check for compatible dictionaries

when doing cross-server calls

diff --git a/src/lib/unlang/call.c b/src/lib/unlang/call.c
index da52dca78d70cdfaff25628de78121ea01f1da05..441e6019db48ec40bb7bb8654477e628281e605e 100644 (file)
--- a/src/lib/unlang/call.c
+++ b/src/lib/unlang/call.c
@@ -81,9 +81,6 @@ static unlang_action_t unlang_call(REQUEST *request,
        RDEBUG("server %s {", cf_section_name2(g->server_cs));
 
        /*
-        *      @todo - we can't change protocols (e.g. RADIUS ->
-        *      DHCP) unless we're in a subrequest.
-        *
         *      @todo - we can't change packet types
         *      (e.g. Access-Request -> Accounting-Request) unless
         *      we're in a subrequest.

diff --git a/src/lib/unlang/compile.c b/src/lib/unlang/compile.c
index e378c4f1703a1ca67972ad999b61f81d9fa93c05..ce8d4a00a43d09a651846d45ecaf7319457db014 100644 (file)
--- a/src/lib/unlang/compile.c
+++ b/src/lib/unlang/compile.c
@@ -2780,6 +2780,7 @@ static unlang_t *compile_call(unlang_t *parent, unlang_compile_t *unlang_ctx, CO
        char                    *packet;
        CONF_SECTION            *server_cs;
        fr_io_process_t         *process_p;
+       fr_dict_t const         *dict;
 
        vp_tmpl_rules_t         parse_rules;
 
@@ -2867,6 +2868,18 @@ static unlang_t *compile_call(unlang_t *parent, unlang_compile_t *unlang_ctx, CO
        *packet = '.';
        packet++;
 
+       /*
+        *      The dictionaries are not compatible, forbid it.
+        */
+       dict = virtual_server_namespace(server);
+       if (dict && (dict != fr_dict_internal) && fr_dict_internal &&
+           unlang_ctx->rules->dict_def && (unlang_ctx->rules->dict_def != dict)) {
+               cf_log_err(cs, "Cannot call namespace '%s' from namespaces '%s'",
+                          fr_dict_root(dict)->name, fr_dict_root(unlang_ctx->rules->dict_def)->name);
+               talloc_free(g);
+               return NULL;
+       }
+
        /*
         *      Verify it exists, but don't bother caching it.  We can
         *      figure it out at run-time.