlang |  8 +-
 src/tests/modules/redis_ippool/static.unlang  |  6 +-
 .../redis_ippool/static_dynamic.unlang        |  4 +-
 .../redis_ippool/static_unassign.unlang       | 12 +--
 src/tests/modules/redis_ippool/update.unlang  | 14 ++--
 .../modules/redis_ippool/update_alloc.unlang  |  8 +-
 src/tests/modules/rest/rest_module.unlang     | 10 +--
 src/tests/modules/rest/rest_timeout.unlang    |  2 +-
 src/tests/modules/rest/rest_xlat.unlang       | 30 +++----
 .../smtp_attachment/tls_attachment.unlang     |  2 +-
 .../smtp_authenticate/tls_authenticate.unlang | 14 ++--
 .../modules/smtp/smtp_crln/tls_crln.unlang    |  2 +-
 .../smtp_stringparse/tls_stringparse.unlang   |  2 +-
 src/tests/modules/smtp/tls_delivery.unlang    | 16 ++--
 .../modules/sql/acct_start_conflict.unlang    |  2 +-
 src/tests/modules/sql/groups.unlang           |  2 +-
 src/tests/modules/sql/map.unlang              | 52 ++++++-------
 src/tests/modules/sqlcounter/test.unlang      | 20 ++---
 src/tests/modules/sqlippool/alloc.unlang      | 14 ++--
 src/tests/modules/sqlippool/alloc_fail.unlang |  6 +-
 .../modules/sqlippool/alloc_requested.unlang  | 12 +--
 src/tests/modules/sqlippool/release.unlang    | 10 +--
 src/tests/modules/sqlippool/static.unlang     |  6 +-
 src/tests/modules/sqlippool/update.unlang     | 20 ++---
 .../modules/sqlippool/update_alloc.unlang     |  8 +-
 .../modules/test/dollar_expansions.unlang     |  2 +-
 src/tests/modules/totp/auth.unlang            |  8 +-
 src/tests/modules/unbound/dns.unlang          | 22 +++---
 src/tests/modules/yubikey/yubikey_auth.unlang |  6 +-
 src/tests/modules/yubikey/yubikey_xlat.unlang | 12 +--
 106 files changed, 572 insertions(+), 572 deletions(-)

diff --git a/src/tests/modules/always/set_rcode.unlang b/src/tests/modules/always/set_rcode.unlang
index fca86e43af434..1a2eeabbfeb70 100644
--- a/src/tests/modules/always/set_rcode.unlang
+++ b/src/tests/modules/always/set_rcode.unlang
@@ -38,4 +38,4 @@ if (notfound) {
 	}
 }
 
-&control.Password.Cleartext := "hello"
+control.Password.Cleartext := "hello"
diff --git a/src/tests/modules/always/set_status_dead.unlang b/src/tests/modules/always/set_status_dead.unlang
index a210315625695..078b15d44ecbf 100644
--- a/src/tests/modules/always/set_status_dead.unlang
+++ b/src/tests/modules/always/set_status_dead.unlang
@@ -11,4 +11,4 @@ if (fail) {
 	reply.Reply-Message := "success"
 }
 
-&control.Password.Cleartext := "hello"
+control.Password.Cleartext := "hello"
diff --git a/src/tests/modules/always/set_status_revive.unlang b/src/tests/modules/always/set_status_revive.unlang
index 092280a0a211a..13e6d24645352 100644
--- a/src/tests/modules/always/set_status_revive.unlang
+++ b/src/tests/modules/always/set_status_revive.unlang
@@ -23,4 +23,4 @@ if (ok) {
 	}
 }
 
-&control.Password.Cleartext := "hello"
+control.Password.Cleartext := "hello"
diff --git a/src/tests/modules/attr_filter/bob.unlang b/src/tests/modules/attr_filter/bob.unlang
index ccc9b747f7876..fb197fbc3926f 100644
--- a/src/tests/modules/attr_filter/bob.unlang
+++ b/src/tests/modules/attr_filter/bob.unlang
@@ -1,7 +1,7 @@
 attr_filter
 
-&control.Password.Cleartext := "goodbye"
+control.Password.Cleartext := "goodbye"
 
-&reply += {
+reply += {
         Reply-Message = "success"
 }
diff --git a/src/tests/modules/attr_filter/operators.unlang b/src/tests/modules/attr_filter/operators.unlang
index d21bbf6d49ba6..2d550749c9ffe 100644
--- a/src/tests/modules/attr_filter/operators.unlang
+++ b/src/tests/modules/attr_filter/operators.unlang
@@ -1,5 +1,5 @@
 # Copy request to reply for later
-&reply := request
+reply := request
 
 attr_filter
 
@@ -44,7 +44,7 @@ if (reply.Idle-Timeout) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
-&control.Password.Cleartext := "goodbye"
-&reply.Reply-Message := Reply-Message
+control.Password.Cleartext := "goodbye"
+reply.Reply-Message := Reply-Message
diff --git a/src/tests/modules/cache_rbtree/cache-bin.unlang b/src/tests/modules/cache_rbtree/cache-bin.unlang
index a2fa88863080b..c007d815f587a 100644
--- a/src/tests/modules/cache_rbtree/cache-bin.unlang
+++ b/src/tests/modules/cache_rbtree/cache-bin.unlang
@@ -6,8 +6,8 @@
 #  Series of tests to check for binary safe operation of the cache module
 #  both keys and values should be binary safe.
 #
-&Class := 0xaa00bb00cc00dd00
-&Callback-Id := "foo\000bar\000baz"
+Class := 0xaa00bb00cc00dd00
+Callback-Id := "foo\000bar\000baz"
 
 # 0. Sanity check
 if (Callback-Id != "foo\000bar\000baz") {
@@ -21,8 +21,8 @@ if (!updated) {
 }
 
 # Now add a second entry, with the value diverging after the first null byte
-&Class := 0xaa00bb00cc00ee00
-&Callback-Id := "bar\000baz"
+Class := 0xaa00bb00cc00ee00
+Callback-Id := "bar\000baz"
 
 # 2. Should create a *new* entry and not update the existing one
 cache_bin_key_octets.store
@@ -30,11 +30,11 @@ if (!updated) {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # If the key is binary safe, we should now be able to retrieve the first entry
 # if it's not, the above test will likely fail, or we'll get the second entry.
-&Class := 0xaa00bb00cc00dd00
+Class := 0xaa00bb00cc00dd00
 
 cache_bin_key_octets
 if (!updated) {
@@ -49,10 +49,10 @@ if (Callback-Id != "foo\000bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Now try and get the second entry
-&Class := 0xaa00bb00cc00ee00
+Class := 0xaa00bb00cc00ee00
 
 cache_bin_key_octets
 if (!updated) {
@@ -67,14 +67,14 @@ if (Callback-Id != "bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 #
 #  We should also be able to use any fixed length data type as a key
 #  though there are no guarantees this will be portable.
 #
-&Framed-IP-Address := 192.168.0.1
-&Callback-Id := "foo\000bar\000baz"
+Framed-IP-Address := 192.168.0.1
+Callback-Id := "foo\000bar\000baz"
 
 cache_bin_key_ipaddr
 if (!ok) {
@@ -82,18 +82,18 @@ if (!ok) {
 }
 
 # Now add a second entry
-&Framed-IP-Address:= 192.168.0.2
-&Callback-Id := "bar\000baz"
+Framed-IP-Address:= 192.168.0.2
+Callback-Id := "bar\000baz"
 
 cache_bin_key_ipaddr
 if (!ok) {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Now retrieve the first entry
-&Framed-IP-Address := 192.168.0.1
+Framed-IP-Address := 192.168.0.1
 
 cache_bin_key_ipaddr
 if (!updated) {
@@ -108,10 +108,10 @@ if (Callback-Id != "foo\000bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Now try and get the second entry
-&Framed-IP-Address := 192.168.0.2
+Framed-IP-Address := 192.168.0.2
 
 cache_bin_key_ipaddr
 if (!updated) {
@@ -126,6 +126,6 @@ if (Callback-Id != "bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 test_pass
diff --git a/src/tests/modules/cache_rbtree/cache-logic.unlang b/src/tests/modules/cache_rbtree/cache-logic.unlang
index 8dc2107080b36..9212aa662f4c9 100644
--- a/src/tests/modules/cache_rbtree/cache-logic.unlang
+++ b/src/tests/modules/cache_rbtree/cache-logic.unlang
@@ -1,12 +1,12 @@
 #
 #  PRE:
 #
-&Filter-Id := 'testkey'
+Filter-Id := 'testkey'
 
 #
 # 0.  Basic store and retrieve
 #
-&control.Callback-Id := 'cache me'
+control.Callback-Id := 'cache me'
 
 cache
 if (!ok) {
@@ -19,7 +19,7 @@ if (Callback-Id) {
 }
 
 # 2. Check status-only works correctly (should return ok and consume attribute)
-&control.Cache-Status-Only := 'yes'
+control.Cache-Status-Only := 'yes'
 
 cache
 if (!ok) {
@@ -43,7 +43,7 @@ if (Callback-Id != control.Callback-Id) {
 }
 
 # 6. Retrieving the entry should not expire it
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 cache
 if (!updated) {
@@ -59,9 +59,9 @@ else {
 }
 
 # 8. Force expiry of the entry
-&control.Cache-Allow-Merge := no
-&control.Cache-Allow-Insert := no
-&control.Cache-TTL := 0
+control.Cache-Allow-Merge := no
+control.Cache-Allow-Insert := no
+control.Cache-TTL := 0
 
 cache
 if (!ok) {
@@ -69,7 +69,7 @@ if (!ok) {
 }
 
 # 9. Check status-only works correctly (should return notfound and consume attribute)
-&control.Cache-Status-Only := 'yes'
+control.Cache-Status-Only := 'yes'
 
 cache
 if (!notfound) {
@@ -82,8 +82,8 @@ if (control.Cache-Status-Only) {
 }
 
 # 11. Check merge-only works correctly (should return notfound and consume attribute)
-&control.Cache-Allow-Merge := 'yes'
-&control.Cache-Allow-Insert := 'no'
+control.Cache-Allow-Merge := 'yes'
+control.Cache-Allow-Insert := 'no'
 
 cache
 if (!notfound) {
@@ -96,7 +96,7 @@ if (control.Cache-Allow-Merge) {
 }
 
 # 13. ...and check the entry wasn't recreated
-&control.Cache-Status-Only := 'yes'
+control.Cache-Status-Only := 'yes'
 
 cache
 if (!notfound) {
@@ -104,7 +104,7 @@ if (!notfound) {
 }
 
 # 14. This should still allow the creation of a new entry
-&control.Cache-TTL := -2
+control.Cache-TTL := -2
 
 cache
 if (!ok) {
@@ -127,10 +127,10 @@ if (Callback-Id != control.Callback-Id) {
 	test_fail
 }
 
-&control.Callback-Id := 'cache me2'
+control.Callback-Id := 'cache me2'
 
 # 18. Updating the Cache-TTL shouldn't make things go boom (we can't really check if it works)
-&control.Cache-TTL := 30
+control.Cache-TTL := 30
 
 cache
 if (!updated) {
@@ -143,7 +143,7 @@ if (Callback-Id == control.Callback-Id) {
 }
 
 # 20. Check that a new entry is created
-&control.Cache-TTL := -2
+control.Cache-TTL := -2
 
 cache
 if (!updated) {
@@ -167,9 +167,9 @@ if (Callback-Id != control.Callback-Id) {
 }
 
 # 24. Check Cache-Merge = yes works as expected (should update current request)
-&control.Callback-Id := 'cache me3'
-&control.Cache-TTL := -2
-&control.Cache-Merge-New := yes
+control.Callback-Id := 'cache me3'
+control.Cache-TTL := -2
+control.Cache-Merge-New := yes
 
 cache
 if (!updated) {
diff --git a/src/tests/modules/cache_rbtree/cache-method-bin.unlang b/src/tests/modules/cache_rbtree/cache-method-bin.unlang
index 7fc8af389df01..f8f7264874523 100644
--- a/src/tests/modules/cache_rbtree/cache-method-bin.unlang
+++ b/src/tests/modules/cache_rbtree/cache-method-bin.unlang
@@ -6,8 +6,8 @@
 #  Series of tests to check for binary safe operation of the cache module
 #  both keys and values should be binary safe.
 #
-&Class := 0xaa11bb00cc00dd00
-&Callback-Id := "foo\000bar\000baz"
+Class := 0xaa11bb00cc00dd00
+Callback-Id := "foo\000bar\000baz"
 
 # 0. Sanity check
 if (Callback-Id != "foo\000bar\000baz") {
@@ -21,8 +21,8 @@ if (!updated) {
 }
 
 # Now add a second entry, with the value diverging after the first null byte
-&Class := 0xaa11bb00cc00ee00
-&Callback-Id := "bar\000baz"
+Class := 0xaa11bb00cc00ee00
+Callback-Id := "bar\000baz"
 
 # 2. Should create a *new* entry and not update the existing one
 cache_bin_key_octets.store
@@ -30,11 +30,11 @@ if (!updated) {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # If the key is binary safe, we should now be able to retrieve the first entry
 # if it's not, the above test will likely fail, or we'll get the second entry.
-&Class := 0xaa11bb00cc00dd00
+Class := 0xaa11bb00cc00dd00
 
 cache_bin_key_octets.load
 if (!updated) {
@@ -49,10 +49,10 @@ if (Callback-Id != "foo\000bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Now try and get the second entry
-&Class := 0xaa11bb00cc00ee00
+Class := 0xaa11bb00cc00ee00
 
 cache_bin_key_octets.load
 if (!updated) {
@@ -67,14 +67,14 @@ if (Callback-Id != "bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 #
 #  We should also be able to use any fixed length data type as a key
 #  though there are no guarantees this will be portable.
 #
-&Framed-IP-Address := 192.168.1.1
-&Callback-Id := "foo\000bar\000baz"
+Framed-IP-Address := 192.168.1.1
+Callback-Id := "foo\000bar\000baz"
 
 cache_bin_key_ipaddr.store
 if (!updated) {
@@ -82,18 +82,18 @@ if (!updated) {
 }
 
 # Now add a second entry
-&Framed-IP-Address:= 192.168.1.2
-&Callback-Id := "bar\000baz"
+Framed-IP-Address:= 192.168.1.2
+Callback-Id := "bar\000baz"
 
 cache_bin_key_ipaddr.store
 if (!updated) {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Now retrieve the first entry
-&Framed-IP-Address := 192.168.1.1
+Framed-IP-Address := 192.168.1.1
 
 cache_bin_key_ipaddr.load
 if (!updated) {
@@ -108,10 +108,10 @@ if (Callback-Id != "foo\000bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Now try and get the second entry
-&Framed-IP-Address := 192.168.1.2
+Framed-IP-Address := 192.168.1.2
 
 cache_bin_key_ipaddr.load
 if (!updated) {
@@ -126,6 +126,6 @@ if (Callback-Id != "bar\000baz") {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 test_pass
diff --git a/src/tests/modules/cache_rbtree/cache-method-logic.unlang b/src/tests/modules/cache_rbtree/cache-method-logic.unlang
index 47732ba262dfd..f96b27faf0b92 100644
--- a/src/tests/modules/cache_rbtree/cache-method-logic.unlang
+++ b/src/tests/modules/cache_rbtree/cache-method-logic.unlang
@@ -1,12 +1,12 @@
 #
 #  PRE:
 #
-&Filter-Id := 'testkey1'
+Filter-Id := 'testkey1'
 
 #
 # 0.  Basic update and retrieve
 #
-&control.Callback-Id := 'cache me'
+control.Callback-Id := 'cache me'
 
 cache.update
 if (!updated) {
@@ -36,7 +36,7 @@ if (Callback-Id != control.Callback-Id) {
 }
 
 # 5. Retrieving the entry should not expire it
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 cache.load
 if (!updated) {
@@ -61,7 +61,7 @@ if (!notfound) {
 }
 
 # 14. This should still allow the creation of a new entry
-&control.Cache-TTL := -2
+control.Cache-TTL := -2
 
 cache.update
 if (!updated) {
@@ -84,10 +84,10 @@ if (Callback-Id != control.Callback-Id) {
 	test_fail
 }
 
-&control.Callback-Id := 'cache me2'
+control.Callback-Id := 'cache me2'
 
 # 18. Updating the Cache-TTL shouldn't make things go boom (we can't really check if it works)
-&control.Cache-TTL := 666
+control.Cache-TTL := 666
 
 cache.ttl
 if (!updated) {
@@ -100,7 +100,7 @@ if (Callback-Id == control.Callback-Id) {
 }
 
 # 20. Check that a new entry is created
-&control.Cache-TTL := -2
+control.Cache-TTL := -2
 
 cache.update
 if (!updated) {
@@ -124,9 +124,9 @@ if (Callback-Id != control.Callback-Id) {
 }
 
 # 24. Check Cache-Merge = yes works as expected (should update current request)
-&control.Callback-Id := 'cache me3'
-&control.Cache-TTL := -2
-&control.Cache-Merge-New := yes
+control.Callback-Id := 'cache me3'
+control.Cache-TTL := -2
+control.Cache-Merge-New := yes
 
 cache.update
 if (!updated) {
diff --git a/src/tests/modules/cache_rbtree/cache-method-update.unlang b/src/tests/modules/cache_rbtree/cache-method-update.unlang
index 68ce8a307fdc3..791cfa6833f3c 100644
--- a/src/tests/modules/cache_rbtree/cache-method-update.unlang
+++ b/src/tests/modules/cache_rbtree/cache-method-update.unlang
@@ -1,16 +1,16 @@
 #
 #  PRE: cache-logic
 #
-&Filter-Id := 'testkey3'
+Filter-Id := 'testkey3'
 
 # Reply attributes
-&reply.Reply-Message := 'hello'
-&reply += {
+reply.Reply-Message := 'hello'
+reply += {
 	Reply-Message = 'goodbye'
 }
 
 # Request attributes
-&request += {
+request += {
 	NAS-Port = 10
 	NAS-Port = 20
 	NAS-Port = 30
@@ -19,7 +19,7 @@
 #
 #  Basic update and retrieve
 #
-&control.Callback-Id := 'cache me'
+control.Callback-Id := 'cache me'
 
 cache_update.update
 if (!updated) {
@@ -76,6 +76,6 @@ if (Login-LAT-Service[2] != 'baz') {
 }
 
 # Clear out the reply list
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/cache_rbtree/cache-update.unlang b/src/tests/modules/cache_rbtree/cache-update.unlang
index e42a3b5edb559..2f009b9797170 100644
--- a/src/tests/modules/cache_rbtree/cache-update.unlang
+++ b/src/tests/modules/cache_rbtree/cache-update.unlang
@@ -1,16 +1,16 @@
 #
 #  PRE: cache-logic
 #
-&Filter-Id := 'testkey2'
+Filter-Id := 'testkey2'
 
 # Reply attributes
-&reply.Reply-Message := 'hello'
-&reply += {
+reply.Reply-Message := 'hello'
+reply += {
 	Reply-Message = 'goodbye'
 }
 
 # Request attributes
-&request += {
+request += {
 	NAS-Port = 10
 	NAS-Port = 20
 	NAS-Port = 30
@@ -19,7 +19,7 @@
 #
 #  Basic update and retrieve
 #
-&control.Callback-Id := 'cache me'
+control.Callback-Id := 'cache me'
 
 cache_update
 if (!ok) {
@@ -70,7 +70,7 @@ if (Login-LAT-Service[2] != 'baz') {
 }
 
