From: Alan T. DeKok Date: Tue, 23 Feb 2021 16:53:23 +0000 (-0500) Subject: cross-check name / number for attributes X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=27f150f0aebccdc9f858029ea5c32488d7126637;p=thirdparty%2Ffreeradius-server.git cross-check name / number for attributes we previously looked up (and checked) duplicate attributes by name. We now check if attributes of the same number are compatible. If not, error out. As a result, a number of dictionaries have to be updated in order to have compatible types. Mostly by commenting out one of the incompatible types. --- diff --git a/share/dictionary/dhcpv4/dictionary.rfc2131 b/share/dictionary/dhcpv4/dictionary.rfc2131 index cb9dcb654f5..415c48853f6 100644 --- a/share/dictionary/dhcpv4/dictionary.rfc2131 +++ b/share/dictionary/dhcpv4/dictionary.rfc2131 @@ -243,7 +243,7 @@ ATTRIBUTE V-I-Vendor-Class 124 octets # Vendor-Specific ATTRIBUTE V-I-Vendor-Specific 125 vsa -ATTRIBUTE Etherboot 128 ether +#ATTRIBUTE Etherboot 128 ether # (for IP Phone software load) # RFC 4578 - Options for the Intel Preboot eXecution Environment diff --git a/share/dictionary/eap/aka-sim/dictionary.3gpp-ts24.302 b/share/dictionary/eap/aka-sim/dictionary.3gpp-ts24.302 index 0bacfc001c3..285ed4cebcc 100644 --- a/share/dictionary/eap/aka-sim/dictionary.3gpp-ts24.302 +++ b/share/dictionary/eap/aka-sim/dictionary.3gpp-ts24.302 @@ -9,7 +9,7 @@ # # Skippable-Attributes # -ATTRIBUTE IPMS-Ind 137 octets +#ATTRIBUTE IPMS-Ind 137 octets ATTRIBUTE IPMS-Res 138 octets ATTRIBUTE Tust-Ind 139 octets ATTRIBUTE Short-Name-For-Network 140 octets diff --git a/share/dictionary/radius/dictionary b/share/dictionary/radius/dictionary index 1dbc3c96ac1..719aabbaf04 100644 --- a/share/dictionary/radius/dictionary +++ b/share/dictionary/radius/dictionary @@ -237,7 +237,11 @@ $INCLUDE dictionary.microsoft $INCLUDE dictionary.mikrotik $INCLUDE dictionary.mimosa $INCLUDE dictionary.motorola -$INCLUDE dictionary.motorola.wimax +# +# The WiMAX dictionary uses the sanme vendor space +# as the main motorola dictionary. +# +#$INCLUDE dictionary.motorola.wimax $INCLUDE dictionary.navini $INCLUDE dictionary.net $INCLUDE dictionary.netscreen diff --git a/share/dictionary/radius/dictionary.cisco.vpn5000 b/share/dictionary/radius/dictionary.cisco.vpn5000 index c6c86aa23e7..1e689573bfb 100644 --- a/share/dictionary/radius/dictionary.cisco.vpn5000 +++ b/share/dictionary/radius/dictionary.cisco.vpn5000 @@ -14,7 +14,7 @@ VENDOR Cisco-VPN5000 255 BEGIN-VENDOR Cisco-VPN5000 ATTRIBUTE Tunnel-Throughput 1 integer ATTRIBUTE Client-Assigned-IP 2 string -ATTRIBUTE Client-Real-IP 3 string +ATTRIBUTE Client-Real-IP 3 ipaddr ATTRIBUTE VPN-GroupInfo 4 string ATTRIBUTE VPN-Password 5 string ATTRIBUTE Echo 6 integer diff --git a/share/dictionary/radius/dictionary.compat b/share/dictionary/radius/dictionary.compat index f0aaaa07172..2a254d919d0 100644 --- a/share/dictionary/radius/dictionary.compat +++ b/share/dictionary/radius/dictionary.compat @@ -22,7 +22,7 @@ ATTRIBUTE Old-Password 17 string ATTRIBUTE Port-Message 18 string ATTRIBUTE Dialback-No 19 string ATTRIBUTE Dialback-Name 20 string -ATTRIBUTE Challenge-State 24 string +ATTRIBUTE Challenge-State 24 octets ATTRIBUTE Framed-Compression 13 integer VALUE Framed-Compression Van-Jacobsen-TCP-IP 1 diff --git a/share/dictionary/radius/dictionary.ruckus b/share/dictionary/radius/dictionary.ruckus index 4ebf4aab8b6..ee17f5da12d 100644 --- a/share/dictionary/radius/dictionary.ruckus +++ b/share/dictionary/radius/dictionary.ruckus @@ -21,7 +21,8 @@ ATTRIBUTE Grace-Period 6 integer ATTRIBUTE SCG-CBlade-IP 7 integer ATTRIBUTE SCG-DBlade-IP 8 integer ATTRIBUTE VLAN-ID 9 integer -ATTRIBUTE Sta-Expiration 10 integer # not used by AP anymore. Please check SCG-33602 +# not used by AP anymore. Please check SCG-33602 +#ATTRIBUTE Sta-Expiration 10 integer ATTRIBUTE Sta-UUID 11 string ATTRIBUTE Accept-Enhancement-Reason 12 integer ATTRIBUTE Sta-Inner-Id 