From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 21 Aug 2023 00:48:00 +0000 (-0400)
Subject: allow operations on list which has some immutable values
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=758dc44eb90699d683c65198ce6b676e8722c17a;p=thirdparty%2Ffreeradius-server.git

allow operations on list which has some immutable values
---

diff --git a/src/lib/unlang/edit.c b/src/lib/unlang/edit.c
index d833c347d00..c3f6a357112 100644
--- a/src/lib/unlang/edit.c
+++ b/src/lib/unlang/edit.c
@@ -357,7 +357,7 @@ static int apply_edits_to_list(request_t *request, unlang_frame_state_edit_t *st
 		 */
 		RDEBUG2("%s %s %s", current->lhs.vpt->name, fr_tokens[T_OP_SUB_EQ], current->rhs.vpt->name);
 
-		while (vp) {
+		for ( ; vp != NULL; vp = next) {
 			fr_pair_list_t *list;
 
 			next = fr_dcursor_next(&cursor);
@@ -365,12 +365,12 @@ static int apply_edits_to_list(request_t *request, unlang_frame_state_edit_t *st
 			list = fr_pair_parent_list(vp);
 			fr_assert(list != NULL);
 
+			if (fr_pair_immutable(vp)) continue;
+
 			if (fr_edit_list_pair_delete(current->el, list, vp) < 0) {
 				tmpl_dcursor_clear(&cc);
 				return -1;
 			}
-
-			vp = next;
 		}
 
 		tmpl_dcursor_clear(&cc);
@@ -1336,7 +1336,13 @@ static int check_lhs(request_t *request, unlang_frame_state_edit_t *state, edit_
 		// &control := ...
 	}
 
-	if (fr_pair_immutable(vp)) {
+	/*
+	 *	We forbid operations on immutable leaf attributes.
+	 *
+	 *	If a list contains an immutable attribute, then we can still operate on the list, but instead
+	 *	we look at each VP we're operating on.
+	 */
+	if (fr_type_is_leaf(vp->vp_type) && vp->vp_immutable) {
 		RWDEBUG("Cannot modify immutable value for %s", current->lhs.vpt->name);
 		return -1;
 	}
diff --git a/src/tests/keywords/immutable b/src/tests/keywords/immutable
index bd21f1071a7..c926c04e14e 100644
--- a/src/tests/keywords/immutable
+++ b/src/tests/keywords/immutable
@@ -52,4 +52,26 @@ if !(&Tmp-Integer-0 == 1814) {
 	test_fail
 }
 
+#
+#  Add a non-immutable NAS-Port
+#
+&request += {
+	&NAS-Port = 6809
+}
+
+debug_request
+
+if !(&NAS-Port[1] == 6809) {
+	test_fail
+}
+
+&request -= &NAS-Port[*]
+if !(&NAS-Port == 1813) {
+	test_fail
+}
+
+if (&NAS-Port[#] != 1) {
+	test_fail
+}
+
 success