 # Clear out the reply list
-&reply := {}
+reply := {}
 
 # Need to test if thie cache env parses correctly, we dont really care about testing the static key
 static_key
diff --git a/src/tests/modules/cache_rbtree/cache-xlat.unlang b/src/tests/modules/cache_rbtree/cache-xlat.unlang
index 8e4044c12eb44..6787f7c5d5276 100644
--- a/src/tests/modules/cache_rbtree/cache-xlat.unlang
+++ b/src/tests/modules/cache_rbtree/cache-xlat.unlang
@@ -1,8 +1,8 @@
 #
 #  PRE: cache-logic
 #
-&Filter-Id := 'testkey'
-&control.Callback-Id := 'cache me'
+Filter-Id := 'testkey'
+control.Callback-Id := 'cache me'
 
 cache
 if (!ok) {
@@ -14,24 +14,24 @@ if (%cache.ttl.get() < 4) {
         test_fail
 }
 
-&request.Login-LAT-Service := %cache('request.Callback-Id')
+request.Login-LAT-Service := %cache('request.Callback-Id')
 
 if (Login-LAT-Service != control.Callback-Id) {
         test_fail
 }
 
-&Login-LAT-Node := %cache(request.Login-LAT-Port)
+Login-LAT-Node := %cache(request.Login-LAT-Port)
 
 if (Login-LAT-Node) {
         test_fail
 }
 
 # Regression test for deadlock on notfound
-&Filter-Id := 'testkey0'
+Filter-Id := 'testkey0'
 
-&Login-LAT-Node := %cache(request.Login-LAT-Port)
+Login-LAT-Node := %cache(request.Login-LAT-Port)
 
 # Would previously deadlock
-&Login-LAT-Port := %cache(request.Login-LAT-Port)
+Login-LAT-Port := %cache(request.Login-LAT-Port)
 
 test_pass
diff --git a/src/tests/modules/chap/chap_password.unlang b/src/tests/modules/chap/chap_password.unlang
index 0fc9480b1b5b1..e8ca74f01cdc5 100644
--- a/src/tests/modules/chap/chap_password.unlang
+++ b/src/tests/modules/chap/chap_password.unlang
@@ -1,8 +1,8 @@
 
-&CHAP-Challenge := 0x0102030405060708090a0b0c0d0e0f10
-&control.Password.Cleartext := "supersecret"
+CHAP-Challenge := 0x0102030405060708090a0b0c0d0e0f10
+control.Password.Cleartext := "supersecret"
 
-&CHAP-Password := "%chap.password(%{control.Password.Cleartext})"
+CHAP-Password := "%chap.password(%{control.Password.Cleartext})"
 
 chap.authenticate
 if (ok) {
diff --git a/src/tests/modules/cipher/fingerprint.unlang b/src/tests/modules/cipher/fingerprint.unlang
index 4c8c24cd2bdd3..aeabaa481b383 100644
--- a/src/tests/modules/cipher/fingerprint.unlang
+++ b/src/tests/modules/cipher/fingerprint.unlang
@@ -3,13 +3,13 @@
 #  but we can test the digest length, and for smoke...
 #
 octets test_octets
-&test_octets := %cipher_rsa.certificate('fingerprint','sha1')
+test_octets := %cipher_rsa.certificate('fingerprint','sha1')
 
 if (%length(%{test_octets}) != 20) {
 	test_fail
 }
 
-&test_octets := %cipher_rsa.certificate('fingerprint','sha256')
+test_octets := %cipher_rsa.certificate('fingerprint','sha256')
 
 if (%length(%{test_octets}) != 32) {
 	test_fail
diff --git a/src/tests/modules/cipher/rsa_encrypt_decrypt.unlang b/src/tests/modules/cipher/rsa_encrypt_decrypt.unlang
index 650bca4113415..0dcc7e7418838 100644
--- a/src/tests/modules/cipher/rsa_encrypt_decrypt.unlang
+++ b/src/tests/modules/cipher/rsa_encrypt_decrypt.unlang
@@ -3,8 +3,8 @@ string test_string2
 octets test_octets1
 octets test_octets2
 
-&test_string1 := "Hello world!"
-&test_octets1 := %cipher_rsa.encrypt(%{test_string1})
+test_string1 := "Hello world!"
+test_octets1 := %cipher_rsa.encrypt(%{test_string1})
 
 if (!test_octets1) {
 	test_fail
@@ -14,7 +14,7 @@ if ((octets)test_string1 == test_octets1) {
 	test_fail
 }
 
-&test_string2 := %cipher_rsa.decrypt(%{test_octets1})
+test_string2 := %cipher_rsa.decrypt(%{test_octets1})
 
 if (test_string1 != test_string2) {
 	test_fail
@@ -23,7 +23,7 @@ if (test_string1 != test_string2) {
 #
 #  Padding scheme should ensure ciphertext is not consistent
 #
-&test_octets2 := %cipher_rsa.encrypt(%{test_string1})
+test_octets2 := %cipher_rsa.encrypt(%{test_string1})
 
 if (test_octets1 == test_octets2) {
 	test_fail
@@ -32,8 +32,8 @@ if (test_octets1 == test_octets2) {
 #
 #  Repeat tests to ensure there are no issues with EVP_PKEY_CTX reuse
 #
-&test_string1 := "Goodbye world!"
-&test_octets1 := %cipher_rsa.encrypt(%{test_string1})
+test_string1 := "Goodbye world!"
+test_octets1 := %cipher_rsa.encrypt(%{test_string1})
 
 if (!test_octets1) {
 	test_fail
@@ -43,7 +43,7 @@ if ((octets)test_string1 == test_octets1) {
 	test_fail
 }
 
-&test_string2 := %cipher_rsa.decrypt(%{test_octets1})
+test_string2 := %cipher_rsa.decrypt(%{test_octets1})
 
 if (test_string1 != test_string2) {
 	test_fail
diff --git a/src/tests/modules/cipher/rsa_sign_verify.unlang b/src/tests/modules/cipher/rsa_sign_verify.unlang
index 6920e76306a33..4f115ac5df263 100644
--- a/src/tests/modules/cipher/rsa_sign_verify.unlang
+++ b/src/tests/modules/cipher/rsa_sign_verify.unlang
@@ -1,8 +1,8 @@
 string test_string
 octets test_octets
 
-&test_string := "Hello world!"
-&test_octets := %cipher_rsa.sign(%{test_string})
+test_string := "Hello world!"
+test_octets := %cipher_rsa.sign(%{test_string})
 
 if (!test_octets) {
 	test_fail
@@ -15,7 +15,7 @@ if ((octets)test_string[0] == test_octets[0]) {
 #
 #  Pass the signature and the original message to the verification function
 #
-&test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
+test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
 
 if (test_string != 'yes') {
 	test_fail
@@ -24,8 +24,8 @@ if (test_string != 'yes') {
 #
 #  Verification should now fail
 #
-&test_string := "Goodbye world!"
-&test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
+test_string := "Goodbye world!"
+test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
 
 if (test_string != 'no') {
 	test_fail
@@ -34,8 +34,8 @@ if (test_string != 'no') {
 #
 #  Repeat tests to ensure there are no issues with EVP_PKEY_CTX reuse
 #
-&test_string := "Hello nurse!"
-&test_octets := %cipher_rsa.sign(%{test_string})
+test_string := "Hello nurse!"
+test_octets := %cipher_rsa.sign(%{test_string})
 
 if (!test_octets) {
 	test_fail
@@ -48,7 +48,7 @@ if ((octets)test_string[0] == test_octets[0]) {
 #
 #  Pass the signature and the original message to the verification function
 #
-&test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
+test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
 
 if (test_string != 'yes') {
 	test_fail
@@ -57,8 +57,8 @@ if (test_string != 'yes') {
 #
 #  Verification should now fail
 #
-&test_string := "Goodbye nurse!"
-&test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
+test_string := "Goodbye nurse!"
+test_string := %cipher_rsa.verify(%{test_octets}, %{test_string})
 
 if (test_string != 'no') {
 	test_fail
diff --git a/src/tests/modules/cipher/serial.unlang b/src/tests/modules/cipher/serial.unlang
index 32e8856f05c20..b1834255e0523 100644
--- a/src/tests/modules/cipher/serial.unlang
+++ b/src/tests/modules/cipher/serial.unlang
@@ -1,6 +1,6 @@
 octets test_octets
 
-&test_octets := %cipher_rsa.certificate('serial')
+test_octets := %cipher_rsa.certificate('serial')
 
 if (%length(%{test_octets}) != 1) {
 	test_fail
diff --git a/src/tests/modules/cipher/valid.unlang b/src/tests/modules/cipher/valid.unlang
index ffd6a21e4dbfa..f732b35183d11 100644
--- a/src/tests/modules/cipher/valid.unlang
+++ b/src/tests/modules/cipher/valid.unlang
@@ -1,8 +1,8 @@
 date test_date1
 date test_date2
 
-&test_date1 := "%cipher_rsa.certificate(notBefore)"
-&test_date2 := "%cipher_rsa.certificate(notAfter)"
+test_date1 := "%cipher_rsa.certificate(notBefore)"
+test_date2 := "%cipher_rsa.certificate(notAfter)"
 
 # Check the cert validity period is 30 days
 if !((test_date2 - test_date1) == ((time_delta) (86400 * 60))) {
diff --git a/src/tests/modules/client/map.unlang b/src/tests/modules/client/map.unlang
index 4b09829af29e4..211201aab48a0 100644
--- a/src/tests/modules/client/map.unlang
+++ b/src/tests/modules/client/map.unlang
@@ -49,7 +49,7 @@ if (Callback-Id[2] != 'c') {
 	test_fail
 }
 
-&request -= Filter-Id[*]
+request -= Filter-Id[*]
 
 map client 127.0.0.2 {
 	Filter-Id += 'group'
@@ -67,8 +67,8 @@ if (Filter-Id[2] != 'f') {
 	test_fail
 }
 
-&request -= Filter-Id[*]
-&request -= Callback-Id[*]
+request -= Filter-Id[*]
+request -= Callback-Id[*]
 
 #
 #  Test non-existent client properties
diff --git a/src/tests/modules/client/xlat.unlang b/src/tests/modules/client/xlat.unlang
index 8a9aa40367343..3277ebd0b9274 100644
--- a/src/tests/modules/client/xlat.unlang
+++ b/src/tests/modules/client/xlat.unlang
@@ -1,24 +1,24 @@
 string test_string
 
-&test_string := "%client('nas_type')"
+test_string := "%client('nas_type')"
 
 if (test_string != 'a_type') {
         test_fail
 }
 
-&test_string := "%client('nas_type',127.0.0.1)"
+test_string := "%client('nas_type',127.0.0.1)"
 
 if (test_string != 'a_type') {
         test_fail
 }
 
-&test_string := "%client('nas_type',127.0.0.2)"
+test_string := "%client('nas_type',127.0.0.2)"
 
 if (test_string != 'b_type') {
         test_fail
 }
 
-&test_string := "%client('nas_type',127.0.0.5)"
+test_string := "%client('nas_type',127.0.0.5)"
 
 if (test_string != 'b_type') {
 	test_fail
@@ -27,12 +27,12 @@ if (test_string != 'b_type') {
 #
 #  Test non-existent client properties
 #
-&test_string := "%client('non-existent-attr')"
+test_string := "%client('non-existent-attr')"
 if !(test_string == "") {
 	test_fail
 }
 
-&test_string := "%client('non-existing-attr2')"
+test_string := "%client('non-existing-attr2')"
 if !(test_string == "") {
 	test_fail
 }
diff --git a/src/tests/modules/detail/escape.unlang b/src/tests/modules/detail/escape.unlang
index 155fdcb352358..3cf6823cc9f9b 100644
--- a/src/tests/modules/detail/escape.unlang
+++ b/src/tests/modules/detail/escape.unlang
@@ -1,6 +1,6 @@
 %file.rm("$ENV{MODULE_TEST_DIR}/127-2e0-2e0-2e1-with--n-c3-b6n--ascii-21")
 
-&request -= Module-Failure-Message[*]
+request -= Module-Failure-Message[*]
 
 detail_escape
 
diff --git a/src/tests/modules/detail/simple.unlang b/src/tests/modules/detail/simple.unlang
index 47a3667ca26b9..54f8047bdec0c 100644
--- a/src/tests/modules/detail/simple.unlang
+++ b/src/tests/modules/detail/simple.unlang
@@ -1,6 +1,6 @@
 %file.rm("$ENV{MODULE_TEST_DIR}/127.0.0.1-detail")
 
-&request -= Module-Failure-Message[*]
+request -= Module-Failure-Message[*]
 
 detail
 
diff --git a/src/tests/modules/detail/suppress.unlang b/src/tests/modules/detail/suppress.unlang
index a635565e925f9..a1bdca6cae1d7 100644
--- a/src/tests/modules/detail/suppress.unlang
+++ b/src/tests/modules/detail/suppress.unlang
@@ -1,6 +1,6 @@
 %file.rm("$ENV{MODULE_TEST_DIR}/127.0.0.1-suppress")
 
-&request -= Module-Failure-Message[*]
+request -= Module-Failure-Message[*]
 
 detail_suppress
 
diff --git a/src/tests/modules/dict/map.unlang b/src/tests/modules/dict/map.unlang
index 20ef1a3b35067..01cd2025bc817 100644
--- a/src/tests/modules/dict/map.unlang
+++ b/src/tests/modules/dict/map.unlang
@@ -1,6 +1,6 @@
-&Vendor-Specific.FreeRADIUS.Proxied-To := 127.0.0.1
+Vendor-Specific.FreeRADIUS.Proxied-To := 127.0.0.1
 
-&Reply-Message := 'foo'
+Reply-Message := 'foo'
 
 if (%dict.attr.by_num(1) != 'User-Name') {
 	test_fail
diff --git a/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang b/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang
index d587399dca1a8..0a6d7cded633c 100644
--- a/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang
+++ b/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang
@@ -12,8 +12,8 @@ if (%aka_sim_id_type("%{User-Name}") != 'permanent') {
 #
 #  Encrypt the permanent ID
 #
-&test_string := '1420032219455258'
-&control.User-Name := %3gpp_temporary_id_encrypt(%{User-Name},%{test_string},6)
+test_string := '1420032219455258'
+control.User-Name := %3gpp_temporary_id_encrypt(%{User-Name},%{test_string},6)
 
 #
 #  0.2 - Can we get the EAP method from the encrypted blob correctly?
@@ -39,7 +39,7 @@ if ("%3gpp_temporary_id_encrypt(%{control.User-Name},%{test_string},6)" != '') {
 #
 #  0.5 - Get the original IMSI back again
 #
-&result_string := %3gpp_temporary_id_decrypt(%{control.User-Name},%{test_string})
+result_string := %3gpp_temporary_id_decrypt(%{control.User-Name},%{test_string})
 
 if (result_string != User-Name) {
 	test_fail
@@ -58,8 +58,8 @@ if (User-Name =~ /^[0-9](.*)/) {
 #
 #  1.1 - Encrypt the permanent ID
 #
-&test_string := '1420032219455259'
-&control += {
+test_string := '1420032219455259'
+control += {
 	User-Name = %3gpp_temporary_id_encrypt(%{User-Name[1]},%{test_string},6)
 }
 
@@ -80,7 +80,7 @@ if ("%3gpp_temporary_id_encrypt(%{control.User-Name[1]},%{test_string},6)" != ''
 #
 #  1.4 - Get the original IMSI back again
 #
-&result_string := %3gpp_temporary_id_decrypt(%{control.User-Name[1]},%{test_string})
+result_string := %3gpp_temporary_id_decrypt(%{control.User-Name[1]},%{test_string})
 
 if (result_string != "0%{User-Name[1]}") {
 	test_fail
@@ -89,8 +89,8 @@ if (result_string != "0%{User-Name[1]}") {
 #
 #  2.1 - Encrypt the permanent ID for fastauth
 #
-&test_string := '1420032219455259'
-&control += {
+test_string := '1420032219455259'
+control += {
 	User-Name = %3gpp_temporary_id_encrypt(%{User-Name[1]},%{test_string},6,fastauth)
 }
 
@@ -111,7 +111,7 @@ if ("%3gpp_temporary_id_encrypt(%{control.User-Name[2]},%{test_string},6,fastaut
 #
 #  2.4 - Get the original IMSI back again
 #
-&result_string := %3gpp_temporary_id_decrypt(%{control.User-Name[2]},%{test_string})
+result_string := %3gpp_temporary_id_decrypt(%{control.User-Name[2]},%{test_string})
 
 if (result_string != "0%{User-Name[1]}") {
 	test_fail
diff --git a/src/tests/modules/eap_sim/sim_xlat_id_aka_decrypt_no_tag.unlang b/src/tests/modules/eap_sim/sim_xlat_id_aka_decrypt_no_tag.unlang
index 0d8a50ae2cdb8..c5d588b7563a3 100644
--- a/src/tests/modules/eap_sim/sim_xlat_id_aka_decrypt_no_tag.unlang
+++ b/src/tests/modules/eap_sim/sim_xlat_id_aka_decrypt_no_tag.unlang
@@ -12,13 +12,13 @@ if (%aka_sim_id_type(%{User-Name}) != 'permanent') {
 #
 #  1.1 - Encrypt the permanent ID
 #
-&test_string := '1420032219455259'
-&control.User-Name := %3gpp_temporary_id_encrypt(%{User-Name},%{test_string},6)
+test_string := '1420032219455259'
+control.User-Name := %3gpp_temporary_id_encrypt(%{User-Name},%{test_string},6)
 
 #
 #  1.2 - Get the original IMSI back again sans tag
 #
-&result_string := %3gpp_temporary_id_decrypt(%{control.User-Name}, %{test_string}, 'false')
+result_string := %3gpp_temporary_id_decrypt(%{control.User-Name}, %{test_string}, 'false')
 
 if ("%{User-Name}" =~ /^0(.*)/) {
 	if (!result_string || (result_string == '') || (%{result_string} != "%{1}")) {
diff --git a/src/tests/modules/eap_sim/sim_xlat_id_error.unlang b/src/tests/modules/eap_sim/sim_xlat_id_error.unlang
index 6aef1631f753f..f47e3e9459881 100644
--- a/src/tests/modules/eap_sim/sim_xlat_id_error.unlang
+++ b/src/tests/modules/eap_sim/sim_xlat_id_error.unlang
@@ -1,7 +1,7 @@
 #
 #  No domain separator
 #
-&User-Name := '14200322194552581'
+User-Name := '14200322194552581'
 
 if ("%aka_sim_id_method(%{User-Name})" != '') {
 	test_fail
@@ -10,7 +10,7 @@ if ("%aka_sim_id_method(%{User-Name})" != '') {
 #
 #  Zero length ID
 #
-&User-Name := ''
+User-Name := ''
 
 if ("%aka_sim_id_method(%{User-Name})" != '') {
 	test_fail
diff --git a/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang b/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang
index 03bf88b6d465a..3276247c62ac0 100644
--- a/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang
+++ b/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang
@@ -11,8 +11,8 @@ if (%aka_sim_id_type(%{User-Name}) != 'permanent') {
 #
 #  Encrypt the permanent ID
 #
-&test_string := '1234567812345678'
-&control.User-Name := %3gpp_temporary_id_encrypt(%{User-Name},%{test_string},6)
+test_string := '1234567812345678'
+control.User-Name := %3gpp_temporary_id_encrypt(%{User-Name},%{test_string},6)
 