13 string diff --git a/share/dictionary/radius/dictionary.sandy b/share/dictionary/radius/dictionary.sandy index cd9fd17a6db..65795a16482 100644 --- a/share/dictionary/radius/dictionary.sandy +++ b/share/dictionary/radius/dictionary.sandy @@ -34,7 +34,7 @@ ATTRIBUTE Mail-Quota 108 integer ATTRIBUTE Mail-Filter 109 octets ATTRIBUTE Mail-Box-Control 110 integer ATTRIBUTE Mail-Client-IP 111 ipaddr -ATTRIBUTE Mail-Client-Helo 110 string +#ATTRIBUTE Mail-Client-Helo 110 string VALUE Mail-Service Transfer 1 VALUE Mail-Service Delivery 2 diff --git a/src/lib/util/dict_util.c b/src/lib/util/dict_util.c index 8470ed2bf42..74dbacdc25f 100644 --- a/src/lib/util/dict_util.c +++ b/src/lib/util/dict_util.c @@ -1153,6 +1153,32 @@ int dict_attr_add_to_namespace(fr_dict_t *dict, fr_dict_attr_t const *parent, fr return 0; } +static int dict_attr_compatible(fr_dict_attr_t const *parent, fr_dict_attr_t const *old, fr_dict_attr_t const *n) +{ + if (old->parent != parent) { + fr_strerror_printf_push("Cannot add duplicate attribute \"%s\" with different parent (old %s, new %s)", + n->name, old->parent->name, parent->name); + return -1; + } + + if (old->attr != n->attr) { + fr_strerror_printf_push("Cannot add duplicate attribute name \"%s\" with different number (old %u, new %d)", + n->name, old->attr, n->attr); + return -1; + } + + if (old->type != n->type) { + fr_strerror_printf_push("Cannot add duplicate attribute with different type (old %s has type %s, new %s has type %s)", + old->name, + fr_table_str_by_value(fr_value_box_type_table, old->type, "?Unknown?"), + n->name, + fr_table_str_by_value(fr_value_box_type_table, n->type, "?Unknown?")); + return -1; + } + + return 0; +} + /** Add an attribute to the dictionary * * @param[in] dict of protocol context we're operating in. @@ -1183,46 +1209,43 @@ int fr_dict_attr_add(fr_dict_t *dict, fr_dict_attr_t const *parent, */ if (!dict_attr_fields_valid(dict, parent, name, &attr, type, &our_flags)) return -1; - /* - * Suppress duplicates. - */ + n = dict_attr_alloc(dict->pool, parent, name, attr, type, &our_flags); + if (!n) return -1; + #define FLAGS_EQUAL(_x) (old->flags._x == flags->_x) old = fr_dict_attr_by_name(NULL, parent, name); if (old) { - if ((old->parent == parent)&& (old->type == type) && + /* + * Don't bother inserting exact duplicates. + */ + if ((old->parent == parent) && (old->type == type) && FLAGS_EQUAL(array) && FLAGS_EQUAL(subtype) && ((old->attr == (unsigned int) attr) || ((attr < 0) && old->flags.internal))) { return 0; } - if (old->parent != parent) { - fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different parent (old %s, new %s)", - name, old->parent->name, parent->name); - return -1; - } - - if (old->attr != (unsigned int) attr) { - fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different number (old %u, new %d)", - name, old->attr, attr); - return -1; - } - - if (old->type != type) { - fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different type (old %s, new %s)", - name, - fr_table_str_by_value(fr_value_box_type_table, old->type, "?Unknown?"), - fr_table_str_by_value(fr_value_box_type_table, type, "?Unknown?")); - return -1; - } + /* + * We have the same name, but different + * properties. That's an error. + */ + if (dict_attr_compatible(parent, old, n) < 0) goto error; - fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different flags", - name); - return -1; + /* + * We have the same name, and same (enough) + * properties. Discard the duplicate. + */ + talloc_free(n); + return 0; } - n = dict_attr_alloc(dict->pool, parent, name, attr, type, &our_flags); - if (!n) return -1; + /* + * Attributes can also be indexed by number. Ensure that + * all attributes of the same number have the same + * properties. + */ + old = fr_dict_attr_child_by_num(parent, n->attr); + if (old && (dict_attr_compatible(parent, old, n) < 0)) goto error; if (dict_attr_add_to_namespace(dict, parent, n) < 0) { error: