dynamic clients must contain at least an IP and shared secret

diff --git a/src/modules/proto_radius/proto_radius_dynamic_client.c b/src/modules/proto_radius/proto_radius_dynamic_client.c
index c7aa9ab953165552c1a725eb3d20a5954b809e6f..bb6211a6f197597fe2f0a69a098631beeb427911 100644 (file)
--- a/src/modules/proto_radius/proto_radius_dynamic_client.c
+++ b/src/modules/proto_radius/proto_radius_dynamic_client.c
@@ -137,9 +137,27 @@ static fr_io_final_t mod_process(REQUEST *request, fr_io_action_t action)
                }
 
                if (request->reply->code == FR_CODE_ACCESS_ACCEPT) {
+                       VALUE_PAIR *vp;
+
+                       vp = fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IP_ADDRESS, TAG_ANY);
+                       if (!vp) fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IPV6_ADDRESS, TAG_ANY);
+                       if (!vp) fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IP_PREFIX, TAG_ANY);
+                       if (!vp) fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IPV6_PREFIX, TAG_ANY);
+                       if (!vp) {
+                               ERROR("The 'control' list MUST contain a FreeRADIUS-Client.. IP address attribute");
+                               request->reply->code = FR_CODE_ACCESS_REJECT;
+                               goto rerun_nak;
+                       }
+
+                       vp = fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_SECRET, TAG_ANY);
+                       if (!vp) {
+                               ERROR("The 'control' list MUST contain a FreeRADIUS-Client-Secret attribute");
+                               request->reply->code = FR_CODE_ACCESS_REJECT;
+                               goto rerun_nak;
+                       }
+
                        /*
-                        *      @todo - check for existence of all necessary VPs.
-                        *      If some don't exist, complain, and run "deny client"
+                        *      Else we're flexible.
                         */
                }