 #
 #  Can we get the EAP method from the encrypted blob correctly?
diff --git a/src/tests/modules/exec/async.unlang b/src/tests/modules/exec/async.unlang
index 87788022c3cf4..fe318cc85c138 100644
--- a/src/tests/modules/exec/async.unlang
+++ b/src/tests/modules/exec/async.unlang
@@ -4,7 +4,7 @@ string test_string
 #  Async calls should always return a zero length string
 #  because we don't wait for the response.
 #
-&test_string := %exec_async('/bin/sh','-c',"'echo -n hello'")
+test_string := %exec_async('/bin/sh','-c',"'echo -n hello'")
 if test_string {
 	test_fail
 }
@@ -27,7 +27,7 @@ if (reply.Reply-Message == 'hello') {
 #  Smoke test - Setup an async process that'll keep running after
 #  after the test exits.
 #
-&test_string := %exec_async('/bin/sh','-c',"'sleep 1'")
+test_string := %exec_async('/bin/sh','-c',"'sleep 1'")
 if test_string {
 	test_fail
 }
diff --git a/src/tests/modules/exec/backticks_list.unlang b/src/tests/modules/exec/backticks_list.unlang
index 25a30e54bc628..e4e60107d7de3 100644
--- a/src/tests/modules/exec/backticks_list.unlang
+++ b/src/tests/modules/exec/backticks_list.unlang
@@ -4,7 +4,7 @@ string test_string
 #  Sync calls should always return a zero length string
 #  because we don't wait for the response.
 #
-&test_string := %exec('/bin/sh', '-c', 'echo hello')
+test_string := %exec('/bin/sh', '-c', 'echo hello')
 if (test_string != 'hello') {
 	test_fail
 }
@@ -12,7 +12,7 @@ if (test_string != 'hello') {
 #
 #  @todo - list over-rides are not allowed!
 #
-&control += %exec('/bin/sh', '-c', "echo Reply-Message := \'hello\'")
+control += %exec('/bin/sh', '-c', "echo Reply-Message := \'hello\'")
 
 if (control.Reply-Message != 'hello') {
 	test_fail
diff --git a/src/tests/modules/exec/sync.unlang b/src/tests/modules/exec/sync.unlang
index 0174a621e30a5..25542de63a2cd 100644
--- a/src/tests/modules/exec/sync.unlang
+++ b/src/tests/modules/exec/sync.unlang
@@ -3,7 +3,7 @@ string test_string
 #
 #  Sync calls return the response
 #
-&test_string := %exec_sync('/bin/sh', '-c', "echo 'hello'")
+test_string := %exec_sync('/bin/sh', '-c', "echo 'hello'")
 if (test_string != 'hello') {
 	test_fail
 }
@@ -11,9 +11,9 @@ if (test_string != 'hello') {
 #
 #  Call something which will take longer than the timeout
 #
-&request -= Module-Failure-Message
+request -= Module-Failure-Message
 
-&test_string := %exec_sync('/bin/sleep', '10')
+test_string := %exec_sync('/bin/sleep', '10')
 
 if (Module-Failure-Message != "Execution of external program failed: Timeout running program") {
 	test_fail
@@ -23,9 +23,9 @@ if test_string  {
 	test_fail
 }
 
-&request -= Module-Failure-Message
+request -= Module-Failure-Message
 
-&test_string := %exec_sync('/bin/sh', "$ENV{MODULE_TEST_DIR}/fail.sh")
+test_string := %exec_sync('/bin/sh', "$ENV{MODULE_TEST_DIR}/fail.sh")
 
 if test_string {
 	test_fail
@@ -79,7 +79,7 @@ if (control.NAS-Identifier == "Failure") {
 	test_fail
 }
 
-&control -= Filter-Id[*]
+control -= Filter-Id[*]
 #
 #  Call a module which uses an xlat function in its arguments
 #
@@ -89,5 +89,5 @@ if !(control.Filter-Id == 'TONY') {
 	test_fail
 }
 
-&reply -= Filter-Id[*]
+reply -= Filter-Id[*]
 test_pass
diff --git a/src/tests/modules/files/any.unlang b/src/tests/modules/files/any.unlang
index a12b5dfe4b785..b097e82dcfa83 100644
--- a/src/tests/modules/files/any.unlang
+++ b/src/tests/modules/files/any.unlang
@@ -1,6 +1,6 @@
 # Add multiple instances of Realm to the control list
 # The data should match on the second.
-&control += {
+control += {
 	Realm = 'one'
 	Realm = 'two'
 	Realm = 'three'
diff --git a/src/tests/modules/files/compound_key.unlang b/src/tests/modules/files/compound_key.unlang
index 4256922f44a50..3632ddea09d53 100644
--- a/src/tests/modules/files/compound_key.unlang
+++ b/src/tests/modules/files/compound_key.unlang
@@ -1,5 +1,5 @@
-&Filter-Id := 'test0'
-&Callback-Id := 'test1'
+Filter-Id := 'test0'
+Callback-Id := 'test1'
 
 compound_key
 if (!ok) {
diff --git a/src/tests/modules/files/prefix.unlang b/src/tests/modules/files/prefix.unlang
index 336c386b5d4a8..d3eb89a6731e2 100644
--- a/src/tests/modules/files/prefix.unlang
+++ b/src/tests/modules/files/prefix.unlang
@@ -1,4 +1,4 @@
-&FreeRADIUS-Client-IP-Prefix := 10.1.2.3/32
+FreeRADIUS-Client-IP-Prefix := 10.1.2.3/32
 
 subnet
 
@@ -14,9 +14,9 @@ if (control.FreeRADIUS-Client-IP-Prefix != 10.1.0.0/16) {
 	test_fail
 }
 
-&FreeRADIUS-Client-IP-Prefix := 10.2.3.4/32
+FreeRADIUS-Client-IP-Prefix := 10.2.3.4/32
 
-&reply -= Reply-Message[*]
+reply -= Reply-Message[*]
 
 subnet
 
@@ -28,16 +28,16 @@ if (control.FreeRADIUS-Client-IP-Prefix != 10.0.0.0/8) {
 	test_fail
 }
 
-&FreeRADIUS-Client-IP-Prefix := 10.1.2.3/32
-&Password.Cleartext := "hello"
+FreeRADIUS-Client-IP-Prefix := 10.1.2.3/32
+Password.Cleartext := "hello"
 
-&reply -= Reply-Message[*]
+reply -= Reply-Message[*]
 
 subnet
 
-&FreeRADIUS-Client-IP-Prefix := 192.168.1.1/32
+FreeRADIUS-Client-IP-Prefix := 192.168.1.1/32
 
-&reply -= Reply-Message[*]
+reply -= Reply-Message[*]
 
 subnet
 
diff --git a/src/tests/modules/files/subnet2.unlang b/src/tests/modules/files/subnet2.unlang
index 3fa5086aa1068..5900b722abd3a 100644
--- a/src/tests/modules/files/subnet2.unlang
+++ b/src/tests/modules/files/subnet2.unlang
@@ -1,4 +1,4 @@
-&FreeRADIUS-Client-IP-Prefix := 10.1.2.3/32
+FreeRADIUS-Client-IP-Prefix := 10.1.2.3/32
 
 subnet2
 
@@ -19,9 +19,9 @@ if !(control.FreeRADIUS-Client-IP-Prefix == 10.0.0.0/8) {
 }
 
 #  Delete previous reply messages
-&reply -= Reply-Message[*]
+reply -= Reply-Message[*]
 
-&FreeRADIUS-Client-IP-Prefix := 10.2.2.3/15
+FreeRADIUS-Client-IP-Prefix := 10.2.2.3/15
 
 subnet2
 
diff --git a/src/tests/modules/icmp/ping.unlang b/src/tests/modules/icmp/ping.unlang
index efd035cc4c85a..1cf99605fcb05 100644
--- a/src/tests/modules/icmp/ping.unlang
+++ b/src/tests/modules/icmp/ping.unlang
@@ -1,5 +1,5 @@
 string test_string
-&test_string := %ping(127.0.0.1)
+test_string := %ping(127.0.0.1)
 
 #
 #  @todo - conditions do not yet support YIELD
diff --git a/src/tests/modules/idn/idn.unlang b/src/tests/modules/idn/idn.unlang
index 671e51375fb4b..91c3ed7b42df7 100644
--- a/src/tests/modules/idn/idn.unlang
+++ b/src/tests/modules/idn/idn.unlang
@@ -3,32 +3,32 @@ string test_string
 #  PRE: update if
 #
 
-&test_string := "%idn('example.com')"
+test_string := "%idn('example.com')"
 if (test_string != "example.com") {
         test_fail
 }
 
-&test_string := "%idn('èxâmpłé.com')"
+test_string := "%idn('èxâmpłé.com')"
 if (test_string != "xn--xmp-ila2ak63d.com") {
         test_fail
 }
 
-&test_string := "%idn('пример.com')"
+test_string := "%idn('пример.com')"
 if (test_string != "xn--e1afmkfd.com") {
         test_fail
 }
 
-&test_string := "%idn('παράδειγμα.com')"
+test_string := "%idn('παράδειγμα.com')"
 if (test_string != "xn--hxajbheg2az3al.com") {
         test_fail
 }
 
-&test_string := "%idn('ตัวอย่าง.com')"
+test_string := "%idn('ตัวอย่าง.com')"
 if (test_string != "xn--72c1a1bt4awk9o.com") {
         test_fail
 }
 
-&test_string := "%idn('invalid_example.com')"
+test_string := "%idn('invalid_example.com')"
 
 if (Module-Failure-Message != "Non-digit/letter/hyphen in input") {
         test_fail
@@ -38,9 +38,9 @@ if (Module-Failure-Message == "") {
         test_fail
 }
 
-&request -= Module-Failure-Message[*]
+request -= Module-Failure-Message[*]
 
-&test_string := "%idn('a.véry.löng.ņàme.whîch.when.expânded.exceedş.ţhe.dns.stanđard.fór.string.łength.of.twø.hündred.ând.fifty.threé.charáctèrs.and.therefore.is.invalid.for.idn.conversion')"
+test_string := "%idn('a.véry.löng.ņàme.whîch.when.expânded.exceedş.ţhe.dns.stanđard.fór.string.łength.of.twø.hündred.ând.fifty.threé.charáctèrs.and.therefore.is.invalid.for.idn.conversion')"
 
 if (Module-Failure-Message != "Conversion was truncated") {
         test_fail
diff --git a/src/tests/modules/imap/auth_bad_pw.unlang b/src/tests/modules/imap/auth_bad_pw.unlang
index f31a8572d6517..07e1c025440ae 100644
--- a/src/tests/modules/imap/auth_bad_pw.unlang
+++ b/src/tests/modules/imap/auth_bad_pw.unlang
@@ -14,4 +14,4 @@ if (fail) {
     reject
 }
 
-&reply.Packet-Type := "Access-Accept"
+reply.Packet-Type := "Access-Accept"
diff --git a/src/tests/modules/imap/auth_bad_usr.unlang b/src/tests/modules/imap/auth_bad_usr.unlang
index f31a8572d6517..07e1c025440ae 100644
--- a/src/tests/modules/imap/auth_bad_usr.unlang
+++ b/src/tests/modules/imap/auth_bad_usr.unlang
@@ -14,4 +14,4 @@ if (fail) {
     reject
 }
 
-&reply.Packet-Type := "Access-Accept"
+reply.Packet-Type := "Access-Accept"
diff --git a/src/tests/modules/imap/auth_plaintext.unlang b/src/tests/modules/imap/auth_plaintext.unlang
index 794b28d3f0c4b..8223c69509c5c 100644
--- a/src/tests/modules/imap/auth_plaintext.unlang
+++ b/src/tests/modules/imap/auth_plaintext.unlang
@@ -17,7 +17,7 @@ if !(ok) {
 #
 #  Check for module failing with missing attributes
 #
-&request -= User-Password[*]
+request -= User-Password[*]
 
 imap.authenticate {
     fail = 1
@@ -28,8 +28,8 @@ if !(invalid) {
     test_fail
 }
 
-&User-Password := 'test2'
-&request -= User-Name[*]
+User-Password := 'test2'
+request -= User-Name[*]
 
 imap.authenticate {
     fail = 1
@@ -44,7 +44,7 @@ if !(invalid) {
 #  Now do multiple authentications of different users
 #
 
-&User-Name := 'user2'
+User-Name := 'user2'
 imap.authenticate {
     fail = 1
 }
@@ -57,8 +57,8 @@ if !(ok) {
     test_fail
 }
 
-&User-Name := 'user3'
-&User-Password := 'test3'
+User-Name := 'user3'
+User-Password := 'test3'
 imap.authenticate {
     fail = 1
 }
@@ -74,8 +74,8 @@ if !(ok) {
 #
 #  And repeat all three
 #
-&User-Name := 'user1'
-&User-Password := 'test1'
+User-Name := 'user1'
+User-Password := 'test1'
 imap.authenticate {
     fail = 1
 }
@@ -88,8 +88,8 @@ if !(ok) {
     test_fail
 }
 
-&User-Name := 'user2'
-&User-Password := 'test2'
+User-Name := 'user2'
+User-Password := 'test2'
 imap.authenticate {
     fail = 1
 }
@@ -102,8 +102,8 @@ if !(ok) {
     test_fail
 }
 
-&User-Name := 'user3'
-&User-Password := 'test3'
+User-Name := 'user3'
+User-Password := 'test3'
 imap.authenticate {
     fail = 1
 }
diff --git a/src/tests/modules/json/encode.unlang b/src/tests/modules/json/encode.unlang
index 2b1b0d43ad11f..c5a0f2946795d 100644
--- a/src/tests/modules/json/encode.unlang
+++ b/src/tests/modules/json/encode.unlang
@@ -6,7 +6,7 @@ string test_string5
 #
 #	json.encode tests
 #
-&request -= Packet-Type[*]
+request -= Packet-Type[*]
 
 #
 #  HACK: the edit code does not currently support deleted by parent
@@ -14,18 +14,18 @@ string test_string5
 #  or even request -= Net.[*]
 #  which returns an error?
 #
-&request -= Net.Src.IP
-&request -= Net.Src.Port
-&request -= Net.Dst.IP
-&request -= Net.Dst.Port
-&request -= Net.Timestamp
-&request -= Net[*]
+request -= Net.Src.IP
+request -= Net.Src.Port
+request -= Net.Dst.IP
+request -= Net.Dst.Port
+request -= Net.Timestamp
+request -= Net[*]
 
 # 0. Check basic xlat parsing
-&test_string1 := %json.encode("request.[*]")
-&test_string2 := %json.encode("request.[*] ")
-&test_string3 := %json.encode(" request.[*]")
-&test_string4 := %json.encode(" 	 request.[*]	")
+test_string1 := %json.encode("request.[*]")
+test_string2 := %json.encode("request.[*] ")
+test_string3 := %json.encode(" request.[*]")
+test_string4 := %json.encode(" 	 request.[*]	")
 
 if (!(test_string1 == '{"User-Name":{"type":"string","value":"john"},"Filter-Id":{"type":"string","value":["f1","f2"]},"NAS-Port":{"type":"uint32","value":999},"Service-Type":{"type":"uint32","value":"Login-User"}}')) {
 	test_fail
@@ -39,19 +39,19 @@ if (!(test_string1 == test_string2) ||
 }
 
 #  Check defaults are the same as output_mode "object":
-&test_string2 := %json_object.encode("request.[*]")
-&test_string3 := %json_object_no.encode("request.[*]")
+test_string2 := %json_object.encode("request.[*]")
+test_string3 := %json_object_no.encode("request.[*]")
 if (!(test_string1 == test_string2) ||
     !(test_string1 == test_string3)) {
 	test_fail
 }
 
-&test_string1 := %json.encode(" request.[*]    !Filter-Id ")
+test_string1 := %json.encode(" request.[*]    !Filter-Id ")
 if !(test_string1 == '{"User-Name":{"type":"string","value":"john"},"NAS-Port":{"type":"uint32","value":999},"Service-Type":{"type":"uint32","value":"Login-User"}}') {
 	test_fail
 }
 
-&test_string1 := %json.encode("request.[*] ! ")
+test_string1 := %json.encode("request.[*] ! ")
 if test_string1 {
 	test_fail
 }
@@ -60,8 +60,8 @@ if test_string1 {
 
 # These are unsorted dictionaries. Hopefully json-c doesn't suddenly
 # decide that it's going to use a different ordering of the keys...
-&test_string1 := %json_object.encode("request.[*]")
-&test_string2 := %json_object_ex.encode("request.[*]")
+test_string1 := %json_object.encode("request.[*]")
+test_string2 := %json_object_ex.encode("request.[*]")
 
 if !(test_string1 == '{"User-Name":{"type":"string","value":"john"},"Filter-Id":{"type":"string","value":["f1","f2"]},"NAS-Port":{"type":"uint32","value":999},"Service-Type":{"type":"uint32","value":"Login-User"}}') {
 	test_fail
@@ -73,15 +73,15 @@ if !(test_string2 == '{"pf:User-Name":{"type":"string","value":["john"]},"pf:Fil
 }
 
 # 1b. "object" empty inputs
-&test_string1 := %json_object.encode("!request.[*]")
+test_string1 := %json_object.encode("!request.[*]")
 
 if !(test_string1 == '{}') {
 	test_fail
 }
 
 # 2a. Output mode "object_simple" tests
-&test_string1 := %json_object_simple.encode("request.[*]")
-&test_string2 := %json_object_simple_ex.encode("request.[*]")
+test_string1 := %json_object_simple.encode("request.[*]")
+test_string2 := %json_object_simple_ex.encode("request.[*]")
 
 if !(test_string1 == '{"User-Name":"john","Filter-Id":["f1","f2"],"NAS-Port":999,"Service-Type":"Login-User"}') {
 	test_fail
@@ -92,15 +92,15 @@ if !(test_string2 == '{"pf:User-Name":["john"],"pf:Filter-Id":["f1","f2"],"pf:NA
 }
 
 # 2b. "object_simple" empty inputs
-&test_string1 := %json_object_simple.encode("!request.[*]")
+test_string1 := %json_object_simple.encode("!request.[*]")
 
 if !(test_string1 == '{}') {
 	test_fail
 }
 
 # 3a. Output mode "array" tests
-&test_string1 := %json_array.encode("request.[*]")
-&test_string2 := %json_array_ex.encode("request.[*]")
+test_string1 := %json_array.encode("request.[*]")
+test_string2 := %json_array_ex.encode("request.[*]")
 
 if !(test_string1 == '[{"name":"User-Name","type":"string","value":"john"},{"name":"Filter-Id","type":"string","value":"f1"},{"name":"Filter-Id","type":"string","value":"f2"},{"name":"NAS-Port","type":"uint32","value":999},{"name":"Service-Type","type":"uint32","value":"Login-User"}]') {
 	test_fail
@@ -111,15 +111,15 @@ if !(test_string2 == '[{"name":"pf:User-Name","type":"string","value":["john"]},
 }
 
