VSAs can only contain internal attributes and VENDORs

diff --git a/src/lib/util/dict_validate.c b/src/lib/util/dict_validate.c
index 4ff8ff0f9261913f52f04516dc3a4827d3203c1d..dadce34b4189be718be7c0d26af69d6c7f1dcf51 100644 (file)
--- a/src/lib/util/dict_validate.c
+++ b/src/lib/util/dict_validate.c
@@ -555,8 +555,15 @@ bool dict_attr_flags_valid(fr_dict_t *dict, fr_dict_attr_t const *parent,
                }
                break;
 
-       case FR_TYPE_TLV:
        case FR_TYPE_VSA:
+               if ((type != FR_TYPE_VENDOR) && !flags->internal) {
+                       fr_strerror_printf("Attributes of type '%s' cannot be children of the 'vendor' type",
+                                          fr_type_to_str(type));
+                       return false;
+               }
+               break;
+
+       case FR_TYPE_TLV:
        case FR_TYPE_VENDOR:
                break;