From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 8 May 2020 12:39:20 +0000 (-0400)
Subject: add tests for actually sending invalid attributes
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=47bd8a68f829ee759b4585c87ec1ab1d2a2ccfd4;p=thirdparty%2Ffreeradius-server.git

add tests for actually sending invalid attributes

If an attribute is unknown, it's type MUST be octets.  AND we can
encode it.  In fact, we generally MUST encode it, as the admin
is trying to work around stupid vendor issues.

<cough> SUPERMICRO </cough>
---

diff --git a/src/lib/server/tmpl.c b/src/lib/server/tmpl.c
index 0c185dff4d0..366fd2ca5cc 100644
--- a/src/lib/server/tmpl.c
+++ b/src/lib/server/tmpl.c
@@ -783,10 +783,10 @@ ssize_t tmpl_afrom_attr_substr(TALLOC_CTX *ctx, attr_ref_error_t *err,
 			}
 
 			/*
-			 *	Unknown attributes can't be encoded, as we don't
-			 *	know how to encode them!
+			 *	Unknown attributes can be encoded, BUT
+			 *	they must be of type "octets".
 			 */
-			tmpl_unknown(vpt)->flags.internal = 1;
+			fr_assert(tmpl_unknown(vpt)->type == FR_TYPE_OCTETS);
 			tmpl_da_set(vpt, tmpl_unknown(vpt));
 
 			p += slen;
diff --git a/src/tests/radclient/auth_4.out b/src/tests/radclient/auth_4.out
new file mode 100644
index 00000000000..4a6c2e56378
--- /dev/null
+++ b/src/tests/radclient/auth_4.out
@@ -0,0 +1,9 @@
+Sent Access-Request Id 123 from 0.0.0.0:1234 to 127.0.0.1:12340 length 51 
+	Cleartext-Password = "hello"
+	User-Name = "bob"
+	User-Password = "hello"
+	NAS-Identifier = "auth_4"
+Received Access-Accept Id 123 from 127.0.0.1:12340 to 0.0.0.0:1234 via lo length 47 
+	Class = 0x483d342c493d34
+	Attr-26 = 0x483d342c493d34
+	Attr-26 = 0x483d342c493d43
diff --git a/src/tests/radclient/auth_4.txt b/src/tests/radclient/auth_4.txt
new file mode 100644
index 00000000000..856fa7cfe8b
--- /dev/null
+++ b/src/tests/radclient/auth_4.txt
@@ -0,0 +1,6 @@
+#
+#	ARGV: -i 123 -c 1 -x -F
+#
+User-Name = "bob",
+User-Password = "hello"
+NAS-Identifier = "auth_4"
diff --git a/src/tests/radclient/config/radiusd.conf b/src/tests/radclient/config/radiusd.conf
index f531b55e86c..ed975246fb2 100644
--- a/src/tests/radclient/config/radiusd.conf
+++ b/src/tests/radclient/config/radiusd.conf
@@ -108,11 +108,26 @@ server test {
 	}
 
 	recv Access-Request {
+		#
+		#  Ensure that we can send unknown attributes back.
+		#
+		if (&NAS-Identifier == "auth_4") {
+			update reply {
+				&Class := 0x483d342c493d34
+			}
+
+			update reply {
+				&Attr-26 := &reply:Class
+				&Attr-26 += 0x483d342c493d43
+			}
+		}
+
 		if (&User-Name == "bob") {
 			accept
 		} else {
 			reject
 		}
+
 	}
 
 	send Access-Accept {