 # 3b. "array" empty inputs
-&test_string1 := %json_array.encode("!request.[*]")
+test_string1 := %json_array.encode("!request.[*]")
 
 if !(test_string1 == '[]') {
 	test_fail
 }
 
 # 4a. Output mode "array_of_names" tests
-&test_string1 := %json_array_names.encode("request.[*]")
-&test_string2 := %json_array_names_ex.encode("request.[*]")
+test_string1 := %json_array_names.encode("request.[*]")
+test_string2 := %json_array_names_ex.encode("request.[*]")
 
 if !(test_string1 == '["User-Name","Filter-Id","Filter-Id","NAS-Port","Service-Type"]') {
 	test_fail
@@ -130,15 +130,15 @@ if !(test_string2 == '["pf:User-Name","pf:Filter-Id","pf:Filter-Id","pf:NAS-Port
 }
 
 # 4b. "array_of_names" empty inputs
-&test_string1 := %json_array_names.encode("!request.[*]")
+test_string1 := %json_array_names.encode("!request.[*]")
 
 if !(test_string1 == '[]') {
 	test_fail
 }
 
 # 5a. Output mode "array_of_values" tests
-&test_string1 := %json_array_values.encode("request.[*]")
-&test_string2 := %json_array_values_ex.encode("request.[*]")
+test_string1 := %json_array_values.encode("request.[*]")
+test_string2 := %json_array_values_ex.encode("request.[*]")
 
 if !(test_string1 == '["john","f1","f2",999,"Login-User"]') {
 	test_fail
@@ -149,7 +149,7 @@ if !(test_string2 == '["john","f1","f2","999","1"]') {
 }
 
 # 5b. "array_of_values" empty inputs
-&test_string1 := %json_array_values.encode("!request.[*]")
+test_string1 := %json_array_values.encode("!request.[*]")
 
 if !(test_string1 == '[]') {
 	test_fail
diff --git a/src/tests/modules/json/encode_error.unlang b/src/tests/modules/json/encode_error.unlang
index 2babd9c56240e..69adac27db920 100644
--- a/src/tests/modules/json/encode_error.unlang
+++ b/src/tests/modules/json/encode_error.unlang
@@ -3,7 +3,7 @@ string test_string
 #       json xlat input parsing test - error with no input
 #
 
-&test_string := %json_object_ex_encode()  # ERROR
+test_string := %json_object_ex_encode()  # ERROR
 if (test_string) {
 	test_fail
 }
diff --git a/src/tests/modules/json/eval.unlang b/src/tests/modules/json/eval.unlang
index 49fb591ee8b01..a7427d8e15021 100644
--- a/src/tests/modules/json/eval.unlang
+++ b/src/tests/modules/json/eval.unlang
@@ -5,7 +5,7 @@ uint32 test_integer
 int64 test_int64
 string test_string
 
-&Filter-Id := "{\"foo\":\"bar\"}"
+Filter-Id := "{\"foo\":\"bar\"}"
 
 # 0. Simple field access
 map json Filter-Id {
@@ -16,7 +16,7 @@ if !(Callback-Id == 'bar') {
 	test_fail
 }
 
-&Filter-Id := "\
+Filter-Id := "\
 {\
 	\"my_array\": [0, 1, 2, 3, 4, 5], \
 	\"my_object\": { \
@@ -30,7 +30,7 @@ if !(Callback-Id == 'bar') {
 	\"bool_false\": false \
 }"
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # Check conversion of all JSON types to strings
 map json Filter-Id {
@@ -72,7 +72,7 @@ if (Callback-Id[6] != 'no') {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 #
 # Now check array slicing operates correctly
@@ -86,7 +86,7 @@ if !(Callback-Id == '[ 0, 1, 2, 3, 4, 5 ]') {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # 9. Simple index
 map json Filter-Id {
@@ -96,7 +96,7 @@ if !(NAS-Port == 0) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 9a. All of the array
 map json Filter-Id {
@@ -106,7 +106,7 @@ if (!(NAS-Port[0] == 0) || !(NAS-Port[1] == 1) || !(NAS-Port[2] == 2) || !(NAS-P
 	test_fail
 }
 
-&NAS-Port := 9
+NAS-Port := 9
 
 # 9b. All of the array using prepend, places the array before the existing value
 map json Filter-Id {
@@ -116,7 +116,7 @@ if (!(NAS-Port[0] == 0) || !(NAS-Port[1] == 1) || !(NAS-Port[2] == 2) || !(NAS-P
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 10. End of the array
 map json Filter-Id {
@@ -126,7 +126,7 @@ if !(NAS-Port == 5) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 11. Past end of the array
 map json Filter-Id {
@@ -136,7 +136,7 @@ if (NAS-Port) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 12. Simple slice
 map json Filter-Id {
@@ -146,7 +146,7 @@ if (!(NAS-Port[0] == 0) || !(NAS-Port[1] == 1)) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 13. Slice with negative start
 map json Filter-Id {
@@ -156,7 +156,7 @@ if !(NAS-Port == 5) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 14. Slice with negative start and negative end
 map json Filter-Id {
@@ -174,7 +174,7 @@ if (!(NAS-Port[0] == 1) && !(NAS-Port[1] == 2)) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 16. Slice with start, end and negative step
 map json Filter-Id {
@@ -184,7 +184,7 @@ if (!(NAS-Port[0] == 4) || !(NAS-Port[1] == 3)) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 17. Slice with start, end (inverted) and negative step
 map json Filter-Id {
@@ -194,7 +194,7 @@ if (NAS-Port) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 18. Slice with start, end and positive step
 map json Filter-Id {
@@ -204,7 +204,7 @@ if (!(NAS-Port[0] == 2) || !(NAS-Port[1] == 3)) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 19. Slice with start, end and positive step > 1
 map json Filter-Id {
@@ -214,7 +214,7 @@ if (!(NAS-Port[0] == 1) && !(NAS-Port[1] == 3)) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 20. Slice with start, end and positive step > end of array
 map json Filter-Id {
@@ -224,7 +224,7 @@ if (!(NAS-Port[0] == 1) || NAS-Port[1]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 21. Slice with start, end and positive step > end of array
 map json Filter-Id {
@@ -234,7 +234,7 @@ if (!(NAS-Port[0] == 5) || NAS-Port[1]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 22. No start/end 3 step
 map json Filter-Id {
@@ -244,7 +244,7 @@ if (!(NAS-Port[0] == 0) || !(NAS-Port[1] == 3) || NAS-Port[2]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 23. No start/end 3 step
 map json Filter-Id {
@@ -254,7 +254,7 @@ if (!(NAS-Port[0] == 5) || !(NAS-Port[1] == 2) || NAS-Port[2]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 24. No end 3 step
 map json Filter-Id {
@@ -264,7 +264,7 @@ if (!(NAS-Port[0] == 3) || !(NAS-Port[1] == 0) || NAS-Port[2]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 25. End 0, 3 step
 map json Filter-Id {
@@ -274,7 +274,7 @@ if (!(NAS-Port[0] == 3) || NAS-Port[1]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 26. End 0, 3 step
 map json Filter-Id {
@@ -284,7 +284,7 @@ if (!(NAS-Port[0] == 0) || NAS-Port[1]) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 27. Everything two levels deep
 map json Filter-Id {
@@ -302,7 +302,7 @@ if (!(Callback-Id[0] == '0') || \
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # 28. Everything three levels deep (nothing)
 map json Filter-Id {
@@ -332,7 +332,7 @@ if (Callback-Id) {
 }
 
 # Some big numbers in nested arrays
-&Filter-Id := "\
+Filter-Id := "\
 [\
 	9223372036854775807, \
 	-9223372036854775807, \
@@ -367,7 +367,7 @@ if !(NAS-Port == 2147483647) {
 	test_fail
 }
 
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 33. Signed 64bit integers
 if (0) {
@@ -386,7 +386,7 @@ if !(test_int64 == -9223372036854775807) {
 	test_fail
 }
 
-&request -= test_int64[*]
+request -= test_int64[*]
 
 # 35. Unsigned 64bit integers (not allowed by json so gets truncated)
 map json Filter-Id {
@@ -397,7 +397,7 @@ if !(Acct-Input-Octets64 == 9223372036854775807) {
 }
 }
 
-&request -= Acct-Input-Octets64[*]
+request -= Acct-Input-Octets64[*]
 
 # 36. Multiple array indices
 map json Filter-Id {
@@ -407,10 +407,10 @@ if (!(Cache-TTL[0] == 2147483647) || !(Cache-TTL[1] == -2147483647)) {
 	test_fail
 }
 
-&request -= Cache-TTL[*]
+request -= Cache-TTL[*]
 
 # 37. Path containing dynamic expansion
-&test_integer := 0
+test_integer := 0
 
 map json Filter-Id {
 	NAS-Port += "$[3][%{test_integer}]"
@@ -418,14 +418,14 @@ map json Filter-Id {
 if !(NAS-Port == 2147483647) {
 	test_fail
 }
-&request -= NAS-Port[*]
+request -= NAS-Port[*]
 
 # 38. An expanded field name with bad chars
-&Filter-Id := "\
+Filter-Id := "\
 {\
 	\"foo.bar\": \"baz\" \
 }"
-&test_string := "%taint('foo.bar')"
+test_string := "%taint('foo.bar')"
 
 map json Filter-Id {
 	Callback-Id := "$.%{test_string}"
@@ -435,9 +435,9 @@ if !(Callback-Id == 'baz') {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
-&Filter-Id := "\
+Filter-Id := "\
 {\
 	\"my_array\": [0, 1, 2, 3, 4, 5], \
 	\"my_object\": { \
@@ -470,7 +470,7 @@ if (!("%{Callback-Id[#]}" == 1) || !(Callback-Id == 'yes')) {
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # 40. Recursive descent with element match (2nd element in each array)
 map json Filter-Id {
@@ -479,7 +479,7 @@ map json Filter-Id {
 if (!("%{Callback-Id[#]}" == 3) || !(Callback-Id[0] == '1') || !(Callback-Id[1] == 'scratchy') || !(Callback-Id[2] == 'clawy')) {
 	test_fail
 }
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 # 41. Recursive descent with field then element match
 map json Filter-Id {
@@ -489,6 +489,6 @@ if (!("%{Callback-Id[#]}" == 2) || !(Callback-Id[0] == 'flat') || !(Callback-Id[
 	test_fail
 }
 
-&request -= Callback-Id[*]
+request -= Callback-Id[*]
 
 test_pass
diff --git a/src/tests/modules/json/json_quote.unlang b/src/tests/modules/json/json_quote.unlang
index 97f0799c6e280..7b21443cf1772 100644
--- a/src/tests/modules/json/json_quote.unlang
+++ b/src/tests/modules/json/json_quote.unlang
@@ -3,32 +3,32 @@ uint32 test_integer
 ipaddr test_ipaddr
 string dummy_string
 
-&test_string := "Hello\n"
+test_string := "Hello\n"
 if (!(%json.quote(%{test_string}) == "\"Hello\\n\"")) {
 	test_fail
 }
 
-&test_string := "Hello\nbob"
+test_string := "Hello\nbob"
 if (!(%json.quote(%{test_string}) == "\"Hello\\nbob\"")) {
 	test_fail
 }
 
-&test_string := "\nHello\nbob"
+test_string := "\nHello\nbob"
 if (!(%json.quote(%{test_string}) == "\"\\nHello\\nbob\"")) {
 	test_fail
 }
 
-&test_string := "Hello!"
+test_string := "Hello!"
 if (!(%json.quote(%{test_string}) == '"Hello!"')) {
 	test_fail
 }
 
-&test_integer := 123456
+test_integer := 123456
 if (!(%json.quote(%{test_integer}) == '123456')) {
 	test_fail
 }
 
-&test_ipaddr := 127.0.0.1
+test_ipaddr := 127.0.0.1
 if (!(%json.quote(%{test_ipaddr}) == '"127.0.0.1"')) {
 	test_fail
 }
diff --git a/src/tests/modules/json/nested_encode.unlang b/src/tests/modules/json/nested_encode.unlang
index c0e3a79f7e1e8..df691de4ffb19 100644
--- a/src/tests/modules/json/nested_encode.unlang
+++ b/src/tests/modules/json/nested_encode.unlang
@@ -1,4 +1,4 @@
-&Tag-1 := {
+Tag-1 := {
 	Vendor-Specific = {
 		Unisphere = {
 			Service-Activate = "PPPOE_SERVICE(3072000,2048000)"
diff --git a/src/tests/modules/json/regression02.unlang b/src/tests/modules/json/regression02.unlang
index 4e799d273e7a9..db46b4e3cd06f 100644
--- a/src/tests/modules/json/regression02.unlang
+++ b/src/tests/modules/json/regression02.unlang
@@ -1,7 +1,7 @@
 string test_string
 
 # An error string from Azure AD, try and access all the bits
-&test_string := "{\"error\":\"invalid_grant\",\"error_description\":\"AADSTS50126: Error validating credentials due to invalid username or password.\\r\\nTrace ID: 20bb60a5-5504-4a6b-ab40-a353a95c2500\\r\\nCorrelation ID: e58bb567-ad15-4a46-8341-cc6e800dd817\\r\\nTimestamp: 2023-02-11 02:32:40Z\",\"error_codes\":[50126],\"timestamp\":\"2023-02-11 02:32:40Z\",\"trace_id\":\"20bb60a5-5504-4a6b-ab40-a353a95c2500\",\"correlation_id\":\"e58bb567-ad15-4a46-8341-cc6e800dd817\",\"error_uri\":\"https://login.microsoftonline.com/error?code=50126\"}"
+test_string := "{\"error\":\"invalid_grant\",\"error_description\":\"AADSTS50126: Error validating credentials due to invalid username or password.\\r\\nTrace ID: 20bb60a5-5504-4a6b-ab40-a353a95c2500\\r\\nCorrelation ID: e58bb567-ad15-4a46-8341-cc6e800dd817\\r\\nTimestamp: 2023-02-11 02:32:40Z\",\"error_codes\":[50126],\"timestamp\":\"2023-02-11 02:32:40Z\",\"trace_id\":\"20bb60a5-5504-4a6b-ab40-a353a95c2500\",\"correlation_id\":\"e58bb567-ad15-4a46-8341-cc6e800dd817\",\"error_uri\":\"https://login.microsoftonline.com/error?code=50126\"}"
 
 map json test_string {
 	Filter-Id := '$.error'
diff --git a/src/tests/modules/ldap/access_state.unlang b/src/tests/modules/ldap/access_state.unlang
index f35f0b6a58cb8..13ce77077066c 100644
--- a/src/tests/modules/ldap/access_state.unlang
+++ b/src/tests/modules/ldap/access_state.unlang
@@ -1,5 +1,5 @@
 # Bill should be disabled
-&Stripped-User-Name := 'bill'
+Stripped-User-Name := 'bill'
 ldap {
 	disallow = 1
 }
@@ -8,7 +8,7 @@ if (!disallow) {
 }
 
 # Test suspended profile application
-&Stripped-User-Name := 'bobby'
+Stripped-User-Name := 'bobby'
 ldap
 if (!updated) {
 	test_fail
@@ -18,6 +18,6 @@ if (reply.Reply-Message != 'User-Suspended') {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/ldap/acct.unlang b/src/tests/modules/ldap/acct.unlang
index 51721667573b7..f8f90e6606d44 100644
--- a/src/tests/modules/ldap/acct.unlang
+++ b/src/tests/modules/ldap/acct.unlang
@@ -9,7 +9,7 @@ if (!ok) {
         test_fail
 }
 
-&test_string := %ldap("ldap://$ENV{TEST_SERVER}/uid=bob,ou=people,dc=example,dc=com?description")
+test_string := %ldap("ldap://$ENV{TEST_SERVER}/uid=bob,ou=people,dc=example,dc=com?description")
 
 if (test_string != "User bob is online") {
         test_fail
diff --git a/src/tests/modules/ldap/auth.unlang b/src/tests/modules/ldap/auth.unlang
index 6a9cba0326c97..a9e6021b72be0 100644
--- a/src/tests/modules/ldap/auth.unlang
+++ b/src/tests/modules/ldap/auth.unlang
@@ -51,41 +51,41 @@ ldap.authenticate
 
 ldap.send.access-accept
 
-&test_string := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?description")
+test_string := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?description")
 
 if (!(test_string == "User %{User-Name} authenticated")) {
 	test_fail
 }
 
 # userPKCS12 is set to be updated from Class - which doesn't exist - check nothing was added
-&test_octets := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?userPKCS12")
+test_octets := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?userPKCS12")
 
 if (test_octets) {
 	test_fail
 }
 
 # Add dummy octet data and re-run the LDAP update to check the data is added
-&Class := 0x01020304
+Class := 0x01020304
 ldap.send.access-accept
 
-&test_octets := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?userPKCS12")
+test_octets := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?userPKCS12")
 
 if (test_octets != 0x01020304) {
 	test_fail
 }
 
 # Remove the RADIUS attribute and check that the update doesn't clear the LDAP attribute
-&request -= Class[*]
+request -= Class[*]
 ldap.send.access-accept
 
-&test_octets := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?userPKCS12")
+test_octets := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?userPKCS12")
 
 if (test_octets != 0x01020304) {
 	test_fail
 }
 
 # carLicense is being populated with += - so there should be 3 instances now
-&control.Filter-Id := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?carLicense")
+control.Filter-Id := %ldap("ldap://$ENV{TEST_SERVER}/uid=john,ou=people,dc=example,dc=com?carLicense")
 if (control.Filter-Id[#] != 3) {
 	test_fail
 }
diff --git a/src/tests/modules/ldap/auth_nested_profile.unlang b/src/tests/modules/ldap/auth_nested_profile.unlang
index 695800f7f8155..730618fa98880 100644
--- a/src/tests/modules/ldap/auth_nested_profile.unlang
+++ b/src/tests/modules/ldap/auth_nested_profile.unlang
@@ -24,7 +24,7 @@ ldap.authenticate
 
 ldap.send.access-accept
 
-&test_string := %ldap("ldap://$ENV{TEST_SERVER}/uid=peter,ou=people,dc=example,dc=com?description")
+test_string := %ldap("ldap://$ENV{TEST_SERVER}/uid=peter,ou=people,dc=example,dc=com?description")
 
 if (!(test_string == "User %{User-Name} authenticated")) {
 	test_fail
diff --git a/src/tests/modules/ldap/auth_ssl.unlang b/src/tests/modules/ldap/auth_ssl.unlang
index f1c98154cd3dd..4789eabf2530a 100644
--- a/src/tests/modules/ldap/auth_ssl.unlang
+++ b/src/tests/modules/ldap/auth_ssl.unlang
@@ -28,7 +28,7 @@ ldapssl.authenticate
 
 ldapssl.send.access-accept
 
-&test_string := %ldapssl("ldaps:///uid=fred,ou=people,dc=subdept,dc=example,dc=com?description")
+test_string := %ldapssl("ldaps:///uid=fred,ou=people,dc=subdept,dc=example,dc=com?description")
 
 if (!(test_string == "User %{User-Name} authenticated")) {
 	test_fail
diff --git a/src/tests/modules/ldap/auth_starttls.unlang b/src/tests/modules/ldap/auth_starttls.unlang
index 60cc0dafb8779..0bc339cae67c3 100644
--- a/src/tests/modules/ldap/auth_starttls.unlang
+++ b/src/tests/modules/ldap/auth_starttls.unlang
@@ -29,7 +29,7 @@ ldaptls.authenticate
 
 ldaptls.send.access-accept
 
-&test_string := %ldaptls("ldap:///uid=joe,ou=people,dc=subdept,dc=example,dc=com?description")
+test_string := %ldaptls("ldap:///uid=joe,ou=people,dc=subdept,dc=example,dc=com?description")
 
 if (!(test_string == "User %{User-Name} authenticated")) {
 	test_fail
diff --git a/src/tests/modules/ldap/dynamic_dn.unlang b/src/tests/modules/ldap/dynamic_dn.unlang
index de8cc65b6648c..82e63f7619d9d 100644
--- a/src/tests/modules/ldap/dynamic_dn.unlang
+++ b/src/tests/modules/ldap/dynamic_dn.unlang
@@ -1,14 +1,14 @@
 
 string base_dn
 
-&base_dn=%ldap.uri.safe('dc=example,dc=com')
+base_dn=%ldap.uri.safe('dc=example,dc=com')
 ldap_dynamic_dn
 if (!ok) {
 	test_fail
 }
 
