From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 17 Sep 2020 13:30:29 +0000 (-0400)
Subject: allow existence checks for list, group, etc.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0bce2f224e12f5e930395cba0301ac9e8428943b;p=thirdparty%2Ffreeradius-server.git

allow existence checks for list, group, etc.

We cannot compare a list / group / TLV to anything.  But we can
certainly check if a list / group / TLV exists.
---

diff --git a/src/lib/server/cond_tokenize.c b/src/lib/server/cond_tokenize.c
index 90f46437617..2bb7c9fdd84 100644
--- a/src/lib/server/cond_tokenize.c
+++ b/src/lib/server/cond_tokenize.c
@@ -1127,6 +1127,30 @@ static int cond_normalise(TALLOC_CTX *ctx, fr_token_t lhs_type, fr_cond_t **c_ou
 	return 0;
 }
 
+static int cond_forbid_groups(tmpl_t *vpt, fr_sbuff_t *in, fr_sbuff_marker_t *m_lhs)
+{
+	if (tmpl_is_list(vpt)) {
+		fr_strerror_printf("Cannot use list references in condition");
+		fr_sbuff_set(in, m_lhs);
+		return -1;
+	}
+
+	if (!tmpl_is_attr(vpt)) return 0;
+
+	switch (tmpl_da(vpt)->type) {
+	case FR_TYPE_VALUE:
+		break;
+
+	default:
+		fr_strerror_printf("Nesting types such as groups or TLVs cannot "
+				   "be used in condition comparisons");
+		fr_sbuff_set(in, m_lhs);
+		return -1;
+	}
+
+	return 0;
+}
+
 static ssize_t cond_tokenize_operand(TALLOC_CTX *ctx, tmpl_t **out,
 				     fr_sbuff_marker_t *opd_start, fr_sbuff_t *in,
 				     tmpl_rules_t const *rules)
@@ -1259,23 +1283,10 @@ static ssize_t cond_tokenize_operand(TALLOC_CTX *ctx, tmpl_t **out,
 	/*
 	 *	Sanity check for nested types
 	 */
-	if (tmpl_is_attr(vpt)) {
-		switch (tmpl_da(vpt)->type) {
-		case FR_TYPE_VALUE:
-			break;
-
-		default:
-			fr_strerror_printf("Nesting types such as groups or TLVs may not "
-					   "be compared in conditions");
-			fr_sbuff_set(&our_in, &m);
-			goto error;
-		}
-
-		if (tmpl_attr_unknown_add(vpt) < 0) {
-			fr_strerror_printf("Failed defining attribute");
-			fr_sbuff_set(&our_in, &m);
-			goto error;
-		}
+	if (tmpl_is_attr(vpt) && (tmpl_attr_unknown_add(vpt) < 0)) {
+		fr_strerror_printf("Failed defining attribute %s", tmpl_da(vpt)->name);
+		fr_sbuff_set(&our_in, &m);
+		goto error;
 	}
 
 	if (tmpl_cast_set(vpt, cast) < 0) {
@@ -1492,6 +1503,12 @@ static ssize_t cond_tokenize(TALLOC_CTX *ctx, fr_cond_t **out,
 		goto closing_brace;
 	}
 
+	/*
+	 *	We now have LHS OP RHS.  So the LHS can't be a group,
+	 *	list, or nested thing.
+	 */
+	if (cond_forbid_groups(lhs, &our_in, &m_lhs) < 0) goto error;
+
 	/*
 	 *	Check for any other operator
 	 */
@@ -1551,6 +1568,11 @@ static ssize_t cond_tokenize(TALLOC_CTX *ctx, fr_cond_t **out,
 		}
 		if (tmpl_is_attr_unresolved(rhs)) c->pass2_fixup = PASS2_FIXUP_ATTR;
 
+		/*
+		 *	Groups can't be on the RHS of a comparison, either
+		 */
+		if (cond_forbid_groups(rhs, &our_in, &m_rhs) < 0) goto error;
+
 		*map = (vp_map_t) {
 			.ci = cf_section_to_item(cs),
 			.lhs = lhs,
@@ -1564,21 +1586,6 @@ static ssize_t cond_tokenize(TALLOC_CTX *ctx, fr_cond_t **out,
 			goto error;
 		}
 
-		/*
-		 *	Binary expressions can't contain lists
-		 */
-		if (tmpl_is_list(lhs)) {
-			fr_strerror_printf("Cannot use list references in condition");
-			fr_sbuff_set(&our_in, &m_lhs);
-			goto error;
-		}
-
-		if (tmpl_is_list(rhs)) {
-			fr_strerror_printf("Cannot use list references in condition");
-			fr_sbuff_set(&our_in, &m_rhs);
-			goto error;
-		}
-
 		if (((op == T_OP_REG_EQ) || (op == T_OP_REG_NE)) &&
 		    (!tmpl_contains_regex(lhs) && !tmpl_contains_regex(rhs))) {
 			fr_strerror_printf("Expected regular expression");