From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 23 Apr 2019 17:31:49 +0000 (-0400)
Subject: check for compatible dictionaries
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c8cba4fe49ac12bc4fbf155738d3fca948d09f69;p=thirdparty%2Ffreeradius-server.git

check for compatible dictionaries

when doing cross-server calls
---

diff --git a/src/lib/unlang/call.c b/src/lib/unlang/call.c
index da52dca78d7..441e6019db4 100644
--- a/src/lib/unlang/call.c
+++ b/src/lib/unlang/call.c
@@ -81,9 +81,6 @@ static unlang_action_t unlang_call(REQUEST *request,
 	RDEBUG("server %s {", cf_section_name2(g->server_cs));
 
 	/*
-	 *	@todo - we can't change protocols (e.g. RADIUS ->
-	 *	DHCP) unless we're in a subrequest.
-	 *
 	 *	@todo - we can't change packet types
 	 *	(e.g. Access-Request -> Accounting-Request) unless
 	 *	we're in a subrequest.
diff --git a/src/lib/unlang/compile.c b/src/lib/unlang/compile.c
index e378c4f1703..ce8d4a00a43 100644
--- a/src/lib/unlang/compile.c
+++ b/src/lib/unlang/compile.c
@@ -2780,6 +2780,7 @@ static unlang_t *compile_call(unlang_t *parent, unlang_compile_t *unlang_ctx, CO
 	char			*packet;
 	CONF_SECTION		*server_cs;
 	fr_io_process_t		*process_p;
+	fr_dict_t const		*dict;
 
 	vp_tmpl_rules_t		parse_rules;
 
@@ -2867,6 +2868,18 @@ static unlang_t *compile_call(unlang_t *parent, unlang_compile_t *unlang_ctx, CO
 	*packet = '.';
 	packet++;
 
+	/*
+	 *	The dictionaries are not compatible, forbid it.
+	 */
+	dict = virtual_server_namespace(server);
+	if (dict && (dict != fr_dict_internal) && fr_dict_internal &&
+	    unlang_ctx->rules->dict_def && (unlang_ctx->rules->dict_def != dict)) {
+		cf_log_err(cs, "Cannot call namespace '%s' from namespaces '%s'",
+			   fr_dict_root(dict)->name, fr_dict_root(unlang_ctx->rules->dict_def)->name);
+		talloc_free(g);
+		return NULL;
+	}
+
 	/*
 	 *	Verify it exists, but don't bother caching it.  We can
 	 *	figure it out at run-time.