 # Bad DN
-&base_dn := %ldap.uri.safe('dc=example,dc=foo,dc=com')
+base_dn := %ldap.uri.safe('dc=example,dc=foo,dc=com')
 ldap_dynamic_dn
 if (!notfound) {
 	test_fail
diff --git a/src/tests/modules/ldap/map_regression0.unlang b/src/tests/modules/ldap/map_regression0.unlang
index 0c637f6db055f..00b1c8d4c4e43 100644
--- a/src/tests/modules/ldap/map_regression0.unlang
+++ b/src/tests/modules/ldap/map_regression0.unlang
@@ -1,5 +1,5 @@
 
-&net.src.ip := 1.1.1.1
+net.src.ip := 1.1.1.1
 
 map ldap "ldapi:///ou=clients,dc=example,dc=com??sub?(&(objectClass=radiusClient)(objectClass=freeradiusClient)(freeradiusClientIdentifier=%{net.src.ip}))" {
 	#  secret
diff --git a/src/tests/modules/ldap/xlat.unlang b/src/tests/modules/ldap/xlat.unlang
index 6c65cc99d1519..166a52e6ac7ff 100644
--- a/src/tests/modules/ldap/xlat.unlang
+++ b/src/tests/modules/ldap/xlat.unlang
@@ -5,106 +5,106 @@ string result_string
 #  Test the "ldap" module xlat escape functions
 #
 
-&test_string := "safe string"
+test_string := "safe string"
 
 # String with no escaping
-&result_string := %ldap.uri.escape(%{test_string})
+result_string := %ldap.uri.escape(%{test_string})
 
 if (!(result_string == "safe string")) {
         test_fail
 }
 
-&result_string := %ldap.uri.unescape(%{result_string})
+result_string := %ldap.uri.unescape(%{result_string})
 
 if (!(result_string == 'safe string')) {
         test_fail
 }
 
 # String with some characters to escape
-&test_string := 'non safe,+"\<>;*=() string'
-&result_string := %ldap.uri.escape(%{test_string})
+test_string := 'non safe,+"\<>;*=() string'
+result_string := %ldap.uri.escape(%{test_string})
 
 if (!(result_string == 'non safe\2c\2b\22\5c\3c\3e\3b\2a\3d\28\29 string')) {
         test_fail
 }
 
-&result_string := %ldap.uri.unescape(%{result_string})
+result_string := %ldap.uri.unescape(%{result_string})
 
 if (!(result_string == 'non safe,+"\<>;*=() string')) {
         test_fail
 }
 
 # String where all characters require escaping
-&test_string := ',+"\<>;*=()'
-&result_string := %ldap.uri.escape(%{test_string})
+test_string := ',+"\<>;*=()'
+result_string := %ldap.uri.escape(%{test_string})
 
 if (!(result_string == '\2c\2b\22\5c\3c\3e\3b\2a\3d\28\29')) {
         test_fail
 }
 
-&result_string := %ldap.uri.unescape(%{result_string})
+result_string := %ldap.uri.unescape(%{result_string})
 
 if (!(result_string == ',+"\<>;*=()')) {
         test_fail
 }
 
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=people,dc=example,dc=com?displayName?sub?(uid=john)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=people,dc=example,dc=com?displayName?sub?(uid=john)")
 
 if (!(result_string == "John Doe")) {
         test_fail
 }
 
 # Return multiple values - could be in any sequence
-&Framed-IP-Address := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=clients,dc=example,dc=com?freeradiusClientIdentifier?sub?(objectClass=freeradiusClient)")
+Framed-IP-Address := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=clients,dc=example,dc=com?freeradiusClientIdentifier?sub?(objectClass=freeradiusClient)")
 
 if !((Framed-IP-Address[0] == "1.1.1.1") && (Framed-IP-Address[1] == "2.2.2.2")) {
         test_fail
 }
 
 # Use tainted string in filter - with special characters
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=people,dc=example,dc=com?cn?sub?(displayName=*%{Filter-Id}*)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=people,dc=example,dc=com?cn?sub?(displayName=*%{Filter-Id}*)")
 
 if (!(result_string == "Bob Smith")) {
         test_fail
 }
 
 # A query which should return no results
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=people,dc=example,dc=com?displayName?sub?(uid=notknown)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=people,dc=example,dc=com?displayName?sub?(uid=notknown)")
 
 if (result_string) {
         test_fail
 }
 
 # Request an invalid DN
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=notthere?displayName?sub?(uid=john)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=notthere?displayName?sub?(uid=john)")
 
 if (result_string) {
         test_fail
 }
 
 # Query within a dn which will prompt a referral
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/dc=subdept,dc=example,dc=com?displayName?sub?(uid=fred)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/dc=subdept,dc=example,dc=com?displayName?sub?(uid=fred)")
 
 if (!(result_string == "Fred Jones")) {
         test_fail
 }
 
 # Reference an alternative LDAP server in the xlat
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:%ldap.uri.escape(%{$ENV{LDAP_TEST_SERVER_PORT} + 1})/dc=subdept,dc=example,dc=com?displayName?sub?(uid=fred)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:%ldap.uri.escape(%{$ENV{LDAP_TEST_SERVER_PORT} + 1})/dc=subdept,dc=example,dc=com?displayName?sub?(uid=fred)")
 
 if (!(result_string == "Fred Jones")) {
         test_fail
 }
 
 # This query will follow 2 referrals, the second will present an alternate search base
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=offsite,dc=subdept,dc=example,dc=com?displayName?sub?(uid=john)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=offsite,dc=subdept,dc=example,dc=com?displayName?sub?(uid=john)")
 
 if (!(result_string == "John Doe")) {
         test_fail
 }
 
 # This query will follow 3 referrals - more than our max referral depth
-&result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=bounce1,dc=subdept,dc=example,dc=com?displayName?sub?(uid=fred)")
+result_string := %ldap("ldap://$ENV{LDAP_TEST_SERVER}:$ENV{LDAP_TEST_SERVER_PORT}/ou=bounce1,dc=subdept,dc=example,dc=com?displayName?sub?(uid=fred)")
 
 if (result_string) {
         test_fail
@@ -115,7 +115,7 @@ if (!(Module-Failure-Message == "Maximum LDAP referral depth (2) exceeded")) {
 }
 
 # Use an ldapi:// connection
-&result_string := %ldapldapi("ldapi:///ou=people,dc=example,dc=com?displayName?sub?(uid=john)")
+result_string := %ldapldapi("ldapi:///ou=people,dc=example,dc=com?displayName?sub?(uid=john)")
 
 if !(result_string == 'John Doe') {
 	test_fail
diff --git a/src/tests/modules/ldap/xlat_profile.unlang b/src/tests/modules/ldap/xlat_profile.unlang
index 7fbc297a9e773..a57e9ec8efa95 100644
--- a/src/tests/modules/ldap/xlat_profile.unlang
+++ b/src/tests/modules/ldap/xlat_profile.unlang
@@ -55,7 +55,7 @@ if (!((reply.Framed-IP-Netmask == 255.255.192.0) && \
 	test_fail
 }
 
-&control := {}
-&reply := {}
+control := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/linelog/linelog-errors.unlang b/src/tests/modules/linelog/linelog-errors.unlang
index 3d9b3b572cb87..e200b86416da0 100644
--- a/src/tests/modules/linelog/linelog-errors.unlang
+++ b/src/tests/modules/linelog/linelog-errors.unlang
@@ -12,7 +12,7 @@ if (!fail) {
 }
 
 #  References are not allowed to go to parent config sections
-&control.Filter-Id := '..messages.valid'
+control.Filter-Id := '..messages.valid'
 
 linelog_missingref {
 	fail = 1
@@ -26,7 +26,7 @@ if !(Module-Failure-Message == 'linelog_missingref: Invalid path "..messages.val
 }
 
 #  Missing config items fall back to the default (which is not set)
-&control.Filter-Id := '.message.valid'
+control.Filter-Id := '.message.valid'
 
 linelog_missingref
 
@@ -35,7 +35,7 @@ if (!noop) {
 }
 
 #  Pointing at a config section is not valid
-&control.Filter-Id := '.messages'
+control.Filter-Id := '.messages'
 
 linelog_missingref {
 	fail = 1
@@ -46,7 +46,7 @@ if !(Module-Failure-Message == 'linelog_missingref: Path ".messages" resolves to
 }
 
 #  Valid reference, but the message points to an attribute that doesn't exist - so no output
-&control.Filter-Id := 'messages.valid'
+control.Filter-Id := 'messages.valid'
 
 linelog_missingref
 
diff --git a/src/tests/modules/linelog/linelog-escapes.unlang b/src/tests/modules/linelog/linelog-escapes.unlang
index ed172a7d7ff53..d383998600ea0 100644
--- a/src/tests/modules/linelog/linelog-escapes.unlang
+++ b/src/tests/modules/linelog/linelog-escapes.unlang
@@ -1,7 +1,7 @@
 string test_string1
 string test_string2
 
-&control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
+control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
 
 #
 #  Remove old log files
@@ -10,12 +10,12 @@ string test_string2
 
 #  Raw attribute value should be written out without further molestation.
 #  Because the value is wrapped in '' the \n is left as \n.
-&control.Filter-Id := 'test_attr'
-&control.Callback-Id := 'foo\nbar'
+control.Filter-Id := 'test_attr'
+control.Callback-Id := 'foo\nbar'
 
 linelog_escapes
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log")
-&test_string2 := "%hex(%{test_string1})"
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log")
+test_string2 := "%hex(%{test_string1})"
 
 #
 #  Note that there's a '5f6e' here, which is "\n"
@@ -28,7 +28,7 @@ else {
 	test_fail
 }
 
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log")
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log")
 
 #
 #  This is left alone, and not "\n" --> 0x0a, too.
@@ -42,12 +42,12 @@ else {
 
 #  Raw attribute value should be written out without further molestation.
 #  Because the value is wrapped in "" the \n is converted to 0x0a (binary).
-&control.Filter-Id := 'test_attr'
-&control.Callback-Id := "foo\nbar"
+control.Filter-Id := 'test_attr'
+control.Callback-Id := "foo\nbar"
 
 linelog_escapes
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log", 2)
-&test_string2 := "%hex(%{test_string1})"
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log", 2)
+test_string2 := "%hex(%{test_string1})"
 
 if (test_string2 == '666f6f0a626172') {
 	test_pass
@@ -56,7 +56,7 @@ else {
 	test_fail
 }
 
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log")
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_escapes.log")
 
 if (test_string1 == "bar") {
 	test_pass
diff --git a/src/tests/modules/linelog/linelog-multi.unlang b/src/tests/modules/linelog/linelog-multi.unlang
index 101b795d42282..69fab68412db4 100644
--- a/src/tests/modules/linelog/linelog-multi.unlang
+++ b/src/tests/modules/linelog/linelog-multi.unlang
@@ -1,6 +1,6 @@
 string test_string
 
-&control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
+control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
 
 #
 #  Remove old log files
@@ -8,9 +8,9 @@ string test_string
 %file.rm("$ENV{MODULE_TEST_DIR}/test_multi.log")
 
 #  Check multiple string type attributes are logged correctly
-&control.Filter-Id := 'test_multi_str'
+control.Filter-Id := 'test_multi_str'
 
-&control += {
+control += {
 	Reply-Message = '0'
 	Reply-Message = '1'
 	Reply-Message = '2'
@@ -25,31 +25,31 @@ string test_string
 }
 
 linelog_ref_multi
-&test_string := %file.tail("$ENV{MODULE_TEST_DIR}/test_multi.log")
+test_string := %file.tail("$ENV{MODULE_TEST_DIR}/test_multi.log")
 
 if !(test_string == '0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, ') {
 	test_fail
 }
 
 # Check octet type attributes are logged in raw form
-&control += {
+control += {
 	Class = 0x686970706f	# Hippo
 	Class = 0x0a		# new line
 	Class = 0x626c6970706f	# Blippo
 }
 
-&control.Filter-Id := 'test_multi_octets'
+control.Filter-Id := 'test_multi_octets'
 
 linelog_ref_multi
 
-&test_string := %file.tail("$ENV{MODULE_TEST_DIR}/test_multi.log")
+test_string := %file.tail("$ENV{MODULE_TEST_DIR}/test_multi.log")
 
 if !(test_string == ', blippo, ') {
 	test_fail
 }
 
 #  When no attributes that match are available, linelog should return noop
-&control.Filter-Id := 'test_empty'
+control.Filter-Id := 'test_empty'
 
 linelog_ref_multi
 if !(noop) {
diff --git a/src/tests/modules/linelog/linelog.unlang b/src/tests/modules/linelog/linelog.unlang
index 45eefa1d82df0..59df34ef5eab7 100644
--- a/src/tests/modules/linelog/linelog.unlang
+++ b/src/tests/modules/linelog/linelog.unlang
@@ -9,7 +9,7 @@ control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
 %file.rm("$ENV{MODULE_TEST_DIR}/test_a.log")
 
 #  Check linelog fails over to the default message (an xlat expansion)
-&control.Filter-Id := 'test_default'
+control.Filter-Id := 'test_default'
 
 linelog_fmt_and_ref
 test_string := %file.tail("$ENV{MODULE_TEST_DIR}/test_a.log")
diff --git a/src/tests/modules/linelog/linelog_xlat.unlang b/src/tests/modules/linelog/linelog_xlat.unlang
index 4effdf13368a8..f5ed7e668a2fe 100644
--- a/src/tests/modules/linelog/linelog_xlat.unlang
+++ b/src/tests/modules/linelog/linelog_xlat.unlang
@@ -2,7 +2,7 @@ string test_string1
 string test_string2
 string test_string3
 
-&control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
+control.Exec-Export := 'PATH="$ENV{PATH}:/bin:/usr/bin:/opt/bin:/usr/local/bin"'
 
 #
 #  Remove old log files
@@ -12,7 +12,7 @@ string test_string3
 if (%linelog_fmt_delim_xlat('bob') != 5) {
 	test_fail
 }
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_xlat.log")
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_xlat.log")
 
 if (test_string1 == 'bob, ') {
 	test_pass
@@ -21,13 +21,13 @@ else {
 	test_fail
 }
 
-&test_string2 := 'more'
-&test_string3 := 'bob'
+test_string2 := 'more'
+test_string3 := 'bob'
 
 if (%linelog_fmt_delim_xlat("%{test_string2}%{test_string3}") != 9) {
 	test_fail
 }
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_xlat.log")
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_xlat.log")
 if (test_string1 == 'bob, morebob, ') {
 	test_pass
 }
@@ -46,7 +46,7 @@ if (%linelog_fmt_delim_xlat("{ \"foo\" : \"bar\", \"baz\" : \"boink\" }") == 36)
 	test_fail
 }
 
-&test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_xlat.log")
+test_string1 := %file.tail("$ENV{MODULE_TEST_DIR}/test_xlat.log")
 
 if (test_string1 == '{ "foo" : "bar", "baz" : "boink" }, ') {
 	test_pass
diff --git a/src/tests/modules/mschap/auth.unlang b/src/tests/modules/mschap/auth.unlang
index 593fac7d7988d..bd7c679b5bfce 100644
--- a/src/tests/modules/mschap/auth.unlang
+++ b/src/tests/modules/mschap/auth.unlang
@@ -1,4 +1,4 @@
-&control.Password.Cleartext := "supersecret"
+control.Password.Cleartext := "supersecret"
 
 mschap
 
@@ -12,7 +12,7 @@ if !(reply.Vendor-Specific.Microsoft.CHAP-MPPE-Keys) {
 	test_fail
 }
 
-&reply -= Vendor-Specific.Microsoft.CHAP-MPPE-Keys
+reply -= Vendor-Specific.Microsoft.CHAP-MPPE-Keys
 
 test_pass
 
diff --git a/src/tests/modules/mschap/auth_mschapv2.unlang b/src/tests/modules/mschap/auth_mschapv2.unlang
index 54dd8eefb6587..f799c7bc362bc 100644
--- a/src/tests/modules/mschap/auth_mschapv2.unlang
+++ b/src/tests/modules/mschap/auth_mschapv2.unlang
@@ -1,4 +1,4 @@
-&control.Password.Cleartext := "secret"
+control.Password.Cleartext := "secret"
 
 mschap
 
@@ -16,7 +16,7 @@ if !(reply.Vendor-Specific.Microsoft.MPPE-Recv-Key) {
 	test_fail
 }
 
-&reply -= Vendor-Specific.Microsoft.MPPE-Send-Key
-&reply -= Vendor-Specific.Microsoft.MPPE-Recv-Key
+reply -= Vendor-Specific.Microsoft.MPPE-Send-Key
+reply -= Vendor-Specific.Microsoft.MPPE-Recv-Key
 
 test_pass
diff --git a/src/tests/modules/mschap/auth_winbind.unlang b/src/tests/modules/mschap/auth_winbind.unlang
index c43a60dbbba56..8778f1b74a1e5 100644
--- a/src/tests/modules/mschap/auth_winbind.unlang
+++ b/src/tests/modules/mschap/auth_winbind.unlang
@@ -1,4 +1,4 @@
-&control.Password.Cleartext := 'secret_123'
+control.Password.Cleartext := 'secret_123'
 
 mschap_winbind
 
@@ -24,6 +24,6 @@ if !(reply.Vendor-Specific.Microsoft.CHAP-MPPE-Keys) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/mschap/pwdchange_local.unlang b/src/tests/modules/mschap/pwdchange_local.unlang
index 57b84196e7614..c0eec218bef75 100644
--- a/src/tests/modules/mschap/pwdchange_local.unlang
+++ b/src/tests/modules/mschap/pwdchange_local.unlang
@@ -1,4 +1,4 @@
-&control.Password.Cleartext := "secret"
+control.Password.Cleartext := "secret"
 
 mschap
 
@@ -35,7 +35,7 @@ if !(reply.Vendor-Specific.Microsoft.MPPE-Recv-Key) {
 	test_fail
 }
 
-&reply -= Vendor-Specific.Microsoft.MPPE-Send-Key
-&reply -= Vendor-Specific.Microsoft.MPPE-Recv-Key
+reply -= Vendor-Specific.Microsoft.MPPE-Send-Key
+reply -= Vendor-Specific.Microsoft.MPPE-Recv-Key
 
 test_pass
diff --git a/src/tests/modules/mschap/pwdchange_ntlm.unlang b/src/tests/modules/mschap/pwdchange_ntlm.unlang
index e25d491c8c5c7..0884375b8f3a1 100644
--- a/src/tests/modules/mschap/pwdchange_ntlm.unlang
+++ b/src/tests/modules/mschap/pwdchange_ntlm.unlang
@@ -1,4 +1,4 @@
-&control.Password.Cleartext := "SuperSecret"
+control.Password.Cleartext := "SuperSecret"
 
 mschap_ntlm
 
@@ -16,7 +16,7 @@ if !(reply.Vendor-Specific.Microsoft.MPPE-Recv-Key) {
 	test_fail
 }
 
