From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 7 Sep 2023 17:19:29 +0000 (-0400)
Subject: VSAs can only contain internal attributes and VENDORs
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2d09de45fff6863bf155bbc8fba830a45b51849d;p=thirdparty%2Ffreeradius-server.git

VSAs can only contain internal attributes and VENDORs
---

diff --git a/src/lib/util/dict_validate.c b/src/lib/util/dict_validate.c
index 4ff8ff0f926..dadce34b418 100644
--- a/src/lib/util/dict_validate.c
+++ b/src/lib/util/dict_validate.c
@@ -555,8 +555,15 @@ bool dict_attr_flags_valid(fr_dict_t *dict, fr_dict_attr_t const *parent,
 		}
 		break;
 
-	case FR_TYPE_TLV:
 	case FR_TYPE_VSA:
+		if ((type != FR_TYPE_VENDOR) && !flags->internal) {
+			fr_strerror_printf("Attributes of type '%s' cannot be children of the 'vendor' type",
+					   fr_type_to_str(type));
+			return false;
+		}
+		break;
+
+	case FR_TYPE_TLV:
 	case FR_TYPE_VENDOR:
 		break;