-&reply -= Vendor-Specific.Microsoft.MPPE-Send-Key
-&reply -= Vendor-Specific.Microsoft.MPPE-Recv-Key
+reply -= Vendor-Specific.Microsoft.MPPE-Send-Key
+reply -= Vendor-Specific.Microsoft.MPPE-Recv-Key
 
 test_pass
diff --git a/src/tests/modules/perl/auth.unlang b/src/tests/modules/perl/auth.unlang
index 131e597c4a976..f1765a9b8ffd1 100644
--- a/src/tests/modules/perl/auth.unlang
+++ b/src/tests/modules/perl/auth.unlang
@@ -10,14 +10,14 @@ if !(reply.Reply-Message == "Denied access by rlm_perl function") {
     test_fail
 }
 
-&reply -= Reply-Message[*]
+reply -= Reply-Message[*]
 
 #  User will not be rejected - an xlat will be called setting a reply attribute
-&User-Name := 'bob'
+User-Name := 'bob'
 
 # Add two instances of a TLV - will result in an array of hashes in Perl
-&Vendor-Specific.3GPP2.Remote-IP = { Address = 192.168.1.1, Mask = 24 }
-&request.Vendor-Specific.3GPP2 += { Remote-IP = { Address = 172.16.1.1, Mask = 16 } }
+Vendor-Specific.3GPP2.Remote-IP = { Address = 192.168.1.1, Mask = 24 }
+request.Vendor-Specific.3GPP2 += { Remote-IP = { Address = 172.16.1.1, Mask = 16 } }
 
 perl.authenticate
 
@@ -40,7 +40,7 @@ if (control.NAS-Identifier) {
 	test_fail
 }
 
-&reply -= Vendor-Specific[*]
-&reply -= Filter-Id[*]
+reply -= Vendor-Specific[*]
+reply -= Filter-Id[*]
 
 test_pass
diff --git a/src/tests/modules/perl/xlat.unlang b/src/tests/modules/perl/xlat.unlang
index 9ce3a8614b250..5af0f6ffec098 100644
--- a/src/tests/modules/perl/xlat.unlang
+++ b/src/tests/modules/perl/xlat.unlang
@@ -6,44 +6,44 @@ uint32 result_integer
 #  PRE: update
 #
 
-&Filter-Id := 'hello,goodbye,welcome,farewell'
-&test_string := 'foo,bar'
-&Callback-Id := %perl_xlat('xlat', %{Filter-Id})
+Filter-Id := 'hello,goodbye,welcome,farewell'
+test_string := 'foo,bar'
+Callback-Id := %perl_xlat('xlat', %{Filter-Id})
 
 if (Callback-Id != 'hello|goodbye|welcome|farewell') {
 	test_fail
 }
 
 # Check for multiple arguments to perl function
-&result_string := %perl_xlat('xlat', %{Filter-Id}, %{test_string})
+result_string := %perl_xlat('xlat', %{Filter-Id}, %{test_string})
 
 if (result_string != 'hello|goodbye|welcome|farewell#foo|bar') {
 	test_fail
 }
 
-&result_integer := %perl_xlat('add', 1, 2, 3)
+result_integer := %perl_xlat('add', 1, 2, 3)
 
 if (result_integer != 6) {
 	test_fail
 }
 
-&Filter-Id := 'hello'
-&request += {
+Filter-Id := 'hello'
+request += {
 	Filter-Id = 'goodbye'
 	Filter-Id = 'welcome'
 }
 
 # Pass a list as an array
-&Callback-Id := %perl_xlat('xlatarray', %{Filter-Id[*]})
+Callback-Id := %perl_xlat('xlatarray', %{Filter-Id[*]})
 
 if (Callback-Id != 'hello|goodbye|welcome') {
 	test_fail
 }
 
-&Filter-Id := 'aa bb cc dd ee'
+Filter-Id := 'aa bb cc dd ee'
 
 # Expect an array of returned values
-&Callback-Id := %perl_xlat('xlatscalar2array', %{Filter-Id})
+Callback-Id := %perl_xlat('xlatscalar2array', %{Filter-Id})
 
 if (Callback-Id[#] != 5) {
 	test_fail
@@ -52,10 +52,10 @@ if !((Callback-Id[0] == 'aa') && (Callback-Id[1] == 'bb') && (Callback-Id[2] ==
 	test_fail
 }
 
-&test_string := 'ff gg hh ii'
+test_string := 'ff gg hh ii'
 
 # Expect an array of array ref returned values
-&Callback-Id := %perl_xlat('xlatscalar2arrayref', %{Filter-Id}, %{test_string})
+Callback-Id := %perl_xlat('xlatscalar2arrayref', %{Filter-Id}, %{test_string})
 
 if (Callback-Id[#] != 9) {
 	test_fail
@@ -64,21 +64,21 @@ if !((Callback-Id[0] == 'aa') && (Callback-Id[1] == 'bb') && (Callback-Id[2] ==
 	test_fail
 }
 
-&Filter-Id := 'a'
-&request += {
+Filter-Id := 'a'
+request += {
 	Filter-Id = 'b'
 	Filter-Id = 'c'
 }
 
 # Returns a hash with each element in the provided array converted to Vn->value
-&Callback-Id := %perl_xlat('xlatarray2hash', %{Filter-Id[*]})
+Callback-Id := %perl_xlat('xlatarray2hash', %{Filter-Id[*]})
 
 if (Callback-Id[#] != 6) {
 	test_fail
 }
 
 # Note: hashes don't have a defined sequence so these are all the possible return values - mashed to single strings for simplicity's sake
-&result_string := "%{Callback-Id[*]}"
+result_string := "%{Callback-Id[*]}"
 if (result_string != "V1aV2bV3c") && (result_string != "V1aV3cV2b") && (result_string != "V2bV1aV3c") && (result_string != "V2bV3cV1a") && (result_string != "V3cV1aV2b") && (result_string != "V3cV2bV1a") {
 	test_fail
 }
diff --git a/src/tests/modules/redis/cluster_key.unlang b/src/tests/modules/redis/cluster_key.unlang
index f2089f1261be4..4d29d4a0629e7 100644
--- a/src/tests/modules/redis/cluster_key.unlang
+++ b/src/tests/modules/redis/cluster_key.unlang
@@ -14,9 +14,9 @@ $INCLUDE cluster_reset.inc
 #  - 127.0.0.1:30005 - slave
 #  - 127.0.0.1:30003 - master [10923-16383]
 #  - 127.0.0.1:30006 - slave
-&testdata1 := "1-%randstr('aaaaaaaa')"
-&testdata2 := "2-%randstr('aaaaaaaa')"
-&testdata3 := "3-%randstr('aaaaaaaa')"
+testdata1 := "1-%randstr('aaaaaaaa')"
+testdata2 := "2-%randstr('aaaaaaaa')"
+testdata3 := "3-%randstr('aaaaaaaa')"
 
 #  Hashes to Redis cluster node master 1 (1)
 if (%redis(SET, b, %{testdata1}) == 'OK') {
diff --git a/src/tests/modules/redis/cluster_node_fail.unlang b/src/tests/modules/redis/cluster_node_fail.unlang
index f7f8bcb682981..27cccb8b47e95 100644
--- a/src/tests/modules/redis/cluster_node_fail.unlang
+++ b/src/tests/modules/redis/cluster_node_fail.unlang
@@ -16,10 +16,10 @@ if (!(%redis(SET, b, 'boom') == 'OK')) {
 %delay(0.5)
 
 #  Note the current master
-&redismaster := %redis.node(b, 0)
+redismaster := %redis.node(b, 0)
 
 #  Note the current replica
-&redisreplica := %redis.node(b, 1)
+redisreplica := %redis.node(b, 1)
 
 #  Cause one of the redis cluster nodes to SEGV
 if (%redis(@%redis.node(b, 0), DEBUG, SEGFAULT)) {
diff --git a/src/tests/modules/redis/cluster_reset.inc b/src/tests/modules/redis/cluster_reset.inc
index dfe4408a78614..cafc8d2b5695a 100644
--- a/src/tests/modules/redis/cluster_reset.inc
+++ b/src/tests/modules/redis/cluster_reset.inc
@@ -9,11 +9,11 @@ string data3
 string cmdresult
 
 # Some values we need for startup
-&control.Filter-Id := { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21 }
+control.Filter-Id := { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21 }
 
-&data1 := "1-%randstr('aaaaaaaa')"
-&data2 := "2-%randstr('aaaaaaaa')"
-&data3 := "3-%randstr('aaaaaaaa')"
+data1 := "1-%randstr('aaaaaaaa')"
+data2 := "2-%randstr('aaaaaaaa')"
+data3 := "3-%randstr('aaaaaaaa')"
 
 if ("$ENV{REDIS_CLUSTER_CONTROL}" == '') {
 	clusterctrl := 'scripts/ci/redis-setup.sh'
@@ -30,7 +30,7 @@ if ("$ENV{REDIS_CLUSTER_CONTROL}" == '') {
 
 # Sometimes redis just fails to start - without it we can't run
 # the tests - so just exit early.
-&cmdresult = %exec(%{clusterctrl}, create)
+cmdresult = %exec(%{clusterctrl}, create)
 if (cmdresult == '') {
 	test_pass
 	handled
@@ -39,7 +39,7 @@ if (cmdresult == '') {
 #
 #  Determine when initial synchronisation has been completed
 #
-&redisserver := $ENV{REDIS_TEST_SERVER}
+redisserver := $ENV{REDIS_TEST_SERVER}
 
 if (!redisserver || (redisserver == '')) {
 	redisserver := "$ENV{REDIS_IPPOOL_TEST_SERVER}"
diff --git a/src/tests/modules/redis_ippool/alloc.unlang b/src/tests/modules/redis_ippool/alloc.unlang
index 0f87440f9e456..e8460ede25b21 100644
--- a/src/tests/modules/redis_ippool/alloc.unlang
+++ b/src/tests/modules/redis_ippool/alloc.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_alloc'
+control.IP-Pool.Name := 'test_alloc'
 
 #
 #  Add IP addresses
@@ -67,10 +67,10 @@ if !(reply.Session-Timeout == 30) {
 	test_fail
 }
 
-&IP-Pool.Range := reply.IP-Pool.Range
-&Framed-IP-Address := reply.Framed-IP-Address
-&Session-Timeout := reply.Session-Timeout # We should get the same lease time
-&reply := {}
+IP-Pool.Range := reply.IP-Pool.Range
+Framed-IP-Address := reply.Framed-IP-Address
+Session-Timeout := reply.Session-Timeout # We should get the same lease time
+reply := {}
 
 #
 #  Add IP addresses
@@ -109,12 +109,12 @@ if ((Session-Timeout - reply.Session-Timeout) > 5) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 #
 #  Now change the Calling-Station-ID and check we get a different lease
 #
-&Calling-Station-ID := 'another_mac'
+Calling-Station-ID := 'another_mac'
 
 redis_ippool
 if (!updated) {
@@ -128,6 +128,6 @@ if !(reply.Framed-IP-Address == 192.168.1.1) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/pool_tool_delete.unlang b/src/tests/modules/redis_ippool/pool_tool_delete.unlang
index caa358d63c9ef..9caeab8937d7a 100644
--- a/src/tests/modules/redis_ippool/pool_tool_delete.unlang
+++ b/src/tests/modules/redis_ippool/pool_tool_delete.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_delete'
+control.IP-Pool.Name := 'test_delete'
 
 #
 #  Add IP addresses
@@ -48,6 +48,6 @@ if !(%redis(ZCOUNT, {%{control.IP-Pool.Name}%}:pool, -inf, +inf) == 0) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/pool_tool_modify.unlang b/src/tests/modules/redis_ippool/pool_tool_modify.unlang
index 8df47d93b1a2b..f03e81c57dbfb 100644
--- a/src/tests/modules/redis_ippool/pool_tool_modify.unlang
+++ b/src/tests/modules/redis_ippool/pool_tool_modify.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_tool_modify'
+control.IP-Pool.Name := 'test_tool_modify'
 
 #
 #  Add IP addresses
diff --git a/src/tests/modules/redis_ippool/pool_tool_release.unlang b/src/tests/modules/redis_ippool/pool_tool_release.unlang
index 5e5d6aa09f9b8..4304f7ed7de4f 100644
--- a/src/tests/modules/redis_ippool/pool_tool_release.unlang
+++ b/src/tests/modules/redis_ippool/pool_tool_release.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_tool_release'
+control.IP-Pool.Name := 'test_tool_release'
 
 #
 #  Add IP addresses
@@ -56,6 +56,6 @@ if !(%redis(ZSCORE, {%{control.IP-Pool.Name}}:pool, %{reply.Framed-IP-Address})
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/pool_tool_static.unlang b/src/tests/modules/redis_ippool/pool_tool_static.unlang
index 54f1f70b7c177..8f5cf4d43b666 100644
--- a/src/tests/modules/redis_ippool/pool_tool_static.unlang
+++ b/src/tests/modules/redis_ippool/pool_tool_static.unlang
@@ -4,7 +4,7 @@
 uint64 zscore
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_tool_static'
+control.IP-Pool.Name := 'test_tool_static'
 
 #
 #  Add a dynamic IP addresses
@@ -33,7 +33,7 @@ if !(reply.Framed-IP-Address == 192.168.0.10) {
 #
 #  Fetch the ZSCORE now on the address
 #
-&zscore := %redis(ZSCORE, {%{control.IP-Pool.Name}}:pool, %{reply.Framed-IP-Address})
+zscore := %redis(ZSCORE, {%{control.IP-Pool.Name}}:pool, %{reply.Framed-IP-Address})
 
 #
 #  Attempt to re-assign static lease
@@ -69,8 +69,8 @@ if !(%redis(GET, {%{control.IP-Pool.Name}}:device:aa:bb:cc:dd:ee:ff) == '192.168
 
 #
 #  Change device to grab the dynamic address
-&Calling-Station-ID := '11:22:33:44:55:66'
-&reply -= Framed-IP-Address[*]
+Calling-Station-ID := '11:22:33:44:55:66'
+reply -= Framed-IP-Address[*]
 
 redis_ippool {
 	invalid = 1
@@ -98,7 +98,7 @@ if !(%redis(GET, {%{control.IP-Pool.Name}}:device:11:22:33:44:55:66) == '192.168
 	test_fail
 }
 
-&zscore := %redis(ZSCORE, {%{control.IP-Pool.Name}}:pool, 192.168.0.1)
+zscore := %redis(ZSCORE, {%{control.IP-Pool.Name}}:pool, 192.168.0.1)
 if !(zscore < (uint64)0x10000000000000) {
 	test_fail
 }
@@ -122,6 +122,6 @@ if (%redis(TTL, {%{control.IP-Pool.Name}}:device:%{Calling-Station-Id}) != '-1')
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/release.unlang b/src/tests/modules/redis_ippool/release.unlang
index b738f7ce84260..b7868f5bff5ac 100644
--- a/src/tests/modules/redis_ippool/release.unlang
+++ b/src/tests/modules/redis_ippool/release.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_release'
+control.IP-Pool.Name := 'test_release'
 
 #
 #  Add IP addresses
@@ -27,7 +27,7 @@ if (!(reply.Framed-IP-Address == 192.168.0.1)) {
 #
 #  Release the IP address
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 redis_ippool.release {
 	invalid = 1
@@ -70,7 +70,7 @@ if ((%c - %redis(ZSCORE, {%{control.IP-Pool.Name}}:pool, %{reply.Framed-IP-Addre
 #
 #  Release the IP address again (should still be fine)
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 redis_ippool.release {
 	invalid = 1
@@ -81,4 +81,4 @@ if (updated) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
diff --git a/src/tests/modules/redis_ippool/static.unlang b/src/tests/modules/redis_ippool/static.unlang
index ab5c9ca7df963..1afd7aba2d7c1 100644
--- a/src/tests/modules/redis_ippool/static.unlang
+++ b/src/tests/modules/redis_ippool/static.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_static'
+control.IP-Pool.Name := 'test_static'
 
 #
 #  Add a dynamic IP addresses
@@ -40,7 +40,7 @@ if (!(reply.Session-Timeout == 30)) {
 #
 #  Check that renewal does not mess with static IP
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 redis_ippool.renew {
 	invalid = 1
@@ -89,6 +89,6 @@ if (%redis(ZSCORE, {%{control.IP-Pool.Name}%}:pool, %{reply.Framed-IP-Address})
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/static_dynamic.unlang b/src/tests/modules/redis_ippool/static_dynamic.unlang
index 9040d40a1b6ff..0d975f6a5f78d 100644
--- a/src/tests/modules/redis_ippool/static_dynamic.unlang
+++ b/src/tests/modules/redis_ippool/static_dynamic.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_static_dynamic'
+control.IP-Pool.Name := 'test_static_dynamic'
 
 #
 #  Add a static IP assigned to a calling station not in the request
@@ -39,6 +39,6 @@ if (!(reply.Framed-IP-Address == 192.168.0.1)) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/static_unassign.unlang b/src/tests/modules/redis_ippool/static_unassign.unlang
index e3ddf69fa4f73..04ed8047f5da7 100644
--- a/src/tests/modules/redis_ippool/static_unassign.unlang
+++ b/src/tests/modules/redis_ippool/static_unassign.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_static_unassign'
+control.IP-Pool.Name := 'test_static_unassign'
 
 #
 #  Add a dynamic IP addresses
@@ -61,7 +61,7 @@ if (%redis(TTL, {%{control.IP-Pool.Name}}:device:%{Calling-Station-Id}) < 20) {
 #
 #  Check that renewal still works as we are within the exipiry time
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 redis_ippool.renew {
 	invalid = 1
@@ -98,9 +98,9 @@ if (%redis(ZSCORE, {%{control.IP-Pool.Name}%}:pool, %{reply.Framed-IP-Address})
 #  Perform IP allocation for alternative device
 #  Should be allocated the previously static address as that is the only one in the pool
 #
-&reply -= Framed-IP-Address[*]
-&request -= Framed-IP-Address[*]
-&Calling-Station-Id := '00:11:22:33:44:55'
+reply -= Framed-IP-Address[*]
+request -= Framed-IP-Address[*]
+Calling-Station-Id := '00:11:22:33:44:55'
 
 redis_ippool.allocate {
 	invalid = 1
@@ -121,6 +121,6 @@ if !(%redis(HGET, {%{control.IP-Pool.Name}}:ip:%{reply.Framed-IP-Address}, devic
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/update.unlang b/src/tests/modules/redis_ippool/update.unlang
index b21ef9cc0cba5..e3c0db4f2d1fc 100644
--- a/src/tests/modules/redis_ippool/update.unlang
+++ b/src/tests/modules/redis_ippool/update.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_update'
+control.IP-Pool.Name := 'test_update'
 
 #
 #  Add IP addresses
@@ -35,8 +35,8 @@ if !(%redis(HGET, {%{control.IP-Pool.Name}}:ip:%{reply.Framed-IP-Address}, gatew
 %exec(./build/bin/local/rlm_redis_ippool_tool, -a, 192.168.1.1/32, $ENV{REDIS_IPPOOL_TEST_SERVER}:30001, %{control.IP-Pool.Name}, 192.168.1.0)
 
 # 6. Verify that the lease time is extended
-&Framed-IP-Address := reply.Framed-IP-Address
-&NAS-IP-Address := 127.0.0.2
+Framed-IP-Address := reply.Framed-IP-Address
+NAS-IP-Address := 127.0.0.2
 
 redis_ippool.renew
 if (!updated) {
@@ -79,7 +79,7 @@ if !(reply.IP-Pool.Range && (reply.IP-Pool.Range == '192.168.0.0')) {
 }
 
 # Change the ip address to one that doesn't exist in the pool and check we *can't* update it
-&Framed-IP-Address := 192.168.3.1
+Framed-IP-Address := 192.168.3.1
 
 redis_ippool.renew {
 	invalid = 1
@@ -88,10 +88,10 @@ redis_ippool.renew {
 if (!notfound) {
 	test_fail
 }
-&Framed-IP-Address := 192.168.0.1
+Framed-IP-Address := 192.168.0.1
 
 # 15. Now change the calling station ID and check that we *can't* update the lease
-&Calling-Station-ID := 'naughty'
+Calling-Station-ID := 'naughty'
 
 redis_ippool.renew {
 	invalid = 1
@@ -105,6 +105,6 @@ if !(reply.Framed-IP-Address == %redis(GET, {%{control.IP-Pool.Name}}:device:00:
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/redis_ippool/update_alloc.unlang b/src/tests/modules/redis_ippool/update_alloc.unlang
index ae4a734700f28..85164c0815f34 100644
--- a/src/tests/modules/redis_ippool/update_alloc.unlang
+++ b/src/tests/modules/redis_ippool/update_alloc.unlang
@@ -3,7 +3,7 @@
 #
 $INCLUDE cluster_reset.inc
 
-&control.IP-Pool.Name := 'test_update_alloc'
+control.IP-Pool.Name := 'test_update_alloc'
 
 #
 #  Add IP addresses
@@ -19,8 +19,8 @@ if (!updated) {
 #
 #  Attempt to reserve an IP address by performing a renew
 #
-&Framed-IP-Address := 192.168.0.1
-&NAS-IP-Address := 127.0.0.1
+Framed-IP-Address := 192.168.0.1
+NAS-IP-Address := 127.0.0.1
 
 redis_ippool.renew
 
@@ -39,6 +39,6 @@ if !(reply.Framed-IP-Address == 192.168.0.1) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/rest/rest_module.unlang b/src/tests/modules/rest/rest_module.unlang
index 831ce0e19d79b..52c937c8ef016 100644
--- a/src/tests/modules/rest/rest_module.unlang
+++ b/src/tests/modules/rest/rest_module.unlang
@@ -1,5 +1,5 @@
 # Pre-set Login-LAT-Node to check correct operator behaviour
-&control.Login-LAT-Node := "foo"
+control.Login-LAT-Node := "foo"
 
 # Test "authorize" rest call.  Uses http to a GET end point
 rest
@@ -32,12 +32,12 @@ if (!(control.Login-LAT-Node[0] == "Bob") || !(control.Login-LAT-Node[1] == "foo
 }
 
 # Reset control attributes
-&control -= Filter-Id[*]
-&control -= Callback-Id[*]
-&control -= User-Name[*]
+control -= Filter-Id[*]
+control -= Callback-Id[*]
+control -= User-Name[*]
 
 # Pre-fill NAS-IP-Address to check operator behaviour
-&control.NAS-IP-Address := "10.0.0.10"
+control.NAS-IP-Address := "10.0.0.10"
 test_pass
 handled
 # Test "accounting" rest call.  Uses https to a POST end point
diff --git a/src/tests/modules/rest/rest_timeout.unlang b/src/tests/modules/rest/rest_timeout.unlang
index e5fd37e83c990..6c1d66bc78581 100644
--- a/src/tests/modules/rest/rest_timeout.unlang
+++ b/src/tests/modules/rest/rest_timeout.unlang
@@ -1,5 +1,5 @@
 # Pre-set Login-LAT-Node to check correct operator behaviour
-&control.Login-LAT-Node := "foo"
+control.Login-LAT-Node := "foo"
 
 # Test "authorize" rest call.  Uses http to a GET end point
 
diff --git a/src/tests/modules/rest/rest_xlat.unlang b/src/tests/modules/rest/rest_xlat.unlang
index 57f6e721511d5..e96b7689c5182 100644
--- a/src/tests/modules/rest/rest_xlat.unlang
+++ b/src/tests/modules/rest/rest_xlat.unlang
@@ -7,13 +7,13 @@ uint32 server_ssl_port
 string test_string
 string result_string
 
-&server_host := "$ENV{REST_TEST_SERVER}"
-&server_port := "$ENV{REST_TEST_SERVER_PORT}"
-&server_ssl_port := "$ENV{REST_TEST_SERVER_SSL_PORT}"
-&test_string := 'notfound'
+server_host := "$ENV{REST_TEST_SERVER}"
+server_port := "$ENV{REST_TEST_SERVER_PORT}"
+server_ssl_port := "$ENV{REST_TEST_SERVER_SSL_PORT}"
+test_string := 'notfound'
 
 # Retrieve a plain text file
-&result_string := %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/test.txt")
+result_string := %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/test.txt")
 
 if (!(REST-HTTP-Status-Code == 200)) {
 	test_fail
@@ -24,28 +24,28 @@ if (!(result_string == "Sample text response\n")) {
 }
 
 # Take host from incoming packet
-&result_string := %rest('GET', "http://%{Login-IP-Host}:%uri.safe(%{server_port})/test.txt")
+result_string := %rest('GET', "http://%{Login-IP-Host}:%uri.safe(%{server_port})/test.txt")
 
 if (!(REST-HTTP-Status-Code == 200) || !(result_string == "Sample text response\n")) {
 	test_fail
 }
 
 # Port is not allowed from incoming packets
-&result_string := %rest('GET', "http://%{server_host}:%{NAS-Port}/test.txt")
+result_string := %rest('GET', "http://%{server_host}:%{NAS-Port}/test.txt")
 
 if (!(Module-Failure-Message == "Failed escaping URI: Unsafe input \"8080\" not allowed in URI part port") || result_string) {
 	test_fail
 }
 
 # Check a "not found" gives a 404 status code
-&result_string := %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/%{test_string}")
+result_string := %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/%{test_string}")
 
 if (!(REST-HTTP-Status-Code == 404)) {
 	test_fail
 }
 
 # GET with URL parameters
-&test_string := %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/user/%{User-Name}/mac/%{Called-Station-Id}")
+test_string := %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/user/%{User-Name}/mac/%{Called-Station-Id}")
 
 if (!(REST-HTTP-Status-Code == 200)) {
 	test_fail
@@ -64,7 +64,7 @@ if (!(control.User-Name == "Bob")) {
 	test_fail
 }
 
-&control.User-Name := 'dummy'
+control.User-Name := 'dummy'
 
 # Directly use json map and prepend the returned value
 map json %rest('GET', "http://%{server_host}:%uri.safe(%{server_port})/user/%{User-Name}/mac/%{Called-Station-Id}") {
@@ -75,10 +75,10 @@ if (!(control.User-Name[0] == 'Bob') || !(control.User-Name[1] == 'dummy')) {
 	test_fail
 }
 
-&test_string := %json.encode('request.NAS-IP-Address')
+test_string := %json.encode('request.NAS-IP-Address')
 
 # POST to https with JSON body data
-&result_string := %rest('POST', "https://%{server_host}:%uri.safe(%{server_ssl_port})/user/%{User-Name}/mac/%{Called-Station-Id}?section=accounting", %{test_string})
+result_string := %rest('POST', "https://%{server_host}:%uri.safe(%{server_ssl_port})/user/%{User-Name}/mac/%{Called-Station-Id}?section=accounting", %{test_string})
 
 if (!(REST-HTTP-Status-Code == 200)) {
 	test_fail
@@ -102,10 +102,10 @@ if (!(control.NAS-IP-Address == "192.168.1.1")) {
 	test_fail
 }
 
-&result_string := "NAS=%{NAS-IP-Address}&user=%{User-Name}"
+result_string := "NAS=%{NAS-IP-Address}&user=%{User-Name}"
 
 # POST to https with POST body data
-&result_string := %rest('POST', "https://%{server_host}:%uri.safe(%{server_ssl_port})/post/test?section=dummy", %{result_string})
+result_string := %rest('POST', "https://%{server_host}:%uri.safe(%{server_ssl_port})/post/test?section=dummy", %{result_string})
 
 if (!(REST-HTTP-Status-Code == 200)) {
 	test_fail
@@ -202,7 +202,7 @@ group {
 }
 
 # Test against endpoint which will time out
-&result_string := %restshorttimeout('GET', "http://%{server_host}:%uri.safe(%{server_port})/delay")
+result_string := %restshorttimeout('GET', "http://%{server_host}:%uri.safe(%{server_port})/delay")
 
 if (REST-HTTP-Status-Code) {
 	test_fail
diff --git a/src/tests/modules/smtp/smtp_attachment/tls_attachment.unlang b/src/tests/modules/smtp/smtp_attachment/tls_attachment.unlang
index 896d4d184814d..379e0deb31d57 100644
--- a/src/tests/modules/smtp/smtp_attachment/tls_attachment.unlang
+++ b/src/tests/modules/smtp/smtp_attachment/tls_attachment.unlang
@@ -1,4 +1,4 @@
-&request += {
+request += {
 	SMTP-Mail-Header = "x-test-Subject: smtp test"
 	SMTP-Mail-Body = "sent from the smtp test module\r\n"
 
diff --git a/src/tests/modules/smtp/smtp_authenticate/tls_authenticate.unlang b/src/tests/modules/smtp/smtp_authenticate/tls_authenticate.unlang
index e0a3b2ccde848..64979dad8a373 100644
--- a/src/tests/modules/smtp/smtp_authenticate/tls_authenticate.unlang
+++ b/src/tests/modules/smtp/smtp_authenticate/tls_authenticate.unlang
@@ -1,4 +1,4 @@
-&request += {
+request += {
 	SMTP-Mail-Header = "Subject: smtp test"
 	SMTP-Mail-Header = "FROM: smtp_sender@gmail.com"
 	SMTP-Mail-Header = "TO: smtp_receiver@localhost"
@@ -27,7 +27,7 @@ if !(ok) {
 #
 #  Check the wrong password results in a reject
 #
-&User-Password := 'Wrong'
+User-Password := 'Wrong'
 
 smtp.authenticate {
 	reject = 1
@@ -46,8 +46,8 @@ if !(reject) {
 #
 #  Check an invalid user results in a reject
 #
-&User-Name := 'Invalid'
-&User-Password := 'Saget'
+User-Name := 'Invalid'
+User-Password := 'Saget'
 
 smtp.authenticate {
 	reject = 1
@@ -62,7 +62,7 @@ if !(reject) {
 	test_fail
 }
 
-&request -= User-Password[*]
+request -= User-Password[*]
 
 #
 #  Check that missing password is an invalid request
@@ -76,8 +76,8 @@ if !(invalid) {
 	test_fail
 }
 
-&User-Password := 'Saget'
-&request -= User-Name[*]
+User-Password := 'Saget'
+request -= User-Name[*]
 
 #
 #  Check that missing user name is an invalid request
diff --git a/src/tests/modules/smtp/smtp_crln/tls_crln.unlang b/src/tests/modules/smtp/smtp_crln/tls_crln.unlang
index 340cdca6325ef..664afd17d7725 100644
--- a/src/tests/modules/smtp/smtp_crln/tls_crln.unlang
+++ b/src/tests/modules/smtp/smtp_crln/tls_crln.unlang
@@ -1,4 +1,4 @@
-&request += {
+request += {
 	SMTP-Mail-Body = "sent from the smtp test module\r\n"
 	SMTP-Mail-Body = "\r\n"
 	SMTP-Mail-Body = "Some Body\r\n"
diff --git a/src/tests/modules/smtp/smtp_stringparse/tls_stringparse.unlang b/src/tests/modules/smtp/smtp_stringparse/tls_stringparse.unlang
index b22236d6f2961..bae40faf4f944 100644
--- a/src/tests/modules/smtp/smtp_stringparse/tls_stringparse.unlang
+++ b/src/tests/modules/smtp/smtp_stringparse/tls_stringparse.unlang
@@ -1,4 +1,4 @@
-&request += {
+request += {
 	SMTP-Mail-Body = "sent from the smtp test module\r\n"
 	SMTP-Recipients = "stringparse_test_receiver@localhost"
 	SMTP-Sender-Address = "smtp_sender@localhost"
diff --git a/src/tests/modules/smtp/tls_delivery.unlang b/src/tests/modules/smtp/tls_delivery.unlang
index e91ad64248069..d440b57db4ad9 100644
--- a/src/tests/modules/smtp/tls_delivery.unlang
+++ b/src/tests/modules/smtp/tls_delivery.unlang
@@ -1,4 +1,4 @@
-&request += {
+request += {
 	SMTP-Mail-Header = "x-test-Subject: smtp test"
 	SMTP-Mail-Body = "sent from the smtp test module\r\n"
 
@@ -45,12 +45,12 @@ echo $?"` == "1") {
 #
 if (!(`/bin/bash -c "for i in {0..50} ; \
 do if [ -e build/ci/exim4/mail/smtp_cc_request_1 ] \
-&& [ -e build/ci/exim4/mail/smtp_cc_request_2 ] \
-&& [ -e build/ci/exim4/mail/smtp_to_request_1 ] \
-&& [ -e build/ci/exim4/mail/smtp_to_request_2 ] \
-&& [ -e build/ci/exim4/mail/smtp_recipient_request ] \
-&& [ -e build/ci/exim4/mail/conf_recipient_1 ] \
-&& [ -e build/ci/exim4/mail/conf_recipient_2 ] ;\
+& [ -e build/ci/exim4/mail/smtp_cc_request_2 ] \
+& [ -e build/ci/exim4/mail/smtp_to_request_1 ] \
+& [ -e build/ci/exim4/mail/smtp_to_request_2 ] \
+& [ -e build/ci/exim4/mail/smtp_recipient_request ] \
+& [ -e build/ci/exim4/mail/conf_recipient_1 ] \
+& [ -e build/ci/exim4/mail/conf_recipient_2 ] ;\
 then \
 echo 'found' ;\
 break; \
@@ -70,7 +70,7 @@ grep -f build/ci/exim4/testfile"`){
 	test_fail
 }
 
-&request := {
+request := {
 	SMTP-Mail-Header = "x-test-Subject: 2nd smtp test"
 	SMTP-Mail-Body = "sent from the smtp test module\r\n"
 
diff --git a/src/tests/modules/sql/acct_start_conflict.unlang b/src/tests/modules/sql/acct_start_conflict.unlang
index a324b18ac5227..892f6bffd8ff1 100644
--- a/src/tests/modules/sql/acct_start_conflict.unlang
+++ b/src/tests/modules/sql/acct_start_conflict.unlang
@@ -32,7 +32,7 @@ if (%sql("SELECT acctsessiontime FROM radacct WHERE AcctSessionId = '00000003'")
 #
 #  Change acctsessiontime and verify it's updated
 #
-&Connect-Info = 'updated'
+Connect-Info = 'updated'
 
 sql.accounting.start
 if !(ok) {
diff --git a/src/tests/modules/sql/groups.unlang b/src/tests/modules/sql/groups.unlang
index aa76e21d3dc5c..8c4f313cc8d0b 100644
--- a/src/tests/modules/sql/groups.unlang
+++ b/src/tests/modules/sql/groups.unlang
@@ -84,7 +84,7 @@ if (%sql.group('groups_group_d')) {
 #
 #  Test paircmp group comparisons with dynamic expansions
 #
-&groupname := 'groups_group_b'
+groupname := 'groups_group_b'
 
 if !(%sql.group(%{groupname})) {
 	test_fail
diff --git a/src/tests/modules/sql/map.unlang b/src/tests/modules/sql/map.unlang
index 6ae342c792c58..62f0e5f8d2287 100644
--- a/src/tests/modules/sql/map.unlang
+++ b/src/tests/modules/sql/map.unlang
@@ -54,9 +54,9 @@ if !(control.NAS-Port == 0) {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
 # Insert our second test row
 %sql("INSERT INTO radusergroup (username, groupname, priority) VALUES ('oof', 'rab', 1)")
@@ -85,9 +85,9 @@ if !(control.NAS-Port == 1) {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
 # Retrieve our test row(s) - With = we should get the values from the first row
 map sql 'SELECT * FROM radusergroup WHERE priority <= 1 ORDER BY priority' {
@@ -113,9 +113,9 @@ if !(control.NAS-Port == 0) {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
 # Retrieve our test row(s) - With ^= we should get the values from the second row then the first
 map sql 'SELECT * FROM radusergroup WHERE priority <= 1 ORDER BY priority' {
@@ -143,9 +143,9 @@ if ((control.NAS-Port[0] != 1) || (control.NAS-Port[1] != 0)) {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
 # Retrieve our test row(s) - With += we should get the values from both rows
 map sql 'SELECT * FROM radusergroup WHERE priority <= 1 ORDER BY priority' {
@@ -188,9 +188,9 @@ else {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
 # Retrieve the username column only (should result in noop because not in map)
 map sql 'SELECT username FROM radusergroup WHERE priority = 0' {
@@ -225,12 +225,12 @@ if !(control.NAS-Port == 0) {
 	test_fail
 }
 
-&sqlcmd := %sql.safe("SELECT * FROM radusergroup WHERE priority <= 1 AND username = '%sql.escape(%{User-Name})'")
+sqlcmd := %sql.safe("SELECT * FROM radusergroup WHERE priority <= 1 AND username = '%sql.escape(%{User-Name})'")
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
 # Retrieve test row with specific username (using ref'd query)
 map sql sqlcmd {
@@ -256,12 +256,12 @@ if !(control.NAS-Port == 0) {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
-&control -= NAS-Port[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
+control -= NAS-Port[*]
 
-&userfield := 'username'
-&groupfield := 'name'
+userfield := 'username'
+groupfield := 'name'
 
 # Retrieve our test row(s) - Using different RHS types
 map sql 'SELECT * FROM radusergroup WHERE priority = 0' {
@@ -296,8 +296,8 @@ if (!notfound) {
 }
 
 # Clear the control list
-&control -= User-Name[*]
-&control -= Filter-Id[*]
+control -= User-Name[*]
+control -= Filter-Id[*]
 
 # Check behaviour of NULL vs empty string returns.
 # radacct is used here as the default schema allows NULL in many columns
diff --git a/src/tests/modules/sqlcounter/test.unlang b/src/tests/modules/sqlcounter/test.unlang
index 09274439ec0ca..ba4994ec5c3cf 100644
--- a/src/tests/modules/sqlcounter/test.unlang
+++ b/src/tests/modules/sqlcounter/test.unlang
@@ -22,7 +22,7 @@ if (!noop) {
 #
 #  Now set a limit and re-call the module
 #
-&control.Max-Daily-Session := 100
+control.Max-Daily-Session := 100
 
 dailycounter
 if (!updated) {
@@ -43,12 +43,12 @@ if !(reply.Session-Timeout == 100) {
 #
 #  Calculate the start date/time to compare with attribute set by the module
 #
-&date_str = %date('now')
-&now = %date(%{date_str})
+date_str = %date('now')
+now = %date(%{date_str})
 if (date_str =~ /([0-9]{4}-[0-9]{2}-[0-9]{2}T)[0-9]{2}:[0-9]{2}:[0-9]{2}Z/) {
 	date_str := "%{1}" + '00:00:00Z'
 }
-&start = %date(%{date_str})
+start = %date(%{date_str})
 
 if !(control.dailycounter-Reset-Start == start) {
 	test_fail
@@ -104,7 +104,7 @@ if !(reply.Session-Timeout == 40) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 #
 #  Insert a second fake accounting record, which when summed with the existing will exceed the limit.
@@ -129,10 +129,10 @@ if !(control.Daily-Session-Time == 109) {
 #  Find how much time is left before the next reset and set the limit
 #  so the user has enough remaining to get into the next period
 #
-&remaining = control.dailycounter-Reset-End - now
-&control.Max-Daily-Session := remaining + 110
+remaining = control.dailycounter-Reset-End - now
+control.Max-Daily-Session := remaining + 110
 
-&reply := {}
+reply := {}
 
 dailycounter
 
@@ -140,7 +140,7 @@ if !(reply.Session-Timeout == (control.Max-Daily-Session - 109)) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 #
 #  Now use module instance with auto_extend = yes
@@ -153,6 +153,6 @@ if !((reply.Session-Timeout > (remaining + control.Max-Daily-Session - 2)) && (r
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/sqlippool/alloc.unlang b/src/tests/modules/sqlippool/alloc.unlang
index ac7e3bbafbcfc..1f26f41039c7d 100644
--- a/src/tests/modules/sqlippool/alloc.unlang
+++ b/src/tests/modules/sqlippool/alloc.unlang
@@ -2,7 +2,7 @@
 #  Allocate an address from an SQL IP Pool
 #
 uint32 expiry
-&control.IP-Pool.Name := 'test_alloc'
+control.IP-Pool.Name := 'test_alloc'
 
 #
 #  Add IP addresses
@@ -25,7 +25,7 @@ if !(reply.Framed-IP-Address == 192.168.0.1) {
 #
 #  Check Expiry
 #
-&expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
+expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
 if ((expiry - %l) < 20) {
 	test_fail
 }
@@ -46,8 +46,8 @@ if !(%sql("SELECT gateway FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Na
 	test_fail
 }
 
-&Framed-IP-Address := reply.Framed-IP-Address
-&reply := {}
+Framed-IP-Address := reply.Framed-IP-Address
+reply := {}
 
 #
 #  Add IP addresses
@@ -69,12 +69,12 @@ if !(Framed-IP-Address == reply.Framed-IP-Address) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 #
 #  Now change the Calling-Station-ID and check we get a different lease
 #
-&Calling-Station-ID := 'another_mac'
+Calling-Station-ID := 'another_mac'
 
 sqlippool.allocate
 if (!updated) {
@@ -88,6 +88,6 @@ if !(reply.Framed-IP-Address == 192.168.1.1) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/sqlippool/alloc_fail.unlang b/src/tests/modules/sqlippool/alloc_fail.unlang
index 0fffcc7bdc798..e1a2822c70c56 100644
--- a/src/tests/modules/sqlippool/alloc_fail.unlang
+++ b/src/tests/modules/sqlippool/alloc_fail.unlang
@@ -2,7 +2,7 @@
 #  Allocate an address from an SQL IP Pool
 #
 uint32 expiry
-&control.IP-Pool.Name := 'test_alloc_fail'
+control.IP-Pool.Name := 'test_alloc_fail'
 
 #
 #  Ensure no matching records
@@ -38,12 +38,12 @@ if !(reply.Framed-IP-Address == 192.168.0.1) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 #
 #  Now change the Calling-Station-ID and check we don't get an address (pool full)
 #
-&Calling-Station-ID := 'another_mac'
+Calling-Station-ID := 'another_mac'
 
 sqlippool.allocate
 if (!notfound) {
diff --git a/src/tests/modules/sqlippool/alloc_requested.unlang b/src/tests/modules/sqlippool/alloc_requested.unlang
index 304849d7ec184..e5fa6ab289d97 100644
--- a/src/tests/modules/sqlippool/alloc_requested.unlang
+++ b/src/tests/modules/sqlippool/alloc_requested.unlang
@@ -2,7 +2,7 @@
 #  Allocate an address from an SQL IP Pool
 #
 uint32 expiry
-&control.IP-Pool.Name := 'test_alloc_requested'
+control.IP-Pool.Name := 'test_alloc_requested'
 
 #
 #  Add IP addresses
@@ -28,7 +28,7 @@ if !(reply.Framed-IP-Address == 192.168.0.2) {
 #
 #  Check Expiry
 #
-&expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
+expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
 if ((expiry - %l) < 20) {
 	test_fail
 }
@@ -49,13 +49,13 @@ if !(%sql("SELECT gateway FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Na
 	test_fail
 }
 
-&reply := {}
-&request -= Framed-IP-Address
+reply := {}
+request -= Framed-IP-Address
 
 #
 #  Now change the Calling-Station-ID and check we get a different lease
 #
-&Calling-Station-ID := 'another_mac'
+Calling-Station-ID := 'another_mac'
 
 sqlippool.allocate
 if (!updated) {
@@ -69,6 +69,6 @@ if !(reply.Framed-IP-Address == 192.168.0.3) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/sqlippool/release.unlang b/src/tests/modules/sqlippool/release.unlang
index 120982f3018fb..5886b25b8c9b1 100644
--- a/src/tests/modules/sqlippool/release.unlang
+++ b/src/tests/modules/sqlippool/release.unlang
@@ -2,7 +2,7 @@
 #  Test releasing IP addresses in the sqlippool module
 #
 uint32 expiry
-&control.IP-Pool.Name := 'test_release'
+control.IP-Pool.Name := 'test_release'
 
 #
 #  Add IP addresses
@@ -25,7 +25,7 @@ if !(reply.Framed-IP-Address == 192.168.0.1) {
 #
 #  Release the IP address
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 sqlippool.release
 if !(updated) {
@@ -42,7 +42,7 @@ if (%sql("SELECT address FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Nam
 
 # Check the expiry - releasing an address sets the exipry to now
 # Allow for some time passing between packet processing and "now"
-&expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
+expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
 if (expiry > (%l + 5)) {
 	test_fail
 }
@@ -55,7 +55,7 @@ if ((%l - expiry) > 5) {
 #  Release the IP address again
 #  Will return notfound as address is already released.
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 sqlippool.release
 
@@ -63,6 +63,6 @@ if (!notfound) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/sqlippool/static.unlang b/src/tests/modules/sqlippool/static.unlang
index bb94119273491..3076c31d29de1 100644
--- a/src/tests/modules/sqlippool/static.unlang
+++ b/src/tests/modules/sqlippool/static.unlang
@@ -1,7 +1,7 @@
 #
 #  Test static IP allocation using sqlippool
 #
-&control.IP-Pool.Name := 'test_static'
+control.IP-Pool.Name := 'test_static'
 
 #
 #  Add a dynamic IP addresses
@@ -31,7 +31,7 @@ if !(reply.Framed-IP-Address == 192.168.0.10) {
 #
 #  Check that renewal does not mess with static IP
 #
-&Framed-IP-Address := reply.Framed-IP-Address
+Framed-IP-Address := reply.Framed-IP-Address
 
 sqlippool.renew
 if !(updated) {
@@ -59,6 +59,6 @@ if (%sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/sqlippool/update.unlang b/src/tests/modules/sqlippool/update.unlang
index 445ad4f5d255a..1e19dc3f2ac0b 100644
--- a/src/tests/modules/sqlippool/update.unlang
+++ b/src/tests/modules/sqlippool/update.unlang
@@ -2,7 +2,7 @@
 #  Test updates on sqlippool allocated addresses.
 #
 uint32 expiry
-&control.IP-Pool.Name := 'test_update'
+control.IP-Pool.Name := 'test_update'
 
 #
 #  Add IP addresses
@@ -22,7 +22,7 @@ if !(reply.Framed-IP-Address == 192.168.0.1) {
 }
 
 # 3. Verify expiry time is based on offer duration
-&expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
+expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
 if ((expiry - %l) < 20) {
 	test_fail
 }
@@ -42,8 +42,8 @@ if !(%sql("SELECT gateway FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Na
 %sql("INSERT INTO fr_ippool (pool_name, address, expiry_time) values ('%{control.IP-Pool.Name}', '192.168.1.1', datetime('now', '-00:10'))")
 
 # 7. Verify that the lease time is extended
-&Framed-IP-Address := reply.Framed-IP-Address
-&NAS-IP-Address := 127.0.0.2
+Framed-IP-Address := reply.Framed-IP-Address
+NAS-IP-Address := 127.0.0.2
 
 sqlippool.renew
 if (!updated) {
@@ -51,7 +51,7 @@ if (!updated) {
 }
 
 # 8. Check expiry reflects that
-&expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
+expiry := %sql("SELECT strftime('%%s', expiry_time) FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Name}' AND address = '%{reply.Framed-IP-Address}'")
 if ((expiry - %l) < 50) {
 	test_fail
 }
@@ -67,7 +67,7 @@ if !(%sql("SELECT gateway FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Na
 }
 
 # Change the ip address to one that doesn't exist in the pool and check we *can't* update it
-&Framed-IP-Address := 192.168.3.1
+Framed-IP-Address := 192.168.3.1
 
 sqlippool.renew
 # 11.
@@ -81,12 +81,12 @@ if (%sql("SELECT address FROM fr_ippool WHERE pool_name = '%{control.IP-Pool.Nam
 }
 
 # re-issue the original allocation
-&reply := {}
-&Framed-IP-Address := 192.168.0.1
+reply := {}
+Framed-IP-Address := 192.168.0.1
 sqlippool.allocate
 
 # 13. Now change the calling station ID and check that we *can't* update the lease
-&Calling-Station-ID := 'naughty'
+Calling-Station-ID := 'naughty'
 
 sqlippool.renew
 if (!notfound) {
@@ -98,6 +98,6 @@ if !(reply.Framed-IP-Address == %sql("SELECT address FROM fr_ippool WHERE pool_n
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/sqlippool/update_alloc.unlang b/src/tests/modules/sqlippool/update_alloc.unlang
index e747d912f89eb..1953ea0225a63 100644
--- a/src/tests/modules/sqlippool/update_alloc.unlang
+++ b/src/tests/modules/sqlippool/update_alloc.unlang
@@ -1,7 +1,7 @@
 #
 #  Allocate an address from an SQL IP Pool and update
 #
-&control.IP-Pool.Name := 'test_update_alloc'
+control.IP-Pool.Name := 'test_update_alloc'
 
 #
 #  Add IP addresses
@@ -18,8 +18,8 @@ if (!updated) {
 #
 #  Attempt to update an IP address by performing a renew
 #
-&Framed-IP-Address := 192.168.0.1
-&NAS-IP-Address := 127.0.0.1
+Framed-IP-Address := 192.168.0.1
+NAS-IP-Address := 127.0.0.1
 
 sqlippool.renew
 
@@ -33,6 +33,6 @@ if !(reply.Framed-IP-Address == 192.168.0.1) {
 	test_fail
 }
 
-&reply := {}
+reply := {}
 
 test_pass
diff --git a/src/tests/modules/test/dollar_expansions.unlang b/src/tests/modules/test/dollar_expansions.unlang
index e1311f4d01263..d4d522dd3fa87 100644
--- a/src/tests/modules/test/dollar_expansions.unlang
+++ b/src/tests/modules/test/dollar_expansions.unlang
@@ -1,4 +1,4 @@
-&Fall-Through := yes
+Fall-Through := yes
 
 # Should be compiled out
 if ('${a_term}' != '${a_term}') {
diff --git a/src/tests/modules/totp/auth.unlang b/src/tests/modules/totp/auth.unlang
index 115a7a68978a8..aa0df8e4e424e 100644
--- a/src/tests/modules/totp/auth.unlang
+++ b/src/tests/modules/totp/auth.unlang
@@ -1,6 +1,6 @@
 string otp
 
-&control.TOTP.Secret := 'ONSWG4TFOQYTEMZUGU3DOOBZ'
+control.TOTP.Secret := 'ONSWG4TFOQYTEMZUGU3DOOBZ'
 
 #
 #  With no OTP from the user, the module does nothing
@@ -15,7 +15,7 @@ if (!noop) {
 #
 #  Use oathtool to calculate OTP
 #
-&TOTP.From-User := %exec('/usr/bin/oathtool', '--base32', '--totp', 'ONSWG4TFOQYTEMZUGU3DOOBZ')
+TOTP.From-User := %exec('/usr/bin/oathtool', '--base32', '--totp', 'ONSWG4TFOQYTEMZUGU3DOOBZ')
 
 totp.authenticate
 
@@ -26,7 +26,7 @@ if (!ok) {
 #
 #  Now set an incorrect OTP and check for reject
 #
-&TOTP.From-User := 'ABCDEF'
+TOTP.From-User := 'ABCDEF'
 
 totp.authenticate {
 	reject = 1
@@ -39,7 +39,7 @@ if !(reject) {
 #
 #  And an invalid length OTP
 #
-&TOTP.From-User := '12345'
+TOTP.From-User := '12345'
 
 totp.authenticate {
 	fail = 1
diff --git a/src/tests/modules/unbound/dns.unlang b/src/tests/modules/unbound/dns.unlang
index e34e5cc1248ee..076b59b731418 100644
--- a/src/tests/modules/unbound/dns.unlang
+++ b/src/tests/modules/unbound/dns.unlang
@@ -2,32 +2,32 @@ ipaddr result_ipaddr
 string result_string
 
 #  Use builtin "local" zone
-&result_ipaddr := %dns('localhost', 'A')
+result_ipaddr := %dns('localhost', 'A')
 
 if (result_ipaddr != 127.0.0.1) {
 	test_fail
 }
 
-&result_string := %dns('localhost', 'AAAA')
+result_string := %dns('localhost', 'AAAA')
 
 if (result_string != '::1') {
 	test_fail
 }
 
-&result_string := %dns('1.0.0.127.in-addr.arpa', 'PTR')
+result_string := %dns('1.0.0.127.in-addr.arpa', 'PTR')
 
 if (result_string != 'localhost') {
 	test_fail
 }
 
 #  Use local data in module config to allow for dotted names
-&result_ipaddr := %dns('www.example.com', 'A')
+result_ipaddr := %dns('www.example.com', 'A')
 
 if (result_ipaddr != 192.168.1.1) {
 	test_fail
 }
 
-&result_string := %dns('1.1.168.192.in-addr.arpa', 'PTR')
+result_string := %dns('1.1.168.192.in-addr.arpa', 'PTR')
 
 if (result_string != 'www.example.com') {
 	test_fail
@@ -42,14 +42,14 @@ if (result_string != 'www.example.com') {
 #}
 
 # Invalid query
-&result_string := %dns('www.example.com', 'ABC')
+result_string := %dns('www.example.com', 'ABC')
 
 if (Module-Failure-Message != "Invalid / unsupported DNS query type") {
 	test_fail
 }
 
-&result_string := ''
-&result_string := %dns(%{result_string}, 'A')
+result_string := ''
+result_string := %dns(%{result_string}, 'A')
 
 if (Module-Failure-Message != "Can't resolve zero length host") {
 	test_fail
@@ -57,7 +57,7 @@ if (Module-Failure-Message != "Can't resolve zero length host") {
 
 # Will return multiple records, though not in a defined sequence.
 # Each returned record is a pair of priority and host values.
-&Filter-Id := %dns(example.com, 'MX')
+Filter-Id := %dns(example.com, 'MX')
 
 if !(((Filter-Id[0] == '10') && (Filter-Id[1] == 'mail.example.com') && (Filter-Id[2] == '20') && (Filter-Id[3] == 'mail2.example.com')) || ((Filter-Id[2] == '10') && (Filter-Id[3] == 'mail.example.com') && (Filter-Id[0] == '20') && (Filter-Id[1] == 'mail2.example.com'))) {
 	test_fail
@@ -65,13 +65,13 @@ if !(((Filter-Id[0] == '10') && (Filter-Id[1] == 'mail.example.com') && (Filter-
 
 # Just return a single record
 # As results are not in a specified order, it could be either.
-&Filter-Id := %dns(example.com,MX,1)
+Filter-Id := %dns(example.com,MX,1)
 
 if !(((Filter-Id[0] == '10') && (Filter-Id[1] == 'mail.example.com')) || ((Filter-Id[0] == '20') && (Filter-Id[1] == 'mail2.example.com'))) {
 	test_fail
 }
 
-&result_string := %dns('n0nex1stent.d0ma1n', 'A')
+result_string := %dns('n0nex1stent.d0ma1n', 'A')
 
 # Running this on macOS produces a timeout due to the nonexistent TLD
 if ((Module-Failure-Message != "dns - Nonexistent domain name") && (Module-Failure-Message != "Timeout waiting for DNS resolution")) {
diff --git a/src/tests/modules/yubikey/yubikey_auth.unlang b/src/tests/modules/yubikey/yubikey_auth.unlang
index 8197568f3921d..8f84cee167f70 100644
--- a/src/tests/modules/yubikey/yubikey_auth.unlang
+++ b/src/tests/modules/yubikey/yubikey_auth.unlang
@@ -11,8 +11,8 @@ if !(Vendor-Specific.Yubico.Yubikey-Public-Id == 'ddddgciilcjk') {
 	test_fail
 }
 
-&control.Vendor-Specific.Yubico.Yubikey-Counter := 1
-&control.Vendor-Specific.Yubico.Yubikey-Key := 0xb8c56af07ff79b2230e04ab8891784ce
+control.Vendor-Specific.Yubico.Yubikey-Counter := 1
+control.Vendor-Specific.Yubico.Yubikey-Key := 0xb8c56af07ff79b2230e04ab8891784ce
 
 # Call module in authenticate mode to decrypt OTP
 yubikey.authenticate
@@ -33,7 +33,7 @@ if !(Vendor-Specific.Yubico.Yubikey-Random) {
 
 
 # Increase the known "counter" value to detect a replay attack
-&control.Vendor-Specific.Yubico.Yubikey-Counter := Vendor-Specific.Yubico.Yubikey-Counter
+control.Vendor-Specific.Yubico.Yubikey-Counter := Vendor-Specific.Yubico.Yubikey-Counter
 
 yubikey.authenticate {
 	reject = 1
diff --git a/src/tests/modules/yubikey/yubikey_xlat.unlang b/src/tests/modules/yubikey/yubikey_xlat.unlang
index 6080a0f4f4468..ffd82e8224f15 100644
--- a/src/tests/modules/yubikey/yubikey_xlat.unlang
+++ b/src/tests/modules/yubikey/yubikey_xlat.unlang
@@ -1,17 +1,17 @@
 string test_string
 string result_string
 
-&test_string := 'vvrbuctetdhc'
-&result_string := %modhextohex(%{test_string})
+test_string := 'vvrbuctetdhc'
+result_string := %modhextohex(%{test_string})
 
 if (result_string != 'ffc1e0d3d260') {
 	test_fail
 }
 
 #  Invalid modhex string - not even length
-&test_string := 'vvrbuctetdh'
+test_string := 'vvrbuctetdh'
 
-&result_string := %modhextohex(%{test_string})
+result_string := %modhextohex(%{test_string})
 
 if (ok) {
 	test_fail
@@ -26,9 +26,9 @@ if (Module-Failure-Message != "Modhex string invalid") {
 }
 
 #  Invalid modhex string - invalid characters
-&test_string := 'vxrbmctetdhc'
+test_string := 'vxrbmctetdhc'
 
-&result_string := %modhextohex(%{test_string})
+result_string := %modhextohex(%{test_string})
 
 if (ok) {
 	test_fail